Paper deep dive
Steering the Flow: Inverting Face Recognition Models via Gradient-Guided Flow Matching
Ye Lu, Shen Wang, Zhaoyang Zhang, Yihan Yan, Li Liu, Runze Liu, Fanghui Sun
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 91%
Last extracted: 8/23/2026, 2:44:24 AM
Summary
The paper proposes Steering Flow Model Inversion (SFMI), a white-box model inversion attack method that reconstructs face recognition training samples by reformulating the process as a trajectory-steering task. SFMI utilizes a two-stage approach: first, pre-training a generic unconditional Flow Matching model to encode human face manifolds; second, using a Progressive Guidance Scheduler (PGS) to inject time-dependent, target-specific gradients during sampling. This method steers generative flow from random noise toward target identity regions, achieving state-of-the-art performance in attack success and visual fidelity on datasets like CelebA.
Entities (10)
Relation Signals (6)
SFMI → evaluatedon → CelebA
confidence 95% · Under an identity-disjoint cross-evaluation setting using the CelebA dataset
SFMI → uses → Flow Matching
confidence 95% · SFMI, a Flow Matching-based white-box model inversion method
SFMI → uses → PGS
confidence 92% · Step II, Attacking with Progressive Guidance Scheduler (PGS)
PGS → injects → gradients
confidence 90% · injects time-dependent target-specific gradients during sampling
SFMI → targets → ArcFace
confidence 90% · SFMI achieves an ACC of 0.9248... on the ArcFace target
Flow Matching → models → ODE
confidence 85% · Flow Matching models data generation through an Ordinary Differential Equation (ODE)
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Model Inversion Attacks (MIAs) aim to reconstruct representative training samples of target identities from face recognition models, exposing critical security vulnerabilities. Existing methods typically rely on indirect guidance or highly stochastic guidance, making it difficult to stably optimize generation trajectories toward target facial images. In this paper, we propose Steering Flow Model Inversion (SFMI), a novel two-stage white-box model inversion method that reformulates inversion as a trajectory-steering task. Specifically, Step I, Learning a Generic Flow Matching Prior, pre-trains a generic unconditional Flow Matching model to encode the manifold of human faces as a robust prior. Step II, Attacking with Progressive Guidance Scheduler (PGS), injects time-dependent target-specific gradients during sampling. By backpropagating through the target model to obtain gradients from intermediate generated states, PGS progressively injects adaptive guidance signals into the vector field. This process effectively steers the current generative flow from random noise toward the high-density regions of the target class. Under an identity-disjoint cross-evaluation setting using the CelebA dataset, SFMI achieves an ACC of 0.9248, an FID of 22.61, and an LPIPS of 0.3874 on the ArcFace target. Extensive experiments on multiple target models demonstrate that SFMI achieves competitive state-of-the-art performance in attack success and visual fidelity under the evaluated white-box protocol.
Tags
Links
- Source: https://arxiv.org/abs/2608.16791v1
- Canonical: https://arxiv.org/abs/2608.16791v1
Trouble viewing inline? Open PDF directly →
Full Text
82,382 characters extracted from source content.
Expand or collapse full text
Steering the Flow: Inverting Face Recognition Models via Gradient-Guided Flow Matching Ye Lu Shen Wang Zhaoyang Zhang Yihan Yan Li Liu Runze Liu Fanghui Sun Thanks: This work was supported in part by the National Defense Basic Scientific Research Program of China under Grant JCKY2023603C043, in part by the Key R&D Plan of Heilongjiang Province under Grant 2022ZX01C01, and in part by the Natural Science Foundation of Heilongjiang Province of China under Grant LH2024F023. Thanks: Ye Lu, Shen Wang, Zhaoyang Zhang, Yihan Yan, Li Liu, Runze Liu, and Fanghui Sun are with the School of Cyberspace Science, Harbin Institute of Technology, Harbin 150001, China (Corresponding author: Yihan Yan; e-mail: yan.office366.m@hit.edu.cn). Abstract Model Inversion Attacks (MIAs) aim to reconstruct representative training samples of target identities from face recognition models, exposing critical security vulnerabilities. Existing methods typically rely on indirect guidance or highly stochastic guidance, making it difficult to stably optimize generation trajectories toward target facial images. In this paper, we propose Steering Flow Model Inversion (SFMI), a novel two-stage white-box model inversion method that reformulates inversion as a trajectory-steering task. Specifically, Step I, Learning a Generic Flow Matching Prior, pre-trains a generic unconditional Flow Matching model to encode the manifold of human faces as a robust prior. Step I, Attacking with Progressive Guidance Scheduler (PGS), injects time-dependent target-specific gradients during sampling. By backpropagating through the target model to obtain gradients from intermediate generated states, PGS progressively injects adaptive guidance signals into the vector field. This process effectively steers the current generative flow from random noise toward the high-density regions of the target class. Under an identity-disjoint cross-evaluation setting using the CelebA dataset, SFMI achieves an ACC of 0.9248, an FID of 22.61, and an LPIPS of 0.3874 on the ArcFace target. Extensive experiments on multiple target models demonstrate that SFMI achieves competitive state-of-the-art performance in attack success and visual fidelity under the evaluated white-box protocol. Index Terms: Model inversion attack, face recognition, privacy attack, deep learning. I Introduction Deep Neural Networks (DNNs) have emerged as the backbone of modern biometric authentication, achieving superhuman accuracy in tasks such as Face Recognition (FR) [46]. The efficacy of these models is predicated on their capacity to extract high-level semantic features from massive-scale datasets. However, this reliance on extensive training data engenders a fundamental tension between utility and privacy. Theoretical and empirical evidence suggests that DNNs tend to unintentionally “memorize” specific training samples rather than merely learning generalized patterns. This phenomenon, coupled with the pervasive deployment of FR systems in critical infrastructure, poses severe privacy risks. In light of stringent regulations such as the GDPR, auditing the potential leakage of sensitive biometric information has become a paramount research imperative. Among the emerging privacy threats, Model Inversion Attacks (MIAs) reveal that DNNs—especially face recognition models—are inherently vulnerable to identity leakage. In an MIA, the adversary reconstructs a representative facial image of a target identity by exploiting the information encoded in a trained model. Generally, MIAs are categorized into black-box and white-box settings based on the adversary’s knowledge. While the black-box setting restricts access to model queries, the white-box setting assumes full access to the model’s parameters and architecture. In this paper, we focus on the white-box scenario, as illustrated in Fig. 1. Here, the adversary leverages full access to the model parameters to backpropagate gradients for a specific label (e.g., “ID: 999”). This feedback iteratively guides random noise to evolve into a facial image that semantically aligns with the target identity. In IoT deployments, such access can arise when an adversary extracts an on-device FR model from a physically compromised smart camera, access-control terminal, or mobile device through firmware inspection or exposed local storage. The extracted model can then be analyzed offline using external computing resources, so inversion need not run on the resource-constrained device itself. We therefore treat white-box inversion as a realistic high-access, worst-case privacy audit rather than a universal adversarial capability. Fig. 1: Basic concept of the Model Inversion Attack (MIA). Despite the well-defined threat model, recovering high-fidelity images remains a formidable challenge due to the high dimensionality of the search space. Early approaches framed inversion as a direct optimization problem in the pixel space, aiming to maximize the likelihood of the target class. However, the optimization landscape of pixel values is highly non-convex, rendering these methods prone to entrapment in local minima. Consequently, the reconstructed images often suffer from pronounced visual artifacts and fail to preserve semantic coherence. To mitigate this, subsequent works leveraged Generative Adversarial Networks (GANs) [10, 11] as prior knowledge, optimizing a latent code within the generator’s manifold. While GAN priors improve visual plausibility, they introduce a structural mismatch: the mapping from the latent space to the image space is inherently non-linear and non-smooth. This results in unstable gradient backpropagation, impeding the optimization from effectively traversing the manifold toward the precise features of the target identity. In recent years, Diffusion Models (DMs) [23, 32, 38] and their continuous-time generalizations, specifically Flow Matching (FM) [26], have superseded GANs as the state-of-the-art in generative modeling. While these models offer superior capabilities in modeling complex data distributions, adapting them for adversarial inversion remains non-trivial. Most diffusion-based inversion methods rely on Stochastic Differential Equation (SDE)-based sampling. However, the stochastic noise injected along the SDE trajectory can mislead, or even interfere with, the sampling process toward the target class. Crucially, these methods lack a mathematically grounded mechanism to effectively rectify the generation path based on the target model’s response. Consequently, they struggle to explicitly navigate the generative flow toward the specific identity regions defined by the target classifier. In this paper, we bridge these gaps by proposing Steering Flow Model Inversion (SFMI), a Flow Matching-based white-box model inversion method that reformulates inversion as a trajectory-steering task. Unlike diffusion models that rely on complex stochastic differential equations, Flow Matching models data generation through an Ordinary Differential Equation (ODE), providing relatively smooth and stable velocity fields. We leverage this property to treat the inversion process not as a static optimization, but as guiding a flow from a simple prior distribution to the target class manifold. Specifically, SFMI operates in two stages: Step I, Learning a Generic Flow Matching Prior, which pre-trains an unconditional Flow Matching model to encapsulate a robust human face prior; and Step I, Attacking with Progressive Guidance Scheduler (PGS), which injects target-specific gradients during integration. By backpropagating through the target model at intermediate integration steps, PGS injects adaptive gradients into the velocity field, effectively “steering” the flow toward the high-density regions of the target identity. We evaluate SFMI under an identity-disjoint protocol across diverse face recognition targets, including ResNet-based backbones, commonly used face recognition models such as ArcFace and CosFace, the modern transformer-based ViT model, and MobileFaceNet, which is widely adopted in IoT and edge-face-recognition scenarios. SFMI achieves an average attack accuracy above 90% with favorable perceptual similarity, demonstrating strong and competitive performance relative to state-of-the-art methods under the evaluated white-box protocol. Our contributions can be summarized as follows: • We propose SFMI, the first white-box model inversion method that leverages Flow Matching as the generative prior and formulates inversion as ODE velocity-field steering, thereby mitigating the optimization instability of previous GAN-based and stochastic diffusion-based attacks. • We design the Progressive Guidance Scheduler (PGS) that seamlessly integrates the target model’s feedback into the ODE solver. By dynamically modulating the vector field with adaptive gradient signals, we achieve fine-grained control over the identity recovery process. • Under an identity-disjoint cross-evaluation protocol, extensive experiments on diverse face recognition targets demonstrate that SFMI delivers strong and competitive performance relative to state-of-the-art optimization-based and generative MIA methods, particularly in attack accuracy and visual fidelity. The remainder of this paper is organized as follows. Section I reviews related work on optimization-based and generative-prior model inversion. Section I introduces the proposed SFMI method, including Learning a Generic Flow Matching Prior and Attacking with Progressive Guidance Scheduler (PGS). Section IV presents experimental settings and quantitative and qualitative evaluations. Finally, Section VI concludes the paper and discusses future directions. I Related Work I-A Deep Face Recognition Deep learning architectures have substantially reshaped visual representation learning. Convolutional Neural Networks (CNNs) established a dominant paradigm for extracting hierarchical spatial features, Residual Networks (ResNet) [13] enabled stable training of deeper models, and Vision Transformers (ViT) [5] further introduced self-attention for global contextual modeling. Driven by these advances, face recognition has shifted from handcrafted-feature pipelines to deep learning-based paradigms [44, 6, 46, 22], where models learn identity-discriminative embeddings in an end-to-end manner. Training objectives have also evolved from metric-learning formulations, such as FaceNet [35], to margin-based softmax losses that enhance intra-class compactness and inter-class separability. In this work, we evaluate SFMI on representative targets spanning these developments: Face.evoLVe and IR-152 are conventional CNN-based FR backbones; CosFace [42] and ArcFace [4] represent widely used margin-based recognition objectives; MobileFaceNet [1] is a lightweight model designed for accurate real-time face verification on mobile, IoT, and edge devices; and the ViT model represents modern transformer-based FR designs. These heterogeneous targets provide different model capacities, embedding geometries, and deployment characteristics for evaluating inversion difficulty. I-B Model Inversion Attacks Model Inversion Attacks (MIAs) pose a severe privacy threat by aiming to reconstruct sensitive training data or infer private attributes from trained machine learning models [8, 51]. The concept was initially formalized by exploiting prediction confidence information from simple classifiers to recover recognizable images [9]. Subsequent research rapidly expanded MIAs into rigorous white-box settings [30, 37], formulating the attack as an explicit optimization problem in continuous pixel space. By utilizing gradient descent [53], attackers attempted to synthesize random noise into inputs that maximize the target class probability. However, because this optimization is performed directly in the extremely high-dimensional and highly non-convex natural image pixel space, traditional methods are prone to being trapped in poor local optima, often resulting in failure modes such as semantically meaningless reconstructions dominated by abstract high-frequency noise. Related privacy and face-recognition studies in IoT contexts have investigated distinct but complementary directions, including secure face identification under fog computing [16], sparse low-rank representation for IoT face recognition [50], and practical feature inference attacks in vertical federated prediction [49], collectively highlighting privacy-related risks in IoT scenarios. To mitigate the mathematical ill-posedness of direct pixel optimization, a profound paradigm shift occurred with the introduction of auxiliary generative priors. Zhang et al. [56] pioneered the Generative Model Inversion (GMI) attack, which leverages a pre-trained Generative Adversarial Network (GAN) to constrain the adversarial search space strictly to a natural image manifold. Following this breakthrough, a proliferation of generative MIAs emerged to enhance reconstruction fidelity and attack transferability. Notable advancements include modeling private data distributions (KEDMI) [2], decoupling target models from priors via Plug & Play Attacks (PPA) [39], and utilizing pseudo-label-guided conditional GANs (PLG) to disentangle search spaces [54]. More recently, researchers have focused on dissecting the prior architecture itself by exploiting intermediate GAN features (IFGMI) [34]. Diffusion-based MIA methods have also emerged as a recent direction: DiffMI [24] fine-tunes a target-specific conditional diffusion prior to improve consistency with the target identity, while FGMIA [29] first recovers feature encodings through a surrogate model and then performs one-shot feature-guided generation without iterative correction from the target model. Several other recent works have also explored related research directions [57, 36, 47]. Other explorations span variational inversion formulations [43], optimization objective refinements [31], and adversarial prior exploitations [41, 21]. To clarify the methodological differences among representative MIAs, Table I summarizes their publication years, priors, evaluation data, image resolutions, attack knowledge, and gradient dependence. TABLE I: Comparison of representative model inversion attack methods in related work, including publication year, prior type, dataset, image resolution, attack scenario, and gradient requirement. Method Year Prior Dataset Resolution Scenario Gradients MIA [9] 2015 None MNIST Various Black/White-box Optional YMIA [53] 2019 None AT&T Faces Various Black/White-box Optional GMI [56] 2020 Unconditional GAN CelebA, FaceScrub 64 White-box Yes KEDMI [2] 2021 Knowledge-enriched GAN CelebA, FaceScrub 64 White-box Yes FMI [21] 2022 DCGAN FaceScrub, CelebA 64 White-box Yes PPA [39] 2022 StyleGAN2 CelebA, FFHQ 112/224 White-box Yes PLGMI [54] 2023 Pseudo-label cGAN CelebA, FaceScrub, PubFig 64/112 White-box Yes DiffMI [24] 2024 Conditional DDPM CelebA, FFHQ 64/112 White-box Yes IFGMI [34] 2024 StyleGAN2 CelebA, FaceScrub 64/112/224 White-box Yes FGMIA [29] 2025 DDPM CelebA, FFHQ 64/112/224 Black/White-box No SFMI (Ours) 2026 Flow Matching CelebA, FFHQ 64/112/224 White-box Yes As for defense methods, existing model-inversion defenses [8] mainly fall into two categories. The first category strengthens model training or pre-training, using robust representation learning, mutual-information regularization [45], transfer-learning-based robustness [15], training-data deduplication [17], trapdoor-based defense [27], or label smoothing [40] to reduce sensitive memorization. The second category processes model outputs, using noise injection, prediction purification [52], adversarial perturbation [48], or other post-processing strategies to weaken exploitable signals. For face recognition models, however, extracting identity-discriminative features is necessary for utility, while model inversion attacks exploit this feature extraction process, revealing the trade-off between recognition performance and privacy security. Despite improving visual plausibility, existing generative MIAs still suffer from fundamental limitations when reconstructing identity-specific targets. On the one hand, GAN-based approaches rely on latent-space optimization, where the latent-to-image mapping is highly non-linear and often non-smooth, leading to unstable optimization dynamics and frequent convergence to suboptimal solutions. On the other hand, diffusion-based approaches typically adopt Stochastic Differential Equation (SDE)-based sampling, whose injected stochastic perturbations can continuously deflect the generation trajectory away from the target class signal. Although DiffMI introduces target-specific conditional diffusion fine-tuning, its DDPM-based sampling still faces potential trajectory deviation and requires multi-step cascaded backpropagation, which can mislead the generative prior during inversion. FGMIA reduces iterative optimization by using recovered feature encodings, but it does not use target-model feedback to progressively correct the generation trajectory. As a result, both paradigms struggle to consistently recover precise, identity-specific target face images, especially against modern margin-based FR models (e.g., CosFace and ArcFace in Sec. I-A). This fundamental optimization instability directly motivates our proposed Steering Flow Model Inversion (SFMI). SFMI uses Flow Matching to construct a deterministic ODE trajectory and progressively injects target-model feedback during sampling. By reformulating the generative prior as a deterministic ODE with smooth trajectories and introducing a progressive guidance mechanism, SFMI provides a trajectory-steering backbone. This mechanism effectively bridges the semantic gap, enabling target-specific adversarial gradients to stably and precisely steer the generative trajectory toward the target identity and thereby overcome the limitations of both highly non-convex GANs and stochastic diffusion models. I Method TABLE I: Notation used for datasets and key variables. Notation Description privD_priv Private dataset used to train the target face recognition model. pubD_pub Public auxiliary dataset available to the adversary and strictly identity-disjoint from privD_priv. ytargety_target Target identity label to be reconstructed by the attack. x0x_0 Initial Gaussian noise sample drawn from p0=(0,)p_0=N(0,I). x1x_1 Clean face sample or the final endpoint of the generative trajectory. xtx_t Intermediate state along the flow trajectory at time t∈[0,1]t∈[0,1]. ut(⋅)u_t(·) Ground-truth conditional vector field defined by the OT path. vϕ(⋅)v_φ(·) Learned velocity field induced by the Flow Matching prior ℳϕM_φ. ℳϕM_φ Flow Matching prior model parameterized by ϕφ. ℒFML_FM Flow Matching training loss for learning vϕv_φ. ℒidL_id Identity supervision objective used to guide inversion toward ytargety_target. g(xt)g(x_t) Raw identity-gradient signal computed with respect to the current state xtx_t. gnorm(xt)g_norm(x_t) Normalized guidance signal scaled to the velocity magnitude. E Expectation over sampled time steps, noise samples, and public data samples. I-A Preliminaries Problem Definition. Let fθ:→f_θ:X denote a pre-trained target face recognition model parameterized by θ, which maps the continuous image space ⊆ℝC×H×WX ^C× H× W to the probability simplex Y over K identities. Given a target label ytarget∈1,…,Ky_target∈\1,…,K\, the goal of a Model Inversion Attack (MIA) is to recover an image that captures the private visual characteristics of that identity from the information encoded in the trained model. We formulate this objective as an optimization problem over X: the adversary seeks an input x∗x^* whose prediction is aligned with ytargety_target, while a regularization term enforces natural image priors. Mathematically, the adversary solves the following minimization problem: x∗=argminx∈ℒinv(fθ(x),ytarget)+λℛ(x),x^*= _x \;L_inv (f_θ(x),y_target )+ (x), (1) where ℒinvL_inv represents the classification objective that penalizes deviations from the target class, ℛ(x)R(x) serves as a prior constraint to ensure the semantic plausibility of the reconstructed image, and λ is a hyperparameter balancing the two terms. In SFMI, ℛ(x)R(x) is not evaluated or optimized as an explicit regularization loss. Instead, the Flow Matching model trained on public face data implicitly imposes the facial prior, while progressive target-model gradients steer the sampling trajectory toward the target class within the learned face manifold. Adversary Knowledge. We operate under a white-box threat model, which grants the adversary comprehensive access to the target system. In this setting, the adversary is assumed to possess full knowledge of the model architecture and its trained parameters θ, thereby enabling the explicit computation of gradients via backpropagation. Furthermore, to facilitate the generation of realistic facial structures, the adversary is assumed to have access to a generic public face dataset pubD_pub that remains strictly identity-disjoint from the private training set privD_priv used for fθf_θ. In practical terms, the public dataset shares neither identities nor samples with the private data. This independent data separation allows the adversary to learn transferable facial priors while fully preserving the assumption that private data are inaccessible. I-B Steering Flow Model Inversion (SFMI) I-B1 Method Overview Fig. 2: Overview of SFMI, which consists of two stages: learning a generic Flow Matching prior and performing progressive gradient-guided attack. In this section, we first provide an overview of Steering Flow Model Inversion (SFMI). As illustrated in Fig. 2, the method consists of two tightly coupled stages: Stage I provides a smooth generative prior over human faces, while Stage I injects target-aware supervision to steer this prior toward identity-specific reconstruction. In the upper part, Stage I trains a Flow Matching model through velocity-field matching so that samples from a Gaussian prior can be transported to the human-face manifold. Specifically, the model learns a smooth vector field that maps samples from p0p_0 to samples from p1p_1, yielding a stable transport trajectory and a generic facial prior for inversion. This prior captures broad facial structure and appearance statistics, which helps constrain subsequent attack trajectories to remain on realistic face manifolds. In the lower part, Stage I starts from Gaussian noise and performs guided sampling toward a target identity. During sampling, clean estimates predicted from intermediate states are fed into the target model to compute identity-related gradients, and these gradients are injected back into the update direction to progressively move intermediate states toward the target face class. Meanwhile, PGS dynamically modulates the guidance strength over time (e.g., warm-up, sustain, and gradual decay), balancing identity alignment and visual fidelity, and thus enabling stable trajectory correction throughout generation. I-B2 Learning a Generic Flow Matching Prior In this stage, we adopt Flow Matching (FM [26, 7]) because model inversion requires a generative prior that is both smooth and controllable when transporting samples from noise to realistic face images. FM directly learns a time-dependent vector field, which provides a stable and differentiable trajectory for optimization and avoids the instability introduced by highly irregular mappings or stochastic perturbations. The role of this stage is therefore to learn an unconditional facial prior that maps a simple Gaussian distribution to the human-face manifold, providing a reliable generative backbone for subsequent identity-specific steering. Let pubD_pub denote a public face dataset accessible to the adversary, which is disjoint from the private dataset privD_priv used to train the target model. We define p1(x)p_1(x) as the empirical data distribution supported by pubD_pub. Conversely, let p0(x)p_0(x) denote a simple prior noise distribution, which we specify as a standard d-dimensional Gaussian distribution, i.e., p0=(0,)p_0=N(0,I). Our objective is to learn a time-dependent vector field that pushes samples from p0p_0 to p1p_1. We define this generative process via an Optimal Transport (OT [26]) displacement map. This map constructs the simplest possible trajectory—a straight line—between a noise sample x0∼p0x_0 p_0 and a data sample x1∼p1x_1 p_1. The state xtx_t at any time t∈[0,1]t∈[0,1] is given by linear interpolation: xt=ψt(x0,x1)=(1−t)x0+tx1.x_t= _t(x_0,x_1)=(1-t)x_0+tx_1. (2) Differentiating Eq. (2) with respect to time yields the ground-truth conditional vector field, denoted as utu_t, which represents the target velocity for this specific path: ut(x∣x0,x1)=x1−x0.u_t(x x_0,x_1)=x_1-x_0. (3) While standard Flow Matching directly approximates utu_t with a velocity-predicting network, we opt for an x-prediction parameterization following prior practice [25]. We train a neural network ℳϕ(xt,t)M_φ(x_t,t) to estimate the clean original image x^1 x_1 from the noisy state xtx_t. Based on the geometry of the OT path, the relationship between the current state xtx_t, the destination x1x_1, and the velocity v is derived as v=(x1−xt)/(1−t)v=(x_1-x_t)/(1-t). Consequently, the vector field vϕv_φ induced by our network is formulated as: vϕ(xt,t)=ℳϕ(xt,t)−xt1−t.v_φ(x_t,t)= M_φ(x_t,t)-x_t1-t. (4) Following the design choice in [25], we optimize the model with a velocity-matching loss (v-loss). To prioritize training on the most critical temporal regions, we sample the time step t from a Logit-Normal distribution parameterized by mean m and standard deviation σ, rather than a uniform distribution. The loss is computed by minimizing the discrepancy between the induced velocity field vϕv_φ (Eq. 4) and the ground-truth target velocity utu_t (Eq. 3): ℒFM(ϕ)=t,x0,x1[‖vϕ(xt,t)−ut‖22].L_FM(φ)=E_t,x_0,x_1 [ \|v_φ(x_t,t)-u_t \|_2^2 ]. (5) The complete training process for the generic Flow Matching prior is detailed in Algorithm 1. At each iteration, we first sample a mini-batch of clean faces x1∼pubx_1 _pub and a mini-batch of Gaussian noise samples x0∼(0,)x_0 (0,I), then draw time steps t from a Logit-Normal distribution with logit(t)∼(m,σ2)logit(t) (m,σ^2) to emphasize informative temporal regions. Next, we construct intermediate states along the OT path via linear interpolation and compute the corresponding target velocities ut=x1−x0u_t=x_1-x_0. Given each pair (xt,t)(x_t,t), the network ℳϕM_φ predicts x^1 x_1, which is converted to the induced velocity vϕv_φ using Eq. 4. We then evaluate the v-loss in Eq. 5 as the batch-wise discrepancy between vϕv_φ and utu_t, and update parameters ϕφ by gradient descent. By repeating this procedure, the model learns a stable, smooth vector field that reliably transports Gaussian noise toward realistic face samples. Algorithm 1 Training of the Generic Flow Matching Prior 0: Public dataset pubD_pub, max iterations N, batch size B, learning rate η, sampling hyperparameters m,σm,σ. 0: Trained model ℳϕM_φ. 1: Initialize network parameters ϕφ. 2: for iter=1iter=1 to N do 3: Sample data batch x1(i)i=1B∼pub\x_1^(i)\_i=1^B _pub. 4: Sample noise batch x0(i)i=1B∼(0,)\x_0^(i)\_i=1^B (0,I). 5: Sample time steps t(i)i=1B∼Logit-Normal(m,σ)\t^(i)\_i=1^B -Normal(m,σ). logit(t)∼(m,σ2)logit(t) (m,σ^2) 6: for i=1i=1 to B do 7: Construct intermediate state via OT path: 8: xt(i)←(1−t(i))x0(i)+t(i)x1(i)x_t^(i)←(1-t^(i))x_0^(i)+t^(i)x_1^(i) 9: Forward pass to predict clean data: 10: x^1(i)←ℳϕ(xt(i),t(i)) x_1^(i) _φ(x_t^(i),t^(i)) 11: Compute induced velocity (Eq. 4): 12: vϕ(i)←(x^1(i)−xt(i))/(1−t(i))v_φ^(i)←( x_1^(i)-x_t^(i))/(1-t^(i)) 13: Compute target velocity (Eq. 3): 14: ut(i)←x1(i)−x0(i)u_t^(i)← x_1^(i)-x_0^(i) 15: end for 16: Compute Loss: ℒ←1B∑i=1B‖vϕ(i)−ut(i)‖22L← 1B _i=1^B\|v_φ^(i)-u_t^(i)\|_2^2 17: Update parameters: ϕ←ϕ−η∇ϕℒφ←φ-η _φL 18: end for 19: return Trained model ℳϕM_φ. I-B3 Progressive Gradient-Guided Attack With the generic flow matching prior ℳϕM_φ trained, the second stage of SFMI focuses on recovering the specific target identity. We formulate this as a trajectory steering problem within the ODE formulation. The objective is to navigate the generative flow such that the final sample minimizes the identity mismatch with respect to the target label ytargety_target. To achieve this, we intervene in the numerical integration process. In a standard unconditional generation, the trajectory is governed solely by the learned velocity field vϕ(xt,t)v_φ(x_t,t). In our adversarial setting, we introduce a guidance term derived from the target classifier fθf_θ. Crucially, since the target classifier is trained on clean images, directly feeding the noisy state xtx_t into fθf_θ would yield uninformative gradients. Instead, we leverage the x-prediction capability of our pre-trained prior. At each time step t, we first pass the current noisy state xtx_t through the Flow Matching model to obtain a clean image estimate x^1=ℳϕ(xt,t) x_1=M_φ(x_t,t). This estimated clean image is then fed into the target classifier to compute the inversion loss. Formally, the loss function is defined as the composition of the classifier and the prior model: ℒinv(xt)=ℒid(fθ(ℳϕ(xt,t)),ytarget).L_inv(x_t)=L_id (f_θ(M_φ(x_t,t)),y_target ). (6) where ℒidL_id denotes the identity supervision objective. In practice, we instantiate ℒidL_id with the max-margin loss (MMLoss) adopted by PLGMI [54]. Let zθ(x^1)∈ℝKz_θ( x_1) ^K be the logit vector of the target classifier for the estimated clean image x^1=ℳϕ(xt,t) x_1=M_φ(x_t,t). MMLoss is defined as ℒM(zθ(x^1),ytarget)=maxk≠ytargetzθ,k(x^1)−zθ,ytarget(x^1).L_M(z_θ( x_1),y_target)= _k≠ y_targetz_θ,k( x_1)-z_θ,y_target( x_1). (7) Minimizing Eq. 7 enlarges the target logit relative to the strongest non-target logit, which encourages identity-discriminative reconstruction. To steer the flow, we require the gradient with respect to the current state xtx_t, not the estimated outcome x^1 x_1. We obtain this by backpropagating the error signal through the frozen target classifier and, significantly, through the frozen Flow Matching prior itself: g(xt)=∇xtℒinv(xt)=∇xt[ℒid(fθ(ℳϕ(xt,t)),ytarget)].g(x_t)= _x_tL_inv(x_t)= _x_t [L_id (f_θ(M_φ(x_t,t)),y_target ) ]. (8) This end-to-end backpropagation ensures that the guidance signal g(xt)g(x_t) accurately reflects how an infinitesimal change in the current noisy state xtx_t influences the final identity objective, accounting for the manifold projection learned by ℳϕM_φ. Before injection, we normalize the raw gradient to a velocity-proportional length: gnorm(xt)=g(xt)‖g(xt)‖2+ϵ⋅‖vϕ(xt,t)‖2,g_norm(x_t)= g(x_t)\|g(x_t)\|_2+ε·\|v_φ(x_t,t)\|_2, (9) where ϵε is a small constant for numerical stability. This preserves the adversarial direction while matching its scale to the FM velocity. We then modify the original velocity field by injecting this gradient signal. The rectified velocity field v~(xt,t) v(x_t,t) is formulated as: v~(xt,t)=vϕ(xt,t)−γ(t)⋅gnorm(xt). v(x_t,t)=v_φ(x_t,t)-γ(t)· g_norm(x_t). (10) As illustrated in Fig. 2, this correction preserves the natural FM trajectory while steering sampling toward a face recognized as the target identity. Progressive Guidance Schedule. Instead of a constant guidance scale, which often leads to saturation artifacts or optimization instability, we design a time-dependent schedule γ(t)γ(t) that modulates the steering strength dynamically. The schedule consists of four phases: warm-up, sustain, decay, and relaxation. Mathematically, it is defined as: γ(t)=M⋅Vmax⋅t0,0≤t≤t0,Vmax,t0<t≤t1,Vmax2[1+cos(πt−t1t2−t1)],t1<t≤t2,0,t2<t≤1.γ(t)=M· casesV_ · tt_0,&0≤ t≤ t_0,\\ V_ ,&t_0<t≤ t_1,\\ V_ 2 [1+ (π t-t_1t_2-t_1 ) ],&t_1<t≤ t_2,\\ 0,&t_2<t≤ 1. cases (11) where M represents the global magnitude scale, and VmaxV_ defines the peak intensity. The thresholds t0,t1,t2t_0,t_1,t_2 delineate the phases. The linear warm-up (t≤t0t≤ t_0) prevents abrupt trajectory shifts when noise is high. The cosine decay (t1<t≤t2t_1<t≤ t_2) ensures a smooth transition, and the final zero-guidance phase (t>t2t>t_2) allows the Flow Matching prior to refine the image without external interference, thereby reinforcing adherence to the learned face manifold, stabilizing the final refinement trajectory, and preserving high visual fidelity. The PGS diagram in Fig. 2 visualizes this schedule as four consecutive warm-up, sustain, decay, and relaxation stages, providing an intuitive counterpart to the piecewise definition above. To mitigate discretization errors and ensure the steered trajectory adheres smoothly to the face manifold, we adopt a second-order predictor-corrector scheme inspired by the Heun sampler [18]. As detailed in Algorithm 2, this mechanism involves a two-stage evaluation at each step: a predictor step to estimate a provisional next state using the gradient at the current position, and a corrector step to refine the update using the gradient at the predicted position. This approach effectively corrects the trajectory curvature induced by the adversarial guidance. Algorithm 2 SFMI: Progressive Gradient-Guided Attack 0: Target model fθf_θ, Prior model ℳϕM_φ, Target label ytargety_target, Steps N. 0: Reconstructed image x1x_1. 1: Sample initial noise x0∼(0,)x_0 (0,I). 2: Set initial state xt0←x0x_t_0← x_0 and step size Δt=1/N t=1/N. 3: for i=0i=0 to N−1N-1 do 4: ti←i/Nt_i← i/N; ti+1←(i+1)/Nt_i+1←(i+1)/N. 5: Compute γ(ti)γ(t_i) and γ(ti+1)γ(t_i+1) using Eq. 11. 6: // Stage 1: Predictor 7: x^1←ℳϕ(xti,ti) x_1 _φ(x_t_i,t_i). 8: vcurr←(x^1−xti)/(1−ti)v_curr←( x_1-x_t_i)/(1-t_i). 9: gcurr←∇xtiℒid(fθ(ℳϕ(xti,ti)),ytarget)g_curr← _x_t_iL_id (f_θ(M_φ(x_t_i,t_i)),y_target ). 10: gcurr←gcurr‖gcurr‖2+ϵ⋅‖vcurr‖2g_curr← g_curr\|g_curr\|_2+ε·\|v_curr\|_2. 11: v~1←vcurr−γ(ti)⋅gcurr v_1← v_curr-γ(t_i)· g_curr. 12: x^ti+1←xti+v~1⋅Δt x_t_i+1← x_t_i+ v_1· t. 13: // Stage 2: Corrector 14: x^1′←ℳϕ(x^ti+1,ti+1) x _1 _φ( x_t_i+1,t_i+1). 15: vpred←(x^1′−x^ti+1)/(1−ti+1)v_pred←( x _1- x_t_i+1)/(1-t_i+1). 16: gpred←∇x^ti+1ℒid(fθ(ℳϕ(x^ti+1,ti+1)),ytarget)g_pred← _ x_t_i+1L_id (f_θ(M_φ( x_t_i+1,t_i+1)),y_target ). 17: gpred←gpred‖gpred‖2+ϵ⋅‖vpred‖2g_pred← g_pred\|g_pred\|_2+ε·\|v_pred\|_2. 18: v~2←vpred−γ(ti+1)⋅gpred v_2← v_pred-γ(t_i+1)· g_pred. 19: // Update State 20: xti+1←xti+Δt2(v~1+v~2)x_t_i+1← x_t_i+ t2( v_1+ v_2). 21: end for 22: return x1=xtNx_1=x_t_N. IV Experiments In this section, we evaluate the proposed Steering Flow Model Inversion (SFMI) method from four complementary perspectives. We first describe the experimental protocol, including disjoint dataset construction, target face recognition models, and cross-evaluation metrics. We then compare SFMI with representative white-box model inversion baselines through both quantitative results and qualitative visualizations. Next, we conduct component-level ablations to isolate the contributions of the prior model, guidance scheduler, and loss design. Finally, we provide a detailed analysis of progressive guidance variants to explain the trajectory-steering behavior behind SFMI’s performance. IV-A Experimental Setup Datasets. We enforce an identity-disjoint protocol throughout all experiments: identities in the adversary’s public prior data never overlap with those used to train the target models. Consistent with Sec. I, privD_priv denotes the private target-training dataset, and pubD_pub denotes the public auxiliary dataset available to the adversary. From CelebA [28], we construct CelebA-priv as privD_priv with 1000 identities and 30,000 images for target-model training, and build a non-overlapping 30,000-image CelebA-pub split as the default pubD_pub for learning the unconditional face prior. Since prior learning is unconditional, pubD_pub requires no identity annotations. To evaluate cross-distribution transferability, we also construct FFHQ-pub from FFHQ [19] as another identity-disjoint 30,000-image auxiliary prior dataset. Thus, CelebA-pub and FFHQ-pub use the same public-data scale while preventing overlap with CelebA-priv. All images follow the same face-recognition preprocessing pipeline, including face detection, five-point landmark localization, 2D partial affine alignment, interpolation, cropping, and resizing to the target-model resolution. Target Models. We evaluate SFMI against six face recognition targets covering different architectures, objectives, and input resolutions. Face.evoLVe [3] and IR-152 [13] are conventional CNN-based face recognition models evaluated at 64×6464× 64 resolution. CosFace [42] and ArcFace [4] are two widely used margin-based face recognition models and are evaluated at 112×112112× 112 resolution. MobileFaceNet [1] is a lightweight face recognition architecture commonly used in mobile, IoT, and edge-device scenarios, and ViT [5] represents a modern transformer-based face recognition model; both are evaluated at 112×112112× 112 resolution in the main comparison. These resolutions refer to the detected, aligned, cropped, and resized face inputs consumed by the FR models rather than raw high-resolution images. In the ablation study, we further include 224×224224× 224 ArcFace and MobileFaceNet targets to examine higher-resolution behavior. For each target, we use an Internet-public pretrained model as the backbone and train only the final classification layer on privD_priv for 10 epochs. To ensure a rigorous and unbiased assessment of the recovered identities and avoid self-evaluation, we strictly adopt a cross-evaluation protocol, where the quantitative performance of an attack against a specific target model is reported as the average score evaluated by the other models. Evaluation Metrics. We evaluate model inversion performance using three complementary metrics: Attack Accuracy (ACC), Fréchet Inception Distance (FID), and Learned Perceptual Image Patch Similarity (LPIPS). Together, they characterize identity recovery success, global visual realism, and fine-grained perceptual consistency. ACC quantifies semantic identity recovery under the cross-evaluation protocol by computing the average proportion of reconstructed images that are recognized as the target identity by non-target evaluators, thus directly reflecting attack effectiveness. During the attack, the adversary only accesses the target model and has no access to the evaluation model; therefore, ACC measures whether the reconstruction is recognized as the target identity by independent evaluators rather than merely fitting the attacked model. FID [14] measures distribution-level similarity and overall image fidelity via the Wasserstein-2 distance between reconstructed samples and real private training images in feature space, where lower values indicate fewer artifacts and better photorealism. LPIPS [55] further evaluates structural and textural alignment between reconstructions and ground-truth faces using deep perceptual features, and lower LPIPS indicates closer perceptual resemblance to the target identity. Implementation Details. We implement ℳϕM_φ using the Flow Matching architecture in [25], which is a ViT/DiT-like Transformer with a 16×1616× 16 patch size and 16 attention heads. The FM prior is trained for 500k optimization steps using AdamW, a per-batch learning rate of 2×10−52× 10^-5, and a learning-rate schedule with linear warmup followed by cosine decay. Instead of uniformly sampling t, we use logit(t)∼(−0.8,0.82)logit(t) (-0.8,0.8^2). During the attack, we use 50 sampling steps by default, with M=0.3M=0.3, t0=0.1t_0=0.1, t1=0.3t_1=0.3, t2=0.7t_2=0.7, and Vmax=1.0V_ =1.0. To balance the facial prior and identity guidance, SFMI directly predicts the original image with the FM prior, injects normalized guidance only through the selected PGS stages, and strictly controls the guidance magnitude; in practice, we recommend keeping M≤0.35M≤ 0.35 because larger values can push the trajectory too far and cause facial distortion or artifacts. At the 112×112112× 112 resolution setting, training one FM prior takes about 18 hours on a single RTX 5090 GPU with 32 GB of memory; at the 224×224224× 224 resolution setting, it takes about 50 hours on the same GPU. Once trained, the generic FM prior can be reused for different target models. The 50-step attack takes about 0.23 seconds per image at 112×112112× 112 resolution and 0.47 seconds per image at 224×224224× 224 resolution. IV-B Comparison with State-of-the-Art Methods To verify the effectiveness of SFMI, we conduct a comprehensive comparison with existing white-box model inversion methods. Specifically, we evaluate six target face recognition models (Face.evoLVe, IR-152, CosFace, ArcFace, MobileFaceNet, and ViT), following prior settings [54, 29] to ensure consistency with standard white-box MIA evaluation practice. We compare SFMI against five representative baselines: GMI [56], PPA [39], PLGMI [54], IFGMI [34], and FGMIA [29]. For fairness, all methods are implemented from official codebases and evaluated under the same protocol in Sec. IV-A, including strict identity-disjoint data splits, model-aligned preprocessing, 30,000-image public auxiliary data at comparable scale, and the same cross-evaluation rule. Specifically, SFMI uses CelebA-pub as the default pubD_pub for training the Flow Matching prior. For the baselines, GMI, PLGMI, and FGMIA use priors trained following their original procedures with the same-scale public auxiliary data, while PPA and IFGMI reuse the prior models released by the original papers because their official protocols rely on these pretrained generative priors. All baseline attacks use the parameters recommended by the corresponding papers or official implementations. TABLE I: Configuration and computational-cost summary under the 112×112112× 112 resolution CosFace setting on an RTX 5090 GPU with 32GB memory. Candidate screening is listed separately from gradient updates, and locally measured prior-training times exclude released pretrained checkpoints. Method Prior type Attack budget Prior training Attack time GMI [56] WGAN-GP [12] 1500 latent-optimization steps 15 h 0.16 s/pic PPA [39] StyleGAN2 [20] 5000-candidate screening + 70 latent-optimization steps – (pretrained) 0.42 s/pic PLGMI [54] Pseudo-label cGAN 600 latent-optimization steps 17 h 0.20 s/pic IFGMI [34] StyleGAN2 [20] 5000-candidate screening + 170 staged updates (70+4×2570+4× 25) – (pretrained) 0.27 s/pic FGMIA [29] Feature-guided DDPM 50 denoising steps 13 h 0.40 s/pic SFMI (Ours) Flow Matching 50 Heun steps (100 NFE) 18 h 0.23 s/pic Table I jointly summarizes the prior architecture, per-attack computational budget, prior-training time, and attack time. PPA and IFGMI use released StyleGAN2 checkpoints rather than priors retrained on our platform. For context, the official StyleGAN2 implementation reports 9 days and 18 hours to train its FFHQ model at 1024×10241024× 1024 resolution on eight Tesla V100 GPUs; because this upstream cost differs in hardware, resolution, and training setup from our RTX 5090 measurements, we exclude it from the direct timing comparison. Since SFMI uses second-order Heun integration, its 50-step attack corresponds to 100 model evaluations (NFE). For SFMI, we repeat the full process three times, from Flow Matching prior training to attacking each target class; for each target class, eight images are sampled and used to compute the reported mean and standard deviation. TABLE IV: Comprehensive white-box MIA comparison among GMI [56], PPA [39], PLGMI [54], IFGMI [34], FGMIA [29], and SFMI on six target models (Face.evoLVe, IR-152, CosFace, ArcFace, MobileFaceNet, and ViT). Metrics include ACC (↑ ), FID (↓ ), and LPIPS (↓ ) under the cross-evaluation protocol. Best results are highlighted in bold. All methods are reported as mean ± standard deviation over three repeated runs. Method Target: Face.evoLVe (64×6464× 64) Target: IR-152 (64×6464× 64) Target: CosFace (112×112112× 112) ACC ↑ FID ↓ LPIPS ↓ ACC ↑ FID ↓ LPIPS ↓ ACC ↑ FID ↓ LPIPS ↓ GMI [56] 0.2537±0.01560.2537 0.0156 27.97±0.9027.97 0.90 0.5319±0.00870.5319 0.0087 0.1382±0.01760.1382 0.0176 27.61±0.4027.61 0.40 0.5595±0.00810.5595 0.0081 0.0608±0.01900.0608 0.0190 26.14±0.7126.14 0.71 0.5350±0.01470.5350 0.0147 PPA [39] 0.7760±0.01200.7760 0.0120 26.61±0.3126.61 0.31 0.5080±0.01000.5080 0.0100 0.6708±0.01200.6708 0.0120 29.84±0.6129.84 0.61 0.5260±0.00420.5260 0.0042 0.7480±0.00990.7480 0.0099 22.72±0.5522.72 0.55 0.5448±0.01800.5448 0.0180 PLGMI [54] 0.3224±0.02240.3224 0.0224 50.26±2.2450.26 2.24 0.4835±0.00560.4835 0.0056 0.4489±0.02510.4489 0.0251 49.62±0.3349.62 0.33 0.4888±0.01060.4888 0.0106 0.5625±0.00550.5625 0.0055 57.52±1.3157.52 1.31 0.4804±0.01160.4804 0.0116 IFGMI [34] 0.8241±0.01020.8241 0.0102 32.53±0.4632.53 0.46 0.4873±0.00770.4873 0.0077 0.8062±0.00570.8062 0.0057 30.61±0.5230.61 0.52 0.4753±0.00750.4753 0.0075 0.7157±0.01290.7157 0.0129 31.24±0.2731.24 0.27 0.4507±0.00640.4507 0.0064 FGMIA [29] 0.8749±0.00480.8749 0.0048 34.88±0.6234.88 0.62 0.4306±0.00480.4306 0.0048 0.8719±0.00540.8719 0.0054 31.32±0.9931.32 0.99 0.4631±0.00330.4631 0.0033 0.9116±0.00740.9116 0.0074 22.40±0.8422.40 0.84 0.4046±0.00290.4046 0.0029 SFMI (Ours) 0.8980±0.00860.8980 0.0086 25.86±0.2125.86 0.21 0.4248±0.00810.4248 0.0081 0.9103±0.00730.9103 0.0073 27.61±0.3127.61 0.31 0.4419±0.00770.4419 0.0077 0.9150±0.00660.9150 0.0066 22.37±0.7422.37 0.74 0.3966±0.00410.3966 0.0041 Method Target: ArcFace (112×112112× 112) Target: MobileFaceNet (112×112112× 112) Target: ViT (112×112112× 112) ACC ↑ FID ↓ LPIPS ↓ ACC ↑ FID ↓ LPIPS ↓ ACC ↑ FID ↓ LPIPS ↓ GMI [56] 0.0379±0.02580.0379 0.0258 29.89±0.5829.89 0.58 0.5161±0.00930.5161 0.0093 0.1440±0.01580.1440 0.0158 26.50±0.1426.50 0.14 0.5059±0.00100.5059 0.0010 0.0418±0.00650.0418 0.0065 29.71±1.0929.71 1.09 0.5400±0.00680.5400 0.0068 PPA [39] 0.4191±0.01010.4191 0.0101 22.84±0.8722.84 0.87 0.5594±0.01430.5594 0.0143 0.8036±0.00700.8036 0.0070 27.49±0.0727.49 0.07 0.4549±0.00540.4549 0.0054 0.3698±0.01820.3698 0.0182 24.82±0.3824.82 0.38 0.5502±0.00820.5502 0.0082 PLGMI [54] 0.2357±0.02920.2357 0.0292 42.19±1.2842.19 1.28 0.4587±0.01010.4587 0.0101 0.8648±0.00810.8648 0.0081 39.25±0.3639.25 0.36 0.4383±0.01210.4383 0.0121 0.2555±0.00960.2555 0.0096 44.09±0.4644.09 0.46 0.4511±0.00790.4511 0.0079 IFGMI [34] 0.7544±0.02630.7544 0.0263 35.79±0.5135.79 0.51 0.4424±0.00170.4424 0.0017 0.8028±0.00730.8028 0.0073 34.84±0.3734.84 0.37 0.4099±0.00450.4099 0.0045 0.7471±0.01150.7471 0.0115 33.57±0.4933.57 0.49 0.4548±0.00470.4548 0.0047 FGMIA [29] 0.8880±0.00870.8880 0.0087 21.72±0.0821.72 0.08 0.4088±0.00120.4088 0.0012 0.9009±0.00640.9009 0.0064 22.98±0.3422.98 0.34 0.3884±0.00900.3884 0.0090 0.8074±0.05800.8074 0.0580 25.69±0.1925.69 0.19 0.3952±0.00500.3952 0.0050 SFMI (Ours) 0.9248±0.00890.9248 0.0089 22.61±0.3022.61 0.30 0.3874±0.00590.3874 0.0059 0.9335±0.01160.9335 0.0116 22.67±0.7422.67 0.74 0.3786±0.00880.3786 0.0088 0.8735±0.01470.8735 0.0147 25.61±0.6525.61 0.65 0.3918±0.01370.3918 0.0137 Table IV reports the main quantitative comparison between SFMI and representative white-box MIA baselines on six target face recognition models, using ACC, FID, and LPIPS as complementary evaluation metrics. SFMI achieves the highest ACC on all evaluated target models and the lowest LPIPS across all targets, indicating strong identity recovery together with superior perceptual consistency. For FID, SFMI attains the best score on Face.evoLVe and remains highly competitive on the other target models, suggesting that the gain in attack success is not obtained at the cost of noticeable realism degradation. Taken together, these results demonstrate that SFMI offers a favorable trade-off between semantic fidelity and visual quality, and that this advantage generalizes across target models with different architectural and loss-design characteristics. Figure 3 further provides visual comparisons. The first row shows real private images, and rows 2–7 correspond to GMI, PPA, PLGMI, IFGMI, FGMIA, and SFMI, respectively. In most cases, SFMI preserves facial geometry and identity-related local traits more clearly, while reducing common artifacts such as blurry textures and unstable high-frequency noise observed in baseline reconstructions. We also observe that several previous methods are, to some extent, misled during optimization, which causes their reconstruction trajectories to drift away from target identities and leads to substantial inconsistencies with the corresponding private faces. These qualitative observations are well aligned with the quantitative trends in Table IV, further confirming the robustness and visual fidelity of SFMI across diverse identities. Fig. 3: Qualitative visual comparison across MIA methods. The first row shows private ground-truth images, and rows 2–7 correspond to GMI, PPA, PLGMI, IFGMI, FGMIA, and SFMI, respectively. IV-C Ablation Studies To rigorously validate the necessity and individual contributions of the core components within the proposed SFMI method, we conduct a comprehensive ablation study. We systematically isolate the effects of the generative prior model, the auxiliary dataset distribution, the Progressive Guidance Scheduler (PGS), the optimization loss design, the input resolution, a simple output-perturbation defense, and a training-phase BiDO defense. Specifically, the variants include: replacing the FM prior with a DDPM prior paired with a DDIM sampler (DDPM prior + DDIM sampler); training the prior on FFHQ-pub instead of CelebA-pub (w/ FFHQ Prior); replacing PGS with a constant multiplier (w/ Constant Guidance); replacing the M loss with cross-entropy (w/ CE Loss (replace M)); increasing the target input resolution (w/ 224 Resolution); injecting noise into the target model output before computing attack guidance (w/ Output Perturbation); and training the target model with Bilateral Dependency Optimization (BiDO) [33] (w/ BiDO Defense). All ablation experiments are evaluated on the primary private dataset (privD_priv), with ArcFace as the main robust margin-based target and MobileFaceNet as an additional lightweight target for checking whether the component-level conclusions generalize across architectures. Following the standard MIA evaluation protocol, each target identity is attacked by sampling eight reconstructed images, and the reported metrics are averaged over all target identities rather than over a single example. To further verify that the component-level conclusions are not specific to ArcFace, we additionally repeat the same key ablations on MobileFaceNet, as summarized in Table VI. TABLE V: Detailed component ablation of SFMI on the ArcFace target: DDPM prior + DDIM sampler, w/ FFHQ Prior, w/ Constant Guidance, w/ CE Loss (replace M), w/ 224 Resolution, w/ Output Perturbation, and w/ BiDO Defense, with SFMI (Full) as the reference. Evaluation metrics are ACC (↑ ), FID (↓ ), and LPIPS (↓ ). Variant ACC ↑ FID ↓ LPIPS ↓ DDPM prior + DDIM sampler 0.1086 76.50 0.6084 w/ FFHQ Prior 0.8995 24.67 0.4564 w/ Constant Guidance 0.1658 80.66 0.5556 w/ CE Loss (replace M) 0.8842 23.99 0.4200 w/ 224 Resolution 0.8599 25.21 0.4593 w/ Output Perturbation 0.8858 21.77 0.4320 w/ BiDO Defense 0.8611 24.63 0.4291 SFMI (Full) 0.9248 22.61 0.3874 TABLE VI: Detailed component ablation of SFMI on the MobileFaceNet target: DDPM prior + DDIM sampler, w/ FFHQ Prior, w/ Constant Guidance, w/ CE Loss (replace M), w/ 224 Resolution, w/ Output Perturbation, and w/ BiDO Defense, with SFMI (Full) as the reference. Evaluation metrics are ACC (↑ ), FID (↓ ), and LPIPS (↓ ). Variant ACC ↑ FID ↓ LPIPS ↓ DDPM prior + DDIM sampler 0.0879 62.70 0.5848 w/ FFHQ Prior 0.8183 21.78 0.4390 w/ Constant Guidance 0.0387 56.71 0.5958 w/ CE Loss (replace M) 0.8983 23.80 0.4291 w/ 224 Resolution 0.8382 26.00 0.4237 w/ Output Perturbation 0.9012 23.01 0.4110 w/ BiDO Defense 0.8572 26.39 0.3978 SFMI (Full) 0.9335 22.67 0.3786 As observed in Table V, replacing the FM prior with a DDPM-trained prior and sampling it with DDIM (DDPM prior + DDIM sampler) still results in a substantial degradation in semantic recovery. Following the original DDIM formulation, this baseline uses the DDPM noise-prediction model to estimate the denoised image x^0 x_0 at each step, computes the target-model gradient through the predicted denoising path, and uses this gradient as guidance for DDIM sampling. Although DDIM removes step-wise sampling randomness, we observe that its guided trajectory is less robust and can more easily drift away from the natural image manifold. We attribute this to two factors: first, SFMI directly predicts the original image rather than relying on noise estimation, which is consistent with the denoising-oriented observation in [25]; second, the DDPM prior induces a more irregular noise-to-face trajectory than Flow Matching, making target-class optimization more difficult. In contrast, the FM velocity field provides a smoother backbone for progressive identity-gradient steering. Furthermore, to evaluate our method’s sensitivity to distribution shifts, we train the prior on the identity-disjoint FFHQ-pub subset (w/ FFHQ Prior) rather than the distributionally aligned CelebA-pub subset. Both public auxiliary subsets contain 30,000 images, so this comparison controls the auxiliary-data scale while changing only the public-prior distribution. The results indicate that while this dataset discrepancy introduces a minor degradation in performance, the overall attack remains highly effective. This demonstrates that SFMI does not strictly rely on matching the target’s data distribution, exhibiting strong cross-distribution robustness. Moreover, ablating the progressive schedule in favor of a static multiplier (w/ Constant Guidance) severely compromises the practical usability of the method. Applying a rigid, constant gradient force uniformly across all integration steps irrecoverably corrupts the highly noisy initial states. This abrupt intervention forces the generative trajectory completely off the natural face manifold, leading to catastrophic optimization collapse. Consequently, the ACC plummets and the generated outputs suffer from severe, unrecognizable visual artifacts (evidenced by a spike in FID). This validates that the carefully modulated temporal dynamics of our progressive guidance are absolutely critical for maintaining the structural integrity of the generation while simultaneously injecting identity-specific features. Regarding the loss design, replacing the margin-based M loss with a standard cross-entropy objective (w/ CE Loss (replace M)) leads to a slight but consistent performance drop compared with the full setting. This observation highlights the superiority of M for identity-level supervision and is broadly consistent with the findings reported in PLGMI [54]. Beyond validating our current design, it also suggests a promising direction for future work: developing more effective discriminative loss functions tailored to white-box model inversion. To further examine higher-resolution behavior, we include a 224-resolution setting in the ablation tables. Scaling SFMI to a higher face-recognition input resolution requires a resolution-matched FM prior and the same detected/aligned/cropped FR preprocessing pipeline; thus, the main practical constraints are the target model’s standardized input resolution and the computational cost of training and sampling the prior, rather than raw image size alone. Although the metrics moderately degrade at this higher resolution, the attack remains effective, indicating that SFMI is not restricted to low-resolution targets. To provide an initial defense-oriented evaluation, we add the w/ Output Perturbation setting in the ablation tables. In this setting, we inject Gaussian noise with standard deviation 0.03 into the target model output before computing attack guidance, representing a lightweight post-processing defense that can be applied without retraining the face recognition model. As shown in the ablation results, SFMI remains effective under this perturbation. We attribute this to the observation that the perturbation-induced interference with the guidance direction is negligible compared with the guidance signal required for face recognition model utility; consequently, the attack still performs well. To further evaluate SFMI against a training-phase defense, we adopt BiDO [33] and train defended ArcFace and MobileFaceNet models on the same private-data split before attacking them with the unchanged SFMI protocol. The corresponding defense results are reported in Tables V and VI. For ArcFace and MobileFaceNet, BiDO lowers attack ACC by 6.37% and 7.63%, respectively, at the cost of 6.86% and 4.45% reductions in target-model recognition accuracy. These results demonstrate that BiDO provides measurable protection but does not eliminate the inversion risk, revealing a clear trade-off between defense effectiveness and model utility. IV-D Detailed Parameter Analysis of Progressive Guidance Having established that a meticulously designed progressive guidance schedule is paramount to the method’s overall usability, we now provide an in-depth parameter analysis of trajectory steering dynamics. We systematically evaluate seven variants of the guidance mechanism to dissect the functional necessity of both spatial direction alignment and the temporal warm-up, sustain, and annealing phases. To intuitively illustrate the impact of each hyperparameter and structural choice, Fig. 4 presents a comprehensive visual and quantitative matrix on the CosFace target model. The first column shows the mathematical curve of the guidance function γ(t)γ(t), and columns 2 through 8 visualize intermediate generation states from initial noise to a fully formed image. The final three columns report the reconstructed attack image, the corresponding real ground-truth face, and the ACC trajectory over guidance sampling steps, respectively. Fig. 4: Detailed row-wise analysis of progressive guidance variants on the CosFace target model. Rows 1–7 correspond to constant guidance (1.0), linear increase (0.0→ 1.0), linear decay (1.0→ 0.0), unnormalized PGS, prolonged-peak PGS, standard PGS+CE loss, and standard PGS+M loss (ours). For each row, the first column shows the guidance curve γ(t)γ(t), middle columns show intermediate trajectory states, and the final three columns report the reconstructed image, ground-truth face, and the ACC evolution curve over sampling steps. In the ACC curve, the blue line denotes ACC on the target model, and the yellow line denotes ACC on validation models. A row-wise reading of Fig. 4 reveals several important behaviors. In Row 1, we remove PGS and apply a constant guidance coefficient of 1.0 without normalization; this seemingly simple guidance is too weak to effectively redirect the generation trajectory toward the target classifier. In Row 2, we again remove PGS and use a linear increase from 0.0 to 1.0 (also without normalization), but the guidance still fails to produce reliable identity steering. In Row 3, we use a linear decay from 1.0 to 0.0 without normalization and observe similarly weak control over facial trajectory evolution. In Row 4, we retain the PGS shape but remove normalization; although the schedule is more structured, the steering strength remains insufficient and reconstruction quality is still unsatisfactory. This weakness is also reflected by the last-column ACC curves, where both the blue target-model line and the yellow validation-model line remain relatively low or fluctuate unstably, indicating limited optimization effectiveness and poor transfer consistency. Rows 5–7 further clarify how schedule design and loss design interact. In Row 5, based on standard PGS, we prolong the high-guidance stage and find that excessive late-stage forcing degrades performance on validation models, likely due to artifact accumulation in the refinement phase; correspondingly, the yellow curve drops in later steps and the blue-yellow gap widens, suggesting overfitting to short-term target gradients. In Row 6, standard PGS with CE loss already yields reasonably effective guidance and improved identity consistency, with both curves showing a clearer upward trend. In Row 7, standard PGS with our recommended M loss achieves the best overall behavior: both target-model optimization and validation-model accuracy improve more stably, leading to the most favorable final reconstructions and the most consistent dual-curve progression. The standard PGS configuration used in Eq. (11) is M=0.3M=0.3, t0=0.1t_0=0.1, t1=0.3t_1=0.3, t2=0.7t_2=0.7, and Vmax=1.0V_ =1.0. The scheduler progressively introduces identity guidance and then attenuates it before final refinement, thereby balancing effective steering toward the target identity with stable evolution along the learned face manifold. The PGS hyperparameters do not need to be reselected for every target model: by normalizing the identity gradient and scaling it relative to the current FM velocity, SFMI reduces sensitivity to variations in target-model gradient magnitude and yields relatively stable hyperparameter choices across architectures. In practice, we retain the standard relative phase allocation defined by t0t_0, t1t_1, and t2t_2, together with VmaxV_ , and primarily adjust the global scale M, which is typically kept at or below 0.35 to preserve manifold stability. V Ethical Considerations This work studies model inversion attacks to audit privacy leakage in face recognition systems under a white-box, strong-access threat model. All experiments are conducted on publicly available research datasets, including CelebA and FFHQ, which are used only for academic evaluation in accordance with their dataset terms and without redistributing the original data. The qualitative reconstructions shown in the paper are included to demonstrate potential privacy leakage risks rather than to identify, profile, or target any individual. We treat publication as bounded academic disclosure of this privacy risk, acknowledge the dual-use nature of identity-reconstruction attacks, and frame SFMI as a privacy-auditing tool for researchers, developers, and system owners to motivate stronger privacy-preserving face recognition defenses, rather than as a practical guide for misuse. VI Conclusion In this paper, we introduced Steering Flow Model Inversion (SFMI), a method that reformulates white-box model inversion attacks as a deterministic trajectory-steering problem. By leveraging the continuous ODE formulation of Flow Matching, SFMI helps mitigate the optimization instability in highly non-convex GAN latent spaces and the stochastic disruption typical of standard diffusion models. Furthermore, we designed a progressive gradient guidance mechanism that dynamically modulates adversarial force across integration steps, ensuring precise temporal and spatial alignment with the generative flow. Extensive experiments demonstrate that SFMI delivers strong and competitive performance relative to state-of-the-art methods, particularly in attack accuracy and visual fidelity, while maintaining competitive distribution-level fidelity. SFMI also exhibits strong attack capability against robust margin-based face recognition architectures such as CosFace and ArcFace and maintains cross-distribution generalization. SFMI still has limitations. First, it involves relatively many hyperparameters and tuning can be difficult, and effective settings depend on a clear understanding of guidance dynamics. Second, SFMI is a white-box method that requires full access to the target model including gradients, which corresponds to a relatively high-access setting in practical scenarios. Third, SFMI depends on access to relevant public auxiliary face data, and its performance may degrade under larger domain shifts between the public and private data. Fourth, SFMI is not intended to attack directly on IoT devices; instead, the deployed target model must first be extracted from the device and then attacked using external computing resources. Fifth, cross-model ACC evaluation and LPIPS provide complementary evidence of identity recovery and perceptual similarity. Nevertheless, ACC remains a cross-model recognition proxy, and satisfying face recognition evaluators does not necessarily imply alignment with human identity perception. Overall, SFMI provides a rigorous and effective tool for auditing privacy leakage in deep biometric systems. In future work, we plan to investigate privacy-preserving face recognition models, weaker-access and black-box model inversion scenarios, more robust attack methods that reduce reliance on many hyperparameters, stronger defensive paradigms against model inversion attacks, and model inversion methods that better align with human identity judgments. References [1] S. Chen, Y. Liu, X. Gao, and Z. Han (2018) MobileFaceNets: efficient cnns for accurate real-time face verification on mobile devices. In Proc. Chinese Conf. Biometric Recognit.(CCBR), p. 428–438. Cited by: §I-A, §IV-A. [2] S. Chen, M. Kahla, R. Jia, and G. Qi (2021) Knowledge-enriched distributional model inversion attacks. Proc. IEEE/CVF Int. Conf. Comput. Vis.(ICCV), p. 16178–16187. Cited by: §I-B, TABLE I. [3] Y. Cheng, J. Zhao, Z. Wang, Y. Xu, J. Karlekar, S. Shen, and J. Feng (2017) Know you at one glance: a compact vector representation for low-shot learning. In Proc. IEEE Int. Conf. Comput. Vis. Workshops(ICCVW), p. 1924–1932. Cited by: §IV-A. [4] J. Deng, J. Guo, J. Yang, N. Xue, I. Kotsia, and S. Zafeiriou (2022) ArcFace: additive angular margin loss for deep face recognition. IEEE Trans. Pattern Anal. Mach. Intell.(TPAMI) 44 (10), p. 5962–5979. Cited by: §I-A, §IV-A. [5] A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly, J. Uszkoreit, and N. Houlsby (2021) An image is worth 16x16 words: transformers for image recognition at scale. In Proc. Int. Conf. Learn. Represent.(ICLR), Cited by: §I-A, §IV-A. [6] H. Du, H. Shi, D. Zeng, X. Zhang, and T. Mei (2021) The elements of end-to-end deep face recognition: a survey of recent advances. Cited by: §I-A. [7] P. Esser, S. Kulal, A. Blattmann, R. Entezari, J. Müller, H. Saini, Y. Levi, D. Lorenz, A. Sauer, F. Boesel, et al. (2024) Scaling rectified flow transformers for high-resolution image synthesis. In Proc. Int. Conf. Mach. Learn.(ICML), Cited by: §I-B2. [8] H. Fang, Y. Qiu, H. Yu, W. Yu, J. Kong, B. Chong, B. Chen, X. Wang, S. Xia, and K. Xu (2024) Privacy leakage on dnns: a survey of model inversion attacks and defenses. arXiv preprint arXiv:2402.04013. Cited by: §I-B, §I-B. [9] M. Fredrikson, S. Jha, and T. Ristenpart (2015) Model inversion attacks that exploit confidence information and basic countermeasures. In Proc. ACM SIGSAC Conf. Comput. Commun. Secur.(CCS), p. 1322–1333. Cited by: §I-B, TABLE I. [10] I. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y. Bengio (2020) Generative adversarial networks. Commun. ACM(CACM) 63 (11), p. 139–144. Cited by: §I. [11] J. Gui, Z. Sun, Y. Wen, D. Tao, and J. Ye (2021) A review on generative adversarial networks: algorithms, theory, and applications. IEEE Trans. Knowl. Data Eng.(TKDE) 35 (4), p. 3313–3332. Cited by: §I. [12] I. Gulrajani, F. Ahmed, M. Arjovsky, V. Dumoulin, and A. Courville (2017) Improved training of wasserstein gans. In Adv. Neural Inf. Process. Syst.(NeurIPS), Vol. 30, p. 5767–5777. Cited by: TABLE I. [13] K. He, X. Zhang, S. Ren, and J. Sun (2016) Deep residual learning for image recognition. In Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recogn.(CVPR), p. 770–778. Cited by: §I-A, §IV-A. [14] M. Heusel, H. Ramsauer, T. Unterthiner, B. Nessler, and S. Hochreiter (2017) GANs trained by a two time-scale update rule converge to a local nash equilibrium. Adv. Neural Inf. Process. Syst.(NeurIPS) 30. Cited by: §IV-A. [15] S. Ho, K. J. Hao, K. Chandrasegaran, N. Nguyen, and N. Cheung (2024) Model inversion robustness: can transfer learning help?. In Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recogn.(CVPR), p. 12183–12193. Cited by: §I-B. [16] P. Hu, H. Ning, T. Qiu, H. Song, Y. Wang, and X. Yao (2017) Security and privacy preservation scheme of face identification and resolution framework using fog computing in internet of things. IEEE Internet Things J.(IoT-J) 4 (5), p. 1143–1155. Cited by: §I-B. [17] N. Kandpal, E. Wallace, and C. Raffel (2022) Deduplicating training data mitigates privacy risks in language models. In Proc. Int. Conf. Mach. Learn.(ICML), p. 10697–10707. Cited by: §I-B. [18] T. Karras, M. Aittala, T. Aila, and S. Laine (2022) Elucidating the design space of diffusion-based generative models. In Adv. Neural Inf. Process. Syst.(NeurIPS), Cited by: §I-B3. [19] T. Karras, S. Laine, and T. Aila (2019) A style-based generator architecture for generative adversarial networks. In Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recogn.(CVPR), p. 4401–4410. Cited by: §IV-A. [20] T. Karras, S. Laine, M. Aittala, J. Hellsten, J. Lehtinen, and T. Aila (2020) Analyzing and improving the image quality of stylegan. In Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recogn.(CVPR), p. 8110–8119. Cited by: TABLE I, TABLE I. [21] M. Khosravy, K. Nakamura, Y. Hirose, N. Nitta, and N. Babaguchi (2022) Model inversion attack by integration of deep generative models: privacy-sensitive face generation from a face recognition system. IEEE Trans. Inf. Forensics Secur.(TIFS) 17, p. 357–372. Cited by: §I-B, TABLE I. [22] M. Kim, A. Jain, and X. Liu (2025) 50 years of automated face recognition. Cited by: §I-A. [23] C. Lai, Y. Song, D. Kim, Y. Mitsufuji, and S. Ermon (2025) The principles of diffusion models. arXiv preprint arXiv:2510.21890. Cited by: §I. [24] O. Li, Y. Hao, Z. Wang, B. Zhu, S. Wang, Z. Zhang, and F. Feng (2024) Model inversion attacks through target-specific conditional diffusion models. arXiv preprint arXiv:2407.11424. Cited by: §I-B, TABLE I. [25] T. Li and K. He (2026) Back to basics: let denoising generative models denoise. In Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recogn.(CVPR), p. 36115–36125. Cited by: §I-B2, §I-B2, §IV-A, §IV-C. [26] Y. Lipman, R. T. Q. Chen, H. Ben-Hamu, M. Nickel, and M. Le (2023) Flow matching for generative modeling. In Proc. Int. Conf. Learn. Represent.(ICLR), Cited by: §I, §I-B2, §I-B2. [27] Z. Liu and S. Chen (2024) Trap-MID: trapdoor-based defense against model inversion attacks. In Adv. Neural Inf. Process. Syst.(NeurIPS), Vol. 37, p. 88486–88526. Cited by: §I-B. [28] Z. Liu, P. Luo, X. Wang, and X. Tang (2015) Deep learning face attributes in the wild. In Proc. IEEE Int. Conf. Comput. Vis.(ICCV), p. 3730–3738. Cited by: §IV-A. [29] Y. Lu, S. Wang, G. Zhu, Z. Zhang, and J. Huang (2025) FGMIA: feature-guided model inversion attacks against face recognition models. IEEE Trans. Inf. Forensics Secur.(TIFS) 20, p. 8465–8480. Cited by: §I-B, TABLE I, §IV-B, TABLE I, TABLE IV, TABLE IV, TABLE IV. [30] M. Nasr, R. Shokri, and A. Houmansadr (2019) Comprehensive privacy analysis of deep learning: passive and active white-box inference attacks against centralized and federated learning. In Proc. IEEE Symp. Secur. Privacy(SP), p. 739–753. Cited by: §I-B. [31] N. Nguyen, K. Chandrasegaran, M. Abdollahzadeh, and N. Cheung (2023) Re-thinking model inversion attacks against deep neural networks. Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recogn.(CVPR), p. 16384–16393. Cited by: §I-B. [32] W. Peebles and S. Xie (2023) Scalable diffusion models with transformers. In Proc. IEEE/CVF Int. Conf. Comput. Vis.(ICCV), p. 4195–4205. Cited by: §I. [33] X. Peng, F. Liu, J. Zhang, L. Lan, J. Ye, T. Liu, and B. Han (2022) Bilateral dependency optimization: defending against model-inversion attacks. In Proc. ACM SIGKDD Conf. Knowl. Discov. Data Min.(KDD), p. 1358–1367. External Links: Document Cited by: §IV-C, §IV-C. [34] Y. Qiu, H. Fang, H. Yu, B. Chen, M. Qiu, and S. Xia (2024) A closer look at gan priors: exploiting intermediate features for enhanced model inversion attacks. In Proc. Eur. Conf. Comput. Vis.(ECCV), p. 109–126. Cited by: §I-B, TABLE I, §IV-B, TABLE I, TABLE IV, TABLE IV, TABLE IV. [35] F. Schroff, D. Kalenichenko, and J. Philbin (2015) FaceNet: a unified embedding for face recognition and clustering. In Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recogn.(CVPR), p. 815–823. Cited by: §I-A. [36] Z. Shen, Z. Xia, K. Gan, P. Yu, and X. Zhou (2026) SWFTI: facial template inversion via styleswin mapping. Pattern Recognit.(PR), p. 113190. Cited by: §I-B. [37] C. Song, T. Ristenpart, and V. Shmatikov (2017) Machine learning models that remember too much. In Proc. ACM SIGSAC Conf. Comput. Commun. Secur.(CCS), p. 587–601. Cited by: §I-B. [38] Y. Song, P. Dhariwal, M. Chen, and I. Sutskever (2023) Consistency models. In Proc. Int. Conf. Mach. Learn.(ICML), Proceedings of Machine Learning Research, Vol. 202, p. 32211–32252. Cited by: §I. [39] L. Struppek, D. Hintersdorf, A. D. A. Correia, A. Adler, and K. Kersting (2022) Plug & play attacks: towards robust and flexible model inversion attacks. Proc. Int. Conf. Mach. Learn.(ICML) 162, p. 20522–20545. Cited by: §I-B, TABLE I, §IV-B, TABLE I, TABLE IV, TABLE IV, TABLE IV. [40] L. Struppek, D. Hintersdorf, and K. Kersting (2024) Be careful what you smooth for: label smoothing can be a privacy shield but also a catalyst for model inversion attacks. In Proc. Int. Conf. Learn. Represent.(ICLR), Cited by: §I-B. [41] D. Usynin, D. Rueckert, and G. Kaissis (2023) Beyond gradients: exploiting adversarial priors in model inversion attacks. ACM Trans. Priv. Secur.(TOPS) 26 (3), p. 1–30. Cited by: §I-B. [42] H. Wang, Y. Wang, Z. Zhou, X. Ji, D. Gong, J. Zhou, Z. Li, and W. Liu (2018) Cosface: large margin cosine loss for deep face recognition. In Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recogn.(CVPR), p. 5265–5274. Cited by: §I-A, §IV-A. [43] K. Wang, Y. Fu, K. Li, A. Khisti, R. Zemel, and A. Makhzani (2021) Variational model inversion attacks. Adv. Neural Inf. Process. Syst.(NeurIPS) 34, p. 31686–31698. Cited by: §I-B. [44] M. Wang and W. Deng (2021) Deep face recognition: a survey. Neurocomputing 429, p. 215–244. Cited by: §I-A. [45] T. Wang, Y. Zhang, and R. Jia (2021) Improving robustness to model inversion attacks via mutual information regularization. In Proc. AAAI Conf. Artif. Intell.(AAAI), Vol. 35, p. 11666–11673. Cited by: §I-B. [46] X. Wang, J. Peng, S. Zhang, B. Chen, Y. Wang, and Y. Guo (2022) A survey of face recognition. Cited by: §I, §I-A. [47] X. Wang, H. Sun, and Y. He (2026) GIDD: gradient inversion using diffusion model for denoising in federated learning. Neurocomputing, p. 132682. Cited by: §I-B. [48] J. Wen, S. Yiu, and L. C. K. Hui (2021) Defending against model inversion attack by adversarial examples. In Proc. IEEE Int. Conf. Cyber Secur. Resilience(CSR), p. 551–556. Cited by: §I-B. [49] R. Yang, J. Ma, J. Zhang, S. Kumari, S. Kumar, and J. J. Rodrigues (2023) Practical feature inference attack in vertical federated learning during prediction in artificial internet of things. IEEE Internet Things J.(IoT-J) 11 (1), p. 5–16. Cited by: §I-B. [50] S. Yang, Y. Wen, L. He, M. Zhou, and A. Abusorrah (2021) Sparse individual low-rank component representation for face recognition in the iot-based system. IEEE Internet Things J.(IoT-J) 8 (24), p. 17320–17332. Cited by: §I-B. [51] W. Yang, S. Wang, D. Wu, T. Cai, Y. Zhu, S. Wei, Y. Zhang, X. Yang, Z. Tang, and Y. Li (2025) Deep learning model inversion attacks and defenses: a comprehensive survey. Artif. Intell. Rev. 58 (8), p. 242. Cited by: §I-B. [52] Z. Yang, B. Shao, B. Xuan, E. Chang, and F. Zhang (2020) Defending model inversion and membership inference attacks via prediction purification. arXiv preprint arXiv:2005.03915. Cited by: §I-B. [53] Z. Yang, J. Zhang, E. Chang, and Z. Liang (2019) Neural network inversion in adversarial setting via background knowledge alignment. In Proc. ACM SIGSAC Conf. Comput. Commun. Secur.(CCS), p. 225–240. Cited by: §I-B, TABLE I. [54] X. Yuan, K. Chen, J. Zhang, W. Zhang, N. Yu, and Y. Zhang (2023) Pseudo label-guided model inversion attack via conditional generative adversarial network. In Proc. AAAI Conf. Artif. Intell.(AAAI), Vol. 37, p. 3349–3357. Cited by: §I-B, TABLE I, §I-B3, §IV-B, §IV-C, TABLE I, TABLE IV, TABLE IV, TABLE IV. [55] R. Zhang, P. Isola, A. A. Efros, E. Shechtman, and O. Wang (2018) The unreasonable effectiveness of deep features as a perceptual metric. In Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recogn.(CVPR), p. 586–595. Cited by: §IV-A. [56] Y. Zhang, R. Jia, H. Pei, W. Wang, B. Li, and D. Song (2020) The secret revealer: generative model-inversion attacks against deep neural networks. In Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recogn.(CVPR), p. 253–261. Cited by: §I-B, TABLE I, §IV-B, TABLE I, TABLE IV, TABLE IV, TABLE IV. [57] L. Zhou, Y. Zhu, and R. Liu (2026) Model inversion attack against federated unlearning. IEEE Trans. Inf. Forensics Secur.(TIFS). Cited by: §I-B.