# Adversarial for Good? How the Adversarial ML Community’s Values Impede
Socially Beneficial Uses of Attacks

Kendra Albert  Maggie Delano  Bogdan Kulynych  Ram Shankar Siva Kumar

###### Abstract

Attacks from adversarial machine learning (ML) have the potential to be used
“for good”: they can be used to run counter to the existing power structures
within ML, creating breathing space for those who would otherwise be the
targets of surveillance and control. But most research on adversarial ML has
not engaged in developing tools for resistance against ML systems. Why? In
this paper, we review the broader impact statements that adversarial ML
researchers wrote as part of their NeurIPS 2020 papers and assess the
assumptions that authors have about the goals of their work. We also collect
information about how authors view their work’s impact more generally. We find
that most adversarial ML researchers at NeurIPS hold two fundamental
assumptions that will make it difficult for them to consider socially
beneficial uses of attacks: (1) it is desirable to make systems robust,
independent of context, and (2) attackers of systems are normatively bad and
defenders of systems are normatively good. That is, despite their expressed
and supposed neutrality, most adversarial ML researchers believe that the goal
of their work is to secure systems, making it difficult to conceptualize and
build tools for disrupting the status quo.

Machine Learning, ICML

##  1 Introduction

Adversarial machine learning (ML) is a subfield of ML that studies
_adversarially_ -mounted _attacks_ against ML-based systems. The most common
research subject in the field is improving _adversarial robustness_ : studying
and finding ways to protect ML models against these attacks and adversaries.
If we take a step back, however, we can see that protecting ML is not a goal
that is universally desirable and agreed-upon. Ubiquitous applications of
predictive algorithms such as ML, e.g., in credit monitoring (Citron &
Pasquale, 2014), facial recognition (Buolamwini & Gebru, 2018), and hiring
(Sánchez-Monedero et al., 2019) regularly cause harm and offence in the real
world, and consequentially meet resistance in various forms: policy decisions
and legal frameworks (European Commission, 2020), activism (Belfield, 2020),
and even artistic interventions (Doringer & Felderer, 2018).

Besides these forms, harmful technological systems can also be resisted by
leveraging technological tools in a subversive way. For instance, within the
security and privacy community, there have been numerous technological
proposals for protecting against privacy-invasive ML systems and their
supporting infrastructures (Brunton & Nissenbaum, 2015), including systems for
protecting people’s privacy against facial recognition (Shan et al., 2020;
Chandrasekaran et al., 2020), voice recognition (Chandrasekaran et al., 2019),
and mechanisms for releasing information while preventing inferences about
private attributes (Jia & Gong, 2020, 2019). Outside of privacy protection,
there are proposed systems for externally rectifying unfair outcomes, and for
influencing harmful ML systems from the outside in the absence of other
leverage (Kulynych et al., 2020; Vincent et al., 2021; Delobelle et al.,
2021).

Most of the proposals above make use of techniques from adversarial ML such as
adversarial examples and poisoning attacks. In fact, adversarial ML offers a
natural toolbox for protesting, contesting, and reconfiguring outcomes of ML
systems from the outside (Kulynych et al., 2020; Albert et al., 2020b; Das,
2020). Why despite this significant body of work is it so rare that mainstream
adversarial ML researchers see the ML model itself as an adversary? Why is it
that research on these non-trivial applications of adversarial ML comes almost
exclusively from outside of the core adversarial ML community? We argue that
the fundamental values of the adversarial ML community has limited its vision
with regards to the beneficial potential of these technologies.

In philosophy and sociology of science, it is widely agreed that culture,
experiences, and — crucially — _values_ of an academic community have a
significant impact on which research problems are considered, and which ones
are not (Latour, 1993; Haraway, 1988; Kuhn, 1970). Clearly, some of these
values, called _epistemic_ (Carrier, 2013), are related to knowledge and its
production, e.g., a community can value accuracy, mathematical elegance, or
novelty. Epistemic values, however, are not the only ones that shape research.
Even though the scientific process is commonly seen as a neutral “gaze from
nowhere” (Haraway, 1988), other values, called _non-epistemic_ , also have an
impact. The non-epistemic values are often not explicitly stated, but include
underlying social, moral, or political values, e.g., a community can value
applicability to human needs (Longino, 1995).

Can we assess the values of the adversarial ML community? The fact that the
community does not engage with a variety of high-profile targets to build
attacks “for good” must be of moral, social, and political nature, thus due to
non-epistemic values. Luckily for us, the NeurIPS conference, following
existing practices by e.g. the US National Science Foundation, has introduced
the requirement for inclusion of broader impact statements in all submissions
in 2020:

_“In order to provide a balanced perspective, authors are required to include
a statement of the potential broader impact of their work, including its
ethical aspects and future societal consequences. Authors should take care to
discuss both positive and negative outcomes.”_ (NeurIPS, 2020a)

The stated ethical and societal impacts of a given work are likely to reflect
some of the moral and social values held by the authors. This presents us with
an opportunity to get a glimpse of the community’s values through the lens of
the broader impact (BI) statements. In this paper, we delve into the BI
statements in adversarial ML papers at NeurIPS 2020 to see how the authors
view the impacts of their work, gain understanding of what values the
community holds, and whether these values are compatible with the direction
and the promise of “Adversarial for Good.”

##  2 Methodology

In this section, we outline our methodology for selecting papers on
adversarial ML at the NeurIPS 2020 conference, and our content analysis
protocol.

### Relevance

The object of our study were NeurIPS 2020 papers that discuss security-
relevant adversarial settings in which the adversary’s goal is to interfere
with the functionality of ML models. The in-scope topics are adversarial
examples, poisoning attacks, model stealing, as well as defences against
these. The out-of-scope topics were the “adversarial” optimization techniques
involving multiple competing objectives, as in generative adversarial networks
(GANs), and works on distributional robustness that do not evaluate or discuss
adversarial robustness. Additionally, we deemed attacks against privacy of the
training data such as membership inference (Shokri et al., 2017) as out of
scope.

### Selection

To obtain information about the papers, we retrieved the data from the NeurIPS
2020 website containing details about all 1918 accepted papers (NeurIPS,
2020b). We used a two-stage process to select the relevant ones. First, we
automatically filtered the papers by occurrence of the following non-case-
sensitive character sequences in their titles: “adversar” (to capture
“adversary” or “adversarial”), “robust” (to capture “robust” and
“robustness”), “poison”, “steal”, “attack”; and excluded occurrences of the
sequence “generative adversarial.” This stage yielded 154 papers. We further
manually inspected each of the initially filtered papers to ensure they fit
our relevance criterion. Our final tally resulted in a total of 91 papers with
a breakdown of 16 _spotlight_ papers (a special distinction at NeurIPS,
reflecting high scores at the review stage) and 75 non-spotlight papers.

### Coding

Having selected the relevant subset of papers, our goal was to better
understand what the authors consider the impact of their work to be, and shed
the light on their values. For this, we followed a standard protocol for
qualitative data analysis known as inductive coding (Berelson, 1952): a set of
_coders_ manually assigned _codes_ , i.e., labels of interest, to all the
papers. Here, the set of coders is all the authors of the present manuscript.
To come up with the codes initially, all four authors read most of the
spotlight papers and took notes on themes. After this initial review, we
determined that there were three assumptions that seemed to cut across the
spotlights, two of which we used as the main codes.

The first assumption is what we call “robustness as a final value.” The
underlying normative value is that ML systems _should be_ adversarially robust
— as in, resistant to attacks. BI statements consistent with this value often
contain the assumption that adversarial robustness is the end goal of
adversarial ML research, often noting that robustness is a prerequisite to AI-
systems being employed in “high risk” or “safety-critical” applications.

The second assumption we noted as common across the field is the moral
judgement that attackers of systems are bad, and that defenders of systems are
good. This corresponds to robustness as a normative good, but is different
insofar as a paper might acknowledge that not all attacks are bad but still
believe that adversarial robustness is net good.

The third assumption we observed was the idea that technology itself is
neutral, and therefore does not have political properties nor relevant
considerations for BI statements. We ended up not using this assumption for
coding for reasons described shortly.

We also included questions about whether or not a BI statement discusses
negative impacts, limitations of their work, ethical issues with their
research, and/or mentions possible downstream applications. Moreover, we added
questions about the form of the BI statement: whether the statement is only
restating conclusions/future work, and whether it cites other sources.
Finally, we also gathered information about the funding sources.

After the preliminary review of the spotlight papers, we proceeded with a two-
stage coding process as presented in Davis et al. (2014). First, all coders
went back and independently coded the spotlight papers that were initially
used to create the set of values evaluated in the paper. This process helped
us refine the questions and codes. For instance, one of our initial questions
was to quantitatively assess how much of the BI statement was treated as
conclusions or future work. We changed this from a percentage to a Yes/No
question asking if the BI statement was _primarily_ used to discuss
conclusions and future work. We also dropped the question “Does the BI
statement assume technology is neutral?” from our analysis as it was difficult
to reliably assess from reading the BI statement. In the second stage, each of
the non-spotlight papers were randomly assigned to two coders. This way, each
paper was reviewed at least twice.

Once the papers were all coded via the form, we examined those papers that
lacked consensus among the reviewers. For spotlight papers, which were
reviewed by all four authors, if two or more coders disagreed even in one of
the responses, we deemed it a “conflict”; for the non-spotlight papers, which
were reviewed by two coders, there was a conflict if either of the coders
disagreed in their responses. We resolved conflicts by discussing the paper
with other coders, debating the answers we initially chose until we came to
consensus.

##  3 Findings

Of the 91 papers reviewed, 88 papers had BI statements. The 3 papers without
BI statements included a comment that their paper was theoretical and/or did
not have any foreseeable societal consequences. However, even on papers
without a broader impacts statement, meta-reviewers discussed the positive
impacts that these works might have on the field, which contradicts the idea
that these works are theoretical and have no societal consequences unless one
assumes that the field is divorced from society.

Table 1: Summary of findings from the qualitative coding NeurIPS 2020
Adversarial ML papers. The full text of the questions is included in the
Appendix.

Question | Yes | No | N/A | Total
---|---|---|---|---
Paper has BI statement? | 88 | 3 | 0 | 91
BI statement primar. restates conclusions? | 58 | 30 | 0 | 88
Security as neg impact in BI? | 23 | 65 | 0 | 88
Societal harms as neg impact in BI? | 13 | 75 | 0 | 88
Environ. harms as neg impact in BI? | 5 | 83 | 0 | 88
Broad harms of field as neg impact in BI? | 13 | 75 | 0 | 88
No neg. impact in BI | 43 | 45 | 0 | 88
Limitations of paper in BI? | 22 | 66 | 0 | 88
Applications of their work in BI? | 36 | 52 | 0 | 88
Cite other work in BI? | 28 | 60 | 0 | 88
Ethics of conducting their research in BI? | 5 | 83 | 0 | 88
“Robustness as Final Value” assump. in BI? | 62 | 11 | 15 | 88
“Attack Bad, Defend Good” assump. in BI? | 38 | 8 | 42 | 88
Paper funded by Military? | 32 | 59 | 0 | 91
Paper funded by Govt. (non-Mil.)? | 60 | 31 | 0 | 91
Paper funded by Industry? | 28 | 63 | 0 | 91
Paper funded by Academic Fellowship? | 7 | 84 | 0 | 91
Paper funded by Non-profit/Other? | 9 | 82 | 0 | 91
Paper received no external funding? | 2 | 89 | 0 | 91
Paper funding not specified? | 8 | 83 | 0 | 91

### Perceived Broader Impact

The 88 papers that included a BI statement ranged in their level of engagement
with broader impacts. In particular, only one-third of the papers (30/88) went
beyond restating future work and conclusions from the paper itself. About half
of the papers (45/88) discussed negative societal impacts, the most common of
which was security concerns (23 papers). The most common security concern was
the potential for published attacks to be used by “adversaries” in ways that
would result in negative social outcomes. A total of 13 papers cited non-
security related societal impacts in particular, and 13 papers referenced the
impacts of the “broader field” (for example, by referencing the field of
computer vision broadly). Five papers discussed environmental impacts due to
computation. A total of 22 papers discuss potential limitations of their
present work in the BI statement. Less than half the papers (36/88) discuss a
specific example of how their work might be used in the future. Those that did
primarily discussed the potential of adversarial robustness to make ML safe
for autonomous vehicles and healthcare settings. About a quarter of the total
papers cited other work (28/88 papers). This suggests that authors may not be
citing the papers that influence their thinking, or may not be engaging with
literature as part of writing BI statements.

Surprisingly, given the broader context of BI statements being part of an
evaluation of ethical practices within the field, only five papers out of 88
papers explicitly considered the ethics of conducting the research itself.
Most adversarial machine learning papers require extensive computing resources
(Luccioni et al., 2020), and some may include human subjects testing or be
done in other settings where there are direct ethical concerns about the
research (Albert et al., 2020a).

### Values

In the BI statements that we reviewed, most authors do not consider (or at
least do not mention) that robustness may not be normatively desirable if an
ML system is being used for anti-democratic or unethical purposes, nor do they
weigh the pluses and minuses of limiting the possibility of circumvention of
such systems. Over 70% of papers (62/88) had robustness as a final value. Only
11/88 of the papers did not have robustness as a final value, with the
remaining 15 papers listed as not applicable as it could not be assessed one
way or another. The papers that did not hold robustness as a final value often
noted that whether robustness was normatively desirable depended on the
context in which the system was employed. For example:

_“This uncertainty is symptomatic of the fact that machine learning is often
fundamental by nature and that there is no machine learning technique for
improving robustness that can be applied only to positive-impact applications,
whatever one’s subjective interpretation of ‘positive’ may be.”_ (Yang et al.,
2020).

The assumption that attackers were “bad” was borne out in a number of ways:
for example, the use of language like “malicious” or “malevolent” was often
used to describe users of attacks, or attacks were described as aligned with
“negative goals” (Elinas et al., 2020). A little less than half of coded
papers explicitly cited attackers as bad and defenders as good (38/88), but
many did not comment one way or the other, for a total of 42 not applicable.
Only 8 of papers that expressed an opinion rejected the idea that attackers
are bad and defenders are good.

Although we did not end up using our study results from the question as to
whether technology is neutral, it is worth mentioning that many papers adopted
an agnostic view as to the pluses and minuses of the technologies produced.
The Yang et al. quote above, for example, while rejecting robustness as a
normative good, makes this neutrality assumption. Although machine learning
may be fundamental, that does not mean that it is “neutral”: as any
technology, it can have a tendency to benefit some actors at the expense of
others (Winner, 1980). For instance, speeding up the processing of large
datasets and making predictions from them fundamentally benefits those with
access to more data (Dotan & Milli, 2019; Albert et al., 2020b).

### Funding

Two thirds of the papers received government funding (60/91), a little over
one third of the papers received military funding (32/91), and about one third
of the papers were funded by industry (28/91) (papers can and often were
funded by more than one source). Additional funding sources included academic
fellowships (7 papers) and non-profits (9 papers). Eight papers had no funding
specified. Two papers explicitly listing that no third party funding was
obtained. These results suggest that government and military funding drive
many significant advances in this field. Although it would be overly
simplistic to say, for example, that military funding directly results in
technologies that can be applied offensively, funding of research can drive
values and priorities, and researchers generally did not discuss how the
funding of their work might affect its broader impacts.

##  4 Conclusions

If broader impact statements are an accurate statement of values, most
adversarial ML researchers publishing at NeurIPS 2020 believe that building
more robust, reliable machine learning systems is the goal of the field, and
that increased security of ML systems is a positive impact, independently of
context. This is concerning because progress in ML is heavily laden with
socio-political and environmental values. These values are manifested in and
caused by the reliance and strong compatibility of ML theory and methods with
“compute-rich and data-rich environments” (Dotan & Milli, 2019). Albert et al.
(2020b) and Alkhatib (2021) argue that one of the declared purposes of ML
systems is to leverage data collected about a deployment environment, often by
outsiders, to better understand that environment. Making environments
“legible”, or more easily understood, means that those environments are more
susceptible to influence by centralized power structures such as governments,
who often have disproportionate access to the data and computational resources
needed for deployment of ML systems. This is concerning not only because it
can increase the power of state actors, but also because these models can give
a false sense of confidence in an understanding of the environment in which
they are deployed (Scott, 1998). Our findings suggest that adversarial ML
shares these underlying values with the core field of ML, rather than being
adverse to it. This creates a significant challenge for efforts to use
adversarial ML attacks “for good”, because the hidden values of the field may
keep researchers from even realizing that the production of useful subversive
technologies is something that adversarial ML is uniquely well-suited to
tackle.

Although we primarily discussed attacks in adversarial ML as a means to
disrupt the operation of harmful systems or reconfiguring their outcomes,
these are not the only beneficial applications of attacks. For example, Albert
et al. (2020b) argue that techniques from adversarial ML can provide us with
tools for testing for: model bias, inclusion of training data without consent,
and predatory inclusion, i.e., creation and use of algorithms that nominally
support marginalized groups but actually exploit them (Taylor, 2019). In order
to produce efficient tools aligned with any of these goals, however,
researchers in adversarial ML need to fundamentally reframe the goals of the
field. This requires understanding machine learning as neither a neutral
technology nor a straight-forwardly positive one, but rather one that is
uniquely compatible with centralized power, and as such, will require concrete
efforts to resist.

## Acknowledgements

The authors would like to thank Maksym Andriushchenko for helpful feedback on
the initial version of this paper. They would also like to thank Apryl
Williams for assistance with the methodology.

## References

  * Albert et al. (2020a) Albert, K., Delano, M., Penney, J., Rigot, A., and Kumar, R. S. S.  Ethical Testing in the Real World: Evaluating Physical Testing of Adversarial Machine Learning.  _arXiv:2012.02048 [cs]_ , December 2020a.
  * Albert et al. (2020b) Albert, K., Penney, J., Schneier, B., and Kumar, R. S. S.  Politics of Adversarial Machine Learning.  _arXiv:2002.05648 [cs, stat]_ , April 2020b.
  * Alkhatib (2021) Alkhatib, A.  To Live in Their Utopia: Why Algorithmic Systems Create Absurd Outcomes.  In _Proceedings of the 2021 CHI Conference on Human Factors in Computing Systems_ , pp. 1–9, Yokohama Japan, May 2021. ACM.  ISBN 978-1-4503-8096-6.  doi: 10.1145/3411764.3445740.
  * Belfield (2020) Belfield, H.  Activism by the AI Community: Analysing Recent Achievements and Future Prospects.  In _Proceedings of the AAAI/ACM Conference on AI, Ethics, and Society_ , AIES ’20, pp. 15–21, New York, NY, USA, February 2020. Association for Computing Machinery.  ISBN 978-1-4503-7110-0.  doi: 10.1145/3375627.3375814.
  * Berelson (1952) Berelson, B.  _Content Analysis in Communication Research._ Free Press, 1952.
  * Brunton & Nissenbaum (2015) Brunton, F. and Nissenbaum, H. F.  _Obfuscation: A User’s Guide for Privacy and Protest_.  MIT Press, Cambridge, Massachusetts, 2015.  ISBN 978-0-262-02973-5.
  * Buolamwini & Gebru (2018) Buolamwini, J. and Gebru, T.  Gender Shades: Intersectional Accuracy Disparities in Commercial Gender Classiﬁcation.  pp. 15, 2018.
  * Carrier (2013) Carrier, M.  Values and Objectivity in Science: Value-Ladenness, Pluralism and the Epistemic Attitude.  _Science & Education_, 22(10):2547–2568, October 2013.  ISSN 1573-1901.  doi: 10.1007/s11191-012-9481-5.
  * Chandrasekaran et al. (2019) Chandrasekaran, V., Linden, T., Fawaz, K., Mutlu, B., and Banerjee, S.  BlackOut and Obfuscator: An Exploration of the Design Space for Privacy-Preserving Interventions for Voice Assistants.  _arXiv:1812.00263 [cs]_ , November 2019.
  * Chandrasekaran et al. (2020) Chandrasekaran, V., Gao, C., Tang, B., Fawaz, K., Jha, S., and Banerjee, S.  Face-Off: Adversarial Face Obfuscation.  _arXiv:2003.08861 [cs]_ , December 2020.
  * Citron & Pasquale (2014) Citron, D. K. and Pasquale, F.  The Scored Society: Due Process for Automated Predictions.  _Washington Law Review_ , 89:1, 2014.  URL https://heinonline.org/HOL/Page?handle=hein.journals/washlr89&id=8&div=&collection=.
  * Das (2020) Das, S.  Subversive AI: Resisting automated algorithmic surveillance with human-centered adversarial machine learning.  _Resistance AI Workshop at NeurIPS 2020_ , pp. 4, 2020.
  * Davis et al. (2014) Davis, C., Powell, H., and Lachlan, K.  _Straight Talk about Communication Research Methods_.  Kendall Hunt Publishing, second edition, 2014.
  * Delobelle et al. (2021) Delobelle, P., Temple, P., Perrouin, G., Frenay, B., Heymans, P., and Berendt, B.  A Take on Obfuscation with Ethical Adversaries.  pp. 4, 2021.
  * Doringer & Felderer (2018) Doringer, B. and Felderer, B.  _Faceless: Re-Inventing Privacy through Subversive Media Strategies_.  De Gruyter, 2018.
  * Dotan & Milli (2019) Dotan, R. and Milli, S.  Value-laden Disciplinary Shifts in Machine Learning.  _arXiv:1912.01172 [cs, stat]_ , December 2019.
  * Elinas et al. (2020) Elinas, P., Bonilla, E. V., and Tiao, L. C.  Variational Inference for Graph Convolutional Networks in the Absence of Graph Data and Adversarial Settings.  _NeurIPS_ , 2020.
  * European Commission (2020) European Commission.  White paper on artificial intelligence: A european approach to excellence and trust, 2020.
  * Haraway (1988) Haraway, D.  Situated Knowledges: The Science Question in Feminism and The Privilege of Partial Perspective.  _Feminist Studies_ , 14(3):579–599, 1988.
  * Jia & Gong (2019) Jia, J. and Gong, N. Z.  Defending against Machine Learning based Inference Attacks via Adversarial Examples: Opportunities and Challenges.  _arXiv:1909.08526 [cs, stat]_ , September 2019.
  * Jia & Gong (2020) Jia, J. and Gong, N. Z.  AttriGuard: A Practical Defense Against Attribute Inference Attacks via Adversarial Machine Learning.  _arXiv:1805.04810 [cs, stat]_ , April 2020.
  * Kuhn (1970) Kuhn, T. S.  _The Structure of Scientific Revolutions_.  International Encyclopedia of Unified Science. Foundations of the Unity of Science. University of Chicago Press, Chicago, second edition, 1970\.  ISBN 978-0-226-45803-8.
  * Kulynych et al. (2020) Kulynych, B., Overdorf, R., Troncoso, C., and Gürses, S.  POTs: Protective Optimization Technologies.  _Proceedings of the 2020 Conference on Fairness, Accountability, and Transparency_ , pp. 177–188, January 2020.  doi: 10.1145/3351095.3372853.
  * Latour (1993) Latour, B.  _We Have Never Been Modern_.  Harvard University Press, Cambridge, Mass, 1993.  ISBN 978-0-674-94838-9 978-0-674-94839-6.
  * Longino (1995) Longino, H. E.  Gender, Politics, and the Theoretical Virtues.  _Synthese_ , 104(3):383–397, 1995.  ISSN 0039-7857.
  * Luccioni et al. (2020) Luccioni, A., Lacoste, A., and Schmidt, V.  Estimating Carbon Emissions of Artificial Intelligence [Opinion].  _IEEE Technology and Society Magazine_ , 39(2):48–51, June 2020.  ISSN 1937-416X.  doi: 10.1109/MTS.2020.2991496.
  * NeurIPS (2020a) NeurIPS.  Call for Papers.  https://neurips.cc/Conferences/2020/CallForPapers, 2020a.
  * NeurIPS (2020b) NeurIPS.  All Papers (JSON Format).  https://neurips.cc/virtual/2020/protected/papers.json, 2020b.
  * Scott (1998) Scott, J. C.  _Seeing like a State: How Certain Schemes to Improve the Human Condition Have Failed_.  Yale Agrarian Studies. Yale University Press, New Haven, 1998.  ISBN 978-0-300-07016-3.
  * Shan et al. (2020) Shan, S., Wenger, E., Zhang, J., Li, H., Zheng, H., and Zhao, B. Y.  Fawkes: Protecting Privacy against Unauthorized Deep Learning Models.  _arXiv:2002.08327 [cs, stat]_ , June 2020.
  * Shokri et al. (2017) Shokri, R., Stronati, M., Song, C., and Shmatikov, V.  Membership inference attacks against machine learning models.  In _2017 IEEE Symposium on Security and Privacy (SP)_ , pp. 3–18. IEEE, 2017.
  * Sánchez-Monedero et al. (2019) Sánchez-Monedero, J., Dencik, L., and Edwards, L.  What Does It Mean to ‘Solve’ the Problem of Discrimination in Hiring?  SSRN Scholarly Paper ID 3463141, Social Science Research Network, Rochester, NY, October 2019.  URL https://papers.ssrn.com/abstract=3463141.
  * Taylor (2019) Taylor, K.-Y.  _Race for Profit: How Banks and the Real Estate Industry Undermined Black Homeownership_.  UNC Press Books, 2019.
  * Vincent et al. (2021) Vincent, N., Li, H., Tilly, N., Chancellor, S., and Hecht, B.  Data Leverage: A Framework for Empowering the Public in its Relationship with Technology Companies.  In _Proceedings of the 2021 ACM Conference on Fairness, Accountability, and Transparency_ , pp. 215–227, Virtual Event Canada, March 2021. ACM.  ISBN 978-1-4503-8309-7.  doi: 10.1145/3442188.3445885.
  * Winner (1980) Winner, L.  Do Artifacts Have Politics?  _Daedalus_ , pp. 17, 1980.
  * Yang et al. (2020) Yang, H., Zhang, J., Dong, H., Inkawhich, N., Gardner, A., Touchet, A., Wilkes, W., Berry, H., and Li, H.  DVERGE: Diversifying Vulnerabilities for Enhanced Robust Generation of Ensembles.  _NeurIPS_ , 2020.

##  Appendix A Appendix

For the full list of 91 papers that were coded, see the next page.

Papers were manually coded by the authors using Google Forms. We asked the
following questions:

  * •

Does the paper have a BI statement?

  * •

Does the BI statement focus primarily on future work or restate conclusions?

  * •

Does the BI statement discuss any negative societal impacts?

  * •

Does the BI statement discuss limitations of the present research?

  * •

Does the BI statement provide specific examples of uses?

  * •

Does the BI statement cite out to other work?

  * •

Did the BI statement discuss any ethical concerns about conducting the
research?

  * •

Does the BI statement have “robustness as a final value” as an assumption?

  * •

Does the BI statement have “attackers are bad and defenders are good” as an
assumption?

  * •

Does the BI statement assume technology is neutral?

  * •

Funding source for the paper

Table 2: List of all the NeurIPS 2020 papers included in the coding analysis. NeurIPS Paper ID | Paper Title | Authors
---|---|---
17743 | Most ReLU Networks Suffer from $\ell^{2}$ Advers… | Amit Daniely et al.
18384 | Certified Robustness of Graph Convolution Netw… | Hongwei Jin et al.
17118 | Measuring Robustness to Natural Distribution S… | Rohan Taori et al.
17260 | Simultaneously Learning Stochastic and Adversa… | Tiancheng Jin et al.
17984 | Large-Scale Adversarial Training for Vision-an… | Zhe Gan et al.
18876 | Guided Adversarial Attack for Evaluating and E… | Gaurang Sriramanan et al.
18985 | A Single Recipe for Online Submodular Maximiza… | Omid Sadeghi et al.
18377 | Variational Inference for Graph Convolutional … | Pantelis Elinas et al.
17327 | Simulating a Primary Visual Cortex at the Fron… | Joel Dapello et al.
17264 | Adversarially Robust Streaming Algorithms via … | Avinatan Hasidim et al.
18492 | Do Adversarially Robust ImageNet Models Transf… | Hadi Salman et al.
19053 | Robust Sub-Gaussian Principal Component Analys… | Arun Jambulapati et al.
16857 | DVERGE: Diversifying Vulnerabilities for Enhan… | Huanrui Yang et al.
17097 | Adversarial Training is a Form of Data-depende… | Kevin Roth et al.
19009 | Beyond Perturbations: Learning Guarantees with… | Shafi Goldwasser et al.
18912 | Robust Deep Reinforcement Learning against Adv… | Huan Zhang et al.
18059 | A Causal View on Robustness of Neural Networks | Cheng Zhang et al.
17941 | Hyperparameter Ensembles for Robustness and Un… | Florian Wenzel et al.
18518 | (De)Randomized Smoothing for Certifiable Defen… | Alexander Levine et al.
17078 | Adversarial Self-Supervised Contrastive Learning | Minseon Kim et al.
18221 | Input-Aware Dynamic Backdoor Attack | Tuan Anh Nguyen et al.
18102 | Adversarial Blocking Bandits | Nicholas Bishop et al.
17781 | Adversarial Distributional Training for Robust… | Yinpeng Dong et al.
18567 | Understanding and Improving Fast Adversarial T… | Maksym Andriushchenko et al.
17027 | Adversarial Bandits with Corruptions: Regret L… | lin yang et al.
18380 | Attack of the Tails: Yes, You Really Can Backd… | Hongyi Wang et al.
17462 | On the Tightness of Semidefinite Relaxations f… | Richard Zhang
17742 | Adversarial Learning for Robust Deep Clustering | Xu Yang et al.
17187 | A Closer Look at Accuracy vs. Robustness | Yao-Yuan Yang et al.
18467 | Adversarial Counterfactual Learning and Evalua… | Da Xu et al.
17905 | Non-Convex SGD Learns Halfspaces with Adversar… | Ilias Diakonikolas et al.
18095 | Optimal Robustness-Consistency Trade-offs for … | Alexander Wei et al.
17064 | Adversarial Weight Perturbation Helps Robust G… | Dongxian Wu et al.
18244 | Robust Pre-Training by Adversarial Contrastive… | Ziyu Jiang et al.
17517 | Provably Robust Metric Learning | Lu Wang et al.
18758 | Iterative Deep Graph Learning for Graph Neural… | Yu Chen et al.
18237 | Biologically Inspired Mechanisms for Adversari… | Manish Reddy Vuyyuru et al.
19079 | Lipschitz Bounds and Provably Robust Training … | Vishaal Krishnan et al.
18867 | Automatic Perturbation Analysis for Scalable C… | Kaidi Xu et al.
17515 | Election Coding for Distributed Learning: Prot… | Jy-yong Sohn et al.
16807 | Maximum-Entropy Adversarial Data Augmentation … | Long Zhao et al.
18266 | Practical No-box Adversarial Attacks against DNNs | Qizhang Li et al.
16872 | Adversarially Robust Few-Shot Learning: A Meta… | Micah Goldblum et al.
17522 | GNNGuard: Defending Graph Neural Networks agai… | Xiang Zhang et al.
16975 | Fast Adversarial Robustness Certification of N… | Sascha Saralajew et al.
17076 | Learning Black-Box Attackers with Transferable… | Jiancheng YANG et al.
17122 | On the Stability and Convergence of Robust Adv… | Kaiqing Zhang et al.
19008 | Adversarial Attacks on Deep Graph Matching | Zijie Zhang et al.
17291 | Contrastive Learning with Adversarial Examples | Chih-Hui Ho et al.
17947 | Adversarial Crowdsourcing Through Robust Rank-… | Qianqian Ma et al.
17567 | Diversity can be Transferred: Output Diversifi… | Yusuke Tashiro et al.
18094 | Robust and Heavy-Tailed Mean Estimation Made S… | Sam Hopkins et al.
NeurIPS Paper ID | Paper Title | Authors
---|---|---
17791 | On 1/n neural representation and robustness | Josue Nassar et al.
18662 | HYDRA: Pruning Adversarially Robust Neural Net… | Vikash Sehwag et al.
18763 | The Complexity of Adversarially Robust Proper … | Ilias Diakonikolas et al.
18173 | Adversarial robustness via robust low rank rep… | Pranjal Awasthi et al.
18058 | Targeted Adversarial Perturbations for Monocul… | Alex Wong et al.
18208 | AdvFlow: Inconspicuous Black-box Adversarial A… | Hadi Mohaghegh Dolatabadi et al.
16955 | Once-for-All Adversarial Training: In-Situ Tra… | Haotao Wang et al.
18049 | Adversarial Example Games | Joey Bose et al.
17792 | Boosting Adversarial Training with Hypersphere… | Tianyu Pang et al.
18205 | A Game Theoretic Analysis of Additive Adversar… | Ambar Pal et al.
18005 | On the Loss Landscape of Adversarial Training:… | Chen Liu et al.
18143 | Smoothed Geometry for Robust Attribution | Zifan Wang et al.
18299 | On Adaptive Attacks to Adversarial Example Def… | Florian Tramer et al.
17851 | The Statistical Cost of Robust Kernel Hyperpar… | Raphael Meyer et al.
17285 | Trade-offs and Guarantees of Adversarial Repre… | Han Zhao et al.
17175 | Adversarial Attacks on Linear Contextual Bandits | Evrard Garcelon et al.
17026 | Robust large-margin learning in hyperbolic space | Melanie Weber et al.
18174 | Dual Manifold Adversarial Robustness: Defense … | Wei-An Lin et al.
18269 | Consistency Regularization for Certified Robus… | Jongheon Jeong et al.
16974 | Backpropagating Linearly Improves Transferabil… | Yiwen Guo et al.
17212 | GreedyFool: Distortion-Aware Sparse Adversaria… | Xiaoyi Dong et al.
17206 | An Efficient Adversarial Attack for Tree Ensem… | Chong Zhang et al.
17181 | Robustness of Bayesian Neural Networks to Grad… | Ginevra Carbone et al.
17871 | Online Robust Regression via SGD on the l1 loss | Scott Pesme et al.
17769 | Adversarial Robustness of Supervised Sparse Co… | Jeremias Sulam et al.
17145 | BERT Loses Patience: Fast and Robust Inference… | Wangchunshu Zhou et al.
18393 | A General Method for Robust Learning from Batches | Ayush Jain et al.
18800 | Over-parameterized Adversarial Training: An An… | Yi Zhang et al.
17964 | Reducing Adversarially Robust Learning to Non-… | Omar Montasser et al.
18072 | Robust Federated Learning: The Case of Affine … | Amirhossein Reisizadeh et al.
18740 | Reliable Graph Neural Networks via Robust Aggr… | Simon Geisler et al.
16819 | Towards More Practical Adversarial Attacks on … | Jiaqi Ma et al.
18236 | Boundary thickness and robustness in learning … | Yaoqing Yang et al.
17897 | Distributionally Robust Local Non-parametric C… | Viet Anh Nguyen et al.
16965 | On the Trade-off between Adversarial and Backd… | Cheng-Hsin Weng et al.
18190 | MetaPoison: Practical General-purpose Clean-la… | W. Ronny Huang et al.
18869 | Certifiably Adversarially Robust Detection of … | Julian Bitterwolf et al.
18413 | Adversarially-learned Inference via an Ensembl… | Adarsh K Jeewajee et al.
18283 | Perturbing Across the Feature Hierarchy to Imp… | Nathan Inkawhich et al.


# Two new examples of Banach spaces with a plastic unit ball

Rainis Haller  Institute of Mathematics and Statistics, University of Tartu,
Narva mnt 18, 51009 Tartu, Estonia<EMAIL_ADDRESS>,  Nikita Leo
Institute of Mathematics and Statistics, University of Tartu, Narva mnt 18,
51009 Tartu, Estonia<EMAIL_ADDRESS>and  Olesia Zavarzina  Department of
Mathematics and Informatics, V. N. Karazin Kharkiv National University, 61022
Kharkiv, Ukraine<EMAIL_ADDRESS>
###### Abstract.

We prove that Banach spaces $\ell_{1}\oplus_{2}\mathbb{R}$ and
$X\oplus_{\infty}Y$, with strictly convex $X$ and $Y$, have plastic unit balls
(we call a metric space plastic if every non-expansive bijection from this
space onto itself is an isometry).

##  1\. Introduction

A function between two metric spaces is called an _isometry_ if it preserves
distances between points, and _non-expansive_ if it does not increase
distances between points. We call a metric space $X$ _plastic_ if every non-
expansive bijection from $X$ onto itself is an isometry. The last notion was
introduced by S. A. Naimpally, Z. Piotrowski, and E. J. Wingler in [8]. It is
known that every totally bounded metric space is plastic, see [3, Satz IV] or
[8, Theorem 1.1]. On the other hand, a plastic metric space need not be
totally bounded nor bounded – e.g., the set of integers with the usual metric
is plastic [8, Theorem 3.1]. There are also examples of bounded metric spaces
that are not plastic, one of our favorite examples here is a solid ellipsoid
in Hilbert space $\ell_{2}(\mathbb{Z})$ with infinitely many semi-axes equal
to $1$ and infinitely many semi-axes equal to $2$, see [1, Example 2.7].

It is a challenging open problem, posed by B. Cascales, V. Kadets, J.
Orihuela, and E. J. Wingler in 2016 [1], whether the unit ball of every Banach
space is a plastic metric space. The unit ball of a finite-dimensional space
is compact, and therefore plastic. So the question is really just about the
infinite-dimensional spaces. So far, the plasticity of the unit ball has
successfully been proved for the following spaces and classes of spaces:

  * •

strictly convex spaces,

  * •

the space $\ell_{1}$,

  * •

$\ell_{1}$-sums of strictly convex spaces,

  * •

spaces whose unit sphere is the union of all its finite-dimensional polyhedral
extreme subsets,

  * •

the space $c$.

The first result was for strictly convex spaces and it was obtained by B.
Cascales, V. Kadets, J. Orihuela, and E. J. Wingler in 2016 [1]. The same
year, V. Kadets and O. Zavarzina proved the plasticity of the unit ball of
$\ell_{1}$ [5]. They generalized this result to $\ell_{1}$-sums of strictly
convex spaces in 2017 [4]. The fourth item was obtained by C. Angosto, V.
Kadets, and O. Zavarzina in 2018 [2, Theorem 4.11]. The plasticity of the unit
ball of $c$ was proved by N. Leo in 2021 [6, Theorem 4.1].

In this paper, we present two new examples of Banach spaces whose unit balls
are plastic: the sum of $\ell_{1}$ and ${\mathbb{R}}$ by $\ell_{2}$, and the
sum of any two strictly convex spaces by $\ell_{\infty}$.

##  2\. Preliminaries

We consider only real Banach paces. For a Banach space $X$, we denote the
closed unit ball and the unit sphere of $X$ by $B_{X}$ and $S_{X}$.

Extreme points turn out to be essential to the study of plasticity of the unit
ball. Recall that for a vector space $X$ and for a convex subset $C$ of $X$, a
point $x\in C$ is called an _extreme point_ of $C$ if it does not belong to
the interior of any non-trivial line segment connecting two distinct points of
$C$. We use $\operatorname{ext}C$ to denote the set of extreme points of a set
$C$. Henceforth, we focus on extreme points of the unit ball. Extreme points
of the unit ball lie on the unit sphere. A space such that all the points of
the unit sphere are extreme is called _strictly convex_. Strictly convex
spaces have a property that, for any two distinct points $x$ and $y$ and any
non-negative scalars $\alpha$ and $\beta$ with $\alpha+\beta=\|x-y\|$, the
point $\frac{\beta}{\|x-y\|}x+\frac{\alpha}{\|x-y\|}y$ is the only point of
the space that is distance $\alpha$ from $x$ and distance $\beta$ from $y$.
This is going to be used in the proof for $\ell_{\infty}$-sum of strictly
convex spaces.

The next proposition describes the behaviour of a non-expansive bijection from
the unit ball of a Banach space onto itself. It provides some of the main
tools for the study of plasticity of the unit ball. The last item is the
reason why are extreme points so important to the topic at hand. This
proposition is going to be used extensively throughout both of the proofs.

######  Proposition 2.1 ([1, Theorem 2.3]).

Let $X$ be a Banach space and let $F\colon B_{X}\to B_{X}$ be a non-expansive
bijection. Then

  1. (1)

$F(0)=0$,

  2. (2)

for each $x\in B_{X}$, $\|F(x)\|\leq\|x\|$,

  3. (3)

if $x\in S_{X}$, then $F^{-1}(x)\in S_{X}$,

  4. (4)

if $x\in\operatorname{ext}B_{X}$, then $F^{-1}(x)\in\operatorname{ext}B_{X}$
and $F^{-1}(\alpha x)=\alpha F^{-1}(x)$ for each $\alpha\in[-1,1]$.

It is also useful to know the following result.

######  Theorem 2.2 ([7, Theorem 2]).

Let $X$ and $Y$ be normed spaces and let $U$ be a subset of $X$ and $V$ be a
subset of $Y$. If $U$ and $V$ are convex with non-empty interior and there
exists an isometric bijection $F\colon U\to V$, then $F$ extends to an affine
isometric bijection $\widetilde{F}\colon X\to Y$.

The theorem implies that if $X$ is a Banach space and $F\colon B_{X}\to B_{X}$
is an isometric bijection, then $F$ extends to an isometric automorphism of
$X$ – a linear isometric bijection from $X$ onto itself. If we want to prove
that every non-expansive bijection on the unit ball of some space $X$ is an
isometry, it might be useful to know what isometric bijections are there. The
last result says that these are precisely the restrictions of the isometric
automorphisms of $X$.

There is also a sufficient condition for a non-expansive bijection $F\colon
B_{X}\to B_{X}$ to be an isometry.

######  Theorem 2.3 ([1, Theorem 2.6]).

Let $X$ be a Banach space and let $F\colon B_{X}\to B_{X}$ be a non-expansive
bijection. If $F(S_{X})=S_{X}$ and $F(\alpha x)=\alpha F(x)$ for every $x\in
S_{X}$ and every $\alpha\in[-1,1]$, then $F$ is an isometry.

The latter will be used to finish the proof for the case of
$\ell_{\infty}$-sum of two strictly convex spaces.

##  3\. The space $\ell_{1}\oplus_{2}\mathbb{R}$

######  Theorem 3.1.

The unit ball of $\ell_{1}\oplus_{2}\mathbb{R}$ is a plastic metric space.

###### Proof.

Denote the space $\ell_{1}\oplus_{2}\mathbb{R}$ by $Z$. Let $e_{k}$ stand for
the $k$-th element of the canonical basis of $\ell_{1}$. Denote by $h$ the
projection of $Z$ onto ${\mathbb{R}}$. For each $b\in[-1,1]$ denote by $L_{b}$
the set $\\{z\in B_{Z}\colon h(z)=b\\}$. Note that

$\operatorname{ext}B_{Z}=\\{(ae_{m},b)\colon a,b\in{\mathbb{R}},\
a^{2}+b^{2}=1,\ m\in{\mathbb{N}}\\}.$

Let $(ae_{i},b)$ and $(ce_{j},d)$ be two arbitrary extreme points. If $i=j$,
then the distance between these two points is $\sqrt{(a-c)^{2}+(b-d)^{2}}$ and
we have

$\displaystyle\sqrt{(a-c)^{2}+(b-d)^{2}}=2$
$\displaystyle\iff(a-c)^{2}+(b-d)^{2}=4$ $\displaystyle\iff
a^{2}-2ac+c^{2}+b^{2}-2bd+d^{2}=4$ $\displaystyle\iff
0=a^{2}+2ac+c^{2}+b^{2}+2bd+d^{2}$ $\displaystyle\iff 0=(a+c)^{2}+(b+d)^{2}$
$\displaystyle\iff a=-c\ \&\ b=-d.$

If $i\neq j$, then the distance between $(ae_{i},b)$ and $(ce_{j},d)$ is
$\sqrt{(|a|+|c|)^{2}+(b-d)^{2}}$ and we have

$\displaystyle\sqrt{(|a|+|c|)^{2}+(b-d)^{2}}=2$
$\displaystyle\iff(|a|+|c|)^{2}+(b-d)^{2}=4$ $\displaystyle\iff
a^{2}+2|a||c|+c^{2}+b^{2}-2bd+d^{2}=4$ $\displaystyle\iff
0=a^{2}-2|a||c|+c^{2}+b^{2}+2bd+d^{2}$ $\displaystyle\iff
0=(|a|-|c|)^{2}+(b+d)^{2}$ $\displaystyle\iff|a|=|c|\ \&\ b=-d.$

That is, the distance between points $(ae_{i},b)$ and $(ce_{j},d)$ is equal to
two if and only if either $i=j$, $a=-c$, and $b=-d$, or $i\neq j$, $|a|=|c|$,
and $b=-d$. In particular, if $u$ and $v$ are extreme points that are distance
two apart, then $h(u)=-h(v)$. This is going to be used in Step 1.

Step 1. Let $F$ be a non-expansive bijection from $B_{Z}$ onto itself. We need
to show that $F$ is an isometry. Let us first show that for each
$m\in{\mathbb{N}}$ we have $F^{-1}(e_{m},0)=(\theta e_{n},0)$, where
$\theta\in\\{-1,1\\}$ and $n\in{\mathbb{N}}$.

Let $m\in{\mathbb{N}}$ be arbitrary. Choose indices $i$ and $j$ such that $m$,
$i$, and $j$ are pairwise distinct. Note that $x=(e_{m},0)$, $y=(e_{i},0)$,
and $z=(e_{j},0)$ are extreme points. Item (4) of Proposition 2.1 implies that
$x^{\prime}=F^{-1}(x)$, $y^{\prime}=F^{-1}(y)$, and $z^{\prime}=F^{-1}(z)$ are
also extreme points. Note that $x$, $y$, and $z$ are distance two apart. The
non-expansiveness of $F$ implies that $x^{\prime}$, $y^{\prime}$, and
$z^{\prime}$ are also distance two apart. Since $x^{\prime}$, $y^{\prime}$,
and $z^{\prime}$ are extreme points that are distance two apart, we have
$h(x^{\prime})=-h(y^{\prime})$, $h(y^{\prime})=-h(z^{\prime})$, and
$h(z^{\prime})=-h(x^{\prime})$, from which it follows that $h(x^{\prime})=0$.
As $x^{\prime}$ is an extreme point, it has the form $(ae_{n},b)$, where
$a,b\in{\mathbb{R}}$, $a^{2}+b^{2}=1$, and $n\in{\mathbb{N}}$. Since
$h(x^{\prime})=0$, we have $b=0$ and $a\in\\{-1,1\\}$, which finishes the
proof. For further reference define $\sigma_{m}=n$, $\theta_{m}=a$, and
$g_{m}=\theta_{m}e_{\sigma(m)}$.

This way we obtain a function $\sigma:{\mathbb{N}}\to{\mathbb{N}}$, which
describes the permutation of indices exerted by $F$. Note that this function
is an injection. Indeed, let $i$ and $j$ be two indices with
$\sigma(i)=\sigma(j)$. Denote by $n$ the common value of $\sigma(i)$ and
$\sigma(j)$. Then $F^{-1}(e_{i},0)=(\theta_{i}e_{n},0)$ and
$F^{-1}(e_{j},0)=(\theta_{j}e_{n},0)$, where
$\theta_{i},\theta_{j}\in\\{-1,1\\}$. Suppose that $\theta_{j}=-\theta_{i}$.
Then item (4) of Proposition 2.1 implies
$F^{-1}(-e_{i},0)=(\theta_{j}e_{n},0)$, but the latter implies
$(-e_{i},0)=(e_{j},0)$, which is impossible. Hence $\theta_{i}=\theta_{j}$, so
we get $(e_{i},0)=(e_{j},0)$, from which it follows that $i=j$. Therefore,
$\sigma$ is indeed an injection. This fact is going to be implicitly used in
what follows. However, note that we do not yet know whether $\sigma$ is also a
surjection.

Now we know that $F^{-1}(e_{m},0)=(g_{m},0)$ for every $m\in{\mathbb{N}}$.
Further, item (4) of Proposition 2.1 implies $F^{-1}(ae_{m},0)=(ag_{m},0)$ for
every $a\in[-1,1]$. The latter can be restated as that
$F(ag_{n},0)=(ae_{n},0)$ for every $n\in{\mathbb{N}}$ and $a\in[-1,1]$.

Step 2. Using the same argument as in [5], we can show that for every
$N\in{\mathbb{N}}$ and real numbers $a_{1},\ldots,a_{N}$ with
$\sum_{n=1}^{N}|a_{n}|\leq 1$ we have

$F\left(\sum_{n=1}^{N}a_{n}g_{n},0\right)=\left(\sum_{n=1}^{N}a_{n}e_{n},0\right),$

where $g_{n}$ is defined as in Step 1. The proof is by induction on $N$. We
are going to omit the proof, since it repeats the argument from [5] almost
word to word. The proof depends on the fact that $F(ag_{n},0)=(ae_{n},0)$ for
every $n\in{\mathbb{N}}$ and $a\in[-1,1]$ as was established in Step 1.

Step 3. The previous step and continuity of $F$ imply that for every real
sequence $(a_{n})_{n=1}^{\infty}$ with $\sum_{n=1}^{\infty}|a_{n}|\leq 1$ we
have

$F\left(\sum_{n=1}^{\infty}a_{n}g_{n},0\right)=\left(\sum_{n=1}^{\infty}a_{n}e_{n},0\right).$

If we denote the set $\\{z\in B_{Z}\colon h(z)=0\\}$ by $L_{0}$, the latter
implies $F^{-1}(L_{0})\subset L_{0}$.

Step 4. We have seen that $F^{-1}(L_{0})\subset L_{0}$. Now, let us show that
$F^{-1}(L_{0})=L_{0}$. We are going to use a proof by contradiction. Suppose
that $F^{-1}(L_{0})\neq L_{0}$. Then there is $z\in L_{0}\setminus
F^{-1}(L_{0})$. Let $s$ stand for $F^{-1}(0,1)$. Item (4) of Proposition 2.1
implies that $F^{-1}(0,-1)=-F^{-1}(0,1)$. Hence $F(s)=(0,1)$ and
$F(-s)=(0,-1)$. Let us consider two cases.

Case 1. Suppose that $s\not\in L_{0}$. Consider a continuous curve
$\xi:[0,1]\to B_{Z}$ composed of line segments $[s,z]$ and $[z,-s]$. Note that
$\operatorname{Im}\xi\cap L_{0}=\\{z\\}$, but $z\not\in F^{-1}(L_{0})$. Hence
$\operatorname{Im}\xi$ does not intersect $F^{-1}(L_{0})$. Since $F$ is
continuous, $\xi^{\prime}=F\circ\xi$ is also a continuous curve in $B_{Z}$. We
know that $\operatorname{Im}\xi$ does not intersect $F^{-1}(L_{0})$, so
$\operatorname{Im}\xi^{\prime}$ should not intersect $L_{0}$. Since $h$ is a
continuous functional, $f=h\circ\xi^{\prime}$ is a continuous function from
$[0,1]$ into ${\mathbb{R}}$. Note that $f(0)=1$ and $f(1)=-1$. Therefore,
there exists $t\in(0,1)$ such that $f(t)=0$, which implies that
$\operatorname{Im}\xi^{\prime}\cap L_{0}\neq\emptyset$, which is a
contradiction.

Case 2. For the second case, suppose that $s\in L_{0}$. The argument is the
same except that now we consider a curve composed of line segments $[s,(0,1)]$
and $[(0,1),-s]$. Again, we see that $\operatorname{Im}\xi$ does not intersect
$F^{-1}(L_{0})$, thus $\operatorname{Im}\xi^{\prime}$ should not intersect
$L_{0}$. However, we have $f(0)=1$ and $f(1)=-1$, which implies that there
exists $t\in(0,1)$ with $f(t)=0$. The latter means that
$\operatorname{Im}\xi^{\prime}\cap L_{0}\neq\emptyset$, which is again a
contradiction.

Therefore, we have $F^{-1}(L_{0})=L_{0}$. Note that this implies that the
function $\sigma$ defined earlier is a bijection from ${\mathbb{N}}$ onto
${\mathbb{N}}$. This allows us to give the set of extreme points an
alternative description:

$\operatorname{ext}B_{Z}=\\{(ag_{n},b)\colon a,b\in{\mathbb{R}},\
a^{2}+b^{2}=1,\ n\in{\mathbb{N}}\\}.$

Step 5. Let us show that $F(0,1)=(0,1)$ or $F(0,1)=(0,-1)$. First, item (4) of
Proposition 2.1 implies that $F^{-1}(0,1)\in\operatorname{ext}B_{Z}$. Hence we
have $F^{-1}(0,1)=(ag_{n},b)$, where $a,b\in{\mathbb{R}}$, $a^{2}+b^{2}=1$,
and $n\in{\mathbb{N}}$. Consider points $(ag_{n},b)$ and $(ag_{n},0)$. These
points are distance $|b|$ from each other. We have $F(ag_{n},b)=(0,1)$ and by
Step 1 we have $F(ag_{n},0)=(ae_{n},0)$. The distance between these points is
$\sqrt{1+a^{2}}$. Since $F$ is non-expansive, we must have
$\sqrt{1+a^{2}}\leq|b|$, which implies that $1+a^{2}\leq b^{2}$. Keeping in
mind the relation $a^{2}+b^{2}=1$, we can infer that $a=0$ and
$b\in\\{-1,1\\}$. Therefore, either $F(0,1)=(0,1)$ or $F(0,1)=(0,-1)$.

For the case $F(0,1)=(0,1)$, item (4) of Proposition 2.1 implies that
$F(0,b)=(0,b)$ for all $b\in[-1,1]$. In particular, we have $F(0,-1)=F(0,-1)$.
For the case $F(0,1)=(0,-1)$, item (4) of Proposition 2.1 implies that
$F(0,b)=(0,-b)$ for all $b\in[-1,1]$. In particular, we have $F(0,-1)=F(0,1)$.
Further we deal with the case $F(0,1)=(0,1)$. The case $F(0,1)=(0,-1)$ can be
handled in an analogous way.

Step 6. Note that an operator $\mathcal{L}\colon\ell_{1}\to\ell_{1}$ defined
by the formula

$\mathcal{L}\left(\sum_{n=1}^{\infty}a_{n}g_{n}\right)=\sum_{n=1}^{\infty}a_{n}e_{n}$

is an isometric automorphism of $\ell_{1}$. Hence the operator
$\mathcal{L}^{\prime}\colon Z\to Z$ defined by
$\mathcal{L}^{\prime}(x,y)=(\mathcal{L}(x),y)$ is an isometric automorphism of
$Z$. Our goal is to show that $F$ is the restriction of the latter operator to
$B_{Z}$. Obviously, this will also prove that $F$ is an isometry. So we need
to show that $F(z)=\mathcal{L}^{\prime}(z)$ for every $z\in B_{Z}$. Note that
the latter has already been established for $h(z)=0$ and $h(z)\in\\{-1,1\\}$.
Hence, we only need to consider the case $|h(z)|\in(0,1)$. Let $b$ be an
arbitrary real number with $|b|\in(0,1)$, let $a$ stand for $\sqrt{1-b^{2}}$,
and let us show that $F(z)=\mathcal{L}^{\prime}(z)$ for $h(z)=b$. Note that
$z$ has the form $(ax,b)$, where $x\in B_{\ell_{1}}$. Also note that
$\mathcal{L}^{\prime}(z)=(\mathcal{L}(ax),b)$. Therefore, we need to show that
$F(ax,b)=(\mathcal{L}(ax),b)$ for every $x\in B_{\ell_{1}}$.

We begin with showing that $F(ax,b)=(\mathcal{L}(ax),b)$ holds for every $x\in
S_{\ell_{1}}$. This is the same as to show that
$F^{-1}(ay,b)=(\mathcal{L}^{-1}(ay),b)$ for every $y\in S_{\ell_{1}}$. Hence,
fix an arbitrary $y\in S_{\ell_{1}}$. Since $F^{-1}(ay,b)\in B_{Z}$, it has
the form $(cx,d)$, where $c,d\in{\mathbb{R}}$, $c^{2}+d^{2}=1$, and $x\in
B_{\ell_{1}}$. Further, since $(ay,b)\in S_{Z}$, by item (3) of Proposition
2.1 we have $(cx,d)\in S_{Z}$. Therefore, $x\in S_{\ell_{1}}$.

Consider points $(cx,d)$ and $(0,1)$. The distance between these points is
equal to $\sqrt{c^{2}+(1-d)^{2}}=\sqrt{2-2d}$. We have $F(cx,d)=(ay,b)$ and by
Step 5 we have $F(0,1)=(0,1)$. The distance between these points is
$\sqrt{a^{2}+(1-b)^{2}}=\sqrt{2-2b}$. Since $F$ is non-expansive, we must have
$\sqrt{2-2b}\leq\sqrt{2-2d}$, which implies that $d\leq b$. Now, consider
points $(cx,d)$ and $(0,-1)$. The distance between these points is equal to
$\sqrt{c^{2}+(1+d)^{2}}=\sqrt{2+2d}$. We have $F(cx,d)=(ay,b)$ and by Step 5
we have $F(0,-1)=(0,-1)$. The distance between these points is
$\sqrt{a^{2}+(1+b)^{2}}=\sqrt{2+2b}$. Since $F$ is non-expansive, we must have
$\sqrt{2+2b}\leq\sqrt{2+2d}$, which implies that $b\leq d$. Therefore, we have
$b=d$.

Consider now points $(cx,b)$ and $(cx,0)$. The distance between these points
is equal to $|b|$. We have $F(cx,b)=(ay,b)$ and by Step 2 we have
$F(cx,0)=(\mathcal{L}(cx),0)$. The distance between these points is equal to
$\sqrt{\|ay-\mathcal{L}(cx)\|^{2}+b^{2}}$. Since $F$ is non-expansive, we must
have $\sqrt{\|ay-\mathcal{L}(cx)\|^{2}+b^{2}}\leq|b|$, but this implies
$\mathcal{L}(cx)=ay$. Therefore, we have
$F^{-1}(ay,b)=(\mathcal{L}^{-1}(ay),b)$, which finishes the argument.

Step 7. The relation $F(ax,b)=(\mathcal{L}(ax),b)$ is now established for
$\|x\|=1$. Note that the latter relation is obvious for $x=0$, being a
corollary of Step 5. Therefore, let us consider the case where
$\|x\|\in(0,1)$.

To begin with, let us consider points $(a\frac{x}{\|x\|},b)$, $(ax,b)$, and
$(0,b)$. The distance between the first two is $a(1-\|x\|)$ and the distance
between the second two is $a\|x\|$. Note that $F(0,b)=(0,b)$ by Step 5 and
$F(a\frac{x}{\|x\|},b)=(\mathcal{L}(a\frac{x}{\|x\|}),b)$ by Step 6. Since $F$
is non-expansive, we have

$\left\|\left(\mathcal{L}\left(a\tfrac{x}{\|x\|}\right),b\right)-F(ax,b)\right\|\leq
a(1-\|x\|)$

and

$\left\|F(ax,b)-(0,b)\right\|\leq a\|x\|.$

However, as the distance between $(\mathcal{L}(a\frac{x}{\|x\|}),b)$ and
$(0,b)$ is equal to $a$, the last two inequalities must be in fact equalities,
since otherwise we have a contradiction with the triangle inequality. Let
$(\sum_{n=1}^{\infty}y_{n}e_{n},d)$ be the expansion of $F(ax,b)$ and let
$(\sum_{n=1}^{\infty}\tilde{y}_{n}e_{n},b)$ be the expansion of
$(\mathcal{L}(a\frac{x}{\|x\|}),b)$. Now we have

$\displaystyle
a=\left\|\mathcal{L}\left(a\tfrac{x}{\|x\|}\right)\right\|=\sum_{n=1}^{\infty}|\tilde{y}_{n}|\leq\sum_{n=1}^{\infty}|\tilde{y}_{n}-y_{n}|+\sum_{n=1}^{\infty}|y_{n}|\leq$
$\displaystyle\sqrt{\left(\sum_{n=1}^{\infty}|\tilde{y}_{n}-y_{n}|\right)^{2}+(b-d)^{2}}+\sqrt{\left(\sum_{n=1}^{\infty}|y_{n}|\right)^{2}+(b-d)^{2}}=$
$\displaystyle\left\|\left(\mathcal{L}\left(a\tfrac{x}{\|x\|}\right),b\right)-F(ax,b)\right\|+\left\|F(ax,b)-(0,b)\right\|=$
$\displaystyle a(1-\|x\|)+a\|x\|=a.$

Therefore, all the inequalities in between are in fact equalities, which is
only possible when $b=d$.

Finally, consider points $(ax,b)$ and $(ax,0)$. The distance between these two
points is $|b|$. By Step 2 we have $F(ax,0)=(\mathcal{L}(ax),0)$. Since $F$ is
non-expansive, it follows that
$\sqrt{\|\sum_{n=1}^{\infty}y_{n}e_{n}-\mathcal{L}(ax)\|^{2}+b^{2}}\leq|b|$,
hence $\sum_{n=1}^{\infty}y_{n}e_{n}=\mathcal{L}(ax)$. Therefore,
$F(ax,b)=(\mathcal{L}(ax),b)$ as needed.

We have shown that $F$ is a restriction of an isometric automorphism of $Z$.
Therefore, $F$ is an isometry as required. ∎

##  4\. The space $X\oplus_{\infty}Y$

In this section, we are going to prove the plasticity of the unit ball of the
$\ell_{\infty}$-sum of two strictly convex Banach spaces.

######  Theorem 4.1.

Let $X$ and $Y$ be two strictly convex Banach spaces. Then the unit ball of
$X\oplus_{\infty}Y$ is a plastic metric space.

###### Proof.

Denote the space $X\oplus_{\infty}Y$ by $Z$. The unit ball of this space is
the set of all pairs $(x,y)$ where $x\in B_{X}$ and $y\in B_{Y}$. Extreme
points are the pairs $(x,y)$ where $x\in S_{X}$ and $y\in S_{Y}$. If one of
the two spaces is trivial, then $Z$ is itself strictly convex, so we can limit
ourselves with the case where $X$ and $Y$ are both non-trivial.

Let $F\colon B_{Z}\to B_{Z}$ be an arbitrary non-expansive bijection from the
unit ball of $Z$ onto itself. Our goal is to show that $F$ is an isometry. Let
us fix the notation. Denote by $G$ the inverse of $F$. For $z\in Z$ denote by
$z_{x}$ and $z_{y}$ the first and the second element of $z$. Denote by $Z_{X}$
the set

$\\{z\in B_{Z}\colon\|z_{x}\|>\|z_{y}\|\\},$

denote by $Z_{Y}$ the set

$\\{z\in B_{Z}\colon\|z_{x}\|<\|z_{y}\|\\},$

and denote by $E$ the set

$\\{z\in B_{Z}\colon\|z_{x}\|=\|z_{y}\|\\}.$

These three sets form a partition of the unit ball of $Z$ – they are pairwise
disjoint and their union is $B_{Z}$. The set $E$ is closed, the closure of
$Z_{X}$ is $Z_{X}\cup E$ and the closure of $Z_{Y}$ is $Z_{Y}\cup E$. Since
$E=\\{\alpha z\colon\alpha\in[0,1],\ z\in\operatorname{ext}B_{Z}\\}$, the last
item of Proposition 2.1 implies $G(E)\subset E$. The proof is going to depend
on the number of dimensions of $X$ and $Y$. If $X$ has more than one
dimension, then $Z_{X}$ is a connected set. However, if $X$ is ${\mathbb{R}}$
(that is, $X$ is one-dimensional), then the set $Z_{X}$ has two connected
components: $Z_{X}^{-}=\\{z\in Z_{X}\colon z_{x}<0\\}$ and $Z_{X}^{+}=\\{z\in
Z_{X}\colon z_{x}>0\\}$. Obviously, the same can be said about $Y$ and
$Z_{Y}$. If $X$ and $Y$ are both one-dimensional, then $Z$ is finite-
dimensional, so we can omit this case. Hence, we have to handle two cases: 1)
both spaces have more than one dimension, 2) one of the spaces is
${\mathbb{R}}$ and the other has more than one dimension.

1) Let us start with the first case. We know that $G(E)\subset E$, so it
follows that $F(Z_{X}\cup Z_{Y})\subset Z_{X}\cup Z_{Y}$. The set $Z_{X}\cup
Z_{Y}$ has two connected components, these are $Z_{X}$ and $Z_{Y}$, so the
continuity of $F$ together with the last inclusion imply that there are four
possible cases:

  1. i)

$F(Z_{X})\subset Z_{X}$ and $F(Z_{Y})\subset Z_{X}$,

  2. ii)

$F(Z_{X})\subset Z_{X}$ and $F(Z_{Y})\subset Z_{Y}$,

  3. iii)

$F(Z_{X})\subset Z_{Y}$ and $F(Z_{Y})\subset Z_{X}$,

  4. iv)

$F(Z_{X})\subset Z_{Y}$ and $F(Z_{Y})\subset Z_{Y}$.

Consider case i). For this case, the continuity of $F$ implies that
$F(\overline{Z_{X}})\subset\overline{Z_{X}}$ and
$F(\overline{Z_{Y}})\subset\overline{Z_{X}}$, and since the union of
$\overline{Z_{X}}$ and $\overline{Z_{Y}}$ is the unit ball, we have
$F(B_{Z})\subset\overline{Z_{X}}$, which contradicts the surjectivity of $F$.
Case iv) is similar. Therefore, we are left with cases ii) and iii), which we
are going to refer to as cases A) and B).

2) Now, let us consider the case where one of the spaces is ${\mathbb{R}}$ and
the other has more than one dimension. We are going to show that this reduces
to case A). Suppose that $X$ has more than one dimension and $Y$ is
${\mathbb{R}}$. Let us introduce the following notations:

$\displaystyle Z_{Y}^{-}$ $\displaystyle=\\{z\in Z_{Y}\colon z_{y}<0\\},$
$\displaystyle Z_{Y}^{+}$ $\displaystyle=\\{z\in Z_{Y}\colon z_{y}>0\\},$
$\displaystyle E^{-}$ $\displaystyle=\\{z\in E\colon z_{y}\leq 0\\},$
$\displaystyle E^{+}$ $\displaystyle=\\{z\in E\colon z_{y}\geq 0\\}.$

Note that the closure of $Z_{Y}^{-}$ is $Z_{Y}^{-}\cup E^{-}$ and the closure
of $Z_{Y}^{+}$ is $Z_{Y}^{+}\cup E^{+}$. As with the previous case, the
starting point is the inclusion $F(Z_{X}\cup Z_{Y})\subset Z_{X}\cup Z_{Y}$,
but the set $Z_{X}\cup Z_{Y}$ is now comprised of three connected components:
$Z_{Y}^{-}$, $Z_{Y}^{+}$, and $Z_{X}$. The continuity of $F$ together with the
last inclusion imply that there are $27=3^{3}$ possible cases, but some of
these can be excluded, because they contradict the surjectivity of $F$. As a
result, we are left with a total of $6=3!$ possible cases. We can divide these
cases into three groups of two, obtaining the following three cases:

  1. i)

$F(Z_{X})\subset Z_{X}$ and $F(Z_{Y})\subset Z_{Y}$,

  2. ii)

$F(Z_{X})\subset Z_{Y}^{-}$ and $F(Z_{Y})\subset Z_{X}\cup Z_{Y}^{+}$,

  3. iii)

$F(Z_{X})\subset Z_{Y}^{+}$ and $F(Z_{Y})\subset Z_{X}\cup Z_{Y}^{-}$.

The first case is the same as case A). Our goal is to exclude cases ii) and
iii). Consider case ii). The continuity of $F$ implies the inclusions
$F(\overline{Z_{X}})\subset Z_{Y}^{-}\cup E^{-}$ and
$F(\overline{Z_{Y}})\subset Z_{X}\cup Z_{Y}^{+}\cup E$. Since $E$ is a subset
of $\overline{Z_{X}}$ and a subset of $\overline{Z_{Y}}$, we obtain the
inclusion $F(E)\subset E^{-}$, which contradicts the previously obtained
inclusion $G(E)\subset E$. Case iii) is similar. As we see, we are left with
case A).

Thereby, we have two cases to consider: A) $F(Z_{X})\subset Z_{X}$ and
$F(Z_{Y})\subset Z_{Y}$, B) $F(Z_{X})\subset Z_{Y}$ and $F(Z_{Y})\subset
Z_{X}$. Let us make some additional conclusions. For case A), the continuity
of $F$ implies that $F(\overline{Z_{X}})\subset\overline{Z_{X}}$ and
$F(\overline{Z_{Y}})\subset\overline{Z_{Y}}$. As $E$ is a subset of
$\overline{Z_{X}}$ and a subset of $\overline{Z_{Y}}$, it follows that
$F(E)\subset\overline{Z_{X}}\cap\overline{Z_{Y}}$. The latter is equal to $E$,
so we have the inclusion $F(E)\subset E$. We can use the same argument to show
this for case B). Now, for case A) we have $F(Z_{X})\subset Z_{X}$,
$F(Z_{Y})\subset Z_{Y}$ and $F(E)\subset E$. Since $F$ is a bijection, while
$Z_{X}$, $Z_{Y}$, and $E$ form a partition of $B_{Z}$, we can conclude that
$F(Z_{X})=Z_{X}$, $F(Z_{Y})=Z_{Y}$, and $F(E)=E$. Analogously, for case B) we
obtain $F(Z_{X})=Z_{Y}$, $F(Z_{Y})=Z_{X}$, and $F(E)=E$.

The last item of Proposition 2.1 asserts that
$G(\operatorname{ext}B_{Z})\subset\operatorname{ext}B_{Z}$. We can also show
that $F(\operatorname{ext}B_{Z})\subset\operatorname{ext}B_{Z}$. To
demonstrate this, let $z\in\operatorname{ext}B_{Z}$ be arbitrary. Since
$F(E)=E$ and $z$ belongs to $E$, $F(z)$ belongs to $E$ as well, so
$F(z)=\alpha z^{\prime}$ where $z^{\prime}\in\operatorname{ext}B_{Z}$ and
$\alpha\in[0,1]$. We need to show that $\alpha=1$. The last item of
Proposition 2.1 implies that $G(\alpha z^{\prime})=\alpha G(z^{\prime})$ and
$G(z^{\prime})\in\operatorname{ext}B_{Z}$, so we obtain the equation $z=\alpha
G(z^{\prime})$. Taking the norm of both sides, we see that $\alpha=1$. This
proves the inclusion
$F(\operatorname{ext}B_{Z})\subset\operatorname{ext}B_{Z}$, hence
$F(\operatorname{ext}B_{Z})=\operatorname{ext}B_{Z}$.

To finish the proof, we would have to consider cases A) and B) separately.
However, the proofs for these two cases are almost identical, so we will only
consider case A).

First, we are going to show that

$\forall z,w\in B_{Z}\quad(z_{x}=w_{x}\in S_{X}\implies G(z)_{x}=G(w)_{x}\in
S_{X}),$ $\forall z,w\in B_{Z}\quad(z_{y}=w_{y}\in S_{Y}\implies
G(z)_{y}=G(w)_{y}\in S_{Y}).$

Let us demonstrate the first item. Fix $z,w\in B_{Z}$ and suppose
$z_{x}=w_{x}\in S_{X}$. Let us consider four possible cases.

  * •

First, we consider the case where $z_{y}\in S_{Y}$ and $w_{y}\not\in S_{Y}$.
Since $w_{x}\in S_{X}$ and $w_{y}\not\in S_{Y}$, it follows that $w\in Z_{X}$.
As $w\in Z_{X}$ and $F(Z_{X})=Z_{X}$, we have $G(w)\in Z_{X}$. Therefore,
$G(w)_{y}\not\in S_{Y}$. Since $z_{x}=w_{x}\in S_{X}$, the distance between
$-z$ and $w$ is two. Therefore, the distance between $G(-z)$ and $G(w)$ is
also two. This means that either $G(-z)_{x}$ and $G(w)_{x}$ are distance two
apart or $G(-z)_{y}$ and $G(w)_{y}$ are distance two apart. The second
possibility is excluded, because $G(w)_{y}\not\in S_{Y}$. Consequently, we
have the first case. As $G(-z)_{x}$ and $G(w)_{x}$ are distance two apart,
they should belong to $S_{X}$. Moreover, since $X$ is strictly convex, it
follows that $G(-z)_{x}=-G(w)_{x}$. Finally, since
$z\in\operatorname{ext}B_{Z}$, the last item of Proposition 2.1 implies that
$G(-z)=-G(z)$, so we have $G(z)_{x}=G(w)_{x}\in S_{X}$ as wanted.

  * •

The same argument can be applied to the case where $z_{y}\not\in S_{Y}$ and
$w_{y}\in S_{Y}$ by swapping the roles of $z$ and $w$.

  * •

If $z_{y}\in S_{Y}$ and $w_{y}\in S_{Y}$, then we take $p\in B_{Z}$ such that
$p_{y}\not\in S_{Y}$ and $p_{x}$ is the same as $z_{x}$ and $w_{x}$. Then
$z_{x}=p_{x}\in S_{X}$, $z_{y}\in S_{Y}$, and $p_{y}\not\in S_{Y}$, so
$G(z)_{x}=G(p)_{x}\in S_{X}$ by the first item of this list. Similarly, as
$w_{x}=p_{x}\in S_{X}$, $w_{y}\in S_{Y}$, and $p_{y}\not\in S_{Y}$, we have
$G(w)_{x}=G(p)_{x}\in S_{X}$. Combining these two yields $G(z)_{x}=G(w)_{x}\in
S_{X}$ as wanted.

  * •

An argument similar to the one used in the third item of this list can be
applied to the case where $z_{y}\not\in S_{Y}$ and $w_{y}\not\in S_{Y}$ by
choosing $p\in B_{Z}$ such that $p_{y}\in S_{Y}$ and $p_{x}$ is the same as
$z_{x}$ and $w_{x}$.

We have considered all four possible cases. One can use the same argument to
prove the second item. The obtained result brings us to consider functions
$g_{x}\colon S_{X}\rightarrow S_{X}$ and $g_{y}:S_{Y}\rightarrow S_{Y}$ that
can be defined with $g_{x}(x)=G(x,0)_{x}$ and $g_{y}(y)=G(0,y)_{y}$. So now we
have

$\forall z\in B_{Z}\quad(z_{x}\in S_{X}\implies G(z)_{x}=g_{x}(z_{x})),$
$\forall z\in B_{Z}\quad(z_{y}\in S_{Y}\implies G(z)_{y}=g_{y}(z_{y})).$

We go on to prove some facts about these functions. First, let us show that
these functions are injective. Consider $g_{x}$. Suppose by contrary that
there are $x,x^{\prime}\in S_{X}$ such that $x\neq x^{\prime}$ and
$g_{x}(x)=g_{x}(x^{\prime})$. Choose arbitrary $y\in S_{Y}$ and consider pairs
$(x,y)$ and $(x^{\prime},y)$. We have $G(x,y)=(g_{x}(x),g_{y}(y))$ and
$G(x^{\prime},y)=(g_{x}(x^{\prime}),g_{y}(y))$. Note that
$(x,y)\neq(x^{\prime},y)$, but $G(x,y)=G(x^{\prime},y)$. This contradicts the
injectivity of $G$. Thus, $g_{x}$ is actually injective. We can use the same
argument to show that $g_{y}$ is injective too.

Let us consider surjectivity. Let $x\in S_{X}$ and $y\in S_{Y}$ be arbitrary.
Then $(x,y)$ is extreme and hence $F(x,y)$ is also extreme, because
$F(\operatorname{ext}B_{Z})=\operatorname{ext}B_{Z}$. Denote by $x^{\prime}$
and $y^{\prime}$ the first and the second element of $F(x,y)$. Since
$(x^{\prime},y^{\prime})$ is extreme, we have $x^{\prime}\in S_{X}$ and
$y^{\prime}\in S_{Y}$. Since $F$ sends $(x,y)$ to $(x^{\prime},y^{\prime})$,
we have $G(x^{\prime},y^{\prime})=(x,y)$, thus $g_{x}(x^{\prime})=x$ and
$g_{y}(y^{\prime})=y$, which proves the surjectivity of both $g_{x}$ and
$g_{y}$. Now that we know $g_{x}$ and $g_{y}$ are bijective, denote the
inverse of $g_{x}$ by $f_{x}$ and the inverse of $g_{y}$ by $f_{y}$.

Let us show that $g_{x}$ and $g_{y}$ are symmetric. That is, we demonstrate
that $g_{x}(-x)=-g_{x}(x)$ and $g_{y}(-y)=-g_{y}(y)$ for every $x\in S_{X}$
and $y\in S_{Y}$. Pick an arbitrary $x\in S_{X}$. Let us show that
$g_{x}(-x)=-g_{x}(x)$. Choose an arbitrary $y\in S_{Y}$. Consider pairs
$z=(x,y)$ and $w=(-x,y)$. The distance between them is two, so the distance
between $G(z)$ and $G(w)$ should be also two. We know that
$G(z)=(g_{x}(x),g_{y}(y))$ and $G(w)=(g_{x}(-x),g_{y}(y))$. For distance
between these two pairs to be equal to two, elements $g_{x}(x)$ and
$g_{x}(-x)$ should be distance two apart. Since $X$ is a strictly convex
space, it follows that $g_{x}(-x)=-g_{x}(x)$. The same argument can be used to
show that $g_{y}(-y)=-g_{y}(y)$ for $y\in S_{Y}$. Obviously, the symmetricity
of $g_{x}$ and $g_{y}$ implies that $f_{x}$ and $f_{y}$ are also symmetric.

Define a function $G_{x}:X\rightarrow X$ with $G_{x}(0)=0$ and
$G_{x}(tx)=tg_{x}(x)$ for all $x\in S_{X}$ and $t>0$. Similarly, define a
function $G_{y}:Y\rightarrow Y$ with $G_{y}(0)=0$ and $G_{y}(ty)=tg_{y}(y)$
for all $y\in S_{Y}$ and $t>0$. We see that $G_{x}$ coincides with $g_{x}$ on
$S_{X}$ and $G_{y}$ coincides with $g_{y}$ on $S_{Y}$. Using the properties of
$g_{x}$ and $g_{y}$ established above, one can show that $G_{x}$ and $G_{y}$
are bijective and homogeneous (that is, for every $x\in B_{X}$, $y\in B_{Y}$
and $t\in\mathbb{R}$ we have $G_{x}(tx)=tG_{x}(x)$ and $G_{y}(ty)=tG_{y}(y)$).
Denote the inverses of $G_{x}$ and $G_{y}$ by $F_{x}$ and $F_{y}$. It is easy
to see that $F_{x}$ and $F_{y}$ are also homogeneous. Moreover, we see that
$F_{x}$ coincides with $f_{x}$ on $S_{X}$ and $F_{y}$ coincides with $f_{y}$
on $S_{Y}$.

Now, we are going to examine what $G$ does with a pair one element of which
lies on the sphere and the other element of which is arbitrary. Our goal is to
show that

$\forall x\in S_{X}\ \forall y\in B_{Y}\quad G(x,y)=(G_{x}(x),G_{y}(y)),$
$\forall x\in B_{X}\ \forall y\in S_{Y}\quad G(x,y)=(G_{x}(x),G_{y}(y)).$

Let us consider the first item. Fix arbitrary $x\in S_{X}$ and arbitrary $y\in
B_{Y}$. First, let us consider the case $y=0$. Our goal is to show that
$G(x,0)=(g_{x}(x),0)$. We know that $G(x,0)=(g_{x}(x),y_{0})$ where $y_{0}\in
B_{Y}$. Suppose by contrary that $y_{0}\neq 0$. Denote by $y_{0}^{*}$ the
element $y_{0}/\|y_{0}\|\in S_{Y}$. We see that $G$ sends $(x,0)$ to
$(g_{x}(x),y_{0})$ and $(x,f_{y}(y_{0}^{*}))$ to $(g_{x}(x),y_{0}^{*})$. The
distance between $(x,0)$ and $(x,f_{y}(y_{0}^{*}))$ is one, while the distance
between $(g_{x}(x),y_{0})$ and $(g_{x}(x),y_{0}^{*})$ is smaller than one,
which is a contradiction. Next, consider the case $y\neq 0$. Then $y=tu$ where
$u\in S_{Y}$ and $t\in(0,1]$. Our goal is to show that $G$ sends $(x,tu)$ to
$(g_{x}(x),tg_{y}(u))$. Again, we know that $G(x,tu)=(g_{x}(x),y_{0})$ where
$y_{0}\in B_{Y}$. We need to show that $y_{0}=tg_{y}(u)$. If $y_{0}=0$, then
$G$ sends both $(x,0)$ and $(x,tu)$ to $(g_{x}(x),0)$, which contradicts the
injectivity of $G$. Therefore, $y_{0}\neq 0$ and we can consider the element
$y_{0}^{*}=y_{0}/\|y_{0}\|\in S_{Y}$. We see that $G$ sends
$(x,f_{y}(y_{0}^{*}))$ to $(g_{x}(x),y_{0}^{*})$, $(x,tu)$ to
$(g_{x}(x),y_{0})$, and $(x,0)$ to $(g_{x}(x),0)$. The distance between
$(g_{x}(x),y_{0}^{*})$ and $(g_{x}(x),y_{0})$ is $1-\|y_{0}\|$, the distance
between $(g_{x}(x),y_{0})$ and $(g_{x}(x),0)$ is $\|y_{0}\|$. So the distance
between $(x,f_{y}(y_{0}^{*}))$ and $(x,tu)$ should be at most $1-\|y_{0}\|$
and the distance between $(x,tu)$ and $(x,0)$ should be at most $\|y_{0}\|$.
This means that the distance between $f_{y}(y_{0}^{*})$ and $tu$ should also
be at most $1-\|y_{0}\|$ and the distance between $tu$ and $0$ should also be
at most $\|y_{0}\|$. Since $Y$ is a strictly convex space, we have
$tu=\|y_{0}\|f_{y}(y_{0}^{*})$. It follows that $t=\|y_{0}\|$ and
$u=f_{y}(y_{0}^{*})$. Thus we have $y_{0}=\|y_{0}\|y_{0}^{*}=tg_{y}(u)$ as
wanted. The proof of the second item is analogous.

From the last obtained result it follows directly that $F$ has the analogous
properties. That is, we have

$\forall x\in S_{X}\ \forall y\in B_{Y}\quad F(x,y)=(F_{x}(x),F_{y}(y)),$
$\forall x\in B_{X}\ \forall y\in S_{Y}\quad F(x,y)=(F_{x}(x),F_{y}(y)).$

Finally, we show that for every $z\in B_{Z}$ we have
$F(z)=(F_{x}(z_{x}),F_{y}(z_{y}))$. Let us first show that for every $z\in
B_{Z}$ we have $F(z)_{x}=F_{x}(z_{x})$. Fix arbitrary $z\in B_{Z}$. Denote the
elements of $z$ by $x$ and $y$ and the elements of $F(z)$ by $x^{\prime}$ and
$y^{\prime}$. The element $x\in B_{X}$ can be represented in the form $tu$
where $t\in[0,1]$ and $u\in S_{X}$. As $F_{x}(tu)=tF_{x}(u)$ by homogeneity of
$F_{x}$, the equality that we need to prove takes the form
$x^{\prime}=tF_{x}(u)$. We know that $F$ sends $(tu,y)$ to
$(x^{\prime},y^{\prime})$, $(u,y)$ to $(F_{x}(u),F_{y}(y))$ and $(-u,y)$ to
$(F_{x}(-u),F_{y}(y))$. By homogeneity of $F_{x}$ we have
$F_{x}(-u)=-F_{x}(u)$. The distance between $(u,y)$ and $(tu,y)$ is $1-t$, the
distance between $(tu,y)$ and $(-u,y)$ is $1+t$. Thus the distance between
$(F_{x}(u),F_{y}(y))$ and $(x^{\prime},y^{\prime})$ is at most $1-t$ and the
distance between $(x^{\prime},y^{\prime})$ and $(-F_{x}(u),F_{y}(y))$ is at
most $1+t$. This implies that the distance between $F_{x}(u)$ and $x^{\prime}$
is also at most $1-t$ and the distance between $x^{\prime}$ and $-F_{x}(u)$ is
also at most $1+t$. Since $X$ is a strictly convex space, it follows that
$x^{\prime}=tF_{x}(u)$ as wanted. One can use the same argument to show that
for every $z\in B_{Z}$ we have $F(z)_{y}=F_{y}(z_{y})$.

We can finish the proof by applying Theorem 2.3.

∎

## Acknowledgements

The third author is grateful to her scientific advisor Vladimir Kadets for
help with this project. The third author was supported by the National
Research Foundation of Ukraine funded by Ukrainian State budget in frames of
project 2020.02/0096 “Operators in infinite-dimensional spaces: the interplay
between geometry, algebra and topology”.

## References

  * [1] B., V., J. and E.J.  “Plasticity of the unit ball of a strictly convex Banach space”  In _Revista de la Real Academia de Ciencias Exactas, Físicas y Naturales. Serie A. Matemáticas_ 110.2, 2016, pp. 723–727
  * [2] C., V. and O.  “Non-expansive bijections, uniformities and polyhedral faces”  In _Journal of Mathematical Analysis and Applications_ 471.1, 2019, pp. 38–52
  * [3] H. and W.  “Dehnungen, Verkürzungen, Isometrien”  In _Fund. Math_ 26, 1936, pp. 120–122
  * [4] V. Kadets and O. Zavarzina  “Nonexpansive bijections to the unit ball of the $\ell_{1}$-sum of strictly convex Banach spaces”  In _Bulletin of the Australian Mathematical Society_ 97, 2018, pp. 285–292
  * [5] V. Kadets and O. Zavarzina  “Plasticity of the unit ball of $\ell_{1}$”  In _Visnyk of V. N. Karazin Kharkiv National University. Ser. Mathematics, Applied Mathematics and Mechanics_ 83, 2016, pp. 4–9
  * [6] N.  “Plasticity of the unit ball of $c$ and $c_{0}$”  In _Journal of Mathematical Analysis and Applications_ 507.1, 2022
  * [7] P.  “On extension of isometries in normed linear spaces”  In _Bull. Acad. Polon. Sci., Sér. Sci. Math. Astronom. Phys._ 20, 1972, pp. 367–371
  * [8] S.., Z. and E..  “Plasticity in metric spaces”  In _J. Math. Anal. Appl_ 313, 2006, pp. 38–48