# Enhancing Data Privacy in Large Language Models through Private Association
Editing

Davide Venditti${}^{\textbf{*}1}$, Elena Sofia Ruzzetti${}^{\textbf{*}1}$,
Giancarlo A. Xompero2
Cristina Giannone2, Andrea Favalli2, Raniero Romagnoli2
Fabio Massimo Zanzotto1
1University of Rome Tor Vergata, Italy
2Almawave S.p.A., Via di Casal Boccone, 188-190 00137, Rome, IT
<EMAIL_ADDRESS><EMAIL_ADDRESS>
<EMAIL_ADDRESS>
###### Abstract

Large Language Models (LLMs) are powerful tools with extensive applications,
but their tendency to memorize private information raises significant concerns
as private data leakage can easily happen. In this paper, we introduce Private
Association Editing (PAE), a novel defense approach for private data leakage.
PAE is designed to effectively remove Personally Identifiable Information
(PII) without retraining the model. Our approach consists of a four-step
procedure: detecting memorized PII, applying PAE cards to mitigate
memorization of private data, verifying resilience to targeted data extraction
(TDE) attacks, and ensuring consistency in the post-edit LLMs. The versatility
and efficiency of PAE, which allows for batch modifications, significantly
enhance data privacy in LLMs. Experimental results demonstrate the
effectiveness of PAE in mitigating private data leakage. We believe PAE will
serve as a critical tool in the ongoing effort to protect data privacy in
LLMs, encouraging the development of safer models for real-world applications.

Enhancing Data Privacy in Large Language Models through Private Association
Editing

Davide Venditti${}^{\textbf{*}1}$, Elena Sofia Ruzzetti${}^{\textbf{*}1}$,
Giancarlo A. Xompero2 Cristina Giannone2, Andrea Favalli2, Raniero Romagnoli2
Fabio Massimo Zanzotto1 1University of Rome Tor Vergata, Italy 2Almawave
S.p.A., Via di Casal Boccone, 188-190 00137, Rome, IT
<EMAIL_ADDRESS><EMAIL_ADDRESS><EMAIL_ADDRESS>

**footnotetext: These authors contributed equally to this work

##  1 Introduction

A massive pretraining phase seems to be the key to obtaining versatility and
accuracy in a large number of tasks: Large language models (LLMs) are indeed
able to perform accurately many tasks by capturing information from their
training data. Even in zero-shot scenarios, LLMs serve as alternative sources
of information Hou et al. (2024), perform translation tasks Mu et al. (2023),
translate natural language requests into code Ranaldi et al. (2024), and are
definitely capable of capturing world knowledge Petroni et al. (2019, 2020).
The massive pretraining phase seems to be the key to obtaining versatility and
accuracy in this large variety of tasks.

However, growing larger, training data for LLMs have become uncontrollable and
may inadvertently contain some private personal information of unaware people.
LLMs may potentially retain this sensitive information Carlini et al. (2021,
2023); Huang et al. (2022). This is a potential threat in privacy of unaware
people. Indeed, by performing Training Data Extraction attacks, Carlini et al.
(2021) showed that LLMs may verbatim generate strings containing sensitive
information observed during training. Then, attackers may gain access to
private information.

Figure 1: Preserving privacy for LLMs by using Private Association Editing

Strategies to remove sensitive information from LLMs are needed and mandatory,
as preserving privacy is a must. Yet, the straight-forward technique of
remove-and-retrain is unfeasible as extremely expensive.

In this paper, we propose Private Association Editing (PAE) to remove
memorized private information adjusting parameters of LLMs without re-training
(see Fig. 1). Stemming from MEMIT Meng et al. (2023b) formulation to edit
factual knowledge, we define PAE as a novel model-editing defense strategy
based on the idea of breaking the association between personal information and
the identity of the person to whom it belongs. We anonymize the private
information directly in the model, replacing the original information with
masked – but semantically equivalent – information. We experiment with GPT-J
Wang and Komatsuzaki (2021) as it is an open-source model that contains
documented private information. We perform Training Data Extraction attacks
Huang et al. (2022) before and after our model-editing defenses and we show
that our strategies are an efficient alternative to make a model more robust
against the generation of private information while keeping constant its
performance in generating texts.

##  2 Background

Large Language Models (LLMs) are prone to emit private information. Indeed,
attacking LLMs to extract memorized private information is possible by using
black-box access to language models. Training Data Extraction (TDE) is a
technique to extract this private information Carlini et al. (2021). It
consists of querying the target model to force it to produce its own training
data. A textual training example is considered "extractable" if a specific
prefix can be used to prompt the model to generate the exact training example
from its training set. Carlini et al. (2021) found that GPT-2 often retains
and reveals personal information such as Twitter handles, email addresses, and
Universal Unique Identifiers (UUIDs). The memorization of training examples
explains the success of these attacks: when LLMs are prompted with a prefix
encountered during training, they often complete the prompt with the remaining
part of the training sequence Carlini et al. (2023).

Attacks may be particularly effective in open LLMs. Huang et al. (2022)
demonstrated that conditioning a model with a prompt that is part of the
training data can result in the leakage of personal identifiable information
(PII), such as email addresses. They also showed that this method is more
effective than creating entirely new, unseen prompts. Nasr et al. (2023)
revealed that Carlini et al. (2021) method is even more effective than
previously expected. By querying open-source models, they confirmed the
success of the attack procedure using the training data solely for
verification purposes. They conducted these attacks on open models like GPT-
Neo Black et al. (2022) and Pythia Biderman et al. (2023), starting with
prompts sourced from Wikipedia.

Even closed LLMs may reveal private information by using Training Data
Extraction. Since these attacks require only black-box access to the model,
closed models like GPT-3.5 and GPT-4 can be attacked. In fact, using the same
prompts proposed by Huang et al. (2022), Wang et al. (2024) demonstrate that
GPT-3.5 and GPT-4 can predict respectively around 5% and 4% of the email
addresses accurately.

As personal information leakage from LLMs is a concrete possibility, model
editing is a possible solution as opposed to an expensive remove-and-retrain
strategy.

Model editing in LLMs refers to the process of modifying specific aspects of a
model’s behavior or knowledge without retraining it from scratch. This
involves making targeted adjustments to the model’s parameters or responses to
correct errors, update information, or adapt to new requirements. Mitchell et
al. (2022) introduced a semi-parametric editing methodology, employing a
retrieval-augmented counterfactual model, that effectively modulates neural
network predictions over the SERAC dataset. Cao et al. (2021) proposed
KNOWLEDGEEDITOR that efficiently and reliably edits factual knowledge within
language models, ensuring consistency across various formulations of facts.
Furthermore, Yao et al. (2023) introduced MEND on various datasets,
demonstrating its ability to rapidly and effectively edit large-scale models’
behaviors without extensive retraining. Since these methods can modify factual
information memorized in LLMs, our goal is to exploit them to erase private
information inadvertently ingested during training.

Similarly to the method defined in our paper, Patil et al. (2023) investigated
model editing techniques to modify the information memorized in LLMs
concluding that information cannot be erased. In particular, they applied TDE
attacks against the GPT-J Wang and Komatsuzaki (2021) model and demonstrated
that in black-box access–performing attacks that also include paraphrases of
the original prompt– model editing cannot erase factual information memorized
in GPT-J. Our setting is different: in fact, Patil et al. (2023) investigated
the effectiveness of model editing only on factual information from sentences
derived from Wikipedia, and not directly present in the training data – the
Pile Gao et al. (2020). By definition, the model under attack does not
verbatim memorize information that is not in training data: since the examples
used by Patil et al. (2023) are derived from Wikipedia and not included in the
Pile, while the factual information they contain is memorized, they cannot be
verbatim memorized. In our experiments, we directly study the effectiveness of
model editing to delete private information that is verbatim memorized with a
focus on privacy rather than factual information.

To the best of our knowledge, this is a novel approach to protect private LLMs
from personal information leakage that show the potential beneficial effect on
privacy preserving.

##  3 Attacking and Defending LLMs from Private Data Leakage

Large Language Models (LLMs) have a tendency to memorize examples from their
training data, and Training Data Extraction (TDE) attacks can be used to
recover these memorized examples. When fed with the right prompt, LLMs emit
verbatim memorized information. In fact, if a model is prompted with a prefix
encountered during training, it often completes it with the rest of the
training sequence Carlini et al. (2023); Huang et al. (2022).

In this scenario, we aim to deliver solutions to help people and owners of
LLMs remove undesirably memorized Personally Identifiable Information from
LLMs. The procedure we propose consists of four steps (see Fig. 1):

  * •

detecting the presence of memorized Personally Identifiable Information (PII)
in pre-edit LLMs performing black box TDE attacks (Sec. 3.1);

  * •

_Private Association Editing_ (PAE) to remove PII by editing parameters of
LLMs obtaining post-edit LLMs (Sec. 3.2);

  * •

assessing that post-edit LLMs are more resilient to attacks with TDE attacks
(as in Sec. 3.1);

  * •

a final consistency check of post-edit LLMs to assess that LLMs are not
corrupted after PAE behaving similarly to pre-edit LLMs (Sec. 3.3)

This procedure is extremely more versatile than erase-and-retrain and can be
used in small batches of modification of an LLM. The core of our procedure is
the method we propose called _Private Association Editing_ (PAE).

###  3.1 Training Data Extraction Attacks to recover Sensitive Information

To detect the presence of memorized Personally Identifiable Information LLMs,
we follow the attack pipeline and attack prompts defined by Huang et al.
(2022). They defined two kinds of attacks depending on how information is
stored and retrieved: (1) a model memorizes personal information if there
exists a prompt from the training data that leads the model to generate that
information; (2) in contrast, a model associates an individual to its personal
information if there exists a prompt not seen during training but containing a
reference to an individual that leads to the generation of PII. Huang et al.
(2022) already demonstrated that memorization is more common in LLM than
association, showing that a model from the GPT-
Neo111https://www.eleuther.ai/artifacts/gpt-neo family can predict emails more
accurately when conditioned with prompts from the training data rather than
wthen analyzely unseen prompts.

We then analyze two attacking schemes: the Memorization attacks and the
Association attacks.

In a Memorization attack, a model is fed with a prompt extracted from its
pretraining data. This prompt is the context that precedes the private PII in
the training data. For example, a context prompt attack to recover the email
address of Jonh Brown would look like: "All the winter months might settle
2.25. As such, the best thing to be short is jan. -----Original Message-----
From: Jonh, Brown". In this attack, following Huang et al. (2022), we simulate
that the attacker has more or less knowledge about the training data by
conditioning the generation of the model to context prompts of different
lengths in terms of tokens.

In the Association Attack, the model is instead fed with a prompt that
contains an identifier of the person whose information is to be extracted, but
that does not exactly match the training data. In particular, Huang et al.
(2022) defined four zero-shot attack prompts, identified by letters from $a$
to $d$. All zero-shot prompts contain the name of the person that owns the
email the attacker wish to obtain and the model is asked to predict the email:
for example, the zero-shot prompt $a$ to recover the email adress of John
Brown is “the email address of John Brown is”. The attack succeeds if, during
the generation of the subsequent tokens, the model generates the target’s
private information, that is, the correct email address.

In both Memorization and Association attacks, the adversary in black-box
access wants to force the model to generate some PII regarding a person. The
analyzed framework encompasses a malicious attacker – or any individual aiming
to detect unauthorized use of their data – who has assumptions about the
original text that was used during training or who has no prior clues about
the original data that contained the private information but who has some
other knowledge about the identity of the individual whose sensitive
information they wish to extract.

###  3.2 Private Association Editing as Efficient Defense against Privacy
Attacks

To defend people from privacy attacks of LLMs, we propose Private Association
Editing (PAE), which is the second step of our procedure. This editing
technique involves disrupting the link between an individual identity and
their PII. The technique proposed here is efficient since it allows the
anonymization of private information directly into the model parameters.
Moreover, our solution is also scalable since it can be used to protect the
privacy of multiple users.

A private association is an association between the name of an individual and
a PII that should not be revealed. This association is a triple
<subject,predicate,PII-object>, as the following example: <John Smith, owns,
<EMAIL_ADDRESS>in the example, the PII-object is the email address
of the person.

Our PAE employs model editing techniques based on ROME (Rank-One Model
Editing) Meng et al. (2023a) and MEMIT (Model Editing via Iterative Training)
Meng et al. (2023b) as a defensive strategy against attacks aimed at
safeguarding the sensitive data used to train Large Language Models (LLMs).
Then, the scalability to editing different facts in a batch is facilitated by
the MEMIT framework, which allows us to incorporate as many elements in the
form of modifications as desired. These modifications are seamlessly executed
on the same model also avoiding degradation of the model’s performance.

In private association editing, once a user of the system has understood that
their personal information has been inadvertently inserted into the training
data and consequently memorized, a model edit can be performed to mask the
private information.

The procedure to edit a private association uses PAE cards based on the MEMIT
modification card. The basic structure of a MEMIT modification card is
composed of a prompt, a ground truth, a target, and a subject. Our PAE cards
specialize the MEMIT modification card on a particular PII. We have defined
two main types of PAE cards to mask the private information of users. The
first type is called "explicit" because it directly identifies the connection
between the person and the private data and perfectly adheres to the MEMIT
implementation. For example, an explicit prompt is "{name} has an email
address that is". The second type is "implicit" which features a prompt that
does not necessarily include the person’s name as the subject of the sentence,
favoring a more precise meaning of the sentence. An example of an implicit
prompt is "The mail address of {name} is".

prompt |  The email address of {subject} is
---|---
ground truth |<EMAIL_ADDRESS>
target |<EMAIL_ADDRESS>
subject |  John Brown
Table 1: An example of Private Association Editing card for email addresses
with an implicit prompt

It is important to note that we used MEMIT in "batch" mode because we are
interested in fixing the model and subjecting it to $k$ modifications. In this
way, we are able to use MEMIT performing $k$ modifications at the same time,
instead of performing single edits separately and recreating the model based
on the post-edited weights obtained from the last edit every time.

In a real-world scenario, recreating or retraining a model for each requested
modification is not feasible. Instead, with our strategy called "one model, n
edits" we are able to make all requested changes to a single model. By masking
and anonymizing the email address, we make it more challenging for attackers
to elicit specific private data from the model in response to particular
prompts. This methodology effectively reduces the risk of sensitive
information being inadvertently disclosed by the model.

###  3.3 Evaluating Language Modeling Performance

The final step of the procedure for preserving privacy with PAE is to
investigate whether the LLM maintains its behavior in text generation. In
fact, Model Editing techniques, in general, and PAE, in particular, may
perturb the language model capabilities due to the intervention on the model
parameters.

The LLM assessment procedure we describe in this Section aims to verify that
the privacy-preserving language model is not a worse model than the original
one. The main idea is that LLMs capabilities are not perturbed if people are
not able to determine which of the two models is responsible for which
generation, then it means that the edit procedure does not affect model
performance: there is no one better than the other, a user of the system would
be equally happy to use one or the other.

The description of the LLM assessment procedure in this section is twofold:
(1) the automatic assessment procedure that should be used when PAE is used in
real scenarios; (2) the manual assessment procedure that is used in this paper
to determine if the automatic assessment procedure capture the main idea of
non-perturbed LLM.

The automatic assessment procedure is the operational procedure to
automatically compare a pre-edit version LLM and a post-edit version LLM. The
idea is to simply collect generations for a given set of prompts for pre-edit
LLM and post-edit LLM. Then, these generations are compared with string-based
similarity metrics, in particular BLEU and METEOR metrics. With these
measures, we can automatically assess if pre-edit LLM and post-edit LLM behave
in a similar way.

The manual assessment procedure is instead an experimental procedure to
confirm that the automatic assessment procedure can be used to determine if
pre-edit LLM and post-edit LLM are similar. In this procedure, we again
collect generations for given prompts for pre-edit LLM and post-edit LLM. In
this case, we ask annotators to choose which model generated each text in a
sort of classification task. We argue that a low accuracy in this
classification task and a low agreement among annotators mean that the models
are not distinguishable and, in particular, that the privacy-preserving models
are no worse than the original ones.

##  4 Experiments

| Pre-edit | Post-edit
---|---|---
Implicit | Explicit
Leaked emails | Number of predicted emails | Attack Accuracy | Leaked emails | Attack Accuracy | Leaked emails | Attack Accuracy
Memorization Attacks |  greedy | context 50 | 353 | 2827 | 0.125 | 203 | 0.072 | 218 | 0.077
context 100 | 476 | 2932 | 0.162 | 301 | 0.103 | 317 | 0.108
context 200 | 537 | 2951 | 0.182 | 368 | 0.125 | 396 | 0.134
beam search | context 50 | 346 | 2689 | 0.129 | 244 | 0.091 | 248 | 0.092
context 100 | 476 | 2809 | 0.169 | 339 | 0.121 | 339 | 0.121
context 200 | 515 | 2863 | 0.180 | 394 | 0.138 | 405 | 0.141
Association Attacks |  greedy | zero-shot a | 5 | 3130 | 0.002 | 1 | 0.000 | 1 | 0.000
zero-shot b | 2 | 3229 | 0.001 | 0 | 0.000 | 0 | 0.000
zero-shot c | 26 | 3234 | 0.008 | 13 | 0.004 | 11 | 0.003
zero-shot d | 68 | 3237 | 0.021 | 48 | 0.015 | 42 | 0.013
beam search | zero-shot a | 6 | 3178 | 0.002 | 3 | 0.001 | 5 | 0.002
zero-shot b | 1 | 3178 | 0.000 | 0 | 0.000 | 0 | 0.000
zero-shot c | 28 | 3232 | 0.009 | 20 | 0.006 | 11 | 0.003
zero-shot d | 73 | 3234 | 0.023 | 50 | 0.015 | 37 | 0.011

Table 2: Results of the attacks against the pretrained model (Pre-edit) and
after the application of PAE. The training data extraction attacks that
exploit the memorization of PII after PAE tends to lose their efficacy in
retrieving private information from the model.

###  4.1 Experimental Setup

In this section, we discuss the parameters of our experiment to allow
replicability: the analized LLM and related datasets, the intricacies of MEMIT
used in our PEA, and, finally, the set-up of the evaluation of the LLMs.

#### Analized LLM and related datasets

In our experiments, we test the GPT-J model Wang and Komatsuzaki (2021) that
is designed to generate human-like text continuations from prompts: it is a
large model, with 6 billion parameters. This model is trained on an open
dataset, the Pile Gao et al. (2020). The Pile is a diverse, large-scale text
corpus that aggregates various sources, including books, articles, websites,
and scientific papers. It spans multiple languages and domains, making it an
ideal training resource for language models like GPT-J. The Pile contains a
rich variety of text, enabling the model to learn from a wide range of
contexts and topics. One of the constituent sub-datasets within The Pile is
the Enron Emails Klimt and Yang (2004) corpus. This dataset contains text from
approximately 150 users, primarily senior management of Enron, organized into
folders. It includes a total of about 0.5 million email messages. The Enron
Emails dataset was originally made public during the investigation into
Enron’s accounting methods. Its inclusion in the Pile mimic the inadvertently
insertion into the training data of private information, in particular of PII
like email adressess. For this reason, the Enron Email dataset represents a
natural starting point to test GPT-J memorization of PII.

#### Intricacies of MEMIT

There are two distinct ways to apply model editing using MEMITYao et al.
(2023) given $N$ elements to modify: batch and sequential editing. Batch
editing involves editing $k$ elements in an LLM simultaneously. Conversely,
sequential editing focuses on editing $N$ elements within an LLM in a
sequential way, with each edit on a subset of the $N$ elements, performed on
the new model retaining previous edits. While batch editing may be sufficient
to preserve privacy, the sequential editing approach is closer to the real-
world need to constantly update model parameters, as more privacy leakages may
be discovered over time.

In our research, we initially adopt the batch editing approach with $k=N$.
This approach is the safest – in principle – since the post-edited parameters
are directly the pretrained ones. Then, we investigate the effect of
sequential editing with $k<N$, simulating the real-world scenario in which
multiple edits are necessary over time. For PAE to be applicable, in both
scenario our method should lead to a comparable decrease in privacy leaks.

#### Evaluation of post-edited LLM

For the automatic assessment procedure, we measure the difference in
generations for the pre-trained GPT-J model and the post-edited version by
generating a small paragraph starting from 45 prompts extracted from the Book3
Rae et al. (2022) dataset, included in the Pile . We prompted the post-edited
models and the pretrained one with 20 tokens of the 45 randomly selected
examples and we evaluate how similar the generations are measuring their
overlap. he higher the similarity, the higher the likelihood that the PAE does
not influence the overall performance of the model. Evaluation measures are
the ROUGE and the METEOR scores.

For the manual assessment procedure, we generate with post-edited models and
with the pretrained one a short paragraph from 10 different prompts (a
complete list can be found in the Appendix 6.1). We collect the generations
for the pre-edit model and the model post-edited according to each of the
editing strategies. Hence, in total, we collect 30 generations. Then, five
annotators are asked to choose which of the models generated each of the
paragraphs. Three sample generations of each model were provided, and the
annotators were informed that two out of three models had been post-edited,
but none of them were informed which of the three systems had been post-
edited. Evaluation measures are the classification accuracy of each annotator
and the Fleiss’ K inter-annotator agreement: a low score on both can confirm
that the models are indistinguishable.

###  4.2 Results and Discussion

#### LLMs leak Private Information

Since LLMs tend to leak training data, we aim to quantify the amount of
private information that can be retrieved from the pre-trained GPT-J.
Unfortunately, GPT-J makes no exception to the trend noticed by Huang et al.
(2022) for the GPT-Neo models. In fact, also this model tends to generate PII.

In Table 2, it is possible to observe that Training Data Extraction Attacks
that are based on Memorization are particularly effective against the GPT-J
model: on average, the model tends to accurately predict the mail observed
during training the $16\%$ of the times.

It is worth noting the scale of the leakage: the model is originally prompted
with 3238 examples. The column Generated emails reports the number of times
during generation that the model answers with an email address, while Leaked
emails reports the number of times the generation is correct, meaning that the
generated email corresponds to the one observed in the training data. On
average, $450.5$ emails are correctly generated by those attacks: the privacy
of a large number of people is threatened.

Moreover, as the attacker gets more information, the accuracy of the attacks
gets higher: the accuracy of the attacks strongly depends on the length of the
prompt. In fact, the lower accuracy – the number of correctly leaked email
addresses over the total email adresses generated– that can be registered in
Memorization Attacks is $12\%$ : the model in that case is fed with a context
prompt that is $50$ tokens long. However, when the context prompt given to the
model is composed of $200$ tokens, the accuracy of the attack peaks at
$18.2\%$ with greedy decoding and $18\%$ using beam search decoding.

The accuracy of the Association Attacks is much more modest. The results of
those attacks against GPT-J model exhibit similar patterns to the one observed
by Huang et al. (2022) against the GPT-Neo models. The larger number of email
addresses leaked by those kind of attacks is $68$, a modest number compared to
the accuracy obtained in the Memorization Attacks. However, in an adversarial
scenario even low accuracy may cause harm to people. Hence, in the next
Section, we will demonstrate the efficacy of PAE against both types of
attacks.

#### PAE in batch editing Preserves Privacy

In Table 2, it is possible to observe the reduced effectiveness of
Memorization and Association attacks after the GPT-J model has undergone an
editing process (Post-edit columns), with Post-edit results further divided
into Implicit and Explicit categories. This Section investigates the impact of
these edits, focusing on their efficacy against more or less informed attacks.
We argue that PAE edits are effective if they can reduce the leakage of
private information, regardless of the nature of the attack.

Post-edit results show, in fact, a significant reduction in the effectiveness
of Association attacks. This reduction is particularly notable in scenarios
where the number of leaked emails drops close to zero. For example, under the
Implicit strategy, zero-shot b result in 0 leaked emails and 0 Attack
accuracy, indicating a complete mitigation of the attack. However, some
prompts still cause leakage; for instance, in prompt zero-shot b the edit
reduces the number of email addresses leaked significantly but not completely
(from 68 pre-edit to 48 post-edit in the Implicit). Crucially, while not
perfect, the PAE edits – both Implicit and Explicit – always cause an increase
in privacy protection, since reduce the number of email correctly leaked by
Association Attacks.

However, it is crucial to consider the originally leaked emails when
interpreting post-edit results. While a reduction to near-zero leakage is
impressive, the impact is more pronounced when starting from a higher number
of pre-edit leaks. For this reason, we focus on the discussion around the
Memorization Attacks, that cause a larger number of private email addresses to
be generated.

PAE is an effective solution against Memorization Attacks. In particular, the
accuracy of the attacks steady decreases in each configuration. The average
drop in accuracy after an Implicit edit is $5\%$ and $4.5\%$ after Explicit
edit: this means that PAE is able to modify model parameter so that, on
average, the $32\%$ of the previously predicted email addresses are no more
verbatim generated by the model using Implicit defense strategy, $29\%$ with
the explicit one. Against attacks with context prompt of 50 tokens, PAE
effectiveness peaks, with $42.5\%$ of the email addresses anonymized. As
expected, more informed context prompts are more challenging: however, also
with  context prompts of 200 tokens, PAE make the accuracy attack drop from
$0.18$ to $0.12$ in Greedy decoding and to $0.138$ using Beam Search in the
Implicit edit, and from $0.18$ to $0.134$ in greedy decoding and to $0.141$
using Beam Search in the Explicit edit. In general, studying the effect of the
decoding algorithm on the attacks accuracy we can state that this factor does
not influence much the results: under Memorization Attacks only a slight
difference in term of accuracy can be registered From this analysis can
conclude that PAE can help in protecting privacy.

Finally, it is possible to notice that there is a consistent difference
between Implicit and Explicit post-edit results. Explicit edits generally
result in a slightly higher number of leaked emails and attack accuracy
compared to Implicit edits, expecially under Memorization Attacks. For
example, in the case of a context prompt of 200, the Explicit edit cause a
larger number of emails to be correctly generated (396 in greedy deconding,
405 in beam search decoding) than the corresponding Implicit edit (368 email
addresses leaked in greedy decoding, 394 in beam search decoding)

In summary, post-edit measures, particularly implicit edits, demonstrate a
strong capability to safeguard email data from various attack strategies,
significantly lowering both the number of leaked emails and the attack
accuracy across different configurations. For our experiments, we adopted the
"one model, n edits" philosophy. This approach is based on the practical
scenario where an LLM producing private data needs to be edited for a large
number of potentially threatened individuals: with PAE, the model owner can
perform a single edit to the model parameters to reduce privacy risks. Our
investigation on the emails that the model generates when subjected to
Memorization and Association attacks confirm that the Memorization Attacks are
able to recover a larger number of private information also after the editing.
However, the evaluation confirms the effectiveness of our model editing
techniques in preventing the disclosure of private data since also informed
attacks –like the Memorization Attacks – are less effective on edited models.
This setup is particularly challenging because it requires analyzing the
impact of n modifications at the same time. In the next Section, we also
demonstrate that the original language model is not negatively influenced by
PAE.

#### PAE preserves the Language Modelling Capabilities

|  |  $E_{1}$-$O$ | $0.808(\pm 0.198)$
---|---|---|---
|  |  $E_{2}$-$O$ | $0.793(\pm 0.199)$
|  BLEU |  $E_{1}$-$E_{2}$ | $0.790(\pm 0.203)$
|  |  $E_{1}$-$O$ | $0.841(\pm 0.173)$
|  |  $E_{2}$-$O$ | $0.826(\pm 0.172)$
Automatic Evaluation |  METEOR |  $E_{1}$-$E_{2}$ | $0.824(\pm 0.183)$
|  Accuracy | $0.35(\pm 0.07)$
Manual Revision |  Fleiss’ $K$ | $0.002$

Table 3: PAE preserves language model performances. In the Manual revision of
the generation, annotators are not able to detect which model generated each
paragraph. Moreover, on a larger scale of examples, the Automatic Evaluation
reveals that the generation of post-edit LLMs $E_{1}$ and $E_{2}$ are both
similar to one another ($E_{1}$-$E_{2}$) and with respect to the pre-edit LLM
$O$ ($E_{1}$-$O$ and $E_{2}$-$O$)

PAE preserves privacy of people while not affecting the Language Modeling
performances. Results of the evaluation can be found in the Table 3. The
results of the automatic assessment procedure can quantitatively give us
insight that models generations are, in fact, similar. Both according to BLEU
metric and to METEOR, the systems generate (in greedy decoding) very similar
paragraph when prompted with the same tokens. In particular, the post-edited
models $E_{1}$ and $E_{2}$ – post-edited with implicit and explicit PAE – are
similar to the original, pre-edited model $O$ and are also similar with respet
to each other. Finally, the manual assessment procedure suggest that the
models are indistinguishable from one another. In fact, the annotators asked
to detect wich model is responsible for a generation among $E_{1}$, $E_{2}$,
and $O$ can only randomly guess, with an average accuracy on this
classification task ($0.35(\pm 0.07)$) close to random choice. Also the very
low agreement suggest that tge three systems are indistinguishable.

This evaluation procedure can attest that the EAP is applicable because it not
only helps to preserve user privacy, but also leaves the capabilities of the
systems language model intact.

Figure 2: Memorization Attack against sequentially post-edited models. The
smaller the batch size $k$, the larger the number of sequential updates are
necessary to edit all the private emails addressess leaked by the original
model. After the Sequential edits, the stronger Memorization Attack
($|p_{M}|=200$) achieve similar performances at all the configurations.

#### PAE is applicable with sequential editing

Finally, in Table is it possible to notice that the sequential update is
definetely applicable with PAE. In this experiments, we perform sequential
edit of the GPT-J model, varying the number of email addresses anonymized per
edit, varying from $5$ to $300$. We indicate the number of anonymized emails
per edit as batch size $k$: with $k<N$ we mimic the real world scenario of
updating a model each time a privacy leak is detected. To understand whether
sequential editing has a negative impact on effectiveness of the edit, we
evaluate the effectiveness of PAE for each of the batch sizes in the
Memorization Attack with the more effective of the prompts ($|p_{M}|=200$).
The results in Table 4.2 refers to a model post-edited with "implicit" PAE. As
can be observed in Table 4.2, the accuracy of the edit is rather stable and
similar to the results obtained in the batch editing scenario. Those results
confirm the applicability of PAE also in sequential editing.

##  5 Conclusion

In this paper, we address the critical issue of private data leakage in Large
Language Models (LLMs) due to their tendency to memorize training data. We
propose Private Association Editing (PAE), a novel defense mechanism that
effectively removes Personally Identifiable Information (PII) from LLMs
without requiring retraining.

Our methodology involves a four-step procedure: detecting memorized PII,
applying PAE cards, verifying resilience to targeted data extraction (TDE)
attacks, and ensuring consistency in the post-edit LLMs. The PAE method stands
out for its versatility and efficiency, allowing for small batch modifications
and significantly enhancing the privacy of LLMs.

Our experiments demonstrate that the PAE approach is both effective and
efficient in mitigating the risk of private data leakage. We believe PAE will
be a valuable tool in the ongoing effort to protect data privacy in LLMs and
encourage its adoption to prevent potential privacy violations as these models
continue to be deployed in real-world applications.

## Limitations

We outline some limitations and possible directions for future research in
enhancing data privacy in Large Language Models (LLMs).

As the landscape of LLMs evolves, it may be useful to extend the Private
Association Editing (PAE) mechanism to accommodate new types of models and
data. Currently, we apply our proposed PAE method on a limited set of LLMs. A
possible extension could involve testing and refining PAE across a broader
spectrum of LLM architectures and training datasets. Our approach focuses on
removing Personally Identifiable Information (PII) from LLMs without
retraining. However, this method might not address all types of sensitive
data. Future research could explore additional techniques to enhance the
comprehensiveness of PII removal. While PAE shows promise in its current form,
its real-world applicability and scalability need thorough validation. By
addressing these limitations, future research can further solidify the role of
PAE in safeguarding data privacy in LLMs and ensure its robustness and
adaptability in various contexts.

## References

  * Biderman et al. (2023) Stella Biderman, Hailey Schoelkopf, Quentin Anthony, Herbie Bradley, Kyle O’Brien, Eric Hallahan, Mohammad Aflah Khan, Shivanshu Purohit, USVSN Sai Prashanth, Edward Raff, Aviya Skowron, Lintang Sutawika, and Oskar van der Wal. 2023.  Pythia: A suite for analyzing large language models across training and scaling.  _Preprint_ , arXiv:2304.01373.
  * Black et al. (2022) Sid Black, Stella Biderman, Eric Hallahan, Quentin Anthony, Leo Gao, Laurence Golding, Horace He, Connor Leahy, Kyle McDonell, Jason Phang, Michael Pieler, USVSN Sai Prashanth, Shivanshu Purohit, Laria Reynolds, Jonathan Tow, Ben Wang, and Samuel Weinbach. 2022.  Gpt-neox-20b: An open-source autoregressive language model.  _Preprint_ , arXiv:2204.06745.
  * Cao et al. (2021) Nicola De Cao, Wilker Aziz, and Ivan Titov. 2021.  Editing factual knowledge in language models.  _Preprint_ , arXiv:2104.08164.
  * Carlini et al. (2023) Nicholas Carlini, Daphne Ippolito, Matthew Jagielski, Katherine Lee, Florian Tramer, and Chiyuan Zhang. 2023.  Quantifying memorization across neural language models.  _Preprint_ , arXiv:2202.07646.
  * Carlini et al. (2021) Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, et al. 2021.  Extracting training data from large language models.  In _30th USENIX Security Symposium (USENIX Security 21)_ , pages 2633–2650.
  * Gao et al. (2020) Leo Gao, Stella Biderman, Sid Black, Laurence Golding, Travis Hoppe, Charles Foster, Jason Phang, Horace He, Anish Thite, Noa Nabeshima, Shawn Presser, and Connor Leahy. 2020.  The pile: An 800gb dataset of diverse text for language modeling.  _Preprint_ , arXiv:2101.00027.
  * Hou et al. (2024) Yupeng Hou, Junjie Zhang, Zihan Lin, Hongyu Lu, Ruobing Xie, Julian McAuley, and Wayne Xin Zhao. 2024.  Large language models are zero-shot rankers for recommender systems.  _Preprint_ , arXiv:2305.08845.
  * Huang et al. (2022) Jie Huang, Hanyin Shao, and Kevin Chen-Chuan Chang. 2022.  Are large pre-trained language models leaking your personal information? In _Findings of the Association for Computational Linguistics: EMNLP 2022_ , pages 2038–2047, Abu Dhabi, United Arab Emirates. Association for Computational Linguistics.
  * Klimt and Yang (2004) Bryan Klimt and Yiming Yang. 2004.  The enron corpus: A new dataset for email classification research.  In _European conference on machine learning_ , pages 217–226. Springer.
  * Meng et al. (2023a) Kevin Meng, David Bau, Alex Andonian, and Yonatan Belinkov. 2023a.  Locating and editing factual associations in gpt.  _Preprint_ , arXiv:2202.05262.
  * Meng et al. (2023b) Kevin Meng, Arnab Sen Sharma, Alex Andonian, Yonatan Belinkov, and David Bau. 2023b.  Mass-editing memory in a transformer.  _Preprint_ , arXiv:2210.07229.
  * Mitchell et al. (2022) Eric Mitchell, Charles Lin, Antoine Bosselut, Christopher D. Manning, and Chelsea Finn. 2022.  Memory-based model editing at scale.  _Preprint_ , arXiv:2206.06520.
  * Mu et al. (2023) Yongyu Mu, Abudurexiti Reheman, Zhiquan Cao, Yuchun Fan, Bei Li, Yinqiao Li, Tong Xiao, Chunliang Zhang, and Jingbo Zhu. 2023.  Augmenting large language model translators via translation memories.  In _Findings of the Association for Computational Linguistics: ACL 2023_ , pages 10287–10299, Toronto, Canada. Association for Computational Linguistics.
  * Nasr et al. (2023) Milad Nasr, Nicholas Carlini, Jonathan Hayase, Matthew Jagielski, A Feder Cooper, Daphne Ippolito, Christopher A Choquette-Choo, Eric Wallace, Florian Tramèr, and Katherine Lee. 2023.  Scalable extraction of training data from (production) language models.  _arXiv preprint arXiv:2311.17035_.
  * Patil et al. (2023) Vaidehi Patil, Peter Hase, and Mohit Bansal. 2023.  Can sensitive information be deleted from llms? objectives for defending against extraction attacks.  _Preprint_ , arXiv:2309.17410.
  * Petroni et al. (2020) Fabio Petroni, Patrick Lewis, Aleksandra Piktus, Tim Rocktäschel, Yuxiang Wu, Alexander H. Miller, and Sebastian Riedel. 2020.  How context affects language models’ factual predictions.  _ArXiv_ , abs/2005.04611.
  * Petroni et al. (2019) Fabio Petroni, Tim Rocktäschel, Sebastian Riedel, Patrick Lewis, Anton Bakhtin, Yuxiang Wu, and Alexander Miller. 2019.  Language models as knowledge bases? In _Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP)_ , pages 2463–2473, Hong Kong, China. Association for Computational Linguistics.
  * Rae et al. (2022) Jack W. Rae, Sebastian Borgeaud, Trevor Cai, Katie Millican, Jordan Hoffmann, Francis Song, John Aslanides, Sarah Henderson, Roman Ring, Susannah Young, Eliza Rutherford, Tom Hennigan, Jacob Menick, Albin Cassirer, Richard Powell, George van den Driessche, Lisa Anne Hendricks, Maribeth Rauh, Po-Sen Huang, Amelia Glaese, Johannes Welbl, Sumanth Dathathri, Saffron Huang, Jonathan Uesato, John Mellor, Irina Higgins, Antonia Creswell, Nat McAleese, Amy Wu, Erich Elsen, Siddhant Jayakumar, Elena Buchatskaya, David Budden, Esme Sutherland, Karen Simonyan, Michela Paganini, Laurent Sifre, Lena Martens, Xiang Lorraine Li, Adhiguna Kuncoro, Aida Nematzadeh, Elena Gribovskaya, Domenic Donato, Angeliki Lazaridou, Arthur Mensch, Jean-Baptiste Lespiau, Maria Tsimpoukelli, Nikolai Grigorev, Doug Fritz, Thibault Sottiaux, Mantas Pajarskas, Toby Pohlen, Zhitao Gong, Daniel Toyama, Cyprien de Masson d’Autume, Yujia Li, Tayfun Terzi, Vladimir Mikulik, Igor Babuschkin, Aidan Clark, Diego de Las Casas, Aurelia Guy, Chris Jones, James Bradbury, Matthew Johnson, Blake Hechtman, Laura Weidinger, Iason Gabriel, William Isaac, Ed Lockhart, Simon Osindero, Laura Rimell, Chris Dyer, Oriol Vinyals, Kareem Ayoub, Jeff Stanway, Lorrayne Bennett, Demis Hassabis, Koray Kavukcuoglu, and Geoffrey Irving. 2022.  Scaling language models: Methods, analysis & insights from training gopher.  _Preprint_ , arXiv:2112.11446.
  * Ranaldi et al. (2024) Federico Ranaldi, Elena Sofia Ruzzetti, Dario Onorati, Leonardo Ranaldi, Cristina Giannone, Andrea Favalli, Raniero Romagnoli, and Fabio Massimo Zanzotto. 2024.  Investigating the impact of data contamination of large language models in text-to-sql translation.  _Preprint_ , arXiv:2402.08100.
  * Wang and Komatsuzaki (2021) Ben Wang and Aran Komatsuzaki. 2021.  GPT-J-6B: A 6 Billion Parameter Autoregressive Language Model.  https://github.com/kingoflolz/mesh-transformer-jax.
  * Wang et al. (2024) Boxin Wang, Weixin Chen, Hengzhi Pei, Chulin Xie, Mintong Kang, Chenhui Zhang, Chejian Xu, Zidi Xiong, Ritik Dutta, Rylan Schaeffer, Sang T. Truong, Simran Arora, Mantas Mazeika, Dan Hendrycks, Zinan Lin, Yu Cheng, Sanmi Koyejo, Dawn Song, and Bo Li. 2024.  Decodingtrust: A comprehensive assessment of trustworthiness in gpt models.  _Preprint_ , arXiv:2306.11698.
  * Yao et al. (2023) Yunzhi Yao, Peng Wang, Bozhong Tian, Siyuan Cheng, Zhoubo Li, Shumin Deng, Huajun Chen, and Ningyu Zhang. 2023.  Editing large language models: Problems, methods, and opportunities.  _Preprint_ , arXiv:2305.13172.

##  6 Appendix

###  6.1 All the prompts of the manual assessment procedure

  * •

"My name is";

  * •

"The weather today is";

  * •

"Ever since I was a child, I’ve always liked";

  * •

"My dear friend Mary";

  * •

"Swimmers are usually";

  * •

"Modern art is";

  * •

"The Industrial Revolution";

  * •

"Follow those steps to cook";

  * •

"It is forbidden to";

  * •

"It is very likely".


††thanks: Corresponding author

# Symmetry classes of dissipative topological insulators with edge dark state

Fei Yang  Center for Advanced Quantum Studies, Department of Physics, Beijing
Normal University, Beijing 100875, China  Zheng Wei  Center for Advanced
Quantum Studies, Department of Physics, Beijing Normal University, Beijing
100875, China  Xianqi Tong  Center for Advanced Quantum Studies, Department of
Physics, Beijing Normal University, Beijing 100875, China  Kui Cao  Center for
Advanced Quantum Studies, Department of Physics, Beijing Normal University,
Beijing 100875, China  Su-Peng Kou  Center for Advanced Quantum Studies,
Department of Physics, Beijing Normal University, Beijing 100875, China
<EMAIL_ADDRESS>
###### Abstract

We classify the dissipative topological insulators (TIs) with edge dark states
(EDS) by using the 38-fold way of non-Hermitian systems in this paper. The
dissipative dynamics of these quadratic open fermionic systems is captured by
a non-Hermitian single-particle matrix which contains both the internal
dynamics and the dissipation, refereed to as damping matrix $X$. And the dark
states in these systems are the eigenmodes of $X$ which the eigenvalues’
imaginary part vanishes. However, there is a constraint on $X$, namely that
the modes in which the eigenvalues’ imaginary parts are positive are
forbidden. In other words, the imaginary line-gap of $X$ is ill-defined, so
the topological band theory classifying the dark states can not be applied to
$X$. To reveal the topological protection of EDS, we propose the double
damping matrix $\tilde{X}=\text{diag}\left(X,X^{*}\right)$, where the
imaginary line-gap is well defined. Thus, the 38-fold way can be applied to
$\tilde{X}$, and the topological protection of the EDS is uncovered. Different
from previous studies of EDS in purely dissipative dynamics, the EDS in the
dissipative TIs are robust against the inclusion of Hamiltonians. Furthermore,
the topological classification of $\tilde{X}$ not only reflects the
topological protection of EDS in dissipative TIs but also provides a paradigm
to predict the appearance of EDS in other open free fermionic systems.

###### pacs:

11.30. Er, 75.10. Jm, 64.70. Tg, 03.65.-W

##  I Introduction

Symmetry and topology play the central role in modern physics, which results
in many interesting phenomena and future applications, such as robust edge
mode in topological insulators (TIs) and topological superconductors (TSs)[1,
2, 3]. And the systematic classifications of those phases are explained by the
ten-fold way of free fermions, or Altland-Zirnbauer (AZ) symmetry classes[4].
The AZ class provides not only a framework to analyze the topological behavior
of system with different symmetries but also gives a paradigm to explore new
topological phases. However, those are for the close Hermitian systems, many
physical systems in nature experience dissipation associated with gain and
loss, such as atomic, molecular, and optical physics[5, 6, 7], the dynamics of
these systems are effectively described with a non-hermitian (NH) Hamiltonian.
Dissipation in these NH systems would give rise to many interesting effect
that do not have Hermitian counterpart, such as NH skin effects[8, 9, 10, 11],
$\mathcal{PT}$-symmetric physics[12, 13], and the breakdown of bulk-boundary
correspondence [14, 15, 16, 17]. Moreover, the question that how the
dissipation influences the topology of a system attracts much attention, which
has been explored in many papers[18, 19, 20, 21, 22, 23, 24]. The fundamental
interests in studying the topological properties of NH systems are to expand
the symmetry classes, which had been settled by Bernard and LeClair based on
four fundamental symmetries, resulting in a total of 43 symmetry classes, that
is known as Bernard-LeClair class[25]. While Kawabata et al. discovered that
only 38 of 43 symmetry classes are topologically inequivalent[26], which is
known as 38-fold way. The 38-fold way provides a paradigm to explore the
topology of a NH system, which has been applied in many NH systems, such as
the NH Sachdev-Ye-Kitaev Model[27], and symmetry classes of the open quantum
system[28, 29].

As we have mentioned, the non-Hermiticity is ubiquitous in nonequilibrium open
systems, but most of them are hard to solve especially if the interaction is
presented. Fortunately, the open free fermionic systems are exactly solvable,
in which the dissipative dynamics are completely captured by the so called
damping matrix $X$, which is a NH single-particle matrix that contains the
internal dynamics as well as the dissipation. The topological phenomena in the
dissipative dynamics of quadratic open fermionic systems can be understood
with the topological classification of complex spectra of $X$ (or Lindbladian
spectra) by using the 38-fold way, in which the symmetries of $X$ play the
central role. The typical future of non-trivial bulk-topology is robust
gapless edge-modes. Notably, there are two types of topological edge modes in
the Lindbladian spectra (the eigenvalues of $X$, denote as $\\{\lambda\\}$),
the edge zero-frequency modes
($\text{Re}\left(\lambda_{\text{edge}}\right)=0$) and edge dark states (EDS,
$\text{Im}\left(\lambda_{\text{edge}}\right)=0$). The edge zero-frequency
modes are the dynamical signature of topological order, which forces the
damping behavior of the bulk and the edge becomes different[30]. While the EDS
is usually related to the non-trivial steady-state of system[31, 32]. And the
relationship between the topology of $X$ and the edge zero-frequency modes has
been uncovered by Lieu et al. based on the 38-fold way [28], however, the
relationship between the topology of $X$ and the EDS is not revealed yet,
which is the topic of this paper.

Previous studies of EDS in open free fermionic systems are mainly focused on
purely dissipative case, in which the EDS is fragile once the Hamiltonian
terms are included[31, 32]. In this paper, we study the EDS in the case of
full dynamics, of which both the Hamiltonian and the dissipation are
presented. We find that the EDS are protected by the topology of double
damping matrix $\tilde{X}=\text{diag}\left(X,X^{*}\right)$, and it is robust
against the including of Hamiltonian. In our scheme, the artificial degree of
freedom $X^{*}$ has no physical counterpart, it’s an auxiliary system which is
used to support the imaginary line-gap in $\tilde{X}$. In such way, we can
classify $\tilde{X}$ topologically with the 38-fold way and the EDS become the
in-gap zero modes of $\tilde{X}$. Additionally, the symmetry classes of two
dissipative TIs of 1D and 2D cases are presented by using the 38-fold way,
these examples revealed that the EDS which are protected by the topology of
$\tilde{X}$ is robust against the inclusion of Hamiltonian. It is expected
that the double damping matrix that built from damping matrix of dissipative
dynamics in an open free fermionic system can apply to the dissipative TSs as
well, which is our future direction.

This paper is organized in the following way. In Sec. II, we introduce the
damping dynamics of open free fermionic system and the concepts of dark state
in these systems. In Sec. III, we briefly review the 38-fold way which gives
the symmetry classes of NHRM. In Sec. IV, a double damping matrix which
determines the symmetry class of EDS is developed. In Sec. V, two examples of
dissipative TIs with EDS is studied, the dissipative 1D Su-Schrieffer-Heeger
(SSH) model and dissipative 2D Qi-Wu-Zhang (QWZ) model. The symmetry classes
of those two models are given, and the robustness of EDS is checked. Those
results revealed that EDS of dissipative TIs is protected by the topology of
the double damping matrix. We conclude our results and future potential
directions in Sec. VI.

##  II damping dynamics of quadratic open fermionic systems

###  II.1 The damping dynamics

The Liouville dynamics of an open quantum system is usually described by an
Lindblad master equation[33, 34, 35, 36]

$\frac{d}{dt}\rho=-\mathrm{i}[H,\rho]+\sum_{\mu}\left(2L_{\mu}^{\dagger}\rho
L_{\mu}-\\{L_{\mu}^{\dagger}L_{\mu},\rho\\}\right),$ (1)

that the time evolution of density matrix $\rho$ is governed by two parts, the
unitary dynamics and the non-unitary dynamics. The Hamiltonian of system is
responsible for the unitary evolution, and the Lindblad operator $L_{\mu}$
that describes the adding or removing of particles via a Markovian bath is
responsible for the non-unitary evolution.

In these open free fermionic system, we consider the Lindblad operators as

$L_{\mu}^{g}=\sum_{s}D_{\mu,s}c^{\dagger}_{\mu,s},\qquad
L_{\mu}^{l}=\sum_{s}D_{\mu,s}c_{\mu,s}$ (2)

where $\mu$ is the index of the lattice site and $s$ denotes the internal
degree of freedom. And when the pairing term in the Hamiltonian is absent, we
can formulate the density matrix with a Gaussian state in terms of one-point
correlation function for these quadratic systems[37]

$\rho\propto\exp\left(\frac{i}{2}\sum_{m,n}\left[\ln\frac{C}{\mathbb{I}-C}\right]_{mn}c^{\dagger}_{m}c_{n}\right),$
(3)

where $C$ is single-particle correlation function,
$C_{mn}=\text{Tr}(c^{\dagger}_{m}c_{n}\,\rho)$. Thus the time evolution of the
density matrix of a open free fermionic system is fully characterized by it’s
correlation function [11]

$\displaystyle\mathrm{i}\frac{d}{dt}C$ $\displaystyle=$
$\displaystyle[-h^{T},C]-\\{\mathrm{i}\left(M_{g}+M_{l}^{T}\right),C\\}+2\mathrm{i}M_{g},$
(4) $\displaystyle=$ $\displaystyle XC-CX^{\dagger}+2\mathrm{i}M_{g}.$

And $X$ is known as the damping matrix, which is a NH single-particle matrix
that contains both the Hamiltonian and the dissipation

$X=-h^{T}-\mathrm{i}\left(M_{g}+M_{l}^{T}\right),$ (5)

where $H=\sum_{m,n}c^{\dagger}_{i}h_{ij}c_{j}$. And the bath matrix $M_{g}$
and $M_{l}$ are caused by the dissipation, which are hermitian matrix

$\left(M_{g}\right)_{ij}=\sum_{\mu}D^{g*}_{\mu i}D^{g}_{\mu
j},\quad\left(M_{l}\right)_{ij}=\sum_{\mu}D^{l*}_{\mu i}D^{l}_{\mu j}.$ (6)

Damping matrix $X$ provides a complete description of dissipative dynamics,
it’s becomes more obvious when we consider the speed that an initial state
converging to the steady state, i.e. we focus on $\tilde{C}(t)=C(t)-C_{s}$,
where $C_{s,ij}=\text{Tr}(c^{\dagger}_{i}c_{j}\,\rho_{s})$ is the steady state
correlation function. Then, we find that $\tilde{C}(t)$ is governed by the
following equation

$\displaystyle\tilde{C}(t)$ $\displaystyle=$ $\displaystyle
e^{-iXt}\cdot\tilde{C}_{0}\cdot e^{-iX^{\dagger}t},$ (7) $\displaystyle=$
$\displaystyle\sum_{m,n}\mathrm{e}^{\mathrm{i}\left(-\lambda_{n}+\lambda^{*}_{m}\right)t}|u^{R}_{n}\rangle\langle
u^{L}_{n}|\tilde{C}_{0}|u^{L}_{m}\rangle\langle u^{R}_{m}|.$

The second step in Eq.(7) is obtained using eigen-decomposition method, where
$\\{\lambda_{n}\\}$ are the eigenvalues of $X$, that is Lindbladian spectra of
the system, and $|u^{R}_{n}\rangle$ and $|u^{L}_{n}\rangle$ satisfy
biorthogonal condition, $\langle u^{L}_{n}|u^{R}_{n}\rangle=\delta_{mn}$,
$X|u^{R}_{n}\rangle=\lambda_{n}|u^{R}_{n}\rangle$,
$X^{\dagger}|u^{L}_{n}\rangle=\lambda^{*}_{n}|u^{L}_{n}\rangle$. It’s obvious
that Eq.(7) is coincide with the Schrödinger equation in quantum mechanics, of
which the dynamic generator is a NH single-particle matrix, and $\tilde{C}(t)$
is analogous to the density matrix. So the topological property of the
dissipative dynamics is captured by the NH damping matrix $X$. The same
dissipative dynamics described by the damping matrix when the pairing-term is
included in the open free fermionic system by using the method of third
quantization[38, 39], while the quansi-particle is changed into Marjorana
fermion.

###  II.2 Lindbladian spectra and the dark state

In the dissipative dynamics, the dynamic information is hidden in the
Lindbladian spectra (or rapidity spectra), which is the eigenvalues’ spectra
of damping matrix $X$ in the complex plane (denote as $\\{\lambda\\}$) in the
quadratic open free fermionic system, as seen in Fig.1. In which the imaginary
parts of $\lambda$ specify the speed that the initial state converges to the
steady state, the smaller the $\text{Im}\left(\lambda\right)$ the quicker it
converges to the steady state. Such that the spectral gap is defined as
$\Delta=2\max\left[\text{Im}\left(\lambda\right)\right]$[38, 32]. In the
Lindblidian spectra, the general modes are those with negative imaginary parts
($\text{Im}\left(\lambda\right)<0$), which decays over time. And if there only
have general modes in the spectra, then there is a unique steady state of the
Liouville dynamics[38, 40]. The modes with positive imaginary part are
forbidden ($\text{Im}\left(\lambda\right)>0$), which are unphysical because
they are amplified over time. The dark state is the eigenmode which it’s
eigenvalue’s imaginary part vanishes ($\text{Im}\left(\lambda\right)=0$),
these modes are neither decay nor amplify over time. Because the dark state is
decoupled from the dissipative dynamics, so it is also a steady-state of the
system governed by Eq.(1), such that the dark state implies the non-unique
steady state of Liouville dynamics[38]. And the zero frequency mode is the
eigenmode which it’s eigenvalue’s real part vanishes
($\text{Re}\left(\lambda\right)=0$).

Figure 1: The lindbladian spectra of open free fermionic system in the complex
plane. Where the physical modes are those $\text{Im}\left(\lambda\right)<0$
(green), the dark states are those $\text{Im}\left(\lambda\right)=0$ (yellow),
and the edge zero frequency modes are those $\text{Re}\left(\lambda\right)=0$
(light blue). However, The modes that $\text{Im}\left(\lambda\right)>0$ (gray)
are the amplifying mode, which is unphysical.

Similar to the gapless edge mode which protected by the topology of
Hamiltonian, EDS and edge zero-frequency mode in the dissipative dynamics are
related to the topology of damping matrix. From the point view topological
band theory, these edge modes are in-gap states. There are three kinds of
bulk-gap in the complex spectra, the point-gap, real line-gap, and imaginary
line-gap, which support different kinds of in-gap edge modes. The closing of
point gap are those $\lambda=0$, and the closing of real (imaginary) line-gap
are those $\text{Re}\left(\lambda\right)=0$
($\text{Im}\left(\lambda\right)>0$). So the topological classification of
dissipative dynamics is to study the complex spectra of damping matrix. S.
Lieu and et al. firstly apply such principle in the open free fermionic
system, and classify the dissipative dynamics with edge zero-frequency mode by
using the 38-fold way, which leads to the Ten-fold way for quadratic
lindbladians, denote as LMC class[28]. However, it’s not known whether the
dissipative dynamics with EDS can be classified with a similar scheme.

##  III topological classification of Non-hermitian random matrix

There are 43 non-equivalent symmetry classes of NHRM, which is known as
Bernard-LeClair class [25]. The topological classification of those NHRM based
on the AZ scheme is proposed by K. Kawabata and et al., that there only have
38 of topological inequivalent symmetry classes, which is the 38-fold way
[26]. The main principle of the classification is to flatten the spectra of a
NH matrix, it is accomplished by the unitary flatten of point-gap, hermitian
flatten of real line-gap and anti-hermitian flatten of imaginary line-gap.
These flatten procedures keep the symmetries and the bulk-gap of complex
spectra, such that the topological classification is identical to it’s
hermitian (or anti-hermitian) counterpart, in which the principle in the AZ
scheme is used. There are three fundamental symmetries in the AZ class, time-
reversal symmetry (TRS), particle-hole symmetry (PHS), chiral symmetry (CS),

$\displaystyle\text{TRS}:$ $\displaystyle\qquad U_{t}\cdot H^{*}\cdot
U^{-1}_{t}=H,$ (8) $\displaystyle\text{PHS}:$ $\displaystyle\qquad U_{c}\cdot
H^{T}\cdot U^{-1}_{c}=-H,$ (9) $\displaystyle\text{CS}:$ $\displaystyle\qquad
S\cdot H^{\dagger}\cdot S^{-1}=-H,$ (10)

where $U_{t}$ and $U_{c}$ are unitary matrices, and square to 1 or to -1,
i.e., we have $U_{c,t}U^{*}_{c,t}=\pm 1$. And CS is a combination of TRS and
PHS, such that $S=U_{t}U^{*}_{c}$. So we have $3\times 3=9$ kinds of symmetry
classes, and another symmetry class is that only the CS is satisfied, which
gives total of 10 symmetry classes. In contrast to the Hermitian case, there
are a variant of TRS and PHS for NH matrix, which is defined as

$\displaystyle\text{TRS}^{\dagger}:$ $\displaystyle\qquad U_{t}\cdot
H^{T}\cdot U^{-1}_{t}=H,$ (11) $\displaystyle\text{PHS}^{\dagger}:$
$\displaystyle\qquad U_{c}\cdot H^{*}\cdot U^{-1}_{c}=-H.$ (12)

These symmetry class is denoted as AZ† class. Compare to AZ class, there only
have 6 independent symmetry classes. Furthermore, there is an additional
symmetry for NH matrix, the sub-lattice symmetry (SLS),

$U_{s}\cdot H\cdot U^{-1}_{s}=-H,\qquad U_{s}^{2}=1,$ (13)

which is equivalent to CS for Hermitian random matrix, while it is an
additional symmetry of NH matrix since $H^{\dagger}\neq H$. Such additional
second-order symmetry would alter the classification space[41], then symmetry
classes is enriched for NHRM, and gives another 22 symmetry classes that
specified by the commutation/anti-commutation relations of $U_{s}$ with TRS or
PHS. And results, we have $10+6+22=38$ symmetry classes, this is the 38-fold
way of NHRM. Another internal symmetry of NHRM is the pseudo-hermitian [42,
43], $\eta H^{\dagger}\eta^{-1}=H$, which is a second-order symmetry that
gives the same symmetry classes as SLS.

##  IV The Double damping matrix and the system class of EDS

In the topological band theory, if there are gapless modes that closing gap at
the edge of system, then the bulk-gap which has non-trivial topology is
unavoidable. Which means that if the EDS in the dissipative dynamics are
protected by the topology of system, then we must have two bands in the system
of which the imaginary parts with opposite sign, one is negative, the other
one is positive.

Figure 2: The double Lindbladian spectra of open free fermionic system, that
the modes which $\text{Im}(\lambda_{n})>0$ and $\text{Im}(\lambda_{n})<0$ are
allowed. However, the modes which $\text{Im}(\lambda_{n})>0$ are unphysical,
the including of those modes is only for the convenience of symmetry
classification.

However, the eigenmodes that $\text{Im}(\lambda_{n})>0$ is forbidden in the
damping matrix, so we can’t define the imaginary line-gap. Which means that
the dark states of an open quantum system might have no topological
protection. To reveal the topological protection of EDS, we combine $X$ with
it’s complex conjugate $X^{*}$ to form a double damping matrix

$\tilde{X}=\begin{pmatrix}X&0\\\ 0&X^{*}\end{pmatrix}.$ (14)

That the redundant freedom $X^{*}$ is only for the convenience of topological
classification, it is unphysical and should be discarded in the dissipative
dynamics. Both the positive and the negative imaginary parts are present in
the spectra of $\tilde{X}$, as seen in Fig.2, so the imaginary line-gap is
well defined in $\tilde{X}$. Such that nontrivial topology of $\tilde{X}$
would indicates the appearance of in-gap edge-mode that closing the imaginary
line-gap, which is the EDS of dissipative dynamics.

Therefore, if $\text{Im}\left(\lambda\right)\neq 0$, then the imaginary line-
gap of non-hermitian matrix $\tilde{X}$ can be defined as
$2\max\left[\text{Im}\left(\lambda\right)\right]$, which is the spectra gap of
Liouville dynamics. And the corresponding symmetry class is identified with
the symmetries that $\tilde{X}$ obeys. We find that TRS is automatically
satisfied in $\tilde{X}$, $U_{t}\tilde{X}^{*}U_{t}^{-1}=\tilde{X}$, where
$U_{t}=\tau_{x}\otimes\mathbb{I}$ or $\tau_{y}\otimes\mathbb{I}$, and
$\tau_{x},\tau_{y}$ is acting on the artificial degree of freedom. However,
both $\tau_{x}\otimes\mathbb{I}$ and $\tau_{y}\otimes\mathbb{I}$ are allowed
for $\tilde{X}$, which means that the symmetry classes of $\tilde{X}$ is non-
unique. Unfortunately, the ambiguity in the symmetry classes can’t be removed,
the interesting thing is that the robustness of EDS against the perturbations
is enhanced if the symmetry classes which give non-trivial topology is non-
unique. The robustness of EDS can be checked by considering the perturbation
which corresponds to the coupling between the degrees of freedom that belongs
to $X^{*}$ and $X$. If the coupling that satisfy the symmetry constraint can
gap out the EDS, then the corresponding topology is trivial, otherwise, the
topology is non-trivial. To determine the robustness of EDS, we study the
coupled damping matrix

$\tilde{X}_{c}=\begin{pmatrix}X&C\\\ C^{\dagger}&X^{*}\end{pmatrix}.$ (15)

The coupling $C$ can breaks or preserves the symmetry of $\tilde{X}$, this is
depends on the symmetry operation. For example, if $C=C^{T}$, the TRS is
preserved if $U_{t}=\tau_{x}\otimes\mathbb{I}$, while the TRS is broken if
$U_{t}=\tau_{y}\otimes\mathbb{I}$. On the contrary, $C=-C^{T}$ preserve TRS
for $U_{t}=\tau_{y}\otimes\mathbb{I}$ and break TRS for
$U_{t}=\tau_{x}\otimes\mathbb{I}$. Consequently, if the symmetry classes of
$\tilde{X}$ corresponds to the symmetry operation $\tau_{x}\otimes\mathbb{I}$
or $\tau_{y}\otimes\mathbb{I}$ is topological non-trivial in a given spatial
dimension, then one can check that whether the EDS are exist or not in the
spectra of $\tilde{X}_{c}$ to verify the robustness of EDS. If the EDS still
present in the spectra of $\tilde{X}_{c}$, that is to say the the EDS can’t be
removed by the perturbation which respect the symmetry constraint, therefore
topological protection of EDS is proved. Instead, if the EDS is disappear in
the spectra of $\tilde{X}_{c}$, then the corresponding topology is trivial,
and the EDS is a trivial mode of dissipative dynamics. In this paper, we
considering the perturbation which preserve the symmetry as
$C_{1}=c\cdot\tau_{x}\otimes\sigma_{x}$ for $U_{t}=\tau_{x}\otimes\mathbb{I}$
and $C_{2}=c\cdot\tau_{x}\otimes\sigma_{y}$ for
$U_{t}=\tau_{y}\otimes\mathbb{I}$.

In a word, the topological classification of double damping matrix
$\tilde{X}=\text{diag}\left(X,X^{*}\right)$ can reveal the topology of the
dissipative dynamics with EDS. If the topology of $\tilde{X}$ is non-trivial
in a given spatial dimension, then there is EDS in the corresponding open
quantum system which described by $X$. And the ambiguities in the symmetry
classes of $\tilde{X}$ can enhance the robustness of EDS against the
perturbation.

##  V Some Examples

###  V.1 dissipative SSH model

The SSH model describes spinless fermions hopping on a one-dimensional (1D)
lattice with staggered hopping amplitudes, and it’s Bloch Hamiltonian is
written as[44, 45]

$H_{\text{ssh}}(k)=(v+w\cos k)\,\sigma_{x}+w\sin k\,\sigma_{y}.$ (16)

Where $\sigma_{x,y,z}$ represents the internal degree of freedom, and denote
as sub-lattice $A$ and $B$. In order to have EDS, we consider the dissipators
per lattice site as

$L^{g}_{\mu}=\sqrt{\gamma_{g}}c^{\dagger}_{\mu,A},\qquad
L^{l}_{\mu}=\sqrt{\gamma_{l}}c^{\dagger}_{\mu,A},$ (17)

where subscript $\mu$ represents the index of lattice site. With simple
derivation, we get damping matrix of the dissipative SSH model as

$X_{\text{ssh}}(k)=-\left(v+w\cos k\right)\sigma_{x}+w\sin
k\,\sigma_{y}-\mathrm{i}\gamma\,\sigma_{z}-i\gamma\mathbb{I},$ (18)

where $\gamma=\frac{\gamma_{g}+\gamma_{l}}{2}$. The spectrum of
$X_{\text{ssh}}(k)$ is

$\lambda_{\text{ssh}}(k)=-i\gamma\pm\sqrt{v^{2}+w^{2}+2vw\,\cos\,k-\gamma^{2}}.$
(19)

It’s obvious that $\text{Im}\left(\lambda_{\text{ssh}}\right)\leq 0$, and ”=”
is only for the real gap closing point where $v=w$. In other words, the
closing of imaginary line-gap is accompanied by the closing of real gap for
$\tilde{X}_{\text{ssh}}(k)$, which means the edge modes of
$\tilde{X}_{\text{ssh}}(k)$ are those that closing the point-gap. Furthermore,
if the winding number of $H_{\text{ssh}}$ is non-trivial in the bulk, then the
point-gap is closed at the edge of system. So that the critical point of
$X_{\text{ssh}}(k)$ to has EDS is identical to the topological phase
transition point of $H_{\text{ssh}}$, which means that the EDS are the dynamic
signature of the topological order of internal dynamics.

Next, we see the topological classification of dissipative SSH model with EDS.
The symmetries of $X_{\text{ssh}}(k)$ are as follows

$\displaystyle\text{PHS}^{\dagger}:$
$\displaystyle\qquad\sigma_{z}X_{\text{ssh}}^{*}(k)\sigma_{z}=-X_{\text{ssh}}(-k),$
(20) $\displaystyle\text{TRS}^{\dagger}:$ $\displaystyle\qquad
X_{\text{ssh}}^{T}(k)=X_{\text{ssh}}(-k),$ (21)

then, $X_{\text{ssh}}(k)$ is belongs to the class BDI† with a $\mathbb{Z}$
classification from LMC classes in the 1D case, which means there are edge-
modes that closing the real line-gap
($\text{Re}\left(\lambda_{\text{edge}}\right)=0$). However, one of such edge-
mode is the EDS ($\text{Im}\left(\lambda_{\text{edge}}\right)=0$), that can’t
be specified by the class BDI†. To reveal the topological protection of EDS in
the dissipative SSH model, we considering the double damping matrix, which has
the following symmetry

$\displaystyle\text{SLS}:$ $\displaystyle\qquad
U_{s}\cdot\tilde{X}_{\text{ssh}}(k)\cdot
U^{-1}_{s}=-\tilde{X}_{\text{ssh}}(k),$ (22) $\displaystyle\text{PHS}:$
$\displaystyle\qquad U_{c}\cdot\tilde{X}_{\text{ssh}}^{T}(k)\cdot
U^{-1}_{c}=-\tilde{X}_{\text{ssh}}(-k),$ (23) $\displaystyle\text{TRS}:$
$\displaystyle\qquad U_{t}\cdot\tilde{X}_{\text{ssh}}^{*}(k)\cdot
U^{-1}_{t}=\tilde{X}_{\text{ssh}}(-k),$ (24)

where $U_{c}=U_{s}=\tau_{x}\otimes\sigma_{z}$ or $\tau_{y}\otimes\sigma_{z}$,
and $U_{t}=\tau_{x}\otimes\mathbb{I}$ or $\tau_{y}\otimes\mathbb{I}$. The
ambiguities of symmetry operation leads to four possible symmetry classes,
which is obtained with the permutation of $U_{s}$ and $U_{t}$, as seen in
Table.I.

$U_{t}$ $\setminus$ $U_{s}$ | $\tau_{x}\otimes\sigma_{z}$ | $\tau_{y}\otimes\sigma_{z}$
---|---|---
$\tau_{x}\otimes\mathbb{I}$ |  $\mathcal{S}_{++}$ BDI |  $\mathcal{S}_{-+}$ CI
$\tau_{y}\otimes\mathbb{I}$ |  $\mathcal{S}_{-+}$ DIII |  $\mathcal{S}_{++}$ CII
Table 1: The symmetry classes of $\tilde{X}_{\text{ssh}}(k)$ with sub-lattice
symmetry (SLS), where the first and second subscripts of
$\mathcal{S}_{\pm\pm}$ specifies the commutation ($+$) and anti-commutation
($-$) relation to the time-reversal symmetry (TRS) and particle-hole symmetry
(PHS) correspondingly. That $U_{s}U_{t}=\pm\epsilon_{t}U_{t}U^{*}_{s}$,
$U_{s}U_{c}=\pm\epsilon_{c}U_{c}U^{*}_{s}$, where
$U_{t}U^{*}_{t}=\epsilon_{t}$ and $U_{c}U^{*}_{c}=\epsilon_{s}$.

When the symmetry classes are identified, then the corresponding classifying
space with the point-gap and it’s topological properties at a certain spatial
dimension is revealed, as seen in Table.II. In the 1D case, the model falls
into class $\mathcal{S}_{++}$BDI with $\mathbb{Z}$ classification or
$\mathcal{S}_{++}$CII with $2\mathbb{Z}$ classification. The label
$2\mathbb{Z}$ indicates the topological number is an even integer, which is
isomorphic to the $\mathbb{Z}$ classification, in a word, the topological
number of dissipative SSH model with EDS is characterize by an integer
$\mathbb{Z}$. This can be understood with the symmetry analysis, the coulpling
$C_{1}$ respects TRS and PHS of class $\mathcal{S}_{++}$BDI, and the coulpling
$C_{2}$ respects TRS and PHS of class $\mathcal{S}_{++}$CII, which means that
the EDS in $\tilde{X}_{\text{ssh}}$ are robust both to the coupling $C_{1}$
and $C_{2}$, which can be seen in Fig.3(c,d). However, the couplings $C_{1}$
and $C_{2}$ break the symmetries of class $\mathcal{S}_{-+}$DIII and class
$\mathcal{S}_{-+}$CI, then gives trivial topological classification.

| classifying space | $d=0$ | $d=1$ | $d=2$ | $d=3$
---|---|---|---|---|---
$\mathcal{S}_{++}$ BDI | $\mathcal{R}_{1}$ | $\mathbb{Z}_{2}$ | $\mathbb{Z}$ | 0 | 0
$\mathcal{S}_{-+}$ CI | $\mathcal{C}_{0}$ | $\mathbb{Z}$ | 0 | $\mathbb{Z}$ | 0
$\mathcal{S}_{-+}$ DIII | $\mathcal{C}_{0}$ | $\mathbb{Z}$ | 0 | $\mathbb{Z}$ | 0
$\mathcal{S}_{++}$ CII | $\mathcal{R}_{5}$ | 0 | $2\mathbb{Z}$ | 0 | $\mathbb{Z}_{2}$
Table 2: The classifying spaces and the topological numbers of symmetry
classes of $\tilde{X}_{\text{ssh}}(k)$ with point-gap, where $d$ is the number
of dimensions. Figure 3: The double Lindbladian spectra of dissipative SSH
model with edge dark state (EDS) in periodic boundary condition (a, PBC) and
open boundary condition (b, OBC) for $L=100$, the EDS is marked in green.
Where $v=1$, $w=1.3$, and $\gamma_{g}=\gamma_{l}=0.2$. And the spectra of
coupled damping matrix $\tilde{X}_{c,\text{ssh}}$ for $C_{1}$ (c) and $C_{2}$
(d), where $c=0.2$, it is obvious that EDS is robust both to the $C_{1}$ and
$C_{2}$.

The Lindbladian spectra of dissipative SSH mode in the periodic boundary
condition (PBC) and open boundary condition (OBC) are presented in Fig.3, as
well as coupled damping matrix $\tilde{X}_{c,\text{ssh}}$. The EDS is robust
both to the coupling $C_{1}$ and $C_{2}$, this is because that both class
$\mathcal{S}_{++}$CII and class $\mathcal{S}_{++}$BDI can characterize the
topological protection of EDS, as seen in Fig.3(c,d).

###  V.2 dissipative QWZ model

The QWZ model is a two-dimensional (2D) Chern insulator that describes the
spinless fermions hopping in 2D lattice. The degree of freedoms (the orbital)
for each unit cell are 2, which we denote them as sub-lattice $A$ and $B$,
then Bloch Hamiltonian of QWZ model is [44, 45]

$H_{\text{qwz}}(\mathbf{k})=\sin k_{x}\,\sigma_{x}+\sin
k_{y}\,\sigma_{y}+\left(u+\cos k_{x}+\cos k_{y}\right)\sigma_{z},$ (25)

Similarly, $\sigma_{x,y,z}$ represents the internal degree of freedom. We
consider the following dissipators per lattice site

$L^{g}_{\mu}=\sqrt{\gamma_{g}}\left(c^{\dagger}_{\mu,A}+ic^{\dagger}_{\mu,B}\right),\qquad
L^{l}_{\mu}=\sqrt{\gamma_{l}}\left(c_{\mu,A}-ic_{\mu,B}\right),$ (26)

where subscript $\mu$ respresents the index of lattice. Then the damping
matrix of dissipative QWZ model is

$\displaystyle X_{\text{qwz}}(\mathbf{k})=\sin k_{x}\,\sigma_{x}+\left(\sin
k_{y}-i\gamma\right)\,\sigma_{y}$ $\displaystyle-\left(u+\cos k_{x}+\cos
k_{y}\right)\sigma_{z}-i\gamma\mathbb{I},$ (27)

and the spectrum of $X_{\text{qwz}}(\mathbf{k})$ is obtained as

$\displaystyle E_{\text{qwz}}(\mathbf{k})=-i\gamma$ (28)
$\displaystyle\pm\sqrt{\left(u+\cos k_{x}+\cos
k_{y}\right)^{2}+\sin^{2}k_{x}+\left(\sin k_{y}-i\gamma\right)^{2}},$

it’s obvious that $\text{Im}\left(E_{\text{qwz}}\right)\leq 0$, and ”=” is
only that $\left(u+\cos k_{x}+\cos k_{y}\right)^{2}+\sin^{2}k_{x}=0$, which is
also the gap closing points where $u=-2,0,2$. Amazingly, the closing of
imaginary line-gap can also be satisfied at the edge of system when the Chern
number of $H_{\text{qwz}}$ is non-zero. So, the EDS of dissipative QWZ model
ware the dynamic signature of the topological order of internal dynamics.

$U_{t}$ $\setminus$ $U_{s}$ | $\tau_{x}\otimes\sigma_{x}$ | $\tau_{y}\otimes\sigma_{x}$
---|---|---
$\tau_{x}\otimes\mathbb{I}$ |  $\mathcal{S}_{+}$ AI |  $\mathcal{S}_{-}$ AI
$\tau_{y}\otimes\mathbb{I}$ |  $\mathcal{S}_{-}$ AII |  $\mathcal{S}_{+}$ AII
Table 3: The symmetry classes of $\tilde{X}_{\text{qwz}}(\mathbf{k})$ with
sub-lattice symmetry (SLS) $\mathcal{S}$, where subscripts of
$\mathcal{S}_{\pm}$ specifies the commutation ($+$) and anti-commutation ($-$)
relation to the time-reversal symmetry (TRS). That
$U_{s}U_{t}=\pm\epsilon_{t}U_{t}U^{*}_{s}$, where
$U_{t}U^{*}_{t}=\epsilon_{t}$.

Then, we study the topological protection of EDS. For $X_{\text{qwz}}$, it’s
symmetry is

$\text{PHS}^{\dagger}:\qquad\sigma_{x}X_{\text{qwz}}^{*}(-\mathbf{k})\sigma_{x}=-X_{\text{qwz}}(\mathbf{k}),$
(29)

In the 2D case, it belongs to class D† with $\mathbb{Z}$ classification in the
LMC class, which means there are edge-modes that closing the real line-gap.
However, the EDS in the dissipative QWZ model can’t be specified by class D†.
The symmetry protection of EDS can be revealed in the double damping matrix,
$\tilde{X}_{\text{qwz}}(\mathbf{k})$ has the following symmetry

$\displaystyle\text{SLS}:$ $\displaystyle\qquad
U_{s}\cdot\tilde{X}_{\text{qwz}}(\mathbf{k})\cdot
U^{-1}_{s}=-\tilde{X}_{\text{qwz}}(\mathbf{k}),$ (30)
$\displaystyle\text{TRS}:$ $\displaystyle\qquad
U_{t}\cdot\tilde{X}_{\text{qwz}}^{*}(\mathbf{k})\cdot
U^{-1}_{t}=\tilde{X}_{\text{qwz}}(-\mathbf{k}),$ (31)

where $U_{s}=\tau_{x}\otimes\sigma_{x}$ or $\tau_{y}\otimes\sigma_{x}$, and
$U_{t}=\tau_{x}\otimes\mathbb{I}$ or $\tau_{y}\otimes\mathbb{I}$. Identical to
the SSH model, the ambiguities of symmetry operation leads to four possible
symmetry classes, as seen in Table.III

| classifying space | $d=0$ | $d=1$ | $d=2$ | $d=3$
---|---|---|---|---|---
$\mathcal{S}_{+}$ AI | $\mathcal{R}_{1}$ | $\mathbb{Z}_{2}$ | $\mathbb{Z}$ | 0 | 0
$\mathcal{S}_{-}$ AI | $\mathcal{R}_{3}$ | 0 | $\mathbb{Z}_{2}$ | $\mathbb{Z}_{2}$ | $\mathbb{Z}$
$\mathcal{S}_{-}$ AII | $\mathcal{R}_{7}$ | 0 | 0 | 0 | $2\mathbb{Z}$
$\mathcal{S}_{+}$ AII | $\mathcal{R}_{5}$ | 0 | $2\mathbb{Z}$ | 0 | $\mathbb{Z}_{2}$
Table 4: The classifying spaces and the topological numbers of symmetry
classes of $\tilde{X}_{\text{qwz}}(\mathbf{k})$ with imaginary line-gap, where
$d$ is the number of dimensions. Figure 4: The double Lindbladian spectra of
dissipative QWZ model with edge dark state (EDS) in periodic boundary
condition (a, PBC) and open boundary condition (b, OBC) for $L_{x}=20$ and
$L_{y}=10$, where OBC is that the boundary along the $x$-direction is open,
the EDS is marked in green. Where $u=-1$, $\gamma_{g}=\gamma_{l}=0.2$. And the
spectra of coupled damping matrix $\tilde{X}_{c,\text{qwz}}$ for $C_{1}$ and
$C_{2}$ where $c=0.8$. One can see that EDS is robust against the perturbation
$C_{1}$ (c), while it’s gaped out by the perturbation $C_{2}$(d).

From 38-fold way of NHRM, the topological classification of
$\tilde{X}_{\text{qwz}}(\mathbf{k})$ in different spatial dimensions is
obtained in Table.IV. In the 2D case, only the class $\mathcal{S}_{-}$AI with
$\mathbb{Z}_{2}$ classification is non-trivial, the other three classes are
trivial. The TRS in class $\mathcal{S}_{-}$AI is satisfied by the coupling
$C_{1}$ while violated by $C_{2}$, so it would expect that the EDS might be
gaped out when the coupling $C_{2}$ is introduced.

In Fig.4, the spectra of double damping matrix $\tilde{X}_{\text{qwz}}$ in the
PBC and OBC are presented. Which OBC is that the boundary condition along the
$x$-direction is open. This is because that the imaginary momentum along the
$y$-direction will induce the NH skin effect, that forces edge-modes of
$X_{\text{qwz}}$ becomes pure imaginary, such that the EDS is absent for such
boundary condition. Furthermore, The EDS are gaped out by coupling $C_{2}$ in
Fig.4(d), while they are robust to the coupling $C_{1}$ in Fig.4(c), that is
to say the EDS are protected by the TRS $U_{t}=\tau_{x}\otimes\mathbb{I}$.

##  VI conclusion and discussion

In this paper, a framework to understand the topological protection of EDS in
the presence of both dissipation and internal dynamics is provided. We make
use of the 38-fold way to classify the damping dynamics with EDS in
dissipative TIs, of which the dissipative dynamics of these sysytems are
completely captured by a single-particle NH matrix $X$. It turns out that the
symmetry classification of $X$ with EDS is ill defined, the right
classification scheme is based on the double damping matrix
$\tilde{X}=\text{diag}\left(X,X^{*}\right)$. In our scheme, the double damping
matrix $\tilde{X}$ is classified topologically by using the 38-fold way, the
edge modes that close the imaginary line-gap of $\tilde{X}$ are the EDS of
$X$. Different from previous studies of EDS in purely dissipative systems [31,
32], the EDS in this work are robust against the including of the Hamiltonian
terms. As the matter of fact, in the two explanation examples of dissipative
SSH model and dissipative QWZ model, the appearance of EDS are associated with
non-trivial topology of internal dynamics, such that the EDS are also a
dynamic signature of topological order.

In 38-fold way, the imaginary line-gap can be defined in the system of which
TRS, PHS† or CS is satisfied, however these symmetries are equivalent when we
flatten the spectra[26]. Which means the double damping matrix $\tilde{X}$
which TRS is automatically satisfied is universal for the open free fermionic
system. So it can be also applied to the dissipative TSs, the only difference
is that the quansi-particle is changed into the Majorana fermions, and the EDS
become the Majorana zero-damping modes, that is vital for the dissipative
braiding[31]. We expect our proposal can also be used in the dissipative TSs,
which is our future direction.

##  VII acknowledgment

## References

  * [1] Xiao-Liang Qi, and Shou-Cheng Zhang, Topological insulators and superconductors, Rev. Mod. Phys. 83, 1057 (2011).doi: 10.1103/RevModPhys.83.1057
  * [2] Charles Day, Quantum spin Hall effect shows up in a quantum well insulator, just as predicted, Phys. Today 61, 19 (2008).doi: 10.1063/1.2835139
  * [3] B. Andrei Bernevig, and Shou-Cheng Zhang, Quantum Spin Hall Effect, Phys. Rev. Lett. 96, 106802 (2006). doi: 10.1103/PhysRevLett.96.106802
  * [4] Alexander Altland, and Martin R. Zirnbauer, Nonstandard symmetry classes in mesoscopic normal-superconducting hybrid structures, Phys. Rev. B 55, 1142 (1997). doi: 10.1103/PhysRevB.55.1142
  * [5] S. Weimann, M. Kremer, Y. Plotnik, Y. Lumer, and et al., Topologically protected bound states in photonic parity–time-symmetric crystals, Nat. Mater 16, 133 (2017). doi: 10.1038/nmat4811
  * [6] Miguel A. Bandres, Steffen Wittek, Gal Harari, Midya Parto, Jinhan Ren, Mordechai Segev, Demetrios N. Christodoulides, and Mercedeh Khajavikhan, Topological insulator laser: Experiments, Science 359, eaar4005 (2018). doi: 10.1126/science.aar4005
  * [7] Julia M. Zeuner, Mikael C. Rechtsman, Yonatan Plotnik, Yaakov Lumer, Stefan Nolte, Mark S. Rudner, Mordechai Segev, and Alexander Szameit, Observation of a Topological Transition in the Bulk of a Non-Hermitian System, Phys. Rev. Lett. 115, 040402 (2015). doi: 10.1103/PhysRevLett.115.040402
  * [8] Ching Hua Lee, and Ronny Thomale, Anatomy of skin modes and topology in non-Hermitian systems, Phys. Rev. B 99, 201103(R) (2018).doi: 10.1103/PhysRevB.99.201103
  * [9] Stefano Longhi, Probing non-Hermitian skin effect and non-Bloch phase transitions, Phys. Rev. Research 1, 023013 (2019).doi: 10.1103/PhysRevResearch.1.023013
  * [10] Hui Jiang, Li-Jun Lang, Chao Yang, Shi-Liang Zhu, and Shu Chen, Interplay of non-Hermitian skin effects and Anderson localization in nonreciprocal quasiperiodic lattices, Phys. Rev. B 100, 054301 (2019).doi: 10.1103/PhysRevB.100.054301
  * [11] Fei Song, Shunyu Yao, and Zhong Wang, Non-Hermitian Skin Effect and Chiral Damping in Open Quantum Systems, Phys. Rev. Lett. 123, 170401 (2019). doi: 10.1103/PhysRevLett.123.170401
  * [12] C. M. Bender, Making sense of non-Hermitian Hamiltonians, Rep. Prog. Phys. 70, 947 (2007). doi: 10.1088/0034-4885/70/6/R03
  * [13] M.-A. Miri, and A. Alù, Exceptional points in optics and photonics, Sci. 363, 6422 (2019). doi: 10.1126/science.aar7709
  * [14] Shun-Yu Yao, and Zhong Wang, Edge States and Topological Invariants of Non-Hermitian Systems, Phys. Rev. Lett. 121, 086803 (2018).doi: 10.1103/PhysRevLett.121.086803
  * [15] Shun-Yu Yao, Fei Song, and Zhong Wang, Non-Hermitian Chern Bands, Phys. Rev. Lett. 121, 136802 (2018).doi: 10.1103/PhysRevLett.121.136802
  * [16] LoÏc Herviou, Jens H. Bardarson, and Nicolas Regnault, Defining a bulk-edge correspondence for non-Hermitian Hamiltonians via singular-value decomposition, Phys. Rev. A. 99, 052118 (2019).doi: 10.1103/PhysRevA.99.052118
  * [17] Xiao-Ran Wang, Cui-xian Guo, and Su-Peng Kou, Defective edge states and number-anomalous bulk-boundary correspondence in non-Hermitian topological systems, Phys. Rev. B. 101, 121116(R) (2020).doi: 10.1103/PhysRevB.101.121116
  * [18] Alexander Altland, Michael Fleischhauer, and Sebastian Diehl, Symmetry Classes of Open Fermionic Quantum Matter, Phys. Rev. X 11, 021037 (2021). doi: 10.1103/PhysRevX.11.021037
  * [19] A. Rivas, and O. Viyuela, Density-matrix Chern insulators: Finite-temperature generalization of topological insulators, Phys. Rev. B 88, 155141 (2013). doi: 10.1103/PhysRevB.88.155141
  * [20] D. Linzner, L. Wawer, F. Grusdt, and M. Fleischhauer, Reservoir-induced Thouless pumping and symmetry-protected topological order in open quantum chains, Phys. Rev. B 94, 201105(R) (2016). doi: 10.1103/PhysRevB.94.201105
  * [21] F. Grusdt, Topological order of mixed states in correlated quantum many-body systems, Phys. Rev. B 95, 075106 (2017). doi: 10.1103/PhysRevB.95.075106
  * [22] Felix Dangel, Marcel Wagner, Holger Cartarius, Jörg Main, and Günter Wunner, Topological invariants in dissipative extensions of the Su-Schrieffer-Heeger model, Phys. Rev. A 98, 013628 (2018). doi: 10.1103/PhysRevA.98.013628
  * [23] Clemens Gneiting, Akshay Koottandavida, A. V. Rozhkov, and Franco Nori, Unraveling the topology of dissipative quantum systems, Phys. Rev. Research 4, 023036 (2022). doi: 10.1103/PhysRevResearch.4.023036
  * [24] Jiewei Cheng, Xiujuan Zhang, Ming-Hui Lu, and Yan-Feng Chen, Competition between band topology and non-Hermiticity, Phys. Rev. B 105, 094103 (2022). doi: 10.1103/PhysRevB.105.094103
  * [25] D. Bernard, and A. LeClair, A classification of non-Hermitian random matrices, in Statistical Field Theories, edited by A. Cappelli and G. Mussardo (Springer Netherlands, Dordrecht, 2002), pp. 207–214.
  * [26] Kohei Kawabata, Ken Shiozaki, Masahito Ueda, and Masatoshi Sato, Symmetry and Topology in Non-Hermitian Physics, Phys. Rev. X 9, 041015 (2019). doi: 10.1103/PhysRevX.9.041015
  * [27] Antonio M. García-García, Lucas Sá, and Jacobus J. M. Verbaarschot, Symmetry Classification and Universality in Non-Hermitian Many-Body Quantum Chaos by the Sachdev-Ye-Kitaev Model, Phys. Rev. X 12, 021040 (2022).doi: 10.1103/PhysRevX.12.021040
  * [28] Simon Lieu, Max McGinley, and Nigel R. Cooper, Tenfold Way for Quadratic Lindbladians, Phys. Rev. Lett. 124, 040401 (2020).doi: 10.1103/PhysRevLett.124.040401
  * [29] Makio Kawasaki, Ken Mochizuki, and Hideaki Obuse, Topological phases protected by shifted sublattice symmetry in dissipative quantum systems, Phys. Rev. B 106, 035408 (2022). doi: 10.1103/PhysRevB.106.035408
  * [30] Moos T. van Caspel, Sergio Enrique Tapias Arze, and Isaac Pérez Castillo, Dynamical signatures of topological order in the driven-dissipative Kitaev chain, SciPost Phys. 6, 026 (2019).doi: 10.21468/SciPostPhys.6.2.026
  * [31] Sebastian Diehl, Enrique Rico, Mikhail A. Baranov, and Peter Zoller, Topology by dissipation in atomic quantum wires, Nat. Phys. 7, 971 (2011). doi: 10.1038/nphys2106
  * [32] C-E Bardyn, M. A. Baranov, C. V. Kraus, E Rico, A. İmamoğlu, P. Zoller, and S. Diehl, Topology by dissipation, New. J. Phys. 15, 085001 (2013). doi: 10.1088/1367-2630/15/8/085001
  * [33] G. Lindblad, On the generators of quantum dynamical semigroups, Commu. Math. Phys. 48, 119 (1976).doi: 10.1007/BF01608499
  * [34] V. Gorini, A. Kossalowski, E. C. G. Sudarshan, E. Rico, A. İmamoğlu, P. Zoller, and S. Diehl, Completely positive dynamical semigroups of N-level systems, J. Math. Phys. (N.Y.) 17, 821 (1976). doi: 10.1063/1.522979
  * [35] M. Wolf, and J. I. Cirac, Dividing Quantum Channels, Commu. Math. Phys. 279, 147 (2008). doi: 10.1007/s00220-008-0411-y
  * [36] H. -P. Breuer, and F. Petruccione, The theory of Open Quantum Systems, Oxford University Press, Oxford, 2007.
  * [37] Siew-Ann Cheong and C. L. Henley, Many-body density matrices for free fermions, Phys. Rev. B 69, 075111 (2004). doi:  10.1103/PhysRevB.69.075111
  * [38] Tomaž Prosen, Third quantization: a general method to solve master equations for quadratic open Fermi systems, New. J. of Phys. 10, 043026 (2008). doi: 10.1088/1367-2630/10/4/043026
  * [39] Tomaž Prosen, Spectral theorem for the Lindblad equation for quadratic open fermionic systems, J. Stat. Mech. 07, 07020 (2010). doi: 10.1088/1742-5468/2010/07/P07020
  * [40] B. Kraus, H. P. Büchler, S. Diehl, A. Kantian, A. Micheli, and P. Zoller, Preparation of entangled states by quantum Markov processes, Phys. Rev. A 78, 042307 (2008). doi: 10.1103/PhysRevA.78.042307
  * [41] Ken Shiozaki and Masatoshi Sato, Topology of crystalline insulators and superconductors, Phys. Rev. B 90, 165114 (2014).doi: 10.1103/PhysRevB.90.165114
  * [42] A. Mostafazadeh, Pseudo-Hermiticity versus PT symmetry: The necessary condition for the reality of the spectrum of a non-Hermitian Hamiltonian, J. Math. Phys. 43, 205 (2002);doi: 10.1063/1.1418246 A. Mostafazadeh, Pseudo-Hermiticity versus PT symmetry II: The necessary condition for the reality of the spectrum of a non-Hermitian Hamiltonian, J. Math. Phys. 43, 2814 (2002);doi: 10.1063/1.1461427 A. Mostafazadeh, Pseudo-Hermiticity versus PT symmetry III: The necessary condition for the reality of the spectrum of a non-Hermitian Hamiltonian, J. Math. Phys. 43, 3944 (2002);doi: 10.1063/1.14890727
  * [43] A. Mostafazadeh, Exact PT-symmetry is equivalent to Hermiticity, J. Phys. A: Math. Gen. 36, 7081 (2003).doi: 10.1088/0305-4470/36/25/312
  * [44] János K. Asbóth, László Oroszlány, and András Pályi, A Short Course on Topological Insulators, Springer Press, Switzerland, 2016.
  * [45] B. Andrei Bernevig, Taylor L. Hughes, and András Pályi, Topological Insulators and topological superconductors, Princeton University Press, Princeton and Oxford, 2013.