# Effect of backdoor attacks over the complexity of the latent space
distribution

Henry Chacón, and Peyman Najafirad H. Chacón is with the Department of
Management Science and Statistics, University of Texas at San Antonio, San
Antonio, TX, 78249 USA, e-mail<EMAIL_ADDRESS>Najafirad is with the
Department of Information Systems and Cyber Security, University of Texas at
San Antonio, San Antonio, TX, 78249 USA, e-mail<EMAIL_ADDRESS>
###### Abstract

The input space complexity determines the model’s capabilities to extract
their knowledge and translate the space of attributes into a function which is
assumed in general, as a concatenation of non-linear functions between layers.
In the presence of backdoor attacks, the space complexity changes, and induces
similarities between classes that directly affect the model’s training. As a
consequence, the model tends to overfit the input set. In this research, we
suggest the D-vine Copula Auto-Encoder (VCAE) as a tool to estimate the latent
space distribution under the presence of backdoor triggers. Since no
assumptions are made on the distribution estimation, like in Variational
Autoencoders (VAE). It is possible to observe the backdoor stamp in non-
attacked categories randomly generated. We exhibit the differences between a
clean model (baseline) and the attacked one (backdoor) in a pairwise
representation of the distribution. The idea is to illustrate the dependency
structure change in the input space induced by backdoor features. Finally, we
quantify the entropy’s changes and the Kullback–Leibler divergence between
models. In our results, we found the entropy in the latent space increases by
around 27% due to the backdoor trigger added to the input.111Code available
at:
https://github.com/henrychacon/Backdoor_attacks/tree/main/D-Vine_copula_auto_encoder

###### Index Terms:

Adversarial examples, machine learning attacks, deep learning attacks,
poisoning, Trojans, backdoor, VAE, copulas, generative process.

##  I Introduction

Advances on Machine and Deep Learning models have positioned those techniques
in an accelerated momentum process, gaining attention in the scientific
community due to the diversity of applications [1]. Pre-trained models and
methods such as transfer learning have provided access to practitioners
willing to reduce training time and computational cost required for models
with a large number of parameters and big data sizes. However, it opens new
possibilities of Cyber data attacks in terms of fairness and poisoning [2]. In
most cases, final users can not validate if the model is free off adversarial
or backdoor attacks. A situation reflected in a survey published in 2020 by
[3] over 28 organizations from different sectors. They found that 25 out of
those surveyed companies “do not have the right tools in place to secure their
ML systems and are explicitly looking for guidance”. Only two of the surveyed
companies reported they developed their ML models from scratch.

EncoderDecoder$\mathbf{X}$$\mathbf{X}^{\prime}$$\mathbf{h}$D-vineCopulaDecoder$\mathbf{X}^{\prime}$Generative
model Figure 1: The generative D-vine autoencoder (VCAE) approach suggested by
[4] and considered to evaluate the backdoor effect in the distribution of a
lower representation of the data. After the AE is trained, the D-vine copula
and the decoder are transformed into the generative model. $\mathbf{X}$
corresponds to the input set (attacked or clean), $\mathbf{h}$ the latent
domain of the input, and $\mathbf{X}^{\prime}$ the reconstructed output.

As artificial intelligence models have grown, the diversity of attacks has
also evolved. According to [5], ML attacks can be classified based on when the
attack happens. When it happens before the training process, they are called
poisoning or backdoor. If they are executed after the model is trained, they
are known as inference time or adversarial attacks. The attacker’s intention
in the former is to produce a misclassification of the model denying access to
one particular category or forcing the model to generate the same response if
a trigger is present. On the other hand, adversarial attacks are intended to
exploit the model’s vulnerabilities by using corrupted inputs to gain access
as if they were a valid entrance.

Most of the applications for ML models found in the literature are related to
image classification [6]. Several challenges can be mentioned in the image
domain. One of the relevant is the number of dimensions and the relationship
between pixels. As it is expected, their dependency structure is not linear.
Therefore, most of the models developed to classify images are based on a
concatenation of layers linked by non-linear functions. Other types of models
are designed to translate the problem into a lower-dimensional representation
of the input. This family is called generative models since their goal is to
recreate new images based on the input space. See for instance [7] where
authors suggest the variational inference approach to estimate the latent
space distribution of the autoencoder. Another relevant reference in this area
is presented by [8]. In their research, authors generate attacked images using
variational auto-encoders (VAE) and VAE-GAN tested on a different data set, as
an alternative adversarial generation.

The limitation with the variational autoencoders approach is the rigid
constraints imposed on the latent space to estimate its distribution. As it is
pointed out by [4]. In this regard, we consider the Vine Copula Autoencoders
(VCAE) proposed by these authors to overcome the restrictions associated with
the backpropagation method. Our contribution is the study of the footprint
effect induced in the latent space due to backdoor attacks to better estimate
its distribution. The VCAE model considered is depicted in figure 1. The
dimensional reduction of the input generated by the AE after training is used
as input to the D-vine copula method. It estimates the latent space
distribution by a process in pairs illustrated in the methodology section. To
evaluate the backdoor effect, we generate two models, a baseline AE trained on
clean data and another model with one category fully attacked with a backdoor
trigger. The Kullback–Leibler divergence of the latent distributions between
both models is computed to measure the changes between inputs induced by the
backdoor attack. In order to track the backdoor and the D-vine method as a
generative process to detect the attack. Clean data is used in an attacked
model to produce the latent space distribution. A better representation of a
situation where an attacked model is provided with a clean data set for
testing. Although the data used do not have any backdoor feature, samples
generated by the generative process depicted in figure 1 exhibit the trigger
shape, not only in the attacked category but also in other categories that
share some similarities with the target input. This confirms the attack is
present in the model’s parameters as it is suggested by [9].

To the best of our knowledge, this is the first research that considers the
VCAE to estimate the latent domain distribution under the backdoor attacks.
This paper is constructed as follows: the first section is defines properly
the motivations to use VCAE instead of VAE to estimate the distribution in the
latent space. Next, a brief introduction of the D-vine copula approach is
presented. Then, the methodology is described, followed by the last section
illustrating experimental results in detail. Finally, conclusions and future
work are discussed.

##  II Motivation and related work

Deep neural networks (DNN) are defined as highly expressive architectures able
to identify the semantic information presented in the input data set. In
different fields, DNN has become the state of the art for image, speech, and
text classification. However, a small perturbation in the training set can
lead to an increment in the prediction error. As it was initially stated by
[10], the effect of a specific perturbation is not a random artifact of
learning, but it causes the same effect applied in a different subset of the
input in another architecture. This property is formally defined as
adversarial transferability by [11] using as hypothesis the dependency
relationship between sequences of the same distribution and their implications
on similar models.

$p(\mathbf{x})$$p(\mathbf{z})$$\mathbf{x}$$\mathbf{z}$Encoder:
$q_{\phi}(\mathbf{z}|\mathbf{x})$Decoder: $p_{\theta}(\mathbf{x}|\mathbf{z})$
Figure 2: Variational Autoencoder probabilistic graph representation. It is
expected the latent space for $\mathbf{z}\in\mathbf{R}^{n}$ is smaller than
the original input space $\mathbf{x}\in\mathbf{R}^{m}$ such as: $m>n$.

Although the transferability property is fundamentally based on the
distribution, most of its application is found on the training process and in
the architecture design [6]. The reason is mainly associated with the DNN
response under attacks. In the case of Backdoors, the attacker introduces a
trigger pattern in a group of images to produce a misclassification in the
model towards a specifics category. As it is expected, the trigger forces an
overlapping between categories due to the complexity increment in the data
set, as it is pointed out by [12]. In their research, authors demonstrate that
backdoor models are more sensitive to input noise, providing a particular
fingerprint in the attacked category. [13] illustrate this idea by developing
a metric of complexity in the data set. They suggest that in the presence of a
complex task, the model is forced to memorize the input set through
overfitting the input. This behavior unbalances the trade-off between bias and
variance during the training step which reduces the model’s generalization
capability.

An appropriate evaluation of the input space distribution is fundamental to
evaluate the implications of backdoors in the model. However, it is limited to
the number of dimensions. From the inferential point of view, density
estimation methods require either several assumptions or intensive
computational costs, such as Bayesian or Variational statistics [14, 15].
Other approaches are focused on space reduction such as Principal Component
Analysis (PCA). Applications of this method to estimate the distribution can
be found in [16], where authors present a mixture of probabilistic principal
component analysis for the density estimation. Alternatively, [17] consider
PCA to detect adversarial samples. They observe an increment in the importance
of lower-ranked components due to adversarial features added to the data. This
application, besides being useful on detecting adversarial features, provides
empirical evidence of the changes due to dissimilar elements in the data.
Other methods are focused on illustrating the distribution of similarities
between elements in the same category. One of the most popular applications in
this area is the t-SNE method proposed by [18]. In this approach, the
neighborhood distance between elements is measured by the $t-$distribution.

Generative Adversarial Networks (GAN) is a popular method to create new
versions of an input image with a high level of quality. However, the
generated model is intractable from the statistical perspective since the
distribution is embedded in a fully connected set of parameters linked by
nonlinear functions [19].

On the other hand, Variational Autoencoders (VAE) is a direct model that
approximates the input distribution by using gradient-based methods. It trains
an encoder and a decoder simultaneously. Nevertheless, some assumptions that
limit the statistical study should be made in order to train the model. In
figure 2, the probabilistic graphical representation for the encoder and
decoder process is displayed. The generative process behind is to train a
model able to infer the distribution of $\mathbf{z}\in\mathbf{R}^{n}$ from the
sample $\mathbf{x}\in\mathbf{R}^{m}$ by the encoder process
$q_{\phi}(\mathbf{z}|\mathbf{x})$. Then, samples from $\mathbf{z}$ are used to
reproduce the input image through the decoder process
$p_{\theta}(\mathbf{x}|\mathbf{z})$. The usual choice for
$q_{\phi}(\mathbf{z}|\mathbf{x})\sim
N(\mathbf{z}|\mu(\mathbf{x};\phi),\Sigma(\mathbf{x};\phi))$ [20].
$\mu(\mathbf{x};\phi)$ and $\Sigma(\mathbf{x};\phi)$ are arbitrary
deterministic functions with parameters computed by the fully connected layers
in the encoder stage optimized by the stochastic gradient descent via
Backpropagation. However, this method is not designed to handle random
variables in the parameters as was stated by [20]. Besides, the optimization
procedure does not guarantee the resulting covariance matrix
$\Sigma(\mathbf{x};\phi)$ be positive definite. To overcome these limitations,
the following reparametrization trick is considered to estimate the
distribution in the latent space [20]:

$z=\mu(\mathbf{x})+\epsilon\sqrt{\Sigma(\mathbf{x})},\qquad\epsilon\sim
N(\mathbf{0},I)$ (1)

Notice from the equation 1, the random behavior in the latent space is reduced
to the standard normal distribution with no dependency between variables of
$\mathbf{z}$. Therefore, the generative process described in the VAE is based
in a small random noise added to $\Sigma(\mathbf{x})$ and $\mu(\mathbf{x})$.
Beyond a merely statistical discussion, the dependency structure (the
covariance matrix in this case) should contain most of the information
presented on individual elements (in the case of images, the relationship
between individual pixels) rather than their absolute value only [21].
Therefore, in order to produce an appropriate inference of the input in the
latent space, it is imperative to provide more flexibility to the dependency
assembly.

[4] suggests an alternative procedure to estimate the latent space
distribution without considering prior assumptions. In their model, authors
use the reduced representation provided by the encoder layer of an AE as the
vine copula input. Since the backpropagation is not considered to produce the
copula’s parameters, the limitations discussed above not hold. The new model
is titled Vine Copula Autoencoders or VCAE. According to the authors is
computationally efficient compared to other generative models such as GAN or
VAE.

A relevant attribute of copulas is its ability to catch complex dependencies
from the data. They are known to produce a multivariate distribution function
from uniform random variables [22]. It is based on scale-free measures of
dependency [23], [24]. This flexibility makes it possible for being applied in
practically any data set. See for instance [25], [26].

Moreover, vine copulas allow a more general dependency structure by using only
bivariate blocks independently selected. The resulting joint density is built
based on the proper arrangement of conditional distributions. This approach,
besides being computational optimal, provides an extension of several
dimensions of the classical copulas families [27].In the present approach, our
goal is to use the VCAE model to evaluate the distribution change in the data
due to backdoor triggers. Since it is evaluated in a reduced representation of
the input space, it facilitates a graphical representation of the changes in
the data complexity in a relative small computation cost.

##  III The vinecopula method

Consider the random vector
$\mathbf{X}=(x_{1},\cdots,x_{n}):x_{j}\in\mathbf{R}$ with a joint distribution
$f(x_{1},\cdots,x_{n})$ to be factorized as:

$\displaystyle f(x_{1},\cdots,x_{n})$ $\displaystyle=$ $\displaystyle
f(x_{n})f(x_{n-1}|x_{n})f(x_{n-2}|x_{n-1},x_{n})\cdots$ (2) $\displaystyle
f(x_{1}|x_{2},\cdots,x_{n})$ $\displaystyle=$
$\displaystyle\prod_{i=1}^{n}f(x_{i}|x_{i+1},\cdots,x_{n})$

1$2$$3$$4$Tree 1$C_{12}$$C_{23}$$C_{34}$$12$$23$$34$Tree
2$C_{13|2}$$C_{24|3}$$13|2$$24|3$Tree 3$C_{14|23}$ Figure 3: D-vine
representation for a four dimension space. Nodes represent marginal
distribution and edges the copula function. For this configuration, the
distribution is exhibited in (III).

In this case, each component $f(x_{i}|x_{i+1},\cdots,x_{n})$ implicitly
includes information about the dependency mapping. The copula model uses this
representation to isolate the dependency structure of $f(\mathbf{X})$ trough a
function of marginal distributions [28]. According to the [29] theorem, a
multivariate distribution $F(x_{1},\cdots,x_{n})$ depends on the marginals
$F_{1}(x_{1}),\cdots,F_{n}(x_{n})$ based on the copula function $C$ given by:

$F(x_{1},\cdots,x_{n})=C(F_{1}(x_{1}),\cdots,F_{n}(x_{n}))$ (3)

it means, the copula $C:[0,1]^{n}\to[0,1]$ is a multivariate distribution with
inputs given by uniformly distributed marginals such as:

$C(u_{1},\cdots,u_{n})=F\left(F_{1}^{-1}(u_{1}),\cdots,F_{n}^{-1}(u_{n})\right)$
(4)

where $F_{i}^{-1}(u_{i})$ corresponds to the inverse of the cumulative
distribution for $x_{i}$. Different types of copula functions are found in the
literature, their selection depends on the domain of $\mathbf{X}$ and its tail
dependency structure. The most popular are: Gaussian, Student’s t, Clayton and
Gumbel. The first two do not have a simple closed-form, while the last two
have it (also called Archimedean copulae). Please refer to [28] for more
details and models definitions about copulas. Assuming all densities exists,
the joint distribution of $f(\mathbf{x})$ can be written as [4]:

$f(x_{1},\cdots,x_{n})=C(u_{1},\cdots,u_{n})\times\prod_{i=1}^{n}f_{i}(x_{i})$
(5)

Notice from (2) the joint density can be factorized on simpler conditional
distributions of one variable depending on the rest, the key idea behind the
vine copulas method. [30] proposes the pair copula construction (PCC) as a
flexible procedure to model high-dimensional distributions [27]. It
corresponds to a hierarchical method where the conditional distribution of
pairs is computed in a tree structure. According to [28], there are two
compositions. If one dimension is relevant, the conditional distributions
depend on that variable. This family of models is called canonical or C-vine
copulas. In contrast, if any variable is not relevant, they are known as
D-vine copulas. Following the same method proposed by [4], the joint density
for the latent space consider here is estimated by the D-vine approach.

To illustrate the method, suppose a latent space of four dimensions is
represented by the sequences $\mathbf{X}=(x_{1},x_{2},x_{3},x_{4})$. One
suggested D-vine arrangement is exhibited in figure 3. Notice that there are
12 possible configurations for this space [28]. Three different trees are
required to produce the joint distribution based on the D-vine copula. Nodes
represent the marginal distributions and edges the bi-variate copula. In the
first tree, marginal distributions are used to compute the copula function in
pairs of input marginals. Therefore, $C_{12}=C_{12}(F(x_{1}),F(x_{2}))$
represents the joint copula between marginal distributions $f(x_{1})$ and
$f(x_{2})$ and so on. The final distribution for $\mathbf{X}$ is expressed as
[28]:

$\displaystyle f(x_{1},x_{2},x_{3},x_{4})$ $\displaystyle=$ $\displaystyle
f(x_{1})f(x_{2})f(x_{3})f(x_{4})$ $\displaystyle
C_{12}C_{23}C_{34}C_{13|2}C_{24|3}C_{14|23}$

it means, the multivariate density for $\mathbf{X}\in\mathbf{R}^{n}$ can be
written as:

$f(x_{1},\cdots,x_{n})=\prod_{k=1}^{n}f(x_{k})\prod_{j=1}^{n-1}\prod_{i=1}^{n-j}C_{i,i+j|i+1,\cdots,i+j-1}$
(7)

where,

$\displaystyle C_{i,i+j|i+1,\cdots,i+j-1}$ $\displaystyle=$ $\displaystyle
C\left[F(x_{i}|x_{i+1},\cdots,x_{i+j-1})\right.,$ (8)
$\displaystyle\left.F(x_{i+j}|x_{i+1},\cdots,x_{i+j-1})\right]$

Other applications of high dimensional representation of D-vine copulas not
associated to latent space distribution can be found in the literature, see
for instance [31], [32] and [33].

##  IV Methodology

Autoencoders (AE) has been successfully used for dimensionality reduction
[34]. It is considered a special case of feedforward methods, trained by the
backpropagation approach [21]. The model is composed of two parts. In the
first one, the input is assigned to a function
$\mathbf{h}=e(\mathbf{X}):\mathbf{R}^{m}\to\mathbf{R}^{n};m>n$, in charge of
producing the latent space $\mathbf{h}$. This layer is called encoder. The
second layer is responsible for reconstructing $\mathbf{X}$ from $\mathbf{h}$.
It is called the decoder layer and is defined by the function
$\mathbf{r}=d(\mathbf{h}):\mathbf{R}^{n}\to\mathbf{R}^{m}$. An AE model is
considered successfully if the reconstructed image is close in distance to the
original input $\mathbf{X}=\mathbf{r}:\mathbf{r}=d(e(\mathbf{X}))$. A
graphical representation of the AE described here is exhibited in figure 4.
The learning process followed by the AE is given by:

$\min\quad\mathcal{L}\left[\mathbf{X},d(e(\mathbf{X}))\right]$ (9)

where $\mathcal{L}$ is the loss function. In our implementation, two fully
connected layers are considered for the encoder and decoder functions
respectively using the linear operation as the connector. They are defined as
follow:

$\mathbf{h}=e(\mathbf{X})=\left[\mathbf{X}^{T}_{[1\times m]}W_{[m\times
p]}^{(1)}\right]W_{[p\times n]}^{(2)}$ (10)
$\mathbf{r}=d(\mathbf{h})=\left[\mathbf{h}_{[1\times n]}W_{[n\times
p]}^{(3)}\right]W_{[p\times m]}^{(4)}$ (11)

Notice from (10) and (11) matrices $W^{(i)}:i\in\\{1,\cdots,4\\}$ are the
model parameters optimized on (9). The input $\mathbf{X}$ commonly corresponds
to a flatten representation of images in $\mathbf{R}^{s\times t}$, where the
resulting input vector $\mathbf{x}\in\mathbf{R}^{m}:m=s\times t$.

$\mathbf{h}$$\mathbf{X}$$\mathbf{r}$$e$$d$ Figure 4: General autoencoder
representation. $\mathbf{h}$ corresponds to the latent space for $\mathbf{X}$,
while $\mathbf{r}$ represents the reconstructed output for the input. $e$ is
the encoded function $e(\mathbf{X}):\mathbf{R}^{m}\to\mathbf{R}^{n}$, while
$\mathbf{r}=d(a(\mathbf{X}))$ represents the decoder function.

In this research, the AE model is trained using Pytorch in a GPU system, while
the joint distribution of the latent space $\mathbf{h}$ defined on (7) is
estimated by the Python package
pyvinecopulib222https://github.com/vinecopulib/pyvinecopulib. New $\mathbf{X}$
samples are produced by the generative process:

$\mathbf{r}^{\prime}=d(\mathbf{h}),\qquad\mathbf{h}\sim
f(\mathbf{e(\mathbf{X})})$ (12)

where $f()$ corresponds to the estimated joint distribution of the latent
space and parameters $W^{{(3,4)}^{*}}$ are obtained from the AE model.
Marginal distributions are empirically computed by the pyvinecopulib package.
A general procedure for the VCAE implemented for a data set
$\mathcal{D}\in\\{(\mathbf{x}_{i},y_{i})\\}_{i=1}^{N}$ is depicted in
algorithm 1. In the first section, parameters for the AE in (10) and (11) are
optimized by the backpropagation method. In the second section, the latent
space distribution is estimated by the D-vine copula approach, it includes the
generative sampling process.

Algorithm 1 VCAE implementation and generative process

0: Input data $\mathcal{D}$ and $num\\_epochs$

if $\mathbf{X}\in\mathbf{R}^{s\times t}$ then

Flat $\mathbf{X}$ into one dimensional vectors in $\mathbf{R}^{m}$

end if

AE training:

for $epoch<num\\_epochs$ do

$W^{(i)}=W^{(i)}-\eta\frac{\partial\mathcal{L}(\mathbf{X},d(e(\mathbf{X}))}{\partial
W^{(i)}}:i\in\\{1,2,3,4\\}$ {Backpropagation}

end for

Latent space distribution estimation (D-Vine copula):

for $j$ to $N$ do

$\mathbf{h}_{j}=e\left(\mathbf{x}_{j}|W^{(1)^{*}},W^{(2)^{*}}\right)$

end for

$\mathbf{H}=\left[\mathbf{h}_{1},\cdots,\mathbf{h}_{N}\right]$

Compute the D-vine copula in (7) using $\mathbf{H}$ as input

return $f(\mathbf{h}):\mathbf{R}^{n}\to[0,1]$, the latent space distribution

Generative process for VCAE:

Considering $F^{-1}(\mathbf{u})$ as the inverse of the CDF of $f(\mathbf{h})$
and a $g$ number of required samples

for $k$ to $g$ do

$\mathbf{h}=F^{-1}(\mathbf{u})$

$\mathbf{r}=d(\mathbf{h}|W^{(3)^{*}},W^{(4)^{*}})$

end for

To evaluate the changes in the latent space due to backdoor attacks, two
models are trained with algorithm 1. In the first one, the latent space
distribution $P=\hat{f}(\mathbf{X})$ is estimated from the original MNIST data
set $\mathcal{D}$. This model is called baseline. The second model is trained
with all inputs in the target category $t\in y$ attacked with a rectangle
pattern located in the bottom right section of images. The estimated
distribution of the latent space for this model is denoted by
$Q=\hat{f}_{p}(\mathbf{X})$ and the backdoor data is labeled as
$\mathcal{D}_{p}=\\{(\mathbf{x}_{i},y_{i})_{y_{i}\neq
t}\\}_{i=1}^{N}\cup\\{(\mathbf{x}_{pi},y_{i})_{y_{i}=t}\\}_{i=1}^{N}$, where
only the input $\mathbf{x}$ of the target is attacked.

Finally, the Kullback-Leibler divergence is computed to quantify the latent
space difference between both distributions. It is defined as follow:

$KL(P||Q)=\sum_{k}P_{k}\log\left(\frac{P_{k}}{Q_{k}}\right)$ (13)

despite it is not a properly distance metric. It is widely use to quantify the
additional information in $P$ relative to $Q$ [35], [32].

##  V Backdoor detection experiments and results

The implemented AE for each model (baseline and backdoor) has the following
characteristics: $m=784$, $p=64$ and $n=5$. It is trained on 100 epochs
considering the Adam optimizer with a learning rate of $1E^{-3}$ and the MNIST
data set $\mathcal{D}$. The target label $t=0$ is attacked with a rectangle
pattern in the bottom right area producing the input $\mathcal{D}_{p}$ as it
is shown in figure 5. The latent space distribution is estimated with the
D-vine copula and samples of the sequence $\mathbf{h}$ are generated based on
its distribution for each model.

Figure 5: Backdoor data $\mathcal{D}_{p}$ used to train the AE. The target
category $t=0$ is attacked with a rectangle pattern located in the bottom
right section of the image.

Figure 7 shows the latent space distribution in pairs for $P$ and $Q$, the
baseline and backdoor model for $t=0$ respectively. In the former, it is
observed a wider spread concentration in the space, while the last one is
highly concentrated in some particular areas in the pairwise representation.
Besides, it is evident a variation in the marginal distributions of
$\mathbf{h}$.

Pre-trained backdoor model D-vine copula Latent distribution of backdoor model
based on clean data $\mathcal{D}$ Clean data $\mathcal{D}$ Figure 6: Backdoor
detection experiment based on the vine copula generative model. The latent
space distribution of an attacked AE is estimated with the clean data
$\mathcal{D}$. A more realistic scenario where the attacker only provides a
pre-trained model and a small set of clean data for testing. Figure 7: Effect
of one perturbed category in the latent space for a coded space of five
dimensions one a pairwise joint distribution representation. In figure a) the
baseline space is exhibited while the backdoor space is presented in figure
b). It is evident the alterations in the dependency structure due to the
backdoor attack included in just one category $t=0$.

It is expected in real-life cases, the attacker provides only a backdoor model
and a small sample set of clean data for testing. This scenario is depicted in
figure 6. The latent space distribution of the attacked model $Q$ is estimated
with a sample of $\mathcal{D}$ and the encoded function:

$\mathbf{h}_{p}=e_{p}(\mathbf{X})=\left[\mathbf{X}^{T}_{[1\times
m]}W_{[m\times p]}^{(1)^{p}}\right]W_{[p\times n]}^{(2)^{p}}$ (14)

where $W^{(1,2)^{p}}$ corresponds to the encoder parameters of the backdoor
model and $\mathbf{X}$ the clean data.

Interestingly, the generative model based on $\mathbf{h}_{p}$ is able to
reproduce the backdoor trigger on new samples of the target class and in other
non-attacked categories. Although clean data is used to estimate the D-vine
copula function. As it is exhibited in figure 8. Notice that no label
information is used to train the AE. It means the backdoor attack affects the
latent space distribution in those categories with a high level of
similarities without any information about the labels. In this case, numbers
$0,5$, and $7$ share some curvatures that make them sensitive to the attack.
This behavior can be considered as a fingerprint of the backdoor pattern
present in the model parameters $W^{(i)}$.

Latent space | Entropy | Change
---|---|---
Baseline | 0.4225 |
Backdoor | 0.5370 | 27.10%
Backdoor tested with clean data | 0.4811 | 13.87%
| KL |
Baseline vs. backdoor | 2.1449 |
Baseline vs. backdoor t. w. clean data | 2.5948 |
TABLE I: Latent space Entropy and Kullback-Leibler divergence for the
configurations used in this research. The Entropy’s percentage change and the
KL are computed using the baseline model as a reference.

Finally, the entropy of the latent distribution for the baseline, backdoor,
and backdoor tested with clean data is shown in table I. The smallest entropy
is exhibited by the baseline latent distribution, while the backdoor model
tested with clean data and attacked data are the second smallest and the
largest value respectively. It indicates that the backdoor increases the data
complexity of the input set as it was suggested by [36, 13, 37].

The Kullback-Leibler divergence between the latent distributions is also
presented in table I. It is smaller for the baseline compared to the backdoor
tested with attacked data. We presume it is related to the distortion of using
not previously seen data in the backdoor model which may induce an increment
in the latent space deviation from the baseline distribution.

###  V-A A practical limitation of the VCAE model for the latent distribution
study:

In a two units GPU system, training the AE and producing the latent space
distribution by the D-vine copula for a sample of 5000 images takes no more
than a couple of minutes, even for more than 5 dimensions in the latent space.
It includes the generative process of new samples based on the input set. The
biggest limitation is found in the latent distribution evaluation in a
reasonable number of points to produce the pairwise comparison and to estimate
the KL divergence. We considered 50 points from the uniform distribution
$U\sim[0,1]$ required as input for the copula in each dimension of
$\mathbf{h}$. In our experiments, the latent space has only 5 dimensions.
Resulting in matrices of around 20 Gigabytes of RAM. Since we evaluated three
latent distributions, it was required a system with at least 60 Gigabytes of
RAM. The memory requirements increase notably in bigger dimensions, where the
required RAM memory to evaluate the latent space may reach easily several
hundreds of Gigabytes in the RAM unit.

##  VI Conclusions and future work

We have presented a method that can be used to estimate the changes in the
input complexity induced by the backdoor attacks. It consists of the
traditional autoencoder as a tool to reduce the space dimensionality trained
by the back-propagation method. Since the latent space distribution is not
included in the AE optimization process. No constraints are imposed on the
density estimation leading to a more flexible representation of the space and
its dependency structure. It shows that VCAE is a promising method to infer
multidimensional distributions in the latent space with a relatively low
computational cost.

Our first contribution is based on the quantification of changes in the
complexity of backdoor data in a reduced space. It provides an accessible
display capability by using the pairwise representation. Besides, the input’s
entropy and the deviation between models though the Kullback-Leibler
divergence reflect the complexity increment of the input set. Our second
contribution is to consider the VCAE as a generative model to identify the
backdoor trigger included in the attacked model, and its reproduction in the
target category and non-target ones with similar shapes to the clean set.

As future work, the suggested method will be evaluated on other data sets at
different levels of attacks. It could illustrate the advantages and
disadvantages of the suggested methodology to identify backdoor and to
illustrate its effect on the model.

Figure 8: Persistent effect of backdoor attacks in the reconstructed output of
the copula distribution. Despite the latent density is generated with clean
data in the backdoor model, the attacked trigger is reproduced by the latent
distribution.

## Acknowledgment

This work was supported in part by the Open Cloud Institute at University of
Texas at San Antonio (UTSA).

## References

  * [1] N. Bendre, H. T. Marín, and P. Najafirad, “Learning from few samples: A survey,” _arXiv preprint arXiv:2007.15484_ , 2020.
  * [2] S. H. Silva and P. Najafirad, “Opportunities and challenges in deep learning adversarial robustness: A survey,” _arXiv preprint arXiv:2007.00753_ , 2020\.
  * [3] R. S. S. Kumar, M. Nyström, J. Lambert, A. Marshall, M. Goertzel, A. Comissoneru, M. Swann, and S. Xia, “Adversarial machine learning–industry perspectives,” _arXiv preprint arXiv:2002.05646_ , 2020\.
  * [4] N. Tagasovska, D. Ackerer, and T. Vatter, “Copulas as high-dimensional generative models: Vine copula autoencoders,” in _Advances in Neural Information Processing Systems (NIPS)_ , 2019, pp. 6528–6540.
  * [5] Y. Vorobeychik and M. Kantarcioglu, “Adversarial machine learning,” _Synthesis Lectures on Artificial Intelligence and Machine Learning_ , vol. 12, no. 3, pp. 1–169, 2018.
  * [6] H. Xu, Y. Ma, H.-C. Liu, D. Deb, H. Liu, J.-L. Tang, and A. K. Jain, “Adversarial attacks and defenses in images, graphs and text: A review,” _International Journal of Automation and Computing_ , vol. 17, no. 2, pp. 151–178, 2020.
  * [7] D. P. Kingma and M. Welling, “Auto-encoding variational bayes,” _arXiv preprint arXiv:1312.6114_ , 2013.
  * [8] J. Kos, I. Fischer, and D. Song, “Adversarial examples for generative models,” in _2018 ieee security and privacy workshops (spw)_. IEEE, 2018, pp. 36–42.
  * [9] Y. Liu, Y. Xie, and A. Srivastava, “Neural trojans,” in _2017 IEEE International Conference on Computer Design (ICCD)_. IEEE, 2017, pp. 45–48.
  * [10] C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, “Intriguing properties of neural networks,” _arXiv preprint arXiv:1312.6199v4_ , 2014.
  * [11] N. Papernot, P. McDaniel, I. Goodfellow, S. Jha, Z. B. Celik, and A. Swami, “Practical black-box attacks against machine learning,” in _Proceedings of the 2017 ACM on Asia conference on computer and communications security_ , 2017, pp. 506–519.
  * [12] N. B. Erichson, D. Taylor, Q. Wu, and M. W. Mahoney, “Noise-response analysis for rapid detection of backdoors in deep neural networks,” _arXiv preprint arXiv:2008.00123_ , 2020.
  * [13] A. Achille, G. Paolini, G. Mbeng, and S. Soatto, “The information complexity of learning tasks, their structure and their distance,” _arXiv preprint arXiv:1904.03292_ , 2019.
  * [14] C. Zhang, J. Bütepage, H. Kjellström, and S. Mandt, “Advances in variational inference,” _IEEE transactions on pattern analysis and machine intelligence_ , vol. 41, no. 8, pp. 2008–2026, 2018.
  * [15] D. P. Kingma, “Variational inference & deep learning: A new synthesis,” Ph.D. dissertation, University of Amsterdam, 2017.
  * [16] M. E. Tipping and C. M. Bishop, “Mixtures of probabilistic principal component analyzers,” _Neural computation_ , vol. 11, no. 2, pp. 443–482, 1999.
  * [17] D. Hendrycks and K. Gimpel, “Early methods for detecting adversarial images,” _arXiv preprint arXiv:1608.00530_ , 2016.
  * [18] L. v. d. Maaten and G. Hinton, “Visualizing data using t-sne,” _Journal of machine learning research_ , vol. 9, no. Nov, pp. 2579–2605, 2008.
  * [19] G. Harshvardhan, M. K. Gourisaria, M. Pandey, and S. S. Rautaray, “A comprehensive survey and analysis of generative models in machine learning,” _Computer Science Review_ , vol. 38, p. 100285, 2020.
  * [20] C. Doersch, “Tutorial on variational autoencoders,” _arXiv preprint arXiv:1606.05908_ , 2016.
  * [21] I. Goodfellow, Y. Bengio, and A. Courville, _Deep learning_. MIT press, 2016.
  * [22] D. Lopez-Paz, J. M. Hernández-Lobato, and G. Zoubin, “Gaussian process vine copulas for multivariate dependence,” in _International Conference on Machine Learning_ , 2013, pp. 10–18.
  * [23] R. B. Nelsen, _An introduction to copulas_. Springer Science & Business Media, 2007.
  * [24] H. Joe, _Dependence modeling with copulas_. CRC press, 2014.
  * [25] A.-C. Favre, S. El Adlouni, L. Perreault, N. Thiémonge, and B. Bobée, “Multivariate hydrological frequency analysis using copulas,” _Water resources research_ , vol. 40, no. 1, 2004.
  * [26] R. Frey, A. J. McNeil, and M. Nyfeler, “Copulas and credit models,” _Risk_ , vol. 10, no. 111114.10, 2001.
  * [27] C. Czado, “Analyzing dependent data with vine copulas,” _Lecture Notes in Statistics, Springer_ , 2019.
  * [28] K. Aas, C. Czado, A. Frigessi, and H. Bakken, “Pair-copula constructions of multiple dependence,” _Insurance: Mathematics and economics_ , vol. 44, no. 2, pp. 182–198, 2009.
  * [29] M. Sklar, “Fonctions dé repartition á n dimensions et leurs marges,” _Publ. inst. statist. univ. Paris_ , vol. 8, pp. 229–231, 1959.
  * [30] H. Joe, _Multivariate models and multivariate dependence concepts_. CRC Press, 1997.
  * [31] B. V. de Melo Mendes, M. M. Semeraro, and R. P. C. Leal, “Pair-copulas modeling in finance,” _Financial Markets and Portfolio Management_ , vol. 24, no. 2, pp. 193–213, 2010.
  * [32] M. Xu, L. Hua, and S. Xu, “A vine copula model for predicting the effectiveness of cyber defense early-warning,” _Technometrics_ , vol. 59, no. 4, pp. 508–520, 2017.
  * [33] G. Pereira and A. Veiga, “Par (p)-vine copula based model for stochastic streamflow scenario generation,” _Stochastic environmental research and risk assessment_ , vol. 32, no. 3, pp. 833–842, 2018.
  * [34] Y. Wang, H. Yao, and S. Zhao, “Auto-encoder based dimensionality reduction,” _Neurocomputing_ , vol. 184, pp. 232–242, 2016.
  * [35] A. Golan, _Foundations of info-metrics: Modeling, inference, and imperfect information_. Oxford University Press, 2018\.
  * [36] H. Chacon, S. Silva, and P. Rad, “Deep learning poison data attack detection,” in _2019 IEEE 31st International Conference on Tools with Artificial Intelligence (ICTAI)_. IEEE, 2019, pp. 971–978.
  * [37] K. Grosse, T. Lee, Y. Park, M. Backes, and I. Molloy, “A new measure for overfitting and its implications for backdooring of deep learning,” _arXiv preprint arXiv:2006.06721_ , 2020.


11footnotetext: Institut de Mathématiques, Université de Neuchâtel,
Switzerland.22footnotetext: ENS, Paris Saclay.

# Regularity of invariant densities for random switching between two linear
odes in ${\mathbb{R}}^{d}.$

Michel Benaïm1 and Améthyste Bichard2

###### Abstract

In a paper entitled singularities of invariant densities for random switching
between two linear odes in $2D$, Bakhtin et al [5], consider a Markov process
obtained by random switching between two stable linear vector fields in the
plane and characterize the singularities of the invariant density in terms of
the switching and contraction rates. This paper considers a generalization of
this model obtained by random switching between two stable linear vector
fields in ${\mathbb{R}}^{d}$ and provides sufficient conditions ensuring that
the invariant distribution is absolutely continuous and has a $C^{r}$ density.
In dimension $\geq 3$ it provides, to the best of our knowledge, the first
fully non-elliptic example of random switching for which quantitative
conditions guaranteeing smoothness of the invariant density can be proved.

###### Contents

  1. 1 Introduction
    1. 1.1 Model and examples
  2. 2 Main results
  3. 3 Proof of Theorem 2.2
    1. 3.1 Preliminaries
    2. 3.2 The induced chain and the $Q-\Delta$ decomposition
    3. 3.3 Proof of the key Lemma 3.3
  4. 4 Appendix

##  1 Introduction

Processes obtained by random switching between finitely many ODEs provide an
interesting class of piecewise deterministic Markov processes (PDMPs), a term
coined by Davis [19], that are often used in a variety of fields including
molecular and cellular biology [16], [20], population dynamics, ecology [10],
[23], [18], MCMC simulation [14], [24], and elsewhere [25]. The investigation
of their ergodic properties started around a decade ago ([3], [7], [8], [17],
[11], [6]). One of the key results established in [3] and [7] (see also [9]
chapter 6.4, and [13], Section 4.2) is that, under the existence of an
accessible and hypoelliptic point, there is (at most) one invariant
distribution which is absolutely continuous with respect to the Lebesgue
measure, and whose support equates the set of accessible points. Here, by
hypoelliptic, we mean a point at which the Lie algebra generated by the vector
fields has full rank. By accessible, we mean a point whose every neighborhood
can be reached from everywhere by following the solution curves of the
different ODEs. It is interesting to point out that this type of result has
long been known for stochastic differential equations. This was proved, for
example, by Arnold and Kiemann in [1]. An alternative proof, relying on
classical results by Bony [15] is in [9], Theorem 6.34. However, while for
stochastic differential equations, hypoellipticity ensures smoothness of the
invariant densities (by Hormandër’s theorem), the situation is more involved
for PDMPs obtained by random switching. The smoothness effect induced by
hypoellipticity may be balanced by contracting properties of the ODEs. In
dimension one, thanks to the work of Bakhtin, Hurth and Mattingly [2], the
situation is well understood: Singularities may occur at attracting equilibria
of the vector fields, while the invariant densities are always smooth away
from these equilibria. In higher dimensions, the situation is much more
complicated and, with the exception of a few very specific examples, little
was known until recently. In [4], Bakhtin, Hurth, Lawley and Mattingly
investigated a two dimensional elliptic (meaning that the vector fields are
transverse) system on the torus given by two free periodic vector fields .
They showed that, under certain strong assumptions, the densities are smooth.
In [5], the same authors considered a planar system given by two stable linear
vector fields, which is elliptic almost everywhere, except on a line where it
is "hypoelliptic". They were able to provide precise conditions (on the jump
rates and the eigenvalues of the vector fields) ensuring boundedness and
unboundedness of the densities. This example is one of the main motivations of
the present paper. The two recent articles [12] and [13] consider the more
general question of proving / disproving the $C^{r}$ regularity of invariant
densities in any dimension. The main result of [12] (see also Section 4.4 in
[13]) is that under a strong version of hypoellipticity called the $1$-H
rmander condition (meaning that the family of the vector fields and their
first-order brackets has full rank), densities are $C^{k}$ provided the jump
rate is fast enough. The paper [13] provides some quantitative estimates and
explains how certain dynamical quantities (like the expansion rates and the
expansion volume rate) should be taken into account to ensure $C^{k}$
regularity. This was successfully applied to the elliptic system on the torus
considered in [4] under much weaker hypotheses.

The present paper builds on the ideas introduced in [13] and gives precise
conditions ensuring that the invariant probability measure of a system
obtained by random switching between two linear ODEs in ${\mathbb{R}}^{d}$
possesses a $C^{r}$ density. This model is a natural generalization of the
planar example considered in [5]. In dimension $\geq 3$ it provides, to the
best of our knowledge, the first fully non-elliptic example of random
switching for which quantitative condition guaranteeing smoothness of the
invariant density can be proved. Note also that, for this example, the
stronger $1$-Hormand r condition used in [12] is not verified.

###  1.1 Model and examples

Throughout $d$ is an integer $\geq 2.$ The Euclidean scalar product on
${\mathbb{R}}^{d}$ is denoted $\langle\cdot\rangle$ and the associated norm
$\|\cdot\|.$ Let $A$ be a $d\times d$ real matrix whose eigenvalues have
negative real parts:

$\Lambda_{1}\leq\ldots\leq\Lambda_{d}<0.$

Let $p\in{\mathbb{R}}^{d}\setminus\\{0\\}.$ For $x\in{\mathbb{R}}^{d},$ set
$F_{0}(x)=Ax$ and $F_{1}(x)=A(x-p).$ We consider the PDMP
$(X_{t},I_{t})_{t\geq 0}$ living on ${\mathbb{R}}^{d}\times\\{0,1\\}$ defined
as

$\frac{dX_{t}}{dt}=F_{I_{t}}(X_{t}),$ (1)

where $(I_{t})_{t\geq 0}$ is a Markov chain on $\\{0,1\\},$ independent of
$(X_{t})_{t\geq 0},$ with transition rates $\alpha_{01},\alpha_{10}>0.$ That
is

${\mathsf{P}}(I_{t+s}=1-i|I_{t}=i,{\cal F}_{t})=s\alpha_{i(1-i)}+o(s)$ (2)

for $i\in\\{0,1\\},$ where ${\cal F}_{t}=\sigma\\{(X_{s},I_{s});s\leq t\\}.$

Let

$H:=\mathsf{span}(\\{A^{k}p:\>k\in{\mathbb{N}}\\}),$

be the vector space spanned by the family $\\{A^{k}p:\>k\in{\mathbb{N}}\\}.$
It is easy to verify that $H$ has dimension $d^{\prime}\in\\{1,\ldots,d\\}$
where $d^{\prime}$ is the largest integer such that
$p,Ap,\ldots,A^{d^{\prime}-1}p$ are linearly independent.

The next elementary lemma shows that $H\times\\{0,1\\}$ is an attracting
invariant set for the PDMP ((1), (2)). For $x\in{\mathbb{R}}^{d},$ we let
$P_{H}(x)$ denote the orthogonal projection of $x$ onto $H$ and
$\mathsf{dist}(x,H)=\|x-P_{H}(x)\|.$

###### Lemma 1.1

Let $0<\lambda<|\Lambda_{d}|.$ Let $(X_{t},I_{t})$ be a solution to ((1),
(2)). Then

(i)

For all $t\geq 0,$

$X_{t}\in H\Leftrightarrow\\{X_{s}\>:s\geq 0\\}\subset H$

(ii)

$\mathsf{dist}(X_{t},H)\leq Ce^{-\lambda t}\mathsf{dist}(X_{0},H)$

where $C$ is some constant depending on $A.$

Proof:  $(i)$ follows from the fact that both $F_{0}$ and $F_{1}$ are tangent
to $H.$ For $(ii),$ let $(\tilde{X_{t}})_{t\geq 0}$ be the solution to (1)
starting from $\tilde{X_{0}}=P_{H}(X_{0}).$ Then $\tilde{X_{t}}\in H$ and

$\|X_{t}-\tilde{X}_{t}\|=\|e^{tA}(X_{0}-\tilde{X}_{0})\|\leq Ce^{-\lambda
t}\|(X_{0}-\tilde{X}_{0})\|.$

$\Box$
In view of this lemma, the long term behavior of the PDMP ((1),(2)) on
${\mathbb{R}}^{d}\times\\{0,1\\}$ is given by its long term behavior on
$H\times\\{0,1\\}.$ Therefore, by replacing ${\mathbb{R}}^{d}$ by $H$ and $A$
by $A|_{H}$ if necessary, we can assume without loss of generality that the
following condition is met.

######  Assumption 1.2 (Standing assumption)

$H={\mathbb{R}}^{d},$ or equivalently: $p,Ap,\ldots,A^{d-1}p$ are linearly
independent.

From now on, this assumption is implicitly assumed to be verified.

###### Example 1.3

This example is given by Malrieu in [22], Section 4.2. Here $d=2,$

$A=\left(\begin{array}[]{cc}-1&-1\\\ 1&-1\\\ \end{array}\right),\mbox{ and
}p=\left(\begin{array}[]{c}1\\\ 0\\\ \end{array}\right).$

Malrieu ([22], Section 4.2, Open question 4) asks: What can be said on the
smoothness of the density of such a process ?

###### Example 1.4

This example is the one thoroughly studied by Bakhtin, Hurth, Lawley and
Mattingly in [5]. Here again $d=2$ and

$A=\left(\begin{array}[]{cc}-\lambda_{1}&0\\\ 0&-\lambda_{2}\\\
\end{array}\right),p=\left(\begin{array}[]{c}1\\\ 1\\\ \end{array}\right),$

with $\lambda_{1}>\lambda_{2}>0.$ The results in [5] characterize precisely
the boundedness properties of the invariant distribution. It is shown that
this distribution is absolutely continuous with respect to Lebesgue (see
Section 2 for a precise definition) and that the density is bounded on every
compact set contained in the interior of the accessible set. At points $0$ and
$p$ as well as at boundary points of the accessible set, this density blows up
if the switching rates are sufficiently large, while it remains bounded if
they are small enough. We refer the reader to Theorems 1 and 2 in [5].

###### Example 1.5

A natural generalization of Example 1.4 in dimension $d\geq 2$ is given by
$A=\mathsf{diag}(-\lambda_{1},\ldots,-\lambda_{d})$ with
$\lambda_{1}>\ldots>\lambda_{d}>0,$ and $p=(1,\ldots,1)^{t}.$ Assumption 1.2
is satisfied because the matrix $(p,Ap,\ldots,A^{d-1}p)$ is the Vandermonde
matrix whose determinant is $\prod_{i<j}(\lambda_{j}-\lambda_{i})\neq 0.$

###### Remark 1.6

In dimension $2,$ (see e.g Examples 1.3 and 1.4) the set of points at which
the system is nonelliptic \- that is the set of points $x\in{\mathbb{R}}^{2}$
at which $(F_{0}(x),F_{1}(x))$ has rank $<2$ \- is the one dimensional vector
space ${\mathbb{R}}p.$ On ${\mathbb{R}}p$, the system satisfies the
$1$-bracket condition :

$\mathsf{span}(F_{0}(x),F_{1}(x),[F_{0},F_{1}](x))={\mathbb{R}}^{2}.$

Therefore, Theorem 4.15 and Example 4.18 in [13], imply that for all $k\geq
0,$ the invariant density of the process is $C^{k}$ provided that
$\alpha_{01}$ and $\alpha_{10}$ are chosen sufficiently large. Note, however,
that these are purely qualitative results that give no information on the size
of $\alpha_{01}$ and $\alpha_{10}.$

###### Remark 1.7

In dimension $d\geq 3$ , there are always points at which the $1$-bracket
condition is not satisfied (in particular, the results mentioned in Remark 1.6
relying on the $1$-bracket conditions are useless). Still, the system is
hypoelliptic because the family

$([F_{0},F_{1}],[F_{0},[F_{0},F_{1}]],\ldots[F_{0},\ldots,[F_{0},[F_{0},F_{1}]])=(Ap,A^{2}p,\ldots,A^{d}p)$

has rank $d.$

##  2 Main results

Let $(P_{t})_{t\geq 0}$ be the Markov semi-group associated to
$(X_{t},I_{t})_{t\geq 0}.$ That is

$P_{t}f(x,i)=\mathsf{E}(f(X_{t},I_{t})|X_{0}=x,I_{0}=i),$

for all $f:{\mathbb{R}}^{d}\times\\{0,1\\}\rightarrow{\mathbb{R}}$ bounded and
measurable.

As usual, if $\mu$ is a measure on ${\mathbb{R}}^{d}\times\\{0,1\\}$ and $f$ a
measurable, bounded or nonnegative, function on
${\mathbb{R}}^{d}\times\\{0,1\\},$ $\mu f$ stands for $\int fd\mu,$ and $\mu
P_{t}$ is the measure defined by

$(\mu P_{t})f=\mu(P_{t}f).$

We also adopt the classical notation $P_{t}((x,i),\cdot)=\delta_{x,i}P_{t}.$

A probability measure $\Pi$ on ${\mathbb{R}}^{d}\times\\{0,1\\}$ is said to be
invariant for $(P_{t})_{t\geq 0}$ (or $(X_{t},I_{t})_{t\geq 0}$) if

$\Pi P_{t}=\Pi$

for all $t\geq 0.$

The Lebesgue measure on ${\mathbb{R}}^{d}\times\\{0,1\\}$ is the measure
${\mathbf{m}}=dx\otimes(\delta_{0}+\delta_{1})$ where $dx$ stands for the
Lebesgue measure on ${\mathbb{R}}^{d}.$

If a measure $\mu$ on ${\mathbb{R}}^{d}\times\\{0,1\\}$ is absolutely
continuous with respect to ${\mathbf{m}}$, its density is a
$L^{1}({\mathbf{m}})$ function
$\rho:{\mathbb{R}}^{d}\times\\{0,1\\}\rightarrow{\mathbb{R}}_{+},(x,i)\mapsto\rho_{i}(x)$
where $\rho_{i}=\frac{d\mu_{i}}{dx},$ and
$\mu_{i}(\cdot):=\mu(\cdot\times\\{i\\}).$ We say that $\rho$ is continuous,
$C^{k},$ etc. whenever $\rho_{i},i=0,1,$ are continuous, $C^{k},$ etc.

Given a piecewise continuous functions
$j:{\mathbb{R}}_{+}\rightarrow\\{0,1\\},$ and $x\in{\mathbb{R}}^{d},$ let
$t\mapsto y(t,x,j)$ denote the solution to the non-autonomous ODE

$\frac{dy}{dt}=F_{j(t)}(y),$

starting from $y(0)=x.$ Let $\gamma^{+}(x)$ be the set of all $y(t,x,j)$ with
$t\geq 0,$ and $j$ piecewise continuous. The accessible set of the pair
$F_{0},F_{1}$ is the nonempty compact connected set (see Proposition 3.11 in
[7] and [8] for more details) defined by

$\Gamma=\bigcap_{x\in{\mathbb{R}}^{d}}\overline{\gamma^{+}(x)}.$

Figure 1: The set $\Gamma$ in Example 1.3

The following proposition easily follows from existing results.

###### Proposition 2.1

(i)

The process $(X_{t},I_{t})_{t\geq 0}$ has a unique invariant probability
measure $\Pi$ which is absolutely continuous with respect to ${\mathbf{m}}$
and whose density $\rho$ can be chosen to be lower semi-continuous.

(ii)

The topological support of $\Pi$ writes $\Gamma\times\\{0,1\\}.$ Furthermore

$\mathsf{Int}(\Gamma)=\\{x\in{\mathbb{R}}^{d}\>:\rho_{i}(x)>0\\},$

and

$\overline{\mathsf{Int}(\Gamma)}=\Gamma.$

(iii)

There exists $\gamma>0$ and, for all $R>0,$ a constant $C_{R}>0$ such that for
all $x\in B(0,R)$ (the Euclidean ball centered at the origin with radius $R$)
and $i=0,1,$

$\|P_{t}((x,i),\cdot)-\Pi\|_{TV}\leq C_{R}e^{-\gamma t}.$

Here $\|\cdot\|_{TV}$ stands for the total variation distance.

Proof:  It is not hard to show (and this is done in Section 3.1) that
$(X_{t})$ eventually enters a compact set $M\subset{\mathbb{R}}^{d}$
positively invariant for the flows induced both by $F_{0}$ and $F_{1}.$
Furthermore, as pointed out in Remark 1.7, the Lie algebra generated by
$F_{0}$ and $F_{1}$ has full rank. Statements $(i)$ and $(iii)$ can then be
deduced from Corollary 2.7 in [6] (itself relying on previous results in [3],
[7] and [21]). The second statement follows from Theorem 4.5 in [13]. $\Box$
The main result of the paper is the following.

###### Theorem 2.2

Let $r\geq 0$ be a integer. Assume that

$\min(\alpha_{01},\alpha_{10})>-[\sum_{i=1}^{d}\Lambda_{i}+r\Lambda_{1}].$ (3)

Then, $\rho$ is $C^{r}$ on ${\mathbb{R}}^{d},$ where $\rho$ is, like in
Proposition 2.1, the density of $\Pi.$

###### Remark 2.3

In case Assumption 1.2 is not satisfied, the process $(X_{t},I_{t})_{t\geq 0}$
still admits a unique invariant probability measure $\Pi,$ supported by $H.$
Furthermore, it is not hard to show (by using a standard coupling argument),
that for all $0<\lambda<\min\\{|\Lambda_{d}|,\alpha_{01}+\alpha_{10}\\}$ there
exists some constant $C>0$ such that for every probability measure $\mu$ on
${\mathbb{R}}^{d}\times\\{0,1\\}$

$W_{1}(\mu P_{t},\Pi)\leq Ce^{-\lambda t}W_{1}(\mu,\Pi)$

where $W_{1}$ is the $1$-Wasserstein distance associated to the distance on
${\mathbb{R}}^{d}\times\\{0,1\\}$ defined as
$D((x,i),(y,j))=\|x-y\|+{\mathbf{1}}_{i\neq j}.$

Clearly the convergence of $(\mu P_{t})$ to $\Pi$ cannot hold in total
variation because, by invariance of $H,$ (see Lemma 1.1) $|\mu
P_{t}(H)-\Pi(H)|=1-\mu(H).$ However, for the process $(X_{t},I_{t})_{t\geq 0}$
restricted to $H\times\\{0,1\\},$ Proposition 2.1 and Theorem 2.2 hold true
with ${\mathbb{R}}^{d}$ replaced by $H$ and ${\mathbf{m}}$ the Lebesgue
measure on $H\times\\{0,1\\}.$

##  3 Proof of Theorem 2.2

###  3.1 Preliminaries

For $i=0,1,$ we let $\\{\Phi_{i}^{t}\\}_{t\in{\mathbb{R}}}$ denote the flow
induced by $F_{i}$ on ${\mathbb{R}}^{d}.$ That is,

$\Phi_{0}^{t}(x)=e^{tA}x,\mbox{ and }\Phi_{1}^{t}(x)=e^{tA}(x-p)+p.$

#### Adapted norms and state space

The following lemma is folklore. We provide a proof for convenience.

######  Lemma 3.1 (Adapted norms)

For all $\varepsilon>0,$ there exist scalar products $(\,,)_{\varepsilon}$ and
$\langle\,,\rangle_{\varepsilon}$ whose associated norms are denoted
$N_{\varepsilon}$ and $\|\>\|_{\varepsilon}$ such that:

$(Ax,x)_{\varepsilon}\leq(\Lambda_{d}+\varepsilon)N_{\varepsilon}^{2}(x)$

and

$\langle
Ax,x\rangle_{\varepsilon}\geq(\Lambda_{1}-\varepsilon)\|x\|^{2}_{\varepsilon}.$

In particular, if $0<\varepsilon<|\Lambda_{d}|$, there exists $R>0$ such that

$\frac{dN_{\varepsilon}(\Phi^{t}_{i}(x))}{dt}<0$

for all $i\in\\{0,1\\},t\geq 0$ and $N_{\varepsilon}(x)\geq R.$

Proof:  Recall that $\|\cdot\|$ and $\langle,\,\rangle$ stand for the
Euclidean norm and scalar product. Fix $\varepsilon>0$ and let
$\lambda=\Lambda_{d}+\varepsilon.$ Then, there exists $\tau>0,$ sufficiently
large, so that $\|e^{tA}x\|\leq e^{\lambda t}\|x\|$ for all $t\geq\tau.$ Set

$(x,y)_{\varepsilon}=\int_{0}^{\tau}\langle e^{sA}x,e^{sA}y\rangle
e^{-2\lambda s}ds.$

To shorten notation we write $(x,y)$ for $(x,y)_{\varepsilon},$ and $N$ for
$N_{\varepsilon}.$ Then

$(Ax,x)=\frac{1}{2}\int_{0}^{\tau}\frac{d\|e^{sA}x\|^{2}}{ds}e^{-2\lambda
s}ds=\frac{1}{2}(\|e^{\tau A}x\|^{2}e^{-2\lambda\tau}-\|x\|^{2})+\lambda
N^{2}(x)\leq\lambda N^{2}(x).$

This proves the first assertion. The second is analogous. It immediately
follows that whenever $\lambda<0,$ $(F_{0}(x),x)<0$ for all $x\neq 0,$ and

$(F_{1}(x),x)=(A(x-p),(x-p))+(A(x-p),p)\leq N(x-p)[\lambda N(x-p)+C]$

with $C=N(A)N(p).$ This latter quantity is negative for $N(x)$ sufficiently
large. This proves the last statement. $\Box$
We now define the state space ${\mathbf{M}}$ of the process. Fix
$0<\varepsilon_{0}<|\Lambda_{d}|.$ The value of $\varepsilon_{0}$ is
unimportant. Let $N=N_{\varepsilon_{0}}$ and ${\mathbf{M}}=M\times\\{0,1\\}$
where

$M=\\{x\in{\mathbb{R}}^{d}:\>\>N(x)\leq R\\}$ (4)

with $R$ given by the preceding lemma. From what precedes, the PDMP
$(X_{t},I_{t})$ starting from $(x,i)\in{\mathbb{R}}^{d}\times\\{0,1\\}$
eventually enters ${\mathbf{M}}$ and remains in ${\mathbf{M}}$ afterwards.

#### The spaces $C^{r}(M),C^{r}({\mathbf{M}})$

For $r\in{\mathbb{N}},$ and $M$ as above (4), let $C^{r}(M)$ be the space of
$C^{r}$ functions $f:{\mathbb{R}}^{d}\rightarrow{\mathbb{R}}$ such that $f=0$
on ${\mathbb{R}}^{d}\setminus M.$ For $\varepsilon>0,$ let
$\|\cdot\|_{\varepsilon}$ be the norm on ${\mathbb{R}}^{d}$ induced by
$\langle,\rangle_{\varepsilon}$ as defined in Lemma 3.1. For $f\in C^{r}(M),$
define

$\|f\|_{r,\varepsilon}=\sum_{k=0}^{r}\|D^{k}f\|_{\varepsilon},$ (5)

where $D^{0}f=f$ and $\|D^{k}f\|_{\varepsilon}=\sup_{x\in
M}\|D^{k}f(x)\|_{\varepsilon}.$ Here, as usual, for $k\geq 1,$

$\|D^{k}f(x)\|_{\varepsilon}=\sup\\{|D^{k}f(x)(u_{1},\ldots,u_{k})|:\>\|u_{1}\|_{\varepsilon}\leq
1,\ldots,\|u_{k}\|_{\varepsilon}\leq 1\\}.$

The space $C^{r}(M)$ equipped with $\|\cdot\|_{r,\varepsilon}$ is a Banach
space. The induced topology is the standard $C^{r}$ topology.

Let $C^{r}({\mathbf{M}})$ be the Banach space (naturally identified with
$C^{r}(M)\times C^{r}(M)$) of functions

$f:{\mathbb{R}}^{d}\times\\{0,1\\}\rightarrow{\mathbb{R}},(x,i)\mapsto
f_{i}(x),$

for which $f_{i}\in C^{r}(M),$ and equipped with the norm

$\|f\|_{r,\varepsilon}=\|f_{0}\|_{r,\varepsilon}+\|f_{1}\|_{r,\varepsilon}.$
(6)

###  3.2 The induced chain and the $Q-\Delta$ decomposition

From now on and until the end of Section 3, we assume that $r\in{\mathbb{N}}$
is given and that the jump rates $\alpha_{01},\alpha_{10}$ satisfy condition
(3). We fix $\alpha,\varepsilon>0$ such that

$\alpha>\max(\alpha_{01},\alpha_{10})\geq\min(\alpha_{01},\alpha_{10})>r|\Lambda_{1}|+\sum_{i=1}^{d}|\Lambda_{i}|+r\varepsilon.$
(7)

Let $U$ be the Markov transition matrix on $\\{0,1\\}$ given by

$U=\frac{1}{\alpha}\left(\begin{array}[]{cc}\alpha-\alpha_{01}&\alpha_{01}\\\
\alpha_{10}&\alpha-\alpha_{10}\\\ \end{array}\right).$

It induces a Markov operator on ${\mathbf{M}},$ still denoted $U$, defined as

$Uf(x,i):=(Uf(x))_{i}=U_{i0}f(x,0)+U_{i1}f(x,1).$

Let now, $K$ and $P$ be the Markov operators on ${\mathbf{M}}$ respectively
defined by

$Kf(x,i)=\int_{0}^{\infty}f(\Phi_{i}^{t/\alpha}(x),i)e^{-t}dt,$

and

$P=KU.$ (8)

###### Remark 3.2

The kernel $P$ is the kernel of a discrete time Markov chain
$(X_{n},I_{n})_{n\geq 0}$ living on ${\mathbf{M}}$ where $(I_{n})$ is a Markov
chain on $\\{0,1\\}$ independent of $(X_{n})$ with transition matrix $U,$

$X_{n+1}=\Phi_{I_{n}}^{\tau_{n+1}}(X_{n}),$

and $(\tau_{n})_{n\geq 0}$ is a sequence of i.i.d random variables having an
exponential distribution with parameter $\alpha.$

The (unique) invariant distribution $\pi$ of $P$ and the (unique) invariant
distribution $\Pi$ of the PDMP ((1), (2)) are linked by the following
formulaes established in ([7], Proposition 2.4 and Lemma 2.6).

$\Pi=\pi K,\,\pi=\Pi U.$

In particular, the densities of $\pi$ and $\Pi,$ satisfy

$\frac{d\pi_{i}}{dx}=\frac{d\Pi_{0}}{dx}U_{0i}+\frac{d\Pi_{1}}{dx}U_{1i},i=0,1.$
(9)

The $2\times 2$ matrix $U$ being invertible, this shows that $\frac{d\pi}{dx}$
and $\frac{d\Pi}{dx}$ have the same regularity properties. The proof of
Theorem 2.2 then amounts to proving that $\pi$ has a $C^{r}$ density.

The strategy of the proof heavily relies on the recent paper [13]. The main
idea is to show that, for $n$ sufficiently large, $P^{n}$ decomposes as the
sum of a sub-markov kernel $Q$ producing regularity and a "small" sub-Markov
kernel $\Delta$ preserving regularity.

Let ${\cal M}({\mathbf{M}})$ be the set of nonnegative bounded measures on
${\mathbf{M}}$ and ${\cal C}({\mathbf{M}})\subset{\cal M}({\mathbf{M}})$ the
subset of measures $\mu$ that are absolutely continuous with respect to the
Lebesgue measure ${\mathbf{m}}$ and whose density $\rho$ lies in
$C^{r}({\mathbf{M}}).$ For such a $\mu$ we write $\|\mu\|_{r,\varepsilon}$ for
$\displaystyle\|\rho\|_{r,\varepsilon}$ by abuse of notation.

A kernel $Q$ on ${\mathbf{M}}$ is called subMarkov (respectively
nondegenerate) if $Q(z,{\mathbf{M}})\leq 1,$ (respectively
$Q(z,{\mathbf{M}})\neq 0$) for all $z\in{\mathbf{M}}.$ It is called Feller if
$Qf$ is continuous whenever $f$ is continuous on ${\mathbf{M}}.$

The following lemma is the cornerstone of the proof. Combined with Theorem 2.8
in [13], it implies that $\pi,$ hence $\Pi,$ lies in ${\cal C}(M).$

######  Lemma 3.3 (Key Lemma)

Assume that condition (3) holds. Then, there exists $n\in{\mathbb{N}}^{*}$
such that $P^{n}=Q+\Delta,$ where $Q$ is a nondegenerate sub-Markov kernel and
$\Delta$ a sub-Markov kernel on ${\mathbf{M}}$ satisfying the following
properties:

(i)

${\cal M}({\mathbf{M}})Q\subset{\cal C}({\mathbf{M}}),$

(ii)

${\cal C}({\mathbf{M}})\Delta\subset{\cal C}({\mathbf{M}})$

(iii)

For all $\mu\in{\cal
C}({\mathbf{M}}),\sum_{k}\|\mu\Delta^{k}\|_{r,\varepsilon}<\infty.$

The remainder of the section is devoted to the proof of this lemma.

###  3.3 Proof of the key Lemma 3.3

Given $n\geq 1,{\mathbf{i}}=(i_{1},\ldots,i_{n})\in\\{0,1\\}^{n},$ and
$s=(s_{1},\ldots,s_{n})\in{\mathbb{R}}^{n},$ we set

$\mathbf{\Phi}^{s}_{{\mathbf{i}}}=\Phi_{i_{n}}^{s_{n}}\circ\ldots\circ\Phi_{i_{1}}^{s_{1}}.$
(10)

and

$U[{\mathbf{i}}]=U_{i_{1}i_{2}}\ldots U_{i_{n-2}i_{n-1}}U_{i_{n-1}i_{n}}.$
(11)

If $i,j\in\\{0,1\\}$ we use the notation
$(i,{\mathbf{i}}),(i,{\mathbf{i}},j),$ etc. to denote the sequences
$(i,i_{1},\ldots,i_{n})\in\\{0,1\\}^{n+1},(i,i_{1},\ldots,i_{n},j)\in\\{0,1\\}^{n+2},$
etc.

Given a $C^{\infty}$ function $h:({\mathbb{R}}_{+}^{*})^{n}\mapsto[0,1]$ and
${\mathbf{i}}\in\\{0,1\\}^{n-1},$ we let $P_{{\mathbf{i}},h}$ denote the sub-
Markovian operator on ${\mathbf{M}}$ defined by

$P_{{\mathbf{i}},h}f(x,i)=\sum_{j\in\\{0,1\\}}U[(i,{\mathbf{i}},j)]\int_{{\mathbb{R}}^{n}_{+}}f(\mathbf{\Phi}_{(i,{\mathbf{i}})}^{s/\alpha}(x),j)e^{-|s|}h(s)ds,$
(12)

where $|s|$ stands for $s_{1}+\ldots+s_{n}.$

If $h\equiv 1,$ we write $P_{{\mathbf{i}}}$ for $P_{{\mathbf{i}},h.}$ Clearly
we have that

$P_{{\mathbf{i}}}=P_{{\mathbf{i}},1-h}+P_{{\mathbf{i}},h}$

and

$P_{{\mathbf{i}}}f(x,i)=\mathbb{E}_{x,i}(f(X_{n},I_{n}){\mathbf{1}}_{\left\\{(I_{1},\ldots,I_{n-1})={\mathbf{i}}\right\\}}),$

where $(X_{n},I_{n})$ is the discrete time Markov chain having $P$ as
transition kernel (see Remark 3.2). In particular

$P^{n}=\sum_{{\mathbf{i}}\in\\{0,1\\}^{n-1}}P_{{\mathbf{i}}}.$ (13)

For $n>1$ and ${\mathbf{i}}\in\\{0,1\\}^{n},$ let

$S({\mathbf{i}})=\mathsf{card}\\{k\in\\{1,\ldots,n-1\\}\>:i_{k+1}\neq
i_{k}\\}$

denote the number of "switches" in the sequence ${\mathbf{i}}.$ For all
$n>d+1,$ we can then rewrite $P^{n}$ as $P^{n}=Q+\Delta,$ where
$\Delta=\Delta_{1}+\Delta_{2},$

$\displaystyle\Delta_{1}=\sum_{\\{{\mathbf{i}}\in\\{0,1\\}^{n-1}\>:\mathsf{S}({\mathbf{i}})<d\\}}P_{{\mathbf{i}}},$
(14)
$\Delta_{2}=\sum_{\\{{\mathbf{i}}\in\\{0,1\\}^{n-1}\>:\mathsf{S}({\mathbf{i}})\geq
d\\}}P_{{\mathbf{i}},1-h_{{\mathbf{i}}}},$ (15)
$Q=\sum_{\\{{\mathbf{i}}\in\\{0,1\\}^{n-1}\>:\mathsf{S}(i)\geq
d\\}}P_{{\mathbf{i}},h_{{\mathbf{i}}}},$ (16)

and $h_{{\mathbf{i}}}:({\mathbb{R}}_{+}^{*})^{n}\rightarrow[0,1]$ (appearing
in $\Delta_{2}$ and $Q$) is a smooth function to be chosen later. Our next
goal is to show that $Q$ and $\Delta$ meet the requirement of Lemma 3.3.

#### Tranfer operators

The transfer operator of $\Phi^{t}_{i}$ is the operator on $L^{1}(dx)$ defined
as

${\cal
L}_{\Phi^{t}_{i}}(\rho)(x)=\rho(\Phi^{-t}_{i}(x))\mathsf{det}(D\Phi^{-t}_{i}(x))=\rho(\Phi^{-t}_{i}(x))e^{-t\mathsf{Tr}(A)}$
(17)

where

$\mathsf{Tr}(A)=\Lambda_{1}+\ldots+\Lambda_{d}$

is the trace of $A.$

Note that if $\rho$ is the density (with respect to the Lebesgue measure) of
some bounded measure $\mu,$ then ${\cal L}_{\Phi^{t}_{i}}(\rho)$ if the
density of $\mu\circ(\Phi_{i}^{t})^{-1},$ the image measure of $\mu$ by
$\Phi_{i}^{t}.$

Note also that for all $t\geq 0$

${\cal L}_{\Phi^{t}_{i}}(C^{r}(M))\subset C^{r}(M).$

The following lemma follows directly from the chain rule and the definition of
$\|\cdot\|_{r,\varepsilon}$ on $C^{r}(M).$ Here $\|{\cal
L}_{\Phi_{i}^{t}}\|_{r,\varepsilon}$ stands for the operator norm of ${\cal
L}_{\Phi_{i}^{t}}$ on $(C^{r}(M),\,\|\cdot\|_{r,\varepsilon}).$

###### Lemma 3.4

For all $t\geq 0,$ and $i\in\\{0,1\\},$

$\|{\cal
L}_{\Phi_{i}^{t}}\|_{r,\varepsilon}\leq\exp{\left[-t\left(\mathsf{Tr}A-r(|\Lambda_{1}|+\varepsilon)\right)\right]}=\exp{\left[t\left(r|\Lambda_{1}|+\sum_{i=1}^{d}|\Lambda_{i}|+r\varepsilon\right)\right]}.$

For all ${\mathbf{i}}\in\\{0,1\\}^{n}$ and $s\in{\mathbb{R}}^{n},$ the
transfer operator of $\mathbf{\Phi}^{s}_{{\mathbf{i}}}$ (see equation (10)) on
$L^{1}(dx)$ is naturally defined as

${\cal L}_{\mathbf{\Phi}^{s}_{{\mathbf{i}}}}={\cal
L}_{\Phi_{i_{n}}^{s_{n}}}\circ\ldots\circ{\cal L}_{\Phi_{i_{1}}^{s_{1}}}$

where ${\cal L}_{\Phi_{i}^{t}}$ is defined by (17).

Associated to $P_{{\mathbf{i}},h}$ (see equation (12)) is the transfer
operator on $L^{1}({\mathbf{m}})$ given by

${\cal P}_{{\mathbf{i}},h}(\rho)(x,j)=U[0,{\mathbf{i}},j]{\cal
L}_{(0,{\mathbf{i}}),h}(\rho_{0})+U[1,{\mathbf{i}},j]{\cal
L}_{(1,{\mathbf{i}}),h}(\rho_{1})$ (18)

where

${\cal L}_{(i,{\mathbf{i}}),h}(\rho_{i}):=\int_{{\mathbb{R}}_{+}^{n}}{\cal
L}_{\mathbf{\Phi}_{(i,{\mathbf{i}})}^{s/\alpha}}(\rho_{i})e^{-|s|}h(s)ds$ (19)

Here also, when $h\equiv 1,$ we write ${\cal P}_{{\mathbf{i}}}$ for ${\cal
P}_{{\mathbf{i}},h}.$

It is readily seen that if $\mu\in{\cal M}({\mathbf{M}})$ has density $\rho\in
L^{1}({\mathbf{m}})$ then $\mu P_{{\mathbf{i}},h}$ has density ${\cal
P}_{{\mathbf{i}},h}(\rho).$ Furthermore,

###### Lemma 3.5

The operator ${\cal P}_{{\mathbf{i}},h}$ is bounded on $C^{r}({\mathbf{M}})$
and for every set $I\subset\\{0,1\\}^{n-1},$ letting
$U[(i,I)]=\sum_{{\mathbf{i}}\in I}U[(i,{\mathbf{i}})],$ one has

$\displaystyle\|\sum_{{\mathbf{i}}\in I}{\cal
P}_{{\mathbf{i}},h}\|_{r,\varepsilon}\leq\max(U[(0,I)],U([(1,I)])C(h)$

where

$C(h)=\int_{({\mathbb{R}}_{+}^{*})^{n}}\exp|s|\left[\frac{r|\Lambda_{1}|+\sum_{i=1}^{d}|\Lambda_{i}|+r\varepsilon}{\alpha}-1\right]h(s)ds$
$\leq\left[1-\frac{r|\Lambda_{1}|+\sum_{i=1}^{d}|\Lambda_{i}|+r\varepsilon}{\alpha}\right]^{-n}.$

Proof:  Set $C=C(h).$ By the preceding lemma and the definition (19) one has

$\|{\cal L}_{(i,{\mathbf{i}}),h}(\rho_{i})\|_{r,\varepsilon}\leq
C(h)\|\rho_{i}\|_{r,\varepsilon}.$

Thus, by the definition of the norm $\|\cdot\|_{r,\varepsilon}$ on
${\mathbf{M}}$ it comes that

$\|\sum_{{\mathbf{i}}\in I}{\cal
P}_{{\mathbf{i}},h}(\rho)\|_{r,\varepsilon}\leq C\sum_{{\mathbf{i}}\in
I}(U[(0,{\mathbf{i}},0)]\|\rho_{0}\|_{r,\varepsilon}+U[(1,{\mathbf{i}},0)]\|\rho_{1}\|_{r,\varepsilon})$
$+C\sum_{{\mathbf{i}}\in
I}(U[(0,{\mathbf{i}},1)]\|\rho_{0}\|_{r,\varepsilon}+U[(1,{\mathbf{i}},1)]\|\rho_{1}\|_{r,\varepsilon})$
$\leq\max(U[(0,I)],U([(1,I)])C(\|\rho_{0}\|_{r,\varepsilon}+\|\rho_{1}\|_{r,\varepsilon})=\max(U[(0,I)],U([(1,I)])C\|\rho\|_{r,\varepsilon}.$

This proves the first inequality. The last one is immediate because $0\leq
h\leq 1.$ $\Box$

#### The operator $\Delta_{1}$

A consequence of the preceding lemma is that, under the assumption of the key
Lemma, the norm of the transfer operator associated to $\Delta_{1}$ (equation
(14)) can be made arbitrary small by choosing $n$ sufficiently large.

###### Lemma 3.6

For all $\eta>0$ there exists $n$ sufficiently large such that

$\|\sum_{\\{{\mathbf{i}}\in\\{0,1\\}^{n-1}\>:\mathsf{S}({\mathbf{i}})<d\\}}{\cal
P}_{{\mathbf{i}}}\|_{r,\varepsilon}<\eta.$

Proof:  Assume for simplicity that $d$ is even (the proof is the same with $d$
odd). Let $T^{1},T^{2},\ldots$ be independent random variables taking values
in ${\mathbb{N}}^{*}$ such that, for $i$ odd (respectively even) $T^{i}$ has a
geometrical distribution with parameter $U_{01}$ (respectively $U_{10}$).
Then,

$\sum_{\\{{\mathbf{i}}\in\\{0,1\\}^{n-1}\mathsf{S}({\mathbf{i}})<d\\}}U(0,{\mathbf{i}})={\mathsf{P}}(T^{1}+\ldots+T^{d}>n-1).$

Now, by Markov inequality, for all

$1<z<\frac{1}{\max(U_{00},U_{11})}=\min((1-\frac{\alpha_{01}}{\alpha})^{-1},(1-\frac{\alpha_{10}}{\alpha})^{-1}),$
(20)
${\mathsf{P}}(T^{1}+\ldots+T^{d}>n-1)\leq\frac{\mathsf{E}(z^{T^{1}+\ldots+T^{d}})}{z^{n-1}}=\frac{1}{z^{n-1}}[\frac{z(1-U_{00})}{(1-zU_{00})}]^{d/2}[\frac{z(1-U_{11})}{(1-zU_{11})}]^{d/2}.$

Our condition 7 permits to choose $z$ satisfying (20) such that

$z\left[1-\frac{r|\Lambda_{1}|+\sum_{i=1}^{d}|\Lambda_{i}|+r\varepsilon}{\alpha}\right]>1.$

Combined with Lemma 3.5, this proves the result. $\Box$

#### The operators $Q,\Delta_{2},$ and the end of the proof

For ${\mathbf{i}}\in\\{0,1\\}^{n},$ we use the notation
$\mathbf{\Phi}_{{\mathbf{i}}}(x)$ to denote the mapping
$s\in{\mathbb{R}}^{n}\mapsto\mathbf{\Phi}^{s}_{{\mathbf{i}}}(x)\in{\mathbb{R}}^{d}$
where $\mathbf{\Phi}^{s}_{{\mathbf{i}}}(x)$ is defined by (10).

###### Lemma 3.7

Let $\mathbf{j}\in\\{0,1\\}^{d+1}$ be one of the two sequences defined by
$j_{k+1}=1-j_{k}$ for $k=1,\ldots,d.$ That is $\mathbf{j}=(0,1,0,\ldots)$ or
$\mathbf{j}=(1,0,1,\ldots).$ Then, there exists an open set
$O\subset({\mathbb{R}}_{+}^{*})^{d+1}$ having full Lebesgue measure such that
for all $x\in M,$ and $s\in O,\mathbf{\Phi}_{\mathbf{j}}(x)$ is submersive at
$s.$

Proof:

Assume for the sake of the proof that $j_{1}=0.$ The other case $j_{1}=1$ is
treated similarly. Set $\mathbf{\Phi}^{s}=\mathbf{\Phi}_{\mathbf{j}}^{s}(0).$
Let

$O^{\prime}=\\{(s_{2},\ldots,s_{d+1})\in({\mathbb{R}}_{+}^{*})^{d}\>:\mathsf{det}\left(\partial_{s_{2}}\mathbf{\Phi}^{s},\ldots,\partial_{s_{d+1}}\mathbf{\Phi}^{s}\right)\neq
0\\}.$

Our first goal is to show that $O^{\prime}$ has full measure in
$({\mathbb{R}}_{+}^{*})^{d}.$

To shorten notation, write
$y_{k}=\Phi_{j_{k}}^{s_{k}}\circ\ldots\circ\Phi_{j_{1}}^{s_{1}}(0).$ Using the
chain rule, it comes that, for $k=1,\ldots,d+1,$

$\partial_{s_{k}}\mathbf{\Phi}^{s}=D(\Phi_{j_{d+1}}^{t_{d+1}}\circ\dots\circ\Phi_{j_{k+1}}^{t_{k+1}})(y_{k})F_{j_{k}}(y_{k})$
$=e^{\left((\sum_{i=k+1}^{d+1}s_{i})A\right)}F_{j_{k}}(y_{k}).$

Thus, $\partial_{s_{1}}\mathbf{\Phi}^{s}=0,$ and for all $k=1,\ldots,d+1,$

$\partial_{s_{k}}\mathbf{\Phi}^{s}-\partial_{s_{k-1}}\mathbf{\Phi}^{s}=e^{\left((\sum_{i=k+1}^{d+1}s_{i})A\right)}[F_{j_{k}}(y_{k})-e^{s_{k}A}F_{j_{k-1}}(y_{k-1})]$
$=\pm Ae^{(\sum_{i=k+1}^{d+1}s_{i})A)}p.$

Here, the last equality follows from the simple observation that

$F_{i}(\Phi_{1-i}^{s}(y))-e^{sA}F_{1-i}(y)=(-1)^{i}Ap$

for all $y\in{\mathbb{R}}^{d},s\in{\mathbb{R}}$ and $i\in\\{0,1\\}.$ Rewriting

$\mathsf{det}\left(\partial_{s_{2}}\mathbf{\Phi}^{s},\ldots,\partial_{s_{d+1}}\mathbf{\Phi}^{s}\right)=\mathsf{det}\left(\partial_{s_{2}}\mathbf{\Phi}^{s},\partial_{s_{3}}\mathbf{\Phi}^{s}-\partial_{s_{2}}\mathbf{\Phi}^{s},\ldots,\partial_{s_{d+1}}\mathbf{\Phi}^{s}-\mathbf{\Phi}(s_{d})\right),$

it follows that $O^{\prime}=({\mathbb{R}}_{+}^{*})^{d}\setminus(f\circ
T)^{-1}(0),$ where

$T(s_{2},...,s_{d+1})=(s_{2},s_{2}+s_{3},\ldots,s_{2}+s_{3}+\ldots+s_{d+1})$

and

$f(t_{2},...,t_{d+1})=\mathsf{det}\left(e^{t_{d}A}p,...,e^{t_{2}A}p\right).$

The map $f$ being real analytical (by analyticity of $\mathsf{det}$ and
$\mathsf{exp}$), $f^{-1}(0)$ has measure zero unless $f$ is identically zero.
A proof of this fact is given for convenience in the appendix (see Lemma 4.1).
To see that $f$ is nonzero, notice that
$\partial_{t_{2}}\partial^{2}_{t_{3}^{2}}\ldots\partial^{d}_{t_{d+1}^{d}}f(0)=\mathsf{det}(A^{d}p,\ldots,A^{2}p,Ap)\neq
0$ by Assumption 1.2. Now, since $T$ preserves the Lebesgue measure, $(f\circ
T)^{-1}(0)$ has measure zero. This concludes the proof that $O^{\prime}$ has
full measure.

To conclude the proof of the lemma, observe that for all
$x\in{\mathbb{R}}^{d},$ and $s\in({\mathbb{R}}_{+}^{*})^{d+1},$
$\mathbf{\Phi}^{s}(x)=\mathbf{\Phi}^{s}+e^{(\sum_{i=1}^{s_{d+1}}s_{i}A)}x.$
Therefore,

$\partial_{s_{k}}\mathbf{\Phi}^{s}(x)-\partial_{s_{1}}\mathbf{\Phi}^{s}(x)=\partial_{s_{k}}\mathbf{\Phi}^{s}$

for all $k=2,\ldots d+1.$ This shows that for all $s\in
O:={\mathbb{R}}_{+}^{*}\times O^{\prime}$ and for all $x\in{\mathbb{R}}^{d},$
$\mathbf{\Phi}(x)$ is submersive at $s.$ $\Box$
The following lemma follows directly from the preceding one.

###### Lemma 3.8

Let $n\geq d+1$ and ${\mathbf{i}}\in\\{0,1\\}^{n}$ be such that
$S({\mathbf{i}})\geq d.$

(i)

There exists an open set $O_{{\mathbf{i}}}\subset({\mathbb{R}}_{+}^{*})^{n}$
having full Lebesgue measure such that for all $s\in O_{{\mathbf{i}}}$ and
$x\in M,$ $\mathbf{\Phi}_{{\mathbf{i}}}(x)$ is submersive at $s;$

(ii)

For all $\eta>0$ there exists a $C^{\infty}$ function
$h_{{\mathbf{i}}}:({\mathbb{R}}_{+}^{*})^{n}\rightarrow[0,1],$ with support in
$O_{{\mathbf{i}}},$ such that

$\|{\cal P}_{{\mathbf{i}},1-h_{{\mathbf{i}}}}\|_{r,\varepsilon}\leq\eta;$

and

${\cal M}({\mathbf{M}})P_{{\mathbf{i}},h_{{\mathbf{i}}}}\subset{\cal
C}({\mathbf{M}}).$

Proof:  The condition $S({\mathbf{i}})\geq d,$ implies that

$\mathbf{\Phi}_{{\mathbf{i}}}^{(s_{1},\ldots,s_{n})}(x)=\Phi_{i_{n}}^{s_{n}}\circ\dots\circ\Phi_{i_{k+1}}^{s_{k+1}}(\mathbf{\Phi}_{{\mathbf{j}}}^{T(s_{1},\ldots,s_{k})}(x))$

where ${\mathbf{j}}\in\\{0,1\\}^{d+1}$ is like in Lemma 3.7, $d+1\leq k\leq
n,$ and $T:{\mathbb{R}}^{k}\rightarrow{\mathbb{R}}^{d+1}$ writes

$T(s_{1},\ldots,s_{k})=(\sum_{0<i\leq k_{1}}s_{i},\sum_{k_{1}<i\leq
k_{2}}s_{i},\ldots,\sum_{k_{d}<i\leq k}s_{i}).$

with $1\leq k_{1}<k_{2}<\ldots<k:=k_{d+1}\leq n.$ By Lemma 3.7, and
surjectivity of $T,$ $s\mapsto\mathbf{\Phi}_{{\mathbf{j}}}^{T(s)}(x)$ is a
submersion on $T^{-1}(O)$ where $O$ is like in Lemma 3.7. Since
$x\mapsto\Phi_{i_{n}}^{s_{n}}\circ\dots\circ\Phi_{i_{k+1}}^{s_{k+1}}(x)$ is a
diffeomorphism, $\mathbf{\Phi}_{{\mathbf{i}},x}$ is then a submersion at every
$s\in O_{{\mathbf{i}}}=T^{-1}(O)\times({\mathbb{R}}_{+}^{*})^{n-(k+1)}.$
Furthermore, $O_{{\mathbf{i}}}$ has full measure in ${\mathbb{R}}^{n}$ because
$O$ has full measure and $T$ is a linear surjection. This proves $(i).$

We now prove $(ii).$ Let $\nu$ be the Borel measure on ${\mathbb{R}}^{n}$
defined by

$\nu(ds)=\exp|s|\left[\frac{r|\Lambda_{1}|+\sum_{i=1}^{d}|\Lambda_{i}|+r\varepsilon}{\alpha}-1\right]{\mathbf{1}}_{({\mathbb{R}}_{+}^{*})^{n}}(s).$

Then, $\nu$ is finite, hence regular. Therefore, there exists a compact set
$K_{{\mathbf{i}}}\subset O_{{\mathbf{i}}}$ such that
$\nu(O_{{\mathbf{i}}}\setminus K_{{\mathbf{i}}})\leq\eta.$ Let
$h_{{\mathbf{i}}}$ be a $C^{\infty}$ function with $0\leq h_{{\mathbf{i}}}\leq
1$ having support in $O_{{\mathbf{i}}}$ and such $h|_{K_{{\mathbf{i}}}}=1.$
Then the first assertion follows from Lemma 3.5 and the second from
Proposition 3.2 in [13], because by $(i)$ $\mathbf{\Phi}_{{\mathbf{i}}}(x)$ is
submersive at every point $s$ in the support of $h_{{\mathbf{i}}}.$ $\Box$
We can now conclude the proof of Lemma 3.3. Fix $\eta<\frac{1}{2}.$ First,
choose $n$ such that the conclusion of Lemma 3.6 holds. Then, relying on the
preceding lemma 3.8, choose for each ${\mathbf{i}}\in\\{0,1\\}^{n-1},$ a
smooth function $0\leq h_{{\mathbf{i}}}\leq 1$ such that $\|{\cal
P}_{{\mathbf{i}},h_{{\mathbf{i}}}}\|_{r,\varepsilon}\leq\frac{\eta}{2^{n}}.$
Next define $Q$ and $\Delta=\Delta_{1}+\Delta_{2}$ by formulaes (16), (14) and
(15).

##  4 Appendix

The Lebesgue measure on ${\mathbb{R}}^{m}$ is denoted $\mathsf{Leb}_{m}.$

###### Lemma 4.1

Let $m\geq 1$ and let $f:I_{1}\times\ldots\times I_{m}\rightarrow{\mathbb{R}}$
be a real analytic function, where $I_{i}\subset{\mathbb{R}},i=1,\ldots,m$ are
nonempty open intervals. Then either $f=0$ (i.e $f$ is the zero function) or
$\mathsf{Leb}_{m}(f^{-1}(0))=0.$

Proof:  We proceed by induction on $m.$ If $m=1,$ and $f\neq 0,$ $f^{-1}(0)$
is countable by analyticity. Hence $\mathsf{Leb}_{1}(f^{-1}(0))=0.$ Suppose
that the property is true for $m-1$ with $m\geq 2.$ Set
$J=I_{2}\times\ldots\times I_{m}.$ Then, by Fubini-Tonelli,

$\mathsf{Leb}_{m}(f^{-1}(0))=\int_{I_{1}}\left(\int_{J}{\mathbf{1}}_{f^{-1}(0)}(x,y)dy\right)dx=\int_{I_{1}}\mathsf{Leb}_{m-1}(f_{x}^{-1}(0))dx$

where $f_{x}:J\rightarrow{\mathbb{R}}$ is the map defined by
$f_{x}(y)=f(x,y).$

Let $A=\\{x\in I_{1}:\>f_{x}=0\\}.$ Then, by continuity,

$A=\bigcap_{y\in J\cap\mathbb{Q}^{m-1}}\\{x\in I_{1}:\>f(x,y)=0\\}.$

This shows that $A$ is measurable. Hence, by the induction hypothesis,

$\mathsf{Leb}_{m}(f^{-1}(0))=\int_{A}\mathsf{Leb}_{m-1}(f_{x}^{-1}(0))dx.$

Now, if $f\neq 0$ there exists some $x^{*}\in I_{1}$ and $y^{*}\in
J\cap\mathbb{Q}^{m-1}$ such that $f(x^{*},y^{*})\neq 0.$ It comes that

$\int_{A}\mathsf{Leb}_{m-1}(f_{x}^{-1}(0))dx\leq\int_{\\{x\in
I_{1}:\>f(x,y^{*})=0\\}}\mathsf{Leb}_{m-1}(f_{x}^{-1}(0))dx$

This later integral is zero because, by the base case,

$\mathsf{Leb}_{1}(\\{x\in I_{1}:\>f(x,y^{*})=0\\})=0.$

$\Box$

Acknowledgement: The work of MB, was funded by the grant 200020-219913 from
the Swiss National Foundation. We thank Yuri Bakhtin, Tobias Hurth, Claude
Lobry, Edouard Strickler and Oliver Tough for stimulating discussions.

## References

  * [1] L. Arnold and W. Kliemann, _On unique ergodicity for degenerate diffusions_ , Stochastics 21 (1987), no. 1, 41–61. MR 899954
  * [2] Y. Bakhtin, T. Hurth, and J.C. Mattingly, _Regularity of invariant densities for 1d-systems with random switching_ , Nonlinearity 28 (2015), 3755–3787.
  * [3] Yuri. Bakhtin and Tobias. Hurth, _Invariant densities for dynamical systems with random switching_ , Nonlinearity (2012), no. 10, 2937–2952.
  * [4] Yuri Bakhtin, Tobias Hurth, Sean D. Lawley, and Jonathan C. Mattingly, _Smooth invariant densities for random switching on the torus_ , Nonlinearity 31 (2018), no. 4, 1331–1350. MR 3816636
  * [5] , _Singularities of invariant densities for random switching between two linear ODEs in 2D_ , SIAM J. Appl. Dyn. Syst. 20 (2021), no. 4, 1917–1958. MR 4322095
  * [6] M. Benaïm, T. Hurth, and E. Strickler, _A user-friendly condition for exponential ergodicity in randomly switched environments_ , Electronic Communications in Probability 23 (2018), no. 44, 1–12.
  * [7] M. Bena\̈mathbf{i}m, S. Le Borgne, F. Malrieu, and P.-A. Zitt, _Qualitative properties of certain piecewise deterministic Markov processes_ , Ann. Inst. Henri Poincaré Probab. Stat. 51 (2015), no. 3, 1040–1075.
  * [8] , _Erratum: Qualitative properties of certain piecewise deterministic Markov processes_ , Ann. Inst. Henri Poincaré Probab. Stat. 55 (2019), no. 4.
  * [9] Michel Bena\̈mathbf{i}m and Tobias Hurth, _Markov chains on metric spaces, a short course_ , Universitext, vol. 99, Springer, Cham, 2022.
  * [10] Michel Bena\̈mathbf{i}m and Claude Lobry, _Lotka-Volterra with randomly fluctuating environments or “How switching between beneficial environments can make survival harder”_ , Ann. Appl. Probab. 26 (2016), no. 6, 3754–3785. MR 3582817
  * [11] M Bena m, F Colonius, and R Lettau, _Supports of invariant measures for piecewise deterministic Markov processes_ , Nonlinearity 30 (2017), no. 9, 3400.
  * [12] Michel Bena m and Oliver Tough, _Regularity of the stationary density for systems with fast random switching_ , 2023, arXiv 2212.03632.
  * [13] , _On invariant distributions of feller markov chains with applications to dynamical systems with random switching_ , 2024, arXiv 2310.17543.
  * [14] Joris Bierkens, Gareth O. Roberts, and Pierre-André Zitt, _Ergodicity of the zigzag process_ , Ann. Appl. Probab. 29 (2019), no. 4, 2266–2301. MR 3983339
  * [15] Jean-Michel Bony, _Principe du maximum, inégalite de Harnack et unicité du problème de Cauchy pour les opérateurs elliptiques dégénérés_ , Ann. Inst. Fourier (Grenoble) 19 (1969), no. fasc. 1, 277–304 xii. MR 262881
  * [16] Paul C. Bressloff, _Stochastic switching in biology: from genotype to phenotype_ , J. Phys. A 50 (2017), no. 13, 133001, 136. MR 3623058
  * [17] Bertrand Cloez and Martin Hairer, _Exponential ergodicity for Markov processes with random switching_ , Bernoulli 21 (2015), no. 1, 505–536. MR 3322329
  * [18] Manon Costa, _A piecewise deterministic model for a prey-predator community_ , Ann. Appl. Probab. 26 (2016), no. 6, 3491–3530. MR 3582809
  * [19] M. H. A. Davis, _Piecewise-deterministic Markov processes: a general class of nondiffusion stochastic models_ , J. Roy. Statist. Soc. Ser. B 46 (1984), no. 3, 353–388, With discussion. MR 790622
  * [20] Sean D. Lawley, Jonathan C. Mattingly, and Michael C. Reed, _Stochastic switching in infinite dimensions with applications to random parabolic PDE_ , SIAM J. Math. Anal. 47 (2015), no. 4, 3035–3063. MR 3379020
  * [21] Dan Li, Shengqiang Liu, and Jing’an Cui, _Threshold dynamics and ergodicity of an SIRS epidemic model with markovian switching_ , Journal of Differential Equations 263 (2017), no. 12, 8873–8915.
  * [22] Florent Malrieu, _Some simple but challenging Markov processes_ , Annales de la Faculté des sciences de Toulouse : Mathématiques Ser. 6, 24 (2015), no. 4, 857–883 (en).
  * [23] Florent Malrieu and Pierre-André Zitt, _On the persistence regime for Lotka-Volterra in randomly fluctuating environments_ , ALEA Lat. Am. J. Probab. Math. Stat. 14 (2017), no. 2, 733–749. MR 3695481
  * [24] Athina Monemvassitis, Arnaud Guillin, and Manon Michel, _Pdmp characterisation of event-chain monte carlo algorithms for particle systems_ , Journal of Statistical Physics 190 (2023), no. 3.
  * [25] G. G. Yin and C. Zhu, _Hybrid switching diffusions_ , Stochastic Modelling and Applied Probability, vol. 63, Springer, New York, 2010, Properties and applications. MR 2559912 (2010i:60226)