{"id":"9aa7d579-5019-499f-b096-99ba28b478a4","arxiv_id":"2505.18171","paper_version":1,"verdict":"REJECT","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":3,"one_line_summary":"A denoising auxiliary loss on perturbed entity embeddings improves KGE robustness on FB15k-237, but the proposed certified robustness metrics rest on a misapplication of randomized smoothing.","lead":"The paper adds a denoising loss to knowledge graph embedding models so they handle small random perturbations of entity vectors, and reports improved link prediction on the FB15k-237 dataset. It also proposes certified robustness metrics based on randomized smoothing, but the certification is applied to the base model rather than the smoothed model, so the certificates are not valid.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Randomized smoothing certificate is applied to the base KGE model, not the smoothed classifier; the claimed certified radii in Definition 1 and Table 1 do not follow from Cohen et al. (2019).","rationale":"The paper's central contribution has two parts: a denoising regularizer and certified robustness metrics. The regularizer may be a useful heuristic, but the certified metrics are derived from a misapplication of randomized smoothing. Definition 1 (Section 3.3) states the certificate for the base model M, and Appendix A explicitly claims CR_f = CR_g at high confidence. Both are incorrect: Cohen et al.'s Theorem 1 concerns the smoothed classifier g, not f. Since the paper's ACR/σ and CA in Table 1 are computed by querying M with Gaussian noise and counting correct outputs, they are not certified radii. This failure is load-bearing because the abstract and method claim 'certified robustness evaluation metrics'. The limitation section even notes that applying randomized smoothing 'directly' to models gives unsatisfactory robustness, but this does not repair the certificate. The denoising result could be salvaged as an empirical robustness improvement, and the paper could be revised to either construct the smoothed classifier or drop the certified claim; as submitted, the central claim is unsupported.","tokens_in":8987,"tokens_out":5325,"duration_ms":52343,"concrete_test":"Run a projected-gradient attack with ℓ2 budget σΦ^{-1}(p_T) on the trained HousE-D model for 100 test queries with estimated p_T > 0.999; if any perturbation with norm below the claimed radius changes the top-1 predicted entity, Definition 1 is empirically false for the base model.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section 3.3 (Definition 1) and Appendix A assert that a lower bound p_T > 1/2 on P(M(q,ε)=e_T) implies M(q,δ)=e_T for all ||δ||_2 < σΦ^{-1}(p_T), i.e., a certified radius for the base KGE model M itself. In Cohen et al. (2019), this guarantee holds only for the smoothed classifier g(x)=argmax_c P(f(x+ε)=c), not for the base classifier f. The paper never constructs or evaluates g; it estimates p_T by applying Gaussian noise to the base model's inputs and then reports ACR/σ and CA computed from M. Appendix A's statement that 'at high confidence C, the gap between the certified robustness of the base classifier f and its smoothed version g becomes negligible' is not a theorem and does not make M certified. A base model can have high empirical accuracy under Gaussian noise while being arbitrarily fragile at individual points within the claimed radius. Therefore the headline claim of 'certified robustness evaluation metrics' is unsupported; the reported numbers are at best empirical robustness under random perturbation, not certificates.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes RKGE-D, a framework that augments arbitrary knowledge graph embedding (KGE) models with a denoising auxiliary loss, motivated by the score-matching interpretation of denoising autoencoders. The authors also propose certified robustness metrics for KGE link prediction based on randomized smoothing, reporting average certified radius (ACR/σ) and certified accuracy (CA) on FB15k-237. Empirically, they show that applying RKGE-D to TuckER and HousE improves link prediction performance on embeddings perturbed with Gaussian noise, and they report multi-hop reasoning results across several base models.","tokens_in":9246,"tokens_out":3377,"duration_ms":30596,"significance":"The general idea of using denoising as a training regularizer for KGE robustness is interesting and plausibly useful, and the multi-hop experiments give some indication of practical benefit. However, the central methodological contribution—the certified robustness evaluation—is based on an incorrect application of randomized smoothing, and the score-matching derivation rests on an unverified equality. If the certification claim were correct, the ACR/σ and CA metrics would be valuable; as written, the paper's headline robustness guarantee is not supported. The empirical work is further limited to a single dataset with no error bars, so the claimed consistency of improvement is not established.","major_comments":[{"comment":"The certified-radius claim is applied to the base KGE model M, but the randomized smoothing theorem of Cohen et al. (2019) guarantees robustness only for the smoothed classifier g(x)=argmax_c P(f(x+ε)=c), not for the base classifier f. The paper estimates p_T by sampling the base model's outputs under Gaussian noise and then asserts that M(q,δ)=e_T for all ||δ||_2 < σΦ^{-1}(p_T). This does not follow: a base model can be accurate on average under Gaussian perturbation while being arbitrarily fragile at individual points within the claimed radius. The statement in Appendix A that 'at high confidence C, the gap between the certified robustness of the base classifier f and its smoothed version g becomes negligible' is not a theorem and is not justified by any argument. Therefore the ACR/σ and CA values reported in Table 1 are at best empirical robustness measures under random perturbation, not certified radii, and the paper's claim of proposing 'certified robustness evaluation metrics' is unsupported.","section":"Section 3.2, Eqs. (2)-(3)"},{"comment":"The denoising loss is derived by asserting the identity ∇_{\\tilde e} log q_σ(\\tilde e) = ∇_{\\tilde h} E(\\tilde h, r, t) (footnote 1). This equality is not derived or tested; it is an ad hoc assumption that the gradient of the KGE energy at a noisy embedding equals the score of the noise-perturbed data distribution. Without this identity, the loss L_d = ||n - \\hat n||^2 with \\hat n = -∇_{\\tilde h} E is not a score-matching objective, and the 'denoising' interpretation of the auxiliary loss is not grounded in the cited theory. Since this is the mechanism by which RKGE-D is claimed to improve robustness, the central methodological justification is incomplete.","section":"Section 3.2, Eqs. (2)-(3)"},{"comment":"The empirical support for the main claim is thin. Results are reported on a single dataset (FB15k-237) with no error bars, multiple random seeds, or significance tests, so the 'consistently superior performance' claimed in the abstract is not established. The HousE comparison is particularly problematic: the paper states that 'due to HousE's strong stability against perturbations, the effect of RKGE-D is not evident under small noise levels,' and therefore applies post hoc noise scales α=100 and α=150 for HousE only. This selective choice of evaluation noise to reveal an effect does not provide a fair comparison with the other models, which are evaluated at α=2 and α=5.","section":"Table 1 and Section 4.2"},{"comment":"There is a notation and conceptual mismatch in the definition of σ. In Eq. (1), σ is described as the 99.73% quantile point of |e_i|, and noise is added as \\tilde e_i = e_i + α ϵ_i with ϵ_i ~ N(0,σ), so the actual noise standard deviation is ασ. In Definition 1 and Eq. (6), however, σ is used in the certified radius formula CR = σ Φ^{-1}(p_T), where randomized smoothing requires σ to be the standard deviation of the Gaussian noise added during certification. The paper's σ is data-dependent and per-entity, not a single noise level, and the relationship between the σ in Eq. (1) and the σ in Eq. (6) is never clarified. As a result, the reported ACR/σ values do not correspond to a well-defined noise level, and the certificate in Eq. (6) is not correctly instantiated.","section":"Eq. (1) and Definition 1"}],"minor_comments":[{"comment":"The abstract claims 'consistently superior performance compared to existing state-of-the-art KGE methods,' but the experiments cover only FB15k-237; this overstates the generality of the results.","section":"Abstract"},{"comment":"Several entries in Table 1 are formatted incorrectly, with values running together (e.g., '197.214' appears to be two separate numbers, and '301.401' in the TuckER-D row). The table needs careful proofreading.","section":"Table 1"},{"comment":"The limitation paragraph states that 'directly applying randomized smoothing to models results in unsatisfactory robustness' and attributes the issue to the noise sensitivity of the base model. This is in tension with the paper's certification claim, and the authors should reconcile these statements or remove the certification language.","section":"Limitation paragraph"},{"comment":"The definition of CA(Rp) in Eq. (9) counts triples with CR(M,T_i) > R_p; CA(0) simply counts triples where the estimated lower bound p_T exceeds 0.5. This is a weak measure and should be justified as meaningful, especially since no adversarial or worst-case evaluation is performed.","section":"Section 3.3.1"},{"comment":"The related work section would benefit from a discussion of prior work on robustness of KGE models under embedding perturbations; the current review focuses on NLP and image domains and does not situate the work within any existing KGE robustness literature beyond data-space noise.","section":"Related Work"}],"recommendation":"reject","confidential_remarks":"The paper's central certified-robustness contribution is founded on a misapplication of randomized smoothing, and the score-matching derivation relies on an asserted equality that is not established. These are not local presentation issues; they affect the main claims. The empirical evaluation is also too narrow (one dataset, no variance estimates, post hoc noise scales) to support the abstract's sweeping claims. The multi-hop reasoning results (Table 2) are suggestive that the auxiliary loss may help in practice, and a revised paper that (i) correctly constructs and evaluates a smoothed classifier, (ii) validates or replaces the score-matching identity, and (iii) reports multi-dataset results with uncertainty could be a useful contribution. As written, however, the load-bearing flaws warrant rejection."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The useful core here is real: a denoising auxiliary loss defined via the energy gradient, applied to embedding-space perturbations, is a sensible and novel way to regularize KGE training. The paper is the first to my knowledge to treat noise in embedding space rather than in triple space, and the empirical gains on FB15k-237 across several backbones are credible, even if modest. The multi-hop case study is a nice touch, too.\n\nThe problem is the certificate. Definition 1 and Appendix A apply the randomized smoothing result to the base model M itself, but Cohen et al. guarantee robustness only for the smoothed classifier g(x)=argmax P(f(x+ε)=c). The paper never constructs or evaluates g. The Appendix A claim that 'at high confidence C the gap becomes negligible' is not a theorem; a base model can be accurate under Gaussian noise and still be arbitrarily fragile within the certified radius. So the ACR/σ and CA numbers in Table 1 are not certified robustness metrics. They are empirical robustness under random perturbation. That is a load-bearing error because the abstract and Section 3.3 advertise certification.\n\nOther soft spots: experiments use only FB15k-237 with no error bars or significance tests, the HousE evaluation requires post hoc noise scales (α=100,150) to show an effect, and the score-matching derivation is asserted rather than derived (the definition of ∇_e log q as the energy gradient is hand-wavy). The hyperparameter sensitivity is fine but thin.\n\nNone of this kills the underlying idea. The denoising regularizer could still be valuable as a heuristic robustness enhancer, and the paper would be salvageable if the authors either (a) actually build the smoothed model and report certificates for it, or (b) drop the certification language and present the metrics as empirical robustness. As submitted, the claims outrun the evidence.\n\nThis paper deserves a serious referee because the contribution is non-routine and the flaw is fixable. I would not cite the certified numbers, but I might cite the denoising framework if the authors revise. Reading group maybe—the certification mistake is a useful teaching example, and the denoising idea is worth discussing. My recommendation: send it to review, but expect a request for major revision before it is publishable.","headline":"The denoising regularizer is a genuinely useful idea for KGE, but the certified robustness claims rest on a misapplication of randomized smoothing and need major revision.","tokens_in":9735,"tokens_out":1269,"would_cite":false,"duration_ms":14275,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Adding a score-matching denoising loss makes knowledge-graph link prediction stable under embedding perturbation.","keywords":["knowledge graph embedding","robustness","denoising","score matching","randomized smoothing","certified robustness","link prediction","multi-hop reasoning"],"falsifier":"Search FB15k-237 test triples for a model whose estimated correct-output lower bound $\\underline{p}_T$ exceeds $1/2$, then run projected gradient descent to find a perturbation $\\delta$ with $\\|\\delta\\|_2 < \\sigma \\Phi^{-1}(\\underline{p}_T)$ that changes the model's top-1 prediction; one such flip refutes the certified-radius claim as stated.","tokens_in":8760,"feed_emoji":"🛡️","tokens_out":8936,"duration_ms":83002,"temperature":0.7,"pith_summary":"This paper argues that knowledge graph embedding (KGE) models are brittle to perturbations of entity embeddings, and proposes a training framework, RKGE-D, that makes them recover. Treating the KGE scoring function as an energy function, the framework adds a denoising loss based on the score-matching identity, so the model learns to remove the added Gaussian noise from entity embeddings while still scoring triples. The paper also adapts randomized smoothing to link prediction, defining certified radius, average certified radius, and certified accuracy for KGE models. On FB15k-237, models trained with RKGE-D beat eight baselines under two noise scales and improve multi-hop reasoning, while leaving clean-data accuracy nearly unchanged.","feed_headline":"Denoising makes knowledge-graph embeddings stable to noise","feed_subtitle":"Adding a score-matching denoising loss beats eight baselines on perturbed FB15k-237 link prediction.","key_machinery":"The central object is the denoising loss $L_d = \\| n - \\hat{n} \\|^2$, where $\\hat{n} = -\\nabla_{\\tilde{h}} E(\\tilde{h}, r, t)$: this is the KGE energy model's gradient matched to the noise score, the exact quantity the score-matching identity says a denoising autoencoder learns. It carries the training-side argument by forcing perturbed embeddings to be pushed back toward clean scoring regions. The evaluation-side object is the randomized-smoothing radius $CR = \\sigma \\Phi^{-1}(p_T)$, with $p_T$ a lower confidence bound obtained from $n_0$ noisy trials, used to define ACR/$\\sigma$ and CA as robustness metrics.","core_discovery":"The paper claims that KGE scoring functions can be trained to denoise additive Gaussian noise on entity embeddings. Concretely, if a noisy head embedding is $\\tilde{h} = h + \\alpha \\epsilon$, the denoising loss $L_d = \\| n - \\hat{n} \\|^2$ with $\\hat{n} = -\\nabla_{\\tilde{h}} E(\\tilde{h}, r, t)$ makes the energy gradient match the score of the noise distribution, and the total loss $L = L_o + \\lambda L_d$ preserves the original link-prediction objective. The paper claims this improves link prediction under perturbation at noise scales $\\alpha = 2$ and $\\alpha = 5$ (and larger values for HousE) on FB15k-237 across geometric, tensor-decomposition, and deep-learning baselines. For certified robustness, it claims that if the model's probability of outputting the correct tail entity under Gaussian noise has lower bound $p_T > 1/2$, then the certified radius is $CR(M, q) = \\sigma \\Phi^{-1}(p_T)$, so predictions are unchanged for all $\\|\\delta\\|_2 < \\sigma \\Phi^{-1}(p_T)$. Robustness is then summarized by average certified radius per noise scale and certified accuracy.","pith_inferences":["A likely explanation of the empirical gains is that the denoising loss smooths the energy landscape; if so, the framework should also reduce vulnerability to worst-case adversarial perturbations, a claim the paper does not test because it only adds Gaussian noise.","The certified-radius claim would be on firmer ground if applied to a smoothed version of the model's ranking, for example a majority vote over many noise-corrupted queries, rather than to the base model's own prediction; that repair is a direct extension of the paper's evaluation metrics.","Because the experiments use one dataset, the natural next test is whether the gains replicate on other standard knowledge graphs and under adversarially crafted perturbations, not just Gaussian noise."],"forward_implications":["Any KGE model with an energy-based scoring function can adopt the framework by adding one auxiliary loss term, so robustness becomes a training plug-in rather than a new architecture.","The normalized certified radius ACR/$\\sigma$ removes dependence on embedding scale, giving a common yardstick for comparing robustness of models with very different embedding ranges.","Stability under one-hop embedding perturbation propagates to downstream multi-hop reasoning; the reported gains on projection and intersection queries are largest for CNN and GNN models.","The method is primarily a robustness regularizer: on clean data it improves accuracy by only about 0.4 percent, while on perturbed data the gains are large."],"supporting_citations":[{"why":"Supplies the randomized smoothing theorem and the formula $CR = \\sigma \\Phi^{-1}(p_T)$ that the paper adapts to link prediction.","marker":"Cohen et al., 2019"},{"why":"Establishes the equivalence between denoising autoencoders and score matching that motivates the denoising loss $L_d$.","marker":"Vincent, 2011"},{"why":"Shows that training on corrupted inputs with a denoising criterion improves stability and feature learning, the basis for corrupting entity embeddings.","marker":"Vincent et al., 2010"},{"why":"Provides the FB15k-237 benchmark, the ConvE evaluation protocol of generating head and tail queries, and a deep-learning baseline.","marker":"Dettmers et al., 2018"},{"why":"Defines the TransE geometric scoring model and the filtered ranking evaluation used throughout the experiments.","marker":"Bordes et al., 2013"},{"why":"Provides HousE, the geometric backbone on which RKGE-D shows its largest robustness gains.","marker":"Li et al., 2022"},{"why":"Provides TuckER, the tensor-decomposition backbone used for RKGE-D experiments.","marker":"Balazevic et al., 2019"},{"why":"Provides RotatE, a geometric baseline whose robustness is compared under RKGE-D.","marker":"Sun et al., 2019"},{"why":"Provides Rot-Pro, a geometric baseline used in the multi-hop reasoning evaluation.","marker":"Song et al., 2021"}],"fun_headline_variants":["Denoising KG embeddings: certified noise robustness","Score-matching denoising boosts KG robustness","Denoising loss gives certified KG resilience","Denoised KGE: robust to perturbed entities"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the randomized-smoothing guarantee applies to the base KGE model itself; the underlying theory certifies the smoothed voting classifier, so this transfer is the step the argument depends on.","fun_headline_variants_meta":{"raw":{"variants":["Denoising KG embeddings: certified noise robustness","Score-matching denoising boosts KG robustness","Denoising loss gives certified KG resilience","Denoised KGE: robust to perturbed entities"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00037,"raw_usage":{"total_tokens":1966,"prompt_tokens":915,"completion_tokens":1051,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":531,"completion_tokens_details":{"reasoning_tokens":1003}},"tokens_in":531,"tokens_out":1051,"duration_ms":10029,"temperature":1.0,"reasoning_tokens":1003,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T21:35:55.753830+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Search FB15k-237 test triples for a model whose estimated correct-output lower bound $\\underline{p}_T$ exceeds $1/2$, then run projected gradient descent to find a perturbation $\\delta$ with $\\|\\delta\\|_2 < \\sigma \\Phi^{-1}(\\underline{p}_T)$ that changes the model's top-1 prediction; one such flip refutes the certified-radius claim as stated.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the randomized smoothing theorem and the formula $CR = \\sigma \\Phi^{-1}(p_T)$ that the paper adapts to link prediction."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the FB15k-237 benchmark, the ConvE evaluation protocol of generating head and tail queries, and a deep-learning baseline."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Defines the TransE geometric scoring model and the filtered ranking evaluation used throughout the experiments."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides Rot-Pro, a geometric baseline used in the multi-hop reasoning evaluation."}],"review_version":1}