Abstract
Video recognition models remain vulnerable to adversarial attacks, while existing diffusion-based purification methods suffer from inefficient sampling and curved trajectories. Directly regressing clean videos from adversarial inputs often fails to recover faithful content due to the subtle nature of perturbations; this necessitates physically shattering the adversarial structure. Therefore, we propose Flow Matching for Adversarial Video Purification FMVP. FMVP physically shatters global adversarial structures via a masking strategy and reconstructs clean video dynamics using Conditional Flow Matching (CFM) with an inpainting objective. To further decouple semantic content from adversarial noise, we design a Frequency-Gated Loss (FGL) that explicitly suppresses high-frequency adversarial residuals while preserving low-frequency fidelity. We design Attack-Aware and Generalist training paradigms to handle known and unknown threats, respectively. Extensive experiments on UCF-101 and HMDB-51 demonstrate that FMVP outperforms state-of-the-art methods (DiffPure, Defense Patterns (DP), Temporal Shuffling (TS) and FlowPure), achieving robust accuracy exceeding 87% against PGD and 89% against CW attacks. Furthermore, FMVP demonstrates superior robustness against adaptive attacks (DiffHammer) and functions as a zero-shot adversarial detector, attaining detection accuracies of 98% for PGD and 79% for highly imperceptible CW attacks.
Abstract (translated)
视频识别模型仍然容易受到对抗性攻击的影响，而现有的基于扩散的净化方法则面临采样效率低下和轨迹弯曲的问题。直接从对抗输入中回归干净视频通常无法恢复忠实的内容，因为这些扰动往往是细微且难以察觉的；这需要物理上破坏对抗结构。因此，我们提出了用于对抗视频净化的流匹配（Flow Matching for Adversarial Video Purification, FMVP）。FMVP通过掩码策略物理性地破坏全局对抗结构，并使用带有修复目标的条件流匹配（Conditional Flow Matching, CFM）重建干净的视频动态。 为了进一步将语义内容与对抗噪声解耦，我们设计了一种频率门控损失（Frequency-Gated Loss, FGL），它明确抑制高频率对抗残差同时保持低频保真度。此外，我们还设计了针对已知威胁和未知威胁的攻击感知训练范式和通才训练范式。 在UCF-101和HMDB-51数据集上进行的广泛实验表明，FMVP优于最先进的方法（DiffPure、Defense Patterns (DP)、Temporal Shuffling (TS) 和 FlowPure），对抗PGD攻击时达到了超过87%的鲁棒准确率，在对抗CW攻击时则超过了89%。此外，FMVP还表现出更强的适应性攻击抵御能力（如DiffHammer）并能够充当零样本对抗检测器，在识别PGD和高度不可察觉的CW攻击方面分别达到98%和79%的检测精度。
URL
https://arxiv.org/abs/2601.02228
