Difference from transformation-based directions. Our 562 method is related at a high level to defenses that infer a 563 recovery direction from multiple transformed views, espe564 cially DBD. The crucial difference is how that direction 565 is obtained and used. We use symmetric local probes to 566 measure odd–even geometry, perform an explicit +∇Ev 567 restoration in image space, and then read the resulting score 568 displacement. Thus the direction in the final readout is the 569 trajectory of an actual restoration step. This distinction mo570 tivates a useful control for future study: replacing the Ev 571 trajectory with a generic augmentation-induced displace572 ment should not reproduce the same gain if restoration573 specific semantics are essential.

Difference from transformation-based directions. Our 562 method is related at a high level to defenses that infer a 563 recovery direction from multiple transformed views, espe564 cially DBD. The crucial difference is how that direction 565 is obtained and used. We use symmetric local probes to 566 measure odd–even geometry, perform an explicit +∇Ev 567 restoration in image space, and then read the resulting score 568 displacement. Thus the direction in the final readout is the 569 trajectory of an actual restoration step. This distinction mo570 tivates a useful control for future study: replacing the Ev 571 trajectory with a generic augmentation-induced displace572 ment should not reproduce the same gain if restoration573 specific semantics are essential.