Pith. sign in

REVIEW 2 major objections 4 minor 13 references

Adaptive Diffusion Denoised Smoothing : Certified Robustness via Randomized Smoothing with Differentially Private Guided Denoising Diffusion

T0 review · 2 major / 4 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Adaptive Diffusion Denoised Smoothing claims that a guided DDPM denoising process, composed through a Gaussian differential privacy filter, certifies $\ell_2$ robustness with radius $\sigma/2(\Phi^{-1}(p_+)-\Phi^{-1}(p_-))$.

desk verdict A promising GDP-filter extension of randomized smoothing to guided diffusion, undermined by a budget initialization bug that invalidates the certificate as printed; worth a real look once fixed. read the letter →

arxiv 2507.08163 v1 pith:BBEH6YFT submitted 2025-07-10 cs.CV cs.CRcs.LG

Frederick Shpilevskiy , Saiyue Lyu , Krishnamurthy Dj Dvijotham , Mathias Lécuyer , Pierre-André Noël This is my paper · ORCID
classification cs.CVcs.CRcs.LG
keywords adaptivediffusiondenoisedsmoothingrandomizedcertifiedrobustnessGaussiandifferentialprivacyfilterguideddenoisingadversarialexamplesImageNetclassification
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper introduces Adaptive Diffusion Denoised Smoothing, a way to certify a vision classifier against $\ell_2$ adversarial perturbations when the input is first cleaned by a guided DDPM denoising process. The key move is to reinterpret each guided denoising step as an adaptive Gaussian mechanism whose sensitivity to the input is controlled by the guidance scale, and to compose those mechanisms with a Gaussian differential privacy filter. The paper claims this composition yields the standard randomized-smoothing certificate with radius $\sigma/2(\Phi^{-1}(p_+)-\Phi^{-1}(p_-))$, and that on ImageNet the method matches or improves both certified and clean accuracy over one-shot and multi-hop diffusion denoising baselines. A sympathetic reader should take the claim as: pretrained diffusion models can serve as certifiable, test-time denoisers without retraining, as long as the per-step privacy budget is tracked correctly.

What carries the argument

The carrying object is a single guided denoising step written as an adaptive Gaussian mechanism. Using the DDIM-style identity, the reverse step is $x_{t-1} = \frac{\sqrt{\bar\alpha_{t-1}}(1-\alpha_t)}{1-\bar\alpha_t}\,\hat x_t^0 + \frac{(1-\bar\alpha_{t-1})\sqrt{\alpha_t}}{1-\bar\alpha_t}\,x_t + \mathcal{N}(0,\Sigma_\theta(x_t,t))$, where $\hat x_t^0$ is the denoiser's predicted clean image. Guidance replaces $\hat x_t^0$ with $(1-s)\hat x_t^0 + s x$, so the mean becomes a convex combination whose derivative with respect to the input is bounded by $s\sqrt{\bar\alpha_{t-1}}(1-\alpha_t)/(1-\bar\alpha_t)$ per pixel. Because $\Sigma_\theta$ is diagonal, each pixel is an independent Gaussian mechanism, and Algorithm 1 accumulates the squared per-step sensitivities; when the budget is exhausted the remaining steps run unguided, keeping the whole trajectory within a fixed GDP budget.

What would settle it

Run Algorithm 1 and Algorithm 2 exactly as printed with $\sigma = 2$ and a positive guidance scale $s$, and log the sum over accepted steps of $s^2 \bar\alpha_{t-1}(1-\alpha_t)^2 / ((1-\bar\alpha_t)^2 \sigma_{t,i}^2)$. If this sum exceeds $1/\sigma^2$ while the filter still returns `ok`, the $r/\sigma$-GDP guarantee is violated for that run; re-certifying with the filter initialized to $1/\sigma^2$ would settle whether the reported radii still hold.

Watch

Extended reading notes

Core claim

The paper's central claim is Theorem 3.3: for the guided DDPM denoising process in Algorithm 2 with total randomized smoothing variance $\sigma^2$, the smoothed classifier $M_S(x) = \arg\max_y \Pr(g(x_0)=y)$ is robust against every $\ell_2$ perturbation $e$ with $\|e\|_2 \le r_x$, where $r_x = \frac{\sigma}{2}(\Phi^{-1}(p_+)-\Phi^{-1}(p_-))$ and $p_+, p_-$ are lower/upper bounds on top-class and runner-up probabilities. The argument models each denoising step as $M_t: x \mapsto A_t(x)+z$ with $z\sim\mathcal{N}(0,\Sigma_\theta(x_t,t))$, bounds the per-pixel sensitivity of $A_t$ by $r_i\, s\, \sqrt{\bar\alpha_{t-1}}(1-\alpha_t)/(1-\bar\alpha_t)$, and composes these steps with a GDP privacy filter, then uses concurrent composition across pixels and the adaptive randomized smoothing theorem to convert the GDP guarantee into the radius. Experiments on ImageNet report that ADDS, especially without unguided denoising after the budget is exhausted, is competitive with or better than DDS and DensePure in certified and clean accuracy across $\sigma \in \{1.0, 1.5, 2.0\}$.

Load-bearing premise

The certificate rests on the privacy filter correctly tracking how much guidance has been used, and as printed the filter tracks $1/\sigma$ while the proof requires $1/\sigma^2$, so for $\sigma > 1$ it can approve more guidance than the guarantee covers.

Editorial extensions

If this is right

  • Any pretrained DDPM with per-step covariance estimates becomes a certifiable denoiser with no additional training, by wrapping it in Algorithm 2 and the GDP filter.
  • Running out of budget and then denoising without guidance (ADDS without unguided denoising) reduces variance and improves clean accuracy, while voting over several trajectories increases certified accuracy at the price of clean accuracy on hard images.
  • At higher smoothing noise ($\sigma=1.5,2.0$), guided denoising can reach a less noisy state than one-shot DDS, yielding better certified accuracy; at $\sigma=1.0$ the one-shot baseline remains competitive.
  • The same private-composition framework gives a template for certifying other multi-step defences whose per-step sensitivity to the input can be bounded.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper: the same GDP-filter accounting should apply to other iterative samplers (e.g., DDIM or score-based SDEs) whenever each substep admits a sensitivity bound, even though the paper does not analyze them.
  • Beyond the paper: because the radius depends only on $p_+$ and $p_-$, any improvement in the base classifier or denoiser sharpens the certificate directly; one could optimize the guidance schedule against these probabilities instead of a fixed budget.
  • Beyond the paper: re-running the method with Algorithm 1 initialized to $1/\sigma^2$ (the squared budget the proof needs) would show whether the reported certified-accuracy gains survive the corrected bookkeeping or depend on the filter as printed.
  • Beyond the paper: the per-pixel concurrent composition is conservative; exploiting the full covariance structure of $\Sigma_\theta$ could yield a tighter end-to-end radius.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 4 minor

Summary. The paper introduces Adaptive Diffusion Denoised Smoothing (ADDS), which treats a guided DDPM reverse process as a sequence of Gaussian differential privacy mechanisms and uses a GDP privacy filter to allocate a per-pixel sensitivity budget across denoising steps. Proposition 3.1 bounds the sensitivity of one guided denoising step, Proposition 3.2 composes the steps into an r_i/sigma-GDP guarantee for each pixel, and Theorem 3.3 derives the certified l2 radius rx = sigma/2 (Phi^{-1}(p+) - Phi^{-1}(p-)). The authors evaluate certified and clean accuracy on a 250-image subset of ImageNet at sigma in {1.0, 1.5, 2.0}, comparing with Carlini et al. (2023b) and DensePure.

Significance. If the theoretical claims hold, ADDS is a valuable extension of adaptive randomized smoothing to diffusion denoising: it provides a principled way to inject input-dependent guidance while retaining a provable certificate, and the experiments suggest gains at larger noise levels. The paper derives the per-step sensitivity in closed form and reduces the end-to-end guarantee to a standard RS-type radius, which is an elegant and useful reduction. The main obstacles are that the printed algorithm does not implement the budget required by the proof and that the empirical evaluation is too thin to support the claimed improvements.

major comments (2)
  1. [Section 3, Algorithms 1-2 and Proposition 3.2] The printed privacy filter is inconsistent with the proof of Proposition 3.2. Algorithm 2 initializes mu = 1/sigma and Lambda <- mu * 1_d, while Algorithm 1 subtracts the per-step quantity s^2 * alpha_bar_{t-1} (1-alpha_t)^2 / ((1-alpha_bar_t)^2 sigma^2_{t,i}). Proposition 3.1 defines mu_{t,i}^2 as r_i^2 times this exact quantity, and the proof of Proposition 3.2 requires the filter to enforce sum_t s^2 * alpha_bar_{t-1} (1-alpha_t)^2 / ((1-alpha_bar_t)^2 sigma^2_{t,i}) <= mu^2 = 1/sigma^2. With Lambda initialized to 1/sigma, the filter as printed only enforces the sum to be at most 1/sigma, which for sigma > 1 is sigma times the permitted squared-sensitivity budget (1.5x at sigma=1.5 and 2x at sigma=2.0). The initialization is also dimensionally inconsistent, since Lambda accumulates squared sensitivities and should be initialized in inverse-variance units rather than inverse-standard-deviation units. Consequently the r_i/sigma-GDP conclusion of Proposition 3.2 and the certified radius of Theorem 3.3 are not supported by the printed algorithm, and the sigma=1.5 and sigma=2.0 columns of Tables 1 and 2 are affected. The fix is to initialize Lambda to mu^2 = 1/sigma^2, or to redefine mu as the squared budget throughout; if the implementation already uses the corrected initialization, the pseudocode must be updated so that the paper and the experiments are consistent.
  2. [Section 4 and Appendix B] The empirical evaluation is too weak to support the paper's stated claim of improving certified and standard accuracy on ImageNet. All results are point estimates on a 250-image subset, the guidance scales are tuned on that same subset (Appendix B: 'We tuned these parameters in the sigma = 1.0, 1.5 settings on ADDS (1 vote)'), and no error bars or confidence intervals are reported. For instance, the best gain in Table 1, ADDS with 5 votes over DensePure with 5 votes at sigma=2.0, is 0.8 percentage points, which is likely within the sampling noise for 250 images. Please report confidence intervals over certification samples and/or multiple seeds, use a separate validation set for hyperparameter selection, and ideally evaluate on a larger subset. Releasing code would also resolve the ambiguity in Major Comment 1 and make the numbers reproducible.
minor comments (4)
  1. [Algorithms 1-2] Algorithms 1 and 2 use Lambda as both a vector and a scalar; please state explicitly that PrivacyFilter operates elementwise on the per-pixel budget vector, and write sigma^2_{t,i} rather than sigma^2_t in the subtraction.
  2. [Proposition 3.1] Proposition 3.1 should state explicitly that the GDP guarantee is conditional on the current denoising trajectory x_t (i.e., on the previous outputs), since the covariance Sigma_theta(x_t,t) is data-dependent; otherwise the mechanism as written is not a standard Gaussian mechanism with fixed variance.
  3. [Abstract and Tables 1-2] The abstract's claim of improving both certified and standard accuracy on ImageNet is stronger than Tables 1-2 show: at sigma=1.0 ADDS is below Carlini et al. in certified accuracy. Consider qualifying the claim to larger noise levels or to the specific configurations where it holds.
  4. [Appendix B] Appendix B reports a guidance scale of 0.9 for sigma=2.0, but the tuning statement only mentions sigma=1.0 and 1.5; clarify whether 0.9 was tuned or set manually.

Circularity Check

0 steps flagged · score 1.0 of 10

No meaningful circularity: the certified radius derives from the per-step sensitivity analysis and external GDP-composition theorems; the print-time budget initialization (Lambda = mu vs Lambda = mu^2) is a soundness gap, not a circular step.

full rationale

I walked the full derivation chain and found no step that reduces to its own inputs. Proposition 3.1 derives the per-step budget mu^2_{t,i} = r_i^2 s^2 alpha_bar_{t-1}(1-alpha_t)^2 / (sigma^2_{t,i}(1-alpha_bar_t)^2) from a sensitivity bound computed on the mechanism's own equation (the guided substitution into Equation (3)); converting that sensitivity into a GDP budget uses the external Gaussian-mechanism characterization of Dong et al. (2022). Proposition 3.2 composes the per-step budgets through the external GDP-filter theorems of Smith & Thakurta (2022) and Koskela et al. (2022). Theorem 3.3 layers concurrent composition (Haney et al., 2023) and then applies Corollary 2.2 of Lyu et al. (2024) to convert 'the full mechanism is r_x/sigma-GDP' into the robustness certificate r_x = (sigma/2)(Phi^{-1}(p_+) - Phi^{-1}(p_-)). The one self-citation (Lyu et al., 2024, with three overlapping authors) is load-bearing at that final conversion step, but it is a peer-reviewed, published theorem whose stated assumptions (a composed sequence of r/sigma-GDP mechanisms) do not include this paper's diffusion-specific content, and the certificate shape itself traces to external foundations (Cohen et al., 2019; Lecuyer et al., 2019) that are also cited; per the review rules it is real evidence and does not raise the circularity score. The guidance scale s is tuned per sigma, but it is a defense hyperparameter: the certificate formula depends only on sigma and the measured probabilities p_+, p_-, and s never appears in it, so no fitted coefficient forces the reported radius. One explicitly flagged soundness gap, distinct from circularity: Proposition 3.2's proof requires the filter to enforce sum_t s^2 alpha_bar_{t-1}(1-alpha_t)^2 / ((1-alpha_bar_t)^2 sigma^2_{t,i}) <= mu^2 with mu^2 = 1/sigma^2, but Algorithm 2 initializes Lambda as mu*1_d with mu = 1/sigma and Algorithm 1 subtracts exactly those squared-sensitivity terms, so as printed the enforced bound is 1/sigma, which for sigma > 1 (the sigma = 1.5 and 2.0 settings) exceeds 1/sigma^2 by factors of 2.25 and 4. The r_i/sigma-GDP claim, and therefore Theorem 3.3's radius, is unsupported as printed unless the implementation actually used Lambda = mu^2, which would make the pseudocode a transcription error. Because this mismatch invalidates the proof's premise rather than making the theorem equivalent to its inputs, it is a correctness risk and does not change the circularity verdict.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

No new physical entities or forces are introduced. The only design choices are the guidance mechanism and privacy filter, which are algorithmic.

free parameters (3)
  • guidance scale s = 0.8 for sigma=1.0 and 1.5; 0.9 for sigma=2.0
    Tuned on the same 250-image ImageNet subset in Appendix B; controls how much of the original image is injected each guided step and directly affects the privacy budget consumption and accuracy.
  • number of denoising steps = 20 evenly spaced from the original 1000
    Chosen without a reported ablation; all variants use 20 steps.
  • number of votes = 1 or 5
    Voting is evaluated both ways; it changes the certified accuracy versus clean accuracy trade-off.
assumptions (5)
  • standard math GDP privacy filter theorem: any adaptive composition of mu_i-GDP mechanisms with sum mu_i^2 <= mu^2 is mu-GDP.
    Used in Proposition 3.2 to bound the end-to-end guided denoising mechanism.
  • standard math Concurrent composition of GDP mechanisms over pixels composes with squared sum of privacy parameters.
    Used in the proof of Theorem 3.3 to combine per-pixel GDP guarantees.
  • standard math Corollary 2.2 of Lyu et al. (2024) converts an r/sigma-GDP guarantee into an l2 certificate with radius sigma/2*(Phi^{-1}(p+)-Phi^{-1}(p-)).
    Bridges the GDP guarantee to the final certified radius.
  • domain assumption The reverse DDPM transition is N(A_t(x), Sigma_theta(x_t,t)) with Sigma_theta depending only on the current noisy state x_t.
    The per-step sensitivity analysis holds only if the denoiser and covariance do not depend directly on the original input x given the current state.
  • domain assumption Adversarial l2 changes decompose per-pixel, so per-pixel GDP analysis can be composed over pixels.
    Required for the pixel-wise privacy filter and the final l2 certificate.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Adaptive Diffusion Denoised Smoothing : Certified Robustness via Randomized Smoothing with Differentially Private Guided Denoising Diffusion." pith.science (2026). https://pith.science/paper/BBEH6YFT

@misc{pith2026250708163,
  author       = {Pith},
  title        = {Pith review of: Adaptive Diffusion Denoised Smoothing : Certified Robustness via Randomized Smoothing with Differentially Private Guided Denoising Diffusion},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/BBEH6YFT}},
  note         = {Machine review of arXiv:2507.08163}
}
abstract

We propose Adaptive Diffusion Denoised Smoothing, a method for certifying the predictions of a vision model against adversarial examples, while adapting to the input. Our key insight is to reinterpret a guided denoising diffusion model as a long sequence of adaptive Gaussian Differentially Private (GDP) mechanisms refining a pure noise sample into an image. We show that these adaptive mechanisms can be composed through a GDP privacy filter to analyze the end-to-end robustness of the guided denoising process, yielding a provable certification that extends the adaptive randomized smoothing analysis. We demonstrate that our design, under a specific guiding strategy, can improve both certified accuracy and standard accuracy on ImageNet for an $\ell_2$ threat model.

Figures

Figures reproduced from arXiv: 2507.08163 by the authors.

Figure 1
Figure 1. (a) Randomized Smoothing adds noise to the input to create a smooth model from a base model g. (b) Our Adaptive Diffusion Denoised Smoothing starts with a pure noise image xT , and guides a reverse-diffusion process at steps T ≤ t ≤ t ∗ (the red box, showing one guiding step) towards reconstructing the target image x0 ≈ x, for a final prediction by g. Starting from xt, the pretrained diffusion model predicts a less … view at source ↗
Figure 2
Figure 2. Certified Test Accuracy of 1 Vote Methods on ImageNet. Certified accuracy of ADDS with 1 vote is competitive with Xiao et al. (2023) in (a) and with Carlini et al. (2023b) in (b) and (c). Although at radius 0, we showed in [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 3
Figure 3. Certified Test Accuracy of 5 Vote Methods on ImageNet. Certified accuracy of ADDS with 5 vote is competitive with Xiao et al. (2023) with 5 votes at every σ. ADDS without unguided de-noising is outperformed by Xiao et al. (2023) and ADDS with 5 votes, but the gap tightens as σ increases. In [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: Runtime Plot. The time it takes each algorithm from [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: Distribution of Classification Counts of ADDS over 1 and 5 Votes. The plot shows the classification counts of ADDS at 1 and 5 votes over 1000 noise seeds on a selection of 10 images. Each column corresponds to a different privacy budget. For each image, we show the 10 …
Figure 6
Figure 6. Figure 6: Selection of Denoised Images at σ = 1.0. 10 [PITH_FULL_IMAGE:figures/full_fig_p010_6.png]
Figure 7
Figure 7. Figure 7: Selection of Denoised Images at σ = 1.5. 11 [PITH_FULL_IMAGE:figures/full_fig_p011_7.png]
Figure 8
Figure 8. Figure 8: Selection of Denoised Images at σ = 2.0. 12 [PITH_FULL_IMAGE:figures/full_fig_p012_8.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

13 extracted references · 11 canonical work pages

  1. [2]

    (2023) in (a) and with Carlini et al

    Certified Test Accuracy of 1 Vote Methods on ImageNet.Certified accuracy of ADDS with 1 vote is competitive with Xiao et al. (2023) in (a) and with Carlini et al. (2023b) in (b) and (c). Although at radius 0, we showed in Table 1 that we improve on Carlini et al. (2023b) by two percentage points, (b) and (c) show that for larger radius, the gap tightens. ...

    work page 2023

  2. [3]

    (2023) with 5 votes at every σ

    Certified Test Accuracy of 5 Vote Methods on ImageNet.Certified accuracy of ADDS with 5 vote is competitive with Xiao et al. (2023) with 5 votes at every σ. ADDS without unguided de-noising is outperformed by Xiao et al. (2023) and ADDS with 5 votes, but the gap tightens as σ increases. In Figure 3, we see that majority voting over 5 unguided trajectories...

    work page 2023

  3. [4]

    Certified robustness to adversarial examples with differential privacy

    L´ecuyer, M., Atlidakis, V ., Geambasu, R., Hsu, D., and Jana, S. Certified robustness to adversarial examples with differential privacy. In 2019 IEEE symposium on security and privacy (SP), pp. 656–672. IEEE,

    work page 2019

  4. [7]

    Guided diffusion model for ad- versarial purification from random noise

    Wu, Q., Ye, H., and Gu, Y . Guided diffusion model for ad- versarial purification from random noise. arXiv preprint arXiv:2206.10875,

    arXiv

  5. [8]

    Consider a Gaussian mechanism M : x → A(x) + z, where z ∼ N(0, r2 µ2 I) and A is some model

    is an extension of (ε, δ)-Differential Privacy that defines privacy according to the power of any hypothesis test to differentiate a Gaussian-distributed output from any of its neighbours. Consider a Gaussian mechanism M : x → A(x) + z, where z ∼ N(0, r2 µ2 I) and A is some model. According to Dong et al. (2022, Theorem 2.7), for any neighbouring inputs x...

    work page 2023

  6. [9]

    This process relies on much stronger assumptions than the RS approach we, Xiao et al

    proposes a one-shot denoising procedure that locally smooths the output by taking a majority vote of the predictions for each purified sample over multiple Gaussian noise samples. This process relies on much stronger assumptions than the RS approach we, Xiao et al. (2023), and Lyu et al. (2024) build on, which we believe is risky in the adversarial settin...

    work page 2023

  7. [10]

    To further improve robustness, various methods (Wang et al., 2022; Wu et al., 2022; Bai et al.,

    has explored different techniques of injecting guidance into diffusion models to steer the denoising trajectories towards task-specific semantics, such that controllable high-fidelity outputs are sampled without retraining the underlying generator. To further improve robustness, various methods (Wang et al., 2022; Wu et al., 2022; Bai et al.,

    work page 2022

  8. [2014]

    Guided dif- fusion model for adversarial purification

    Wang, J., Lyu, Z., Lin, D., Dai, B., and Fu, H. Guided dif- fusion model for adversarial purification. arXiv preprint arXiv:2205.14969,

    arXiv

Show all 13 references
  1. [2016]

    and Thakurta, A

    5 Submitted to 2nd Workshop on Test-Time Adaptation for ICML2025 Smith, A. and Thakurta, A. Fully adaptive composi- tion for gaussian differential privacy. arXiv preprint arXiv:2210.17520,

    arXiv

  2. [2019]

    Concurrent composition for interactive differential privacy with adaptive privacy-loss parameters

    Haney, S., Shoemate, M., Tian, G., Vadhan, S., Vyrros, A., Xu, V ., and Zhang, W. Concurrent composition for interactive differential privacy with adaptive privacy-loss parameters. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, pp. 1949–1963,

    2023

  3. [2022]

    Imagenet: A large-scale hierarchical image database

    Deng, J., Dong, W., Socher, R., Li, L.-J., Li, K., and Fei-Fei, L. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition. Ieee,

    2009

  4. [2023]

    Individual pri- vacy accounting with gaussian differential privacy

    Koskela, A., Tobaben, M., and Honkela, A. Individual pri- vacy accounting with gaussian differential privacy. arXiv preprint arXiv:2209.15596,

    arXiv

  5. [2024]

    Although obtaining empirical accuracy improvement, these methods do not provide provable certification

    has utilized guidance with diffusion in adversarial purification. Although obtaining empirical accuracy improvement, these methods do not provide provable certification. Inspired by (Bansal et al., 2023), our adaptive pipeline takes advantage of the guidance during denoising, ...

    2023

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.