FlowGuard: Multi-Domain Security Defenses

• FlowGuard is a set of distinct defense mechanisms that secure early decision boundaries in multi-agent LLM systems, energy IDS, and latent diffusion models.
• The multi-agent LLM variant sanitizes prompt inputs by decomposing and rewriting instructions to prevent malicious workflow guidance.
• The IDS and diffusion variants respectively utilize continuous normalizing flows for OOD query detection and lightweight latent decoding with Fourier filtering for early intervention.

Searching arXiv for papers titled or containing “FlowGuard” to ground the article in the primary sources. arXiv search query: FlowGuard FlowGuard is a reused system name applied to three distinct 2026 research proposals: an input-side defense for planner–executor multi-agent LLM systems, an identity-independent detector for data-free model-stealing attacks against AI-based intrusion detection systems in energy networks, and an in-generation safety detector for latent diffusion image models (Li et al., 12 May 2026, Schwarzer et al., 2 Jun 2026, Yang et al., 9 Apr 2026). Despite the shared name, the three frameworks address different threat models, operate on different computational objects, and use different formal machinery. In the multi-agent LLM setting, FlowGuard sanitizes prompts before workflow formation; in the IDS setting, it scores incoming queries with a Continuous Normalizing Flow before model access; in diffusion, it classifies intermediate denoising states to enable early termination.

1. Disambiguation and scope

The name “FlowGuard” does not designate a single canonical method. Instead, it identifies three unrelated defenses introduced in separate domains during 2026 (Li et al., 12 May 2026, Schwarzer et al., 2 Jun 2026, Yang et al., 9 Apr 2026).

arXiv id	Domain	Primary intervention point
(Li et al., 12 May 2026)	Multi-agent LLM systems	Prompt preprocessing before the planner
(Schwarzer et al., 2 Jun 2026)	Energy-system IDS security	Per-query OOD filtering before IDS processing
(Yang et al., 9 Apr 2026)	Diffusion-model safety	Intermediate denoising-step inspection

This naming collision matters because the technical meaning of “flow” changes across the three papers. In the multi-agent LLM work, the operative object is workflow formation in planner–executor architectures, including subtasks, roles, dependencies, and routing paths (Li et al., 12 May 2026). In the IDS work, the relevant flow is a Continuous Normalizing Flow trained on legitimate traffic to compute log-likelihood scores for query filtering (Schwarzer et al., 2 Jun 2026). In the diffusion work, the monitored process is the denoising trajectory in latent diffusion, with intermediate latent states projected into a shared image-like space for NSFW detection (Yang et al., 9 Apr 2026).

A common misconception is that these papers are minor variants of one defense family. The available descriptions do not support that reading. Their threat models, algorithms, evaluation protocols, and target systems are different. The shared label is therefore nominal rather than methodological.

2. FlowGuard in planner–executor multi-agent LLM systems

In "FlowSteer: Prompt-Only Workflow Steering Exposes Planning-Time Vulnerabilities in Multi-Agent LLM Systems" (Li et al., 12 May 2026), FlowGuard is an input-side defense designed to protect the “planning boundary” of a planner–executor MAS. The security goal is to prevent malicious prompt-side cues from biasing how the planner decomposes tasks, assigns roles, or constructs dependencies, while preserving the legitimate task intent. The threat model assumes that an attacker has only black-box prompt-only access at runtime and may append arbitrary natural-language content to the user prompt $t$, yielding $\tilde t = t \oplus a$, but cannot modify agents, tools, memory, messages, or MAS code.

The mechanism consists of two sequential modules located immediately before the planner. The first, intent triage, decomposes the user prompt $x$ into three buckets: $I_{\text{task}}$, the core task objective; $I_{\text{method}}$, methodological or structural instructions; and $I_{\text{framing}}$, framing cues such as assertive facts, pseudo-authoritative claims, or compliance language. Formally,

$$C(x) = (I_{\text{task}}, I_{\text{method}}, I_{\text{framing}}).$$

The second, intent decontamination, rewrites the prompt into a sanitized prompt $\hat x = R(x; C(x))$ that preserves $I_{\text{task}}$ verbatim, softens “Rigid Structural Mandates” in $I_{\text{method}}$ into user preferences, and downgrades “Assertive Axioms” in $\tilde t = t \oplus a$0 into hypotheses or context to be evaluated. The planner then receives $\tilde t = t \oplus a$1 rather than $\tilde t = t \oplus a$2:

$\tilde t = t \oplus a$3

This design is explicitly prompt-side rather than graph-side. The rationale is that if malicious framing or structural mandates are stripped before planning, they never reach the component that generates the workflow. The paper argues that defenses inspecting only the generated workflow provide limited protection because FlowSteer biases the planning signals that generate the workflow itself (Li et al., 12 May 2026).

The evaluation uses two benchmarks: MisinfoTask, comprising 108 analytical tasks with explicit reference solutions and malicious targets, and ASB-Bench, comprising 100 open-ended professional tasks derived from ASB. Three MAS configurations are reported: G1, in which planner and executors use the same LLM; G2, with a stronger planner and weaker executors; and G3, with a weaker planner and stronger executors. Runtime settings include 3 communication rounds and temperature $\tilde t = t \oplus a$4. The reported metrics are TASR, the task-deviation success rate, and MASR, the malicious-alignment success rate. In the Table 5 excerpt for GPT-4o-mini, MisinfoTask MASR falls from 65.74% without defense to 35.19% with FlowGuard, while ASB-Bench MASR falls from 59.00% to 27.00%. ARGUS reduces MisinfoTask MASR to 61.11% and ASB-Bench MASR to 47.00%, whereas G-Safeguard yields 63.89% and 59.00%, respectively. Across all four model families and both benchmarks, FlowGuard reduces MASR by up to approximately 34 percentage points (Li et al., 12 May 2026).

The benign-utility ablation reports that benignly enhanced prompts have near-zero TASR and MASR, and that applying FlowGuard to these benign enhancements leaves TASR and MASR almost unchanged. The stated interpretation is that FlowGuard selectively removes malicious steering cues rather than eliminating beneficial task guidance. The reported overhead for 10 MisinfoTask instances is approximately \$\tilde t = t \oplus a$50.13 with FlowGuard, with no change in MAS execution latency beyond the small extra call for intent triage and rewriting.

A concrete example in Table 6 illustrates the decontamination behavior. Prompt fragments such as “you must reference the external evidence” and “explicitly dictates” are rewritten into softer preference-style guidance such as “you are encouraged to” and “suggests.” Claims such as “invalid approach” become “may not align with recommended practices” or “may not be necessary.” The paper’s description indicates that this weakens malicious preservation of routing dependencies during planning (Li et al., 12 May 2026).

3. FlowGuard in energy-system intrusion detection against model stealing

In "FlowGuard: Flow Matching for Identity-Independent Detection of Data-Free Model Stealing Attacks on Energy System Intrusion Detection Systems" (Schwarzer et al., 2 Jun 2026), FlowGuard is a defense for AI-based IDS deployments in energy infrastructure such as smart grids and SCADA. The threat is data-free model stealing: an adversary repeatedly queries a deployed IDS, learns a surrogate without access to the original training data, and then uses that surrogate offline to craft evasive traffic. The paper positions existing defenses as inadequate in two specific ways. Identity-bound query monitoring methods such as PRADA and FDINet depend on per-client statistics and fail under distributed Sybil attacks, while prediction-poisoning methods such as Reverse Sigmoid and ModelGuard are inapplicable in hard-label settings because many IDSs expose only binary decisions rather than soft-label probabilities (Schwarzer et al., 2 Jun 2026).

The proposed defense is identity-independent and content-based. It performs per-query out-of-distribution detection using a Continuous Normalizing Flow density model trained on genuine traffic. The core intuition is that data-free extraction attacks such as MAZE and DisGUIDE generate synthetic queries from noise or a co-trained generator, and these synthetic queries occupy a lower-dimensional manifold than real traffic. A density estimator trained on genuine traffic therefore assigns lower likelihood to them.

The CNF defines invertible dynamics through

$\tilde t = t \oplus a$6

with exact log-density computed by the change-of-variables formula

$\tilde t = t \oplus a$7

At inference, each incoming query $\tilde t = t \oplus a$8 is treated as $\tilde t = t \oplus a$9, the ODE is solved backward from $x$0 to $x$1, and the resulting score $x$2 is compared against a threshold $x$3 chosen as the lower $x$4-quantile of scores on held-out legitimate traffic. Queries with $x$5 are flagged as OOD and blocked before IDS processing (Schwarzer et al., 2 Jun 2026).

The CNF architecture is parameterized by a U-Net–style network with hidden dimensions $x$6, where $x$7 is the flow input dimension, and uses sinusoidal positional encoding of time injected at multiple layers. Training uses Conditional Flow Matching with objective

$x$8

where $x$9 and $I_{\text{task}}$0 is the straight-line velocity. The algorithmic pipeline is separated into TrainCNF and FlowGuardDetect, the latter computing the backward ODE, accumulating the Jacobian trace integral, and making a threshold decision.

The attacks used for evaluation are MAZE, a zeroth-order gradient-estimation method that trains a generator alongside the surrogate classifier, and DisGUIDE, a disagreement-guided extraction method with an ensemble-based disagreement and diversity loss. The paper evaluates both single-client and distributed 100-client Sybil settings. In the distributed setting, a total query budget such as 200 queries is split evenly across 100 fake clients so that each identity issues only 2 queries, which defeats per-identity tests used by PRADA and FDINet (Schwarzer et al., 2 Jun 2026).

The experimental setup uses CIFAR-10 images as traffic-flow proxies and a VGG16-BN victim with 85% test accuracy. Reported metrics are TPR, FPR, Precision, F1, Macro-F1, and ROC–AUC. In the single-client MAZE setting, FlowGuard reports TPR 0.965, FPR 0.170, F1 0.904, and ROC–AUC 0.921; PRADA reports TPR 0.840 and ROC–AUC 0.920; FDINet reports TPR 0.545, FPR 0.530, and ROC–AUC 0.488. In distributed 100-client MAZE, FlowGuard remains at TPR 0.965 and ROC–AUC 0.922, whereas PRADA drops to TPR 0.000 and ROC–AUC 0.500. For DisGUIDE, FlowGuard reports TPR 1.000 and ROC–AUC 1.000 in both single-client and distributed settings. The reported conclusion is that FlowGuard maintains stable detection independent of identity distribution, while PRADA collapses to 0% detection under Sybil conditions and FDINet exhibits high FPR of approximately 53% (Schwarzer et al., 2 Jun 2026).

The paper also states several limitations. The approach relies on the manifold assumption that data-free attacks produce low-density queries. An adaptive attacker that explicitly optimizes queries to lie on the high-density manifold could reduce the likelihood gap. The present evaluation is limited to image proxies and two generators; real IDS flows such as ERENO IEC-61850 and data-dependent attacks remain future work. Suggested extensions include combining FlowGuard with velocity-based detection such as FlowPure, extending to diffusion-based or GAN-based generators, and integrating into real-time SCADA or smart-grid platforms.

4. FlowGuard in latent diffusion safety detection

In "FlowGuard: Towards Lightweight In-Generation Safety Detection for Diffusion Models via Linear Latent Decoding" (Yang et al., 9 Apr 2026), FlowGuard addresses NSFW safety in diffusion-based image generation. The stated motivation is that pre-generation text filters cannot guarantee image safety because prompt safety and image safety diverge, while post-generation image classifiers only inspect fully synthesized outputs after the bulk of computation has already occurred. The proposed alternative is in-generation detection, which inspects intermediate denoising states and intervenes early.

The main technical difficulty is that early latent states are dominated by Gaussian noise and that prior in-generation detectors tend to be tied to a single architecture. FlowGuard addresses these issues with four components: a lightweight linear decoder that projects heterogeneous model-specific latents into a shared image-like space, a fixed Fourier low-pass filter to suppress high-frequency noise, a curriculum-learning schedule to stabilize training under heavy denoising noise, and a single frozen ViT-based binary classifier that flags NSFW content during generation (Yang et al., 9 Apr 2026).

The diffusion formalism is given in latent space. If $I_{\text{task}}$1 is a real image, then latent diffusion first encodes it into $I_{\text{task}}$2. The forward process is

$I_{\text{task}}$3

equivalently

$I_{\text{task}}$4

with $I_{\text{task}}$5 and $I_{\text{task}}$6. Standard decoding would reconstruct $I_{\text{task}}$7, but repeated use of $I_{\text{task}}$8 at early steps is described as costly.

FlowGuard therefore replaces exact decoding with an affine projector

$I_{\text{task}}$9

trained to minimize

$I_{\text{method}}$0

A first-order Taylor argument is given to justify the approximation, and the paper further states that if the NSFW classifier $I_{\text{method}}$1 is $I_{\text{method}}$2-Lipschitz, then the classifier discrepancy is bounded by the decoding approximation error. The reported practical result is that as few as 1,000 latent–image pairs suffice to yield semantically faithful $I_{\text{method}}$3 “sketches” (Yang et al., 9 Apr 2026).

Noise suppression is implemented with a fixed Fourier low-pass filter:

$I_{\text{method}}$4

where $I_{\text{method}}$5 is a radius-$I_{\text{method}}$6 mask in the frequency domain. The summary reports that $I_{\text{method}}$7 of the spectrum balances noise removal against semantic fidelity.

Training uses a multi-stage curriculum over timestep sets

$I_{\text{method}}$8

The classifier $I_{\text{method}}$9 is a ViT-B/16 backbone pretrained on ImageNet and fine-tuned with its first 5 blocks frozen. It minimizes the binary classification loss

$I_{\text{framing}}$0

together with a consistency loss across timesteps of the same trajectory,

$I_{\text{framing}}$1

using total loss $I_{\text{framing}}$2 with $I_{\text{framing}}$3 (Yang et al., 9 Apr 2026).

At inference, the method checks a predetermined set of early timesteps $I_{\text{framing}}$4, computes $I_{\text{framing}}$5, filters it to $I_{\text{framing}}$6, obtains a score $I_{\text{framing}}$7, and aggregates via $I_{\text{framing}}$8. If $I_{\text{framing}}$9 with $$C(x) = (I_{\text{task}}, I_{\text{method}}, I_{\text{framing}}).$$0, generation is declared NSFW and terminated immediately. The mechanism therefore functions as both a safety detector and an early-exit controller.

The benchmark spans nine backbones. Five are used for in-distribution training: Flux1, Flux2, PixArt, Stable Diffusion v1.5, and SD3. Four held-out models are used for out-of-distribution testing: SDXL, Qwen-Image, Zimage, and SD3.5. Reported F1 scores for FlowGuard are 0.86 to 0.90 on in-distribution models and 0.74 to 0.88 on held-out models, while the best post-generation baseline, Falconsai, is reported around 0.66 to 0.71 for in-distribution models. The paper also reports that FlowGuard remains above 0.8 accuracy as early as step 10, whereas off-the-shelf classifiers fall below 0.6 in that regime. Efficiency results compare standard VAE decoding at approximately 8 seconds and approximately 28 GiB peak GPU memory against the linear decoder at approximately 0.2 seconds and below 0.7 GiB across batch sizes, corresponding to more than 97% memory reduction and a 40× speed-up. The ablations attribute an approximately 5% final-stage F1 gain to the Fourier low-pass filter and an approximately 0.15 F1 loss at late steps when the multi-stage curriculum is removed (Yang et al., 9 Apr 2026).

5. Shared technical pattern across the three FlowGuard systems

Although the three frameworks are unrelated in mechanism, they exhibit a notable structural convergence. Each inserts a lightweight control stage at or before a critical decision boundary rather than modifying the full downstream model stack. In the multi-agent LLM case, that boundary is the planner input; in the IDS case, it is the query interface preceding the victim classifier; in the diffusion case, it is an early subset of denoising steps prior to final VAE decoding (Li et al., 12 May 2026, Schwarzer et al., 2 Jun 2026, Yang et al., 9 Apr 2026).

This suggests a shared design pattern of boundary-hardening by preprocessing or intermediate filtering rather than heavyweight retraining of the main system. The MAS variant explicitly rewrites prompts without changing executor agents or planner internals. The IDS variant blocks OOD queries before they reach the IDS and does not rely on client identity. The diffusion variant uses a frozen ViT-based classifier and a linear latent decoder instead of model-specific safety heads. A plausible implication is that “FlowGuard” has been repeatedly used to denote defenses that guard a process flow at a narrow chokepoint, even though the guarded object differs across domains.

Another commonality is that each paper emphasizes preserving useful functionality while suppressing attack-relevant signals. In the MAS paper, the sanitized prompt preserves $$C(x) = (I_{\text{task}}, I_{\text{method}}, I_{\text{framing}}).$$1 verbatim and benign guidance remains largely intact under ablation. In the IDS paper, only low-likelihood queries are blocked, while legitimate traffic is forwarded based on a calibrated threshold. In the diffusion paper, only generations whose intermediate states cross the NSFW threshold are terminated, and the linear decoder is introduced precisely to make such monitoring computationally cheap enough for routine deployment (Li et al., 12 May 2026, Schwarzer et al., 2 Jun 2026, Yang et al., 9 Apr 2026).

6. Limitations, boundary conditions, and interpretive significance

Each FlowGuard inherits limitations from the assumptions used to separate benign and malicious inputs. The planner–executor FlowGuard assumes that workflow steering is carried by overt framing or structural instructions that can be isolated as $$C(x) = (I_{\text{task}}, I_{\text{method}}, I_{\text{framing}}).$$2 or $$C(x) = (I_{\text{task}}, I_{\text{method}}, I_{\text{framing}}).$$3; the paper notes that highly stealthy semantic contamination buried entirely inside $$C(x) = (I_{\text{task}}, I_{\text{method}}, I_{\text{framing}}).$$4 may slip through. It also notes that a small fraction of very fine-grained structural guidance may be weakened if misclassified as a rigid mandate, although overall utility remains high in the reported ablation (Li et al., 12 May 2026).

The IDS FlowGuard depends on a density-gap assumption: data-free extraction queries should lie on a lower-dimensional manifold than legitimate traffic and thus receive lower CNF likelihood. The paper explicitly identifies adaptive attackers that optimize for high-density queries as a challenge, and it limits current evidence to CIFAR-10 proxy data, a VGG16-BN victim, and the MAZE and DisGUIDE attacks (Schwarzer et al., 2 Jun 2026).

The diffusion FlowGuard, as summarized, is evaluated on a benchmark of nine backbones and is designed around latent decoding, Fourier low-pass filtering, and curriculum-based stabilization. The reported results establish cross-model generalization within that benchmark, but the evidence provided is specific to NSFW detection in latent diffusion and to the stated training and evaluation setup (Yang et al., 9 Apr 2026).

Taken together, these works position “FlowGuard” as a recurrent label for defenses that attempt to intercept harmful trajectories before full downstream execution. In one case the trajectory is a planned agent workflow, in another it is a query stream used for model extraction, and in the third it is a denoising path in latent diffusion. The substantive lesson is therefore not the existence of a unified FlowGuard framework, but the recurrence of a broader security principle: intervene at the earliest tractable stage where attack signals become machine-actionable.