---
title: 'DualFlow: Dual-Branch ML Frameworks Overview'
url: https://www.emergentmind.com/topics/dualflow
type: topic
---

# DualFlow: Dual-Branch ML Frameworks Overview

DualFlow denotes several unrelated machine-learning frameworks that share a common naming motif centered on “two-flow” or “dual-branch” design. In the arXiv literature represented here, the name refers to: a multi-target, instance-agnostic adversarial attack framework formulated as a pair of ODE transports between clean, mildly perturbed, and $\epsilon$-constrained image distributions; a unified rectified-flow architecture for interactive and reactive two-person 3D motion generation under text, music, and retrieval conditioning; and a real-time streaming perception module for object detection that fuses dynamic and static feature flows to predict next-frame detections [2502.02096], [2509.24099], [2203.12338].

## 1. Name usage and scope

The term DualFlow is not a single standardized method. It appears in at least three distinct contexts with different tasks, representations, and objectives: adversarial robustness evaluation, multi-modal human motion generation, and streaming object detection.

| Usage | Domain | Core duality |
|---|---|---|
| Dual-Flow | Adversarial attacks | Forward diffusion/rectified flow and reverse adversarial flow |
| DualFlow | 3D motion generation | Two persons and two interaction modes |
| DualFlow Perception | Streaming detection | Dynamic flow and static flow |

In the adversarial setting, Dual-Flow is introduced as “Transferable Multi-Target, Instance-Agnostic Attacks via In-the-wild Cascading Flow Optimization” and is explicitly designed for black-box transferability in targeted attacks [2502.02096]. In the motion-generation setting, DualFlow is presented as “Unified Multi-Modal Interactive & Reactive 3D Motion Generation via Rectified Flow,” where the duality is architectural and task-level rather than adversarial [2509.24099]. In streaming perception, DualFlow appears as the “DualFlow Perception module (DFP)” inside StreamYOLO, where two feature paths capture motion trend and static detection cues for next-frame prediction under streaming evaluation [2203.12338].

A plausible implication is that the recurring name reflects a shared design intuition—separating complementary transports, branches, or feature streams—rather than a common lineage of methods.

## 2. Dual-Flow in transferable adversarial attacks

Dual-Flow is a framework for multi-target instance-agnostic adversarial attacks in black-box settings, where transferability from surrogate models to unseen victim models is central. The method addresses a stated limitation of prior multi-target generators: a single conditioned generator must fit many target-condition behaviors into one model, which increases capacity requirements and can induce generalization gaps between training and inference distributions [2502.02096].

The framework is organized as a two-flow pipeline. A pretrained diffusion or rectified-flow model defines a forward ODE velocity function $\mathbf{v}_\phi$ that deterministically transports clean images from $\mathcal{X}$ to a mildly perturbed distribution $\mathcal{X}_\tau$:

$$
\frac{d\mathbf{x}}{dt} = \mathbf{v}_\phi(\mathbf{x}, t),\quad \Phi(\mathbf{x},0) \sim \mathcal{X},\quad \Phi(\mathbf{x},\tau) \sim \mathcal{X}_\tau.
$$

A learned, class-conditioned adversarial velocity function $\mathbf{v}_\theta$ then defines the reverse transport from $\mathcal{X}_\tau$ to the $\epsilon$-constrained adversarial set $\mathcal{X}^\epsilon$:

$$
\frac{d\mathbf{x}}{dt} = \mathbf{v}_\theta(\mathbf{x}, t, c),\quad \Psi(\mathbf{x},\tau) \sim \mathcal{X}_\tau,\quad \Psi(\mathbf{x},0) \in \mathcal{X}^\epsilon.
$$

The targeted objective is written as

$$
j(\mathbf{x}; c) = - \mathrm{CE}\bigl(f(\mathbf{x}), c\bigr),
$$

where maximizing $j$ corresponds to increasing the target class $c$ under a surrogate classifier $f$. Training uses a candidate reconstruction of the initial frame,

$$
\widehat{\mathbf{x}_0} = \mathbf{x}_t - \mathbf{v}_\theta(\mathbf{x}_t, t, c)\,t,
$$

followed by per-pixel clipping to the $\epsilon$-ball around the clean image. The adversarial loss is the targeted cross-entropy

$$
\mathcal{L}_{\mathrm{adv}}(\theta) = \mathrm{CE}\bigl(f(\widehat{\mathbf{x}_0}), c\bigr).
$$

The perturbation budget is $L_\infty \le 16/255$ in experiments, enforced by dynamic gradient clipping during training and hard clipping at the final timestep. Multi-target capability is obtained by conditioning $\mathbf{v}_\theta$ on $c$ through CLIP text embeddings injected by cross-attention:

$$
Q = \mathbf{z} W_Q,\quad K = \mathbf{e} W_K,\quad V = \mathbf{e} W_V,\quad
\mathrm{Attn}(Q,K,V) = \mathrm{softmax}\!\left(\frac{QK^\top}{\sqrt{d}}\right)V.
$$

A central component is Cascading Distribution Shift Training (CDST), which trains $\mathbf{v}_\theta$ along the actual forward ODE trajectory points $x_\tau, x_{\tau-\delta}, \ldots$, thereby aligning optimization with the sampling trajectory and reducing train-test trajectory mismatch. The paper states an informal “cascading improvement” proposition: under smoothness and small steps $\delta$, updating $\theta$ at time $t$ decreases, or does not increase, the cross-entropy at $t-\delta$.

The implementation uses a Stable Diffusion backbone for $\mathbf{v}_\phi$, deterministic Euler steps in both directions, LoRA rank $16$, $\tau = 0.25$, and $N = 6$ steps for both training and inference. Multi-target training runs for $50$k steps with learning rate $2.5\times 10^{-5}$ and batch size $8$; single-target fine-tuning adds $10$k steps with learning rate $10^{-5}$ and batch size $4$.

## 3. Empirical profile of the adversarial-attack framework

The experimental setup trains on the ImageNet-1k train set and evaluates on ImageNet-NeurIPS and ImageNet validation. Surrogates are Inception-v3 and ResNet-152. Black-box normally trained targets include Inc-v4, Inc-Res-v2, DenseNet-121, GoogleNet, and VGG-16; robust targets include adv-Inception-v3, ens-adv-Inception-ResNet-v2, and four robust ResNet-50 variants: SIN, IN, fine, and Augmix. The metric is Attack Success Rate for targeted attacks, averaged over $8$ target classes [2502.02096].

On normally trained black-box models, Dual-Flow reports average ASR of $73.96\%$ with Inc-v3 as surrogate, compared with $52.80\%$ for CGNC and $51.08\%$ for C-GSP. With Res-152 as surrogate, Dual-Flow reports average ASR of $70.76\%$, compared with $58.40\%$ for CGNC and $47.03\%$ for C-GSP. A highlighted result is transfer from Inc-v3 to Res-152: Dual-Flow achieves $77.06\%$ versus CGNC’s $42.48\%$, a $34.58\%$ absolute gain.

After brief per-class fine-tuning, the single-target variant Dual-Flow† improves further, including average black-box ASR of $76.79\%$ with Inc-v3 source, surpassing GAP, CD-AP, TTP, DGTA-PI, and CGNC†. Against robust models, Dual-Flow reports average ASR of $62.28\%$ with Inc-v3 surrogate, versus $28.60\%$ for CGNC and $24.28\%$ for C-GSP; with Res-152 surrogate, the corresponding figures are $66.94\%$, $51.06\%$, and $36.02\%$.

The defense evaluation includes input processing such as Gaussian smoothing and JPEG compression. One cited example is Inc-v3 surrogate to DN-121 target under Gaussian smoothing, where Dual-Flow reaches $52.99\%$ ASR versus $28.27\%$ for CGNC. Ablations attribute much of the advantage to the deterministic cascading ODE formulation. Dual-Flow-co, the Cascading ODE variant, achieves white-box $92.39\%$ on Res-152 and average black-box $70.76\%$, while Cascading SDE variants fall to roughly $40$–$46\%$ black-box ASR and Random SDE variants to roughly $15$–$33\%$.

A variant with $L_2$-matching to the forward ODE path, Dual-Flow-L2, underperforms Dual-Flow by approximately $14.7\%$ average black-box ASR, which the paper uses to motivate dynamic clipping and targeted-objective alignment. The paper also reports semantic evidence: unclipped reverse-flow outputs $x_0'$ often become semantically close to the target class and are highly likely to be classified as $c$ even before clipping, while clipped perturbations retain target-aligned semantics better than baseline methods.

## 4. DualFlow for multi-modal two-person 3D motion generation

A separate work uses the name DualFlow for a unified framework for two-person 3D motion generation conditioned on text, music, prior motion sequences, or combinations thereof. The task includes interactive generation, where coordinated motions for persons A and B are synthesized from text, music, or both, and reactive generation, where person B’s motion is generated conditioned on person A’s motion plus text and/or music [2509.24099].

The motion representation is defined in a global coordinate frame anchored at person A’s root joint, with person B’s global position expressed relative to person A’s root. Each frame uses a per-person representation $\mathbf{x}_i \in \mathbb{R}^{262}$ based on SMPL with $22$ joints: global joint positions, global joint velocities, local joint rotations in $6$D root-relative coordinates, and four foot-contact binary flags. The full motion sequence is $X \in \mathbb{R}^{N \times J \times 3}$, and sequences are typically at $30$ FPS.

The architecture is “dual” in two dimensions. First, it models two persons: symmetric branches for A and B in interactive mode, and a single “reactor” branch for B in reactive mode. Second, it supports two interaction modes: interactive and reactive, implemented by switching Motion Cross-Attention into a causal, look-ahead variant in reactive mode and masking the actor’s input branch.

Conditioning is multi-modal. Text is encoded by CLIP ViT-L/14 embeddings of dimension $768$, passed through a transformer encoder and fused with time-step embeddings to form text latent $Z_d$, which conditions adaptive LayerNorm parameters. Music uses Jukebox embeddings of dimension $4800$ to form music latent $Z_m$. Retrieval augmentation uses top-$k$ exemplars from four databases aligned with LLM-decomposed text and music: DS for Spatial Relationship, DB for Body Movement, DR for Rhythm, and DM for Music. Retrieved signals are mapped to motion latent space and concatenated to form $Z_R$.

The backbone contains $N = 20$ DualFlow blocks. Each block includes multi-scale temporal Conv1d with parallel temporal kernels and strides $7$, $11$, and $21$, followed by GELU and gating; Self-Attention; Music Cross-Attention; Motion Cross-Attention between persons or Causal Cross-Attention with look-ahead $L$ in reactive mode; Retrieval Cross-Attention; residual connections; FlashAttention; and adaptive LayerNorm conditioned by $Z_d$. Motion and conditioning are projected to latent dimension $512$; FFNs use hidden size $1024$; there are $8$ attention heads and dropout $0.1$.

The generative formulation uses rectified flow. For a ground-truth motion sample $x_0$ and Gaussian noise $\epsilon \sim \mathcal{N}(0, I)$, the probability path is the linear interpolation

$$
x(t) = (1 - t)x_0 + t\epsilon,\quad t \in [0,1],
$$

with target constant velocity

$$
v(t) = \epsilon - x_0.
$$

The model learns $v_\theta(x(t), t, c)$ with the flow-matching objective

$$
L_{\mathrm{flow}} = \mathbb{E}_{x_0,\epsilon,t}\left[\left\|v_\theta(x(t), t, c) - (\epsilon - x_0)\right\|_2^2\right].
$$

A contrastive velocity-space triplet loss is added,

$$
L_{\mathrm{triplet}} = \mathbb{E}\left[\max(0, d(v, v^+) - d(v, v^-) + m)\right],
$$

and the contrastive rectified flow loss becomes

$$
L_{\mathrm{CRF}} = L_{\mathrm{flow}} + \lambda_{\mathrm{triplet}} L_{\mathrm{triplet}}.
$$

Geometric and interaction regularization are also used, with total loss

$$
L_{\mathrm{total}} = L_{\mathrm{CRF}} + \lambda_{\mathrm{geo}} L_{\mathrm{geo}} + \lambda_{\mathrm{inter}} L_{\mathrm{inter}}.
$$

The synchronization term is

$$
L_{\mathrm{sync}} = \sum_{j_1,j_2} w_a(j_1, j_2)\cdot w_j(j_1, j_2)\cdot \left\| d_p(j_1, j_2) - d_{gt}(j_1, j_2) \right\|_2^2,
$$

where the weights emphasize spatially close joints and key end-effectors such as hands, feet, and hips.

## 5. Training, evaluation, and ablations in motion generation

The training data comprise InterHuman-AS, an asymmetric extension with actor–reactor labels and approximately $50$K interactions across $11$ action types; DD100, with $100$ duet dance routines paired with music and structure annotations; and MDD, with $10.3$ hours of duet dance motion capture and more than $10$K text annotations [2509.24099]. Training uses classifier-free guidance by jointly masking both modalities $10\%$ of the time and individually masking text or music $20\%$ of the time. Optimization uses Adam with learning rate $2\times 10^{-4}$, weight decay $2\times 10^{-5}$, $1000$ warm-up steps, batch size $32$, $5000$ epochs, cosine learning-rate scheduling, and $200$ flow integration steps. In reactive generation, the look-ahead is $L = 10$ frames.

Evaluation uses FID, Multimodal Distance, R-Precision, Diversity, Multimodality, Beat Echo Degree, and Beat-Alignment Score. On MDD interactive text+music generation, DualFlow (Both) reports $\mathrm{R\text{-}Prec@3}=0.513$, $\mathrm{MMDist}=0.513$, $\mathrm{FID}=0.415$, Diversity $=1.392$, BAS $=0.179$, and BED $=0.286$. The paper states reported gains versus prior state of the art of $2.5\%$ FID, $76\%$ R-precision, and $3\times$ in Multimodal Distance for the interactive task on MDD.

On MDD reactive generation, DualFlow (Both) reports FID $=0.686$, MMDist $=1.056$, $\mathrm{R\text{-}Prec@3}=0.471$, BAS $=0.226$, and BED $=0.215$, with reported gains versus prior state of the art of $1.7\%$ FID, $2.5\times$ R-precision, and $2\times$ Multimodal Distance. On InterHuman-AS interactive text-only generation, DualFlow reports $\mathrm{R\text{-}Prec@1/2/3}=0.437/0.558/0.681$, MMDist $=4.394$, Multimodality $=2.729$, and FID $=6.296$. On DD100 reactive generation, it reports FIDk $=19.22$, FIDg $=28.85$, FIDcd $=5.57$, Divk $=11.01$, Divgt $=7.35$, BAS $=0.211$, and BED $=0.276$.

The ablation studies assign importance to several components. Removing RAG or the triplet loss harms R-Precision, MMDist, and FID in both tasks. Removing $L_{\mathrm{sync}}$ degrades inter-person coordination and rhythmic scores. Replacing Jukebox with spectral features reduces performance. In reactive generation, replacing Causal Look-Ahead Attention with regular cross-attention worsens FID and alignment; the cited example is DualFlow without CLA at FID $0.849$ versus $0.686$. Shallower architectures, single temporal convolution, or smaller latent dimensions each produce consistent drops.

The paper attributes part of the behavior to rectified flow itself: straight-line deterministic transport reduces step count and avoids per-step stochastic noise addition, which is argued to lower error accumulation and latency. It also notes limitations and failure cases: rare or highly complex interaction styles can reduce contact accuracy or stylization, very long horizons may drift without additional anchors, and domain gaps in music genres or unconventional textual phrasing can reduce retrieval precision.

## 6. DualFlow Perception in streaming object detection

In StreamYOLO, DualFlow is a lightweight FPN-level module for next-frame detection under streaming perception evaluation. The underlying setting differs from standard offline video detection because predictions computed from frame $F_t$ are evaluated against the world state at a later instant. For real-time detectors with processing time less than the frame period $\Delta$, the alignment becomes a one-frame lookahead, $A(t)=t+1$, and the unified metric is streaming AP, or sAP, averaged over IoU thresholds from $0.5$ to $0.95$ [2203.12338].

The detector is based on YOLOX with CSPDarknet-53 as backbone, PANet as neck, and decoupled detection heads. DualFlow Perception is inserted after the FPN to fuse the last and current frame features at each pyramid level before classification, objectness, and regression heads. It contains two paths.

The dynamic flow path takes same-level FPN features from $F_{t-1}$ and $F_t$. Each is reduced to half the channels by a shared $1\times 1$ convolution followed by BN and SiLU, then concatenated:

$$
F^{\mathrm{dyn},\ell}_t = [h(X^\ell_{t-1}), h(X^\ell_t)],\quad
h(\cdot)=\mathrm{SiLU}(\mathrm{BN}(\mathrm{Conv}_{1\times1}(\cdot))).
$$

The static flow path simply preserves the current-frame feature:

$$
F^{\mathrm{stat},\ell}_t = X^\ell_t.
$$

Fusion is residual addition:

$$
F^\ell_t = F^{\mathrm{stat},\ell}_t + F^{\mathrm{dyn},\ell}_t.
$$

The detector is trained directly for one-step lookahead prediction using triplets $(F_{t-1}, F_t, G_{t+1})$, so that $\hat{Y}_{t+1} = H(\mathrm{DFP}(F_{t-1}, F_t))$ is evaluated against $G_{t+1}$. The method explicitly avoids optical flow, warping, deformable alignment, and recurrent state; motion trend is learned implicitly from concatenated adjacent-frame features.

Trend-Aware Loss reweights the regression loss according to inter-frame motion. For each ground-truth box at time $t+1$, the best IoU with boxes at time $t$ is

$$
mIoU_i = \max_j \mathrm{IoU}(box^{t+1}_i, box^t_j).
$$

Given threshold $\tau$ and constant $\nu>1$, the unnormalized trend factor is

$$
\omega_i =
\begin{cases}
1/mIoU_i, & mIoU_i \ge \tau,\\
1/\nu, & mIoU_i < \tau.
\end{cases}
$$

To preserve loss scale, the normalized factor is

$$
\hat{\omega}_i = \omega_i \cdot \frac{\sum_{i=1}^N L^{reg}_i}{\sum_{i=1}^N \omega_i L^{reg}_i},
$$

and the final loss is

$$
L_{total} = \sum_{i \in positive} \hat{\omega}_i L^{reg}_i + L_{cls} + L_{obj}.
$$

Grid search found $\tau=0.3$ and $\nu=1.4$ to be effective.

The training set is Argoverse-HD with center RGB camera only at $30$ FPS, following the Streamer split; validation has $24$ videos totaling approximately $15$k frames. The model is fine-tuned from COCO-pretrained YOLOX for $15$ epochs on $8\times$ GTX 2080 Ti with batch size $32$, SGD momentum $0.9$, weight decay $0.0005$, learning rate $0.001 \times \mathrm{BatchSize}/64$, cosine schedule, and $1$-epoch warm-up. No augmentation is used because adjacent frames must be aligned. At inference, the method caches FPN features from the previous frame; for the first frame, the current features are duplicated as pseudo-history.

Quantitatively, for YOLOX-L at $600\times 960$, the baseline streaming detector reports sAP $=31.2$, $\mathrm{sAP}_{50}=54.8$, and $\mathrm{sAP}_{75}=29.5$. A basic next-frame prediction pipeline adds $+3.0$ sAP to reach $34.2$. DFP alone adds $+1.3$ to reach $35.5$, TAL alone adds $+0.9$ to reach $35.1$, and DFP with TAL reaches $36.1$ sAP, $\mathrm{sAP}_{50}=57.6$, and $\mathrm{sAP}_{75}=35.6$, which is a $+4.9$ improvement over baseline. Under $2\times$ speed re-sampling, baseline sAP is $24.9$, the basic pipeline reaches $31.3$, DFP reaches $32.9$, and DFP with TAL reaches $33.3$.

Latency remains close to the original detector. Reported per-frame latency on Tesla V100 for YOLOX-L at $600\times 960$ is $18.23$ ms for baseline and $18.98$ ms for FPN-level concatenation plus residual, compared with $26.11$ ms for non-local and $24.32$ ms for spatial transformer. Relative to Kalman Filter forecasting, StreamYOLO adds approximately $0.8$ ms versus approximately $3.11$ ms while obtaining higher sAP.

## 7. Comparative interpretation

Across these three works, the name DualFlow consistently denotes an explicit decomposition into two coordinated processes, but the technical meaning of “flow” differs substantially. In adversarial attacks, flow is literal ODE transport over image distributions, with a pretrained forward velocity and a learned reverse adversarial velocity [2502.02096]. In two-person motion generation, flow refers to rectified-flow generative transport from Gaussian noise to motion sequences, while “dual” also names the two-person and two-mode structure [2509.24099]. In streaming detection, flow is an architectural metaphor for two feature streams, one dynamic and one static, rather than a diffusion- or ODE-based generative process [2203.12338].

Their optimization targets are likewise distinct. The adversarial framework minimizes targeted cross-entropy on clipped reconstructions inside an $L_\infty$ ball. The motion-generation framework matches a rectified-flow velocity field and augments it with triplet, geometric, interaction, and synchronization losses. The streaming-detection framework optimizes next-frame detection with trend-aware reweighting of the regression term under streaming alignment. Their evaluation metrics also occupy different regimes: ASR for transfer attacks, FID and alignment metrics for motion synthesis, and sAP for low-latency perception.

A plausible implication is that the shared label should not be treated as identifying a single methodological family. For literature retrieval, implementation, or citation, the arXiv identifier is therefore essential: [2502.02096] for multi-target adversarial attacks, [2509.24099] for multi-modal 3D motion generation, and [2203.12338] for streaming perception.

Source: https://www.emergentmind.com/topics/dualflow