Stable-GFN: Stability in Fluid Networks & GFlowNets

Updated 4 July 2026

Stable-GFN is a context-dependent term that spans strict fluid network models and GFlowNet frameworks, employing concepts like Lyapunov stability and state-dependent verification.
The approach integrates specialized training methods such as reference flows, Trajectory Balance stabilization, and contrastive objectives to manage optimization loss and enhance fidelity.
Its applications range from theoretical stability analysis in fluid networks to practical implementations in materials sampling and LLM red-teaming, demonstrating diverse operational impact.

Stable-GFN (S-GFN) is not a single universally fixed designation. In the fluid-network literature it denotes, informally, a stable strict generic fluid network model admitting a state-dependent Lyapunov function (Schönlein et al., 2011). In recent GFlowNet research it names at least two explicit training frameworks: “Stable GFlowNets with Probabilistic Guarantees,” which stabilizes Trajectory Balance by reference flow and TV certificates (Lei et al., 3 May 2026), and “Stable-GFlowNet,” a red-teaming framework that replaces partition-function estimation with contrastive trajectory balance and adds masking and fluency filtering (Kwon et al., 1 May 2026). The same label is also used informally for stability-focused GFlowNets whose rewards prefer low-energy objects, as in crystal generation and Boltzmann conformational sampling (AI4Science et al., 2023, Volokhova et al., 15 Jul 2025). Accordingly, the meaning of S-GFN depends on whether “stability” refers to Lyapunov stability, optimization stability, or thermodynamic stability.

1. Nomenclature and scope

The literature uses the label in several technically distinct ways. In one lineage, GFN means generic fluid network, not Generative Flow Network; in another, it denotes a family of reward-proportional generative models on DAGs. This suggests that “Stable-GFN” is best treated as a context-dependent term rather than a single canonical method.

Usage	Meaning of “stability”	Representative source
Stable strict GFN model	Stability of fluid-network paths; state-dependent Lyapunov characterization	(Schönlein et al., 2011)
Stable GFlowNets	Stability of GFlowNet optimization with probabilistic TV guarantees	(Lei et al., 3 May 2026)
Stable-GFlowNet	Stable and robust LLM red-teaming training	(Kwon et al., 1 May 2026)
Stability-focused GFlowNet	Sampling low-energy crystals or conformations	(AI4Science et al., 2023, Volokhova et al., 15 Jul 2025)

A further source of ambiguity is the proximity of the acronym to graph neural flow work. The paper “Lyapunov Stable Graph Neural Flow” explicitly states that it does not introduce the acronym “Stable-GFN” or “S-GFN”; its own terms are IL-GNN and FL-GNN (Chu et al., 13 Mar 2026). That distinction matters, because graph neural flows and GFlowNets solve different problems even when both are phrased in terms of “flow.”

2. Stable strict GFN models in fluid-network theory

In the earliest usage represented here, a GFN model is a nonempty set $\mathcal{Q}$ of paths $Q(\cdot):\mathbb{R}_+\to\mathbb{R}^K_+$ satisfying Lipschitz, scaling, and shift properties, with closed GFN models additionally satisfying closedness under uniform convergence on compact sets (Schönlein et al., 2011). Stability is defined by the existence of $T>0$ such that

$Q(T+\cdot)\equiv 0$

for every path $Q(\cdot)\in\mathcal{Q}(1)$ , where $\mathcal{Q}(1)$ denotes paths with unit initial norm. The paper shows that this is equivalent to asymptotic stability of the zero path in the Lyapunov sense.

The central obstruction in general closed GFN models is that path-wise decay functionals do not automatically yield a state-dependent Lyapunov function. The candidate

$V(x):=\sup_{Q(\cdot)\in\mathcal{Q}_x}\int_0^\infty \|Q(s)\|\,ds$

is well-defined and upper semicontinuous for stable closed GFN models, but counterexamples show that it need not be lower semicontinuous, and concatenations of admissible paths need not remain admissible (Schönlein et al., 2011). Those failures block a general converse Lyapunov theorem.

To restore a state-dependent theory, the paper introduces strict GFN models by augmenting closed GFNs with two additional conditions: concatenation and lower semicontinuity of the set-valued map $x\mapsto \mathcal{Q}_x|_{[0,T]}$ . For stable strict GFNs, the same $V$ becomes continuous, and the main converse theorem states that a strict GFN model is stable if and only if it admits a Lyapunov function in the sense of Definition 2.5, with the explicit construction above (Schönlein et al., 2011). The comparison functions can be chosen as

$\omega_1(r)=\frac{r^2}{2L},\qquad \omega_2(r)=r^2(1+LT)T,\qquad \omega_3(r)=r.$

The paper further shows that general work-conserving fluid networks and priority fluid networks define strict GFN models, so each is stable if and only if it admits a continuous Lyapunov function (Schönlein et al., 2011). By contrast, for linear Skorokhod problems the lower semicontinuity property is not established, and the result is only an upper semicontinuous Lyapunov function. In this lineage, what is informally called S-GFN is therefore not a new algorithmic variant but a strengthened structural class of fluid-network models for which converse Lyapunov theory becomes state dependent.

3. Stability-targeted GFlowNets in materials and molecular sampling

A different usage treats S-GFN as a stability-focused GFlowNet: a model whose reward is constructed from an energy or energy proxy so that low-energy objects are sampled more often. The crystal-generation paper does not use the term “Stable-GFN” explicitly, but it states that Crystal-GFN is essentially a “stability-targeted” GFlowNet for crystals (AI4Science et al., 2023). Crystal-GFN generates a crystal structure $Q(\cdot):\mathbb{R}_+\to\mathbb{R}^K_+$ 0 sequentially by choosing a space group, constructing a composition, and sampling lattice parameters, with terminal sampling distribution satisfying

$Q(\cdot):\mathbb{R}_+\to\mathbb{R}^K_+$ 1

Its reward is a Boltzmann transformation of predicted formation energy per atom,

$Q(\cdot):\mathbb{R}_+\to\mathbb{R}^K_+$ 2

with $Q(\cdot):\mathbb{R}_+\to\mathbb{R}^K_+$ 3, so lower formation energy yields higher reward. The model uses the Trajectory Balance objective, enforces hard constraints by masking invalid actions, and structures the state space as

$Q(\cdot):\mathbb{R}_+\to\mathbb{R}^K_+$ 4

The crystallographic constraints are a defining part of that design. Compatibility among crystal-lattice system, point symmetry, and space group is enforced in the space-group subspace; charge neutrality and Wyckoff compatibility constrain composition actions; and the lattice system implied by the space group imposes equalities such as $Q(\cdot):\mathbb{R}_+\to\mathbb{R}^K_+$ 5 and $Q(\cdot):\mathbb{R}_+\to\mathbb{R}^K_+$ 6 for cubic cells (AI4Science et al., 2023). In the reported setup, the search is restricted to 113 space groups, 12 common elements, max 5 unique elements per composition, and up to 50 total atoms, with the forward and backward policies implemented as 3-layer MLPs with 256 hidden units per layer. Crystal-GFN is trained for 50,000 iterations, with 10% uniformly random actions, 500,000 proxy calls, and approximately 12 hours on CPU. The reported median predicted formation energy of generated crystals is approximately $Q(\cdot):\mathbb{R}_+\to\mathbb{R}^K_+$ 7 eV/atom, and approximately 95% of generated structures have predicted FE $Q(\cdot):\mathbb{R}_+\to\mathbb{R}^K_+$ 8 eV/atom (AI4Science et al., 2023).

A closely related molecular instance is Torsional-GFN, which targets the Boltzmann distribution over torsion angles conditioned on a molecular graph $Q(\cdot):\mathbb{R}_+\to\mathbb{R}^K_+$ 9 and local structure $T>0$ 0 (Volokhova et al., 15 Jul 2025). Conformations are written as $T>0$ 1, with torsions $T>0$ 2, and the target conditional is

$T>0$ 3

The reward is therefore

$T>0$ 4

Torsional-GFN uses a continuous-state GFlowNet with fixed-length trajectories, von Mises mixtures for periodic torsion updates, and a VectorGNN that predicts mixture parameters from graph and geometry. Training is based on the VarGrad objective,

$T>0$ 5

where

$T>0$ 6

Several design choices are explicitly aimed at stable Boltzmann sampling: log-domain training, off-policy learning without importance sampling, 50% $T>0$ 7-greedy exploration with $T>0$ 8, 50% replay-based backward trajectories, and reward-prioritized replay with diversity criterion (Volokhova et al., 15 Jul 2025). The authors also report that training the GNN policy from scratch required considerably more iterations than an MLP per molecule, and therefore pretrain VectorGNN to predict energy and torsion angles from conformations. The reported result is approximate Boltzmann-proportional sampling for multiple molecules with a single model and zero-shot generalization to unseen bond lengths and angles coming from MD simulations (Volokhova et al., 15 Jul 2025). Taken together with Crystal-GFN, this suggests an informal S-GFN interpretation in which “stability” denotes preference for thermodynamically favorable or Boltzmann-weighted states rather than stabilization of the optimizer itself.

4. Stable GFlowNets with probabilistic guarantees

The paper “Stable GFlowNets with Probabilistic Guarantees” formalizes S-GFN as a method for stabilizing GFlowNet optimization while retaining distributional guarantees (Lei et al., 3 May 2026). Its starting point is a sensitivity analysis of standard objectives—Trajectory Balance (TB), Flow Matching, Detailed Balance, and Subtrajectory Balance—showing that a small total variation distance between the learned terminal distribution $T>0$ 9 and the target $Q(T+\cdot)\equiv 0$ 0 does not preclude unbounded training loss. In the regular $Q(T+\cdot)\equiv 0$ 1-ary tree example, changing one leaf reward from $Q(T+\cdot)\equiv 0$ 2 to $Q(T+\cdot)\equiv 0$ 3 leaves

$Q(T+\cdot)\equiv 0$ 4

yet the local training losses scale as $Q(T+\cdot)\equiv 0$ 5 and diverge as $Q(T+\cdot)\equiv 0$ 6 (Lei et al., 3 May 2026). The paper therefore distinguishes global fidelity from local loss spikes.

The converse direction is constructive. For TB, if every trajectory satisfies

$Q(T+\cdot)\equiv 0$ 7

then

$Q(T+\cdot)\equiv 0$ 8

For DB and FM, an analogous result holds with dependence on maximum trajectory length $Q(T+\cdot)\equiv 0$ 9: $Q(\cdot)\in\mathcal{Q}(1)$ 0 The paper also derives a sampling-based certificate: if TB losses are bounded on $Q(\cdot)\in\mathcal{Q}(1)$ 1 trajectories sampled from the target/backward distribution $Q(\cdot)\in\mathcal{Q}(1)$ 2 and $Q(\cdot)\in\mathcal{Q}(1)$ 3 trajectories sampled from the forward policy, then with confidence $Q(\cdot)\in\mathcal{Q}(1)$ 4,

$Q(\cdot)\in\mathcal{Q}(1)$ 5

These are loss-to-TV guarantees: bounded TB loss certifies global distributional fidelity (Lei et al., 3 May 2026).

The algorithmic mechanism used to enforce bounded loss is reference flow. For a trajectory $Q(\cdot)\in\mathcal{Q}(1)$ 6, the target trajectory flow is

$Q(\cdot)\in\mathcal{Q}(1)$ 7

and the augmented flows are

$Q(\cdot)\in\mathcal{Q}(1)$ 8

The augmented TB loss is

$Q(\cdot)\in\mathcal{Q}(1)$ 9

The minimal $\mathcal{Q}(1)$ 0 that caps the absolute log-ratio by $\mathcal{Q}(1)$ 1 is given piecewise in Equation (RF), with $\mathcal{Q}(1)$ 2 whenever the raw TB log-ratio already lies within $\mathcal{Q}(1)$ 3 (Lei et al., 3 May 2026). A fidelity–stability trade-off then follows: $\mathcal{Q}(1)$ 4

Stable-GFN operationalizes these results by maintaining a top- $\mathcal{Q}(1)$ 5 buffer $\mathcal{Q}(1)$ 6 of high-reward terminal states, splitting each batch between forward samples and backward samples from $\mathcal{Q}(1)$ 7, and updating the loss threshold online via

$\mathcal{Q}(1)$ 8

with $\mathcal{Q}(1)$ 9 (Lei et al., 3 May 2026). In the reported experiments, Stable-GFN matches the best baselines on Hypergrid $V(x):=\sup_{Q(\cdot)\in\mathcal{Q}_x}\int_0^\infty \|Q(s)\|\,ds$ 0, achieves the best $V(x):=\sup_{Q(\cdot)\in\mathcal{Q}_x}\int_0^\infty \|Q(s)\|\,ds$ 1 error on Hypergrid $V(x):=\sup_{Q(\cdot)\in\mathcal{Q}_x}\int_0^\infty \|Q(s)\|\,ds$ 2 with $V(x):=\sup_{Q(\cdot)\in\mathcal{Q}_x}\int_0^\infty \|Q(s)\|\,ds$ 3, and on L14-RNA1 attains 3483 / 704 train/test modes, which is the best reported test coverage among the listed baselines (Lei et al., 3 May 2026). In extended experiments, StableTeacher discovers approximately 8,858 of 8,967 modes—approximately 98.8% coverage—while sampling only approximately 5.36% of the end-state space. In this usage, S-GFN is fundamentally an optimization-stability framework for reward-proportional generative training.

5. Stable-GFlowNet for LLM red-teaming

The red-teaming paper uses Stable-GFlowNet (S-GFN) as the explicit name of a framework for generating diverse and robust jailbreak prompts for a safety-aligned victim LLM (Kwon et al., 1 May 2026). The attacker policy $V(x):=\sup_{Q(\cdot)\in\mathcal{Q}_x}\int_0^\infty \|Q(s)\|\,ds$ 4 emits a prompt $V(x):=\sup_{Q(\cdot)\in\mathcal{Q}_x}\int_0^\infty \|Q(s)\|\,ds$ 5, the victim model $V(x):=\sup_{Q(\cdot)\in\mathcal{Q}_x}\int_0^\infty \|Q(s)\|\,ds$ 6 generates a response $V(x):=\sup_{Q(\cdot)\in\mathcal{Q}_x}\int_0^\infty \|Q(s)\|\,ds$ 7, a toxicity classifier $V(x):=\sup_{Q(\cdot)\in\mathcal{Q}_x}\int_0^\infty \|Q(s)\|\,ds$ 8 scores the pair, and the reward is

$V(x):=\sup_{Q(\cdot)\in\mathcal{Q}_x}\int_0^\infty \|Q(s)\|\,ds$ 9

The paper argues that standard TB is unstable in this setting because it requires estimating a single global partition function $x\mapsto \mathcal{Q}_x|_{[0,T]}$ 0 over an enormous combinatorial space and because rewards are noisy. Its solution is Contrastive Trajectory Balance (CTB),

$x\mapsto \mathcal{Q}_x|_{[0,T]}$ 1

which algebraically removes $x\mapsto \mathcal{Q}_x|_{[0,T]}$ 2 by comparing pairs of trajectories rather than regressing each trajectory to $x\mapsto \mathcal{Q}_x|_{[0,T]}$ 3 (Kwon et al., 1 May 2026).

The theoretical claim is exact: if $x\mapsto \mathcal{Q}_x|_{[0,T]}$ 4 for all $x\mapsto \mathcal{Q}_x|_{[0,T]}$ 5 and $x\mapsto \mathcal{Q}_x|_{[0,T]}$ 6 has full support, then

$x\mapsto \mathcal{Q}_x|_{[0,T]}$ 7

Thus CTB preserves the same optimal policy as TB without explicit partition-function estimation (Kwon et al., 1 May 2026). The paper further introduces Noisy Gradient Pruning (NGP),

$x\mapsto \mathcal{Q}_x|_{[0,T]}$ 8

and shows that if the saliency graph $x\mapsto \mathcal{Q}_x|_{[0,T]}$ 9 is connected, the global minimum still satisfies $V$ 0. This is a robustness mechanism against noisy or nearly indistinguishable reward pairs.

A third component, the Min-K Fluency Stabilizer (MKS), addresses reward hacking through gibberish prompts. Using a frozen reference model $V$ 1, the paper defines

$V$ 2

where $V$ 3 is the set of the $V$ 4 least likely tokens in the sequence, and filters rewards by

$V$ 5

This differs from KL regularization because it removes clearly non-fluent sequences without reshaping the target among fluent ones (Kwon et al., 1 May 2026).

The empirical results are reported on Qwen-based attacker and victim models, with Meta-Llama-Guard-3-8B as toxicity classifier. Against the target victim Qwen2.5-1.5B-Instruct, S-GFN achieves UA = 134.00 ± 12.77 and ASR = 92.55 ± 2.87%, whereas GFN-TB yields UA = 17.67 ± 6.51 and ASR = 93.75 ± 4.40%, and PPO yields UA = 3.00 ± 1.00 and ASR = 91.70 ± 2.95% (Kwon et al., 1 May 2026). In the cross-attack defense matrix, a defense trained on S-GFN attacks drives GFN attacks to 0.03% ASR and reduces S-GFN self-attack to 0.75% ASR. On unseen victims such as Gemma3-4B-Instruct and Llama3.2-3B-Instruct, S-GFN also shows the highest reported transfer ASR and UA among the listed GFN and QD baselines. Here, S-GFN denotes a concrete contrastive GFlowNet variant tailored to noisy sequence-level rewards.

The phrase can be confused with the control-theoretic paper “Lyapunov Stable Graph Neural Flow,” but that work is not a GFlowNet paper and does not introduce the acronym “Stable-GFN” or “S-GFN” explicitly (Chu et al., 13 Mar 2026). Its objects are continuous-depth GNNs whose state $V$ 6 evolves according to an integer-order ODE or a fractional-order Caputo system,

$V$ 7

and whose stability is enforced by a learned Lyapunov function built from an Input Convex Neural Network,

$V$ 8

A projection operator modifies the vector field so that $V$ 9 in the integer-order case or the corresponding fractional inequality holds in the Caputo case (Chu et al., 13 Mar 2026). The resulting models are named IL-GNNs and FL-GNNs, and the reported empirical effect is robustness against adversarial graph perturbations.

This neighboring usage clarifies a persistent ambiguity. Across the sources considered here, “stability” may denote at least four different objects: extinction and Lyapunov decay of fluid-network paths, descent of a learned Lyapunov function in graph neural flows, thermodynamic favorability or Boltzmann weighting of generated scientific objects, and bounded-loss optimization with probabilistic fidelity guarantees in GFlowNets (Schönlein et al., 2011, Chu et al., 13 Mar 2026, AI4Science et al., 2023, Volokhova et al., 15 Jul 2025, Lei et al., 3 May 2026, Kwon et al., 1 May 2026). A plausible implication is that the term S-GFN is most informative only when accompanied by its target domain and the operative notion of stability. Without that qualifier, it spans structurally different theories: converse Lyapunov theorems for strict GFNs, reward-proportional sampling of stable crystals or conformers, certification-oriented stabilization of Trajectory Balance, and contrastive partition-free red-teaming.