{"id":"4243b4a0-675f-45f1-97cd-e1844dfac481","arxiv_id":"2505.21742","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":6,"one_line_summary":"Diffusion models trained with an equivariant adversarial-smoothing regularizer tolerate heavy training-data corruption but lose image quality on clean data.","lead":"This paper argues that adversarial training for diffusion models should enforce equivariance rather than invariance, and it adds a time-dependent smoothing term to the diffusion training loss. The regularizer helps diffusion models generate clean images when up to 90% of training data is Gaussian-corrupted, at the cost of a large FID drop on clean data.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The ELBO derivation in Appendix A.1 assumes an independent Gaussian perturbation, while Algorithm 1 uses a uniform-then-FGSM δ that depends on θ; until this gap is closed, the 'equivariance is required' claim is not formally established.","rationale":"The reader's weakest assumption is exactly the gap I identify: Section A.1.1 assumes the perturbation is an independent Gaussian transition, but Algorithm 1 uses a uniform-initialized, FGSM-refined, θ-dependent perturbation. This is the point where the formal justification for Eq. (9) is least secure. The empirical results on corrupted data are suggestive and are the real support for the method, but the theoretical framing in the abstract—'AT in DMs requires equivariance'—depends on the derivation, not on the experiments. Because the concern is the same as the reader's, and because the paper's empirical contribution can still be defended after the derivation is repaired or downgraded to a heuristic, the correct verdict remains CONDITIONAL rather than REJECT or ACCEPT. I would not strengthen or weaken the reader's verdict. I note fair evidence in the paper's favor: the low-dimensional 'in vitro' evaluation with closed-form reconstruction error is a genuinely useful check, code is promised, and the random-versus-adversarial ablation in Table 1 gives some internal consistency. Those elements support a conditional accept once the theoretical gap and the missing baseline comparisons are addressed.","tokens_in":24267,"tokens_out":3536,"duration_ms":40580,"concrete_test":"Train three versions of the same model on corrupted CIFAR-10 (90% corruption, σ=0.1) with identical hyperparameters: (a) the actual δ_adv from Algorithm 1; (b) δ sampled independently from N(0, r_β(t)^2/3 I) with no FGSM; (c) δ from (b) followed by one FGSM step. If (a) and (c) are comparable and both beat (b), the key ingredient is the adversarial gradient, not the Gaussian-transition assumption. If (a) strictly outperforms (c), the random-start uniform initialization is important. Independently, record the empirical distribution of δ_adv during training and test whether it is Gaussian and uncorrelated with the current ε_θ prediction. If the distribution clearly rejects Gaussianity or correlates with θ, then the A.1.1 Gaussian-transition assumption is contradicted by the algorithm, and the ELBO derivation in A.1.3 cannot be invoked as the formal basis for Eq. (9).","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central theoretical claim is that adversarial training for diffusion models requires equivariance, and that the regularizer in Eq. (9) is the correct objective. The only formal support for this is the variational derivation in Appendix A.1. The derivation models the attack as an additional Gaussian transition, writing q''(x_t+δ_t|x_{t-1}) = q'(x_t+δ_t|x_t)·q(x_t|x_{t-1}) in A.1.1 and then uses this factorization to re-derive the ELBO in A.1.3. The algorithm actually used in Section 2.3 and Algorithm 1 draws δ from U[-r_β(t), r_β(t)] and, in the adversarial case, applies one FGSM step using the gradient of J_θ with respect to x_t. Thus δ is (i) not Gaussian, (ii) a deterministic function of the current model parameters θ, and (iii) not stationary across training because θ changes in every iteration. The factorization and the subsequent ELBO manipulation require treating the attack as an exogenous, model-independent transition. With a θ-dependent bounded uniform perturbation, the ELBO does not reduce to Eq. (9), so the derivation in A.1.3 does not establish that equivariance is required. Eq. (9) therefore functions as an ad hoc regularizer whose justification is empirical rather than mathematical. The experiments do provide useful evidence that the loss improves corrupted-data generation, but the conceptual claim in the title and abstract is substantially stronger than what the derivation supports.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper addresses the question in its title by proposing that adversarial training (AT) for diffusion models should enforce equivariance rather than invariance. The central proposal is the training objective in Eq. (9), which combines the standard DDPM denoising loss with a regularizer that pushes the epsilon-prediction at a perturbed input x_t+delta toward the prediction at x_t plus the perturbation delta. The perturbation is chosen from a time-dependent ray schedule r_beta(t) and can be random or adversarial (FGSM with random start). The authors argue that this 'equivariant' regularization smooths the diffusion flow, and they support the claim with experiments on synthetic low-dimensional and high-dimensional data with known distributions, as well as CIFAR-10, CelebA, and LSUN Bedroom under 90% Gaussian corruption. They also report reduced memorization, faster sampling, and improved robustness to FGSM and PGD trajectory attacks.","tokens_in":24678,"tokens_out":8656,"duration_ms":86263,"significance":"If the central claim were established, the paper would make a useful conceptual and practical contribution: it offers a simple regularization term that integrates into standard DDPM training and shows strong empirical gains in training on heavily corrupted data, without requiring knowledge of the noise level. The paper's strengths include the use of synthetic datasets with closed-form reconstruction error, the release of code, and a relatively broad evaluation across datasets and corruption levels. However, the theoretical derivation that is advertised as establishing the 'equivariance is required' claim does not actually yield Eq. (9), and the robustness evaluation attacks an objective closely aligned with the training regularizer. The contribution is therefore best regarded at present as an empirical regularizer with promising results, not as a formally grounded principle for AT in diffusion models.","major_comments":[{"comment":"The variational derivation does not establish Eq. (9). The factorization between the penultimate and final lines of the ELBO computation replaces p_theta(x_{t-1}|x_t+delta_t) by p_theta(x_{t-1}|x_t) p'_theta(x_t|x_t+delta_t), which is not a valid conditional-probability identity. In addition, the ratio q'(x_t|x_0)/q'(x_t+delta_t|x_0) disappears without comment, and the sign of the boundary term log p'_theta(x_0|x_1+delta_1) changes incorrectly. More importantly, even if the ELBO algebra were correct, the two resulting KL terms do not reduce to the explicit equivariance regularizer ||epsilon_theta(x_t+delta) - [epsilon_theta(x_t)+delta]||^2: no step of the derivation maps the variational bound to Eq. (9). The abstract's assertion that AT for DMs 'requires equivariance' is therefore supported only by the experiments, not by the theory as written.","section":"Appendix A.1.3, Eq. (9)"},{"comment":"The theoretical forward-chain model assumes the perturbation is an independent Gaussian transition, q''(x_t+delta_t|x_{t-1}) = q'(x_t+delta_t|x_t) q(x_t|x_{t-1}), with delta_t independent of x_t and of the model. The algorithm actually used draws delta from U[-r_beta(t), r_beta(t)] and then applies an FGSM step (Eq. (7)) whose gradient is computed through epsilon_theta; hence delta_adv is a deterministic function of the current weights theta and of x_t, is not Gaussian, and changes throughout training. The factorization and the subsequent ELBO manipulation therefore do not apply to the method in Algorithm 1, and Eq. (9) functions as an ad hoc regularizer whose justification is empirical. If the theoretical claim is to be kept, this gap must be closed, for example by treating the adversarial perturbation as an outer maximization over a Gaussian model or by deriving the regularizer directly from a different principle.","section":"Appendix A.1.1 and Section 2.3 / Algorithm 1"},{"comment":"The robustness evaluation is partly circular. Algorithm 2, and its epsilon-prediction reformulation in Appendix A.2, define the attack cost as J_theta(x_t,delta,t) = ||epsilon_theta(x_t+delta,t) - epsilon_theta(x_t,t)||^2, which is the same pairwise output difference that the regularizer in Eq. (9) is designed to suppress (the regularizer's target is epsilon_theta(x_t)+delta rather than epsilon_theta(x_t), but for small delta the two objectives are closely aligned). Training on Eq. (9) therefore specifically reduces the quantity the attack maximizes, so the reported FID improvements under this attack do not demonstrate general trajectory robustness. I recommend evaluating robustness with an attack that is not derived from the training objective, such as attacking the final generated samples, or using a downstream classifier or perceptual metric, and reporting whether the gains persist.","section":"Section 3.4, Algorithm 2 and Appendix A.2"}],"minor_comments":[{"comment":"The sampling notation t ~ U(0,I) is a typo; it should be t ~ U({1,...,T}) or an equivalent discrete uniform distribution over timesteps.","section":"Section 2.1, Eq. (3)"},{"comment":"The left-hand sides of Eqs. (8) and (9) use 'arg min_theta' although the right-hand sides are loss values; this notation is misleading and should be replaced by a plain loss definition.","section":"Section 2.4, Eqs. (8) and (9)"},{"comment":"The column layout of Table 2 is difficult to parse; in particular, the p=0 row and the separation between the columns for DDPM, Robust adv, DDIM, and Robust adv should be explicitly formatted so that each FID/IS pair is unambiguous.","section":"Section 3, Table 2"},{"comment":"The text in B.4.1 says 'both with p=0.9%' and should read p=90%; B.3.3 contains the typo 'Instea,d DDPM'.","section":"Appendix B.4.1 and B.3.3"},{"comment":"The notation q'(x_t|x_0) is used but q' was only defined as a transition q'(x_t+delta|x_t), not as a marginal distribution; this needs to be defined or the derivation needs to be rewritten.","section":"Appendix A.1.3"}],"recommendation":"major_revision","confidential_remarks":"The paper has a promising empirical core but overclaims its theoretical contribution. The advertised variational derivation does not produce Eq. (9), and the robustness evaluation attacks the model's own training objective. These are fixable within the manuscript's scope: the authors could reframe Eq. (9) as a heuristic regularizer, provide a corrected derivation, and evaluate with a decoupled attack. I would not reject on the current evidence, but the central claim needs to be substantially weakened or properly supported before publication."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper's central claim — that adversarial training for diffusion models should be equivariant rather than invariant — is a good reframing, and the specific regularizer in Eq (9) is a sensible way to enforce local smoothness of the score. The controlled low-dimensional experiments are a real strength: using known distributions and exact reconstruction error is the right way to isolate behavior. And the noisy-data results on CIFAR, CelebA, and LSUN do show the method removes Gaussian corruption far better than plain DDPM.\n\nThe problems are in the theory and the evaluation. Appendix A.1.3 has a sign error in the ELBO manipulation (the last term flips the sign on log p'_theta(x0|x1+δ1)), and the derivation never actually produces Eq (9); it gestures at two KL divergences and jumps to the MSE loss. More importantly, the derivation models δ as an independent Gaussian transition, while Algorithm 1 draws it from a uniform distribution and then applies FGSM, making it model-dependent and non-Gaussian. So the 'equivariance is required' conclusion is not supported by the math. The loss stands as an ad hoc regularizer, and that's fine, but the paper should say so.\n\nThe robustness evaluation is also partly circular: the attack maximizes the same pairwise epsilon-difference that the regularizer minimizes. That doesn't invalidate the results, but it does mean the robustness numbers are favorable to the method by construction.\n\nTwo more issues. The clean-data FID degradation is large (CIFAR-10 7.2→28.7, LSUN 9.9→57.1), which the paper describes as 'slight' — that's not honest. And there's no empirical comparison to ambient diffusion or other noise-aware training methods, despite the claim of generality. The hand-designed schedule with ω, γ, β, λ also has several free constants, though that's a minor point.\n\nStill, this deserves a serious referee. The conceptual contribution is real, the experiments are targeted, and the flaws are fixable in revision. I'd send it out if I were the editor, but the authors need to rework the theory section, add non-circular attacks, and report clean-data cost honestly.","headline":"A genuinely new equivariance-based regularizer for robust diffusion training, with a flawed variational derivation and a partially circular attack evaluation.","tokens_in":25130,"tokens_out":6262,"would_cite":false,"duration_ms":54115,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper argues that adversarial training for diffusion models must enforce equivariance—shifting the predicted noise by the same perturbation added to the input—rather than invariance.","keywords":["adversarial training","diffusion models","equivariance","denoising","robustness","data corruption","memorization","fast sampling"],"falsifier":"Train with δ drawn from a genuinely independent zero-mean Gaussian with the same time-dependent radius, omitting the FGSM refinement, and compare FID on 90%-corrupted CIFAR-10; if the Gaussian version matches the uniform-plus-FGSM version, the FGSM component is not needed and the claimed derivation is not the mechanism. Alternatively, on held-out points measure the equivariance error $\\|\\epsilon_\\theta(x_t+\\delta,t)-\\epsilon_\\theta(x_t,t)-\\delta\\|$; if robustness to corruption persists where this error is large, the regularizer is not what produces the robustness.","tokens_in":24085,"feed_emoji":"🛡️","tokens_out":10285,"duration_ms":101327,"temperature":0.7,"pith_summary":"This paper asks what adversarial training should mean for diffusion models and answers that it should enforce equivariance, not invariance. Because the denoising network solves a regression problem, shifting the noisy input by δ should shift the predicted noise by δ, whereas classifier-style invariance makes the reverse process drift off the data manifold. The authors add a time-dependent regularization term to the standard DDPM objective that imposes this local equivariance, using either random noise or a single FGSM step, and they show that the resulting model generates clean samples even when 90% of the training data is corrupted. The same regularization reduces memorization and allows 500-step sampling to beat the 1000-step baseline.","feed_headline":"Equivariance, not invariance, makes diffusion models robust","feed_subtitle":"A time-dependent smoothing loss lets DDPMs ignore 90% corrupted training data, memorize less, and sample in half the steps.","key_machinery":"The load-bearing object is the time-dependent equivariance regularizer in Equation (9), combined with a scheduled perturbation. The perturbation δ is drawn uniformly in an $\\ell_\\infty$ ball of radius $r_\\beta(t)$ and, in the adversarial variant, refined by one FGSM step with random start; the effective deviation added to $x_t$ scales as $(\\sqrt{1-\\alpha_t})^\\omega + \\gamma\\beta$, so it is large in the noise phase, small in the content phase, and never below a floor. The regularization weight $\\lambda_t = \\lambda\\sqrt{3}/(\\beta r(t))$ is rescaled by the perturbation's standard deviation so that the smoothness constraint stays comparable across timesteps. The mechanism forces the denoising network to map $x_t+\\delta$ to the same next state $x_{t-1}$ as the unperturbed point, which is what keeps the chain aligned with the data distribution while absorbing local noise.","core_discovery":"The central claim is that adversarial training for diffusion models is a smoothing operation on the diffusion flow, and it must be formulated as equivariance. Concretely, the paper proposes to minimize $L_{\\rm AT} = \\|\\epsilon_\\theta(x_t,t)-\\epsilon\\|_2^2 + \\lambda_t \\|\\epsilon_\\theta(x_t^{\\rm adv},t)-[\\epsilon_\\theta(x_t,t)+\\delta]\\|_2^2$, where the first term is the usual denoising objective and the second term requires the network's noise prediction to shift by the same perturbation δ that was added to the input. The authors argue that the naive invariance objective $\\|\\epsilon_\\theta(x_t+\\delta,t)-\\epsilon_\\theta(x_t,t)\\|_2^2$ causes the model to learn the wrong distribution. With the equivariant loss, a DDPM trained on up to 90% corrupted data with strong Gaussian noise generates samples close to the clean distribution, resists white-box trajectory attacks better, memorizes less, and supports faster sampling.","pith_inferences":["I infer that the equivariance loss, being stated at the level of the noise-prediction field, should transfer to latent diffusion and consistency models, though the paper only tests DDPM.","Because the method never requires knowing the corruption level or distinguishing clean from noisy samples, it could be paired with blind denoising or used as a training-time defense before adversarial purification; the paper does not test these combinations.","The schedule that shrinks perturbation strength in the content phase suggests a general principle — regularization strength should track the signal-to-noise ratio — that could be tested on other generative frameworks, including the fully corrupted p=100% case the paper lists as future work."],"forward_implications":["A DDPM trained with the equivariant regularizer can be trained on datasets in which 90% of the samples are corrupted by Gaussian noise at σ=0.2 and still produce images close to the clean distribution, where the unregularized baseline's FID rises above 100 on CIFAR-10.","The correct formulation of adversarial training for generative models is equivariance: enforcing invariance makes the reverse process diverge from the data manifold, as the paper shows on both synthetic and real data.","The regularized model memorizes less: on CIFAR-10 the similarity histogram of generated samples shifts left and has fewer near-duplicates above 0.9 similarity.","Smoother diffusion flow allows faster sampling: on clean CIFAR-10 the robust model reaches 24.34 FID with 500 inference steps, better than 28.68 with the standard 1000 steps.","The regularized model is more resistant to white-box trajectory attacks, keeping FID in a reasonable range when up to 50% of inference timesteps are attacked under both FGSM and PGD variants."],"supporting_citations":[{"why":"supplies the DDPM training objective and inference recurrence that Equation (9) modifies.","marker":"[15]"},{"why":"introduces the adversarial perturbation (FGSM) that the paper reinterprets for the regression setting.","marker":"[12]"},{"why":"provides the FGSM-with-random-start procedure used to initialize and refine δ.","marker":"[22]"},{"why":"provides the randomized-smoothing analogue for the random perturbation variant.","marker":"[5]"},{"why":"an ambient-diffusion baseline that requires the exact corruption variance, which the proposed method claims to avoid.","marker":"[9]"},{"why":"a baseline for learning clean distributions from corrupted data and for the memorization comparison.","marker":"[10]"},{"why":"a noisy-data baseline whose assumptions (clean/noisy knowledge) the paper contrasts with its own.","marker":"[7]"},{"why":"defines the near-duplicate memorization measurement that the paper uses to show reduced memorization.","marker":"[48]"},{"why":"provides the self-supervised embeddings used to compute similarity between generated and training images.","marker":"[39]"}],"fun_headline_variants":["Equivariant adversarial training smooths diffusion models","Diffusion adversarial training: equivariance beats invariance","Why adversarial training for diffusion is smoothing, not invariance","Equivariance, not invariance, for robust diffusion models","Adversarial training smooths diffusion flows via equivariance"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The derivation of the equivariance loss assumes that the added perturbation δ is an independent Gaussian transition appended to the forward chain, so the corrupted chain remains a product of Gaussian kernels; in the actual algorithm δ is uniform and then refined by FGSM, so if that Gaussian model fails, the ELBO argument does not justify Equation (9) and the regularizer stands or falls on its empirical behavior.","fun_headline_variants_meta":{"raw":{"variants":["Equivariant adversarial training smooths diffusion models","Diffusion adversarial training: equivariance beats invariance","Why adversarial training for diffusion is smoothing, not invariance","Equivariance, not invariance, for robust diffusion models","Adversarial training smooths diffusion flows via equivariance"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000568,"raw_usage":{"total_tokens":2680,"prompt_tokens":930,"completion_tokens":1750,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":546,"completion_tokens_details":{"reasoning_tokens":1674}},"tokens_in":546,"tokens_out":1750,"duration_ms":13123,"temperature":1.0,"reasoning_tokens":1674,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T13:24:33.703022+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train with δ drawn from a genuinely independent zero-mean Gaussian with the same time-dependent radius, omitting the FGSM refinement, and compare FID on 90%-corrupted CIFAR-10; if the Gaussian version matches the uniform-plus-FGSM version, the FGSM component is not needed and the claimed derivation is not the mechanism. Alternatively, on held-out points measure the equivariance error $\\|\\epsilon_\\theta(x_t+\\delta,t)-\\epsilon_\\theta(x_t,t)-\\delta\\|$; if robustness to corruption persists where this error is large, the regularizer is not what produces the robustness.","supporting_citations":[{"cited_title":"Explaining and harnessing adversarial examples","cited_arxiv_id":null,"evidence_quote":"introduces the adversarial perturbation (FGSM) that the paper reinterprets for the regression setting."},{"cited_title":"Goodfellow, and Samy Bengio","cited_arxiv_id":null,"evidence_quote":"provides the FGSM-with-random-start procedure used to initialize and refine δ."},{"cited_title":"Certified adversarial robustness via randomized smoothing","cited_arxiv_id":null,"evidence_quote":"provides the randomized-smoothing analogue for the random perturbation variant."},{"cited_title":"Consistent diffusion meets tweedie: Training exact ambient diffusion models with noisy data","cited_arxiv_id":null,"evidence_quote":"an ambient-diffusion baseline that requires the exact corruption variance, which the proposed method claims to avoid."},{"cited_title":"Ambient diffusion: Learning clean distributions from corrupted data","cited_arxiv_id":null,"evidence_quote":"a baseline for learning clean distributions from corrupted data and for the memorization comparison."},{"cited_title":"How much is a noisy image worth? data scaling laws for ambient diffusion.arXiv e-prints, pages arXiv–2411, 2024","cited_arxiv_id":null,"evidence_quote":"a noisy-data baseline whose assumptions (clean/noisy knowledge) the paper contrasts with its own."},{"cited_title":"Diffusion art or digital forgery? investigating data replication in diffusion models","cited_arxiv_id":null,"evidence_quote":"defines the near-duplicate memorization measurement that the paper uses to show reduced memorization."},{"cited_title":"Dinov2: Learning robust visual features without supervision.TMLR, 2023","cited_arxiv_id":null,"evidence_quote":"provides the self-supervised embeddings used to compute similarity between generated and training images."}],"review_version":1}