Pith. sign in

REVIEW 4 major objections 5 minor 30 references

Robust Knowledge Graph Embedding via Denoising

T0 review · 4 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Pith's one-line read Adding a score-matching denoising loss makes knowledge-graph link prediction stable under embedding perturbation.

desk verdict The denoising regularizer is a genuinely useful idea for KGE, but the certified robustness claims rest on a misapplication of randomized smoothing and need major revision. read the letter →

arxiv 2505.18171 v1 pith:MS2AA62L submitted 2025-05-14 cs.LG

classification cs.LG
keywords knowledgegraphembeddingrobustnessdenoisingscorematchingrandomizedsmoothingcertifiedlinkpredictionmulti-hopreasoning
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that knowledge graph embedding (KGE) models are brittle to perturbations of entity embeddings, and proposes a training framework, RKGE-D, that makes them recover. Treating the KGE scoring function as an energy function, the framework adds a denoising loss based on the score-matching identity, so the model learns to remove the added Gaussian noise from entity embeddings while still scoring triples. The paper also adapts randomized smoothing to link prediction, defining certified radius, average certified radius, and certified accuracy for KGE models. On FB15k-237, models trained with RKGE-D beat eight baselines under two noise scales and improve multi-hop reasoning, while leaving clean-data accuracy nearly unchanged.

What carries the argument

The central object is the denoising loss $L_d = \| n - \hat{n} \|^2$, where $\hat{n} = -\nabla_{\tilde{h}} E(\tilde{h}, r, t)$: this is the KGE energy model's gradient matched to the noise score, the exact quantity the score-matching identity says a denoising autoencoder learns. It carries the training-side argument by forcing perturbed embeddings to be pushed back toward clean scoring regions. The evaluation-side object is the randomized-smoothing radius $CR = \sigma \Phi^{-1}(p_T)$, with $p_T$ a lower confidence bound obtained from $n_0$ noisy trials, used to define ACR/$\sigma$ and CA as robustness metrics.

What would settle it

Search FB15k-237 test triples for a model whose estimated correct-output lower bound $\underline{p}_T$ exceeds $1/2$, then run projected gradient descent to find a perturbation $\delta$ with $\|\delta\|_2 < \sigma \Phi^{-1}(\underline{p}_T)$ that changes the model's top-1 prediction; one such flip refutes the certified-radius claim as stated.

Watch

Extended reading notes

Core claim

The paper claims that KGE scoring functions can be trained to denoise additive Gaussian noise on entity embeddings. Concretely, if a noisy head embedding is $\tilde{h} = h + \alpha \epsilon$, the denoising loss $L_d = \| n - \hat{n} \|^2$ with $\hat{n} = -\nabla_{\tilde{h}} E(\tilde{h}, r, t)$ makes the energy gradient match the score of the noise distribution, and the total loss $L = L_o + \lambda L_d$ preserves the original link-prediction objective. The paper claims this improves link prediction under perturbation at noise scales $\alpha = 2$ and $\alpha = 5$ (and larger values for HousE) on FB15k-237 across geometric, tensor-decomposition, and deep-learning baselines. For certified robustness, it claims that if the model's probability of outputting the correct tail entity under Gaussian noise has lower bound $p_T > 1/2$, then the certified radius is $CR(M, q) = \sigma \Phi^{-1}(p_T)$, so predictions are unchanged for all $\|\delta\|_2 < \sigma \Phi^{-1}(p_T)$. Robustness is then summarized by average certified radius per noise scale and certified accuracy.

Load-bearing premise

The load-bearing premise is that the randomized-smoothing guarantee applies to the base KGE model itself; the underlying theory certifies the smoothed voting classifier, so this transfer is the step the argument depends on.

Editorial extensions

If this is right

  • Any KGE model with an energy-based scoring function can adopt the framework by adding one auxiliary loss term, so robustness becomes a training plug-in rather than a new architecture.
  • The normalized certified radius ACR/$\sigma$ removes dependence on embedding scale, giving a common yardstick for comparing robustness of models with very different embedding ranges.
  • Stability under one-hop embedding perturbation propagates to downstream multi-hop reasoning; the reported gains on projection and intersection queries are largest for CNN and GNN models.
  • The method is primarily a robustness regularizer: on clean data it improves accuracy by only about 0.4 percent, while on perturbed data the gains are large.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A likely explanation of the empirical gains is that the denoising loss smooths the energy landscape; if so, the framework should also reduce vulnerability to worst-case adversarial perturbations, a claim the paper does not test because it only adds Gaussian noise.
  • The certified-radius claim would be on firmer ground if applied to a smoothed version of the model's ranking, for example a majority vote over many noise-corrupted queries, rather than to the base model's own prediction; that repair is a direct extension of the paper's evaluation metrics.
  • Because the experiments use one dataset, the natural next test is whether the gains replicate on other standard knowledge graphs and under adversarially crafted perturbations, not just Gaussian noise.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes RKGE-D, a framework that augments arbitrary knowledge graph embedding (KGE) models with a denoising auxiliary loss, motivated by the score-matching interpretation of denoising autoencoders. The authors also propose certified robustness metrics for KGE link prediction based on randomized smoothing, reporting average certified radius (ACR/σ) and certified accuracy (CA) on FB15k-237. Empirically, they show that applying RKGE-D to TuckER and HousE improves link prediction performance on embeddings perturbed with Gaussian noise, and they report multi-hop reasoning results across several base models.

Significance. The general idea of using denoising as a training regularizer for KGE robustness is interesting and plausibly useful, and the multi-hop experiments give some indication of practical benefit. However, the central methodological contribution—the certified robustness evaluation—is based on an incorrect application of randomized smoothing, and the score-matching derivation rests on an unverified equality. If the certification claim were correct, the ACR/σ and CA metrics would be valuable; as written, the paper's headline robustness guarantee is not supported. The empirical work is further limited to a single dataset with no error bars, so the claimed consistency of improvement is not established.

major comments (4)
  1. [Section 3.2, Eqs. (2)-(3)] The certified-radius claim is applied to the base KGE model M, but the randomized smoothing theorem of Cohen et al. (2019) guarantees robustness only for the smoothed classifier g(x)=argmax_c P(f(x+ε)=c), not for the base classifier f. The paper estimates p_T by sampling the base model's outputs under Gaussian noise and then asserts that M(q,δ)=e_T for all ||δ||_2 < σΦ^{-1}(p_T). This does not follow: a base model can be accurate on average under Gaussian perturbation while being arbitrarily fragile at individual points within the claimed radius. The statement in Appendix A that 'at high confidence C, the gap between the certified robustness of the base classifier f and its smoothed version g becomes negligible' is not a theorem and is not justified by any argument. Therefore the ACR/σ and CA values reported in Table 1 are at best empirical robustness measures under random perturbation, not certified radii, and the paper's claim of proposing 'certified robustness evaluation metrics' is unsupported.
  2. [Section 3.2, Eqs. (2)-(3)] The denoising loss is derived by asserting the identity ∇_{\tilde e} log q_σ(\tilde e) = ∇_{\tilde h} E(\tilde h, r, t) (footnote 1). This equality is not derived or tested; it is an ad hoc assumption that the gradient of the KGE energy at a noisy embedding equals the score of the noise-perturbed data distribution. Without this identity, the loss L_d = ||n - \hat n||^2 with \hat n = -∇_{\tilde h} E is not a score-matching objective, and the 'denoising' interpretation of the auxiliary loss is not grounded in the cited theory. Since this is the mechanism by which RKGE-D is claimed to improve robustness, the central methodological justification is incomplete.
  3. [Table 1 and Section 4.2] The empirical support for the main claim is thin. Results are reported on a single dataset (FB15k-237) with no error bars, multiple random seeds, or significance tests, so the 'consistently superior performance' claimed in the abstract is not established. The HousE comparison is particularly problematic: the paper states that 'due to HousE's strong stability against perturbations, the effect of RKGE-D is not evident under small noise levels,' and therefore applies post hoc noise scales α=100 and α=150 for HousE only. This selective choice of evaluation noise to reveal an effect does not provide a fair comparison with the other models, which are evaluated at α=2 and α=5.
  4. [Eq. (1) and Definition 1] There is a notation and conceptual mismatch in the definition of σ. In Eq. (1), σ is described as the 99.73% quantile point of |e_i|, and noise is added as \tilde e_i = e_i + α ϵ_i with ϵ_i ~ N(0,σ), so the actual noise standard deviation is ασ. In Definition 1 and Eq. (6), however, σ is used in the certified radius formula CR = σ Φ^{-1}(p_T), where randomized smoothing requires σ to be the standard deviation of the Gaussian noise added during certification. The paper's σ is data-dependent and per-entity, not a single noise level, and the relationship between the σ in Eq. (1) and the σ in Eq. (6) is never clarified. As a result, the reported ACR/σ values do not correspond to a well-defined noise level, and the certificate in Eq. (6) is not correctly instantiated.
minor comments (5)
  1. [Abstract] The abstract claims 'consistently superior performance compared to existing state-of-the-art KGE methods,' but the experiments cover only FB15k-237; this overstates the generality of the results.
  2. [Table 1] Several entries in Table 1 are formatted incorrectly, with values running together (e.g., '197.214' appears to be two separate numbers, and '301.401' in the TuckER-D row). The table needs careful proofreading.
  3. [Limitation paragraph] The limitation paragraph states that 'directly applying randomized smoothing to models results in unsatisfactory robustness' and attributes the issue to the noise sensitivity of the base model. This is in tension with the paper's certification claim, and the authors should reconcile these statements or remove the certification language.
  4. [Section 3.3.1] The definition of CA(Rp) in Eq. (9) counts triples with CR(M,T_i) > R_p; CA(0) simply counts triples where the estimated lower bound p_T exceeds 0.5. This is a weak measure and should be justified as meaningful, especially since no adversarial or worst-case evaluation is performed.
  5. [Related Work] The related work section would benefit from a discussion of prior work on robustness of KGE models under embedding perturbations; the current review focuses on NLP and image domains and does not situate the work within any existing KGE robustness literature beyond data-space noise.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the denoising loss is an auxiliary regularizer anchored by the backbone KGE loss, and robustness gains are measured empirically against external baselines.

full rationale

The paper's derivation chain is not circular. Eq. (3) defines the denoising loss Ld = ||n - \hn||^2 with \hn = -∇_{\tilde h}E(\tilde h,r,t); although the 'predicted noise' is expressed through the model's own energy gradient, the objective is not vacuous: minimizing it jointly with the original loss Lo imposes a real constraint on the energy landscape, and the reported gains are obtained by standard link-prediction evaluation under added Gaussian perturbation against external baselines, not by construction from the loss. The robust metrics ACR/σ and CA are direct adaptations of Cohen et al.'s randomized smoothing statistics, and no fitted parameter is renamed as a predicted result. The certification claim in Definition 1/Appendix A applies the Cohen et al. guarantee to the base model M rather than the smoothed classifier g; that is a mathematical-support/correctness concern, not a circularity, because no equation in the paper reduces to its own input. The appended Limitation section concedes only modest gains on clean data, which is consistent with an empirical robustness contribution rather than a tautology. Hence no circular step meets the evidence bar required by the review rules.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central claims rest mostly on the energy-based KGE assumption and on two unjustified identifications: the energy gradient standing in for the score of the noisy data distribution, and the base model inheriting the randomized smoothing certificate. These are ad hoc assumptions specific to this paper, not standard results. The only tuned parameters are α and λ (plus a post hoc HousE noise scale), so the ledger is relatively light, but the assumptions themselves are heavy.

free parameters (3)
  • α (training noise scale) = grid-searched {0.1,0.2,0.5,1.0}; selected per backbone
    Controls the magnitude of Gaussian noise added to entity embeddings in Eq (1); the paper reports only the grid, not the chosen values per model.
  • λ (denoising loss weight) = grid-searched {0.1,0.2,0.5,1.0}; selected per backbone
    Balances original loss and denoising loss in Eq (4); selection per model is not reported.
  • Test-time noise scale for HousE = α=100 and 150
    Chosen post hoc because small noise showed no effect for HousE; this is a data-dependent selection of the evaluation condition.
assumptions (4)
  • domain assumption KGE scoring functions can be treated as energy-based models with differentiable gradients with respect to entity embeddings.
    Section 3.1 defines E(h,r,t) = -f_r(h,t); the denoising loss uses ∇_h E, requiring differentiability and a meaningful gradient direction.
  • ad hoc to paper The gradient of the KGE energy at a noisy embedding equals the score of the noisy data distribution (i.e., ∇_~e log qσ(~e) = ∇_~h E(~h,r,t)).
    Stated in Section 3.2 after Eq (2) without proof; this identification is what connects the denoising loss to score matching, but it does not follow from Vincent (2011).
  • ad hoc to paper The randomized smoothing certificate applies to the base KGE model M directly.
    Definition 1 (Section 3.3) claims CR(M,q) and a guarantee on M(q,δ) from the base model's probability. Cohen et al. (2019) certifies the smoothed classifier, not the base model; this axiom is false.
  • domain assumption Gaussian noise with variance σ^2 where σ is the 99.73% quantile of |e_i| is a faithful model of embedding perturbation.
    Eq (1) defines the perturbation model; the choice of σ is heuristic and affects both training and the certified radius formula.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Robust Knowledge Graph Embedding via Denoising." pith.science (2026). https://pith.science/paper/MS2AA62L

@misc{pith2026250518171,
  author       = {Pith},
  title        = {Pith review of: Robust Knowledge Graph Embedding via Denoising},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/MS2AA62L}},
  note         = {Machine review of arXiv:2505.18171}
}
read the original abstract

We focus on obtaining robust knowledge graph embedding under perturbation in the embedding space. To address these challenges, we introduce a novel framework, Robust Knowledge Graph Embedding via Denoising, which enhances the robustness of KGE models on noisy triples. By treating KGE methods as energy-based models, we leverage the established connection between denoising and score matching, enabling the training of a robust denoising KGE model. Furthermore, we propose certified robustness evaluation metrics for KGE methods based on the concept of randomized smoothing. Through comprehensive experiments on benchmark datasets, our framework consistently shows superior performance compared to existing state-of-the-art KGE methods when faced with perturbed entity embedding.

Figures

Figures reproduced from arXiv: 2505.18171 by the authors.

Figure 1
Figure 1. Link prediction shift caused by embedding [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. shows that during the training process, how the noise scale α and weight of denoising loss λ affect the model performance. (a) α (b) λ [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Case Study stream multi-hop reasoning tasks on KGs. Multi￾hop reasoning involves deducing indirect relations between entities by traversing multiple relational paths. Unlike single-hop reasoning, it requires models to understand complex path structures and intermediate relations, making it crucial for an￾swering complex questions and enhancing knowl￾edge graph completion. This task is challenging, demanding robust m… view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

30 extracted references · 16 canonical work pages

  1. [1]

    online" 'onlinestring :=

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block STRING...

  2. [2]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

  3. [3]

    Javad Asl, Eduardo Blanco, and Daniel Takabi. 2023. https://doi.org/10.18653/v1/2023.findings-emnlp.305 R obust E mbed: Robust sentence embeddings using self-supervised contrastive pre-training . In Findings of the Association for Computational Linguistics: EMNLP 2023, pages 4587--4603, Singapore. Association for Computational Linguistics

  4. [4]

    Ivana Balazevic, Carl Allen, and Timothy Hospedales. 2019. https://doi.org/10.18653/v1/d19-1522 Tucker: Tensor factorization for knowledge graph completion . Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP)

  5. [5]

    Antoine Bordes, Nicolas Usunier, Alberto Garcia-Duran, Jason Weston, and Oksana Yakhnenko. 2013. Translating embeddings for modeling multi-relational data. In Advances in Neural Information Processing Systems 26, pages 2787--2795

  6. [6]

    Linlin Chao, Jianshan He, Taifeng Wang, and Wei Chu. 2021. https://aclanthology.org/2021.acl-long.336 P air RE : Knowledge graph embeddings via paired relation vectors . In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Paper...

  7. [7]

    Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. 2019. Certified adversarial robustness via randomized smoothing. In international conference on machine learning, pages 1310--1320. PMLR

  8. [8]

    Tim Dettmers, Pasquale Minervini, Pontus Stenetorp, and Sebastian Riedel. 2018. Convolutional 2d knowledge graph embeddings. Proceedings of the 32nd AAAI Conference on Artificial Intelligence

Show all 30 references
  1. [9]

    Goodfellow, Jonathon Shlens, and Christian Szegedy

    Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. 2015. https://arxiv.org/abs/1412.6572 Explaining and harnessing adversarial examples . Preprint, arXiv:1412.6572

  2. [10]

    Jiabao Ji, Bairu Hou, Zhen Zhang, Guanhua Zhang, Wenqi Fan, Qing Li, Yang Zhang, Gaowen Liu, Sijia Liu, and Shiyu Chang. 2024. https://doi.org/10.18653/v1/2024.naacl-short.23 Advancing the robustness of large language models through self-denoised smoothing . In Proceedings of ...

  3. [11]

    Thanh Le, Nam Le, and Bac Le. 2023. Knowledge graph embedding by relational rotation and complex convolution for link prediction. Expert Systems with Applications, 214:119122

  4. [12]

    Seanie Lee, Minki Kang, Juho Lee, and Sung Ju Hwang. 2021. Learning to perturb word embeddings for out-of-distribution qa. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics

  5. [13]

    Rui Li, Jianan Zhao, Chaozhuo Li, Di He, Yiqi Wang, Yuming Liu, Hao Sun, Senzhang Wang, Weiwei Deng, Yanming Shen, Xing Xie, and Qi Zhang. 2022. H ous E : Knowledge graph embedding with householder parameterization. In Proceedings of the 39th International Conference on Machin...

  6. [14]

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2019. https://arxiv.org/abs/1706.06083 Towards deep learning models resistant to adversarial attacks . Preprint, arXiv:1706.06083

  7. [15]

    SGOPAL Patro and Kishore Kumar Sahu. 2015. Normalization: A preprocessing stage. arXiv preprint arXiv:1503.06462

  8. [16]

    Hongyu Ren and Jure Leskovec. 2020. Beta embeddings for multi-hop logical reasoning in knowledge graphs. Advances in Neural Information Processing Systems, 33:19716--19726

  9. [17]

    Hshmat Sahak, Daniel Watson, Chitwan Saharia, and David Fleet. 2023. https://arxiv.org/abs/2302.07864 Denoising diffusion probabilistic models for robust image super-resolution in the wild . Preprint, arXiv:2302.07864

  10. [18]

    Yingchun Shan, Chenyang Bu, Xiaojian Liu, Shengwei Ji, and Lei Li. 2018. https://doi.org/10.1109/ICBK.2018.00013 Confidence-aware negative sampling method for noisy knowledge graph embedding . In 2018 IEEE International Conference on Big Knowledge (ICBK), pages 33--40

  11. [19]

    Tengwei Song, Jie Luo, and Lei Huang. 2021. Rot-pro: Modeling transitivity by projection in knowledge graph embedding. In Proceedings of the Thirty-Fifth Annual Conference on Advances in Neural Information Processing Systems ( NeurIPS )

  12. [20]

    Zhiqing Sun, Zhi-Hong Deng, Jian-Yun Nie, and Jian Tang. 2019. Rotate: Knowledge graph embedding by relational rotation in complex space. In International Conference on Learning Representations

  13. [21]

    Trouillon, J

    T. Trouillon, J. Welbl, S. Riedel, E. Gaussier, and G. Bouchard. 2016. Complex embeddings for simple link prediction. In Proceedings of 33rd Int. Conf. Mach. Learn, page 2071–2080

  14. [22]

    Pascal Vincent. 2011. https://doi.org/10.1162/NECO_a_00142 A connection between score matching and denoising autoencoders . Neural Computation, 23(7):1661--1674

  15. [23]

    Pascal Vincent, Hugo Larochelle, Isabelle Lajoie, Yoshua Bengio, and Pierre-Antoine Manzagol. 2010. Stacked denoising autoencoders: Learning useful representations in a deep network with a local denoising criterion. J. Mach. Learn. Res., 11:3371–3408

  16. [24]

    Wang , B

    R. Wang , B. Li , S. Hu , W. Du , and M. Zhang . 2020. Knowledge graph embedding via graph attenuated attention networks. IEEE Access, 8:5212--5224

  17. [25]

    Yibin Wang, Yichen Yang, Di He, and Kun He. 2023. https://doi.org/10.18653/v1/2023.findings-acl.42 Robustness-aware word embedding improves certified robustness to adversarial word substitutions . In Findings of the Association for Computational Linguistics: ACL 2023, pages 67...

  18. [26]

    B. Yang, W. t. Yih, X. He, J. Gao, and L. Deng. 2015. Embedding entities and relations for learning and inference in knowledge bases. In ICLR, pages 1--13

  19. [27]

    Xiaohan Yang and Ning Wang. 2023. https://doi.org/10.1016/j.neucom.2023.126261 A confidence-aware and path-enhanced convolutional neural network embedding framework on noisy knowledge graph . Neurocomput., 545(C)

  20. [28]

    Runtian Zhai, Chen Dan, Di He, Huan Zhang, Boqing Gong, Pradeep Ravikumar, Cho-Jui Hsieh, and Liwei Wang. 2019. Macer: Attack-free and scalable robust training via maximizing certified radius. In International Conference on Learning Representations

  21. [29]

    Jiawei Zhang, Linyi Li, Ce Zhang, and Bo Li. 2023. Care: Certifiably robust learning with reasoning via variational inference. In 2023 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), pages 554--574. IEEE

  22. [30]

    Zhaocheng Zhu, Zuobai Zhang, Louis-Pascal Xhonneux, and Jian Tang. 2021. Neural bellman-ford networks: A general graph neural network framework for link prediction. Advances in Neural Information Processing Systems, 34

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.