When and how can inexact generative models still sample from the data manifold?
Authors: Nisha Chandramoorthy
Adriaan A. de Clercq
Venue: NeurIPS 2025 poster ()
Keywords: Generative models; machine learning theory; dynamical systems theory;
Primary area: deep_learning
TL;DR: Under strong compression of the dynamics of a generating process, a generative model learns the tangent space of the data manifold.

Abstract: A curious phenomenon observed in some dynamical generative models is the following: despite learning errors in the score function or the drift vector field, the generated samples appear to shift \emph{along} the support of the data distribution but not \emph{away} from it. In this work, we investigate this phenomenon of \emph{robustness of the support} by taking a dynamical systems approach on the generating stochastic/deterministic process. Our perturbation analysis of the probability flow reveals that infinitesimal learning errors cause the predicted density to be different from the target density only on the data manifold for a wide class of generative models. Further, what is the dynamical mechanism that leads to the robustness of the support? We show that the alignment of the top Lyapunov vectors (most sensitive infinitesimal perturbation directions) with the tangent spaces along the boundary of the data manifold leads to robustness and prove a sufficient condition on the dynamics of the generating process to achieve this alignment. Moreover, the alignment condition is efficient to compute and, in practice, for robust generative models, automatically leads to accurate estimates of the tangent bundle of the data manifold. Using a finite-time linear perturbation analysis on samples paths as well as probability flows, our work complements and extends existing works on obtaining theoretical guarantees for generative models from a stochastic analysis, statistical learning and uncertainty quantification points of view. Our results apply across different dynamical generative models, such as conditional flow-matching and score-based generative models, and for different target distributions that may or may not satisfy the manifold hypothesis.

When and how can inexact generative models still sample from the data manifold?
Nisha Chandramoorthy Department of Statistics
Committee on Computational and Applied Mathematics
The University of Chicago
Chicago, IL. 60637
ni nashac@uuhicago.. .du
Adriaan de Clereq
Department of Statistics
Committee Computational and Applied Mathematics The University of Chicago Chicago, II. 60637
Abstract
A curious phenomenon observed in some dynamical generative models the following: despite learning errors in the score function or the drift vector field, the generated samples appear shift along the support of the data distribution but not away from it. In this work, we investigate this phenomenon of robust- ness of the support by taking dynamical systems approach on the generating stochastieddetemmniisti process. Our perturbation analysis of the probability flow reveals that infinitesimal learning errors cause the predicted density to different from the target density only on the data manifold for wide class of generative models. Further, what the dynamical mechanism that leads to the robustness of the support? We show that the alignment of the top Lyapunov vectors (most sensitive infinitesimal perturbation directions) with the tangent spaces along the boundary of the data manifold leads to robustness and prove sufficient condition on the dynamics of the generating process to achieve this alignment. Moreover, the alignment condition is efficient compute and, in practice, for robust generative models, automatically leads to accurate estimates of the tangent bundle of the data manifold. Using finite-time linear perturbation analysis well as probability flows, our work complements and extends existing works on obtaining theoretical guarantees for generative models from stochastic analysis, statistical learning and uncertainty quantification points of view. Our results apply across different dynamical generative models, such conditional flow-matching and score-basee baseed generative models, and for different target distributions that may may not satisfy the manifold hypothesis.
samples paths
Introduction
Given samples from targer distribution, generative model (GM) outputs samples (approxi- mately) from the target. Most generative models accomplish this task using a dynamical formulation of probabilistic measure transport. They solve an optimization problem for vector field drift term deterministic or stochastic process that produces the desired target samples in finite time. Flows under the learned vector field transports probability densities between some source density
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Figure I: Robustness of the support under perturbations of SGMs. Columns I and 2: score vector field (lines) and the density (contours) near the start time and toward the end respectively. Notice that the score field is nearly orthogonal to the target support. Column 3: generated target density. Column 4: Leading finite-time Lyapunov vectors at the end, which are noticeably aligned with the target support. Column 5: kernel density estimate of the distribution generated by process corrupted by large errors in the score. The density is shifted primarily tangent to the data manifold.
and the target. For instance, in diffusion models or score-based generative models (SGMs) and their II] the vector field corresponds to a score of a noising process (e.g., an Orstein- Uhlenbeck process starting initialized with the given target samples) and the source density is that achieved at the end of the noising process. On the other hand, in conditional flow matching variants and using Neural ODEs 61 [4], the learned vector field is constructed by specifying a path (c.g., straight line path or optimal transport paths) sample space, between samples according a fixed source density and the given target samples. In every case, there are inevitably errors incurred in learning the vector field neural network for multiple reasons, including optimization errors, approximation errors, discretization errors during time integration (of the underlying deterministic or stochastic process) and finite sample errors. These errors will propagate through the generating process and therefore be reflected in the predicted target samples. However, when are the predicted target samples close to high density regions of the target? How can we formalize this error propagation? Further, how can determine the robustness of given GM to these errors in the vector field? In this work, we provide answers these questions by taking a dynamical systems approach to GMs. Even as the use of GMs proliferates (see e.g., [60] for review), their utility in critical applications, c.g., in climate predictions 40 especially hinges on theoretical guarantees for their practical implementations. Significant research progress has been achieved in obtaining convergence guarantees (see e.g., [1 34 section (5) for SGM-variants under minimal assumptions on the target as learning errors the score vanish. But rather than convergence to the distribution, a property that may be more pertinent to practical applications across engineering and data science is the robustness of support, which is the subject of this work. In other words, since learning errors are inevitable, a characterization of when a generative model will still be able to capture the high-density regions, or produce physically relevant or plausible samples, would be enormously useful.
variants [52] 51
37 56 57 55 stochastic interpolants and Schrödinger bridge-basee variants [8
3 2
Our definition of robustness is motivated by many empirical and theoretical studies on the feature learning and generalization of SGMs under the manifold hypothesis (47 13]. Figure [ depicts these observations for two-dimensional two-moons target density (supported almost on a 1D curve), generated by an SGM using analytical scores, shown in the third column. When at each step of the generating process, we make deterministic error in the score estimation, we observe that the generated distribution shifts along the support, as illustrated in Figure [] (rightmost column). Surprisingly, the errors in the score estimation, even when large, do not cause the generated samples to move to zero probability regions of the target, which are off the moons for the target shown in Figure M A natural question that arises is when such a robustness of the support may be expected. To answer this question, we formally analyze this behavior of the sime-inhomoecncous Markov chain that generates the samples as a random dynamical system. As a byproduct our analysis, we characterize precisely how geometric information about the support is extracted by robust generative models. Our main contributions are as follows:
Robustness of support. Under mild regularity assumptions on the generating dynamics, we show that an infinitesimal change in the predicted target is only supported where the target density is supported as the perturbation size tends to 0. This explains our observed robustness of support even in high-dimensional data distributions (see Appendix G.4 for response to score perturbations on the CIFAR 10 distribution).

---

Alignment. When the leading finite-time Lyapunov vectors (LVs; see section 4 for precise definitions), which represent the principal directions of deformation of the sample space the final time, have a negligible component normal to the target support, we show that the generating process learns the support. This is evident in Figure I Icolumn 4), where the leading IVs (shown as black lines) are tangent to the support, and robustness of the support holds.
Dynamical mechanism for alignment. We prove sufficient conditions that characterize when the generating dynamics has LVs that align with the support of the data distribution. One sufficient condition, intuitively, turns out to be that the vector field acts as an attracting force to the support, which is satisfied for the SGM dynamics in Figure | (columns 1 and 2).
Practical implications. Note that there many efficient, numerically stable algorithms, which can be implemented with automatic differentiation, to compute these finite-time Lyapunov vectors. Thus, can efficiently obtain the tangent spaces to the data manifold using any aligned GM. Finally, we show that a GM has the alignment property, so does the same GM under learning errors. Since our analyses do not assume a specific dynamics, our results apply to all practical implementations (e.g.. using predictor-corrector integration or ODE integration) and across different dynamical generative models (e.g., SGMs or conditional flow matching).
2 Preliminaries: generative models as random dynamical systems
Let Pdata be the data (target) distribution with compact support M C RDP, The distribution Pdata is singular under the manifold hypothesis, i.e., dim = < D. Let po be a given source probability density in R Fixing Po and density that approximates Pdata: there can be infinitely many couplings between them. That is, for many sequences of functions [Fe sample paths X, = 1 can have the same starting and ending distributions, i.c., Xo- ~ po and X,, Pdata What enables given sequence {Fi} to have the robustness of support property? To study this question, we treat the sequence F2 (random) dynamical system.
In score generative models or diffusion models [52], the dynamics, F,, on path space the stochastic reverse process. At each time L 0, 1, T 1, the map 17 on sample space represents the dynamics under an instance of the noise path, denoted by E. This noise path is a sequence = (So..... - of independent Gaussian random variables, which must be viewed as (scaled) time discretization of Brownian motion. Since, with a known score, deterministic, time-dependent solution of probability flow ODE) can effect the same dynamics on probability space, for simplicity, we consider deterministic, non-autonomous maps Fr throughout. However, note that the perturbation analysis both on probability space and tangent space in the remainder of this paper applies pathwise (for each E) (see S 22 for a rigorous treatment of Lyapunov vectors and exponents for random dynamical systems), even if we consider F; as a stochastic process.
process
In a dynamical formulation of a GM, F, is typically partially represented by a neural network. In general, (z( = x + 56 vn (x)), where the drift vector field n, (a neural network) is learned using samples from Pdata and 8t is small timestep. For instance, a score-based generative model based on an Crnstein-Uhlenbar
noising (forward) process, F,, the dynamical system representing the reverse process can be written as (x) = 0 x + d²s) S T, where the score functions of the OU process St V log Pt: represented using neural network. With no learning errors, may write that FT Po = Pr: where the pushforward notation (:) for probability densities means the following: Typ= = ı implies that if x ~ p. T(x) ~ x. Explicitly, the pushforward operator is a linear operator on densities, and in the context of dynamical systems, called the Frobenius-Perroo or the transfer operator: Lip ;= o F.1 /Jdet d.F.) o FT assuming that F; E C² (RR)). We use exponential notation, |r+1 == F, F", with 00D = ld, to denote iterations of the process.
Tangent space. From here on, we will be considering the evolution of infinitesimal perturbations along sample paths of F,. These will represent small learning errors that will perturb the evolution of sample paths. Roughly speaking, at each point E IR,, the directions of infinitesimal perturbation are also in IRP More precisely, at each point x; we have a tangent space (isomorphic to R RDD) denoted by T, Rp that represents all possible infinitesimal perturbations or tangen! vectors at A vector field, say e : RD - TRD, is function that maps a base point x E R D to a tangent vector w(r) in T, T,R.. We refer the reader to Appendix for further background on tangent spaces.
3

---

3 Why GMs sample along the support even under learning errors
In this section alone, assume that Pdata is absolutely continuous (i.e., d D) and its density is Pr: i.e., the generative model F" is exact/convergent (ignoring errors on (ót)). Consider now the perturbed dynamical system, (x))
öt (x) + Xa(z), where the vector field X² represents a time-dependent perturbation, and the original model Pt is recovered with 0. It is important to note that tangent perturbation does not mean perturbation along the tangent space Tg M, but rather
just perturbation (a tangent vector) in T.R... In other words, the perturbation (z(2) ) at an can be any direction in I..
Perturbations to the dynamics here are models for statistical errors in the learned drift, v, That is, define parameterized family of maps c - Ft.c at each time with Fi = Fi-1, F The corresponding dynamics on probability densities is given by Pt.c = Lt.eft-1.es with the corresponding Perronrreeerrr operator, Lr.e- We omit the subseript to refer to the unperturbed system, 0. For instance, Lt.e and L. are respectively the Frobenius-Pent perturbed and unperturbed systems. Using exponential notation for Li,e as well, fixing the source density Po we write the perturbed density, Pr. = Po-
operator at time / of the
Recall that for vector field and differentiable scalar function its directional derivative is given by the scalar field defined as (z) == lim,-=o (f(x + eu(x)) ((x))/e Now let u be a vector field such that the directional derivative of pr with respect to u, denoted by u(pr), is the perturbation in the predicted density due to the perturbation of the dynamics. That is, let the vector field u be such that u(p)) dele=o CT Pu- Intuitively, the derivative à. delc= gives the statistical response after time r of the dynamics } We refer to u as the target response field, since is a vector field that measures the direction and magnitude of the perturbation to the target density. We now understand the target response field, u, through explicit expressions for the statistical response operator, Ie
(f. pa) (fo F Fo) from a change-of-variable in the integration (one can view this as a conservation principle for probability mass). Here, (.-) refers to an L inner product with respect to Lebesgue measure on IRP Now for any observable f, we define its time-dependent response, re(f), to be a scalar field that denotes the change in its value along path due to the perturbation to the dynamics. More precisely, let rf( == lim,-su(1/e (f F² fo o F*), so that, by taking adjoints, we have (f, O. lo= Po) (f. u(p")) = (f,(f), Pa). Now, using the definition of rf()), for any f and t, can derive the following recursive relationship,
For given test function f M + R. Ez-p, f(x) == (f.p.)
Fo FT-1)= + (So so r(J) = lim - --0
f F*)]
= =rt-i F(-)) (Vfo X
Here, we have used the definition of the perturbation vector field X at time t by (z(x) lim (11e)((()))
(x)). which isolates the error made due to the perturbation to the dynamics time f. Since both F and F are the identity, we have ro( to be the zero function for all f. Apply-
ing the recursive relationship (I. we obtain rf( Σ (V(f F, ....o 11+1) F; o:)o F'. Substituting this explicit expression for the response of f, we obtain the following expression for the statistical response, (f, @.le=oLTTp)) po) (f, u(p))) (r, (f), Σ.D (V(f Fr
1++1) Fi+1, Xi o F*, po). Upon integration by parts and change of variables, we obtain for test functions f that vanish on the boundary aM,
u(p+)(z) (x) Σ (div(xe) Xa= -x) sz) FF (z)
(2)
The above expression indicates that the statistical response is the product of the target density, Pr. with sealar field. In other words, when Pdata is non-singular and F, is continously differentiable on RD, we obtain that the statistical response is supported only where the target density is non-zero, in the limit e -> O. See Appendix for an extension of the above computation to stochastic processes and singular Pdata.

---

10
10-
00
1.0
-10
-30
-20
-15
-14
15 20
-20 -15
10
15
Figure 2: The finite-time Lyapunov vectors shown in green at two samples of the predicted distribution. The sample path of diffusion model starting at the red dot is shown blue. The leading backward Lyapunov vector (BLV), shown in darker green, shows alignment with the data manifold. See Appendix G.2 for more details on this two-dimensional example.
dynamical mechanism for robustness
In the previous section, we looked at statistical response to learning errors for non-singular targets. Here, we propose a mechanism for the robustness of the statistical response by looking at infinitesimal perturbations along sample paths (dynamics on the tangent bundle) for both singular and non-singular target distributions. To do this, we carry out pathwise analysis that elucidates how learning errors propagate when we apply the dynamics. This is an adaptation of linear perturbation theory from dynamical systems theory (see 28 for a textbook exposition), and we illustrate the required concepts below.
Fixing a sample path, deduce sufficient conditions on the stability of the sample path that is consistent with the robustness of support. To this end, we must define a notion of sample path stability. We say that a path initialized with 20 ~v pn is robusiness-comsiiter if its end point, xr, the directions of accumulated infinitesimal perturbations point along the data manifold and not away from it. To explain the reasoning behind this notion and define it more precisely, we provide a brief primer on tangent dynamics.
Dynamics tangent space. Fix sample path 3; F Now, consider applying an infinitesimal perturbation (similar to in section 3 at time 0. Then, after one step, = (2o) edFo((o)) xo(2o) + Oc²). Hence, after step, in the limit - O, we have (Fr) x1)/c dFo( xo(xo) =: XI (x1), which we may define as a new vector field XI evaluated at the point 2y (a tangent vector at 21). Iterating this definition, we can define linear dynamical system, dF = d Ft-1, ... dFo that acts on the tangent bundle and evolves an infinitesimal perturbation along vector field applied at time to the corresponding vector field time t. Considering these linear evolutions, we can define the principal directions of deformation (the most sensitive directions of perturbation) by considering the leading eigenvectors of (dF* (dF't) ), which we will call the finite-time Lyapunov vectors. The eigenvalues are generally arranged in decreasing order, with at least one positive eigenvalue indicating expanding directions or diverging infinitesimal perturbations. The time-asymptotic properties of these matrix are well-studied via the classical Furstenberg and Oseledets ergodic theorems (see [5] for textbook exposition). However, we are only concerned with finite-time dynamics here, since GMs considered here are only defined for 0 S S
By definition, the least stable Lyapunov subspace is aligned with the most sensitive directions of (infinitesimal) perturbations in the dynamics. In Figure 2 we illustrate the two Lyapunov vectors (two -inddmmnniionll Lyapunov subspaces) computed along a two-dimensional sample path (in blue). Here the data manifold (the support of the data distribution) is a one-dimensions curve shown in red. For more details on this experiment, including Pdata, which is singular here, we refer the reader to Appendix G.2 The leading/least stable Lyapunov vector is shown in green, and interestingly. it appears tangent the data manifold. Intuitively, this means that the direction where most errors will result along the sample path is aligned with the data manifold. In other words, the direction of the most stable Lyapunov vector, where any error made along the sample path decays quickest, is away from the data manifold. This means that the sample path is attracted to the data manifold, even under (small) errors. We formalize this intuition the proposition below for convergent generative models
34
5

---

For now, assume that the support of Pdata is a compact d- d-dimensional subset of IR', which d < D. On the boundary of the support of the data (target) distribution, intuitively, the score is orthogonal to the support. This is because Pdata is zero outside of the data manifold, and non-zero on it; thus the gradient log or score points in the direction of this sharp change in Pdata- We will define bubustness-consisteeee
as the condition where the least stable d-dimensional Lyapunov subspace is orthogonal to the score. When the target score has a small (or zero) component along the least stable Lyapunov subspace, this means that the langent directions most sensitive to perturbations are along the data manifold (as in the example in Figure 2. In this section, we give sufficient conditions for the robustness coneesseenn of sample paths. We will show how this improves understanding of why some generative models are robust. Moreover, we will provide a computable criterion for verifying the robustness of a given generative model. Before this, we first describe the most sensitive subspaces or constructive approximations of the least stable Lyapunov subspaces of the tangent spaces associated with sample paths.
qualitative
Most sensitive subspaces. Let {ar) } be a fixed sample path (trajectory) of the generative model F When we have exact generative model, if zo po. then I, ~ Pdata Recall that the set M E RD is the support of Piataa and the effective dimension of the support is d <= D. We define Eig to be a randomly chosen d dimensional subbundle (a D x d orthogonal matrix at each 2)). We can consider the orthogonal decomposition of T2 M (which is isomorphic to I to be Tæ M = Ed (xg) @ Eg (zo). Now, the evolution of these subspaces under the time- demendenn Jacobian matrix field, dF,, gives the tangent dynamics: d.F, Ex = E R2 By construction, since EX+1 (z) at each x is orthogonal, the above tangent equation is simply a QR decomposition of the D x d matrix dF' Et The diagonal elements of R, represent stretching or contraction factors under the linearization dFc. We refer to Et constructed this way the most sensitive subbundle because as t + oc, this converges to the top d- d-dimensional Oseledets subbundle (backward Lyapunov vector bundle). See Appendix (A]
Proposition 4.1. |Predicting the support with convergent and aligned generative models.] For any 5 > O, let eo >> O be such that a convergent generative model (see Appendix DD. F", produces samples, {yk J. E [m]] such that with probubility 2 6/2 over the generated samples, [[T(y:) Pdata. Additionally, let F be such that the most sensitive d-dimensional subspace of the tangent space, (x).. spans T,0M with probability 2 1 1-8/2. Then, for some e > 0, there exists a binary function f: R + {+1, -1} such that, Ex-pane 1 f<v(2) S en-1 cnoloog n +
yall S ED and T(y))
n log(n?) /28), with probability 5. 8.
Proof: (Sketch) Given n predicted samples, Yi, let = T(ys) ~ Pdata be samples from Pdata obtained by applying the I o.ptott transport map. Let f(x) = sgn(w: .(x) + b) be a one-class kemnl-baased classifier trained on T;, E [r]] Then, f satisfies the margin-based generalization bounds (see e.g., Theorem 3 of [58]; [49] in the statement the proposition. By assumption, with probability 2 1 8/2, we have, since the samples yi are of the form, y/- = xi + eou;, where E T,0M, the predictions [yx) = (xx,) and therefore the confidence margin of f does not change Taking union bound, we obtain the result, with O[L/margin) See Appendix D elaboration.
The above lemma therefore says that the alignment with the data manifold of the least stable directions crucial for robustness of the support, as defined in section 3 We formally define this alignment as follows.
Definition 4.2. We say that a generative model Fr has the alignment property if, (x),, the top d d-dimensional Lyapumov subspace (spanned by the top d least stable Lyapunov vectors) is orthogonal to the target score, s, (z:), at each x E aM, the boundary of the support of py.
First, we provide some intuition for the definition of alignment. We claim that robust predicted distribution (in the sense of robustness of the support) has a highly anisotropic score near the data manifold (the true support of the target). More precisely, for a robust distribution, the score components along the data manifold are smaller than the components normal to it. Thus, it is reasonable to conclude that when a robust distribution shows such an anisotropicity along EK @ ExL, the most sensitive directions Ed are aligned with (the tangent bundle along) the data manifold. Before we state our main result, which provides a sufficient characterization of generative models that have the alignment property, we define anisotropic derivatives.
Tangent and normal derivatives. We consider the orthogonal decomposition of the vector field (drift term) Dn on the tangent bundle DB Edd @ EdL That is, we write u, (x)) (=) +

---

4
10 B1.4100
-12
-16-
-18 200 400 600 800
Figure 3: Top row (Column 1): noise image from source distribution. (Column 2): an MNIST 19
digit generated by a score-based generative model. See Appendix[Gi for training details. (Column 3): generated image corrupted by the most sensitive Lyapunov vector. See Appendix A for details on the computation of these vectors. (Column 4): generated image corrupted by the 100th most sensitive LV at the same noise level. This shows that moving along very stable LVs, for indices greater than the intrinsic dimension, results in leaving the data manifold. Bottom row: finite time Lyapunov exponents associated with the generating process in an SGM, with small gap at index close to the intrinsic dimension, signifying superstability off the data manifold.
(1) (I), defining the components, (r,a(x) E (x));(x) Rd and Vt (x) ELLT (x) E RDDd of the vector (I)).. Let Vi, indicate the differential "along the subspace Ed i.e., Ve,a(() (z) [f (())))
limm. (
where (x) is the ith column of EÇ The differential, Vt,a_ is defined similarly as the directional derivatives along the subspace EdL Finally, we also define the contraction factors == R, ol and B. = |F,, Ed >0. where the co norm over the scalar field is the supremum over I E M. By definition, 2 a 2 Be, all
Theorem 4.3. [Alignment of generative models.] Let M C. RD be the compact set where the target distribution Pdata is supported. When the support M of the target is d-dimensional manifold with d S D, for an exact generative model that is compressive, the alignment property holds under the following conditions: for some E (0, 1), there exists a time t" [0. such that
( IIrsner On 2 (1 + S) 2 t"; ii) [[[dd + ôt Vi.V"e.) Ptaall S //((t),, for all
t E [t", T); and, ûi) the cross derivatives V',,l, l (/V,,a as O. for t [t", Intuitively this means that the generating dynamics may include an expansive phase and the vector field is uniform "attracting force" at the end.
Proof. Recall the covariance of Ey in the sense that dFFEE, E Rr, where R, is upper triangular matrix in d dimensions. At each time t, for some 8, > O, we choose local coordinates d--neighborhood of such that 2; maps to 0 in RD and Ey maps to the standard basis of Rd under the differential. If M is a smooth embedding in RD we may define derivatives of all orders of these local coordinates. We now analyze the behavior of the Jacobian d.F, and the score vector field, 8, the two distinct phases of the dynamics: for f < t" and at the end, when > t*. In local 8t V Vr,a at,
coordinates, we have, (zF( ld òt V,,av,,((x)
Id + & (x) Now, to analyze the behavior of the scores, 8t, consider the change of variables formula for probability densities. Differentiating after taking the logarithm of the change of variables for probability densities, we have that sc+1 1 ) (dFF))(F((z)))) tr(dF((I))) F(F We now define
öt Vi.aVi,d1
7

---

the evolution of the score components along E Using the covariance of E,, we get,
(se+1 1 - E R₁" tr((dr,'' R,
Since Edd is covariant, we may interpret (3) as an operator acting on score component functions, 814 (+1: (d-dimensional row vectors at each x) each time,
o = R we E R
RR. At the start, since Eg is random, we may assume that p is zero vector field. Since the dynamics is compressive overall, mingg- < 1, and further, II. a, < 1. However, at small t, the vector field Eg is random, and by assumption, U/ is uniformly contractive in all directions. Thus, d= has a small norm. Thus, we assume that ||w, || S c öt. Thus, in the starting phase we have, Eisr- I| E, R. ... R I ct 5t Ills. 0 Then, from (i)-(ii), |/u, Flll S 55/((-t) öt, (see Appendix E for any t", and so, 1, R, .... RR, < öt (1((=-)) (1 5) Now, applying recursively, we obtain that (g) F'I = [0]] = Eisr Wi E R₁," R771 ... R S ct öt Ilesr ar"
where, for convenience, we have defined, (x) = tr((dFF(tt)'dd
-H öt 01 Eisr 81((--() (1 - ((t)..
Implications for manifold learning. The above theorem outlines sufficient conditions for the align- ment of the most sensitive directions with the data manifold. There are two important consequences of this result. First, for an aligned and convergent generative model, we expect that any small learning errors in 1/2 will result in probability mass redistributed on approximately the same support. In other words, the predicted density will have the approximately the same support the target, since the directions orthogonal to the support are superstable (very large tinite-time LEs). This is observed in Figure where a generated digit (second column) is perturbed in the direction of the 1st LV (3rd column) to obtain another recognizable digit. On the other hand, when the 100th LV (shown in the 4th column of Figure 33) is added, obtain artifacts that represent leaving the data manifold. In practice, the Lyapunov vectors may be computed using standard algorithms akin to iterative algorithms for eigenvectors (see [20 7 ). Thus, an aligned generative model can effectively be used compute the tangent bundle of the data manifold. In other words, an aligned generative model can learn the data manifold with the same sample complexity as the generative model, which is stronger than thought in previous works [54 47). which have only shown that generative models learn the dimension of the manifold.
Regularity of alignment. Secondly, the alignment property itself is robust, i.c., when a generating process has the alignment property, under small perturbations, this property is retained, as we show next. This implies that, even an approximate generating process can be used for manifold learning.
Lemma 4.4. The alignment property is regular.
Proof. Let F be a continuously differentiable generating process (i.e., F (M) for which alignment holds. Now, consider a sequence c - 0, as h - 00, and a sequence of C' generating processes, F7. that converge Fg in the C¹ norm. Let FgJ be differentiable (on some open set containing M in RDD). Starting with the same Ei we may define the most sensitive subspaces, Edd for each map FT,, as per the construction in this section. Then, from the continuity of d.FT, the covariance of E& and the continuity of Rd (see Appendix F each element of the sequence E is locally continuous (we need to also assume the non-degeneracy of the stretchiggcooppresioon factors, Appendix F). Since M is compact, from the Aizela-Ascoll theorem, contains a converging subsequence, which retains the alignment property.
conclude that Ed
Justification for sufficient conditions. We now describe the type of dynamics of the generating process that would satisfy the sufficient conditions in the theorem above. In the beginning, in the absence of information about the target score, the vector field 12 could be uniformly compressive, e.g.. in an SGM with the source density being nearly a Gaussian 47 [6]. Then, as information about the target is used, the score acquires an anisotropic behavior, and our sufficient conditions imply that correspondingly anisotropicity in the vector field must be such that the vector field has small cross-derivatives. That is,
anisotropicity must emerge in the vector field as well. Further, this
while V Ur and V Vidd. Ve can have large norms, the cross-derivation Vi Vt, and V Vi,
8

---

must be negligible at the end. An SGM typically satisfies this condition, as one can visually see in Figure In the leftmost image in Figure which represents an intermediate time, the score vector field (which is equivalent to 14 in an SGM) appears to stretch/compress differential volumes (i.e., it is anisotropic), while at the end (second image in Figure D. there very large compression toward the data manifold (the two moons) and the cross-derivatives (in local coordinates) are evidently small. The large compression toward the data manifold has been described from many perspectives before: 13 [6] use Fourier analysis, [47] uses stochastic analysis, [54] 41) take the statistical learning and uncertainty quantification perspective. Consistent with these results, our sufficient conditions (Theorem 4.3), when applied to SGMs, imply that the attraction/comppessioo in volumes normal to the data manifold leads to robustness of the support. Notice that under this attraction condition, and (i)- of Theorem 4.3
cannot control the norm of the orthogonal component of the score, 8, F This is due to two self-reinforcing effects: the compression factor matrices along Ey have smaller norm and hence a larger inverse compared to R4. Secondly, the components of wi do not become small along E because the vector field may have non-negligible second derivatives, V2 i,d1 Vt d (one can observe this visually for an SGM in the second column of Figure I
Remark 4.5 (Without the expansion assumption (i)). If min, a₁ > 1, notice that G, o Fe in the proof above is linear contraction in Rd. In this case as well, the score component along FX decreases and becomes negligible. However, in practice, generating processes are compressive dynamics, as they acquire more information about the score when increases. Hence, we allow expansion for some part of the dynamics but assume compression overall. We need not assume any expansion at all, if an observed phase transition 1 occurs, wherein F, becomes linear for t > t", which case, wy the zero vector field.
5 Related Work
Tremendous progress has been achieved in the past few years to explain the empirical success of generative models. Several works, such as 115 12 34
35 [0 have established theoretical guarantees for the convergence of diffusion models under different metrics (such as Wasserstein, reverse KI, total variation), including proving that they achieve minimax rates for learning the target 43,, without demanding any functional inequalities (log-concavity) of the target. We do not tackle the question of generalization convergence in this paper; instead, for small perturbations of generative models that indeed converge, we focus on the related but different question of when the predicted support is still close to the support of the target. Since our approach is dynamical, it applies to any other path on probability space that leads to the target. Hence, our analysis also applies to normalizing flows 45 [46] and flow matching variants 37 56), which can be interpreted as easier-to-train models with
specified probability paths.
Our sufficient conditions in Theorem 4.3 are consistent with observations made from several different angles on the generative process. For instance, (36) finds the emergence of linear behavior when the diffusion model starts to generalize. which is consistent with second derivatives of the vector field being small. Other works such as [ 62) study phase transitions in the dynamics or regularization effects [6] that leads to generalization.
which suggest the robustness of the support in cassed generative models in the context of the manifold hypothesis
Our work most closely inspired by analyses and empirical evidence in 47 13
48 Here, we analyze the dynamics of the reverse process in a way that applies even non- singular distributions. Further, our splitting in the Lyapunov directions suggests that there is more quantitative geometric information the generating process about the data manifold beyond just the data dimension 55. Although we do not focus on the unboundedness of the score (since our analysis applics also to targets with density) [47] (3). our results are consistent with unbounded score components along Ed+, normal to the data manifold (see section 4). We remark that finite-time Lyapunov analysis has been classically used for perturbation analysis of fluid flows in the geophysical fluids literature [50 21 B3). The eigenvectors of the Cauchy-Gredd deformation tensor, which in our notation is dF d are our Lyapunov vectors; in fluids, these have been used to understand the deformation in the current velocity field due to perturbationss/trainn in the past. Interestingly. the application of this analysis technique to generative modeling reveals insight into stability to errors in probability flow ODEs.
Finally, even though we not explicitly discuss class-conditional generation and guided diffusions 660 24 our work can potentially guide algorithms for learning projected scores or diffusions

---

Our results establish theoretical foundation for such projections of the vector field by uncovering the connection between the dynamics and the directions where accurate learning of the vector field is not necessary.
a pewer-dimensions latent space [27 9
6 Numerical Results
Apart from the two-moons example we show in Figure I we collect many other two-dimensional examples that help with visualizing the vector field and the sufficient conditions in Theorem 4.3 In Appendix G.3] we give an example of a non-robust generating process. We observe that when using flow-matching [7 56], with source density being the 8 Gaussian density, do not have the robustness property (see Appendix G.5 for more details, including the Lyapunov vector field). Among high-dimensional examples, consider MNIST digit generation in Figure B but further examples are deferred G Using a pretrained model from a score-generative model repository [Github link]] we find that adding perturbations of even large norm (when compared the supremum norm over the pixel values) leads to high-quality images with comparable likelihood scores. Thus, consistent with observations in 47 we find that SGMs satisfy the robustness property. Finally, we describe an empirical observation that qualitatively confirms our manifold learning results from section 4 For an aligned generative model like the MNIST SGM (see Appendix G.3 for training details), we find that the Lyapunov exponents also provide geometric insight into the data manifold. A small gap arises in the LEs (Figure Bottom) at an index consistent with previous estimates of the effective dimension of the MNIST data distribution [48. Beyond index (20)) the LEs along the more stable directions appear to be continuous, while the top LEs are degenerate, depicting the deformmations/pettbbattoos of the most sensitive subspace of the underlying feature space.
7 Conclusion and limitations
Overall, we study the robustness of the support of the density predicted by generative model, when the underlying vector field (score/drift) is learned with errors. Our results suggest that the tangent spaces of the support being aligned with the most sensitive Lyapunov subspaces leads to robustness (Proposition 4.1 and Theorem 4.3) Since the Lyapunov vectors are efficient compute, aligned generative models can be used for manifold learning. The computation of LVs can also help us quantitatively distinguish between generative models based their robustness property. Our proof techniques involve novel combination of statistical learning with the finite-time perturbation theory of non-autonomous dynamical systems, which could be independently applicable in other settings. Here are some specific practical impacts of our results.
Preserving invariances: for singular targets in science, the support is often defined by some invariances (conservation laws) and group symmetries. Our results imply that ensuring alignment yields predicted targets that obey these known physical laws.
Controlling GMs: the most sensitive subspaces we introduce in this work can help design controllers for generative models to bias the target distribution for downstream applications, such as rare event sampling or unlearning- While we defer the details to future work, consider a vector field, uy- representing a control neural network. Given orbit, say, Z1, that leads to an unwanted sample at time T, our goal will be to train We such that 2, + (x(x is a desired orbit. To do this in reduced dimensions, we only need to determine the components Ey in the most sensitive directions.
The wider implication of our results is that the theory of dynamical systems (including perturbation theory and the operator theoretic view) can advance our understanding of as well provide principled algorithmic improvements to generative modeling and more broadly of probability flow dynamics.
Limitations. We only provide sufficient condition and not necessary condition for alignment and hence robustness. More extensive experimentation with various different generative models needed to determine the most common scenario where alignment occurs. More advanced and extensive experiments are also needed to understand the prevalence of alignment and therefore robustness in practice. Further, method of detecting tangent spaces of the data manifold hinges there being alignment and our results do not explicitly reveal insight into memorization.
10

---

References
[1] Beatrice Achilli, Enrico Ventura, Gianluigi Silvestri, Bao Pham, Gabriel Raya, Dmitry Krotov, Carlo Lucibello, and Luca Ambrogioni. Losing dimensions: Geometric memorization in generative diffusion, 2024. URLhttps://arxii http:////axxxxv..oaabb/ wtg//ba////////// /410
[2] Michael S Albergo and Eric Vanden-Fijnden Building normalizing flows with stochastic interpolants. arXiv preprint arXiv:2209. 15571, 2022.
[3] Michael S Albergo, Nicholas M Boffi, and Eric Ganden-Eijndes Stochastic interpolants: A unifying framework for flows and diffusions. arXiv preprint arXiv:2303.0879) 2023.
[4] Brian DO Anderson. Reverse-time diffusion equation models. Stochastic Processes and their Applications, 12(3):313-2) 1982.
[5] Ludwig Amold, Christopher KRT Jones, Konstantin Mischaikow, Geneviève Raugel, and Ludwig Amold. Random dynamical systems. Springer, 1995.
[6] Ricardo Baptista, Agnimitra Dasgupta, Nikola Kovachki, Assad Oberai, and Andrew M Stuart. Memorization and regularization in generative diffusion models. arXiv preprint arXiv:2501.15785. 2025.
[7] Giancarlo Benettin, Luigi Galgani, Antonio Giorgilli, and Jean-Maric Strelcyn. Lyapunov characteristic exponents for smooth dynamical systems and for hamiltonian systems; a method for computing all of them. part 1: Theory. Meccanica, 15:9-20, 1980.
[8] Giulio Biroli, Tony Bonnaire, Valentin De Bortoli, and Marc Mézard. Dynamical regimes of diffusion models. Nature Communications, 15(1) ):957, 2024.
[9] Andreas Blattmann, Robin Rombach, Huan Ling, Tim Dockhorn, Seung Wook Kim, Sanja Fidler, and Karsten Kreis. Align your latents: High-resolution video synthesis with latent diffusion models. In Proceedingy of the IEEF/CVF Conference on Computer Vision and Puttern Recognition (CVPR), pages 02563-22574, June 2023.
[10] Valentin De Bortoli. Convergence of denoising diffusion models under the manifold hypothesis, //arxiv...ivvoo// org/ brgg/bb///// abs/2208 05314
2023.
[11] Valentin De Bortoli, Emile Mathicu, Michael Hutchinson, James Thornton, Yee Whye Tch, and Arnaud Doucet. Riemannian score-based generative modelling, 2022. URL https
/arxiv.orgg// abs/ 2ttp//222.02663
[12] Hongrui Chen, Holden Lee, and Jianfeng Lu. Improved analysis of score-based generative modeling: User-friendly bounds under minimal smoothness assumptions. In Andreas Krause, Emma Brunskill, Kyunghyun Cho, Barbara Engelhardt, Sivan Sabato, and Jonathan Scarlett, editors, Proceedings of the 40th International Conference Machine Learning, volume 202 of Proceedings of Machine Learning Research, pages 4735-4765 PMLR, 23-29 Jul 2023. URL attps://proceeediggs mlr press/ v202/ chen23q html
[13] Minshuo Chen, Kaixuan Huang, Tuo Zhao, and Mengdi Wang. Score approximation, estimation and distribution recovery of diffusion models on low-dimensional data. In International Conference Machine Learning, pages 4672-4712. PMLR, 2023.
[14] Ricky TQ Chen, Yulia Rubanova, Jesse Bettencourt, and David K Duvenaud. Neural ordinary differential equations. Advances in neural information processing systems, 31, 2018.
[15] Sitan Chen, Sinho Chewi, Jerry Li, Yuanzhi Li, Adil Salim, and Anru R Zhang. Sampling is as easy learning the score: theory for diffusion models with minimal data assumptions. arXiv preprint 2rXiv:2209.112111 2022.
[16] Sitan Chen, Sinho Chewi, Holden Lee, Yuanzhi Li, Jianfeng Lu, and Adil Salim. The probability flow ode is provably fast. Advances in Neural Information Processing Systems, 36:68552-68575, 2023.
[17] Valentin De Bortoli. Convergence of denoising diffusion models under the manifold hypothesis. arXiv preprint 2xXiv:2008.05314, 2022.

---

[18] Valentin De Bortoli, James Thortoo,, Jeremy Heng, and Arnaud Doucet. Diffusion schrödinger bridge with applications score- score-based generative modeling. Advances in Neural Information Processing Systems, 34:17695-17709 2021.
[19] Li Deng. The mnist database of handwritten digit images for machine learning research. IEEE Signal Processing Magazine, 29(6):141-14,, 2012.
[20] Francesco Ginelli, Pictro Poggi, Alessio Turchi, Hugues Chaté, Roberto Livi, and Antonio Politi. Characterizing dynamics with covariant Iyapunov vectors. Physical review letters, 99 113):130601, 2007.
[21] George Haller and Guocheng Yuan. Lagrangian coherent structures and mixing in two- dimensional turbulence. Physica D: Nonlinear Phenomena, 147(3-4):352-370) 2000.
[22] UIrich G Haussmann and Etienne Pardoux. Time reversal of diffusions. The Annals of Probability, pages 1188-1205, 1986.
[23] Desmond Higham, Xuerong Mao, and Andrew M Stuart. Strong convergence of euler-type methods for nonlinear stochastic differential equations. SIAM journal on numerical analysis, 40(3):0441-103,, 2002.
[24] Jonathan Ho and Tim Salimans. Classifier-free diffusion guidance. vrXi::2207.12598, 2022.
arXiv preprint
[25] Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models, 2020.
URI /tl.:tttt:://xxi.orrrr wwwp:/vw...r//////o//o/ 11239
[26] Zahra Kadkhodaie, Florentin Guth, Bero P. Simoncelli, and Stéphane Mallat. Generalization in diffusion models arises from coometry-addative harmonic representations, 2024. URL
fttps://arxxv..rr//appa
[27] Zahra Kadkhodaie, Stéphane Mallat, and Eero P. Simoncelli. Feature-guided score diffusion for sampling conditional densities, 2024. URL
[28] Anatole Katok and Boris Hasselblatt. Introduction to the Modern Theory of Dynamical Systems. Encyclopedia of Mathematics and its Applications. Cambridge University Press, 1995.
[29] Yuri Kifer. Ergodic theory of random transformations, volume 10. Springer Science & Business Media, 2012.
[30] Hiroshi Kunita. Stochastic differential equations based on lévy processes and stochastic flows of diffeomorphisms. In Real and Stochastic Analysis: New Perspectives, pages 305-373. Springer, 2004.
[31] Hiroshi Kunita and Hiroshi Kunita. Stochastic flows and stochastic differential equations, volume 24. Cambridge university press, 1990.
[32] Pavel V Kuptsov and Ulrich Parlitz. Theory and computation of covariant lyapunov vectors. Journal of nonlinear science, 22:727-762, 2012.
[33] Guillaume Lapeyre. Characterization of finite-time lyapunov exponents and vectors two- dimensional turbulence. Chaos: An Interdisciplinary Journal of Nonlinear Science, 12(3): 688-698, 2002.
[34] Holden Lee, Jianfeng Lu, and Yixin Tan. Convergence of score-based generative modeling for general data distributions. In International Conference Algorithmic Learning Theory, pages 946-985, PMLR, 2023.
[35] Gen Li, Yuting Wei, Yuejie Chi, and Yuxin Chen. A sharp convergence theory for the probability flow odes of diffusion models, 2024. URL httpp::/aarivvorg///aa wwwp/////bb//aoooo 02320
12

---

[36] Xiang Li, Yixiang Dai, and Qing Qu Understanding generalizability of diffusion mod- els requires rethinking the hidden gaussian structure. In A. Globerson, L. Mackey, D. Belgrave, A. Fan, U. Paquet, J. Tomezak, and C. Zhang. editors, Advances in Neu- ral Information Processing Systems, volume 37, pages 57499-57533. Curran Associates, Inc., 2024. htR.httts://prrceeddnng neurips.. cc/ ww/paper__a. fnrerrrfilsss files/ wallee/pane htsp/ppee//2/////eeeee 9966611cccd80004444beceeee11f5f Paw.ree-ee--pppeer--oeeeeeeeeeee
pdf
[37] Yaron Lipman, Ricky T. Q. Chen, Heli Ben-Hamu, Maximilian Nickel, and Matthew Le. Flow matching for generative modeling- In The Eleventh International Conference on Learning Representations, 2023. URL
www.::eee.forreiee Pd=PqvMRDC
[38] Xingchao Liu, Chengyue Gong, and qiang liu. Flow straight and fast: Learning to generate and transfer data with rectified flow. In The Eleventh International Conference on Learning Representations, 2023. URL URL
nett/forun?ddxX//TTinaa
[39] Yubin Lu, Zhongjian Wang, and Guillaume Bal. Mathematical analysis of singularities in the diffusion model under the submanifold assumption, 2024. jtttps://////x org. org/ abs/
07882
[40] Morteza Mardani, Noah Brenowitz, Yair Cohen, Jaideep Pathak, Chieh-Yu Chen, Cheng- -hhn Liu, Arash Vahdat, Mohammad Amin Nabian, Tao Ge, Akshay Subramaniam, et al. Residual corrective diffusion modeling for km-scale atmospheric downscaling. Communications Earth & Environment, 6(1):124, 2025.
[41] Nikiforos Mimikos-Stamin Stamatopollos, Benjamin Zhang, and Markos A. Katsoulakis. Score- based generative models are provably robust: an uncertainty quantification perspective. In A. Globerson, L. Mackey, D. Belgrave, Fan, U. Paquet, Tomezak, and C. Zhang, editors, Advances in Neural Information Processing Systems, volume 37, pages 63154-633 63143.3183.. Curran Associates, Inc., 2024. URL /tt/sstps//prrreeeddngg mew.:eeedddinneneneeeppeeeeeeeee neurips......e wwtppper_cilleeeeeeeeeeeeeeeeeee fitpaper_fflleeppperrr http:///eaaappeeoopppeeeee////pa
20007//1111772124444444000002060 Cow.pppeeeroooeeeeeeeeee pdf
[42] Alex Nichol and Prafulla Dhariwal. Improved denoising diffusion probabilistic models, 2021. URL htttttttp//axii org/
09672
[43] Kazusato Oko, Shunta Akiyama, and Taiji Suzuki. Diffusion models are minimax optimal distribution estimators. In International Conference on Machine Learning, pages 26517-26582.
PMLR, 2023.
[44] Bernt Øksendal and Bernt Øksendal. Stochastic differential equations. Springer, 2003.
[45] Derek Onken, Samy Wu Fung, Xingjian Li, and Lars Ruthotto. Ot-flow: Fast and accurate continuous normalizing flows via optimal transport. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pages 9223 0223-9232, 2021.
[46] George Papamakarios, Eric Nalisnick, Danilo Jimenez Rezende, Shakir Mohamed, and Balaji Lakshminarayanan. Normalizing flows for probabilistic modeling and inference. Journal of Machine Learning Research, 22(57): 2021.
[47] Jakiw Pidstrigach. Score-based generative models detect manifolds. Advances in Neural Information Processing Systems, 35:35852-35865, 2022.
[48] Phil Pope, Chen Zhu, Ahmed Abdelkader, Micah Goldblum, and Tom Goldstein. The intrinsic dimension of images and its impact on learning. In International Conference on Learning Representations, 2021. URL htttps://peenrevie: wttp:/enrrweieeeee/oorreeereeeee
[49] Bernhard Schölkopf, John C Platt, John Shawe- Taylor, Alex Smola, and Robert C Williamson. Estimating the support of high-dimensional distribution. Neural computation, 13(7):1443, 1471, 2001.
[50] Shawn C Shadden, Francois Lekien, and Jerrold E Marsden. Definition and properties of la- grangian coherent structures from finite-time Iyapunov exponents two-dimensional aperiodic flows. Physica D: Nonlinear Phenomena, 212(3-4):271-304, 2005.
13

---

[51] Jascha Sohl- Sil--Dicsttei, Eric Weiss, Niru Maheswaranathan, and Surya Ganguli. Deep unsuper- vised learning using nonequilibrium thermodynamics. In International conference on machine learning, pages 2256-2265. pmlr, 2015.
[52] Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. arXiv preprint arXfv:2011.13356 2020.
[53] Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. In International Conference on Learning Representations, 2021. URL (RLL,ttts:/// hnttps://ppenreiiee
het//forum//ddPXXIII1IRRRR
[54] Jan Pawel Stanczuk, Georgios Batzolis, Teo Deveney, and Carola- Schönlieb. Diffusion models encode the intrinsic dimension of data manifolds. In Forty-first International Conference on Machine Learning, 2024. URL https::////pp evie. net aot.forurmld-a000AA661 a0xiA6v256
[55] Yifeng Tian, Nishant Panda, and Yen Ting Lin. Liouville flow importance sampler. In Forty-first International Conference on Machine Learning, 2024. URL https://openreviex net/
forum?i DOrumP/d=OMKNBZF6HH
[56] Alexander Tong, Kilian FATRAS, Nikolay Malkin, Guillaume Huguet, Yanlei Zhang, Jarrid Rector-Brooks, Guy Wolf, and Yoshua Bengio. Improving and generalizing flow-based genera- tive models with minibatch optimal transport. Transactions Machine Learning Research, Expert
2024. ISSN 2835-8856. URL Certification.
[57] Alexander Tong, Nikolay Malkin, Kilian Fatras, Lazar Atanackovic, Yanlei Zhang, Guillaume Huguet, Guy Wolf, and Yoshua Bengio. Simulation-fres free Schrödinger bridges via score and flow matching. In Sanjoy Dasgupta, Stephan Mandt, and Yingzhen Li, editors, Proceedings The 27th International Conference on Artificial Intelligence and Statistics, volume 238 of Proceedings of Machine Leurning Research, pages 1279-1287. PMLR, 02-04 May 2024. URL nttps://proceedingg mlr press/ v2tps//vv8//ee8 20233//togg244 html
[58] Régis Vert, Jean- jean-Philippe Vert, and Bernhard Schölkopf. Consistency and convergence rates of one-class svms and related algorithms. Journal of Machine Learning Research, 7(5), 2006.
[59] Phil Wang. denoising--diffusion----eee -oytooh.c....h.....oo..
https: htaps:///githbbe wtt.:huwb..oomuuuuddiiia.tt.. 2024. Accessed: 2025-05-16.
denoising htwphannddifffff---yoooooooooooo
[60] Ling Yang. Zhilong Zhang, Yang Song. Shenda Hong. Runsheng Xu, Yue Zhao, Wentao Zhang. Bin Cui, and Ming-Hsuan Yang. Diffusion models: A comprehensive survey of methods and applications. ACM Computing Surveys, 56(4):1-39, 2023.
[61] Cagatay Yildiz, Markus Heinonen, and Harri Lahdesmaki. Ode2vae: Deep generative second order odes with bayesian neural networks. Advances in Neural Information Processing Systems,
32, 2019.
[62] Huijie Zhang, Jinfan Zhou, Yifu Lu, Minzhe Guo, Peng Wang, Liyue Shen, and Qing Qu The emergence of reproducibility and generalizability in diffusion models. arXiv preprint 10..5223/0.05264, 2023.
14

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: Claims made in the abstract and the motivating questions in the introduction are precisely those addressed the main body of the paper.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification:
Our limitations are discussed at the end of section 7
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g.. independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
the paper. The authors should use their best
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
15

---

Justification: any assumption or proof step that was too long for the main paper is placed in its own appendix section and referenced. Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
The code necessary to replicate the low dimensional results does not require any training, and is included in the supplementary material.
Justification:
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of large language model), releasing of a model checkpoint, or other means that appropriate to the research performed.
While NeurlPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
16

---

Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [Yes]
Justification: We do not provide any new datasets. Access to the code that reproduces the figures provided in the supplementary material.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips... cc/
for more details.
While encourage the release of code and data, we understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing much information possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (c.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
The low dimensional computations are via numerical methods and not need neural network training. The MNIST training and architecture is described in the supplement.
Justification:
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to a level of detail that is necessary appreciate the results and make sense of them.
The full details can provided either with the code, appendix, or as supplemental material.
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [Yes]
Justification: our paper does not perform statistical tests, but probability distributions and uncertainty estimates are shown accurately.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by emoo bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
17

---

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
OK to report 1-sigma error bars, but one should state The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that out of range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Question:
Answer: [Yes]
Justification: Training and architecture details are provided in appendix Experiments were performed on available hardware.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't 't make it into the paper).
9. Code of ethics
Question: Does the research conducted the paper conform, in every respect, with the NeurlPS Code of Ethics htttpp////aarrrge..cc/o////l/lla
Answer: [Yes]
Justification: Since this a theoretical study on the behavior of generative models under perturbation, methods cannot be directly used to cause harm.
Guidelines:
The answer NA means that the authors have not reviewed the NeurlPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (c.g.. if there special consid- eration due to laws or regulations in their jurisdiction..
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [NA]
This a theoretical study of the behavior of generative models. This paper aims to further our understanding of the dynamics of generative modeling. Our results impacts society only indirectly, through the potential improvements that follow as result of our understanding.
Justification:
18

---

Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no societal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considcrations.
The conference expects that many papers will be foundational research and tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning conrectly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper deseribe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: Our code only serves to justify the theory and our models are only trained on benchmark datasets. We do not foresee it used in dangerous manner.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model. for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: All datasets and codes cited and used in accordance their license agreements.
Guidelines:
The answer NA means that the paper does not existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, possible, include URL.
19

---

The name of the license (e.g., CC-BY 4.0) should be included for each asset. For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
assets are released, the license, copyright information, and terms use in the package should be provided. For popular datasets, paperssi thoode com comddatasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided. If this information is not available online, the authors are encouraged to reach out to the asset's 's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: the datasets generated and the code for computing Lyapunov vectors is included in the supplementary material.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification:
This study does not involve human subjects.
Guidelines:
The answer NA means that the paper does involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based the requirements of your country institution) were obtained?
Answer: [NA]
Justification: This is not study with human participants.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
20

---

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if' applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Does the paper describe the usage of LLMs if is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, originality of the research, declaration is not required.
Question:
Answer: [NA]
Justification: LLMs were sometimes used superficially, to understand technical concepts, and generate standard implementation.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, non-standard components.
Please refer to our LLM policy (https://neurl)) (ttrge///eerrpp.ccc///fffeeeeeee /c///oofeeeenees//225////.. for what should or should not be described.
21

---

A Background on the random dynamical systems view of diffusion models
In the main text, we define the generating process of any generative modeling algorithm random dynamical system. In particular, dynamical generative models like normalizing flow, rectified flow, conditional flow matching-variante stochastic interpolants [46] 37
38 etc can be viewed as nonautonomous (forced in time-dependent manner) and deterministic d dynamical system. On the
36
other hand, diffusion models or score-based generative models [8 60 TO 12 52 have stochastic
generating processes (reverse or denoising process). However, in the main text, we argued that, for the purpose of analyzing the probability flow, we may ignore the noise in the reverse process. and thus, also consider SGMs to be nonautonomous but deterministic systems. Here, we present more general dynamical systems definition applicable both deterministic and stochastic nonautnomous systems. These, so-called random dynamical systems have been classically studied as part of dynamical systems theory, while undergoing parallel development in the probability and stochastic analysis communities (see e.g.. [5] and [3]] for textbook expositions of random dynamical systems from the dynamical systems/ergodic theory and probabliisiccssochasiii analysis perspectives respectively).
The unifying random dynamical systems framework to represent generative models is as follows. Consider an instance of a time-discretized Wiener path, = = {En,- Er-I), where &, are indepen- dent standard normal variables. These provide stochastic forcing to the dynamics .FF, at time f. which is now extended with a superscript indicate a fixed noise path. For fixed noise, E. FT.S, is defined as composition (time r-dynamics) as expected, F = F o F 1,E with F0.5 Id, for all
Example: score-based diffusion [51 52 In score-based diffusion models, the generating process is an Ito process of the form: dX, fx,,, dt + dW,, where f. is deterministic score term that is represented as a neural network, and W, is a Wiener path/Brownian noise. Given a time- integration scheme for this stochastic process, we can define F',= as the stochastic flow over short time. For instance, using Euler-Maruyama time-integration with a fixed timestep, 51, we have
Xe+1 = X1 + (X,) öt + v öt &.. Then, [=(x)= := + (tr + Vōt &t. In summary, we view a stochastic generating process as a one-parameter family random diffeomorphisms, F.E for (almost) every time sampling. 3, of the underlying Brownian path. For the existence of this one-parameter family, we refer to classical works on stochastic flows [3 30). With this RDS view, the stochastic process (a continuous-state discrete-ting Markov chain) has a dime-dependent transition kernel that can now be written in terms of F as:
Po(X++ A|X, x) P(E: (F(x) A).
Substituting for (z)====+ (t)( + Vōt E.. and using the fact that & has a normal distribution, get, (A(r)) = JA 1alll---6tf ( dy for this example process. The usual equation for the evolution of the probability measures, say pe, is the Kolmogorov forward equation, which is given by,
(((Alx)ddu(=)= ( f /P(G :F((x) E A) dpr(z).
(5) On the right hand side of the above equation, notice the transition kernels written in terms of the RDS. Moreover, beyond Me, we can also define sequence of sample-path measures, nr, which are obtained for fixed Brownian paths via pushforwards or the Saabeniux-Perroo operator,
M++1(A) -
F 1 = 1o F. F
Since we start the process with X, Mo. we take ~ = 1oo for all paths E. We note that since Ho typically has a density (with respect Lebesgue Rd), say, Po; Pr as well the sample-path measures, Hi also have densities up to finite time, even when F is nol-ue preserving diffeomorphism. We denote these densities as Pt and of respectively corresponding to μ and uf. With the density pr defined, we can use the bhange-of-variable formula in 6 to obtain,
i CT
F o F..-1'
where we define L to be time-dependent linear operator that transforms densities through deterministic system. Combining with the Kolmogorov forward equation in (5), we also have,
Pe+1 (v) = P
(8)
22

---

provided Pu= = po: where we have used Eg to denote expectation with respect to the independent standard Gaussian RVs. = [Eo. -....... ---1
For a fixed noise E. the deterministic dynamics F is a coupling between Po and a noise path- dependent density f. i.e., Lr. pa = p.. Here, the operator C is called the FrobeniussPerron or transfer operator, which describes the evolution of probability densities through the map, FT. The Frobenius-Perron operator _T is also defined as a composition of per-iteration operators, which p = (p Avol,) o rē"", where Avol( = [det(dFF)l indicates the change of differential volume under the application of the map FT- Note that, since the noise E is independent of the state, Avol, is not function of E. In the standard stochastic analysis literature, we generally refer to Eg as the Kolmogorov forward operator, which is described in 5 when 14, are absolutely continuous with respect to Lebesgue. By definition, EzAf Pt = Pt+1- Classically, we may write, Pt+1 (x) = JMs Ky (2. y) Pe(y) dy, where K2 (z, y) is the conditional density of the transition kernel, Pey,, dr), which represents the conditional density of the state at time t + 1 being conditioned on the state at time & being y. This assumes the kernel is absolutely continuous in both arguments, which is typical for diffusion- models (e.g., the transition probability measure in (5) is absolutely continuous). When the target measure, H4, = Pdata is singular, making Pr undefined, the probability density Pr-a for a small A approximates notion of density associated with the target. For simplicity, Pr in this case should be interpreted as Pr-A, which is a convolution of the target measure, Pdata; with a Gaussian of variance A.
we denote by L so that LT = pê+1 Specifically, we define 4
A.1 Diffusion models
Our paper treats the reverse process of diffusion model as a random dynamical system. While we presented this view in the main text and the previous section, here we review the more standard view through SDEs. Diffusion models generate samples from an unknown target probability distribution P(R") from which only have access to samples. The general setup 52 is to consider diffusion process, which will be referred to as the forward process, that transforms the target into distribution that is easy sample from. Typically, the forward process is chosen from a class of processes
dx, - 3,X, dt + v 28,dB
Xo ~ T.
(9)
assumed that Be is positive and integrable such that the integral 1n B, ds + do as L + co. follows that (9) is time-rescaling of the standard Ornstein-Uhlenbed process, through the time =I' 3. ds and the marginals Pt converge geometrically
change of variables multivariate normal distribution N NO, ID) P(R Since (9) has linear drift, it follows that the solutions can be solved analytically, yielding the formula for the marginals in terms of the target pr(xr) = [x) Xo)] with the conditional density given by the kernel
the standard
px (200 = N (exD (-fo-
B. B.ds) wo: (1 (1-exp exp (-2 (-2/
Br do (=((Bd)))
TD) Im)
(10)
We note here that the above kernel is smooth in the space variable, implying the C smoothness for the marginals for all t > O.
The forward process is ergodic, with the marginals converging to the standard normal at rate cxp (-Jo 3, ds) After a finite large time T samples are assumed to be approximately normal. Once T is chosen, define the time-reversed process Y, == Xx- E (0, T). It is known ([22.
that Y, is Markov process and that it is a weak solution to the following stochastic integral
dY, -r (Y, + 2V log (T)) dt + ddB. Yo PT.
(1))
From the smoothness of the marginals P: and hence smoothness of the drift term y + 2V log p (v) it follows that (I1) admits strong solution for times t T. It follows from weak uniqueness of the backward process [44] that the law of Yr-, coincides with that of X,. Hence, generating trajectories from the reverse process provides way of sampling from the target distribution as T.
The backward process only defined for times < T. order to extend the backward process to the full time interval E [0,T], T], one needs the assumption on the initial density that V log Po V log
23

---

exists in a weak L sense (22]. However, in practice this is almost never satisfied as the target density typically singular. This implies singularity in the score s, that grows as 3, da as + To overcome this issue, the backward process is typically only sampled up to time = T A, which is responsible for the characteristic noise typically present in image models.
B Response of the predicted density to learning errors
In the main paper, argued that we may ignore the noise term for a fixed path in probability space, and simply consider the deterministic nonautonomous system. Here we show how to extend the perturbation response result in section 3 to random dynamical systems. Using the framework presented in section A| we may go through the same derivation as in section 3 pathwise, by replacing C, with CT Again, the density p is close to the target (on averaging with respect to the noise paths, E), but not exactly equal. In case the target density with respect to Lebesgue does not cxist, we can perform integration by parts and treat p genuine density due to the convolution of the target measure with Gaussians that describes the pr. in the discrete time algorithm (DDPM).
As before, we consider f to be constant functions on the data manifold that are differentiably extended to Rd. The pathwise responses derived in this way contain pathwise score functions, sF which are not the same as the score functions, While E,² p, we do not get the score by taking expectations of the pathwise scores. In order to compute ش5 however, we may recursively apply the log gradient of the change of variables through the map, F i..., CT. The above pathwise statistical response, uniformly bounded over the Wiener paths, due to dominated convergence, allows us to exchange limits, and thus, the overall statistical response still be computed pathwise via,
0e F pa) EE O. (Po))
(12)
C Tangent dynamics: evolution of infinitesimal perturbations
The primary objective of this work is to study the effect of learning errors on the dynamics. For stochastic generative processes, we can extend the linear perturbation analysis in the main text to each noise realization of an RDS. As before, to model the effect of score learning errors, we consider evolving Fiz with perturbed scores of the form, 3t EXt, where X is a time-dependent vector field that indicates the direction of the error in the score. The perturbed dynamics, for a fixed noise path, is represented as, F F
... F,, and correspondingly, the perturbed densities, by F4 Po = p.... leading to the perturbed predicted density, Pr,e, when we take an expectation over noise realizations E. We set G. == a F!.3 to represent dieendependent vector field that gives the perturbation in the state (sample) at time l. due to the learning error field. Taking -> 0, we can obtain the following recursive relationship for G
S++1 Fē dFF & + Fi.
(13)
simply by applying chain rule. Unrolling this recursion, and since CH = 0,F0. = O.Id = 0 identically as a vector field, we obtain,
1 o F. Σ dF.
dF n+ F
F=1 F Xn-
(14)
vector field can be evaluated at a specific point, say x E IR, to give a tangent vector, that indicates the direction of infinitesimal change at An interpretation of this infinitesimal change when viewed through differentiable scalar fields is the following. If g R + R is a scalar function on the domain, then, at z, vector field represents one among the possible directions of infinitesimal change in g. In other words, tangent vector fields can be thought of as (linear) operators which when acting on differentiable functions produce their directional derivatives at each point. As an example, (x( E RDD is a tangent vector that can be used to produce the directional derivative of any as dg(x)) (e(x:) == lim,--o(g(z + <G, (x:) (xr))/e. c. In this sense, there is natural interpretation for the sequence of vector fields defined in 13 Let us fix an orbit/sample path, {I+- = (2+-1)) The
tangent vectors (2x) E DR can be applied to a scalar function g to obtain the overall infinitesimal
change in along the sample path due to infinitesimal learning errors. More precisely,
0g o Ft. (xxo) dg(z,) (x
(15)
24

---

Rewriting (14 to make (e(2)) explicit along fixed sample path,
(x(x)) Σ dP. ( ... d (In+1) Xa (1(+n))).
(16)
Each term in the above sum consists of multiplication by a sequence of matrices. Let us define A, := (x,) RDx and the product An,: := A, A An for 0 S S t 1, for the sake of shorter notation. That is, the perturbation vector (e can now be written as
(++1(10-1)= = Σ Au+1. (n(
(17)
To analyze the effect of infinitesimal errors on infinitely long sample paths, we can let - -0 in the above equation. In this case, the asymptotic behavior of the product of random matrices comes into play. Oseledets theory (see e.g., as applied to cocycles defined on dynamical systems. Essentially. assuming that max (0, log A, is summable for almost all paths, one can define Lyapunov exponents (for each E) to be the logarithms of the set of eigenvalues of the matrix, lim,--- (AA,, An.:) /2(tt=)) Corresponding the Lyapunov exponents (LE), there is a decomposition of the tangent space at each t in the characteristic directions called Oseledets subspaces, i.e., directions in which the perturbation norms grow at an exponential rate corresponding to given LE. Thus, to analyze the growth/decay of the norms in the time-dependent linear dynamical system (33), these characteristic directions form a natural basis. Here, since our dynamical system is defined only over finite time interval, we consider computational proxy for the Oseledets spaces, which are described in the main text (section 4). In the remainder of this section, we let -o and review Oseledets theorem.
5 a collection of classical results on random matrix products
Ignoring the control or forcing (inhomogeneous) growth/decay on an exponential scale, we can consider the following homogeneous tangent equation,
in
isolate the time-asymptotic
W+++1
Ae Wt-
(18)
If we only interested in growth/decay on exponential (in t) scale, finite sums for close to t in (17) are not significant. Morcover, the vectors Xn (2n+1) ) are path-dependent and perturbation- dependent, and they not fundamental directions characteristic of the dynamics. Thus, by consider- ing a decomposition (as in section 4) of (x() along Oseledets spaces, we can provide a pessimistic analysis, since a random vector (3.) will, with probability 1, have non-zero component in the leading Oseledets space at x---
The homogeneous tangent equation (8 gives the evolution of infinitesimal perturbations in the initial conditions, i.e., wi := dFt. wp.. This equation gives the most general evolution of infinitesimal perturbations along generic sample path {Iz). When 2; is invariant, i.c., fixed point, A, is also invariant, and this reduces to linear stability analysis. When 2, is a periodic orbit, the matrices A, are classically studied with Floquet theory and corresponding exponents. In more generality, the random matrix product (z,,) Tr, R. + R2, known as the tangent propagator [32] is studied as - under Oseledets multiplicative ergodic theorem.
When the dynamics F, is invertible, we consider the limit
W (t) lim (47,T 1/(2(t-n))
The eigenvectors (t) of W (t) are called the backward Lyapunov vectors (BLVs), and the negative log of the singular values \; log a, are called the Lyapunov exponents. Conventionally. the LEs are still deterministic and are defined by taking expectations with respect to the noise paths 3. The vectors (1) form a basis for tangent space at x, are defined for P-a.e. (for almost every noise realization). For an exposition on the ergodic theory for RDS, see (29). When the distribution IP does not depend on time, the Backward Lyapunov vectors can also be defined a deterministic manner P a.e.
D Robustness of the support upon alignment
Proposition 4.1 shows that with high probability an aligned and convergent generative model can be used to learn the support of the data distribution accurately. First, by convergence, mean that the
25

---

generating process enjoys a theoretical convergence result in Wasserstein metric. For instance, we can consider convergence result from [4] for denoising diffusson probabilistic model (DDPM), a time-discrete diffusion model. For any general target with compact support, as we have assumed, suppose the score is learned with a T,2 error (c), uniformly over time S T. Then, (44 show that the Wasserstein-2 2 distance between the predicted density, Pr.c and the target Pdata is (cc//5). Note that, by definition of Wasserstein-2 distance, if T is the optimal transport map between Pdata and Pr.e: then, Ex-pasta [Tr) - x l I Ce', where T(x) ~ Pr.c. Now since [[T(x) zil is a random variable with a small mean and variance, we can get an 6n (applying Chebyshev's 's inequality e.g.) in the statement of Proposition 4.1 given any 8 > 0, such that with probability (over n independent draws from Pdata) 2 1 6/2, we have that [zx) x.ll S Co. for all i S n.
Next we examine the alignment property. In Proposition 4.1, we assume alignment with high probability. That is, with probability 2 1 - 6/2 over independent draws from Pdata, alignment holds, i.e., at the generated samples, T the most sensitive Lyapunov subspace Ed is tangent to the support of pdasa- In other words, the generated samples T(x:) = xj + eli;, where h; is along TOM. Now consider a one-classifier trained to predict if a data point is on the support and -1 otherwise. kernel-based classifier is always realizable for a discrete data distribution 49
It is a one-class classifier because for all the data points F₁. the output label is 1 and we do not have negative samples.
A key observation is that the confidence margin of (one-class) hyperplane classifier trained using I; is the same as that trained using T(x;). Therefore, we can apply a known generalization result, and going further, even data-dependent upper and lower bounds for classification using the true data distribution to now the predicted distribution, provided the prediction is aligned (margin does not change). This is the essence of the proof. In summary, we pose learning the support estimating one-class classifier. Then, we use the fact that the margin does not change when we move data points along the separating hyperplane.
E
Alignment proofs
In the proof of Theorem 4.3, we make assumptions about the dynamics of the vector field Us whose time-discretized flow is our dynamies, F². Mainly, toward the end, when / 1", we assume specific anisotropic behavior of the vector field. It is helpful to think of the anisotropy by considering local coordinates that align the first d coordinates with the most sensitive subspaces, Ed In other words, consider local coordinates, $ RDD - TR D around Tr, such that, (0) = Ig and (0) maps the first d standard basis vectors to EY
Recall assumptions (i)-(ii) in the statement of Theorem 4.3. Consider the Jacobian matrix at time V (1,
Id + ot a t, dz)(() in block form, (z) = öt V aa (x)
Id 5tV t, di (x)
and the second
V 2 t (x)
Ti (1,a(x) and St Vi Ur (x)
derivative d2F, F2 can be written as two block tensors:
8t t Vr.d (x)
St Vi.
(z) St aa ((ala))
St Vi (z) öt V Eddd_ (x) To obtain an estimate of w. == tr((dF.)-1 Ft), we
first observe that using assumptions (ii),, the Schur complement of the first dxd block of dF, reduces to ld + òt Ve,di Vt, Using this Schur complement and assumption iii, we obtain that the first block of We, which is we Eg is given by 5l tr((Id 86 V Vi,ave,a) V2 V.a) Then, using assumption ii we obtain the estimate in the main text.
F Regularity of alignment
Lemma 4.4 shows a notion of regularity of the alignment property. We show this by using the Arzela- Ascoli theorem on the space of functions Ed. for some perturbation of the dynamics. Applying Arzela-Ascoli gives the existence of converging subsequence on this space. This subsequence consists of most sensitive subspaces of perturbed systems, which from convergence, will also be closely aligned with the data manifold if the original dynamics is aligned. To apply Arzela- one sufficient condition is to assume Fr,- E Cl+ since we then obtain that Ed is Holder continuous.
This is because E&! is by construction an orthonormal basis for the column space of dFF, which is
26

---

C For the Holder continuity of E, we also need the eigenvalues of dFF to be nondegenerate, With uniform Holder constants and exponents, since M is compact, we get the needed equicontinuity
G
Additional numerical experiments
Our numerical results using score-based diffusions indicate robustness of support in all cases; further, they also show alignment, qualitatively validating the dynamical mechanism for robustness that we show in the main text. We report on the numerical methods, implementation details and our experiments in this section. The supplementary material also contains the code needed reproduce the figures in the main text.
G.1 Sampling via reverse diffusion
In the case of score-based diffusions, our dynamics F refers the Euler-Maruyama discretization of the reverse diffusion (TI) There are various noise schedules 3r used practice. In terms of the continuous time SDE choosing 3, is tantamount to reparameterizing the time variable in the standard Ornstein- Chineien-UUeebeckk process via Jn 8g ds. From mathematical perspective, the density evolutions are therefore the same. Practically, however, the process has to be discretized and some noise schedules are more robust against dineediscettization errors [23] For the purpose of this study, we therefore fix the noise schedule to be the cosine noise schedule from 42) that was shown empirically to yield good FID and NLL scores. We observe that our experimental results on alignment and robustness do not change when using different noise schedules. The cosine noise schedule from 42 translates to the formula for 3r given by
sin
π
1+8
B.
(1+
4+6
co8
T+6
This comes from the formula for de f(t)/((0), cos
[++6_
;)² given in 42 and noting
1+6
that Or exp
0 Bg ds)
Once a suitable approximation to the score is acquired, the backward equation yield the random dynamical system
is discretized to
Y = (M,. S.) == Yn 3r-,, (Yn + 28T (Xn)) öt E. 23r öt, Yo~ (0,1).
We also study solutions the perturbed system
Ya+1 = F..... = Y,, + Br- (Yn + 28T (Vn) + X (V.)) St + En E 2, 5t. The perturbation vector Xn. specifying the error between the original dynamical system (. 5n) F. O) and the perturbed dynamical system (. EniEe)) e). and measures the strength of the
perturbation (sce The timesteps in is chosen equispaced with 0 < to <...t = -' = 1- A. with A controlling the early stopping time avoid singularities. This corresponds to solving the backward SDE (11) from = to backward to t A.
G.2 Two dimensional examples
We perform a number of experiments on two-dimensional domains with one or two-dimensional support of the target. We show our experiments with the 2 moons distribution in Figures ((main paper), g and 7 We also visualize the Lyapunov vectors on a different example in Figures and Throughout, LVs and LEs are computed using the QR algorithm (a finite-time version of the Gram-Schmin process from (0) described in section 4.
curve (or collection of curves as in the half-moon example) r = {T(()= L [0, 1]} C R22 The target measure is given by dpdata dy where dy is the arc-length measure for the curve [()), and g some smooth density. We compute expectations against π via the parameterization as
In these planar experiments, represent the manifold
B[g(X)] / g(z)p(z)ds= [ ((T())((()))
27

---

Distrbution at
Distrbbtion 4t 0.1
18-
13
c0
50
-03
-25
-00
-1.0
-05
16
Dstribution att 0.001
15-
10
-5
-10
Score-based diffusion with numerical estimates of the score. Top row: starting density, Po and the density time 0.9. Bottom row: predicted target, P1-A- In each figure, the red curve represents the analytical data manifold.
Figure 4:
The Ornstein-Uhlenbed process
9 is linear SDE with additive noise. The density Pr can therefore be solved analytically [4 via the integral equation
px(
(
The kernel (xx(o)) is the Green's 's function to the associated Tokker-Plande equation and is given by
| E - 2(1 c-t)
pe(x)(o))
Z. exp
The score st V log Pe also be solved for in terms of the one dimensional integral
(z) Jr (z)lo)))) Jr Pr (
Our paper focuses on the propagation of score errors through the dynamics. To validate our theoretical results the robustness of the support in stylized setting, and since the integrals involved tractable in the low- -iwedimeniional setting, we estimate the score via quadrature rather than training neural network. This is done to maintain explicit control of the errors involved in our motivating examples and experiments.
G.3 MNIST training details
Here present additional details the MNIST results from the main paper. We showed that MNIST generation with diffusion models tends to have robustness of the support. Further, we also observed that our proposed mechanism of alignment holds even in this higher dimensional setting. Specifically, we showed that the leading (220) (approximately the intrinsic dimension of the support/data manifold) LVs span the tangent spaces the data manifold. As empirical proof of this, we saw that moving along an LV of a higher index (indices are, by convention, in decreasing order of LEs) takes us off the data manifold. This is shown in more detail in Figure
These images are produced by a DDPM where the score model is trained by minimizing the simplified conditioned score matching loss from 25):
Esimple (0) Er,z0, [lle ee + vI
age, {]
28

---

4
f
4
Figure 5: Top: Denoising diffusion trajectory sampled by approximating the score using U-Net architecture trained on the MNIST digit dataset. Middle: The Lyapunov vectors of indices 1, 2. 20, 50 and 100 (from left right) calculated along the sample trajectory. Notice that the principal Lyapunov vectors recover meaningful features of the sampled digit. The is in contrast to the lower Lyapunov vectors (higher indices indicate smaller LEs), which become progressively more noisy. Bottom: The sample image perturbed in the direction of the Lyapunov vectors in the same column. The Lyapunov vectors represent the principal directions which errors the sampling algorithm influence the sampled image. Notice that the principle Lyapunov vectors morph the shape of the sample without destroying image fidelity, whereas the lower Lyapunov vectors destroy image structure. This consistent with our claim that errors propagate the image tangent to the data manifold.
where & ~ (Amin: T), Fo Pduta and No0, T). Once again we note that in the continuous setting we have a₁ exp (- [-oo 3.ds). Training is done in batches of 64 for 30 epochs. The backward process consists 4000 steps, generating a trajectory of (11) from time = 0.9 down to A T/4000. We use an Adam optimizer with learning rate 2c-5.
t). The neural network 60 a U-Net, that was implemented in PyTorch by [59]. The U-Net consists of two down-sampling stages, mid-level stage, and two up-sampling stages, where the 28 x 28 image is down-sampled to an array of 7 x images and up-sampled again. Each downsampling stage consists two ResNet layers with SiLU nonlinearity and Attention layer. The mid-level consists of ResNet layer followed by an Attention layer followed again by ResNet layer, before up-sampling in symmetric fashion.
Once trained, the score approximation given by so s0 () = -o
G.4 CIFAR-10
Our perturbation experiments on the CIFAR-10 data distribution also confirm the robustness of the support property exhibited by score- based diffusion models. In Figure 6 (left), we show images sampled by a pretrained generative model from (53] Github On the right hand side of Figure 6 we show images generated by the same model with score perturbation of size 0.1 (L norm) added to Fr for each I. These samples look visually no different and produce similar likelihood scores, R 3.7 bits/dim, compared to the predicted samples using the original pretrained score model even for perturbation size up to As expected, this behavior of robustness the support reproduced with any stable time-intes interintegattion scheme, c.g., using predictor-corrector probability flow ODEs.
29

---

Figure 6: Left: images predicted by pre-trained score-generative model by Song et al 2021 [Github link] on CIFAR-10 training images. Right: Predicted images by the model when a size 0.1 perturbation is added to the score vector field.
G.5 Conditional flow matching
So far, all our numerical experiments were carried out with diffusion models. Here we compare the robustness of the support across other conceptually different generative models. Specifically, consider experiments with conditional flow matching variants [38 37 and stochastic interpolants
[], and all our experiments are based on the implementation by the TorchCFM package Github At their core, these dynamical generative models interpolate samples from a source density po and samples from the target Pdata. For instance, a variance preserrvng interpolation is used in stochastic interpolants [3] and a straight line interpolation is proposed in rectified flow sampling (38]. In these generative models, a stochastic path such as X, (1 t)X, + tX1 + (t) with Xo ~ po- X1 ~ Pdata is predetermined, while the probability flow path is computed. This is in contrast to SGMs, where the probability path is predetermined for the reverse process by choice of the forward process. The score approximation is performed for Brownian/OU paths in SGMs, while for other paths in flow matching. Thus, is natural to ask the learned dynamics for these different probability paths also possess the robustness property.
Less robust flow matching models. Following TorchCFM tutorials (56) learn vector fields Ut with an MLP and 256 training samples per epoch from the 2 moons data distribution. The generated probability density is quite accurate for all of these models. In Figure 7 (top left), we show the generated density from Optimal Coansport-Conditionn perturbation of size 0.5 and 1.0 in the - norm to the learned vector field Ut. The predicted densities for OT-CFM (first row) and stochastic interpolants (third row) seem to show the most robustness to the support, while for non-rectified flow matching the densities do not seem to exhibit robustness of the support, in comparison. Visually, all of these models seem to be less robust (c.f. Figure 1) than score-based diffusions. is noteworthy that this not due to the effect of the noise in the diffusion process, as the same robustness is visible even for deterministic time-integration (probability flow ODEs) using the scores. Thus, the robustness seems to be dynamical, with different dynamics on probability space and the loss function/formulltionn together dictating specific dynamics on sample space.
Flow matching (56). Next, we add
To understand the effect of the dynamics further, we compute the LVs and LEs as before using an iterative QR algorithm. Recall that the LEs are recovered as the time-average of the log diagonal elements of R₂ (see section 4 of the main paper). We observe that some paths (i.e., with non-zero probability with respect to the source distribution) may have positive leading LEs, while SGMss were always observed to have stable LEs. We take the source density to be 8 Gaussians, but essentially similar results were obtained with a standard Gaussian source density.
In Figure g we show the leading LV (in blue) calculated for three different GMs in the top row. Also plotted the score of the approximate moons density (shown in red) in each case. The model OT-CFM seems to be most consistent with Theorem 4.3, showing most orthogonality with the score, or alignment, among the flow-mater fow-matching models, but much less compared with diffusion models. To quantify the alignment, we plot the histogram of the absolute value of the dot product between the normalized score vectors. The generative model using optimal transport appears to have the best alignment since the histogram has faster decay and sharper peak at 0 (orthogonality between the score and the leading LV). Although Theorem 4.3 only proves that the orthogonality is a sufficient condition for the robustness of the support, it seems to agree qualititatively with the observations in 7 The most aligned model, being OT-CFM, also exhibits most stability of the predicted support to perturbations. Moreover, none of these models robust as aligned as diffusion
30

---

CT-P%
002215
OT-ONN
0.250
002343
5/66111
60033
04015
0/4014
00256
00072
5.3033
-2
02024
201018
00139
-5
-5.0
-2.5
0.0
5.0
CFM, eps 0.5
CFM. eps 1.0
0.1606
0.1958
0.1428
0.1740
0.1249
2
0.1523
0.1071
0.1305
0.0892
0
0.1088
0.0714
0.0870
0.0535
0.0653
-2
0.0357
-2
0.0435
0.0218
0.0000
0.0000
-5.0
-2.5
0.0
2.5
5.0
5.00
-2.5
2.5
5.0
eps
0.1334
Interp., eps
0.1697
0.1186
0.1508
0.1037
0.1320
2
0.0889
0.1131
0
0.0754
0.0445
0.0566
-2
0.0296
0.0377
0.0148
0.0189
0.0000
0.0000
-5.0
-2.5
0.0
2.5
5.0
-5
5
Figure 7: Top row: (Left) Two moons data distribution generated by an optimal transport-conditional flow matching (OT-CFM) algorithm [56]. OT-CFM dynamics perturbed by errors in the vector field of L norm 0.5 (center) and (right). Middle row: densities predicted by non-rectified flow matching model with perturbations of size 0.5 (left) and 1.0 (right). Bottom: densities predicted by perturbed stochastic interpolant models.
models for the same target. These interesting results can open up avenues to pinpoint the most prevalent cause of robustness lack thereof of the support. Furthermore, results can be starting point to understanding the deep connection between the dynamics on sample space that leads to robustness and the dynamics probability space (which does not uniquely determine the sample space dynamics).
31

---

OT-CIM
CFM
scr data dist
scr deta dist
scr data dist
-1
-2
6000
5000
4000
4000
4000
2000
1000
1000
0.2
0.8
0.8
1.0
OT-CFM
DV1 CFM
Figure 8: Top row: the target score vector field (bluc) and the top LV (red) computed using unperturbed GMs: OT-CFM (left), CFM (center) and stochastic interpolant (right). Bottom row: the histograms of the dot products (absolute value) between the normalized target score and the leading LV (red) over 40,000 points. We see that the stochastic interpolant model and CFM are less aligned than OT-CFM according to our definition in this case.
32


Reviews:
[{"review_id": "pHCz3X4YGf", "reviewer": "Reviewer_678s", "summary": "This paper investigates a key empirical observation in dynamical generative models, where errors in the learned vector field (score) often shift generated samples along the data manifold but not off it. The authors propose a theoretical explanation for this phenomenon via a dynamical systems perspective, focusing on finite-time Lyapunov vectors.", "questions": "1. I am a bit confused about the 'tangent perturbation' at line 120. Does it mean the perturbation along or away from the data manifold? To study the robustness of support, I believe we should consider the perturbation pushing the samples away from the manifold, but 'tangent' sounds like making the samples stick to the manifold. Same question for the last column of Figure 1: what does it mean by shifted 'tangent' to the data manifold? Also would you please clarify what it means by 'perturbations along sample paths' at line 157?\n\n2. At line 68, the author states '... as the perturbation size tends to 0', which looks like indicating an asymptotic result. But I would expect the result like 'as the perturbation size $\\epsilon$ is sufficiently small'. Please correct me if I have a misunderstanding.\n\n3. The notation of $u$ defined in section 3 is a bit confusing, as $u$ is a vector field while $u(\\rho_\\tau)$ is a scalar. I would suggest using different notations.", "limitations": "Yes.", "rating": 5, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 3, "significance": 3, "originality": 4, "strengths_and_weaknesses": "The paper provides rigorous and detailed mathematical analysis, bridging generative modeling with classical dynamical systems theory, particularly via Lyapunov analysis and transfer operators. However, the paper focuses on sufficient but not necessary conditions, leaving the full characterization of robustness open.", "was_revised": true, "final_justification": "All my concerns have been addressed, and so I raised my score.", "rebuttal": "We thank the reviewer for these insightful comments and questions. We completely agree that we only provide a sufficient but not necessary condition on the dynamics for the robustness of the support. Rather than a full characterization of robustness, we aimed to introduce two concepts that can have an impact beyond the analysis in the present paper: most sensitive subspace (least stable finite-time Lyapunov subspace) and alignment (the tangency of the most sensitive subspace with the tangent space of the target support). In future work, we anticipate that alignment will be used as an objective function to fine-tune generative models (please see responses to Reviewers YsYs and gbmB on a related question). Since the most sensitive subspaces are defined constructively using an efficient algorithm, they make maximizing the objective function computationally feasible.\n\nBeyond the application to robustness in the present paper, we believe that computable bases for the tangent spaces (which contain errors and control terms) can be useful for optimizing other objective functions, e.g., control-based objective functions in rare event sampling or unlearning. That is, the tangent bases introduced in this paper establish principles for controlling generative models to bias the target distribution for downstream applications, which is a subject of active research in multiple communities. \n\n## Definition of tangent perturbations \n\nOn Line 120, we call the perturbation vector field $\\chi_t$  a *tangent perturbation*. This simply means that the additive perturbation $\\chi_t$ is a vector field: a function that evaluates to a tangent vector in $T_x \\mathbb{R}^D$ at each point $x \\in \\mathbb{R}^D$. In this context, tangent vector is used in the usual sense of differential geometry; we may think of $\\chi_t(x)$ at a point $x \\in \\mathbb{R}^D$ as a vector in $\\mathbb{R}^D$ that represents all possible directions of infinitesimal perturbations (velocity vectors) at $x \\in \\mathbb{R}^D.$ Most generally, $\\chi_t(x),$ will have components both along the tangent spaces to the data manifold as well as orthogonal to it. In other words,  at each $x$ in the support of the target, we have the orthogonal decomposition $T_x \\mathbb{R}^D = T_x M \\oplus (T_x M)^\\perp$ into linear subspaces tangent to and orthogonal to the data manifold, $M$. The tangent space to the data manifold at $x$, denoted $T_x M,$ is a $d$-dimensional linear subspace, where $d < D.$  We have corrected this ambiguity from the use of the word ``tangent space'' for both $T_x \\mathbb{R}^D$ and $T_x M$ in the revised version. Thank you for pointing it out!\n    \nIn Figure 1, we observe that the samples are shifted tangent to the data manifold, $M,$ which is the $d$-dimensional support of the target. This means the following. Consider a sample $x + \\epsilon y$, for a point $x$ on the data manifold (support of the target distribution, which is assumed to be a $d$-dimensional manifold) and a small $\\epsilon.$ The shift $y$ from $x$ is a tangent vector, and this vector can have components along the manifold (i.e., on $T_x M$) and orthogonal to it (i.e., on $(T_x M)^\\perp$). One can write $y \\in T_x \\mathbb{R}^D$ as an orthogonal decomposition, $y = y_t + y_o,$ where $y_t \\in T_x M$ and  $y_o \\in (T_x M)^\\perp.$ However, interestingly, we find that under alignment, the component $y_o$ of the generated samples of SGMs is negligible. This is what is illustrated in the figure and serves as the motivation for the theory in the paper.\n\nIn line 157, we introduce the notion of evolution of infinitesimal perturbations along orbits of $F_t$ (the generating process), which we describe in the remainder of the section. Briefly, using the notation above, we are interested in studying the cumulative effect of infinitesimal perturbations along $\\chi_t,$ which captures the error at time $t.$ To understand this, let us fix an initial sample $x_0$ from the source distribution, and consider the original dynamics, $F^t_0$ so that $x_\\tau$ is a sample according to the target. Now, starting at the same initial sample, $x_0,$ suppose we apply incorrect (perturbed) dynamics at time 0. That is, we will get $x_1^\\epsilon = F_{0, \\epsilon}(x_0) = F_0(x_0) + \\epsilon \\chi_0(x_0) + \\mathcal{O}(\\epsilon^2) = x_1 + \\epsilon \\chi_0(x_0) + \\mathcal{O}(\\epsilon^2).$ Then, we can define a new vector field, say, $u_1,$ which evaluates to $u_1(x_1) = \\lim_{\\epsilon \\to 0} (x_1^\\epsilon - x_1)/\\epsilon = \\chi_0(x_0).$ By definition,  $u_1$ captures the difference between the two sample paths (governed by the original and the incorrect dynamics) at time 1. We can capture the cumulative effect of infinitesimal perturbations ($\\epsilon \\to 0$) at any time $t$ using the tangent dynamics, as described in the main text of section 3. We will revise the first paragraph of this section to make the motivation clear -- thank you for raising this point!\n\n ## About infinitesimal perturbations\n\nThank you for asking about infinitesimal versus non-infinitesimal perturbation size, a question similar to one posed by Reviewer gbmB. In the previous section, we defined the vector field $u_1$ even in the case when $\\epsilon$ does not go to 0. However, for the linear perturbation analysis for longer times to hold, in general, we need the limit $\\epsilon \\to 0.$ This is because we linearize about an orbit (hence we are able to construct dynamics on the tangent space) and for this linearization to hold, the errors in the difference in the orbits must be on the $\\mathcal{O}(\\epsilon)$. That is, a Taylor expansion for the perturbed orbit about the original must be accurate. Thus, we are restricted to ``small'' and more rigorously infinitesimal perturbations. Thank you for pointing out this clarification, which have added in the revision. When the learning errors are large, perturbation analyses are inapplicable, and we need to take an operator or control theoretic perspective instead, as we discuss in the response to Reviewer gbmB. \n\n## Notation updates for vector fields and their different interpretations\n\nVector fields are used in two senses in differential geometry, and both these are applied in section 3. In one sense, we interpret vector fields as functions from $\\mathbb{R}^D$ to $\\mathbb{R}^D,$ which evaluate to infinitesimal perturbations at each point, as explained above. The second sense is as a linear functional, and it is in this sense that we define the vector field $u$ in Eq. 2. A vector field, say $u$ at each point, gives a direction to take derivatives. That is, it acts as a linear operator that defines how infinitesimal perturbations in the direction of the vector field affect the values of any differentiable function. In other words, if at a point $x,$ the value of a differentiable scalar function, say $f,$ changes along a vector field $u,$ by the amount, $\\lim_{\\epsilon \\to 0} (f(x + \\epsilon u(x)) - f(x))/\\epsilon.$ This value, called the directional derivative, is also the value of the linear operator: $u(f)(x) := \\lim_{\\epsilon \\to 0} (f(x + \\epsilon u(x)) - f(x))/\\epsilon.$ But, we agree with the Reviewer that this notation is confusing. We reverted to writing $\\nabla f\\cdot u,$ with the caveat that $u(f)$ is defined even when $f$ is not differentiable in all directions but only along $u.$ But the existence of $\\nabla f$ requires that $f$ is differentiable in all directions. \n\nWe have answered all your questions, but we would be very happy to resolve any other issues that you find with the paper or the rebuttal above. Thank you very much once again for your time, and we kindly request you to reevaluate our work based on our responses and revisions above!"}, {"review_id": "gEzMrOgnqS", "reviewer": "Reviewer_qRyA", "summary": "In this paper, authors study the robust behavior of dynamical generative models. \n\nAuthors first show that even with erroneous perturbation, the infinitesimal change of the target density is only supported where the target density is supported. To explore the manifold hypothesis, the authors introduce the notion of alignment: the principal directions of sample deformation—captured by the leading Lyapunov vectors—are orthogonal to the target score at the boundary of the data manifold. A sufficient condition for alignment is also derived for generative models. \n\nBoth analyses explain the robustness of dynamical generative models and why they can reliably produce samples on the target manifold even with statistical estimation errors. \n\nSome empirical results are performed on toy and real-world datasets, validating the theoretical claim.", "questions": "If the author could kindly answer the following questions, it would greatly helpful: \n\n- > Intuitively this means that the generating dynamics may include an expansive phase and the vector field vt is a\n uniform “attracting force” at the end.\n\nCould authors explain how this intuition is derived from the sufficient conditions listed in Theorem 4.3? Specifically, it is not clear to me which part of the sufficient condition implies that we could have an expansive phase. \n\n- What does the condition (ii) mean in Theorem 4.3? Could we check if this condition is satisfied in Figure 1?", "limitations": "Yes.", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths: \n\n1. The manifold hypothesis (Song and Emron., 2019, [45, 14] in the manuscript) is an important conjecture and is believed to be the reason that dynamical generative model work so well comparing to other generative methods (e.g. GAN). Mathematical analysis on this subject will have significant impact on down-stream applications. \n2. Authors' analysis assumes a very generic framework of dynamical generative models; thus, the results are applicable to a wide variety of drift based generative models (such as diffusion models and CFM). \n3. The sufficient conditions of manifold alignment theorem have intuitive interpretations and can be computationally validated even on high-dimensional data (Figure 2). \n\nSong and Emron, Generative Modeling by Estimating Gradients of the Data Distribution, 2019\n\nWeaknesses and Comments: \n\nOverall, this paper is technically dense and could benefit from additional examples illustrating these mathematical concepts. \n \nThe first result (Section 3) is not very well explained. Authors could expand the paragraph after eq. 2, explaining the result and its implications in a more intuitive manner (similar to line 274 - 288). For example, why does the eq. 2 show that generative model sticks to the target support? It is not immediately clear as the rho_tau(x) in eq.2 is not target density p_data. \n\nSome elements in the sufficient conditions in Theorem 4.3 are very abstract, (e.g., nabla_t,d v_t,d), and are not easily observable from Figure 1. Could authors create a new plot to show how do these quantities behave on the boundary of the manifold? \n\nAfter Theorem 4.3. I recommend introduce some toy examples (e.g. diffusion generative model learning a target density on a sphere) and show the validity of the sufficient conditions using this simple example. \n\nTo a general reader who may not have extensive experience on dynamical generative model, some terminologies may be hard to understand. For example, \"compressive\", \"expansive phase\", \"superstable\", \"non-singular target density\" etc.", "was_revised": true, "final_justification": "If the author could incorporate more intuitive explanations into the revision, this paper would be stronger. All my confusions are addressed, and after reading other reviews, I am now more confident that this is a technically sound paper.", "rebuttal": "We thank the reviewer for taking the time to provide us with many suggestions to improve the clarity and presentation of the paper.\n\n## Intuitive explanation for statistical response-based robustness\n\nAs the reviewer has pointed out, we have omitted an intuitive explanation for why Eq. 2 (on statistical response) implies the robustness of the support. We have now added the following explanation to the revision. Before that, however, we would like to point out that $\\rho_\\tau$ is indeed the density of the target distribution, $p_\\mathrm{data},$ if $p_\\mathrm{data}$ has a density (with respect to Lebesgue measure, i.e., it is absolutely continuous or not singular). When $p_\\mathrm{data}$ does not have a density (e.g., if a discrete probability distribution or a continuous distribution supported on a low-dimensional manifold), then $\\rho_\\tau$ is an approximate probability density of $p_\\mathrm{data}.$ The latter case is best exemplified in a diffusion model, where a time-integrating the reverse process from 0 to $\\tau - \\delta t$, i.e., close to the final time (just before the score blows up or is undefined) still results in a probability density: this probability density is the density of the distribution $p_\\mathrm{data}$ convolved with a  Gaussian of small variance and mean 0.\n\nHaving clarified the meaning of $\\rho_\\tau$ as the density of the target or the approximate density of the target, we now interpret the implications of Eq. 2 for robustness of the support. In Eq. 2, the density $\\rho_{\\tau, \\epsilon}$ is the density obtained from an incorrect GM in which the magnitude of learning errors is $\\epsilon.$ This equation compares the incorrect density $\\rho_{\\tau, \\epsilon}$ with $\\rho_\\tau,$ the target density produced by a perfect GM. For small $\\epsilon,$ we can rewrite the left hand side as $(\\rho_{\\tau, \\epsilon} - \\rho_\\tau)/\\epsilon$ and the right hand side is the product of a scalar function, say, $\\alpha(x) := \\sum_{t=0}^{\\tau -1} ( \\mathrm{div}(\\chi_t) + \\chi_t \\cdot s_t) \\circ F_t^{-1} \\cdots F_{\\tau-1}^{-1}(x),$ and $\\rho_\\tau.$\nHence, we can rewrite Eq. 2 as $\\rho_{\\tau, \\epsilon}(x) - \\rho_\\tau(x) = \\epsilon  \\alpha(x)  \\rho_\\tau(x) + \\mathcal{O}(\\epsilon^2).$ There are a number of implications of this result:\n\n 1.  The leading order (in $\\epsilon$) term is zero where $\\rho_\\tau$ is zero. As a result, the leading order contribution to the error in the densities, $\\rho_{\\tau, \\epsilon}(x) - \\rho_\\tau(x),$ is made on the support of the target. Alternatively, at an $x$ outside the support of the target density, the error is $\\mathcal{O}(\\epsilon^2).$\n 2.  Secondly, the error, $\\rho_{\\tau, \\epsilon}(x) - \\rho_\\tau(x),$ for a small $\\epsilon$ only depends on the unperturbed GM, which has no errors. This is because, in order to evaluate the error at an $x,$ we only need to evaluate the score and the perturbation vector field $\\chi$ (and its divergence) along an unperturbed orbit, since the terms involved in $\\alpha$ only contain the maps $F_t$ and not $F_{t, \\epsilon}.$ Hence, the error in the predicted density only depend on the properties of the original dynamics.\n3. In regions of high target density (non-negligible $\\rho_\\tau$), the error depends on the dot product of the perturbation $\\chi_t$ with the score functions $s_t$ along the unperturbed orbit. This is intuitive and tells us that a perturbation more aligned with gradients of log density along an orbit will have a greater effect on the predicted density at time $\\tau.$ \n\nThank you again for this question, and we will add an abridged version of the response above to the paper after Eq. 2, as you suggest.\n\n**Non-singular targets**: these are target  probability distributions that are not absolutely continuous with respect to Lebesgue (volume) measure in $\\mathbb{R}^D,$ the ambient space. We will add a clarification to this and the dynamical systems and perturbation theory related terms (which are explained below) in the main text space permitting, otherwise to the appendix. Thank you for the suggestion!\n\n## Intuition behind sufficient conditions for robustness; illustrative examples for what derivatives along and away from support mean}\n\nYou are absolutely correct that more explanation is needed for the abstractly defined cross-derivatives and how their values impact robustness of the support. We also agree that the illustrations presented for the two-moons example in Figure 1 may be insufficient to observe the evolution of the derivatives of the vector field. Therefore, we will add experiments on a mixture of Gaussians on the circle (since three dimensional vector fields on the 2-sphere may still be hard to visualize) or von Mises distributions. Please see a related answer we wrote for Reviewer Ysys. Here we will focus on providing a textual description to convey the intuition as best as we can.\n\n## Meaning of cross-derivatives and the local coordinates: explanation for sufficient conditions \n\nFirst we start with the motivation for the choice of local coordinates. At each point $x,$ we have a tangent space $T_x \\mathbb{R}^D$ that consists of all possible directions in which infinitesimal perturbations (to any function) can act. The fundamental idea behind robustness of the support is that perturbations to predicted samples are most significant along the support, i.e., in the subspace $T_x M \\subset T_x \\mathbb{R}^D,$ where $M$ is the support of the target. When $M$ is of a lower dimension than $D,$ the ambient dimension, we know that the score of the target is aligned with $(T_x M)^\\perp.$ Although the target score is technically not defined, we may approximately consider as the target score, the score of $p_\\mathrm{data}$ convolved with a Gaussian, as described above. Since the log of this density changes the most in the direction orthogonal to the data manifold, the direction of its gradient (the score) lies in $(T_x M)^\\perp.$ The fundamental idea behind our alignment proof is to show that the angle between the score at time $t,$ $s_t,$ and the most sensitive subspace, $E^d_t,$ grows and at the final time, these two vector fields become orthogonal. Thus, $E^d_t$ becomes equivalent to $T_x M,$ which is what alignment means. Because we want to bound the angle between $s_t$ and $E^d_t,$ using local coordinates along $E^d_t$ and $(E^d_t)^\\perp$ become a natural choice. Intuitively, this means rotating the Euclidean coordinate system so that now the first $d$ coordinates of a vector in $\\mathbb{R}^D$ in this new coordinate system are the components along $E^d_t$ and the last $D-d$ coordinates are the components along $(E^d_t)^\\perp.$\n\nHaving defined these local coordinates, the derivatives of any function must be accordingly rotated. That is, the rotated coordinate system, say $C:\\mathbb{R}^D \\to \\mathbb{R}^D,$ near an $x,$ is defined with the following rules: $C(0) = x$ and $\\partial_i C(y) := dC(y) e_i = (E^d_t)(i)$ where $e_i$ is the $i$th standard basis vector. Here $A(i)$ refers to the $i$th column of a matrix $A.$ With these change of coordinates, what we must prove conditions under which $s_t \\cdot E^d_t = \\sum_{i=1}^d \\partial_i \\log \\rho_t$ become smaller as $t$ increases. To find these conditions, we use the fact that the score components $\\sum_{i=1}^d \\partial_i \\log \\rho_t$ and the dynamics $F_t$ are related because i) $F_t$ evolves the densities $\\rho_t$ and ii) $F_t$ also defines the directions $\\partial_i \\equiv (E^d_t)_i$ recursively.\n\n## What expansion means and why it helps with alignment\n\nAs derived in the paper, we obtain that $\\sum_{i=1}^d \\partial_i \\log \\rho_t = s_t E^d_t$ evolves according to the following recursive equation: $\\sum_{i=1}^d (\\partial_i \\log \\rho_{t+1})(x_{t+1}) = \\sum_{i=1}^d \\partial_i \\log \\rho_t(x_t) \\: R_t^{-1} - w_t \\: E^d_t \\: R_t^{-1}.$ Consider the equation for a sequence of scalars, $p_t$, $p_{t+1} = p_t/R_t - w_t E^d_t/R_t.$ \n\n**Expansive and compressive dynamics.** In dynamics, we say $F_t$ is ``expansive'' if $\\mathrm{det}(R_t) > 1.$  Intuitively, this means the under the transformation $F_t,$ volumes are expanded (the Jacobian determinant of the transformation gives the contraction or expansion). Similarly, a dynamical system $F_t$ is compressive if $|\\mathrm{det}(dF_t)| = \\mathrm{det}(R_t) < 1.$\n\nGoing back to the equation for the evolution of score components, we can clearly see that the map from $p_t$ to $p_{t+1}$ is contractive when $\\mathrm{det}(R_t) > 1.$ Thus, expanding dynamics at each time $t$ leads to alignment. However, we do not observe expansion for most orbits in our numerical experiments with SGMs and CFMs. Thus, we come up with sufficient conditions that allow for contraction, and yet $p_t$ still tends to an arbitrarily small value. To derive such a condition, we impose conditions on the vector $w_t = \\mathrm{Tr}(\\nabla^2 F_t (\\nabla F_t)^{-1})$ and this is what leads to the seemingly unintuitive sufficient conditions ii and iii. The complete proof is in Appendix E. We will revise our explanation in 274-278 to make it more intuitive. We will also add the more easy-to-observe example on the circle, since the tangent and normal spaces are very easy to see.\n\nWe have answered all the questions above although not in the order asked. Please let us know if any additional clarification is needed. We are once again very grateful for your thoughtful questions; we request you to kindly reevaluate our work based on the answers above."}, {"review_id": "iUKpQRlG39", "reviewer": "Reviewer_Ysys", "summary": "This work attempts to theoretically explain the robust performance of generative models in the presence of approximation error in the score function. The main message of the paper is the following: even under the approximation error, the generated samples drift only in the directions along the support, not away from it. As a result, the generated samples are not too different from the target samples. The main analysis of the work relies on the perturbation theory and analyzes the properties of the top Lyapunov vector (the most sensitive perturbation direction). I think this is an important problem to study and requires future research. However, I find the presentation of the paper extremely hard to follow. I elaborate on this in the later section.", "questions": "- What is the main implication of Theorem 4.3? It would be helpful if the authors could provide more figures with explanations.\n\n- Line 275: What is the meaning of \" aligned and convergent generative model\"? An explicit definition will be helpful to the readers. \n\n- Also, how to verify the alignment of a model in practice?\n\n- Lemma 4.4: What is the meaning of regular? An explicit definition is \"alignment property,\" and \"regular\" is helpful.\n\n- \n\nline 311: \"An SGM typically satisfies this condition.\":  Is that trivial? A short argument might be helpful.", "limitations": "As of now, the scope of the work is very theoretical and limited. Further experimental verifications are necessary to gauge the impact of the work.", "rating": 4, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 1, "significance": 2, "originality": 3, "strengths_and_weaknesses": "# Strength\n\nThe paper addresses an important problem that might broaden our theoretical understanding of the contemporary generative models. The paper introduces a novel mathematical framework for analyzing the dynamics of the generated samples using perturbation theory. I am not an expert in perturbation theory, but it seems that the present framework might be helpful in future research in this direction. \n\n# Weakness\nI find the presentation of the paper extremely hard ot follow. \n\n- The paper is very notation-heavy, and it is hard to follow the claims for a non-expert reader. I encourage the authors to add some sort of table for notations.\n\n- Line 180 - 185: The phenomenon regarding the top Lyapunov vector explained in the aforementioned lines is not quite clear. It will be helpful if the authors provide more figures to explain the details of the dynamics. More importantly, definite examples supporting the claims would be helpful for the readers. For example, verifying the claims in simple settings, such as the DDP model with a mixture of Gaussian distributions as the target distribution,  is encouraged for better readability.\n\n- The main results of the paper are hard to parse. For example, the implication of Proposition 4.1 is not clear. Also, what is \"margin\" when you write $c = O(1/ margin)$ in Line 213? I could not find any definition.", "was_revised": true, "final_justification": "My doubts have been clarified.", "rebuttal": "Thank you for taking the time to improve the readability and clarity of the paper! Below we elucidate all the concepts and terms that were previously unclear, and we will also modify the relevant parts of the paper in the revision -- thank you once again. Please let us know if there is still any misunderstanding in our response, and we are happy to try again.\n\n## Intuitive explanation of top Lyapunov vectors\nFirst we begin with what a Lyapunov vector is in our context of a finite-time nonautonomous dynamical system (nonautonomous means that the transformation at time $t,$ denoted $F_t,$ is itself a function of time). As described in the paper, the eigenvectors of $(\\nabla F^t)(\\nabla F^t)^\\top$ or equivalently the left singular vectors of $\\nabla F^t$ are the finite-time Lyapunov vectors we use. Please see the following references: Young J Physics 2013, Ginelli et al J. Physics, 2013, for the theory of Lyapunov vectors (in the time-asymptotic case), in addition to the references cited in the paper.\n\nTo understand what these left singular vectors mean, we can consider any unit vector, say, $y_0 \\in \\mathbb{R}^D$ and its evolution under the linearized dynamics (please also see the response to a similar question by Reviewer 678s) that dictates how an infinitesimal perturbation to the initial sample, say $x_0,$ propagates through $F^t,$ $y_t:= \\nabla F^t(x_0)  y_0.$ Now, the unit vector $y_t/\\|y_t\\|$ and the norm $\\|y_t\\|$ determine the direction and norm of the growth/decay of the perturbation applied to $x_0$ in the direction of $y_0.$ By definition of singular values and singular vectors, the $y_0$ that maximizes the stretch by $\\nabla F^t$ is its singular vector corresponding to its top singular value. There are $D$-many (possibly non-distinct) singular values and their logarithms divided by $t$ are referred to as finite-time Lyapunov exponents. The constructive definition of the most sensitive subspaces in section 3 of the paper is an approximate numerically stable algorithm (similar to QR iteration for computing eigenvectors) for computing the top $d$ ($\\leq D$) Lyapunov vectors. Thank you very much for asking this question and suggesting further numerical experiments to illustrate these concepts. Currently we show the top Lyapunov vector (the leading direction of infinitesimal perturbation growth) for the 2D generative model in Figure 1, and we have 2 other two-dimensional examples in Appendix G.2. We plan to add one more 2D example as you suggested, in which the target distribution will be supported on the circle, where it will be easy to visualize both the leading Lyapunov vector as well as alignment, which we describe next (please see response to Reviewer qRyA).\n\n## Intuitive explanation of the concept of alignment and its numerical verification\n\nAlignment means that the most sensitive subspace (the top $d$-Lyapunov vectors defined above) is parallel to the tangent space of the data manifold. As we discuss above, the tangent space of the $d$ data manifold ($M$) is a subspace of $\\mathbb{R}^D$ at each point. When the two subspaces, the most sensitive and the tangent to $M$ at each point on the boundary, this leads to the generative model learning the support, and this is our main result (Theorem 4.3).\n\nThe most sensitive subspace refers to directions of maximum error propagation in the dynamics $F^t.$ Therefore, for a sample at time $\\tau,$ an incorrect dynamics leads to shifts along this subspace. When this subspace is the same as $TM$ infinitesimal errors cause perturbations along $M$, but not away from it. This is what Figure 1 illustrates, where there is alignment. When alignment is not present (for example, with CFM in Figures 5 and 6 of the Appendix), we see that learning errors in the drift term can cause samples to move away from the data manifold. One way to make this argument more quantitative is via Proposition 4.1, which we describe next.\n\n## Definition of classification margin and why margin does not change under alignment\n\nFor binary classification by a hyperplane classifier, margin is the minimum distance between the training points and the classifying hyperplane. The relationship between the margin and generalization of a binary classifier is a well-known part of statistical learning (see e.g., Mohri et al 2018). In our context, we leverage these classical results for a kernel binary classifier to quantitatively describe how an incorrect model can still learn the support.\n\nLearning the support of a probability distribution can be cast as a problem of a one-class binary classification: given only positive samples (that is, points from the support), learn a binary function that evaluates to -1 when samples are out-of-support. If we use the generated samples as positive training samples, can we learn the correct classifier for the target distribution? The main novelty of the proof is the recognition that alignment is the condition under which the margin of a classifier learned with true samples and one with samples from an incorrect generative model coincide. This leads to identical generalization bounds and thus we obtain quantitative estimates on how well an aligned generative model can learn the support. Thank you! We will add an abridged version of this response to the revision.\n\nThe incorrect generative model is only a small perturbation of an ideal GM. This is what is captured by **convergence**. We refer to the existing literature on convergence of GMs. We consider a convergence result from Lee, Lu and Tan in COLT 2023. Suppose the score is learned with an L2 error $\\mathcal{\\epsilon}$. Then, they show that the W2 distance between the predicted density, and the target is $\\mathcal{O}(\\epsilon^{1/18})$. We use this result and optimal transport theory combined with margin-based classification bounds (above) to obtain Proposition 4.1. Please see Appendix D for more. We plan to add the definition of convergent GMs to the main text. \n\n## Implications of Theorem 4.3: sufficient conditions for alignment\n\n1. When alignment holds, the most sensitive subspaces directly give the tangent basis to the data manifold. This construction exploits the dynamics of generative models and thus provides an efficient way to learn the data manifold. This point appears in the paper after the proof of 4.3.\n\n2. The recursive equation for the score component along the data manifold, given in Eq. 4, provides mathematical insight into how errors in generative models propagate to the predicted density to either produce or preclude alignment. This equation (see also our answers to Reviewer qRyA) is how the dynamics affects alignment. For example, it says that positive finite-time LEs, i.e., expanding sample space volume, can make it easier for alignment to hold. Thus, this can lead to a principled basis on which to distinguish between the many existing GM algorithms.\n\n3. We can rederive Eq. 4 and control the left hand side by replacing $F_t$ with a deliberately perturbed generative model, e.g., $F_t \\to F_t + u_t,$ a controlled dynamical system. Minimizing the new left hand side over all $u_t$ will produce alignment in the controlled generative model. The same approach can produce another desired property, e.g., for unlearning. Thus, the techniques used in 4.3 are applicable for controlling generative models, going beyond alignment (please see our response to Reviewers 678s and gbmB).\n\n**verifying alignment in practice**: this is an excellent question! In low-dimensional examples, such as Figure 1 of the main text and Figures 5 and 6 of the Appendix, we can directly visualize the tangent spaces to the data manifold and the most sensitive subspaces, and therefore alignment. For high-dimensional examples, we have developed two indirect ways of verifying alignment:\n\n1. In Fig 2 of the main paper and Fig 3 of the Appx, the indirect verification is based on moving along the most sensitive subspace (easy to compute using their definitions, see section 3) and check if we still obtain a sample on M. If yes, alignment holds.\n\n2. When M is low-dimensional (see answers to Reviewers 678y and qRYa), the target score is orthogonal to $TM$. Thus, alignment essentially means orthogonality of the score and the most sensitive subspaces. This is what is used in Figs 2 and 5-6 in the Appendix. This approach is scalable.\n\n## Definition of regularity of alignment\n\nRegularity of a property, across different areas of math, means stability of the property under perturbations. In our context, we ask whether a GM with alignment will also retain alignment under perturbations. The answer is yes, as shown in the paper. This is helpful in practice because if we build a GM with alignment, we do not need to worry that even a smooth perturbation will ruin the alignment.\n\n## Why do cross-derivatives have small norm?\n\nThank you for this great observation whose explanation we have omitted on line 311. In an SGM, the drift term is the same as the score. Therefore, near time $\\tau,$ the drift vector field has the same structure as the target score. Now, the target score is undefined at $\\tau$ and has uniformly large values pointing away from M under the manifold hypothesis when $t$ is close to $\\tau$. Because of this, the score component orthogonal to M does not change drastically in the direction of data manifold (along $E^d_t$), since it takes on uniformly large values. Similarly, the score component tangent to the data manifold is changing more rapidly in the tangent direction, indicating the fine-grained features of the target probability density, when compared to in the orthogonal direction. This is because the density outside the support is zero uniformly. You are right that this message will be enhanced with the mixture of Gaussians (vonMises distributions) example that you suggested. \n\nThank you again for your time, and we would be very grateful if you could reassess our contributions in light of our answers and revisions."}, {"review_id": "oENPbFs8Nf", "reviewer": "Reviewer_gbmB", "summary": "This paper explores the surprising empirical observation that generative models GMs often generate samples that remain close to the support of the data distribution—even when the learned score function is inaccurate. The authors investigate this phenomenon through a dynamical systems lens, modeling the generative process as a random dynamical system and conducting a perturbation analysis on both the probability flows and sample paths.", "questions": "The current theory provides sufficient conditions for robustness. Are there indications of necessary conditions, or empirical observations of counterexamples that satisfy some but not all conditions?\n\nCould the alignment property be enforced or encouraged during training via a regularization term?\n\nYour results are framed for infinitesimal or small perturbations. How does the theory behave when learning errors are non-negligible?", "limitations": "Yes", "rating": 5, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 3, "significance": 4, "originality": 4, "strengths_and_weaknesses": "Strengths\n- this is an excellent high-quality paper with deep general insights into the robustness and behavior of the main generative models used today.\n- the results are extremely general, applying to all practical implementations of GMs\n- the results are clear, extremely significant, and original\n- theoretical analysis is rigorous, with careful derivation of perturbation response fields and a novel use of finite-time Lyapunov theory.\n- sufficient conditions for support robustness are justified and grounded in both empirical observation and mathematical derivation.\n- The paper is well-structured, guiding the reader through a difficult topic with illustrative examples and clear definitions.\n- It connects geometry, dynamical systems, and deep generative models in a novel way that could influence future design and evaluation.\n\nweaknesses:\n- Concrete suggestions to improve to GMs are not mentioned, even vague suggestions would be welcome.", "was_revised": true, "final_justification": "The author has addressed concerns in the review. Recommend an accept.", "rebuttal": "We really appreciate all your keen observations about our paper, the great questions and your encouraging review! In line with your comments, we believe that connecting the dynamics of GMs to the geometry of the data manifold will help us improve both theory and algorithms for GMs. One suggestion we have (and are currently working on) is solve control problems to fine-tuning GMs to ensure specific properties, as we mention in the response to Reviewers YsYs and 678s. Here are a few ideas: \n\n   1. **Studying guided diffusions**: we can take our dynamical systems approach to understand guided SGMs, where an additive drift term changes the target distribution. Apart from analysis of the theory of guided diffusions (how to use them for Bayesian posterior sampling etc), there remain many open questions on how to use guidance for rare event sampling (guiding toward low-probability regions) and for unlearning (guiding away from certain regions of the target support). Taking the dynamical systems approach in such problems will provide a new perspective compared to existing optimal control or learning theoretic approaches to both understand and improve guidance. We believe that in viewing guidance as a control problem (please see responses to Reviewers YsYs and 678s), the most sensitive subspaces we define here can act as a good basis to reduce the dimension of the desired control. Therefore, the dimension of the control or fine-tuning optimization will reduce to the intrinsic dimension as opposed to the ambient dimension, thus also making learning algorithms for such controls feasible. \n\n   2. **Transfer operators**: while this discussion is outside the scope of the paper, an operator theoretic view of the dynamics, via Koopman or transfer operators, is also underexplored in the GM literature. The transfer operator gives the evolution of probability densities under the dynamics. This means that when we consider perturbations to transfer operators due to errors in the dynamics, we can obtain fine-grained control over errors in the predicted probability density. In the computational dynamics literature, there have recently been exciting developments in scalable spectral approximations of these transfer operators. It would be very impactful to consider how the availability of approximate transfer operators can help us build GMs with controlled errors. \n\n\n## Necessary conditions\n\nYou are absolutely correct that the current theory only proves sufficient conditions for robustness of the support. Using the recursion for the score (like Eq. 4) however, we can give a partial answer to your question about necessary conditions. Consider a generative model that expands sample space volume in $(TM)^\\perp$, that is, orthogonal to the data manifold. In effect, this amounts to the opposite of alignment: the least stable Lyapunov vectors are orthogonal to the data manifold at the boundary. In addition, if these directions are expanding, that is, $\\mathrm{det}(\\prod_t R_t) > 1,$ then, any small errors will cause samples to shift away from the data manifold. This will necessarily lead to lack of robustness of the support. Therefore, one necessary condition is not having complete misalignment or orthogonality of $E^d_t$ and $TM.$ \n\nThank you for the very interesting question on examples violating the sufficient conditions of 4.3. We have one such example in Figures 5-6 of the Appendix. Curiously, here, we observe that the sufficient conditions i and ii hold while iii on the cross-derivatives of the drift terms in a conditional flow-matching model is not necessarily satisfied. In this setup, we find that alignment only partially holds, as Figure 6 (left) shows. Your question leads us to ask if having small cross-derivatives (see also our responses to Reviewer YsYs) and a huge attractive force toward the target support is necessary for alignment. Unfortunately, our results neither support nor disagree with this. \n\n## Fine-tuning to ensure alignment\n\nWe believe that alignment can be enforced with a regularization term, as you suggest, or as an additional objective function to fine-tune pretrained GMs (this is our current work in progress). The main idea (also in the response to Reviewer YsYs) is as follows. For alignment to hold, using the proof of Theorem 4.3, the score component along the most sensitive subspace, $s_t E^d_t,$ must decrease with $t$ and become arbitrarily small as $t \\to \\tau$ on the boundary of $M.$ Since $s_t E^d_t$ satisfies a recursive relationship, as we show in Eq. 3, we can add the recursion to the usual score-matching or flow-matching loss to be minimized: $\\sum_t \\|s_{t+1} E^d_{t+1} - s_t E^d_t R_t^{-1} - w_t E^d_t R_t^{-1} \\|^2.$ Additionally, since we want to minimize $s_\\tau E^d_\\tau$ to produce alignment, we can add its norm as a regularizer. Since both these terms only depend on the dynamics (solution map $F_t$) and are computable only using the linear algebraic calculations we describe in section 3, the loss function will have a feasible computation that would retain automatic differentiability. Moreover, since the score recursion essentially captures the fact that the dynamics $F^t$ acts as a transport map between the source and target distributions, perhaps this can be used to isolation, without needing the score-matching or flow-matching type loss functions. We believe this idea amounts to knowledge distillation or self-distillation for GMs but derived in a more general context, and we will explore this connection in our future work.  \n\n## Non-negligible perturbations\n\nWhen learning errors are non-negligible, none of the linear perturbation analysis we carry out in our present paper applies! Nevertheless, viewing the generating process as a random/nonautonomous dynamical system is still valuable in the following ways.\n\n1.  Under large perturbations, we can treat the incorrect generating process as a completely different dynamical system, say $G_t$. Now, when can $F_t$ (original dynamics) and $G_t$, which are completely different transformations, have the same final density? Since $F_t$ and $G_t$ are different, so are their transfer/Frobenius-Perron operators, say, $\\mathcal{L}_t$ and \n$\\mathcal{P}_t$ respectively. Now, since we know the approximate spectral properties (using standard operator approximation methods) of $\\mathcal{L}^\\tau$, we can reproduce this approximation on a finite-dimensional space for $\\mathcal{P}^\\tau$. In other words, even though the one-step dynamics and the corresponding probability evolutions do not match, we can use the final transfer operator approximation to train a new dynamical system with the same finite-dimensional approximation.\n\n2. In the above, we have not utilized perturbation theory of operators. Control theory however still applies. Again, let the incorrect generative model be $G_t$ and $F_t$ be the true model that is unknown but produces the correct probability density. We can think of using orbits of $G_t$ the incorrect model with the learning errors to recover the ground truth $F_t$ even if $G_t$ is not a small perturbation. For instance, consider an invertible coordinate transformation $\\Phi$ (an encoder or lift represented by a neural network) such that $F_t = \\Phi \\circ G_t \\circ \\Phi^{-1}$. Given the desired properties, say alignment that are present in $F_t$, how can we ensure that these hold for $G_t$, the given dynamics? This question can be theoretically analyzed via techniques used to study conjugacies (although these typically consider $\\Phi $ to be a small perturbation of the identity) in dynamical systems. Practically, we can consider the problem of training a neural network $\\Phi$ to effect desired properties on $G_t$ using only samples from $F^\\tau$. These are preliminary ideas that we hope to explore in our future work.\n\nPlease let us know if you would like additional elaboration on any of the answers above! We are extremely grateful to you once again for the thought-provoking questions that can spur future efforts in this direction."}]

Author rebuttal:

Meta-review: In this paper, the authors analyze both stochastic and deterministic dynamical generative models to explain a robustness phenomenon: learning errors in the score or drift field tend to move generated samples along the data manifold rather than away from it. Using perturbation analysis of probability flows and sample paths, they show that the predicted density differs from the target density only on the data manifold. They identify the cause as an alignment between the most sensitive perturbation direction and the tangent space of the manifold, prove a sufficient condition for this alignment, and show that it is efficient to compute. The results apply to different dynamical  generative models, regardless of whether the manifold hypothesis holds, and the theory is validated with a basic experimental setting.

The reviewers acknowledge that the paper offers a significant theoretical analysis that helps explain phenomena previously observed empirically. In particular, the paper:

1. introduces a mathematical framework connecting geometry, dynamical systems, and deep generative models, using perturbation theory to analyze the dynamics, This framework applies to a wide range of models and provides insights into their robust behavior

2. presents theoretical results that appear rigorous and sound, supported by the provided experiments

3. addresses a relevant problem with the potential for significant impact

Some concerns were raised, mainly regarding the clarity and accessibility of the manuscript. While most of these points were addressed in the rebuttal, the paper would benefit from including high-level explanations of the theoretical results, along with visualizations to help build intuition around the key concepts. I therefore recommend acceptance and encourage the authors to consider the feedback and update the final version of the paper accordingly.
Decision: Accept (poster)