DualFlow: Dual-Branch ML Frameworks Overview
- DualFlow is a term for several ML frameworks employing dual-branch designs to handle tasks like adversarial attacks, interactive motion synthesis, and streaming perception.
- In adversarial attacks, DualFlow combines deterministic ODE-based transport with targeted cross-entropy losses to achieve significantly improved transfer success rates.
- In motion generation and streaming detection, DualFlow leverages multi-modal conditioning and dual feature streams to enhance coordinated motion synthesis and real-time object prediction.
DualFlow denotes several unrelated machine-learning frameworks that share a common naming motif centered on “two-flow” or “dual-branch” design. In the arXiv literature represented here, the name refers to: a multi-target, instance-agnostic adversarial attack framework formulated as a pair of ODE transports between clean, mildly perturbed, and -constrained image distributions; a unified rectified-flow architecture for interactive and reactive two-person 3D motion generation under text, music, and retrieval conditioning; and a real-time streaming perception module for object detection that fuses dynamic and static feature flows to predict next-frame detections (Chen et al., 4 Feb 2025, Gupta et al., 28 Sep 2025, Yang et al., 2022).
1. Name usage and scope
The term DualFlow is not a single standardized method. It appears in at least three distinct contexts with different tasks, representations, and objectives: adversarial robustness evaluation, multi-modal human motion generation, and streaming object detection.
| Usage | Domain | Core duality |
|---|---|---|
| Dual-Flow | Adversarial attacks | Forward diffusion/rectified flow and reverse adversarial flow |
| DualFlow | 3D motion generation | Two persons and two interaction modes |
| DualFlow Perception | Streaming detection | Dynamic flow and static flow |
In the adversarial setting, Dual-Flow is introduced as “Transferable Multi-Target, Instance-Agnostic Attacks via In-the-wild Cascading Flow Optimization” and is explicitly designed for black-box transferability in targeted attacks (Chen et al., 4 Feb 2025). In the motion-generation setting, DualFlow is presented as “Unified Multi-Modal Interactive & Reactive 3D Motion Generation via Rectified Flow,” where the duality is architectural and task-level rather than adversarial (Gupta et al., 28 Sep 2025). In streaming perception, DualFlow appears as the “DualFlow Perception module (DFP)” inside StreamYOLO, where two feature paths capture motion trend and static detection cues for next-frame prediction under streaming evaluation (Yang et al., 2022).
A plausible implication is that the recurring name reflects a shared design intuition—separating complementary transports, branches, or feature streams—rather than a common lineage of methods.
2. Dual-Flow in transferable adversarial attacks
Dual-Flow is a framework for multi-target instance-agnostic adversarial attacks in black-box settings, where transferability from surrogate models to unseen victim models is central. The method addresses a stated limitation of prior multi-target generators: a single conditioned generator must fit many target-condition behaviors into one model, which increases capacity requirements and can induce generalization gaps between training and inference distributions (Chen et al., 4 Feb 2025).
The framework is organized as a two-flow pipeline. A pretrained diffusion or rectified-flow model defines a forward ODE velocity function that deterministically transports clean images from to a mildly perturbed distribution :
A learned, class-conditioned adversarial velocity function then defines the reverse transport from to the -constrained adversarial set :
The targeted objective is written as
0
where maximizing 1 corresponds to increasing the target class 2 under a surrogate classifier 3. Training uses a candidate reconstruction of the initial frame,
4
followed by per-pixel clipping to the 5-ball around the clean image. The adversarial loss is the targeted cross-entropy
6
The perturbation budget is 7 in experiments, enforced by dynamic gradient clipping during training and hard clipping at the final timestep. Multi-target capability is obtained by conditioning 8 on 9 through CLIP text embeddings injected by cross-attention:
0
A central component is Cascading Distribution Shift Training (CDST), which trains 1 along the actual forward ODE trajectory points 2, thereby aligning optimization with the sampling trajectory and reducing train-test trajectory mismatch. The paper states an informal “cascading improvement” proposition: under smoothness and small steps 3, updating 4 at time 5 decreases, or does not increase, the cross-entropy at 6.
The implementation uses a Stable Diffusion backbone for 7, deterministic Euler steps in both directions, LoRA rank 8, 9, and 0 steps for both training and inference. Multi-target training runs for 1k steps with learning rate 2 and batch size 3; single-target fine-tuning adds 4k steps with learning rate 5 and batch size 6.
3. Empirical profile of the adversarial-attack framework
The experimental setup trains on the ImageNet-1k train set and evaluates on ImageNet-NeurIPS and ImageNet validation. Surrogates are Inception-v3 and ResNet-152. Black-box normally trained targets include Inc-v4, Inc-Res-v2, DenseNet-121, GoogleNet, and VGG-16; robust targets include adv-Inception-v3, ens-adv-Inception-ResNet-v2, and four robust ResNet-50 variants: SIN, IN, fine, and Augmix. The metric is Attack Success Rate for targeted attacks, averaged over 7 target classes (Chen et al., 4 Feb 2025).
On normally trained black-box models, Dual-Flow reports average ASR of 8 with Inc-v3 as surrogate, compared with 9 for CGNC and 0 for C-GSP. With Res-152 as surrogate, Dual-Flow reports average ASR of 1, compared with 2 for CGNC and 3 for C-GSP. A highlighted result is transfer from Inc-v3 to Res-152: Dual-Flow achieves 4 versus CGNC’s 5, a 6 absolute gain.
After brief per-class fine-tuning, the single-target variant Dual-Flow† improves further, including average black-box ASR of 7 with Inc-v3 source, surpassing GAP, CD-AP, TTP, DGTA-PI, and CGNC†. Against robust models, Dual-Flow reports average ASR of 8 with Inc-v3 surrogate, versus 9 for CGNC and 0 for C-GSP; with Res-152 surrogate, the corresponding figures are 1, 2, and 3.
The defense evaluation includes input processing such as Gaussian smoothing and JPEG compression. One cited example is Inc-v3 surrogate to DN-121 target under Gaussian smoothing, where Dual-Flow reaches 4 ASR versus 5 for CGNC. Ablations attribute much of the advantage to the deterministic cascading ODE formulation. Dual-Flow-co, the Cascading ODE variant, achieves white-box 6 on Res-152 and average black-box 7, while Cascading SDE variants fall to roughly 8–9 black-box ASR and Random SDE variants to roughly 0–1.
A variant with 2-matching to the forward ODE path, Dual-Flow-L2, underperforms Dual-Flow by approximately 3 average black-box ASR, which the paper uses to motivate dynamic clipping and targeted-objective alignment. The paper also reports semantic evidence: unclipped reverse-flow outputs 4 often become semantically close to the target class and are highly likely to be classified as 5 even before clipping, while clipped perturbations retain target-aligned semantics better than baseline methods.
4. DualFlow for multi-modal two-person 3D motion generation
A separate work uses the name DualFlow for a unified framework for two-person 3D motion generation conditioned on text, music, prior motion sequences, or combinations thereof. The task includes interactive generation, where coordinated motions for persons A and B are synthesized from text, music, or both, and reactive generation, where person B’s motion is generated conditioned on person A’s motion plus text and/or music (Gupta et al., 28 Sep 2025).
The motion representation is defined in a global coordinate frame anchored at person A’s root joint, with person B’s global position expressed relative to person A’s root. Each frame uses a per-person representation 6 based on SMPL with 7 joints: global joint positions, global joint velocities, local joint rotations in 8D root-relative coordinates, and four foot-contact binary flags. The full motion sequence is 9, and sequences are typically at 0 FPS.
The architecture is “dual” in two dimensions. First, it models two persons: symmetric branches for A and B in interactive mode, and a single “reactor” branch for B in reactive mode. Second, it supports two interaction modes: interactive and reactive, implemented by switching Motion Cross-Attention into a causal, look-ahead variant in reactive mode and masking the actor’s input branch.
Conditioning is multi-modal. Text is encoded by CLIP ViT-L/14 embeddings of dimension 1, passed through a transformer encoder and fused with time-step embeddings to form text latent 2, which conditions adaptive LayerNorm parameters. Music uses Jukebox embeddings of dimension 3 to form music latent 4. Retrieval augmentation uses top-5 exemplars from four databases aligned with LLM-decomposed text and music: DS for Spatial Relationship, DB for Body Movement, DR for Rhythm, and DM for Music. Retrieved signals are mapped to motion latent space and concatenated to form 6.
The backbone contains 7 DualFlow blocks. Each block includes multi-scale temporal Conv1d with parallel temporal kernels and strides 8, 9, and 0, followed by GELU and gating; Self-Attention; Music Cross-Attention; Motion Cross-Attention between persons or Causal Cross-Attention with look-ahead 1 in reactive mode; Retrieval Cross-Attention; residual connections; FlashAttention; and adaptive LayerNorm conditioned by 2. Motion and conditioning are projected to latent dimension 3; FFNs use hidden size 4; there are 5 attention heads and dropout 6.
The generative formulation uses rectified flow. For a ground-truth motion sample 7 and Gaussian noise 8, the probability path is the linear interpolation
9
with target constant velocity
0
The model learns 1 with the flow-matching objective
2
A contrastive velocity-space triplet loss is added,
3
and the contrastive rectified flow loss becomes
4
Geometric and interaction regularization are also used, with total loss
5
The synchronization term is
6
where the weights emphasize spatially close joints and key end-effectors such as hands, feet, and hips.
5. Training, evaluation, and ablations in motion generation
The training data comprise InterHuman-AS, an asymmetric extension with actor–reactor labels and approximately 7K interactions across 8 action types; DD100, with 9 duet dance routines paired with music and structure annotations; and MDD, with 00 hours of duet dance motion capture and more than 01K text annotations (Gupta et al., 28 Sep 2025). Training uses classifier-free guidance by jointly masking both modalities 02 of the time and individually masking text or music 03 of the time. Optimization uses Adam with learning rate 04, weight decay 05, 06 warm-up steps, batch size 07, 08 epochs, cosine learning-rate scheduling, and 09 flow integration steps. In reactive generation, the look-ahead is 10 frames.
Evaluation uses FID, Multimodal Distance, R-Precision, Diversity, Multimodality, Beat Echo Degree, and Beat-Alignment Score. On MDD interactive text+music generation, DualFlow (Both) reports 11, 12, 13, Diversity 14, BAS 15, and BED 16. The paper states reported gains versus prior state of the art of 17 FID, 18 R-precision, and 19 in Multimodal Distance for the interactive task on MDD.
On MDD reactive generation, DualFlow (Both) reports FID 20, MMDist 21, 22, BAS 23, and BED 24, with reported gains versus prior state of the art of 25 FID, 26 R-precision, and 27 Multimodal Distance. On InterHuman-AS interactive text-only generation, DualFlow reports 28, MMDist 29, Multimodality 30, and FID 31. On DD100 reactive generation, it reports FIDk 32, FIDg 33, FIDcd 34, Divk 35, Divgt 36, BAS 37, and BED 38.
The ablation studies assign importance to several components. Removing RAG or the triplet loss harms R-Precision, MMDist, and FID in both tasks. Removing 39 degrades inter-person coordination and rhythmic scores. Replacing Jukebox with spectral features reduces performance. In reactive generation, replacing Causal Look-Ahead Attention with regular cross-attention worsens FID and alignment; the cited example is DualFlow without CLA at FID 40 versus 41. Shallower architectures, single temporal convolution, or smaller latent dimensions each produce consistent drops.
The paper attributes part of the behavior to rectified flow itself: straight-line deterministic transport reduces step count and avoids per-step stochastic noise addition, which is argued to lower error accumulation and latency. It also notes limitations and failure cases: rare or highly complex interaction styles can reduce contact accuracy or stylization, very long horizons may drift without additional anchors, and domain gaps in music genres or unconventional textual phrasing can reduce retrieval precision.
6. DualFlow Perception in streaming object detection
In StreamYOLO, DualFlow is a lightweight FPN-level module for next-frame detection under streaming perception evaluation. The underlying setting differs from standard offline video detection because predictions computed from frame 42 are evaluated against the world state at a later instant. For real-time detectors with processing time less than the frame period 43, the alignment becomes a one-frame lookahead, 44, and the unified metric is streaming AP, or sAP, averaged over IoU thresholds from 45 to 46 (Yang et al., 2022).
The detector is based on YOLOX with CSPDarknet-53 as backbone, PANet as neck, and decoupled detection heads. DualFlow Perception is inserted after the FPN to fuse the last and current frame features at each pyramid level before classification, objectness, and regression heads. It contains two paths.
The dynamic flow path takes same-level FPN features from 47 and 48. Each is reduced to half the channels by a shared 49 convolution followed by BN and SiLU, then concatenated:
50
The static flow path simply preserves the current-frame feature:
51
Fusion is residual addition:
52
The detector is trained directly for one-step lookahead prediction using triplets 53, so that 54 is evaluated against 55. The method explicitly avoids optical flow, warping, deformable alignment, and recurrent state; motion trend is learned implicitly from concatenated adjacent-frame features.
Trend-Aware Loss reweights the regression loss according to inter-frame motion. For each ground-truth box at time 56, the best IoU with boxes at time 57 is
58
Given threshold 59 and constant 60, the unnormalized trend factor is
61
To preserve loss scale, the normalized factor is
62
and the final loss is
63
Grid search found 64 and 65 to be effective.
The training set is Argoverse-HD with center RGB camera only at 66 FPS, following the Streamer split; validation has 67 videos totaling approximately 68k frames. The model is fine-tuned from COCO-pretrained YOLOX for 69 epochs on 70 GTX 2080 Ti with batch size 71, SGD momentum 72, weight decay 73, learning rate 74, cosine schedule, and 75-epoch warm-up. No augmentation is used because adjacent frames must be aligned. At inference, the method caches FPN features from the previous frame; for the first frame, the current features are duplicated as pseudo-history.
Quantitatively, for YOLOX-L at 76, the baseline streaming detector reports sAP 77, 78, and 79. A basic next-frame prediction pipeline adds 80 sAP to reach 81. DFP alone adds 82 to reach 83, TAL alone adds 84 to reach 85, and DFP with TAL reaches 86 sAP, 87, and 88, which is a 89 improvement over baseline. Under 90 speed re-sampling, baseline sAP is 91, the basic pipeline reaches 92, DFP reaches 93, and DFP with TAL reaches 94.
Latency remains close to the original detector. Reported per-frame latency on Tesla V100 for YOLOX-L at 95 is 96 ms for baseline and 97 ms for FPN-level concatenation plus residual, compared with 98 ms for non-local and 99 ms for spatial transformer. Relative to Kalman Filter forecasting, StreamYOLO adds approximately 00 ms versus approximately 01 ms while obtaining higher sAP.
7. Comparative interpretation
Across these three works, the name DualFlow consistently denotes an explicit decomposition into two coordinated processes, but the technical meaning of “flow” differs substantially. In adversarial attacks, flow is literal ODE transport over image distributions, with a pretrained forward velocity and a learned reverse adversarial velocity (Chen et al., 4 Feb 2025). In two-person motion generation, flow refers to rectified-flow generative transport from Gaussian noise to motion sequences, while “dual” also names the two-person and two-mode structure (Gupta et al., 28 Sep 2025). In streaming detection, flow is an architectural metaphor for two feature streams, one dynamic and one static, rather than a diffusion- or ODE-based generative process (Yang et al., 2022).
Their optimization targets are likewise distinct. The adversarial framework minimizes targeted cross-entropy on clipped reconstructions inside an 02 ball. The motion-generation framework matches a rectified-flow velocity field and augments it with triplet, geometric, interaction, and synchronization losses. The streaming-detection framework optimizes next-frame detection with trend-aware reweighting of the regression term under streaming alignment. Their evaluation metrics also occupy different regimes: ASR for transfer attacks, FID and alignment metrics for motion synthesis, and sAP for low-latency perception.
A plausible implication is that the shared label should not be treated as identifying a single methodological family. For literature retrieval, implementation, or citation, the arXiv identifier is therefore essential: (Chen et al., 4 Feb 2025) for multi-target adversarial attacks, (Gupta et al., 28 Sep 2025) for multi-modal 3D motion generation, and (Yang et al., 2022) for streaming perception.