{"id":"dd2943d6-9106-4279-b281-95b00e7c8e83","arxiv_id":"2607.18516","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"Signed Rectified Flow adds a negative branch to flow-based generation by targeting the signed measure (1+α)π+ − απ−, provably avoiding negative regions while preserving the positive density on a reachable subset.","lead":"This paper generalizes Rectified Flow to signed target distributions, subtracting an unwanted distribution from a desired one during sampling. The method provably keeps generated samples out of regions defined by negative examples, with applications in image quality, anti-memorization, and safety.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The exclusion guarantee is conditional on Assumption B.2's nondegenerate zero set, and the practical estimator/clipping pipeline does not verifiably inherit it; Theorem B.4's 'provable exclusion' applies to an idealized exact ODE, not the implemented sampler.","rationale":"The reader's weakest assumption and my concern coincide: the provable exclusion result rests on Assumption B.2, which is unverified in realistic high-dimensional settings, and the practical estimators/clipping break the exactness of the velocity field. This is a genuine load-bearing concern because the paper's headline contribution is the guarantee of avoiding negative regions. The theoretical derivation is internally consistent under the stated assumptions, so I do not see a fatal flaw; rather, the advertised guarantee is narrower than the abstract suggests. The proposed concrete test directly checks whether the implemented approximation inherits the barrier property in a setting where the ground-truth signed density is available. If the practical variants never cross into negative regions in the toy, the concern would be largely mitigated; if they do, the conditional verdict is justified. Since the reader already issued a conditional verdict, my read does not change the verdict, so I mark UNCHANGED.","tokens_in":30530,"tokens_out":10227,"duration_ms":116754,"concrete_test":"On the 2D Gaussian-mixture toys of Sec. C.1, run 10,000 shared-seed trajectories under Signed RF with (a) the analytic density ratio, (b) the trained classifier ratio, and (c) the online-tracked ratio using the exact ImageNet clipping (ε=1e-3, λmax=10). At every Euler step, evaluate πsign_t(z_t) using the closed-form Gaussian-mixture marginals (Eq. 16) and record the fraction of trajectories that ever enter the negative region πsign_t < 0. If (b) or (c) shows nonzero entry while (a) is zero, the practical algorithm violates the nonpenetration guarantee; if all are zero, the concern is weakened and the guarantee appears robust to the practical approximations in this setting.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Theorem B.4 and Proposition B.3 depend critically on Assumption B.2: ∇πsign_t(x) ≠ 0 whenever πsign_t(x) = 0. The nonpenetration proof uses this to show that the signed flux points toward the positive side via the identity ∇πsign_t · jsign_t = (1−t)/t ‖∇πsign_t‖² > 0 on the zero set. If the zero set contains any degenerate point, the proof collapses, and Remark B.5 explicitly concedes that such cases are 'not covered by the present result.' In high-dimensional learned models, πsign_t is a difference of two neural/empirical densities; there is no mechanism enforcing nondegeneracy, and in the analytic anti-memorization flow (Eq. 7) the zero-set geometry is uncontrolled. Moreover, the practical method in Sec. 2.3 replaces the exact velocity with a classifier-ratio estimate or online-tracked ut, plus clipping and capping (ε, λmax). Thus even the exact barrier direction is not what is simulated in the ImageNet, anti-memorization, and concept-suppression experiments. The central 'provably excludes' claim therefore holds for an idealized object, not for the evaluated algorithm unless the practical deviations are shown to preserve the barrier.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces Signed Rectified Flow (Signed RF), a generalization of Rectified Flow that replaces the target distribution by the signed measure π^sign = (1+α)π^+ − απ^−, where π^+ is promoted and π^− is suppressed. By linearity of the RF marginal and flux, the authors derive a signed velocity field that is well defined away from the zero set of π^sign. They prove that, under Assumption B.2 (C1 regularity and nondegenerate zero set), source-initialized trajectories remain in the positive region and the sampling law coincides with π^sign on a dynamically reachable subset Ω^r_t, while negative and ghost regions are never visited. The paper also derives a guidance-form implementation whose local strength is the density ratio π^−_t/π^+_t, estimated either by a classifier or by online ODE tracking. Experiments cover 2D toys, PointMaze, ImageNet-256 class-conditional generation, anti-memorization via an analytic negative flow, and concept/nudity suppression in Stable Diffusion 3.5, reporting improvements over constant-guidance baselines.","tokens_in":30967,"tokens_out":11113,"duration_ms":121697,"significance":"If the result holds, Signed RF provides a principled way to inject negative information into flow-based generative models, with a clear target-level construction and a nontrivial theoretical characterization of the induced sampling law. The proofs in Appendix B are coherent and the TV-optimality interpretation (Proposition B.1) is a nice contribution. The paper is also strong on the empirical side: the ImageNet, anti-memorization, and safety experiments are extensive and include useful ablations (classifier checkpoint stability, guidance-cap sensitivity, runtime measurements). The main caveat is that the 'provable exclusion' guarantee is established only for the exact Signed RF ODE under Assumption B.2, whereas the implemented pipeline uses estimated ratios, clipping, and caps; the manuscript should make this distinction much more prominent.","major_comments":[{"comment":"The nonpenetration guarantee relies critically on the nondegeneracy condition ∇π^sign_t(x) ≠ 0 whenever π^sign_t(x) = 0. For π^sign_t = (1+α)π^+_t − απ^−_t where π^±_t are learned densities or empirical Gaussian mixtures, this condition is not enforced and can fail at degenerate points; Remark B.5 explicitly concedes such cases are not covered. The abstract and Sec. 2.2 state 'provably excluding' without this qualification. Please add the regularity condition to the main-text claims, or provide a generic-perturbation argument showing degenerate zero sets are negligible, or empirically test nondegeneracy in the evaluated settings.","section":"Assumption B.2 / Proposition B.3 / Remark B.5"},{"comment":"The implemented sampler replaces the exact velocity with a classifier- or online-estimated density ratio, then applies the denominator lower bound max((1+α)−α r_t, ε) and the guidance cap λ_max. These modifications mean the simulated trajectories are not governed by the signed flux, so the density identity and nonpenetration results (Prop. B.3, Thm. B.4) do not apply to the evaluated algorithm. The main text should state this explicitly in Sec. 2.3 and soften the abstract/conclusion accordingly. It would strengthen the paper to quantify the effect of clipping (e.g., bound on the distance from the zero set, or a post-hoc check that no samples land in Ω^−_1).","section":"Sec. 2.3 / Eq. (5) and stabilization"},{"comment":"The ImageNet FID numbers are reported as best-FID after sweeping α (and ω for CFG) on the same 50K evaluation set. Selecting the best hyperparameter on the test set can overestimate improvements because FID has sampling variance. The stability tables (Tables 2 and 3) are helpful, but they do not address the selection-bias issue. Please report a held-out hyperparameter selection procedure, or give mean±std over multiple seeds for a fixed α chosen on a validation split, and include the full sweep curves so readers can assess the operating points.","section":"Sec. 3.2 / Fig. 6 / Table 1"}],"minor_comments":[{"comment":"The text says 'the black curve shows the signed marginal', but the figure is in color; please adjust the color reference or label the curves directly.","section":"Sec. 2.2 / Figure 2"},{"comment":"In the online ratio-tracking ODE, λ^α_t(z_t) is used before its definition at the tracked ratio; clarify that λ^α_t is evaluated at r_t(z_t)=exp(u_t).","section":"Sec. 2.3 / Eq. (6)"},{"comment":"The negative distribution for the ImageNet classifier is a mixture of low-quality and wrong-class samples, not a fixed π^− as in the theory. The density-ratio interpretation is therefore approximate; please state this explicitly in the main text.","section":"Sec. 3.2"},{"comment":"The header 'Step α' is ambiguous; rename it to 'α' and clarify that FID is computed on the same 50K sample set.","section":"Tables 2 and 3"},{"comment":"The legend 'RF Ours' is unclear; it should be split into distinct labels for the base model and the proposed method.","section":"Figure 8"},{"comment":"The sentence 'under the stated assumptions, the strict nonpenetration result applies to the exact Signed RF dynamics' is an important caveat that should appear in Sec. 2.3 or 2.2, not only in the related-work appendix.","section":"Appendix A"}],"recommendation":"major_revision","confidential_remarks":"The theoretical contribution is sound in its idealized form, and the empirical study is broad and useful. The main issue is a mismatch between the 'provably excluding' language in the abstract/conclusion and the fact that the practical, evaluated algorithm relies on estimated ratios and clipping that are not covered by the theorems. This is fixable by rewriting the claims and adding a clear separation between exact and implemented dynamics. The ImageNet best-FID selection should also be addressed. I recommend major revision rather than rejection."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper is worth taking seriously. It generalizes Rectified Flow to signed targets in a way I have not seen before: the target (1+α)π+ − απ− is not sampled directly, but the source-initialized ODE is shown to realize the positive part of the signed marginal on a reachable set while staying out of the negative region. The reachable/ghost/negative decomposition and the TV-optimality observation are real conceptual additions, and they give a principled reason why state-dependent guidance should beat constant CFG. The proof of Theorem B.4 is coherent under Assumption B.2, and the flux identity showing the zero set is repulsive is a nice argument.\n\nWhat is also good: the paper is honest about the main caveat. Remark B.5 says degenerate zero sets are not covered, and Sec. 2.3 makes clear that the implemented method uses ratio estimators, clipping, and capping. The stress-test note is right, though: the abstract's \"provably excluding\" reads as a property of the evaluated algorithm, while it actually holds for the exact velocity field under regularity and nondegeneracy assumptions that are not verified in the experiments. In high dimensions, π+ and π− are neural densities, so there is no reason the zero set of their difference is nondegenerate; and once you replace the velocity with a classifier estimate and clamp it, the barrier direction is approximate anyway. That is a genuine gap between theorem and practice, but it is not a hole in the theory — the theorem is stated with assumptions.\n\nThe empirical work is useful but not airtight. The ImageNet results come from sweeping α and reporting best FID, without error bars; the classifier stability tables help, but they are single-run. The anti-memorization stress test is thoughtfully designed — picking high-risk seeds and then comparing methods on the same seeds is the right way to measure copying — and the analytic negative flow is a nice reproducible construction. Still, no code is released, and the safety numbers on SD 3.5 are reported without variance. The related-work discussion is fair and includes the closest methods, DNG and Safe Denoiser; the novelty claim over them is plausible because those methods do not have the signed-measure/ghost-region analysis.\n\nWho is this for: people working on guidance for flow/diffusion models, concept erasure, and memorization mitigation. It deserves a serious referee. I would send it out. The main things I would ask for: code and seeds, variance estimates, and a discussion that clearly separates the idealized nonpenetration theorem from the practical approximations.","headline":"Signed RF is a genuinely new way to put negative distributions into flow guidance, with a clean theory for the idealized dynamics; the practical method is plausible but the exact exclusion guarantee does not transfer to the implemented sampler.","tokens_in":31367,"tokens_out":2488,"would_cite":true,"duration_ms":29141,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Signed Rectified Flow turns a signed measure (positive minus negative distributions) into a valid sampling process that provably avoids the negative regions.","keywords":["signed measures","rectified flow","generative modeling","guidance","density ratio estimation","anti-memorization","concept suppression","continuity equation"],"falsifier":"Construct a Gaussian-mixture target where the positive and negative components meet tangentially so that πsign_t(x)=0 and ∇πsign_t(x)=0 at some point, simulate Signed RF with the closed-form ratio, and check whether any trajectory reaches a negative region; any crossing would falsify nonpenetration under degenerate zero sets. In practical settings, measuring signed-density violations along sampled trajectories with finite Euler steps and a learned classifier would test the robustness of the exact guarantee.","tokens_in":30465,"feed_emoji":"🎯","tokens_out":7640,"duration_ms":74258,"temperature":0.7,"pith_summary":"Signed Rectified Flow generalizes Rectified Flow to a signed target πsign = (1+α)π+ − απ−, where π+ is the distribution to promote and π− the distribution to suppress. Although a signed measure cannot be sampled directly, the paper shows that simulating the flow from the usual noise source yields a valid probability law that matches πsign on a 'reachable' subset of its positive region and never enters the negative region. The zero set of the signed marginal acts as a repulsive barrier, and the positive mass that is not reached exactly balances the excluded negative mass. This yields a state-dependent guidance rule whose local strength is set by the density ratio π−/π+, rather than a fixed schedule. The practical payoff is better fidelity–diversity trade-offs in class-conditional generation, reduced training-data replication, and suppression of unsafe concepts with little loss in image quality.","feed_headline":"Signed flow provably skips unwanted regions","feed_subtitle":"Subtracting a negative distribution at sampling time gives a state-dependent guidance that improves fidelity and cuts memorization.","key_machinery":"The central object is the signed marginal πsign_t = (1+α)π+_t − απ−_t, obtained by writing the usual rectified-flow mixture with a negative coefficient, together with the Signed RF velocity field formed by dividing the signed flux by πsign_t. Because both branches share a Gaussian source, the Tweedie identity shows the signed flux at the zero set points toward the positive side, so the zero set acts as a repulsive barrier. The paper interprets the dynamics as charged particles: positive and negative particles annihilate at the moving zero set, while backward from t=1 only particles from the reachable region connect to the source at t=0. A Liouville/continuity-equation argument along the flow","core_discovery":"The paper's central claim is Theorem B.4: for the exact Signed RF dynamics (under local C1 regularity and nondegenerate zero set), the law of the source-initialized ODE satisfies πsignRF_t(x)=πsign_t(x) 1{x∈Ωr_t}. The flow rectifies a signed density into a valid probability: on the reachable region Ωr_t it preserves the signed density exactly; outside it (ghost and negative regions) it places zero mass. Proposition B.3 shows trajectories never cross the zero set. The same construction gives guidance-form velocity v+_t + λα_t(v+_t−v−_t) with λα_t = α rt/((1+α)−α rt), so the effective guidance scale is a local function of the density ratio rt=π−_t/π+_t. The paper provides two estimators for rt","pith_inferences":["If the nondegeneracy assumption (nonzero gradient wherever πsign_t vanishes) fails in high-dimensional learned models, sharp exclusion boundaries may become degenerate, and the exact nonpenetration guarantee weakens to approximate exclusion; this is worth testing in learned latent spaces.","Because the guidance scale is a density-ratio function, the same construction could be applied to preference data by treating dispreferred examples as π−, connecting sampling-time suppression to preference-based training objectives.","The ghost region means Signed RF silently discards some positive mass; a testable extension is to characterize when the reachable region covers the modes of π+, since diversity depends on this dynamically determined subset.","A direct falsification experiment would use an exactly computable ratio in a 2D Gaussian mixture whose zero set has a degenerate tangency and check whether any trajectory crosses into a negative region."],"forward_implications":["If the central theorem holds, negative information enters generation exactly: the induced sampling law is a total-variation-optimal nonnegative approximation of the signed target, equal to the signed density on the reachable region.","The guidance scale is locally determined by the density ratio π−_t/π+_t, so repulsion is automatically weak where the state looks positive and strong where it looks negative, replacing fixed guidance schedules with a state-dependent rule.","Taking the training set as the negative distribution yields a training-free analytic negative flow; repelling from it shifts nearest-neighbor similarity upward while keeping FID and inception score close to baseline.","In safety and concept-suppression settings, subtracting a model of unsafe outputs from a model of safe outputs lowers attack success rates while preserving CLIP and aesthetic scores.","Explicitly modeling invalid regions as π− resolves the missing-negative-data problem for planning, removing wall crossings while retaining broad path diversity."],"fun_headline_variants":["Proof: signed rectified flow skips negative regions","Rectified flow that excludes unwanted data regions","Generative model with provable negative-mass avoidance","Signed RF: provably zero mass in ghost and negative zones","Flow that subtracts a negative distribution at sample time"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The load-bearing premise is that the signed density's zero set is always a smooth boundary (nonzero gradient wherever it vanishes), so the signed flux points into the positive region and trajectories can never cross it.","fun_headline_variants_meta":{"raw":{"variants":["Proof: signed rectified flow skips negative regions","Rectified flow that excludes unwanted data regions","Generative model with provable negative-mass avoidance","Signed RF: provably zero mass in ghost and negative zones","Flow that subtracts a negative distribution at sample time"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00015,"raw_usage":{"total_tokens":1035,"prompt_tokens":748,"completion_tokens":287,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":492,"completion_tokens_details":{"reasoning_tokens":212}},"tokens_in":492,"tokens_out":287,"duration_ms":3565,"temperature":1.0,"reasoning_tokens":212,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-01T15:09:15.631215+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Construct a Gaussian-mixture target where the positive and negative components meet tangentially so that πsign_t(x)=0 and ∇πsign_t(x)=0 at some point, simulate Signed RF with the closed-form ratio, and check whether any trajectory reaches a negative region; any crossing would falsify nonpenetration under degenerate zero sets. In practical settings, measuring signed-density violations along sampled trajectories with finite Euler steps and a learned classifier would test the robustness of the exact guarantee.","supporting_citations":[],"review_version":1}