aiqbench analysis
FlowGuard introduces a flow-matching defense that detects data-free model stealing attacks by identifying synthetic queries as out-of-distribution before they reach the intrusion detection system. Unlike existing methods that fail against distributed Sybil attackers or require identity-bound monitoring, this approach maintains stable detection rates across single-client and large-scale distributed scenarios without relying on user identity. The technique leverages the lower-dimensional manifold of adversarial traffic to achieve robustness in hard-label IDS deployments, offering a critical upgrade for securing AI-based infrastructure against offline evasion tactics.
FlowGuard: Flow Matching for Identity-Independent Detection of Data-Free Model Stealing Attacks on Energy System Intrusion Detection Systems
arXiv:2606.03430v1 Announce Type: cross Abstract: Artificial Intelligence (AI)-based Intrusion Detection Systems (IDS) deployed in energy infrastructure are vulnerable to model theft attacks, which allow adversaries to create evasive traffic offline. Current defences against model extraction rely either on identity-bound query monitoring, which is ineffective against distributed attackers (Sybil), or on prediction poisoning through soft-label perturbation, which is inapplicable to hard-label IDS deployments. Therefore, we propose FlowGuard, an identity-independent defence based on flow matching that classifies incoming queries as out-of-distribution (OOD) prior to IDS processing. This approach exploits the fact that queries generated synthetically for data-free model stealing attacks occupy a lower-dimensional manifold than real network traffic. This results in measurably lower log-likelihoods when using a Continuous Normalizing Flow that has been trained on legitimate data. We evaluate our method against PRADA and FDINet using MAZE and DisGUIDE attacks in single-client and distributed (100-client Sybil) settings. While PRADA's detection rate dropped to 0% when the distribution changed, our defence maintained a stable detection rate across both settings without relying on identity information. We discuss the scope and limitations of the approach, and outline potential applications to data-dependent attacks.
Abstract:Artificial Intelligence (AI)-based Intrusion Detection Systems (IDS) deployed in energy infrastructure are vulnerable to model theft attacks, which allow adversaries to create evasive traffic offline. Current defences against model extraction rely either on identity-bound query monitoring, which is ineffective against distributed attackers (Sybil), or on prediction poisoning through soft-label perturbation, which is inapplicable to hard-label IDS deployments. Therefore, we propose FlowGuard, an identity-independent defence based on flow matching that classifies incoming queries as out-of-distribution (OOD) prior to IDS processing. This approach exploits the fact that queries generated synthetically for data-free model stealing attacks occupy a lower-dimensional manifold than real network traffic. This results in measurably lower log-likelihoods when using a Continuous Normalizing Flow that has been trained on legitimate data. We evaluate our method against PRADA and FDINet using MAZE and DisGUIDE attacks in single-client and distributed (100-client Sybil) settings. While PRADA's detection rate dropped to 0% when the distribution changed, our defence maintained a stable detection rate across both settings without relying on identity information. We discuss the scope and limitations of the approach, and outline potential applications to data-dependent attacks.
Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI)
arXiv:2606.03430 [cs.CR]
(or arXiv:2606.03430v1 [cs.CR] for this version)
https://doi.org/10.48550/arXiv.2606.03430 Focus to learn more arXiv-issued DOI via DataCite (pending registration)
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Full text under the publisher's open licence · 280 words
Related coverage
News
Quantum Computing Report · Jul 25, 2026
A shared agentic platform for Wood Mackenzie, on Amazon Bedrock AgentCore
AWS · Sep 17, 2026
Natera’s intelligent appointment scheduling with Amazon Bedrock AgentCore
AWS · Aug 26, 2026
Manage agents, tools and skills at scale with AWS Agent Registry
AWS · Aug 31, 2026