Deterministic Inversion Flow Matching (DIFM)

• DIFM is an ODE-based generative methodology that deterministically maps complex distributions using learned vector fields for efficient inversion and residual correction.
• It employs a flow matching loss and Lipschitz-constrained neural networks to provide explicit theoretical error bounds and robust guarantees on distributional fidelity.
• Its practical design enables low-latency feature inversion even with off-manifold or corrupted inputs, proving valuable in privacy analysis and split DNN applications.

Deterministic Inversion Flow Matching (DIFM) is an ODE-based generative methodology that learns a deterministic vector field for mapping between complex probability distributions. Originating in the context of flow matching and feature inversion under the probability flow ODE paradigm, DIFM enables sample generation, inverse mapping, and residual correction with strong theoretical guarantees for error bounds. Importantly, it allows efficient deterministic inversion even in settings where only indirect (e.g., off-manifold or corrupted) representations are available, and underpins recent empirical advances in black-box feature inversion for privacy analysis in split DNNs.

1. Mathematical Formulation and Theoretical Foundations

Let $\pi_0, \pi_1$ denote two distributions on $\mathbb{R}^d$ (e.g., $\pi_0$ a standard Gaussian and $\pi_1$ a target data law). Flow matching defines a stochastic interpolant: $$X_0 \sim \pi_0,\quad X_1 \sim \pi_1,\quad Z \sim \mathcal{N}(0,I),\quad X_t = \alpha_t X_0 + \beta_t X_1 + \gamma_t Z,\quad t \in [0,1],$$ with boundary conditions $\alpha_0=1$, $\beta_1=1$, $\gamma_0=\gamma_1=0$ (or small). The associated causal velocity field is

$$v^x(x,t) = \mathbb{E}[\dot{X}_t \mid X_t = x],\quad \dot{X}_t = \partial_t X_t.$$

The deterministic flow ODE is

$\frac{dZ_t^x}{dt} = v^x(Z_t^x, t),\quad Z_0^x = x,$

which by construction yields $\mathbb{R}^d$0 and interpolates between $\mathbb{R}^d$1 and $\mathbb{R}^d$2 as $\mathbb{R}^d$3 traverses $\mathbb{R}^d$4.

In practice, the velocity field $\mathbb{R}^d$5 is approximated by a parametric function $\mathbb{R}^d$6 (e.g., a neural network), learned by minimizing the $\mathbb{R}^d$7 flow-matching loss: $\mathbb{R}^d$8 The ODE solution for $\mathbb{R}^d$9 with $\pi_0$0, $\pi_0$1, yields a distribution at $\pi_0$2 that ideally approximates $\pi_0$3; the quality is controlled by the approximation properties of $\pi_0$4 and further regularity properties of the data (Benton et al., 2023).

2. Error Bounds and Regularity Assumptions

The primary theoretical guarantee for DIFM is an explicit bound on the 2-Wasserstein distance $\pi_0$5 between the learned endpoint distribution $\pi_0$6 and the true $\pi_0$7: $\pi_0$8 where:

• $\pi_0$9 (approximation error),
• $\pi_1$0 is the Lipschitz constant of $\pi_1$1.

This result is established using the Aleksseev–Gröbner perturbation formula and Grönwall's inequality. Central assumptions are:

• (A1) $\pi_1$2 approximation error is bounded,
• (A2) Existence and uniqueness of smooth, differentiable ODE flows,
• (A3) Time-dependent Lipschitz continuity of the learned velocity field,
• (A4) The data distributions are $\pi_1$3-regular, meaning the random variable $\pi_1$4 admits a local smoothing property; log-concave and many Gaussian mixtures satisfy this with small $\pi_1$5.

Control of the Lipschitz constant is key: for concave schedules $\pi_1$6 vanishing only at endpoints, $\pi_1$7. This allows parameterization of $\pi_1$8 so that the exponential term does not blow up, resulting in explicit polynomial-in-$\pi_1$9 error rates (Benton et al., 2023).

3. Practical Algorithmic Design

DIFM is implemented with explicit guidance from theory:

• The interpolation schedule $$X_0 \sim \pi_0,\quad X_1 \sim \pi_1,\quad Z \sim \mathcal{N}(0,I),\quad X_t = \alpha_t X_0 + \beta_t X_1 + \gamma_t Z,\quad t \in [0,1],$$0 is chosen smooth and concave, with $$X_0 \sim \pi_0,\quad X_1 \sim \pi_1,\quad Z \sim \mathcal{N}(0,I),\quad X_t = \alpha_t X_0 + \beta_t X_1 + \gamma_t Z,\quad t \in [0,1],$$1 small only at endpoints, for stability.
• The vector field $$X_0 \sim \pi_0,\quad X_1 \sim \pi_1,\quad Z \sim \mathcal{N}(0,I),\quad X_t = \alpha_t X_0 + \beta_t X_1 + \gamma_t Z,\quad t \in [0,1],$$2 is parameterized in a function class with provable Lipschitz bounds (e.g., via spectral normalization or gradient penalties).
• Training minimizes the empirical estimate of the $$X_0 \sim \pi_0,\quad X_1 \sim \pi_1,\quad Z \sim \mathcal{N}(0,I),\quad X_t = \alpha_t X_0 + \beta_t X_1 + \gamma_t Z,\quad t \in [0,1],$$3 loss via stochastic gradient descent.
• Inference proceeds by solving the learned ODE $$X_0 \sim \pi_0,\quad X_1 \sim \pi_1,\quad Z \sim \mathcal{N}(0,I),\quad X_t = \alpha_t X_0 + \beta_t X_1 + \gamma_t Z,\quad t \in [0,1],$$4, typically with a fixed-step ODE solver. For tasks where the off-manifold starting point is close to the target manifold, a single Euler step suffices for practical accuracy (Ren et al., 19 Nov 2025).

In the feature inversion setting (FIA-Flow), DIFM is applied as a residual correction: an off-manifold latent $$X_0 \sim \pi_0,\quad X_1 \sim \pi_1,\quad Z \sim \mathcal{N}(0,I),\quad X_t = \alpha_t X_0 + \beta_t X_1 + \gamma_t Z,\quad t \in [0,1],$$5 (from an alignment module) and the ground-truth latent $$X_0 \sim \pi_0,\quad X_1 \sim \pi_1,\quad Z \sim \mathcal{N}(0,I),\quad X_t = \alpha_t X_0 + \beta_t X_1 + \gamma_t Z,\quad t \in [0,1],$$6 are linearly interpolated; a simple velocity field $$X_0 \sim \pi_0,\quad X_1 \sim \pi_1,\quad Z \sim \mathcal{N}(0,I),\quad X_t = \alpha_t X_0 + \beta_t X_1 + \gamma_t Z,\quad t \in [0,1],$$7 is learned to match the constant velocity $$X_0 \sim \pi_0,\quad X_1 \sim \pi_1,\quad Z \sim \mathcal{N}(0,I),\quad X_t = \alpha_t X_0 + \beta_t X_1 + \gamma_t Z,\quad t \in [0,1],$$8 along the path. The transformation is effected in one step at inference: $$X_0 \sim \pi_0,\quad X_1 \sim \pi_1,\quad Z \sim \mathcal{N}(0,I),\quad X_t = \alpha_t X_0 + \beta_t X_1 + \gamma_t Z,\quad t \in [0,1],$$9 This affords low-latency, data-efficient inversion even with few training pairs (Ren et al., 19 Nov 2025).

4. Connections to Inverse Flow and Consistency Models

DIFM belongs to the broader class of ODE-based flow models used for both generative tasks and inverse problems, such as denoising without clean ground truth. Related methodologies include Inverse Flow Matching (IFM) (Zhang et al., 17 Feb 2025), where a deterministic vector field is learned to reconstruct clean data from corrupted observations by solving an ODE in reverse. Both paradigms exploit a regression loss matching the learned field $\alpha_0=1$0 to a known conditional velocity $\alpha_0=1$1, though IFM addresses cases with only access to $\alpha_0=1$2 (corrupted data), while DIFM as employed in feature inversion has explicit access to aligned and target latent codes.

In both, deterministic flows yield invertible mappings, circumventing the need for stochastic score-based sampling. They typically achieve competitive denoising or inversion with fewer function evaluations than diffusion-based approaches, highlighting the computational efficiency of the ODE formulation (Benton et al., 2023, Zhang et al., 17 Feb 2025).

5. Empirical Performance and Applications

DIFM achieves state-of-the-art performance in semantic feature inversion attacks against split DNNs, particularly in the FIA-Flow framework (Ren et al., 19 Nov 2025). It refines off-manifold intermediate representations (from the LFSAM module) onto the VAE-encoded image manifold, substantially improving both perceptual and quantitative metrics (PSNR, SSIM, LPIPS, Top-1 accuracy).

Empirical results on datasets such as ImageNet and COCO, across various architectures (AlexNet, ResNet, Swin, YOLO, DINOv2), demonstrate that DIFM's one-step residual correction:

• Brings recovered images closer to the ground-truth manifold (measured by LPIPS and semantic consistency).
• Retains efficacy under privacy defenses (NOISE+NoPeek, DISCO), revealing a more severe privacy leakage than previous black-box attacks.
• Generalizes to cross-dataset target distributions.

Performance remains robust in data-scarce regimes, showing strong generalization even with minimal training pairs (Ren et al., 19 Nov 2025).

6. Implementation Details and Training Protocol

Architecturally, DIFM frequently employs a U-Net backbone (e.g., Stable Diffusion 2.1) for the vector field $\alpha_0=1$3. Only a small subset of parameters (e.g., LoRA adapters in cross-attention blocks) are optimized during training, with the core network frozen, enabling efficient convergence with limited supervision.

Training proceeds in two stages within frameworks like FIA-Flow:

1. LFSAM alignment from intermediate features to VAE-latent space is learned and frozen.
2. DIFM is trained to perform residual flow correction in latent space, supervised by both flow-matching and image reconstruction (LPIPS + $\alpha_0=1$4) losses.

Batch sizes, learning rates, and LoRA ranks are tuned for hardware efficiency (e.g., NVIDIA A100). At inference, the ODE is solved in a single step, achieving near real-time inversion (Ren et al., 19 Nov 2025).

7. Comparison with Other Generative and Inverse Methods

Relative to stochastic diffusion models, DIFM requires strictly deterministic vector fields with no need for noise injection during sampling or inference. This enables faster, lower-variance, and more direct recovery of target distributions, both in generative modeling and inverse reconstruction tasks (Benton et al., 2023, Zhang et al., 17 Feb 2025).

Compared to standard (forward) conditional flow matching, DIFM and related inverse flow designs operate effectively in the absence of clean data, leveraging regularity properties and self-supervised training. Under mild identifiability and smoothness assumptions, the methods recover the true distribution or mapping, as proven via explicit bounds on endpoint distributions (Benton et al., 2023, Zhang et al., 17 Feb 2025).

A plausible implication is that the deterministic nature and theoretical error guarantees of DIFM make it attractive in applications requiring both efficiency and provable distributional fidelity, especially for privacy-critical or data-sparse regimes.