AdvFM：面向不可察觉且可迁移对抗样本的前瞻流匹配速度场攻击
AdvFM: Lookahead Flow-Matching Velocity-Field Attacks for Imperceptible and Transferable Adversarial Examples
将对抗扰动注入流匹配的速度场而非像素空间，利用高斯平滑降低梯度方差并提升迁移性，为生成式对抗攻击提供了一种可复用的连续时间动力学视角。
原文依据 we propose AdvFM, a velocity-field attack that injects adversarial signals into the flow-matching dynamics instead of the pixel space.
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论基于生成模型的无限制对抗攻击通常直接在图像空间操作，或通过扩散式的去噪与重加噪进行，这限制了迁移性以及对防御的鲁棒性。我们从流匹配和连续时间速度场的视角重新审视这一问题，提出 AdvFM，一种将对抗信号注入流匹配动力学而非像素空间的速度场攻击。给定噪声状态 x_t，AdvFM 扰动 t=1 处的重建，并将该扰动转化为速度场的变化，从而产生一个在噪声空间中放大内部 PGD 步的状态更新。我们进一步引入前瞻变体，在当前重建和展开重建上优化两点目标，减少沿 ODE 轨迹的时序失配。从理论角度，我们证明与基于扩散的攻击相比，AdvFM 具有以下优势：(i) 通过步长放大在单步内对黑盒损失产生更大提升；(ii) 由于高斯平滑，梯度方差降低且代理-目标对齐更强，从而增强迁移性；(iii) 扰动集中在鲁棒切向方向，从而与对抗训练模型的鲁棒梯度对齐，并更有效地抵御净化；前瞻变体进一步降低了两点鲁棒目标的梯度噪声。大量实验表明，AdvFM 在黑盒迁移性和一系列对抗训练与净化防御上均取得了有前景的性能。
英文原文摘要 1598 字符
Unrestricted adversarial attacks based on generative models typically operate either directly in image space or through diffusion-style denoising and re-noising, which limits transferability and robustness against defenses. We revisit this problem through the lens of flow matching and continuous-time velocity fields, and propose AdvFM, a velocity-field attack that injects adversarial signals into the flow-matching dynamics instead of the pixel space. Given a noisy state x_t, AdvFM perturbs the reconstruction at t = 1 and converts this perturbation into a change of the velocity field, yielding a state update that amplifies the inner PGD step in the noisy space. We further introduce a lookahead variant that optimizes a two-point objective over the current and rolled-out reconstructions, reducing temporal mismatch along the ODE trajectory. From a theoretical perspective, we show that compared to diffusion-based attacks, AdvFM enjoys: (i) larger single-step increases in the black-box loss via step amplification, (ii) reduced gradient variance and stronger surrogate-target alignment due to Gaussian smoothing, enhancing its transferability, and (iii) perturbations that concentrate in robust-tangent directions, thereby aligning with robust gradients of adversarially trained models and surviving purification more effectively; the lookahead variant further lowers gradient noise for a two-point robust objective. Extensive experiments demonstrate that AdvFM achieves promising performance in both black-box transferability and a suite of adversarial training and purification defenses.