Adversarial Flow Models (AFMs)

• Adversarial Flow Models are generative frameworks that combine invertible normalizing flows with adversarial objectives to enforce optimal transport and high sample fidelity.
• They enable robust adversarial attacks by manipulating latent representations to produce naturalistic, manifold-conforming perturbations.
• AFMs extend to continuous-time neural ODE flows and controlled generative tasks, achieving state-of-the-art results in image synthesis, audio generation, and reinforcement learning.

Adversarial Flow Models (AFMs) are a class of generative and adversarial machine learning frameworks that integrate invertible flow-based mappings with adversarial training or optimization objectives. AFMs have been developed for both generation and adversarial attack applications, unifying optimal transport priors, tractable sample likelihoods, and adversarial discriminative feedback. Architectures under the AFM umbrella range from normalizing flows trained jointly with adversarial objectives to continuous-time neural ODE flows with discriminator guidance, extending to sequential decision policies in adversarial game-theoretic settings. AFMs encompass both white-box and black-box attack methods, adversarially trained generative models, and robust sampling strategies for reinforcement learning and structured prediction.

1. Mathematical Foundations and Core Principles

At their foundation, AFMs employ invertible mappings—most commonly normalizing flows—between a base distribution (usually multivariate normal) and the data distribution. Normalizing flows are parameterized as a composition of invertible transformations $f_\theta$, enabling exact likelihood computation via the change-of-variables formula: $$p_X(x) = p_Z\bigl(f_\theta^{-1}(x)\bigr) \cdot \left|\det\left(\frac{\partial f_\theta^{-1}(x)}{\partial x}\right)\right| = p_Z(z)\;\left|\det\frac{\partial f_\theta(z)}{\partial z}\right|^{-1}$$ where $z = f_\theta^{-1}(x)$ and $p_Z$ is the base density (Dolatabadi et al., 2020, Dolatabadi et al., 2020, Lin et al., 27 Nov 2025).

Unlike standard flows which are typically trained via maximum likelihood, AFMs enforce high-level sample realism or targeted property matching through adversarial objectives. In canonical AFMs for generation, the flow generator $g_\theta$ learns an optimal transport map $g_\theta: \mathbb{R}^n \rightarrow \mathbb{R}^n$, targeting minimization of quadratic cost under pushforward constraints: $$g_\theta\#\mathcal{Z} = \mathcal{X} \quad,\quad g_\theta = \arg\min_{G\,:\,G\#\mathcal{Z}=\mathcal{X}} \mathbb{E}_{z\sim\mathcal{Z}}\big[\|G(z)-z\|^2\big]$$ This is coupled with an adversarial loss—e.g., relativistic GAN objectives—and an explicit optimal-transport penalty to ensure uniqueness and correspond with flow-matching theory (Lin et al., 27 Nov 2025).

In attack applications, the invertibility is exploited not for sample generation but for manipulating latent codes to synthesize adversarial examples with naturalistic, manifold-conforming perturbations. Here, the search for an adversarial example is formulated as a constrained optimization in latent space. For an input $x$, one computes $z_0 = f_\theta^{-1}(x)$ and seeks $z^*$ so that $$p_X(x) = p_Z\bigl(f_\theta^{-1}(x)\bigr) \cdot \left|\det\left(\frac{\partial f_\theta^{-1}(x)}{\partial x}\right)\right| = p_Z(z)\;\left|\det\frac{\partial f_\theta(z)}{\partial z}\right|^{-1}$$0 misleads the target classifier, subject to an $$p_X(x) = p_Z\bigl(f_\theta^{-1}(x)\bigr) \cdot \left|\det\left(\frac{\partial f_\theta^{-1}(x)}{\partial x}\right)\right| = p_Z(z)\;\left|\det\frac{\partial f_\theta(z)}{\partial z}\right|^{-1}$$1 or $$p_X(x) = p_Z\bigl(f_\theta^{-1}(x)\bigr) \cdot \left|\det\left(\frac{\partial f_\theta^{-1}(x)}{\partial x}\right)\right| = p_Z(z)\;\left|\det\frac{\partial f_\theta(z)}{\partial z}\right|^{-1}$$2 constraint on the reconstructed perturbation (Dolatabadi et al., 2020, Dolatabadi et al., 2020, Liu et al., 2023).

2. AFM Architectures and Adversarial Objectives

AFM architectures range from classical affine-coupling flows (RealNVP, Glow) to continuous-time neural ODE flows and transformer-based Monge map models. The adversarial component is instantiated as either:

(a) Adversarial Generative Training:

The AFM generator is trained to map noise $$p_X(x) = p_Z\bigl(f_\theta^{-1}(x)\bigr) \cdot \left|\det\left(\frac{\partial f_\theta^{-1}(x)}{\partial x}\right)\right| = p_Z(z)\;\left|\det\frac{\partial f_\theta(z)}{\partial z}\right|^{-1}$$3 to data $$p_X(x) = p_Z\bigl(f_\theta^{-1}(x)\bigr) \cdot \left|\det\left(\frac{\partial f_\theta^{-1}(x)}{\partial x}\right)\right| = p_Z(z)\;\left|\det\frac{\partial f_\theta(z)}{\partial z}\right|^{-1}$$4 with a discriminator $$p_X(x) = p_Z\bigl(f_\theta^{-1}(x)\bigr) \cdot \left|\det\left(\frac{\partial f_\theta^{-1}(x)}{\partial x}\right)\right| = p_Z(z)\;\left|\det\frac{\partial f_\theta(z)}{\partial z}\right|^{-1}$$5 providing adversarial feedback. Example loss formulations include: $$p_X(x) = p_Z\bigl(f_\theta^{-1}(x)\bigr) \cdot \left|\det\left(\frac{\partial f_\theta^{-1}(x)}{\partial x}\right)\right| = p_Z(z)\;\left|\det\frac{\partial f_\theta(z)}{\partial z}\right|^{-1}$$6

$$p_X(x) = p_Z\bigl(f_\theta^{-1}(x)\bigr) \cdot \left|\det\left(\frac{\partial f_\theta^{-1}(x)}{\partial x}\right)\right| = p_Z(z)\;\left|\det\frac{\partial f_\theta(z)}{\partial z}\right|^{-1}$$7

The optimal transport penalty uniquely selects the Monge map between base and data distributions (Lin et al., 27 Nov 2025).

(b) Contrastive, Conditional, and Hybrid Adversarial Training:

Variants such as CAGlow integrate condition-encoding adversarial supervision, class-label discriminators, and jointly trained decoders to control attribute conditioning and latent disentanglement (Liu et al., 2019). Flow Contrastive Estimation (FCE) adversarially matches both flow and energy-based models over data and flow samples, minimizing a minimax criterion with respect to density ratios (Gao et al., 2019).

(c) Continuous-Time and Few-Step AFMs:

AFMs extend to continuous-time flows parameterized via neural ODEs, where velocity fields are guided by a JVP-based discriminator. Instead of optimizing mean-squared error between flows (flow matching), adversarial loss on the Jacobian-vector product of the discriminator shapes trajectories toward data-conforming features, improving sample realism and alignment (Lin et al., 13 Apr 2026).

(d) Adversarial Flows for Attacks:

In attacks, flows serve as a prior over imperceptible perturbations. The adversarial example is generated by manipulating the latent code to maximize classification loss while projecting the resulting image back into an allowable perturbation ball—a process that can be optimized via Natural Evolution Strategies or direct gradient methods (Dolatabadi et al., 2020, Liu et al., 2023).

3. Latent-Space and Continuous-Time Attack Procedures

For adversarial example generation, AFMs formulate the attack as a search for a latent perturbation. For a pre-trained flow $$p_X(x) = p_Z\bigl(f_\theta^{-1}(x)\bigr) \cdot \left|\det\left(\frac{\partial f_\theta^{-1}(x)}{\partial x}\right)\right| = p_Z(z)\;\left|\det\frac{\partial f_\theta(z)}{\partial z}\right|^{-1}$$8:

• Latent variable update:

Sample candidates $$p_X(x) = p_Z\bigl(f_\theta^{-1}(x)\bigr) \cdot \left|\det\left(\frac{\partial f_\theta^{-1}(x)}{\partial x}\right)\right| = p_Z(z)\;\left|\det\frac{\partial f_\theta(z)}{\partial z}\right|^{-1}$$9, reconstruct $z = f_\theta^{-1}(x)$0, and project onto the $z = f_\theta^{-1}(x)$1-ball around the original $z = f_\theta^{-1}(x)$2.

• Optimization:

Employ black-box strategies (e.g., evolutionary updates of $z = f_\theta^{-1}(x)$3) or direct gradient descent in the latent space. The constraint ensures $z = f_\theta^{-1}(x)$4.

• Stopping criterion:

Terminate upon achieving a successful misclassification or exhausting a query budget (Dolatabadi et al., 2020, Dolatabadi et al., 2020).

More advanced frameworks, such as Dual-Flow, introduce bi-directional ODE-based velocity functions, employing both a pre-trained forward flow and a trainable adversarial reverse flow for multi-target, high-transferability attacks. The adversarial reverse flow, fine-tuned with cross-attention and CLIP embeddings, drives samples toward targeted misclassification while adhering to strict perturbation constraints through “Cascading Distribution Shift Training” and dynamic/hard clipping at each step (Chen et al., 4 Feb 2025).

4. Theoretical Guarantees, Stability, and Functional Properties

AFMs leverage optimal transport theory and properties of the Monge map to ensure equilibrium and stability. The inclusion of explicit optimal transport or quadratic penalties distinguishes AFMs from classical GANs by enforcing uniqueness and preventing generator mode collapse:

• Uniqueness of the Monge map:

Linear interpolation plus quadratic transport between $z = f_\theta^{-1}(x)$5 and $z = f_\theta^{-1}(x)$6 ensures a single solution under adversarial training with the OT penalty (Lin et al., 27 Nov 2025).

• Stability:

The adversarial loss drives $z = f_\theta^{-1}(x)$7 toward $z = f_\theta^{-1}(x)$8; the transport penalty aligns the generator with the optimal coupling, resolving non-identifiability present in pure adversarial training.

• Sample quality and convergence:

Empirically, adversarial training of flows improves sample class alignment, texture faithful reproduction, and guidance-free FID compared to MSE-matched flow models. Continuous Adversarial Flow Models (CAFMs) further boost realism by adversarially guiding continuous-time velocity fields on ODE trajectories, aligning generated distributions with the data manifold (Lin et al., 13 Apr 2026).

In adversarial RL/game-theoretic applications, AFlowNets generalize AFM principles to sequential multi-agent settings, with equilibrium guaranteed by trajectory-balance (TB) and expected detailed-balance (EDB) constraints per agent. These algorithms require only a single policy forward pass per state, with guaranteed unique equilibria and strong empirical performance in games like Connect-4 (Jiralerspong et al., 2023).

5. Applications: Generation, Attacks, Control, and Beyond

Generative Modeling:

AFMs have achieved state-of-the-art performance on image generation tasks. The XL/2 model of (Lin et al., 27 Nov 2025) attains an FID of 2.38 on ImageNet-256px with a 1-step sampler—surpassing consistency-based, GAN, and flow-based competitors—and achieves as low as FID=1.94 with depth-repetition strategies.

Adversarial Examples:

AFM attacks demonstrate greater imperceptibility and higher success rates against adversarially-trained and “robust” classifiers compared to direct pixel-space methods, due to their inherent bias toward data-manifold-conforming perturbations. Notably, AFLOW achieves up to 96.7% ASR at $z = f_\theta^{-1}(x)$9 (pixel quantization) versus ≤55% for PGD/BIM, and evades manifold-based detectors with AUROC as low as 52–65% (Liu et al., 2023).

Conditional and Controlled Generation:

CAGlow, representing a conditional adversarial generative flow, enables multi-label and attribute-driven controllable synthesis with improved disentanglement, minimal attribute drift, and improved classification accuracy and FID relative to unconditional flows (Liu et al., 2019).

Audio Synthesis:

Adversarial Flow Matching as instantiated in PeriodWave-Turbo demonstrates that adversarial fine-tuning of continuous flow-matching models can achieve SOTA perceptual quality (PESQ=4.454) for waveform synthesis with as few as 4 ODE steps—speeding up generation and matching or surpassing GAN vocoders (Lee et al., 2024).

Structured Prediction and RL:

AFlowNets generalize AFM structure to adversarial and multi-policy learning in zero-sum environments, achieving high move optimality and Elo in self-play, and outperforming AlphaZero in round-robin tournaments without relying on Monte-Carlo Tree Search (Jiralerspong et al., 2023).

6. Limitations, Open Problems, and Future Directions

Although AFMs excel in sample realism, imperceptibility, and transferability, several open areas remain:

• Hyperparameter scheduling:

Optimal annealing of transport penalty weights and adversarial/discriminator learning rates remains empirically tuned; principled strategies are yet to be developed (Lin et al., 27 Nov 2025).

• Computational efficiency:

Adversarial training with strong gradient penalties is more expensive than standard flow-matching; techniques for lightweight or robust adversarial regularization are an active area of research.

• Generalization to other modalities:

While AFMs have been extended to text, audio, and structured domains, domain-optimized flows and discriminators are necessary for high-fidelity or robust performance.

• Formal convergence:

Full convergence guarantees for AFMs, especially in min–max adversarial regimes with OT regularization, require further theoretical work.

• Integration with Guidance and Reward Models:

Expanding AFMs to classifier-free guidance, reinforcement learning reward functions, and joint training in representation space is ongoing (Lin et al., 27 Nov 2025, Lin et al., 13 Apr 2026).

• Robustness and Defenses:

Countermeasures explicitly modeling flow priors, or incorporating flows into classifier pipelines, are required to mitigate AFM-based attack strategies (Dolatabadi et al., 2020, Liu et al., 2023).

7. Summary Table: Key AFM Variants and Achievements

Model/Framework	Principal Setting	Key Results / Metrics
AFM (Monge GAN, (Lin et al., 27 Nov 2025))	ImageNet-256px Gen	FID=2.38 (XL/2, 1 step), stable OT convergence
CAFM (Lin et al., 13 Apr 2026)	Continuous flows, post-adapt	SiT FID 8.26→3.63, JiT FID 7.17→3.57
AdvFlow/AFLOW (Dolatabadi et al., 2020, Liu et al., 2023)	Black/White-box attack	CIFAR-10 defended ASR ~41% @ 𝜖=8/255
Dual-Flow (Chen et al., 4 Feb 2025)	Transferable attacks	Inc-v3→Res-152 ASR +34.58% over CGNC
CAGlow (Liu et al., 2019)	Controlled synthesis	MNIST FID=26.34, CelebA FID=104.91
AFlowNet (Jiralerspong et al., 2023)	Zero-sum games/RL	>80% move optimality; Elo > 2000 in Connect-4
PeriodWave AFM (Lee et al., 2024)	Audio (LibriTTS)	PESQ=4.454 w/ 4 ODE steps, UTMOS=3.859

By merging explicit optimal transport, continuous invertibility, adversarial training, and data-driven synthesis, Adversarial Flow Models define a unifying framework for high-fidelity generation, robust and imperceptible attacks, controllable sampling, and equilibrium-seeking policies in complex environments.