FIA-Flow in Privacy & Metabolomics

• FIA-Flow is an integrated workflow that enables high-fidelity image inversion in split DNN attacks and robust FIA-HRMS data preprocessing in metabolomics.
• In deep neural networks, FIA-Flow employs latent feature space alignment and deterministic inversion flow matching to accurately reconstruct input images and demonstrate privacy vulnerabilities.
• In FIA-HRMS preprocessing, FIA-Flow automates noise estimation, peak detection, alignment, and matrix-effect diagnostics, ensuring rapid and reliable quantification.

FIA-Flow is a term used for distinct, high-impact workflows in both deep learning privacy attacks and mass spectrometry data preprocessing. In the context of split deep neural networks (DNNs), FIA-Flow refers to a black-box feature inversion attack pipeline that efficiently reconstructs high-fidelity input images from leaked intermediate features, demonstrating severe privacy vulnerabilities in collaborative inference environments. Independently, in metabolomics, FIA-Flow describes a robust preprocessing workflow (as implemented in the proFIA package) for flow injection analysis coupled to high-resolution mass spectrometry (FIA-HRMS), automating noise modeling, peak detection, alignment, and quantification with matrix-effect diagnostics. Both uses share an emphasis on extracting accurate latent structures from high-dimensional, noisy data streams, albeit for different scientific and security goals.

1. FIA-Flow in Split DNN Privacy Attacks

FIA-Flow is designed to expose the privacy risks inherent in split DNN architectures, where the edge device transmits intermediate activation features to a cloud server (Ren et al., 19 Nov 2025). The core challenge addressed by FIA-Flow is reconstructing the original input $x$ from the leaked feature $f=M(x)$, where $M$ is the unknown edge submodel. FIA-Flow is a two-stage, decoupled feature inversion pipeline:

• Stage 1: Latent Feature Space Alignment Module (LFSAM) LFSAM maps $f$ to a coarsely aligned latent $z_s$ in the decoder’s VAE latent space $\mathcal Z$. The architecture combines pixel shuffle upsampling, a U-Net backbone, and a feature aggregation network, learning via latent $\ell_2$ and image-domain $\ell_1$ losses against matched encoder latents $z_x=\mathrm{Enc}(x)$ and reconstructions.
• Stage 2: Deterministic Inversion Flow Matching (DIFM) DIFM corrects distributional mismatch by learning a deterministic vector field $v_\theta(z,t)$ that flows $z_s$ to the manifold region $\mathrm{supp}(p(z_x))$ with a single Euler step. The probability-flow ODE is used for training, with flow-matching and reconstruction losses.

This pipeline enables faithful, semantically aligned image reconstruction even with limited training data (≤4096 pairs) and without knowledge of $M$, provided the VAE architecture is accessible.

2. FIA-Flow in FIA-HRMS Data Preprocessing

In FIA-HRMS metabolomics, FIA-Flow refers to the complete automated preprocessing methodology implemented in the proFIA package (Delabrière et al., 2017). The pipeline processes raw mass spectrometry files in six stages:

1. Noise estimation: Observed intensity $I(t)=S(t)+B(t)+\varepsilon(t)$, with empirical modeling of heteroscedastic noise variance $V(I)$ via loess regression on binned residuals.
2. Peak detection and quantification: Matched filtering with an Exponentially-Modified Gaussian (EMG) $P(t)$ and explicit matrix-effect modeling $ME_i(P)$; peak boundaries are detected by convolution and local maxima refinement, baseline-corrected area $\widehat E$ quantified and statistically filtered.
3. Peak grouping (alignment): Hierarchical m/z-band clustering within files, followed by kernel density estimation and assignment of band masses across samples, supporting mass-tolerance parameterization.
4. Missing-value imputation: Truncated-normal kNN approach (KNN-TN) and optional missForest regression used for non-detected or low-intensity values.
5. Matrix-effect indicator: Pearson correlation $\rho_{f,s}$ between each feature's peak shape and reference injection profile; low values (<0.2) flag matrix-suppressed features.
6. Parameter-selection guidance: Instrument mass resolution guides settings for mass tolerances ("ppm", "dmz") and grouping widths.

This workflow achieves high detection (precision 96%, recall 98%) and enables robust quantification for large-scale metabolomics.

3. Mathematical Formalization and Algorithmic Structure

FIA-Flow in DNN Privacy Attacks

• Forward mapping:

$G(f) = \mathrm{Dec}\bigl(G_{\mathrm{refine}(G_{\mathrm{align}(f))}\bigr) = x'$

• Flow-matching vector field:

$v_\theta(z,t)\approx z_x - z_s$

• Optimization objectives:

$$\mathcal L_{\mathrm{s1}} = \mathbb E[\|z_s-z_x\|_2^2 + \|\mathrm{Dec}(z_s)-x\|_1]$$

$$\mathcal L_{\mathrm{s2}} = \mathcal L_{\mathrm{fm}} + \mathcal L_{\mathrm{rec}}$$

• Privacy-leakage metrics:
  • LVLM-Consistency (LVLM-C): Measures whether LVLM-generated descriptions for $x$ and $x'$ refer to the same object.
  • LVLM-Privacy-Leakage (LVLM-PL): BERTScore between LVLM descriptions.

FIA-Flow in FIA-HRMS Preprocessing

• Noise model:

$$I(t) = S(t) + B(t) + \varepsilon(t), \quad \varepsilon(t) \sim \mathcal N(0,V(I(t)))$$

• EMG profile for injection modeling:

$$P(t) = \frac{\lambda}{2}\exp\left[\frac{\lambda}{2}(2\mu+\lambda\sigma^2-2t)\right]\mathrm{erfc}\left(\frac{\mu+\lambda\sigma^2-t}{\sqrt2\sigma}\right)$$

• Statistical solvent test:

$p = \mathrm{P}(\mathcal N(0,\Sigma^2)>\widehat E)$

• Feature intensity:

$$A = \max\{\widehat E,0\} \quad \text{if } p < p_{\rm cutoff}$$

• Matrix-effect indicator:

$$\mathrm{ME\_ind}(f) = \frac{1}{S}\sum_{s=1}^S \rho_{f,s}$$

4. Empirical Results and Comparative Performance

FIA-Flow (DNN)

FIA-Flow achieves state-of-the-art inversion fidelity across victim models and split layers, outperforming SG-DIP and FIA-Align baselines in PSNR, SSIM, LPIPS, and top-1 accuracy. For example, on ResNet-50 (L1-2):

Method	PSNR↑	SSIM↑	LPIPS↓	Acc (%)↑	LVLM-C↑	LVLM-PL↑
SG-DIP	27.90	0.754	0.193	65.2	65.3	0.922
FIA-Align	29.86	0.810	0.157	64.3	70.0	0.923
FIA-Flow	30.01	0.814	0.100	71.3	70.1	0.929

FIA-Flow maintains strong performance under privacy defenses, with Acc ≈60% and PSNR 26–28 dB.

FIA-Flow (FIA-HRMS)

proFIA preprocessing yields precision of 96% and recall of 98% on metabolomics testbeds (including spiked serum datasets). Preprocessing per raw file requires less than 15 seconds. Robust feature alignment and matrix-effect diagnostics support high-throughput phenotyping.

5. Limitations, Implications, and Countermeasures

DNN Privacy Attacks

• Requires proxy dataset for training (<0.32% of ImageNet-1K, i.e., ≤4096 pairs).
• Assumes attacker has access to the victim VAE architecture.
• Standard split DNN attack model: attacker queries split layer activations.

Effective defenses include activation obfuscation (random projections, channel shuffling), NoPeek-style training constraints, noise/quantization, secure activation encryption, and privacy-aware split design. High privacy leakage is possible even for deep layers, motivating urgent countermeasures.

FIA-HRMS Preprocessing

• Parameter tuning is governed by instrument mass resolution.
• Matrix effects may reduce quantification fidelity for selected features.
• Approaches for alignment and imputation are robust across standard sample sets.

Matrix-effect diagnostics (ME_ind) assist in prioritizing reliable features. Parameter settings (ppm, dmz) and grouping tolerances can be directly inferred from hardware specifications.

6. Context and Impact Across Application Domains

FIA-Flow represents substantive advances in both data-efficient feature inversion for security-critical AI applications and automated quantification in high-throughput metabolomics. In DNNs, FIA-Flow reveals that intermediate layer activations are far more privacy-compromising than previously assumed, with quantitative and qualitative evidence of meaningful semantic leakage. In mass spectrometry, FIA-Flow (proFIA) removes the need for liquid chromatography separation, achieving efficient, reliable extraction of quantitative features, and enabling deeper biological insights.

This suggests that "FIA-Flow" epitomizes the use of flow-guided, distributionally grounded mappings to transform latent data streams into actionable information, regardless of whether the context is security analytics or bioinformatics.