# Class group Statistics for torsion fields generated by elliptic curves

Anwesh Ray  Department of Mathematics
University of British Columbia
Vancouver BC, Canada V6T 1Z2<EMAIL_ADDRESS>and  Tom Weston
Department of Mathematics, University of Massachusetts, Amherst, MA, USA.
<EMAIL_ADDRESS>
###### Abstract.

For a prime $p$ and a rational elliptic curve $E_{/\mathbb{Q}}$, set
$K=\mathbb{Q}(E[p])$ to denote the torsion field generated by
$E[p]\mathrel{\mathop{\mathchar
58\relax}}=\operatorname{ker}\\{E\xrightarrow{p}E\\}$. The class group
$\operatorname{Cl}_{K}$ is a module over $\operatorname{Gal}(K/\mathbb{Q})$.
Given a fixed odd prime number $p$, we study the average non-vanishing of
certain Galois stable quotients of the mod-$p$ class group
$\operatorname{Cl}_{K}/p\operatorname{Cl}_{K}$. Here, $E$ varies over all
rational elliptic curves, ordered according to _height_. Our results are
conditional, and rely on predictions made by Delaunay and Poonen-Rains for the
statistical variation of the $p$-primary parts of Tate-Shafarevich groups of
elliptic curves. We also prove results in the case when the elliptic curve
$E_{/\mathbb{Q}}$ is fixed and the prime $p$ is allowed to vary.

###### Key words and phrases:

Torsion fields, class groups, Selmer groups of elliptic curves, arithmetic
statistics

###### 2020 Mathematics Subject Classification:

11G05, 11R29, 11R32, 11R34, 11R45

##  1\. Introduction

Given a family of number fields, it is natural to study the statistical
variation of class groups in the family. Of significant interest is the family
of imaginary quadratic extensions $K/\mathbb{Q}$. Such investigations go back
to the work of Gauss, who was interested in the determination of all imaginary
quadratic fields of a given class number $h$. The problem was solved for $h=1$
by Baker, Heegner and Stark, for $h=2$ by Baker and Stark and for $h=3$ by
Oesterlé. Watkins in [Wat04] computed the imaginary quadratic fields for which
$h\leq 100$. Soundararajan showed that the number of imaginary quadratic
fields of class number $<x$ is asymptotically
$\frac{3\zeta(2)}{\zeta(3)}x^{2}$ as $x\rightarrow\infty$. The story for real
quadratic fields is significantly different. Predictions can be made for the
distribution of class groups via Cohen-Lenstra heuristics for all quadratic
number fields [CL84] and Cohen-Lenstra-Martinet heuristics for general number
fields [MC90]. We refer to [Woo16] for a survey of these methods. The study of
class numbers on average in families of number fields has notably gained
significant momentum in the following works [DH71, Won99, Bha05, FK07, EV07,
EPW17, HJK+19, BST+20, Kly20, WW21, PTBW20, PTBMW21].

Motivated by such developments, we consider the family of number field
extensions that are generated by the torsion in elliptic curves defined over
$\mathbb{Q}$. To be specific, given an elliptic curve $E_{/\mathbb{Q}}$, and a
prime $p$, we let $E[p]$ denote the $p$-torsion subgroup of
$E(\bar{\mathbb{Q}})$. Let $K=\mathbb{Q}(E[p])$ be the field generated by
$E[p]$, defined to be the fixed field of the residual representation

$\bar{\rho}\mathrel{\mathop{\mathchar
58\relax}}\operatorname{Gal}(\bar{\mathbb{Q}}/\mathbb{Q})\rightarrow\operatorname{GL}_{2}(\mathbb{F}_{p})$

on $E[p]\simeq\mathbb{F}_{p}\oplus\mathbb{F}_{p}$. Let $\operatorname{Cl}_{K}$
be the class group of $K$. Note that $G=\operatorname{Gal}(K/\mathbb{Q})$ acts
on $\operatorname{Cl}_{K}$ and thus on the mod-$p$ class group
$\operatorname{Cl}_{K}/p\operatorname{Cl}_{K}$. We study Galois stable
quotients of the $\operatorname{Cl}_{K}/p\operatorname{Cl}_{K}$ that are
isomorphic to $E[p]$ as a $G$-module. More specifically, we study the
following related questions.

  1. (1)

Let $p$ be a fixed odd prime. As $E$ varies over all elliptic curves defined
over $\mathbb{Q}$, how often is
$\operatorname{Hom}_{G}\left(\operatorname{Cl}_{K}/p\operatorname{Cl}_{K},E[p]\right)$
non-vanishing?

  2. (2)

Let $E_{/\mathbb{Q}}$ be a fixed elliptic curve. As $p$ varies over all
primes, how does the dimension of
$\operatorname{Hom}_{G}\left(\operatorname{Cl}_{K}/p\operatorname{Cl}_{K},E[p]\right)$
vary?

In the context of the first question above, we order elliptic curves
$E_{/\mathbb{Q}}$ according to _height_. Our results rely on heuristics for
the statistical behavior of Tate-Shafarevich groups of elliptic curves. These
heuristics are based on random matrix theory and were initially studied by
Delaunay [Del07] and generalized by Poonen and Rains [PR12]. Let
$\mathcal{E}_{p}$ be the set of elliptic curves $E_{/\mathbb{Q}}$ such that
$\operatorname{Hom}_{G}(\operatorname{Cl}_{K},E[p])\neq 0$. Given
$\Delta\in\mathbb{Z}_{<0}$ with $\Delta\equiv 0,1\mod{4}$, let $H(\Delta)$ be
Hurwitz class number, see Definition 3.10. Given a set of elliptic curves
$\mathcal{S}$, we denote by $\underline{\mathfrak{d}}(\mathcal{S})$ the lower
density of Weierstrass equations for elliptic curves in $\mathcal{S}$ (see
(3.1) for the definition of $\underline{\mathfrak{d}}(\mathcal{S})$).

######  Theorem (Theorem 4.4).

Let $p$ be an odd prime, and assume that Conjecture 4.2 is satisfied. Then, we
have that

$\underline{\mathfrak{d}}(\mathcal{E}_{p})>(p^{-1}+p^{-3}-p^{-4})(1-p^{-1}-\mathfrak{d}_{p}-\mathfrak{d}_{p}^{\prime}),$

where

$\mathfrak{d}_{p}=\begin{cases}\zeta(p)-1&\text{ if }p\geq 5,\\\
(\zeta(3)-1)+(\zeta(4)-1)+(\zeta(7)-1)&\text{ if }p=3,\\\ \end{cases}$
$\mathfrak{d}_{p}^{\prime}=\begin{cases}\left(\frac{p-1}{2p^{2}}\right)H(1-4p)&\text{
if }p\geq 7,\\\
\left(\frac{p-1}{2p^{2}}\right)\left(H(1-4p)+H(p^{2}+1-6p)\right)&\text{ if
}p\leq 5.\\\ \end{cases}$

We obtain the following Corollary to the above result.

######  Corollary (Corollary 4.5).

Let $p$ be an odd prime, and assume that Conjecture 4.2 is satisfied. Then, we
have that

$\underline{\mathfrak{d}}(\mathcal{E}_{p})\geq p^{-1}+O(p^{-3/2+\epsilon}).$

In other words, for any choice of $\epsilon>0$ there is a constant $C>0$,
depending on $\epsilon$ and independent of $p$, such that

$\underline{\mathfrak{d}}(\mathcal{E}_{p})\geq p^{-1}-Cp^{-3/2+\epsilon}.$

Next, we study the second question, where $E$ is fixed and $p$ varies. In this
context, we prove two results.

######  Theorem (Theorem 5.1).

Let $E_{/\mathbb{Q}}$ be an elliptic curve and assume that the following
conditions are satisfied,

  1. (1)

$\Sh(E/\mathbb{Q})$ is finite,

  2. (2)

$\operatorname{rank}E(\mathbb{Q})\leq 1$,

  3. (3)

$E$ does not have complex multiplication.

Then, for $100\%$ of primes $p$, we have that
$\operatorname{Hom}_{G}(\operatorname{Cl}_{K}/p\operatorname{Cl}_{K},E[p])=0$.

######  Theorem (Theorem 5.2).

Let $E_{/\mathbb{Q}}$ be an elliptic curve and assume that the following
conditions are satisfied,

  1. (1)

$\operatorname{rank}E(\mathbb{Q})\geq 2$,

  2. (2)

$E$ does not have complex multiplication.

Then, for $100\%$ (i.e., for a Dirichlet density $1$ set) of primes $p$, we
have that

$\operatorname{dim}\operatorname{Hom}_{G}(\operatorname{Cl}_{K}/p\operatorname{Cl}_{K},E[p])\geq\operatorname{rank}E(\mathbb{Q})-1.$

_Organization:_ In section 2, we introduce preliminary notions and also recall
results of Prasad and Shekhar [PS21] on the Galois module structure of the
class group of the torsion field $\mathbb{Q}(E[p])$. In section 3, we study
the density of elliptic curves satisfying local conditions at a possibly
infinite set of primes. Such results are crucially used in proving the main
results of the article. In section 4, we fix an odd prime $p$. The main
results are Theorem 4.4 and Corollary 4.5, which establish that
$\operatorname{Hom}_{G}(\operatorname{Cl}_{K}/p\operatorname{Cl}_{K},E[p])$ is
non-vanishing for a positive density set of elliptic curves. Furthermore, we
prove a lower bound for this density explicitly. These results are conditional
since it relies on the heuristic of Poonen and Rains. In section 5, we fix an
elliptic curve $E_{/\mathbb{Q}}$ which does not have complex multiplication
and study the variation of the dimension of
$\operatorname{Hom}_{G}\left(\operatorname{Cl}_{K}/p\operatorname{Cl}_{K},E[p]\right)$,
where $p$ varies over all prime numbers. Finally, in section 6 we provide
explicit computations for the prime $p=3$. These computations do also
illustrate cases of interest, when some of the hypotheses on $E$ and $p$ are
relaxed.

##  2\. Preliminaries

Fix an algebraic closure $\bar{\mathbb{Q}}$ of $\mathbb{Q}$ and let $E$ be an
elliptic curve defined over $\mathbb{Q}$. Set
$\mathbb{F}_{p}=\mathbb{Z}/p\mathbb{Z}$ to denote the finite field of $p$
elements. Let $p$ be a prime number and for $n\geq 1$, denote by $E[p^{n}]$
the kernel of the multiplication map $\times p^{n}\mathrel{\mathop{\mathchar
58\relax}}E(\bar{\mathbb{Q}})\rightarrow E(\bar{\mathbb{Q}})$, and set
$E[p^{\infty}]\mathrel{\mathop{\mathchar 58\relax}}=\bigcup_{n}E[p^{n}]$. The
absolute Galois group $\operatorname{G}_{\mathbb{Q}}\mathrel{\mathop{\mathchar
58\relax}}=\operatorname{Gal}(\bar{\mathbb{Q}}/\mathbb{Q})$ acts on
$E[p^{n}]$. Choosing an isomorphism
$E[p^{n}]\simeq\left(\mathbb{Z}/p^{n}\mathbb{Z}\right)^{2}$, let $\rho_{n}$ be
the associated Galois representation on $E[p^{n}]$,

$\rho_{n}\mathrel{\mathop{\mathchar
58\relax}}\operatorname{G}_{\mathbb{Q}}\rightarrow\operatorname{GL}_{2}(\mathbb{Z}/p^{n}\mathbb{Z}).$

Set $\rho\mathrel{\mathop{\mathchar 58\relax}}=\varprojlim_{n}\rho_{n}$ to be
the Galois representation on the $p$-adic Tate-module
$\operatorname{T}_{p}(E)\mathrel{\mathop{\mathchar
58\relax}}=\varprojlim_{n}E[p^{n}]$. Set $\bar{\rho}$ to denote the mod-$p$
reduction of the characteristic-zero representation
$\rho\mathrel{\mathop{\mathchar
58\relax}}\operatorname{G}_{\mathbb{Q}}\rightarrow\operatorname{GL}_{2}(\mathbb{Z}_{p})$.
We shall refer to $\bar{\rho}$ as the _residual representation_ and identify
$\rho_{1}\mathrel{\mathop{\mathchar
58\relax}}\operatorname{G}_{\mathbb{Q}}\rightarrow\operatorname{GL}_{2}(\mathbb{F}_{p})$
with $\bar{\rho}$. Let $\chi\mathrel{\mathop{\mathchar
58\relax}}\operatorname{G}_{\mathbb{Q}}\rightarrow\mathbb{Z}_{p}^{\times}$ be
the $p$-adic cyclotomic character, and $\bar{\chi}\mathrel{\mathop{\mathchar
58\relax}}\operatorname{G}_{\mathbb{Q}}\rightarrow\mathbb{F}_{p}^{\times}$ its
mod-$p$ reduction.

Given an integer $r$, set $\mathbb{Z}_{p}(r)\mathrel{\mathop{\mathchar
58\relax}}=\mathbb{Z}_{p}(\chi^{r})$ and given a
$\mathbb{Z}_{p}[\operatorname{G}_{\mathbb{Q}}]$-module $M$, set
$M(r)\mathrel{\mathop{\mathchar
58\relax}}=M\otimes_{\mathbb{Z}_{p}}\mathbb{Z}_{p}(\chi^{r})$ to denote the
_$r$ -th Tate-twist_ of $M$. Note that if $M$ is an
$\mathbb{F}_{p}[\operatorname{G}_{\mathbb{Q}}]$-module, then,
$M(r)=M\otimes_{\mathbb{F}_{p}}\mathbb{F}_{p}(r)$. Let $V_{\bar{\rho}}=E[p]$
be the underlying vector space for $\bar{\rho}$. Given $i,j\in\mathbb{Z}$
lying in the range $1\leq i\leq(p-1)$ and $1\leq j\leq(p-2)$, we set
$V^{i,j}=V^{i,j}_{p,E}$ to denote $\operatorname{Sym}^{i}(V_{\bar{\rho}})(j)$.
Throughout, we shall assume that $\bar{\rho}$ is irreducible. However, for the
sake of discussion, let us consider the special case when $\bar{\rho}$ is
surjective. Then, upon choosing a basis of $V_{\bar{\rho}}=E[p]$, we may
identify the image of $\bar{\rho}$ with
$\operatorname{GL}_{2}(\mathbb{F}_{p})$ and thus the module $V^{i,j}$ is
viewed as an irreducible representation of
$\operatorname{GL}_{2}(\mathbb{F}_{p})$. Note that any irreducible
representation of $\operatorname{GL}_{2}(\mathbb{F}_{p})$ over
$\mathbb{F}_{p}$ is of the form $V^{i,j}$. A semisimple module $M$ over
$\mathbb{F}_{p}[\operatorname{G}_{\mathbb{Q}}]$ decomposes into a direct sum

$M\simeq\bigoplus_{i,j}\left(V^{i,j}\right)^{r_{i,j}(M)},$

where $r_{i,j}(M)\geq 0$.

Let $K=\mathbb{Q}(E[p])$ be the _splitting field_ of $\bar{\rho}$, taken to be
the Galois extension of $\mathbb{Q}$ given by
$K=\bar{\mathbb{Q}}^{\operatorname{ker}\bar{\rho}}$. Set
$G\mathrel{\mathop{\mathchar 58\relax}}=\operatorname{Gal}(K/\mathbb{Q})$, and
identify $G$ with the image of $\bar{\rho}$. Note that when $\bar{\rho}$ is
surjective, $G$ is identified with $\operatorname{GL}_{2}(\mathbb{F}_{p})$.
There is natural action of $G$ on the class group $\operatorname{Cl}_{K}$, and
thus on the mod-$p$ class group
$\operatorname{Cl}_{K}/p\operatorname{Cl}_{K}$. The study of the Galois module
structure of $\operatorname{Cl}_{K}/p\operatorname{Cl}_{K}$ shall be the
primary focus of this paper. When $\bar{\rho}$ is surjective, its semi-
simplification decomposes into a direct sum of irreducible representations of
$\operatorname{GL}_{2}(\mathbb{F}_{p})$

$\left(\operatorname{Cl}_{K}/p\operatorname{Cl}_{K}\right)^{\operatorname{ss}}\simeq\bigoplus_{i,j}\left(V^{i,j}\right)^{n_{i,j}}.$

We are specifically interested in the space of homomorphisms
$\operatorname{Hom}_{G}\left(\operatorname{Cl}_{K}/p\operatorname{Cl}_{K},E[p]\right)$.
Note that
$\operatorname{Hom}_{G}\left(\operatorname{Cl}_{K}/p\operatorname{Cl}_{K},E[p]\right)\neq
0$ precisely when there is a $G$-stable quotient of $\operatorname{Cl}_{K}$
which is isomorphic to $E[p]$. By class field theory, this corresponds to the
existence of an unramified $(\mathbb{Z}/p\mathbb{Z})^{2}$-extension $L$ of $K$
which is Galois over $\mathbb{Q}$, such that $\operatorname{Gal}(L/K)\simeq
E[p]$ as a module over $G=\operatorname{Gal}(K/\mathbb{Q})$. We have that

$n_{1,0}\geq\operatorname{dim}_{\mathbb{F}_{p}}\operatorname{Hom}_{G}\left(\operatorname{Cl}_{K}/p\operatorname{Cl}_{K},E[p]\right),$

with equality in the special case when the representation of $G$ on
$\operatorname{Cl}_{K}/p\operatorname{Cl}_{K}$ is semisimple.

Given a prime number $\ell$, let $\mathcal{E}$ be the Néron model of $E$ over
$\mathbb{Z}_{\ell}$. Let $E^{0}(\mathbb{Q}_{\ell})$ be the subset of points of
$E(\mathbb{Q}_{\ell})=\mathcal{E}(\mathbb{Z}_{\ell})$ which reduce modulo
$\ell$ to the identity component of $E_{/\mathbb{F}_{\ell}}$. Fix an absolute
value $|\cdot|_{p}\mathrel{\mathop{\mathchar
58\relax}}\mathbb{Q}_{p}^{\times}\rightarrow\mathbb{Q}^{\times}$, normalized
by $|p|_{p}^{-1}=p$. The _Tamagawa number_ at $\ell$ is set to be
$c_{\ell}(E)\mathrel{\mathop{\mathchar
58\relax}}=[E(\mathbb{Q}_{\ell})\mathrel{\mathop{\mathchar
58\relax}}E^{0}(\mathbb{Q}_{\ell})]$, and set
$c_{\ell}^{(p)}(E)\mathrel{\mathop{\mathchar
58\relax}}=|c_{\ell}(E)|_{p}^{-1}$. Therefore, $c_{\ell}(E)$ is a unit in
$\mathbb{Z}_{p}$ if and only if $c_{\ell}^{(p)}(E)=1$. We denote by
$\operatorname{Sel}_{p}(E/\mathbb{Q})$ the $p$-Selmer group of $E$ over
$\mathbb{Q}$ defined by

$\operatorname{Sel}_{p}(E/\mathbb{Q})\mathrel{\mathop{\mathchar
58\relax}}=\operatorname{ker}\left\\{H^{1}(\bar{\mathbb{Q}}/\mathbb{Q},E[p])\rightarrow\prod_{\ell}H^{1}\left(\bar{\mathbb{Q}}_{\ell}/\mathbb{Q}_{\ell},E(\bar{\mathbb{Q}}_{\ell})\right)[p]\right\\},$

where the restriction map for the prime $\ell$ is the composite

$H^{1}(\bar{\mathbb{Q}}/\mathbb{Q},E[p])\rightarrow
H^{1}(\bar{\mathbb{Q}}_{\ell}/\mathbb{Q}_{\ell},E[p])\rightarrow
H^{1}(\bar{\mathbb{Q}}_{\ell}/\mathbb{Q}_{\ell},E(\bar{\mathbb{Q}}_{\ell}))[p].$

The Tate-Shafarevich group

$\Sh(E/\mathbb{Q})\mathrel{\mathop{\mathchar
58\relax}}=\operatorname{ker}\left\\{H^{1}(\bar{\mathbb{Q}}/\mathbb{Q},E(\bar{\mathbb{Q}}))\rightarrow\prod_{l}H^{1}(\bar{\mathbb{Q}}_{l}/\mathbb{Q}_{l},E(\bar{\mathbb{Q}}_{l}))\right\\},$

fits into an exact sequence

$0\rightarrow
E(\mathbb{Q})/pE(\mathbb{Q})\rightarrow\operatorname{Sel}_{p}(E/\mathbb{Q})\rightarrow\Sh(E/\mathbb{Q})[p]\rightarrow
0,$

see [Coa00, p.8, (1)].

Note that
$\operatorname{dim}_{\mathbb{F}_{p}}E(\mathbb{Q})/pE(\mathbb{Q})=\operatorname{rank}E(\mathbb{Q})+\operatorname{dim}_{\mathbb{F}_{p}}E(\mathbb{Q})[p]$,
and since $\bar{\rho}$ is irreducible, $E(\mathbb{Q})[p]=0$, and thus,
$\operatorname{dim}_{\mathbb{F}_{p}}E(\mathbb{Q})/pE(\mathbb{Q})=\operatorname{rank}E(\mathbb{Q})$.
Hence, we find that

$\operatorname{dim}_{\mathbb{F}_{p}}\operatorname{Sel}_{p}(E/\mathbb{Q})=\operatorname{rank}E(\mathbb{Q})+\dim_{\mathbb{F}_{p}}\Sh(E/\mathbb{Q})[p].$

Due to the Cassels-Tate pairing, the $\mathbb{F}_{p}$-dimension of
$\Sh(E/\mathbb{Q})[p]$ is even. The following result show that there is an
explicit relationship between $\operatorname{Cl}_{K}/p\operatorname{Cl}_{K}$
and the $p$-torsion in the Tate Shafarevich group $\Sh(E/\mathbb{Q})$ and is
key to constructing quotients of
$\operatorname{Cl}_{K}/p\operatorname{Cl}_{K}$ that are isomorphic to $E[p]$.

######  Theorem 2.1 (Prasad-Shekhar).

Let $E$ be an elliptic curve over $\mathbb{Q}$ and $p$ be an odd prime number
at which $E$ has good reduction. With respect to notation above, suppose that
the following assumptions hold:

  1. (1)

$c_{\ell}^{(p)}(E)=1$ for all primes $\ell\neq p$,

  2. (2)

$E(\mathbb{Q}_{p})[p]=0$.

Then, we have that

(2.1)
$\operatorname{dim}_{\mathbb{F}_{p}}\operatorname{Hom}_{G}\left(\operatorname{Cl}_{K}/p\operatorname{Cl}_{K},E[p]\right)\geq\operatorname{rank}E(\mathbb{Q})+\dim_{\mathbb{F}_{p}}\Sh(E/\mathbb{Q})[p]-1.$

In particular, under the above assumptions, if $\Sh(E/\mathbb{Q})[p]\neq 0$,
or $\operatorname{rank}E(\mathbb{Q})\geq 2$, then,
$\operatorname{Hom}\left(\operatorname{Cl}_{K}/p\operatorname{Cl}_{K},E[p]\right)$
is non-zero.

###### Proof.

The inequality (2.1) follows from [PS21, Theorem 3.1]. The second assertion
follows from Corollary 3.2 of _loc. cit._ ∎

######  Definition 2.2.

Let $\mathcal{I}=\mathcal{I}_{p}(E)$ be the set of primes $\ell\neq p$ such
that

  * •

$E$ has split multiplicative reduction at $\ell$ and $E(\mathbb{Q}_{\ell})[p]$
has rank $1$,

  * •

$E$ has non-split multiplicative reduction at $\ell$ and
$E(\mathbb{Q}_{\ell})[p]$ and $E(\mathbb{Q}_{\ell}^{\operatorname{nr}})[p]$
has rank $1$.

######  Theorem 2.3 (Prasad-Shekhar).

Let $E_{/\mathbb{Q}}$ be an elliptic curve and $p$ an odd prime at which the
conditions of Theorem 2.1 are satisfied. Let $\mathcal{I}$ be the finite set
from Definition 2.2. Then, the following bound is satisfied

$\operatorname{Hom}\left(\operatorname{Cl}_{K}/p\operatorname{Cl}_{K},E[p]\right)\leq\operatorname{rank}E(\mathbb{Q})+\operatorname{dim}_{\mathbb{F}_{p}}\Sh(E/\mathbb{Q})[p]-1+\\#\mathcal{I}.$

###### Proof.

The above result is [PS21, Theorem 4.2]. ∎

Theorem 2.1 is crucially used in the proof of Theorem 4.4, which is our main
result. On the other hand, both Theorems 2.1 and 2.3 are applied to prove
results in the case when $E$ is a fixed elliptic curve and $p$ varies over all
primes at which $E$ has good reduction, see section 5.

##  3\. Density results for Weierstrass equations with local conditions

In this section, we recall results due to Cremona and Sadek [CS20] for the
density of elliptic curves $E_{/\mathbb{Q}}$ satisfying local conditions at a
prescribed set of primes. This set of primes may in fact be infinite. The
results in this section are used to study the proportion of elliptic curves
$E_{/\mathbb{Q}}$ ordered according to _height_ which satisfy the conditions
of Theorem 2.1. As always, we fix an odd prime $p$. Given a tuple of integers
$a=(a_{1},a_{2},a_{3},a_{4},a_{6})$ we have an associated elliptic curve
$E_{a}$ defined by the long Weierstrass equation

$Y^{2}+a_{1}XY+a_{3}Y=X^{3}+a_{2}X^{2}+a_{4}X+a_{6}.$

The _height_ of $E_{a}$ is defined as follows

$\operatorname{ht}(a)=\operatorname{ht}(E_{a})\mathrel{\mathop{\mathchar
58\relax}}=\operatorname{max}_{i}\\{|a_{i}|^{\frac{1}{i}}\\}.$

We let

$\begin{split}&b_{2}=a_{1}^{2}+4a_{2},b_{4}=a_{1}a_{3}+2a_{4},b_{6}=a_{3}^{2}+4a_{6},\\\
&b_{8}=a_{1}^{2}a_{6}+4a_{2}a_{6}-a_{1}a_{3}a_{4}+a_{2}a_{3}^{2}-a_{4}^{2},\\\
&\Delta(a)=-b_{2}^{2}b_{8}-8b_{4}^{3}-27b_{6}^{2}+9b_{2}b_{4}b_{6}.\end{split}$

Given a ring $R$, we let

$\mathcal{W}(R)=R^{5}=\\{a=(a_{1},a_{2},a_{3},a_{4},a_{6})|a_{i}\in R\\},$

and let $\Delta(a)=\Delta(E_{a})$ be the associated discriminant. Given a
prime $\ell$, let $\mathcal{W}_{M}(\mathbb{Z}_{\ell})$ be the subset of
$\mathcal{W}(\mathbb{Z}_{\ell})$ consisting of equations which are _minimal_
in the sense of [Sil09, section VII.1]. Recall that if $E$ is an elliptic
curve over $\mathbb{Q}_{\ell}$, the _Kodaira type_ is one of the following
choices

  * •

$\operatorname{I}_{0}$ if $E$ has good reduction;

  * •

$\operatorname{I}_{\geq 1}$ if $E$ has bad multiplicative reduction, of type
$\operatorname{I}_{m}$ for some $m\geq 1$.

  * •

Finally, if $E$ has bad additive reduction, we have the following choices:
$\rm{II}$, $\rm{III}$, $\rm{IV}$, $\rm{II}^{*}$, $\rm{III}^{*}$,
$\rm{IV}^{*}$, $\rm{I}_{0}^{*}$, $\rm{I}_{\geq 1}^{*}$, the latter meaning
type $\rm{I}_{m}^{*}$ for some $m\geq 1$.

We refer to [Sil94, IV, section 9] for a comprehensive study of Kodaira types
and how they may be detected via Tate’s algorithm. For
$a\in\mathcal{W}(\mathbb{Z}_{\ell})$, we say that $a$ has Kodaira type $T$ if
the associated elliptic curve $E_{a}$ has Kodaira type $T$. Note that this
definition applies to non-minimal Weierstrass equations as well. Given a
Kodaira type $T$, let $\mathcal{W}^{T}(\mathbb{Z}_{\ell})$ be the subset of
$\mathcal{W}(\mathbb{Z}_{\ell})$ of tuples $a$ of Kodaira type $T$, and set
$\mathcal{W}_{M}^{T}(\mathbb{Z}_{\ell})=\mathcal{W}^{T}(\mathbb{Z}_{\ell})\cap\mathcal{W}_{M}(\mathbb{Z}_{\ell})$.
Let $\mu$ be the Haar measure on
$\mathcal{W}(\mathbb{Z}_{\ell})\simeq\mathbb{Z}_{\ell}^{5}$, and set
$\rho^{M}(\ell)\mathrel{\mathop{\mathchar
58\relax}}=\mu\left(\mathcal{W}_{M}(\mathbb{Z}_{\ell})\right)$. Given a
Kodaira type $T$ at the prime $\ell$, set

$\begin{split}&\rho^{M}_{T}(\ell)\mathrel{\mathop{\mathchar
58\relax}}=\mu\left(\mathcal{W}_{M}^{T}(\mathbb{Z}_{\ell})\right),\\\
&\rho_{T}(\ell)\mathrel{\mathop{\mathchar
58\relax}}=\mu\left(\mathcal{W}^{T}(\mathbb{Z}_{\ell})\right).\\\ \end{split}$

According to [CS20, Proposition 2.6], we have that
$\rho_{T}(\ell)=(1-\ell^{-10})^{-1}\rho^{M}_{T}(\ell)$. These local densities
are calculated in _loc. cit._ , and these calculations are summarized here.

######  Theorem 3.1 (Cremona-Sadek).

Let $\ell$ be a prime, then $\rho^{M}(\ell)=1-\ell^{-10}$. For each Kodaira
type $T$, the local density $\rho_{T}^{M}(\ell)$ is given by the following
values:

$T$ | $\rho_{T}^{M}(\ell)$
---|---
$\rm{I}_{0}$ | $(\ell-1)/\ell$
$\rm{II}$ | $(\ell-1)/\ell^{3}$
$\rm{III}$ | $(\ell-1)/\ell^{4}$
$\rm{IV}$ | $(\ell-1)/\ell^{5}$
$\rm{I}_{0}^{*}$ | $(\ell-1)/\ell^{6}$
$\rm{I}_{\geq 1}^{*}$ | $(\ell-1)/\ell^{7}$
$\rm{IV}^{*}$ | $(\ell-1)/\ell^{8}$
$\rm{III}^{*}$ | $(\ell-1)/\ell^{9}$
$\rm{II}^{*}$ | $(\ell-1)/\ell^{10}$
$\rm{I}_{m}$ | $(\ell-1)^{2}/\ell^{m+2}$
$\rm{I}_{\geq m}$ |  $(\ell-1)/\ell^{m+1}$.

###### Proof.

The above result follows from [CS20, Propositions 2.1 (3), 2.2, 2.5]. ∎

Let $\mathcal{S}$ be a subset of
$\mathcal{W}(\mathbb{Z})\simeq\mathbb{Z}^{5}$, the _density_ of $\mathcal{S}$
is taken to be the following limit

(3.1) $\begin{split}\mathfrak{d}(\mathcal{S})&\mathrel{\mathop{\mathchar
58\relax}}=\lim_{x\rightarrow\infty}\frac{\\#\\{a\in\mathcal{S}\mid\operatorname{ht}(a)<x\\}}{\\#\\{a\in\mathbb{Z}^{5}\mid\operatorname{ht}(a)<x\\}},\\\
&=\lim_{x\rightarrow\infty}2^{-5}x^{-16}\\#\\{a\in\mathcal{S}\mid|a_{i}|<x^{i}\text{
for }i=1,2,3,4,6\\}.\\\ \end{split}$

Note that the above limit may not exist. We let
$\overline{\mathfrak{d}}(\mathcal{S})$ and
$\underline{\mathfrak{d}}(\mathcal{S})$ be the upper and lower limit
respectively. Note that $\overline{\mathfrak{d}}(\mathcal{S})$ and
$\underline{\mathfrak{d}}(\mathcal{S})$ are defined by replacing the limit by
$\limsup$ and $\liminf$ respectively, and that these limits do exist
unconditionally. If $\mathcal{S}$ is a set of elliptic curves
$E_{/\mathbb{Q}}$, we shall by abuse of notation denote by $\mathcal{S}$ the
subset of $\mathcal{W}(\mathbb{Z})$ consisting of all tuples
$a=(a_{1},a_{2},a_{3},a_{4},a_{6})$ such that $E_{a}\in\mathcal{S}$. Note that
since we work with long Weierstrass equations, the choice of $a$ for a given
isomorphism class of elliptic curves is not unique. According to [CS20,
Theorem 1.1] the proportion of integral Weierstrass equation that are globally
minimal is $1/\zeta(10)=93555/\pi^{10}\approx 99.99\%$. Let $\Phi$ be a
possibly infinite set of prime numbers and for each prime $\ell\in\Phi$, let
$U_{\ell}$ be a subset of $\mathcal{W}(\mathbb{Z}_{\ell})$ defined by a set of
congruence classes. In other words, $U_{\ell}$ is the inverse image of a
subset of $\mathcal{W}(\mathbb{Z}/\ell^{M}\mathbb{Z})$ for some integer $M>0$.
Let $U$ be the family of conditions $\\{U_{\ell}\mid\ell\in\Phi\\}$. Given
$N>0$, let

$Z_{N}(U)\mathrel{\mathop{\mathchar
58\relax}}=\\{a\in\mathcal{W}(\mathbb{Z})\mid a\in U_{\ell}\text{ for some
prime }\ell>N\\}.$

######  Definition 3.2.

The family $U=\\{U_{\ell}\mid\ell\in\Phi\\}$ is said to be _admissible_ if

$\lim_{N\rightarrow\infty}\mathfrak{d}\left(Z_{N}(U)\right)=0.$

Let $\mathcal{W}_{U}$ be the set of integral Weierstrass equations
$a\in\mathcal{W}(\mathbb{Z})$ not satisfying $U_{\ell}$ at any prime
$\ell\in\Phi$.

######  Proposition 3.3.

Let $U$ be an admissible family and $s_{\ell}=\mu(U_{\ell})$. Then,
$\sum_{\ell\in\Phi}s_{\ell}$ converges and

$\mathfrak{d}(\mathcal{W}_{U})=\prod_{\ell\in\Phi}(1-s_{\ell}).$

###### Proof.

The above result follows from [CS20, Proposition 3.4]. ∎

######  Definition 3.4.

Given a Kodaira type $T$, let $U(T)$ be the family of conditions on the set of
primes $\ell\neq p$, where $U_{\ell}$ consists of local Weierstrass equations
$a\in\mathcal{W}(\mathbb{Z}_{\ell})$ satisfying $T$. Thus,
$\mathcal{W}_{U(T)}$ consists of integral Weierstrass equations
$a\in\mathcal{W}(\mathbb{Z})$ such that $E_{a}$ does not satisfy $T$ at any
prime $\ell\neq p$.

######  Lemma 3.5.

Let $T$ be a Kodaira type such that $U(T)$ is admissible, then, the density of
$\mathcal{W}_{U(T)}$ exists and equals

$\mathfrak{d}(\mathcal{W}_{U(T)})=\prod_{\ell\neq
p}\left(1-\rho_{T}(\ell)\right)\geq 1-\sum_{\ell\neq p}\rho_{T}(\ell).$

###### Proof.

The result follows directly from Proposition 3.3. ∎

######  Theorem 3.6.

Let $p$ and $\ell$ be distinct prime numbers, and $E$ an elliptic curve over
$\mathbb{Q}_{\ell}$. The following assertions hold.

  1. (1)

Suppose that $p\geq 5$, then, $p|c_{\ell}(E)$ if and only if $E$ has Kodaira
type $T=\operatorname{I}_{pm}$ for $m\in\mathbb{Z}_{\geq 1}$.

  2. (2)

Suppose that $p=3$, then, $p|c_{\ell}(E)$ if and only if $E$ has Kodaira type
$T=\operatorname{I}_{3m}$ for $m\in\mathbb{Z}_{\geq 1}$, or
$T=\operatorname{IV}$, or $T=\operatorname{IV}^{*}$.

###### Proof.

The result is well known, see [Sil94, Table 4.1, p.365]. ∎

We come to the main result of this section, which is subsequently used in the
proof of our main result in the next section.

######  Definition 3.7.

Recall that $p$ is a fixed prime number. Let $\mathcal{S}_{p}$ be the set of
elliptic curves $E_{/\mathbb{Q}}$ such that $p|c_{\ell}(E)$ for some prime
$\ell\neq p$.

######  Theorem 3.8.

Let $E$ be an elliptic curve and $p$ an odd prime number. We have the
following assertions

  1. (1)

if $p\geq 5$, then,

$\overline{\mathfrak{d}}(\mathcal{S}_{p})<\zeta(p)-1$

  2. (2)

if $p=3$, then,

$\begin{split}\overline{\mathfrak{d}}(\mathcal{S}_{p})&<(\zeta(3)-1)+(\zeta(4)-1)+(\zeta(7)-1).\end{split}$

###### Proof.

We prove the result on a case by case basis.

  1. (1)

First, we consider the case when $p\geq 5$. Then, by Theorem 3.6 (1), we have
that $p|c_{\ell}(E)$ if and only if the Kodaira type $T$ is
$\operatorname{I}_{mp}$ for some integer $m\geq 1$. Let
$U=U(\operatorname{I}_{\geq p})$ be the datum such that $U_{\ell}=I_{\geq p}$
at every prime $\ell\neq p$. It follows directly from the proof of [CS20,
Theorem 4.6] that the datum $U(\operatorname{I}_{\geq 2})$ is admissible, and
hence, so is $U$. From Lemma 3.5, we have that

$\begin{split}\mathfrak{d}(\mathcal{W}_{U})=&\prod_{\ell\neq
p}\left(1-(1-\ell^{-10})^{-1}(1-\ell^{-1})\ell^{-p}\right)\\\
\geq&\prod_{\ell\neq p}(1-\ell^{-p})\\\ \geq&1-\sum_{\ell\neq
p}\ell^{-p}.\end{split}$

Since $\mathcal{S}_{p}$ is contained in the complement of $\mathcal{W}_{U}$,
we find that

$\overline{\mathfrak{d}}(\mathcal{S}_{p})\leq\sum_{\ell\neq
p}\ell^{-p}<\zeta(p)-1.$

  2. (2)

We now consider the case when $p=3$. By Theorem 3.6 (2), we have that
$3|c_{\ell}(E)$ if and only if the Kodaira type $T$ is $\operatorname{I}_{3m}$
for some integer $m\geq 1$, or, $T=\rm{IV}$ or $T=\rm{IV}^{*}$. Let $U$ be
such that $U_{\ell}$ is the subset of $\mathcal{W}(\mathbb{Z}_{\ell})$ with
Kodaira type $\operatorname{I}_{\geq 3}$, $\rm{IV}$ or $\rm{IV}^{*}$
respectively. Note that $\ell^{2}$ divides $\Delta$ for such reduction types.
Admissibility is a direct consequence of the proof of [CS20, Theorem 4.6].

We find that

$\begin{split}\mathfrak{d}(\mathcal{W}_{U})\geq&\prod_{\ell\neq
p}\left(1-\rho_{\operatorname{I}_{\geq
3}}(\ell)-\rho_{\rm{IV}}(\ell)-\rho_{\rm{IV}^{*}}(\ell)\right)\\\
\geq&\prod_{\ell\neq
p}\left(1-(1-\ell^{-10})^{-1}(1-\ell^{-1})(\ell^{-3}+\ell^{-4}+\ell^{-7})\right)\\\
\geq&\prod_{\ell\neq p}\left(1-(\ell^{-3}+\ell^{-4}+\ell^{-7})\right)\\\
\geq&1-\sum_{\ell\neq p}\ell^{-3}-\sum_{\ell\neq p}\ell^{-4}-\sum_{\ell\neq
p}\ell^{-7}.\\\ >&1-(\zeta(3)-1)-(\zeta(4)-1)-(\zeta(7)-1).\end{split}$

Thus, we find that

$\overline{\mathfrak{d}}(\mathcal{S}_{p})<(\zeta(3)-1)+(\zeta(4)-1)+(\zeta(7)-1).$

∎

######  Definition 3.9.

Denote by $\mathcal{S}_{p}^{\prime}$ the set of elliptic curves $E$ for which
$p\nmid\Delta(E)$ and $E(\mathbb{Q}_{p})[p]\neq 0$. Note that for such
elliptic curves and $p>2$, $\widetilde{E}(\mathbb{F}_{p})[p]\neq 0$, where
$\widetilde{E}$ is the reduction of $E$.

Let $\Delta\in\mathbb{Z}_{<0}$ with $\Delta\equiv 0,1\mod{4}$, and set

$B(\Delta)\mathrel{\mathop{\mathchar
58\relax}}=\left\\{ax^{2}+bxy+cy^{2}\in\mathbb{Z}[x,y]\mid
a>0,b^{2}-4ac=\Delta\right\\}.$

The group $\operatorname{SL}_{2}(\mathbb{Z})$ acts on $\mathbb{Z}[x,y]$, where
a matrix $\sigma=\left({\begin{array}[]{cc}p&q\\\ r&s\\\ \end{array}}\right)$
sends $x\mapsto(px+qy)$ and $y\mapsto(rx+sy)$. Thus, if $f=ax^{2}+bxy+cy^{2}$,
the matrix $\sigma$ acts by

$f\circ\sigma=a(px+qy)^{2}+b(px+qy)(rx+sy)+c(rx+sy)^{2}.$

It can be checked that $B(\Delta)$ is stable under the action of
$\operatorname{SL}_{2}(\mathbb{Z})$ and
$B(\Delta)/\operatorname{SL}_{2}(\mathbb{Z})$ is finite, see _loc. cit._ for
additional details.

######  Definition 3.10.

The _Hurwitz class number_ $H(\Delta)$ is the order of
$B(\Delta)/\operatorname{SL}_{2}(\mathbb{Z})$.

Let $d(p)$ be the number of tuples $a\in\mathcal{W}(\mathbb{F}_{p})$ such that
$E_{a}(\mathbb{F}_{p})[p]\neq 0$. Note that

$\frac{d(p)}{\\#\mathcal{W}(\mathbb{F}_{p})}=\frac{d(p)}{p^{5}}.$

######  Lemma 3.11.

With respect to notation above,
$\overline{\mathfrak{d}}(\mathcal{S}_{p}^{\prime})\leq\frac{d(p)}{p^{5}}$.

###### Proof.

Given $a\in\mathcal{W}(\mathbb{F}_{p})$, let $\mathcal{S}_{a}$ be the set of
$\tilde{a}\in\mathcal{W}(\mathbb{Z})$ which reduce to $a$. It is easy to see
that $\mathfrak{d}(\mathcal{S}_{a})=\frac{1}{p^{5}}$. Note that
$\mathcal{S}_{p}^{\prime}$ is contained in the disjoint union
$\bigsqcup_{a}\mathcal{S}_{a}$, where $a$ ranges over the tuples in
$\mathcal{W}(\mathbb{F}_{p})$ such that $E_{a}(\mathbb{F}_{p})[p]\neq 0$. The
result follows from this. ∎

######  Proposition 3.12.

With respect to notation above, we have that

$\overline{\mathfrak{d}}(\mathcal{S}_{p}^{\prime})\leq\begin{cases}\left(\frac{p-1}{2p^{2}}\right)H(1-4p)&\text{
if }p\geq 7,\\\
\left(\frac{p-1}{2p^{2}}\right)\left(H(1-4p)+H(p^{2}+1-6p)\right)&\text{ if
}p\leq 5.\\\ \end{cases}$

###### Proof.

The number of isomorphism classes of elliptic curves $E$ over $\mathbb{F}_{p}$
such that $E(\mathbb{F}_{p})[p]\neq 0$ is

$\begin{cases}H(1-4p)&\text{ if }p\geq 7,\\\ H(1-4p)+H(p^{2}+1-6p)&\text{ if
}p\leq 5,\\\ \end{cases}$

see [RS21, Corollary 3.11] for additional details. Given
$a\in\mathcal{W}(\mathbb{F}_{p})$ and associated integral Weierstrass model
$E_{a}$, then, after a transformation $(X,Y)\mapsto(X+r,Y+sX+t)$, we obtain an
elliptic curve with a short Weierstrass equation. Note that two elliptic
curves

$\begin{split}&E_{c,d}\mathrel{\mathop{\mathchar 58\relax}}Y^{2}=X^{3}+cX+d\\\
&E_{c^{\prime},d^{\prime}}\mathrel{\mathop{\mathchar
58\relax}}Y^{2}=X^{3}+c^{\prime}X+d^{\prime}\end{split}$

are isomorphic over $\mathbb{F}_{p}$ if there exists
$s\in\mathbb{F}_{p}^{\times}$ such that

$c^{\prime}=s^{4}c\text{ and }d^{\prime}=s^{6}d.$

It is thus easy to see that the number of Weierstrass equations in a given
isomorphism class is at most $p^{3}\left(\frac{p-1}{2}\right)$. Thus, we find
that

$d(p)\leq\begin{cases}p^{3}\left(\frac{p-1}{2}\right)H(1-4p)&\text{ if }p\geq
7,\\\ p^{3}\left(\frac{p-1}{2}\right)\left(H(1-4p)+H(p^{2}+1-6p)\right)&\text{
if }p\leq 5.\\\ \end{cases}.$

∎

##  4\. Results for a fixed prime and varying elliptic curve

In this section we prove our main results. Throughout, we fix an odd prime
number $p$. Given a set of rational elliptic curves $\mathcal{S}$, we obtain a
subset of $\mathcal{W}(\mathbb{Z})$ consisting of all $a$ such that
$E_{a}\in\mathcal{S}$. By abuse of notation, we shall refer to this set as
$\mathcal{S}$ as well. The density $\mathfrak{d}(\mathcal{S})$ is defined as
in (3.1). Recall that the upper and lower densities, denoted
$\overline{\mathfrak{d}}(\mathcal{S})$ and
$\underline{\mathfrak{d}}(\mathcal{S})$, are always defined even if
$\mathfrak{d}(\mathcal{S})$ need not be. Let $\mathcal{E}_{p}$ be the set of
elliptic curves $E_{/\mathbb{Q}}$ such that
$\operatorname{Hom}_{G}(\operatorname{Cl}_{K},E[p])\neq 0$. Note that for
$E\in\mathcal{E}_{p}$, we have in particular that
$p|\\#\operatorname{Cl}_{K}$.

Recall from Definition 3.7 that $\mathcal{S}_{p}$ is the set of elliptic
curves $E_{/\mathbb{Q}}$ such that $p|c_{\ell}(E)$ for some prime $\ell\neq
p$. Recall from Definition 3.9 that $\mathcal{S}_{p}^{\prime}$ is the set of
elliptic curves $E$ for which $p\nmid\Delta(E)$ and $E(\mathbb{Q}_{p})[p]\neq
0$. Denote by $\mathcal{S}_{p}^{\prime\prime}$ the set of elliptic curves
$E_{/\mathbb{Q}}$ with bad reduction at $p$. Let $\mathfrak{T}_{p}$ be the
elliptic curves $E$ such that $\Sh(E/\mathbb{Q})[p]\neq 0$.

######  Proposition 4.1.

Let $p$ be an odd prime. Then, we have that

$\underline{\mathfrak{d}}(\mathcal{E}_{p})\geq\underline{\mathfrak{d}}\left(\mathfrak{T}_{p}\backslash(\mathcal{S}_{p}\cup\mathcal{S}_{p}^{\prime}\cup\mathcal{S}_{p}^{\prime\prime})\right).$

###### Proof.

Suppose $E$ is an elliptic curve in
$\mathfrak{T}_{p}\backslash(\mathcal{S}_{p}\cup\mathcal{S}_{p}^{\prime}\cup\mathcal{S}_{p}^{\prime\prime})$,
then, since $E\in\mathfrak{T}_{p}$, we have that $\Sh(E/\mathbb{Q})[p]\neq 0$,
and since
$E\notin\mathcal{S}_{p}\cup\mathcal{S}_{p}^{\prime}\cup\mathcal{S}_{p}^{\prime\prime}$,
we have that $p\nmid c_{\ell}(E)$ for all primes $\ell\neq p$, and
$E(\mathbb{Q}_{p})[p]=0$. So long as the residual representation on $E[p]$ is
irreducible it follows from Theorem 2.1 that
$\operatorname{Hom}_{G}(\operatorname{Cl}_{K},E[p])\neq 0$. As a result, $E$
is contained in $\mathcal{E}_{p}$. By a well known result of Duke [Duk97], the
residual representation on $E[p]$ is irreducible for $100\%$ of elliptic
curves, and the result follows. ∎

Throughout, we shall assume that for any elliptic curve $E_{/\mathbb{Q}}$, the
$p$-primary part of the Tate-Shafarevich group $\Sh(E/\mathbb{Q})[p^{\infty}]$
is finite. The density of elliptic curves $E_{/\mathbb{Q}}$ such that
$\Sh(E/\mathbb{Q})[p^{\infty}]\neq 0$ was studied by Delaunay [Del07] and
Poonen-Rains [PR12]. Their predictions are based on heuristics based on Cohen-
Lenstra heuristics and random matrix theory.

######  Conjecture 4.2 (Delaunay, Poonen-Rains).

With respect to notation above,

$\underline{\mathfrak{d}}(\mathfrak{T}_{p})\geq 1-\prod_{i\geq
1}\left(1-p^{-(2i-1)}\right)>p^{-1}+p^{-3}-p^{-4}.$

Moreover, given a set $\mathcal{E}$ of elliptic curves defined by local
congruence conditions,

$\underline{\mathfrak{d}}(\mathfrak{T}_{p}\cap\mathcal{E})=\underline{\mathfrak{d}}(\mathfrak{T}_{p})\mathfrak{d}(\mathcal{E}).$

######  Remark 4.3.

For the purposes of this article, we shall use only the second lower bound
predicted by the above conjecture: that is, we shall assume that

$\underline{\mathfrak{d}}(\mathfrak{T}_{p}\cap\mathcal{E})>\left(p^{-1}+p^{-3}-p^{-4}\right)\mathfrak{d}(\mathcal{E}),$

where $\mathcal{E}$ is taken to be the complement of
$\mathcal{S}_{p}\cup\mathcal{S}_{p}^{\prime}\cup\mathcal{S}_{p}^{\prime\prime}$.

######  Theorem 4.4.

Let $p$ be an odd prime, and assume the above conjecture. Then, we have that

$\underline{\mathfrak{d}}(\mathcal{E}_{p})>(p^{-1}+p^{-3}-p^{-4})(1-p^{-1}-\mathfrak{d}_{p}-\mathfrak{d}_{p}^{\prime}),$

where

$\mathfrak{d}_{p}=\begin{cases}\zeta(p)-1&\text{ if }p\geq 5,\\\
(\zeta(3)-1)+(\zeta(4)-1)+(\zeta(7)-1)&\text{ if }p=3,\\\ \end{cases}$
$\mathfrak{d}_{p}^{\prime}=\begin{cases}\left(\frac{p-1}{2p^{2}}\right)H(1-4p)&\text{
if }p\geq 7,\\\
\left(\frac{p-1}{2p^{2}}\right)\left(H(1-4p)+H(p^{2}+1-6p)\right)&\text{ if
}p\leq 5.\\\ \end{cases}$

###### Proof.

Let $\mathcal{E}$ be the set of elliptic curves in the complement of
$\mathcal{S}_{p}\cup\mathcal{S}_{p}^{\prime}\cup\mathcal{S}_{p}^{\prime\prime}$.
We have from Theorem 3.8 (resp. Proposition 3.12) that
$\mathfrak{d}(\mathcal{S}_{p})=\mathfrak{d}_{p}$ (resp.
$\mathfrak{d}(\mathcal{S}_{p}^{\prime})=\mathfrak{d}_{p}^{\prime}$).
Furthermore, we have from Theorem 3.1 and Proposition 3.3 that
$\mathfrak{d}(\mathcal{S}_{p}^{\prime\prime})=\frac{1}{p}$. From Proposition
4.1, we have that
$\underline{\mathfrak{d}}(\mathcal{E}_{p})\geq\underline{\mathfrak{d}}\left(\mathfrak{T}_{p}\backslash(\mathcal{S}_{p}\cup\mathcal{S}_{p}^{\prime}\cup\mathcal{S}_{p}^{\prime\prime})\right)$.
According to our assumption,

$\begin{split}&\underline{\mathfrak{d}}\left(\mathfrak{T}_{p}\backslash(\mathcal{S}_{p}\cup\mathcal{S}_{p}^{\prime}\cup\mathcal{S}_{p}^{\prime\prime})\right)=\underline{\mathfrak{d}}(\mathfrak{T}_{p}\cap\mathcal{E})\\\
\geq&\left(1-\prod_{i\geq
1}\left(1-p^{-(2i-1)}\right)\right)\mathfrak{d}(\mathcal{E})\\\
>&\left(p^{-1}+p^{-3}-p^{-4}\right)\mathfrak{d}(\mathcal{E})\\\
=&\left(p^{-1}+p^{-3}-p^{-4}\right)\left(1-p^{-1}-\mathfrak{d}_{p}-\mathfrak{d}_{p}^{\prime}\right),\end{split}$

and the result follows.

∎

######  Corollary 4.5.

Assume Conjecture 4.2. Then

$\underline{\mathfrak{d}}(\mathcal{E}_{p})\geq p^{-1}+O(p^{-3/2+\epsilon}).$

In other words, for any choice of $\epsilon>0$ there is a constant $C>0$,
depending on $\epsilon$ and independent of $p$, such that

$\underline{\mathfrak{d}}(\mathcal{E}_{p})\geq p^{-1}-Cp^{-3/2+\epsilon}.$

###### Proof.

According to Theorem 4.4, we have that

$\begin{split}\underline{\mathfrak{d}}(\mathcal{E}_{p})>&(p^{-1}+p^{-3}-p^{-4})(1-p^{-1}-\mathfrak{d}_{p}-\mathfrak{d}_{p}^{\prime})\\\
>&p^{-1}-p^{-1}\left(p^{-1}+\mathfrak{d}_{p}+\mathfrak{d}_{p}^{\prime}\right).\end{split}$

We have that

$\zeta(p)-1=2^{-p}+\sum_{n\geq
3}n^{-p}<2^{-p}+\int_{2}^{\infty}x^{-p}dx=2^{-p}\left(\frac{p+1}{p-1}\right),$

and hence,

$\mathfrak{d}_{p}=O(2^{-p})=O(p^{-1/2+\epsilon}).$

On the other hand, it follows from known results that

$\mathfrak{d}_{p}^{\prime}=O\left(p^{-1/2}\operatorname{log}p(\operatorname{log}\operatorname{log}p)^{2}\right)=O(p^{-1/2+\epsilon}),$

(see [LJ87, Proposition 1.9]) and the result follows. ∎

##  5\. Results for a fixed elliptic curve and varying prime

In this section we prove results for a fixed elliptic curve $E_{/\mathbb{Q}}$
and varying prime $p$. We shall assume throughout that $E$ does not have
complex multiplication, and that the Tate-Shafarevich group
$\Sh(E/\mathbb{Q})$ is finite. Given a prime $p$, we let
$K_{p}=\mathbb{Q}(E[p])$. We make a number of observations with regard to the
variation of $\operatorname{Cl}_{K_{p}}/p\operatorname{Cl}_{K_{p}}$, where $p$
varies over all primes $p$.

######  Theorem 5.1.

Let $E_{/\mathbb{Q}}$ be an elliptic curve, assume that the following
conditions are satisfied,

  1. (1)

$\Sh(E/\mathbb{Q})$ is finite,

  2. (2)

$\operatorname{rank}E(\mathbb{Q})\leq 1$,

  3. (3)

$E$ does not have complex multiplication.

Then, for $100\%$ of primes $p$, we have that
$\operatorname{Hom}_{G}(\operatorname{Cl}_{K_{p}}/p\operatorname{Cl}_{K_{p}},E[p])=0$.

###### Proof.

Note that for all but finitely many primes $p$,

  1. (1)

$E$ has good reduction at $p$,

  2. (2)

$E(\mathbb{Q}_{\ell})[p]=0$ for all primes $\ell$ at which $E$ has bad
reduction,

  3. (3)

$\Sh(E/\mathbb{Q})[p]=0$,

  4. (4)

the representation on $E[p]$ is irreducible,

  5. (5)

$c_{\ell}^{(p)}(E)=1$ for all primes $\ell$ at which $E$ has bad reduction.

Thus, it follows from Theorem 2.3, that we have that
$\operatorname{Hom}_{G}(\operatorname{Cl}_{K_{p}}/p\operatorname{Cl}_{K_{p}},E[p])=0$
provided $E(\mathbb{Q}_{p})[p]=0$. Let $\widetilde{E}$ be the reduction of $E$
over $\mathbb{F}_{p}$. The formal group $\widehat{E}(\mathbb{Z}_{p})$ of $E$
at $p$ has no nontrivial $p$-torsion. Thus, if $p$ is a prime of good
reduction, the natural map
$E(\mathbb{Q}_{p})\rightarrow\widetilde{E}(\mathbb{F}_{p})$ induces an
injection

$E(\mathbb{Q}_{p})[p]\rightarrow\widetilde{E}(\mathbb{F}_{p})[p].$

A prime $p$ at which $E$ has good reduction is called an _anomalous prime_ if
$\widetilde{E}(\mathbb{F}_{p})[p]\neq 0$. It is well known that for a non-CM
elliptic curve, $100\%$ of primes are non-anomalous (see for instance
[Mur97]). Thus, $E(\mathbb{Q}_{p})[p]=0$ for $100\%$ of primes $p$, and thus
the result follows. ∎

######  Theorem 5.2.

Let $E_{/\mathbb{Q}}$ be an elliptic curve, assume that the following
conditions are satisfied,

  1. (1)

$\operatorname{rank}E(\mathbb{Q})\geq 2$,

  2. (2)

$E$ does not have complex multiplication.

Then, for $100\%$ of primes $p$, we have that

$\operatorname{dim}\operatorname{Hom}_{G}(\operatorname{Cl}_{K_{p}}/p\operatorname{Cl}_{K_{p}},E[p])\geq\operatorname{rank}E(\mathbb{Q})-1.$

###### Proof.

It follows from the proof of Theorem 5.1 that for $100\%$ of primes $p$, all
of the following conditions are satisfied:

  1. (1)

$E$ has good reduction at $p$,

  2. (2)

the representation on $E[p]$ is irreducible,

  3. (3)

$c_{\ell}^{(p)}(E)=1$ for all primes $\ell$ at which $E$ has bad reduction,

  4. (4)

$E(\mathbb{Q}_{p})[p]=0$.

It follows from Theorem 2.1 that

$\operatorname{dim}\operatorname{Hom}_{G}(\operatorname{Cl}_{K_{p}}/p\operatorname{Cl}_{K_{p}},E[p])\geq\operatorname{rank}E(\mathbb{Q})-1.$

∎

##  6\. Computational results

In this section we present some computations of
$\operatorname{Cl}_{K}/3\operatorname{Cl}_{K}$, where $K=\mathbb{Q}(E[3])$,
for certain families of elliptic curves $E$. Due to the difficulty of
computing statistics for larger extensions, we primarily restricted ourselves
to the case that
$\operatorname{Gal}(K/\mathbb{Q})\subset\operatorname{GL}_{2}(\mathbb{F}_{3})$
is the normalizer of a split Cartan subgroup. This is the smallest irreducible
subgroup of $\operatorname{GL}_{2}(\mathbb{F}_{3})$. We include also a few
additional calculations where the Galois group is the normalizer of a non-
split Cartan subgroup.

We note that the hypotheses of [PS21] are often violated in these cases.
Specifically, a majority of such $E$ have bad reduction at $3$. In addition,
all ramification at $3$ is tame as the Galois group has order prime to $3$:
thus any such $E$ for which $a_{3}(E)\equiv 1\pmod{3}$ has $3$ as a local
torsion prime. We computed our examples without regard to these
considerations. We comment only that we verified that every computation which
violates the lower bound of [PS21] does not satisfy their hypotheses.

###  6.0.1. Normalizer of a split Cartan: Varying $j$-invariants

We use the formula of Zywina [Zyw15, Theorem 1.2]

$j_{2}(t)=27\frac{(t+1)^{3}(t-3)^{3}}{t^{3}}$

such that any elliptic curve with such a $j$-invariant has
$\operatorname{Gal}(\mathbb{Q}(E[3])/\mathbb{Q})$ contained in the normalizer
of a split Cartan subgroup. For any $t$, let $E_{t}$ denote the elliptic curve
of smallest conductor with $j$-invariant $j_{2}(t)$ and let $K_{t}$ denote the
field $\mathbb{Q}(E_{t}[3])$. We computed
$\operatorname{Sel}_{3}(E_{t}/\mathbb{Q})$ as well as the Galois module
structure of $\operatorname{Cl}_{K_{t}}/3$ for the 599 elliptic curves in the
set

$S_{0}=\\{E_{a/b}\mid|a|\leq 50,1\leq b\leq
10,[K_{t}\mathrel{\mathop{\mathchar 58\relax}}\mathbb{Q}]=8\\}.$

Let $L_{t}$ denote the unique biquadratic subfield of $K_{t}$; note that
$L_{t}$ necessarily contains $\mathbb{Q}(\sqrt{-3})$. In each case there was
$d_{t}\geq 0$ such that there was an isomorphism

$\operatorname{Cl}_{K_{t}}/3\cong\operatorname{Cl}_{L_{t}}/3\oplus
E_{t}[3]^{d_{t}}$

as $\operatorname{Gal}(K_{t}/\mathbb{Q})$-modules. Note that
$\operatorname{Gal}(K_{t}/\mathbb{Q})$ acts on $\operatorname{Cl}_{L_{t}}/3$
via its abelianization.

Our interest here is primarily in comparing
$\operatorname{Sel}_{3}(E_{t}/\mathbb{Q})$ and $d_{t}$. We briefly report the
data for $\operatorname{Cl}_{L_{t}}/3$:

$\dim\operatorname{Cl}_{L_{t}}/3$ # $t$ 0 447 1 123 2 28 3 1

The only curve in our sample with $\dim\operatorname{Cl}_{L_{t}}/3=3$ was
$E_{-46/3}$ with $L_{t}=\mathbb{Q}(\sqrt{-3},\sqrt{2917})$.

Turning to the other quantities, we have the following.

$\dim\operatorname{Sel}_{3}(E_{t}/\mathbb{Q})$ $d_{t}$ # $t$ 0 0 103 0 1 26 1
0 228 1 1 52 1 2 2 2 0 95 2 1 74 2 2 2 3 0 4 3 1 12 3 2 1

We remark that the restriction to $E$ with specified $3$-torsion fields
obviously biases the distribution of $3$-Selmer groups. Although it is unwise
to extrapolate too much from this limited data, we note that for $t$ with
$\dim\operatorname{Sel}_{3}(E_{t}/\mathbb{Q})\leq 1$, the dimension of
$\operatorname{Cl}_{K_{t}}/3$ appears to be the roughly the same (being
nonzero around $19\%$ of the time) whether the Selmer group has dimension zero
or one. By contrast, for Selmer groups of dimension two, the proportion having
$d_{t}\geq 1$ is much larger at $44\%$. For Selmer groups of dimension three
it is much larger than that, in this limited sample.

Granting the limits of this data set, it certainly appears that
$\operatorname{Sel}_{3}(E_{t}/\mathbb{Q})$ has a significant effect on
$d_{t}$, but there are additional influences as well which are not currently
clear.

###  6.0.2. Normalizer of a split Cartan: Fixed $j$-invariants

We also investigated two quadratic twist families. Let $E_{1}$ denote the
elliptic curve

$y^{2}+xy+y=x^{3}-141x+624$

with $j(E_{1})=857375/8$ and conductor $10082=2\cdot 71^{2}$. For any
squarefree $t$, let $E_{1,t}$ denote the quadratic twist of $E_{1}$ by $t$ and
let $K_{1,t}$ denote the field $\mathbb{Q}(E_{1,t}[3])$. Then
$\operatorname{Gal}(K_{1,t}/\mathbb{Q})$ is the normalizer of a split Cartan
subgroup of $\operatorname{GL}_{2}(\mathbb{F}_{3})$. We note that each
$K_{1,t}$ contains the biquadratic field
$L_{1}=\mathbb{Q}(\sqrt{-3},\sqrt{-71})$ which has trivial $3$-class group.

Consider the set of 608 elliptic curves

$S_{1}=\left\\{E_{1,t}\mid 1\leq t\leq 1000,t\text{~{}squarefree}\right\\}.$

In each case we computed a
$\operatorname{Gal}(K_{1,t}/\mathbb{Q})$-isomorphism

$\operatorname{Cl}_{K_{1,t}}/3\cong E_{1,t}[3]^{d_{1,t}}$

for some $d_{1,t}$. We computed the following data.

$\dim\mathrm{Sel}_{3}(E_{1,t}/\mathbb{Q})$ $d_{1,t}$ # $t$ 0 0 341 0 1 1 1 0
74 1 1 31 1 2 2 2 1 140 2 2 18 3 2 1

We note here that the dependence of $d_{1,t}$ on
$\mathrm{Sel}_{3}(E_{1,t}/\mathbb{Q})$ is more clear than in the case of
varying $j$-invariants: the lower bound of [PS21] (although as noted the
hypotheses are often violated in this data set) appears to control most of the
behavior of $d_{1,t}$.

We computed analogous data for the elliptic curve $E_{2}$ given by

$y^{2}=x^{3}-83667346875x-10711930420406250$

with $j(E_{2})=-42875/8$ and conductor $6962=2\cdot 59^{2}$. With notation as
above, we consider the set of 608 quadratic twists

$S_{2}=\left\\{E_{2,t}\mid 1\leq t\leq 1000,t\text{~{}squarefree}\right\\}.$

Each $3$-division field field $K_{2,t}$ has Galois group the normalizer of a
split Cartan subgroup and contains the biquadratic field
$L_{2}=\mathbb{Q}(\sqrt{-3},\sqrt{-59}).$ This field has class group
$\mathbb{Z}/3$, and for each $t$ we computed a
$\operatorname{Gal}(K_{2,t}/\mathbb{Q})$-isomorphism

$\operatorname{Cl}_{K_{2,t}}/3\cong\operatorname{Cl}_{L_{2}}/3\oplus
E_{2,t}[3]^{d_{2,t}}$

for some $d_{2,t}$.

$\dim\mathrm{Sel}_{3}(E_{2,t}/\mathbb{Q})$ $d_{2,t}$ # $t$ 0 0 54 0 1 18 1 0
332 1 1 165 2 0 18 2 1 13 2 2 2 3 2 6

This behavior appears somewhat less straightforward than for $S_{1}$. The
distribution of $\mathrm{Sel}_{3}(E_{2,t}/\mathbb{Q})$ is obviously quite
different than that of $\mathrm{Sel}_{3}(E_{1,t}/\mathbb{Q})$ and the effect
on $d_{2,t}$ is less clear. We do note that the distributions of $d_{1,t}$ and
$d_{2,t}$ ignoring Selmer groups are similar, which is somewhat curious.

###  6.0.3. Normalizer of a non-split Cartan: fixed $j$-invariant

We compiled very limited data in one case with mod $3$ image of Galois the
normalizer of a non-split Cartan subgroup. Consider the elliptic curve $E_{3}$
given by

$y^{2}=x^{3}+x^{2}-2x-8$

with $j(E_{3})=-64$ and conductor $1568=2^{5}\cdot 7^{2}$. We consider its set
of 61 twists

$S_{3}=\left\\{E_{3,t}\mid 1\leq t\leq 100,t\text{~{}squarefree}\right\\}.$

For each $t$ we have an isomorphism of
$\operatorname{Gal}(K_{3,t}/\mathbb{Q})$-modules

$\operatorname{Cl}_{K_{3,t}}/3\cong E_{3,t}[3]^{d_{3,t}}$

for some $d_{3,t}$.

$\dim\mathrm{Sel}_{3}(E_{3,t}/\mathbb{Q})$ $d_{3,t}$ # $t$ 0 0 18 0 1 2 1 0 18
1 1 14 1 2 1 2 1 8

There is too little data here to provide anything more than wild speculations;
unfortunately the computations rapidly became very time consuming beyond this
point.

## References

  * [Bha05] Manjul Bhargava.  The density of discriminants of quartic rings and fields.  Annals of Mathematics, pages 1031–1063, 2005.
  * [BST+20] Manjul Bhargava, Arul Shankar, Takashi Taniguchi, Frank Thorne, Jacob Tsimerman, and Yongqiang Zhao.  Bounds on 2-torsion in class groups of number fields and integral points on elliptic curves.  Journal of the American Mathematical Society, 33(4):1087–1099, 2020\.
  * [CL84] Henri Cohen and Hendrik W Lenstra.  Heuristics on class groups of number fields.  In Number Theory Noordwijkerhout 1983, pages 33–62. Springer, 1984\.
  * [Coa00] John Henry Coates.  Galois cohomology of elliptic curves.  Lecture Notes at the Tata Institute of Fundamental Research No. 88, 2000.
  * [CS20] JE Cremona and M Sadek.  Local and global densities for weierstrass models of elliptic curves.  arXiv preprint arXiv:2003.08454, 2020.
  * [Del07] Christophe Delaunay.  Heuristics on class groups and on tate-shafarevich groups: the magic of the cohen-lenstra heuristics.  Ranks of elliptic curves and random matrix theory, 341:323–340, 2007.
  * [DH71] Harold Davenport and Hans Arnold Heilbronn.  On the density of discriminants of cubic fields. ii.  Proceedings of the Royal Society of London. A. Mathematical and Physical Sciences, 322(1551):405–420, 1971.
  * [Duk97] William Duke.  Elliptic curves with no exceptional primes.  Comptes rendus de l’Académie des sciences. Série 1, Mathématique, 325(8):813–818, 1997.
  * [EPW17] Jordan Ellenberg, Lillian Pierce, and Melanie Wood.  On $\ell$-torsion in class groups of number fields.  Algebra & Number Theory, 11(8):1739–1778, 2017.
  * [EV07] Jordan S Ellenberg and Akshay Venkatesh.  Reflection principles and bounds for class group torsion.  International Mathematics Research Notices, 2007, 2007.
  * [FK07] Étienne Fouvry and Jürgen Klüners.  On the 4-rank of class groups of quadratic number fields.  Inventiones mathematicae, 167(3), 2007.
  * [HJK+19] Samuel Holmin, Nathan Jones, Pär Kurlberg, Cam McLeman, and Kate Petersen.  Missing class groups and class number statistics for imaginary quadratic fields.  Experimental Mathematics, 28(2):233–254, 2019.
  * [Kly20] Jack Klys.  The distribution of p-torsion in degree p cyclic fields.  Algebra & Number Theory, 14(4):815–854, 2020.
  * [LJ87] Hendrik W Lenstra Jr.  Factoring integers with elliptic curves.  Annals of mathematics, pages 649–673, 1987.
  * [MC90] Jacques Martinet and Henri Cohen.  Étude heuristique des groupes de classes des corps de nombres.  1990\.
  * [Mur97] V Kumar Murty.  Modular forms and the chebotarev density theorem ii.  London Mathematical Society Lecture Note Series, pages 287–308, 1997.
  * [PR12] Bjorn Poonen and Eric Rains.  Random maximal isotropic subspaces and selmer groups.  Journal of the American Mathematical Society, 25(1):245–269, 2012\.
  * [PS21] Dipendra Prasad and Sudhanshu Shekhar.  Relating the tate–shafarevich group of an elliptic curve with the class group.  Pacific Journal of Mathematics, 312(1):203–218, 2021.
  * [PTBMW21] Lillian B Pierce, Caroline L Turnage-Butterbaugh, and Melanie Matchett Wood.  On a conjecture for $\ell$-torsion in class groups of number fields: from the perspective of moments.  Mathematical Research Letters, 28(2), 2021.
  * [PTBW20] Lillian B Pierce, Caroline L Turnage-Butterbaugh, and Melanie Matchett Wood.  An effective chebotarev density theorem for families of number fields, with an application to $\ell$-torsion in class groups.  Inventiones mathematicae, 219(2):701–778, 2020.
  * [RS21] Anwesh Ray and R Sujatha.  Arithmetic statistics for the fine selmer group in iwasawa theory.  arXiv preprint arXiv:2112.13335, 2021.
  * [Sil94] Joseph H Silverman.  Advanced topics in the arithmetic of elliptic curves, volume 151\.  Springer Science & Business Media, 1994.
  * [Sil09] Joseph H Silverman.  The arithmetic of elliptic curves, volume 106.  Springer, 2009.
  * [Wat04] Mark Watkins.  Class numbers of imaginary quadratic fields.  Mathematics of Computation, 73(246):907–938, 2004.
  * [Won99] Siman Wong.  On the rank of ideal class groups.  In Proc. Fourth Canad. Number Theory Conf, pages 377–383, 1999\.
  * [Woo16] Melanie Matchett Wood.  Asymptotics for number fields and class groups.  In Directions in number theory, pages 291–339. Springer, 2016.
  * [WW21] Weitong Wang and Melanie Matchett Wood.  Moments and interpretations of the cohen–lenstra–martinet heuristics.  Commentarii Mathematici Helvetici, 96(2):339–387, 2021.
  * [Zyw15] David Zywina.  On the possible images of the mod ell representations associated to elliptic curves over q.  arXiv preprint arXiv:1508.07660, 2015.


# Human-Imperceptible Retrieval Poisoning Attacks in LLM-Powered Applications

Quan Zhang<EMAIL_ADDRESS>Tsinghua University ,  Binqi Zeng
<EMAIL_ADDRESS>Central South University ,  Chijin Zhou
<EMAIL_ADDRESS>Tsinghua University ,  Gwihwan Go<EMAIL_ADDRESS>Tsinghua University ,  Heyuan Shi<EMAIL_ADDRESS>Central South
University and  Yu Jiang<EMAIL_ADDRESS>Tsinghua University

###### Abstract.

Presently, with the assistance of advanced LLM application development
frameworks, more and more LLM-powered applications can effortlessly augment
the LLMs’ knowledge with external content using the retrieval augmented
generation (RAG) technique. However, these frameworks’ designs do not have
sufficient consideration of the risk of external content, thereby allowing
attackers to undermine the applications developed with these frameworks. In
this paper, we reveal a new threat to LLM-powered applications, termed
retrieval poisoning, where attackers can guide the application to yield
malicious responses during the RAG process. Specifically, through the analysis
of LLM application frameworks, attackers can craft documents visually
indistinguishable from benign ones. Despite the documents providing correct
information, once they are used as reference sources for RAG, the application
is misled into generating incorrect responses. Our preliminary experiments
indicate that attackers can mislead LLMs with an 88.33% success rate, and
achieve a 66.67% success rate in the real-world application, demonstrating the
potential impact of retrieval poisoning.

Large Language Models, Retrieval Poisoning Attack

††copyright: none††booktitle: Proceedings of the 32nd ACM Symposium on the
Foundations of Software Engineering (FSE ’24), November 15–19, 2024, Porto de
Galinhas, Brazil

##  1\. Introduction

Large Language Models (LLMs) have powered hundreds of applications in various
natural language processing (NLP) domains (Izacard and Grave, 2020; Stahlberg,
2020). Notably in the question-answering domain, LLM-powered applications like
ChatGPT can be prompted with relevant content to generate valuable responses
for users. Increasingly, many applications are adopting the Retrieval
Augmented Generation (RAG) technique (Lewis et al., 2020) to equip LLMs with
external knowledge during their generative process. However, despite offering
significant convenience, these applications are also subject to security
threats. If compromised, they could potentially be manipulated to respond to
user queries with harmful content, leading to severe consequences.

The majority of existing research on LLM security primarily concentrates on
the security of the LLMs themselves, often presuming that the attack surface
exposed by LLM-powered applications solely originates from the LLMs. As a
result, the primary focus tends to be on LLM-centric attacks such as jailbreak
(Chao et al., 2023; Huang et al., 2023) and prompt injection (Abdelnabi et
al., 2023; Liu et al., 2023a), where attackers can craft malicious prompts to
compromise the safeguard of LLMs. This enables them to steal sensitive
information from other users or produce harmful content for other users. In
contrast, limited research has been conducted on the security of the
intersection among LLMs, applications, and external content. LLM-powered
applications usually utilize external content to augment the knowledge base of
the LLMs to generate more informed responses. This practice, while beneficial,
also exposes additional attack surfaces to potential adversaries.

Figure 1. Attack scenario of retrieval poisoning.

In this paper, we unveil a new threat, retrieval poisoning, targeting LLM-
powered applications, which exploits the design features of LLM application
frameworks to perform imperceptible attacks during RAG. Additionally, we
introduce the detailed approach of retrieval poisoning to inspire the
potential defenses.

Attack Scenario. As depicted in Figure 1, users unknowingly face a risk of
exposure to malicious content. For example, when seeking guidance for
installing ColossalAI, a user may request assistance from an LLM-powered
application, providing relevant documents or links as referencing external
content. The application then employs the RAG technique to retrieve the
related information from the external content, and assemble an augmented
request with the retrieved content and the original query of users. In normal,
based on the augmented request, the application is supposed to provide an
answer telling users the correct download link of ColossalAI, as shown by the
upper part of Figure 1. However, as presented in Figure 1’s below part, users
may unintentionally reference a document crafted by attackers since it is
identical to the normal one in human perception. The crafted document contains
an invisible attack sequence, which is designed to manipulate the LLM into
generating the response with an incorrect download link, guiding the users to
install a malicious program.

Approach. Retrieval poisoning fully leverages the RAG workflow, exhibiting a
significant threat to the LLM ecosystem. Initially, attackers analyze and
exploit the design features of LLM application frameworks, imperceptibly
embedding attack sequences in external documents and ensuring a high
likelihood of these sequences being retrieved and integrated into augmented
requests. Moreover, a gradient-guided mutation technique, which adopts a
weighted loss, is introduced to generate attack sequences with high
effectiveness. Finally, by invisibly injecting the generated sequences at
proper positions in benign documents, attackers can easily craft malicious
documents. When released onto the Internet, these documents pose a threat to
the applications dependent on external content.

Preliminary Experiment. To demonstrate the impact of retrieval poisoning, we
construct a dataset comprising 30 documents and perform a preliminary
experiment. Subsequently, we executed the attack on three powerful open-source
LLMs with two temperature settings, achieving an average attack success rate
(ASR) of 88.33%. In addition, experiment results also depict that the attack
can maintain its effectiveness in various situations. Furthermore, a real-
world experiment was conducted on a widely-used LLM-powered application
developed with LangChain, where retrieval poisoning achieves 66.67% ASR. In
conclusion, retrieval poisoning poses an extreme danger to current
applications, necessitating the urgent development of more effective
mitigation strategies.

##  2\. Methodology

In this section, we introduce the workflow to perform retrieval poisoning for
real-world LLM-powered applications. Figure 2 shows the overall workflow. The
goal of retrieval poisoning is to craft a malicious document, which is
designed to manipulate the LLM into generating responses that align with the
attacker’s intent while appearing identical to the original in human
perception. This crafted document can then be used to poison the retrieval
process of LLM-powered applications. To achieve this goal, retrieval poisoning
consists of two main steps. The first step is to analyze LLM application
frameworks’ critical components used for RAG in order to facilitate the
invisible injection of the attack sequence generated in the next step. The
second step is to generate the attack sequence and craft the malicious
document with a gradient-guided token mutation technique.

###  2.1. Framework Analysis

Currently, LLM-powered applications are usually developed with LLM application
frameworks (Liu et al., 2023c), which provide many powerful components to
support RAG. Therefore, we first introduce the workflow of RAG and then
analyze the exploitable features of the components that can be leveraged by
attackers to perform retrieval poisoning. In this paper, we focus on the most
popular LLM application framework, LangChain. It has gained over 72,000 stars
on GitHub after its release (LangChain-AI, 2023) and has been adopted by many
popular LLM-powered applications (kyrolabs, 2023; Chatchat-Space, 2023). Thus,
the attacks based on LangChain can affect a large number of users.

RAG Workflow. Before processing users’ requests with RAG, a retrieval database
should be first constructed by users or developers of applications.
Specifically, users and developers will collect the documents from the
Internet. These documents’ content, after being parsed by the document
parsers, is split into chunks with appropriate lengths by text splitters.
Finally, the retrieval database is constructed with vectors that are embedded
from these chunks (Song et al., 2020; Okorie et al., 2011). From the database,
applications can retrieve relevant content, and then assemble the content and
the original request into an augmented request following a prompt template. In
the end, the augmented request is fed to LLMs to generate the response.

Figure 2. Workflow of retrieval poisoning.

Exploitable Features. In this process, the document parser, text splitter, and
prompt template are three components that can be exploited by attackers.
First, by analyzing the document parser, attackers can find features used for
invisible injection in different document formats. The content on the Internet
is usually in rich text formats, such as PDF, HTML, and Markdown, which
require rendering before being shown to users. However, some content in the
documents will not be rendered as visible but can be parsed by the document
parsers. For example, in Markdown files, attackers may hide an attack sequence
at the beginning of code blocks, as the listing shows below.

⬇

“‘bash injected_sequence

echo ”bash script”

“‘

The injected sequence will not be rendered visibly or influence the syntax
highlighting of the code block, but it will be parsed by the document parser.
As for PDF and HTML, many transparent elements can be leveraged to hide an
extra sequence. Therefore, attackers can easily find invisible features to
hide the attack sequences in benign documents.

Second, to ensure the attack sequence can be conveyed to the LLMs, attackers
will also analyze the text splitters to ensure a proper injection position, so
that the injected attack sequence can stay with the crucial information in the
same chunk. In detail, the text is split based on the length and section of
the content. Section-based splitters divide content according to tags that
label different sections, which attackers can exploit to place their attack
sequences within these delineated chunks. As for length-based splitters, they
will split the content into fixed-length chunks with overlap (to keep context
between chunks). Therefore, attackers may locate their attack sequence at an
appropriate distance from crucial information, ensuring it remains undivided
by length-based splitters.

Third, attackers can obtain the augmented request according to the frameworks’
prompt templates to perform attack sequence generation. Prompt template can
determine how the retrieved content is organized alongside the user’s request
to form the augmented request. The template is crucial, as it impacts the
overall performance of LLM-powered applications. Frameworks like LangChain
offer a variety of prompt templates whose effectiveness has been validated,
enabling application developers to either directly adopt them or customize
their own templates based on these templates. Therefore, by utilizing the
framework’s prompt templates, attackers can craft high-quality augmented
requests to generate the attack sequence, as illustrated in Section 2.2. These
attack sequences retain their effectiveness across a range of prompt templates
used by developers in various applications.

###  2.2. Document Crafting

Algorithm 1 illustrates how attackers can leverage the pre-analyzed features
to generate the attack sequence and craft the malicious documents. The
algorithm aims to modify an initial document to a crafted document $doc$,
which is identical to the original in human perception but includes an attack
sequence. The algorithm needs five inputs, as illustrated below. The augmented
request $aReq$ is built based on the retrieved content and the prompt
template. $tRes$ represents the targeted response, typically manipulated from
the LLMs’ original response by modifying essential information, e.g., the
installation link of ColossalAI in Figure 1. $M$ is the targeted LLM model
that is used by LLM-powerful applications. In this paper, we focus on the
open-source LLMs, which are widely adopted by existing applications (Touvron
et al., 2023; Jiang et al., 2023). We will extend our research to closed-
source LLMs using transfer techniques in future works (Zou et al., 2023; Yuan
et al., 2020). In addition, the algorithm also needs the injection position
$pos$ and invisible features $features$ to craft a malicious document.

Input : $aReq$: Augmented Request

$pos$: Injection Position

$tRes$: Targeted Malicious Response

$features$: Invisible Features

$M$: Targeted LLM

Output : $doc$: Crafted Document

1

2$i:=0$

3while  _$i$ ++ $\leq maxStep$ _ do

4 $input:=inject(aReq,seq,pos)$

5 $res:=generate(M,input)$

6 if  _$res\approx tRes$_ then

7 break;

8

9 $logits:=logits(M,input)$

10 $loss:=weighted\\_loss(logits,tRes)$

11 $grad:=cal\\_grad(loss,seq)$

// mutate k new sequences

12

13 $newSeqs:=mutate(seq,grad,k)$

14 $seq:=select(newSeqs)$

15

$doc:=craft(origDoc,seq,features,pos)$

Algorithm 1 Document Crafting

The algorithm first needs to generate an attack sequence $seq$, which
satisfies $M(aReq+seq)\approx tRes$. $\approx$ means that the essential
information in the response should align with that of $tRes$, rather than
being identical in its entirety. The algorithm performs an iterative mutation
under the guidance of a weighted loss. As shown in Line 3, attackers will
first combine the attack squeeze $seq$ and $aReq$ at the injection position
$pos$. Then, the algorithm utilizes the targeted LLM $M$ to generate the
response and examines whether the attack is successful (Line 4-6). If the
further mutation is still required, then attackers can calculate a weighted
loss (Line 7-8) following the equation below,

$\displaystyle loss:=$ $\displaystyle cross\\_entropy(logits,tRes)\times(1-w)$
$\displaystyle+$ $\displaystyle
cross\\_entropy(logits[crucial],tRes[crucial])\times w$

Specifically, the loss is calculated by the cross entropy of the $logits$ and
$tRes$. $logits$ is the raw output of LLMs, which is utilized for gradient
calculation. The weighted loss is designed to guide the mutation process, with
a specific emphasis on altering crucial information in the generated response.
Based on the loss, the algorithm computes the gradient $grad$ with respect to
the $seq$ and mutates the sequence to generate $k$ new sequences $newSeqs$
(Line 10-11). In our experiment, we adopt $k$ as 32. Each new sequence is
generated by randomly selecting one token in the $seq$ and mutating based on
the gradient. Finally, the algorithm will select the next $seq$ by calculating
the loss of each sequence and selecting the one with a lower loss (Line 11).
With $seq$, the final step is to craft the malicious document $doc$ by hiding
$seq$ into the initial benign document at position $pos$ with invisible
features $features$ (Line 12).

##  3\. Preliminary Experiments

In this section, we conduct preliminary experiments to show the impact of
retrieval poisoning attack on LLM-powered applications. First, we evaluate the
attack success rate (ASR) of retrieval poisoning towards different LLMs and
meanwhile evaluate that the attack sequence is effective under different
augmented requests. To perform the attack, we construct a dataset with 30
documents, including software installation instructions and medication guides.
The target LLMs for our attack are Llama2-7b, Llama2-13b, and Mistral-7b,
which vary in parameter size and architecture, providing a comprehensive range
of scenarios for our analysis. Furthermore, we also perform real-world attacks
on ChatChat, a popular application powered by LangChain, demonstrating that
attackers can effectively execute the retrieval poisoning in a manner that
remains undetected by humans.

###  3.1. Evaluation on LLMs

To evaluate that retrieval poisoning is easily performed, we first concentrate
on attacks towards LLMs, on which we evaluate the ASR of generated attack
sequences. In detail, we first evaluate retrieval poisoning on three different
LLMs with two different temperature settings. Then, the attack sequences are
evaluated on different augmented requests constructed based on different
prompt templates.

Table 1. Evaluation of retrieval poisoning on LLMs. “Iter” is the average
iteration during the attack. “Seq”, “Req”, and “Res” show the average token
length of the attack sequences, augmented requests, and output responses,
respectively.

Temp | LLMs | ASR | Iter | Seq | Req | Res
---|---|---|---|---|---|---
0.7 | Llama2-7b | 86.67% | 140.63 | 31.37 | 600.53 | 140.73
Llama2-13b | 90.00% | 137.67 | 30.80 | 601.90 | 135.23
Mistral-7b | 86.67% | 141.60 | 30.23 | 583.43 | 128.40
1.0 | Llama2-7b | 90.00% | 124.10 | 31.13 | 600.53 | 140.63
Llama2-13b | 93.33% | 102.30 | 27.87 | 601.90 | 139.67
Mistral-7b | 83.30% | 168.83 | 30.77 | 583.43 | 130.93
Average | 88.33% | 135.86 | 30.36 | 595.29 | 135.93

As Table 1 shows, retrieval poisoning is very effective and achieves an 88.33%
average ASR on all LLMs and settings. Among all LLMs, retrieval poisoning
gains the highest ASR on Llama2-13b, despite having the most parameters. It
may be because LLMs with fewer parameters are easily affected by attack
sequences, and sometimes, the response becomes totally unrelated to the
request, causing low attack efficiencies. Additionally, retrieval poisoning
maintains high effectiveness, with an ASR above 83.30%, across different
temperature settings, indicating that temperature has a slight impact on the
attack’s performance. Even using the attack sequence generated at a
temperature setting of 0.7, retrieval poisoning still achieves an 86.67% ASR
on LLMs with 1.0 temperature.

Additionally, Table 1 presents the average iteration steps, offering insights
into the LLMs’ resistance to retrieval poisoning. The data indicate that
Mistral-7b exhibits greater robustness, aligning with the ASR findings.
Moreover, the table includes the average token length of the generated attack
sequences and responses. An average sequence length of 30.36 suggests
attackers can easily conceal these sequences within external content. The
average lengths of requests and responses, at 595.29 and 135.93 tokens,
respectively, imply that retrieval poisoning is typically employed in complex
tasks. This contrasts with existing adversarial attacks, which often focus on
text classification tasks where the LLMs’ output is limited to simple
classifications like positive or negative. Please note that different LLMs
adopt distinct tokenizers, which will encode the same inputs into different
token sequences in various lengths.

Table 2. ASR on different augmented requests.

LLMs | Llama2-7b | Llama2-13b | Mistral-7b
---|---|---|---
ASR | 59.26% | 46.43% | 64.00%

In reality, attack sequences should keep their effectiveness on different
augmented requests, since prompt templates and queries differ for various
developers and users. Therefore, we evaluate the generated attack sequence
with different augmented requests. Because it is challenging to measure the
replacement of queries objectively, we made significant modifications to the
prompt template, constructing entirely different augmented requests for
evaluation. In detail, the original prompt template is “¡Scenario Description¿
¡Content¿ ¡Question¿”, presenting a QA scenario before the content and
question. The new format, “¡Question¿ ¡Content¿”, directly poses a question to
be answered from the provided content. The results show that 56.56% of
successfully generated attack sequences are still effective on very different
augmented requests, demonstrating that retrieval poisoning is not specified
for one augmented request. This evaluation is operated with LLMs at a
temperature setting of 1.0, where retrieval poisoning generates more attack
sequences, as evidenced in Table 1.

###  3.2. Real-World Application Experiment

To assess retrieval poisoning’s impact in the real world, we perform the
imperceptible attack on ChatChat (Chatchat-Space, 2023), a popular LLM-powered
application with over 21k stars on GitHub. We employ Mistral-7b as the LLM for
ChatChat, since it is recognized as the most powerful 7b LLM (AI, 2023). As
outlined by Table 3, we utilized content in three commonly used formats: PDF,
Markdown, and HTML. We collect more PDF files due to their well-structured and
fine-grained content. While HTML files are prevalent online, they often
include extraneous elements like website menus, adversely affecting
application effectiveness. Hence, formats such as PDF are likely more
preferred by users and developers for building retrieval databases.

Table 3. Evaluation on real-world applications.

Formats | PDF | Markdown | HTML | Total
---|---|---|---|---
Count | 14 | 10 | 6 | 30
Injection | 85.71% (12) | 90% (9) | 83.33% (5) | 86.67% (26)
ASR | 71.43% (10) | 60.00% (6) | 66.67% (4) | 66.67% (20)

On all documents, attackers can successfully perform the imperceptible attack
sequence injection. Moreover, as Table 3 shows, 86.67% of injected sequences
are successfully conveyed to the LLMs after the complex RAG workflow. As for
the other four cases, the injected sequences affect the applications’
retrieval engines, resulting in inaccuracies in retrieving relevant content.
With attack sequences injected, ChatChat produces incorrect responses to users
on 66.67% documents across three formats. Six attack sequences are conveyed to
the LLMs but fail to achieve the retrieval poisoning. This can be attributed
to the RAG workflow’s complexity. For instance, the application might
incorrectly decode special texts within the attack sequence, leading to attack
failures. The ASR is higher in PDF documents since the injection on PDF is
more feasible. In contrast, more complex injection requirements of other
formats slightly diminish the attack’s effectiveness.

Figure 3. A case of retrieval poisoning on ChatChat.

Figure 3 presents a detailed example of an retrieval poisoning on ChatChat. As
the sword icon pointed out, attackers hide an attack sequence at the beginning
of the code block in Markdown format, which is invisible after rendering. When
users request installation information for ColossalAI (Li et al., 2023),
ChatChat should, in normal, generate its response based on the external
content and provide the correct link. However, through a meticulously crafted
attack sequence and careful injection, attackers can manipulate the
application, misleading users with an incorrect download link that potentially
leads to the download of malicious programs.

##  4\. Discussion

Difference from Prompt Injection. Prompt injection can hijack LLM-powered
applications to generate malicious content with harmful instructions. However,
this method typically assumes the user has malicious intent, contrasting with
the retrieval poisoning scenarios. Moreover, some researchers start to inject
long malicious instructions through external content (Abdelnabi et al., 2023).
Different from these attacks, retrieval poisoning achieves a more
imperceptible attack by analyzing the LLM application framework and can bypass
advanced instruction filtering methods (Garg, 2023; Liu et al., 2023b).

Potential Defenses. This paper is dedicated to heightening researchers’
awareness of the risks associated with retrieval poisoning and to inspiring
the community to develop possible mitigation. One possible defense strategy is
for applications to display the source content underlying their responses,
allowing users to cross-reference the content with the response. However, this
method might be less effective with complex content, as it could require users
to invest much time in verification. Another approach involves using LLMs to
rewrite content, thereby breaking the attack sequence. Nevertheless, it will
introduce substantial computational resources and delays in application
response times, influencing the efficiency of applications. Moreover,
rewriting may also be affected by retrieval poisoning, incorrectly rewriting
the crucial information. Therefore, the development of more efficient and
effective defense mechanisms remains a critical need.

##  5\. Conclusion

In this paper, we expose a new threat to LLM-powered applications, named
retrieval poisoning, where a benign document in human eyes can guide the LLMs
to produce incorrect responses during RAG. In detail, attackers can exploit
the LLM application framework to hide a malicious sequence in the external
content, guiding the LLM-powered application to produce malicious responses.
This work encourages the community to explore further into understanding the
intricacies of LLM application frameworks, leading to more resilient and
reliable LLM-powered applications.

## References

  * (1)
  * Abdelnabi et al. (2023) Sahar Abdelnabi, Kai Greshake, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. 2023.  Not What You’ve Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection. In _Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security_ (Copenhagen, Denmark) _(AISec ’23)_. Association for Computing Machinery, New York, NY, USA, 79–90.  https://doi.org/10.1145/3605764.3623985
  * AI (2023) Mistral AI. 2023.  Mistral 7B. The best 7B model to date.  https://mistral.ai/news/announcing-mistral-7b/.
  * Chao et al. (2023) Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J Pappas, and Eric Wong. 2023.  Jailbreaking black box large language models in twenty queries.  _arXiv preprint arXiv:2310.08419_ (2023).
  * Chatchat-Space (2023) Chatchat-Space. 2023.  ChatChat.  https://github.com/chatchat-space/Langchain-Chatchat.
  * Garg (2023) Vaibhav Garg. 2023.  Mitigating Prompt Injection Attacks on an LLM based Customer support App.  https://vaibhavgarg1982.medium.com/mitigating-prompt-injection-attacks-on-an-llm-based-customer-support-app-b34298b2bc7a.
  * Huang et al. (2023) Yangsibo Huang, Samyak Gupta, Mengzhou Xia, Kai Li, and Danqi Chen. 2023.  Catastrophic jailbreak of open-source LLMs via exploiting generation.  _arXiv preprint arXiv:2310.06987_ (2023).
  * Izacard and Grave (2020) Gautier Izacard and Edouard Grave. 2020.  Leveraging passage retrieval with generative models for open domain question answering.  _arXiv preprint arXiv:2007.01282_ (2020).
  * Jiang et al. (2023) Albert Q. Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, Lélio Renard Lavaud, Marie-Anne Lachaux, Pierre Stock, Teven Le Scao, Thibaut Lavril, Thomas Wang, Timothée Lacroix, and William El Sayed. 2023.  Mistral 7B.  arXiv:2310.06825 [cs.CL]
  * kyrolabs (2023) kyrolabs. 2023.  Awesome-LangChain.  https://github.com/kyrolabs/awesome-langchain.
  * LangChain-AI (2023) LangChain-AI. 2023.  LangChain.  https://github.com/langchain-ai/langchain.
  * Lewis et al. (2020) Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen-tau Yih, Tim Rocktäschel, et al. 2020\.  Retrieval-augmented generation for knowledge-intensive nlp tasks.  _Advances in Neural Information Processing Systems_ 33 (2020), 9459–9474.
  * Li et al. (2023) Shenggui Li, Hongxin Liu, Zhengda Bian, Jiarui Fang, Haichen Huang, Yuliang Liu, Boxiang Wang, and Yang You. 2023.  Colossal-AI: A Unified Deep Learning System For Large-Scale Parallel Training. In _Proceedings of the 52nd International Conference on Parallel Processing_ (Salt Lake City, UT, USA) _(ICPP ’23)_. Association for Computing Machinery, New York, NY, USA, 766–775.  https://doi.org/10.1145/3605573.3605613
  * Liu et al. (2023c) Xiaoxia Liu, Jingyi Wang, Jun Sun, Xiaohan Yuan, Guoliang Dong, Peng Di, Wenhai Wang, and Dongxia Wang. 2023c.  Prompting Frameworks for Large Language Models: A Survey.  _arXiv preprint arXiv:2311.12785_ (2023).
  * Liu et al. (2023a) Yi Liu, Gelei Deng, Yuekang Li, Kailong Wang, Tianwei Zhang, Yepang Liu, Haoyu Wang, Yan Zheng, and Yang Liu. 2023a.  Prompt Injection attack against LLM-integrated Applications.  _arXiv preprint arXiv:2306.05499_ (2023).
  * Liu et al. (2023b) Yupei Liu, Yuqi Jia, Runpeng Geng, Jinyuan Jia, and Neil Zhenqiang Gong. 2023b.  Prompt Injection Attacks and Defenses in LLM-Integrated Applications.  _arXiv preprint arXiv:2310.12815_ (2023).
  * Okorie et al. (2011) Patricia Nkem Okorie, F Ellis McKenzie, Olusegun George Ademowo, Moses Bockarie, and Louise Kelly-Hope. 2011.  Nigeria Anopheles vector database: an overview of 100 years’ research.  _Plos one_ 6, 12 (2011), e28347.
  * Song et al. (2020) Kaitao Song, Xu Tan, Tao Qin, Jianfeng Lu, and Tie-Yan Liu. 2020.  MPNet: Masked and Permuted Pre-training for Language Understanding. In _Advances in Neural Information Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, NeurIPS 2020, December 6-12, 2020, virtual_ , Hugo Larochelle, Marc’Aurelio Ranzato, Raia Hadsell, Maria-Florina Balcan, and Hsuan-Tien Lin (Eds.).
  * Stahlberg (2020) Felix Stahlberg. 2020.  Neural machine translation: A review.  _Journal of Artificial Intelligence Research_ 69 (2020), 343–418.
  * Touvron et al. (2023) Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, Dan Bikel, Lukas Blecher, Cristian Canton Ferrer, Moya Chen, Guillem Cucurull, David Esiobu, Jude Fernandes, Jeremy Fu, Wenyin Fu, Brian Fuller, Cynthia Gao, Vedanuj Goswami, Naman Goyal, Anthony Hartshorn, Saghar Hosseini, Rui Hou, Hakan Inan, Marcin Kardas, Viktor Kerkez, Madian Khabsa, Isabel Kloumann, Artem Korenev, Punit Singh Koura, Marie-Anne Lachaux, Thibaut Lavril, Jenya Lee, Diana Liskovich, Yinghai Lu, Yuning Mao, Xavier Martinet, Todor Mihaylov, Pushkar Mishra, Igor Molybog, Yixin Nie, Andrew Poulton, Jeremy Reizenstein, Rashi Rungta, Kalyan Saladi, Alan Schelten, Ruan Silva, Eric Michael Smith, Ranjan Subramanian, Xiaoqing Ellen Tan, Binh Tang, Ross Taylor, Adina Williams, Jian Xiang Kuan, Puxin Xu, Zheng Yan, Iliyan Zarov, Yuchen Zhang, Angela Fan, Melanie Kambadur, Sharan Narang, Aurelien Rodriguez, Robert Stojnic, Sergey Edunov, and Thomas Scialom. 2023.  Llama 2: Open Foundation and Fine-Tuned Chat Models.  arXiv:2307.09288 [cs.CL]
  * Yuan et al. (2020) Liping Yuan, Xiaoqing Zheng, Yi Zhou, Cho-Jui Hsieh, and Kai-Wei Chang. 2020.  On the Transferability of Adversarial Attacksagainst Neural Text Classifier.  _arXiv preprint arXiv:2011.08558_ (2020).
  * Zou et al. (2023) Andy Zou, Zifan Wang, J Zico Kolter, and Matt Fredrikson. 2023.  Universal and transferable adversarial attacks on aligned language models.  _arXiv preprint arXiv:2307.15043_ (2023).