# Lost in the Averages: A New Specific Setup to Evaluate Membership Inference
Attacks Against Machine Learning Models

Florent Guépin* Department of Computing
Imperial College London
United Kingdom
Nataša Krco* Department of Computing
Imperial College London
United Kingdom
Matthieu Meeus  Department of Computing
Imperial College London
United Kingdom
Yves-Alexandre de Montjoye  Department of Computing
Imperial College London
United Kingdom

###### Abstract

Membership Inference Attacks (MIAs) are widely used to evaluate the propensity
of a machine learning (ML) model to memorize an individual record and the
privacy risk its release poses. MIAs are currently evaluated in the same way
as ML models: the MIA is performed on a test set of models trained on data
samples that were not seen during training, where the datasets for the test
set are sampled from a larger pool $D_{eval}$. The performance of the MIA is
then evaluated across all the datasets (i.e. models) in the test set, thus
evaluating the MIA across the distribution of datasets sampled from
$D_{eval}$. While this was a natural extension of the ML evaluation pipeline
to MIAs, recent work has shown that the privacy risk of an individual record
is highly dependent on the dataset it is in. Outliers have, for instance, been
shown to be particularly vulnerable, yet an outlier in one data sample might
often not be an outlier in another data sample. The source of randomness
currently used to create test data for MIAs might thus lead to an incorrect
estimate of the privacy risk of individual records. We here propose a new
evaluation setup for MIAs against ML models, which we call specific. Our setup
uses weight initialization as the only source of randomness for evaluation,
instead of the additional sampling of different datasets. This allows us to
accurately evaluate the risk posed by the release of a model trained on a
specific target dataset. Using existing MIAs, we show empirically the per-
record risk estimates given by the current average setup to lead to a
substantial number of records to be incorrectly classified as low risk when
used to train synthetic data generators and machine learning (ML) classifiers.
We then derive theoretical results which, combined with empirical evidence,
strongly suggest that the risk calculated in the current setup is an average
of the risks specific to each dataset sampled for testing, validating our use
of weight initialization as the only source of randomness. Finally, we propose
an MIA attack allowing a very strong adversary, akin to the Differential
Privacy one, to leverage information about the target dataset to infer
membership. Taken together, our results show that current evaluation setups
for MIAs are incorrectly averaging the risk across datasets, leading a
significantly high number of records to be misclassified as low risk and the
risk posed by attacks leveraging information about the target dataset to be
potentially dramatically underestimated. They emphasize the need to use weight
initialization as the only source of randomness when evaluating MIAs on ML
models and how future attacks might leverage information about the target
dataset.

11footnotetext: These authors contributed equally to this work and are ordered
alphabetically.

##  1 Introduction

Machine Learning (ML) models are increasingly trained or fine-tuned by
companies, governments, and academic researchers often using data that can be
personal. Membership inference attacks (MIAs) have become the standard method
to evaluate the privacy risks of aggregate data [homer2008resolving,
sankararaman2009genomic] including when releasing ML models
[shokri2017membership, carlini2022membership]. MIAs quantify the risk of an
attacker being able to infer that the target record was a member of the
released model’s training set.

MIAs against ML models are typically instantiated as a binary meta-classifier,
predicting membership for a given target record [shokri2017membership,
carlini2022membership, stadler2022synthetic]. The meta-classifier is trained
using auxiliary data, and then evaluated on models trained on datasets
randomly sampled from a large held-out data pool dedicated to evaluation. The
target record is then added to a fraction of the datasets, typically to half
of them to create a balanced setup.

Though using dataset sampling as a source of randomness is a natural extension
of the ML evaluation pipeline to MIAs, we argue that–in light of recent
evidence–this does not properly evaluate the privacy risk posed by an ML model
release in practice. Recent research on MIAs against machine learning models
has indeed shown how the privacy risk often lies with particular records being
memorized [carlini2022membership, meeus2023achilles, aerni2024evaluations,
stadler2022synthetic], leading to the development of techniques to identify
them [meeus2023achilles] and new metrics–such as TPR at low FPR–being adopted
[carlini2022membership]. Recent evidence [carlini2022privacy,
meeus2023achilles] also suggest that at-risk records tend to be outliers,
records that are different from other records in the dataset used to trained
the model. Using data sampling as a source of randomness to evaluate the
privacy risk of releasing is therefore problematic as it evaluates the average
risk of a target record in a dataset sampled from the underlying distribution
instead of the risk posed by the release of the actual model which was trained
on a specific dataset.

Contribution. In this paper, we propose a specific evaluation setup for MIAs
against ML models which we argue, in light of recent evidence, better captures
the privacy risk of releasing an ML model.

First, we formalize the _average_ MIA evaluation setup as currently used in
the literature with dataset sampling as a source of randomness. We then
propose a specific evaluation setup which only uses weight initialization as a
source of randomness which we argue better captures the risk posed by the
release of a given ML model.

Second, we instantiate both evaluation setups using existing state-of-the-art
MIAs against synthetic data generators [houssiau2022tapas, meeus2023achilles]
and ML models. We show the results from existing MIA attacks to strongly
differ when evaluated using the current, average, setup and the more accurate
specific setup we propose. For instance, we find that 94% of high-risk records
in the Adult dataset would be incorrectly considered as low-risk when using
the average setup to evaluate a model trained using synthpop. We validate our
finding against a range of datasets and synthetic data models and classifiers.

Third, we derive theoretical results which, combined with empirical evidence,
strongly suggest that the risk calculated in the current setup is an average
of the risks specific to each dataset sampled for testing. We argue these
results validate our use of weight initialization as the (only) source of
randomness necessary to evaluate MIAs against ML models.

Finally, we instantiate an MIA attack by a very strong attacker with knowledge
of the training dataset $D_{target}$, a version of the standard attacker in
Differential Privacy. We show this attack to lead to drastically and
significantly improved membership inference when evaluated in the specific
setup (mean AUC going from 0.601 to 0.792) but not in the average setup. These
results further validate the need to use a specific setup when evaluating MIAs
against machine learning models and emphasize the fact that new stronger
attacks, leveraging (some) knowledge of the training dataset, are likely to be
developed in the future.

##  2 Related work

#### Membership inference attacks (MIAs).

homer2008resolving first introduced the concept of MIAs to infer the presence
of a trace amount of DNA from released genomic aggregates. Their work was then
extended to study how the parameters, e.g. the number of records in the
aggregates, impact MIA performance [sankararaman2009genomic]. MIAs have since
been applied to other types of data aggregates for instance location traces
[pyrgelis2017knock] and, most importantly for this work, machine learning (ML)
models [shokri2017membership].

In parallel, new techniques have been proposed to carry out MIAs
[leino2020stolen, nasr2019comprehensive, yeom2018privacy, salem2018ml,
carlini2022membership, stadler2022synthetic]. While the 2008 attack by Homer
et al. used statistical hypothesis techniques, most attacks today rely on the
shadow modeling technique introduced by ateniese2015hacking and popularized by
shokri2017membership. In particular, LiRA, which combines shadow modelling and
statistical testing to determine membership, is the state-of-the-art black-box
MIA against ML models carlini2022membership. While out of scope for us,
attacks that rely only on access to the labels predicted by a model have been
developed e.g. choquette2021label as well as white box attacks e.g.
nasr2019comprehensive which uses the gradients and activations of the layers
of a deep neural network to predict membership. Finally, black-box attacks
leveraging shadow models have been developed against synthetic data
generators. These include stadler2022synthetic and the state-of-the-art query-
based attack which we use here [houssiau2022tapas].

#### MIA performance evaluation.

To the best of our knowledge, all methods so far evaluate the record-level
privacy risk using dataset sampling as a source of randomness. AUC or,
alternatively, accuracy were the primary metrics used to measure the success
of an MIA against a target record, usually with a balanced test set
[shokri2017membership, choquette2021label, hayes2019logan]. As new research
emphasizing how certain records might be much more at risk than others
[feldman2020neural, meeus2023achilles, carlini2022membership,
stadler2022synthetic] developed, metrics focusing on the most at-risk records
started to be used. This includes metrics focusing on the records identified a
posteriori as being particularly at risk e.g. in synthetic datasets
[stadler2022synthetic, meeus2023achilles] and metrics measuring the risk the
most vulnerable records across the entire dataset are exposed to, such as TPR
(True Positive Rate) at low FPR (False Positive Rate). Popularized by
carlini2022membership for MIAs, TPR at low FPR has become a standard metric to
measure the effectiveness of MIAs against the most vulnerable records used to
train an ML model. Recent evidence [carlini2022privacy, meeus2023achilles]
also suggest that at-risk records tend to be outliers, records that are
different from other records in the dataset used to trained the model.

##  3 MIA evaluation setups

###  3.1 Notation

#### Records.

We consider a tabular record to consist of a finite set of $m$ attributes
$x_{i}=(x_{i,1},\cdots,x_{i,m})~{}\in~{}$
$\mathcal{F}_{1}\times,\cdots,\times\mathcal{F}_{m}$. We denote by
$\mathcal{F}=\mathcal{F}_{1}\times,\cdots,\times\mathcal{F}_{m}$ the universe
of possible records, and define $\mathcal{D}$ as a random distribution of
records over $\mathcal{F}$.

We consider an image record to consist of a finite set of pixels, that can be
written as a matrix $(X_{i,j}^{r},X_{i,j}^{g},X_{i,j}^{b})\in[0,255]^{3}$. For
an image of size $n\times m$, we denote by $\mathcal{F}=([0,255]^{3})^{n\times
m}$ the universe of possible records, and define $\mathcal{D}$ as a random
distribution of records over $\mathcal{F}$.

#### Evaluation setup.

We denote $D_{target}$ the target dataset used to trained the target machine
learning model $\mathcal{M}_{target}(D_{target})$ and $x_{target}$ the target
record whose membership the attacker aims to infer. Note that for simplicity
we use $\mathcal{M}_{target}$ as a shorthand for
$\mathcal{M}_{target}(D_{target})$.

To accommodate–without loss of generality–the average and specific setups, we
denote $D_{eval}$ the evaluation data pool available to the model developer to
evaluate the privacy risk of releasing a trained model $\mathcal{M}_{target}$,
including the dataset used to train $\mathcal{M}_{target}$ ($D_{target}\subset
D_{eval}$).

We also use the term _evaluation models_ for the models we use to evaluate the
effectiveness of an MIA and evaluation datasets for the datasets they are
trained on.

Finally, an auxiliary dataset $D_{aux}$ is used to train the MIA. We here
first consider MIAs trained on $D_{aux}$, a dataset drawn from the same
distribution as $D_{eval}$ (but strictly not overlapping), the most standard
assumption in the literature [shokri2017membership, carlini2022membership]. In
Sec. 7 specifically, we also develop an MIA where a very strong attacker, akin
to the Differential Privacy attacker, has access to $D_{target}$ minus the
membership information of $x_{target}$ as auxiliary dataset.

#### Privacy risk.

We denote by $R_{setup}^{\phi}(x,D)$ the privacy risk for the record $x$ when
evaluation datasets are sampled from $D$ and metric $\phi$ is used to
calculate the performance score of the MIA. For metric $\phi$, we use both ROC
AUC and TPR at low FPR (further simplified as TPR at an FPR of 0.1 except in
section 5 where we use 0.3).

Figure 1: On the left: the average evaluation setup, sampling multiple
datasets from the evaluation pool $D_{eval}$ and training an evaluation model
on each. On the right: the specific evaluation setup: the only evaluation
datasets used are the full $\mathcal{D}_{target}$, in which $x_{target}$ is
included, and $D_{target}$ in which $x_{target}$ is replaced by a reference
record $x_{R}$ sampled from the evaluation pool $D_{eval}$.

###  3.2 Average evaluation setup

The evaluation setup used in the literature relies on the sampling of
evaluation datasets as a source of randomness to evaluate the effectiveness of
an MIA against an ML model. The privacy risk $R_{avg}^{\phi}$ of a target
record $x_{target}$ is evaluated on the trained MIA’s ability to distinguish
between ML models trained on a dataset containing $x_{target}$ and those not.
The source of randomness in this setup is the sampling of evaluation datasets
- $N$ different evaluation datasets are sampled from $D_{eval}$ and
$x_{target}$ is included in half of them. A separate evaluation model is
trained on each evaluation dataset, and the trained MIA is applied to it. The
privacy risk for $x_{target}$ is then estimated as the performance of the MIA
aggregated across the evaluation models. A diagram of this setup is presented
on the left-hand side of Figure 1. We write $R_{avg}^{\phi}(x,D_{eval})$
(simplified as $R_{avg}^{\phi}$) for the risk estimated using the average
setup using metric $\phi$.

###  3.3 Specific evaluation setup

In the specific MIA evaluation setup, we remove the randomness coming from the
sampling of evaluation datasets, and use the the weight initialization of the
evaluation models as the sole source of randomness. More specifically, we
train $\frac{N}{2}$ evaluation models on $D_{target}$, ensuring that each has
a different random initialization. For the remaining $\frac{N}{2}$ evaluation
models, we train on $D_{target}$ where $x_{target}$ is swapped out for a
reference record $x_{ref}$, sampled from $D_{eval}$. We estimate the privacy
risk of $x_{target}$ by calculating a performance score over all $N$
evaluation models. The right-hand side of Figure 1 shows a diagram of this
setup.

###  3.4 Comparing setups

#### Miss rate.

We define _miss rate_ to be the fraction of records classified as high-risk in
the specific setup, that are classified as low-risk in the average setup.
Given a threshold $t$, we consider a record $x$ to be high-risk if
$R^{\phi}_{setup}(x,D)>t$, and low-risk otherwise, for $setup\in\\{avg,sp\\}$,
dataset $D$, and metric $\phi$. Formally, we define the _miss rate_ $\forall
S\subseteq D_{target}$ as:

$\displaystyle\mathcal{M}(S,D_{target},D_{eval})=\frac{|\\{x\in
S|R_{avg}^{\phi}(x,D_{eval})\leq t\wedge
R_{sp}^{\phi}(x,D_{target})>t\\}|}{|\\{x\in
S|R_{sp}^{\phi}(x,D_{target})>t\\}|}$

#### RMSE and Pearson correlation.

We also use Root Mean Squared Error ($RMSE$) and Pearson correlation to
compare the results in the specific and average evaluation setups.

$RMSE$ quantifies the error made when using the average setup instead of
specific while the Pearson correlation allows us to compare our empirical
results to what we would expect theoretically (see Theorem 1). Formally, we
compute them $\forall S\subseteq D_{target}$ as:

$\displaystyle RMSE(S,\phi)$ $\displaystyle=\sqrt{\frac{1}{|S|}\sum_{x\in
S}(R_{avg}^{\phi}-R_{sp}^{\phi})^{2}}$ $\displaystyle\rho(S,\phi)$
$\displaystyle=\frac{\sum_{x\in
S}\left(R_{avg}^{\phi}-\bar{R}^{\phi}_{avg}\right)\cdot\left(R_{sp}^{\phi}-\bar{R}^{\phi}_{sp}\right)}{\sqrt{\sum_{x\in
S}\left(R_{avg}^{\phi}-\bar{R}^{\phi}_{avg}\right)^{2}\cdot\sum_{x\in
S}\left(R_{sp}^{\phi}-\bar{R}^{\phi}_{sp}\right)^{2}}}$

Where $\bar{R}^{\phi}_{avg}=\frac{1}{|S|}\sum_{x\in S}R_{avg}^{\phi}$ is the
mean average risk and $\bar{R}^{\phi}_{sp}=\frac{1}{|S|}\sum_{x\in
S}R_{sp}^{\phi}$ is the mean specific risk.

Note that all the measures used to compare setups are specific to the metric
$\phi$ used to calculate the performance score of the MIA. In particular, AUC
typically ranges from 0.5 to 1 while TPR at low FPR ranges from 0 to 1. The
metrics might furthermore be distributed differently. Measures computed using
$\phi=$AUC can thus not be directly compared to measures computing $\phi=$TPR.
We also use different thresholds for which records are considered high-risk
namely $t=0.8$ for AUC and $t=0.6$ for TPR.

##  4 MIAs against generative models

With synthetic data becoming a popular privacy-preserving technology in
practice [census_synthetic, oecd_synthetic, fca_synth], we first compare both
evaluation setups when evaluating SOTA MIAs against synthetic data generators.

#### Experimental setup.

We use the SOTA MIA against synthetic data, the query-based attack, introduced
by houssiau2022tapas. We consider two models: synthetic data generators
Synthpop [synthpop2022] and Baynet [baynet], and two datasets: Adult
[misc_adult_2] and UK Census [census2011]. $D_{eval}$ used to evaluate the MIA
contains $15,222$ records for Adult and $27,193$ for UK census. We always
consider $D_{target}$ to contain 1000 records. We compute the privacy risk on
all records in $D_{target}$ for Adult and, for computational efficiency, on a
random subset of $100$ records for UK census. The auxiliary dataset available
to train the MIA contains $30,000$ records for Adult and $52,390$ records for
UK census and is strictly not overlapping with $D_{eval}$. We train the MIAs
using $1,000$ shadow models to ensure of the validity of our results (see Plot
4(a) and discussion in Appendix). Implementation details are given in Appendix
D.

###  4.1 Adult and $\mathcal{M}_{target}$ Synthpop

We first present the results and metrics for one popular model, Synthpop, and
dataset Adult.

Figure 2(a) shows how the AUC obtained when evaluating the effectiveness of
the SOTA MIA in the average setup is, at best, a highly imperfect estimate of
the effectiveness of an MIA against the model actually released and the
dataset used to train it (the specific setup). As shown by the area shaded in
grey (T=0.8), 94% of high-risk records would indeed be incorrectly classified
as low-risk by an auditor using the average setup.

Figure 2(b) further shows that the AUC for a given target record, a value that
empirically ranges roughly from 0.5 to 1, would be off by more than 0.1 for
$15\%$ of the records in the target dataset and could go up to $0.26$. Across
all records, using the average setup leads to an error (RSME) of $0.07$.

We obtain similar results using another metric, $\phi=$TPR, instead of AUC.
95% of high-risk records would be incorrectly classified as low-risk (T=0.6)
and using the average setup leads to an error (RSME) of $0.11$.

(a)

(b)

Figure 2: Privacy risk for each record in $D_{target}$ sampled from the Adult
dataset, $\mathcal{M}_{target}$ Synthpop, and $\phi=AUC$. (a) per-record
specific and average risks. The dashed grey lines mark the high-risk threshold
$t=0.8$. The shaded grey area marks all the high-risk records missed in the
average setup. (b) histogram of per-record absolute differences between the
specific and average risks.

###  4.2 Other generators and datasets

The results we have presented so far were for one popular model, Synthpop, and
one dataset, Adult. We now present the complete results for the two models,
Synthpop and Baynet, and two datasets, Adult and UK census.

Table 1: Miss rate across different datasets and synthetic data generators for $AUC$ and $TPR$. Dataset | $\mathcal{M}_{target}$ | Miss rate |  | $RMSE$
---|---|---|---|---
$AUC$ | $TPR$ |  | $AUC$ | $TPR$
Adult | Synthpop | 0.94 | 0.92 |  | 0.07 | 0.11
Baynet | 0.73 | 0.63 |  | 0.05 | 0.11
Census | Synthpop | 0.94 | 0.93 |  | 0.14 | 0.24
Baynet | 0.67 | 0.75 |  | 0.04 | 0.06

Table 1 shows that we obtain similarly high miss-rate across metrics, models,
and datasets. As a reminder, if the average setup was a good approximation of
the risk we should observe miss rates close to 0. Instead, we observe large
values of miss rates, ranging from 0.67 to 0.94 for $\phi=$AUC (T=0.8) and
0.62 to 0.93 for $\phi=$TPR with, as expected, slightly lower values on
average for Baynet which is known to be less prone to memorization
[meeus2023achilles, annamalai2023linear]. Table 1 then shows that we obtain
similarly high values of RMSE across metrics, models, and datasets.

##  5 MIAs against machine learning classifiers

We have so far compared the specific and average evaluation setups when
evaluating MIAs against synthetic data generators. We now compare them using
SOTA MIAs against ML classifiers.

#### Experimental setup.

We now consider a ResNet image classifier [resnet] trained on CIFAR10
[krizhevsky2009learning] and a fully connected neural network classifier
trained at predicting the binary salary attribute in Adult as the target
models $\mathcal{M}_{target}$. We use LiRA proposed by [carlini2022membership]
as the SOTA MIA attack.

For the image classifier, we consider a target dataset $D_{target}$ of size
$|D_{target}|=10,000$ and $|D_{eval}|=30,000$. We evaluate the effectiveness
of the MIAs using $AUC$ and $TPR$ at $FPR=0.1$ on $256$ evaluation models (as
done by carlini2022membership).

For the neural network, we take $D_{target}$ of size $|D_{target}|=2000$ and
$|D_{eval}|=15,222$. We evaluate the effectiveness of the MIAs using $AUC$ and
$TPR$ at $FPR=0.3$ on $500$ evaluation models. Note that we here use a FPR of
0.3 as this shows to be a particularly difficult task for the MIA, and TPR
rates at FPR 0.1 are very low, and therefore not informative.

#### Results.

Table 2 shows that, compared to a miss rate close to 0 we would observe if the
average setup was a good approximation of the risk, we obtain similarly high
miss-rate values across metrics, models, and datasets. Interestingly, the miss
rate for the ResNet image classifier trained CIFAR10, while still high
compared to 0, are amongst the lowest we observe across datasets and models.
We hypothesize this to be largely due to CIFAR10 being a much larger dataset
($|D_{target}|=10,000$) than the other datasets considered
($|D_{target}|=1000$). While a complete analysis is outside the scope of this
work, we believe that the “outlier-nature” of a record might be, on average,
more likely to be preserved in across datasets (in the average setup) when the
dataset is large. However, other factors such as the effective
“dimensionality” of a record are also likely to play a role. Finally, Table 2
shows that we obtain similarly high values of RMSE across models, and
datasets.

Table 2: Miss rate and RMSE across different datasets for $\mathcal{M}_{target}$ ML classifier for $AUC$ and $TPR$. Dataset | Miss rate |  | RMSE
---|---|---|---
$AUC$ | $TPR$ |  | $AUC$ | $TPR$
CIFAR10 | 0.40 | 0.67 |  | 0.07 | 0.12
Adult | 1.0 | 0.58 |  | 0.05 | 0.07

##  6 Theoretical results

We eliminate what we argue is an incorrect source of randomness to evaluate
MIAs against ML models: datasets sampling. Another source of randomness was
however necessary to evaluate MIAs (as otherwise the result would be a binary
value). We thus propose to use weight initialization as the source of
randomness, leading to what we call the specific evaluation setup for MIAs
against ML models.

Using a theoretical result we prove below and empirical results across models,
datasets, and metrics we argue that weight initialization is a appropriate
source of randomness and that $R_{avg}^{\phi}$ is, in fact, an average of
$R_{sp}^{\phi}$.

To do so, we first introduce and then prove (see Appendix A) the following
theorem:

######  Theorem 1.

Let $X=[X_{1},\cdots,X_{n}]$ where $\forall~{}i~{}|~{}X_{i}$ is a random
variable of mean $\mu_{i}$ and standard deviation $\sigma_{i}$, and let
$\bar{X}=[\mu_{1},\cdots,\mu_{n}]$. Then we have that the expected Pearson
correlation between $X$ and $\bar{X}$ is equal to the square root of the ratio
of their variances:

$\displaystyle E[\rho(X,\bar{X})]=\mathcal{V}(\bar{X},X)$
$\displaystyle\text{where
}\mathcal{V}(\bar{X},X)=\sqrt{\frac{V(\bar{X})}{V(X)}}$

With this, we then prove the relationship between two arrays $X$ and $\bar{X}$
of random variables with $\bar{X}_{i}$ being the mean of variable $X_{i}$.

Additionally, we note that

$\displaystyle\bar{X}=E[X]\Rightarrow E[\bar{X}]=E[E[X]]=E[X]$

i.e. the two arrays would have equal expected values.

In our context, $X$ would be the array of specific risk estimates, while
$\bar{X}$ would be the array of average risk estimates. If our hypothesis is
correct, i.e. $R_{avg}^{\phi}$ is the average of $R_{sp}^{\phi}$, risk
estimates for records in $D_{target}$ would have a relationship consistent
with Theorem 1. Subsequently, this would also empirically show that the
randomness in the specific setup associated with the sampling of the reference
record only has a minor effect and is a good choice of randomness.

Empirically, this would mean that $\rho(S,\phi)$, the empirical correlation
value, and $\mathcal{V}(R_{avg}^{\phi},R_{sp}^{\phi})$, the square root of
variances value should be close to one another. Similarly, this means that
$\bar{R}^{\phi}_{avg}$ and $\bar{R}^{\phi}_{sp}$ should be close to one
another. To evaluate whether these relationships hold we compute
$\rho(S,\phi)$ and $\mathcal{V}(R_{avg}^{\phi},R_{sp}^{\phi})$ in every
settings of our experiments.

Table 3 shows how $\rho(S,\phi)$ and
$\mathcal{V}(R_{avg}^{\phi},R_{sp}^{\phi})$ are close to each others across
datasets and metrics and for both ML models and synthetic data generators.
This empirical relationship between $R_{avg}^{\phi}$ and $R_{sp}^{\phi}$ is
consistent with the hypothesis that the average risk is the mean of the
specific risk and provide evidence that weight initialization is an
appropriate source of randomness.

Table 3: $\rho(R_{avg}^{\phi},R_{sp}^{\phi})$ and
$\mathcal{V}(R_{avg}^{\phi},R_{sp}^{\phi})$ values across different datasets,
ML models and synthetic data generators for $AUC$ and $TPR$.

| Adult | Census | CIFAR10
---|---|---|---
| Synthpop | Baynet | ML classifier | Synthpop | Baynet | ML classifier
| AUC | TPR | AUC | TPR | AUC | TPR | AUC | TPR | AUC | TPR | AUC | TPR
$\rho$ | 0.65 | 0.68 | 0.85 | 0.76 | 0.68 | 0.63 | 0.80 | 0.72 | 0.85 | 0.78 | 0.88 | 0.82
$\mathcal{V}$ | 0.63 | 0.60 | 0.85 | 0.73 | 0.75 | 0.78 | 0.75 | 0.68 | 0.88 | 0.72 | 0.81 | 0.78

##  7 MIA by a Strong Adversary

We have so far compared evaluation setups using SOTA attacks from the
literature. These assume the attacker to have access to an auxiliary dataset
drawn from the same distribution but strictly non overlapping with
$D_{target}$.

We now instantiate an MIA attack by a very strong attacker with knowledge of
all the evaluation datasets including the training dataset $D_{target}$,
similar to the standard DP attacker. In the average case, this means an
attacker with access to the exact shadow models–thus datasets sampled from
$D_{eval}$–used for MIA evaluation. In the specific case, this means an
attacker with access to the full target dataset $D_{target}$.

We instantiate the stronger attack in our standard setup (Synthpop with the
Adult dataset) and run the attack on 500 different target records randomly
sampled from $D_{target}$. We compare the performance of the strong attacker
to the attacker with only access to auxiliary data used previously (Sec. 4.1),
which we refer to as the classic attack.

Fig. 3 shows the strong attacker to be able to achieve a substantially higher
AUC $0.792\pm 0.092$ (mean and standard deviation) than the classic attacker
with access to an auxiliary dataset ($0.601\pm 0.092$) in the specific setup.
This is, however, not the case in the average setup where the strong attacker
only achieves an AUC of $0.636\pm 0.054$ compared to the $0.600\pm 0.060$
achieved by the classic attacker.

These results further emphasize the need to use a specific setup when
evaluating MIAs against machine learning models, especially as new stronger
attacks, leveraging knowledge of the training dataset, are likely to be
developed in the future. Indeed, while we here focus on a very strong
attacker, akin to the standard DP attacker, new attacks could leverage partial
knowledge of the target dataset e.g. information leaked by the released
synthetic dataset or knowledge about a specific part of the dataset where the
target record would lie.

Figure 3: AUC results for the classic and stronger attack for $500$ points
randomly sampled from $D_{target}$, for both the average and the specific
setup.

##  8 Conclusion and limitations

Our work shows that the current source of randomness used to evaluate MIAs
against machine learning models is incorrectly averaging the risk across
datasets. We instead propose to use a specific setup with weight
initialization as the only source of randomness. Using existing state-of-the-
art MIAs, we compare the results obtained in the average setup with those
obtained in the specific setup and show them to lead to a high number of
records to be misclassified as low risk. We show this to be true across more
than 10 combinations of datasets, MIA metrics, and ML models including
generative and predictive models. We then derive theoretical results which,
combined with empirical evidence, strongly suggest that the risk calculated in
the current setup is an average of the risks specific to each dataset sampled
for testing. We argue these results validate our use of weight initialization
as the (only) source of randomness necessary to evaluate MIAs against ML
models. We finally instantiate an MIA by a very strong attacker and show the
risk posed by this attack to be captured by the specific setup while leading
to the same result as the (much weaker) attacker with access to an auxiliary
dataset in the average setup.

Taken together, our results strongly emphasize the need to evaluate the
effectiveness of MIA attacks against machine learning model in a specific
setup. In particular, we show weight initialisation to be a good source of
randomness.

#### Broader impact.

Our work adds to the existing literature on privacy risk evaluation
[aerni2024evaluations, stadler2022synthetic, carlini2022privacy] and, in
particular, enables more accurate record-level risk estimation when releasing
machine learning models. We hope this work to help entities dealing with
highly sensitive data, such as those in healthcare [lotan2020medical] or the
financial sector [fca_synth], to better understand the potential data leakage
when releasing machine learning models and ensure a high standard of privacy.
We believe this work to be particularly impactful for statistical “outliers”,
i.e. individuals whose data are significantly different from others, and to
help ensure that their privacy is preserved to an equal standard as that of
people whose data is closer to the average. Finally, we note that our results
might lead to the development of stronger attacks which could be used by
malicious adversaries. However, we believe that the knowledge our work
provided to data controllers and for further research outweighs the potential
risk.

#### Limitations.

The first limitation of our work is the fact that we perform and evaluate two
attacks: the query-based attack [houssiau2022tapas] for synthetic data
generators, and LiRA [carlini2022membership] for ML models. Though these two
attacks are the current state-of-the-art for their respective models, there
might exist attacks that are less sensitive to outliers and therefore to the
evaluation setup. Second, we provide intuition about the properties of
datasets where using the average instead of the specific evaluation setup
might lead to incorrect conclusions. More specifically, we hypothesise that
small datasets are particularly vulnerable, but due to the computational cost
of training and evaluating MIAs, we were unable to conduct a full study on
this topic. Finally, we show how the effectiveness of attacks relying on
stronger assumptions, namely some knowledge of the target dataset, might be
currently be under-evaluated. The attack we instantiate however relies on a
very stronger adversary which, while considered by Differential Privacy, might
not be not realistic in general. Further work is thus necessary to evaluate
whether and when stronger but generally realistic attacks might exist.

#### Acknowledgements

We acknowledge computational resources and support provided by the Imperial
College Research Computing Service. ***http://doi.org/10.14469/hpc/2232.

## References

  * Aerni et al., [2024] Aerni, M., Zhang, J., and Tramèr, F. (2024).  Evaluations of machine learning privacy defenses are misleading.  arXiv preprint arXiv:2404.17399.
  * Alan Turing Institute, [2022] Alan Turing Institute (2022).  Reprosyn.  https://github.com/alan-turing-institute/reprosyn.  This work is licensed under the MIT license. To view a copy of this license, please visit https://github.com/alan-turing-institute/reprosyn/blob/main/LICENSE.
  * Annamalai et al., [2023] Annamalai, M. S. M. S., Gadotti, A., and Rocher, L. (2023).  A linear reconstruction approach for attribute inference attacks against synthetic data.  arXiv preprint arXiv:2301.10053.
  * Ateniese et al., [2015] Ateniese, G., Mancini, L. V., Spognardi, A., Villani, A., Vitali, D., and Felici, G. (2015).  Hacking smart machines with smarter ones: How to extract meaningful data from machine learning classifiers.  International Journal of Security and Networks, 10(3):137–150.
  * Becker and Kohavi, [1996] Becker, B. and Kohavi, R. (1996).  Adult.  UCI Machine Learning Repository.  DOI: https://doi.org/10.24432/C5XW20. This work is licensed under the Creative Commons Attribution 4.0 International License. To view a copy of this license, visit http://creativecommons.org/licenses/by/4.0/.
  * [6] Carlini, N., Chien, S., Nasr, M., Song, S., Terzis, A., and Tramèr, F. (2022a).  Membership inference attacks from first principles.  In 2022 IEEE Symposium on Security and Privacy (SP), pages 1897–1914.
  * [7] Carlini, N., Jagielski, M., Zhang, C., Papernot, N., Terzis, A., and Tramer, F. (2022b).  The privacy onion effect: Memorization is relative.  Advances in Neural Information Processing Systems, 35:13263–13276.
  * Choquette-Choo et al., [2021] Choquette-Choo, C. A., Tramer, F., Carlini, N., and Papernot, N. (2021).  Label-only membership inference attacks.  In International conference on machine learning, pages 1964–1974. PMLR.
  * Dr Henrike Mueller, Leo Gosland, Owen Courtney, Pavle Avramovic, Valerie Marshall, [2023] Dr Henrike Mueller, Leo Gosland, Owen Courtney, Pavle Avramovic, Valerie Marshall (2023).  Can synthetic data enable data sharing in financial services?  https://oecd.ai/en/wonk/synthetic-data-financial-services.
  * Feldman and Zhang, [2020] Feldman, V. and Zhang, C. (2020).  What neural networks memorize and why: discovering the long tail via influence estimation.  In Proceedings of the 34th International Conference on Neural Information Processing Systems, NIPS ’20, Red Hook, NY, USA. Curran Associates Inc.
  * Gary Benedetto, Jordan C. Stanley, and Evan Totty, [2018] Gary Benedetto, Jordan C. Stanley, and Evan Totty (2018).  The creation and use of the sipp synthetic beta v7.0.  https://www.census.gov/library/working-papers/2018/adrm/SIPP-Synthetic-Beta.html.
  * Hayes et al., [2019] Hayes, J., Melis, L., Danezis, G., and De Cristofaro, E. (2019).  Logan: Membership inference attacks against generative models.  Proceedings on Privacy Enhancing Technologies, 2019:133–152.
  * Hazy, [2019] Hazy (2019).  Synthpop.  https://github.com/hazy/synthpop.
  * He et al., [2016] He, K., Zhang, X., Ren, S., and Sun, J. (2016).  Deep residual learning for image recognition.  In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR).
  * Homer et al., [2008] Homer, N., Szelinger, S., Redman, M., Duggan, D., Tembe, W., Muehling, J., Pearson, J. V., Stephan, D. A., Nelson, S. F., and Craig, D. W. (2008).  Resolving individuals contributing trace amounts of dna to highly complex mixtures using high-density snp genotyping microarrays.  PLoS genetics, 4(8):e1000167.
  * Houssiau et al., [2022] Houssiau, F., Jordon, J., Cohen, S. N., Daniel, O., Elliott, A., Geddes, J., Mole, C., Rangel-Smith, C., and Szpruch, L. (2022).  Tapas: a toolbox for adversarial privacy auditing of synthetic data.  arXiv preprint arXiv:2211.06550.
  * Krizhevsky et al., [2009] Krizhevsky, A., Hinton, G., et al. (2009).  Learning multiple layers of features from tiny images.  https://www.cs.toronto.edu/~kriz/cifar.html.
  * Leclerc et al., [2023] Leclerc, G., Ilyas, A., Engstrom, L., Park, S. M., Salman, H., and Madry, A. (2023).  FFCV: Accelerating training by removing data bottlenecks.  In Computer Vision and Pattern Recognition (CVPR).  https://github.com/libffcv/ffcv/. commit xxxxxxx.
  * Leino and Fredrikson, [2020] Leino, K. and Fredrikson, M. (2020).  Stolen memories: Leveraging model memorization for calibrated $\\{$White-Box$\\}$ membership inference.  In 29th USENIX security symposium (USENIX Security 20), pages 1605–1622.
  * Lotan et al., [2020] Lotan, E., Tschider, C., Sodickson, D. K., Caplan, A. L., Bruno, M., Zhang, B., and Lui, Y. W. (2020).  Medical imaging and privacy in the era of artificial intelligence: myth, fallacy, and the future.  Journal of the American College of Radiology, 17(9):1159–1162.
  * Meeus et al., [2023] Meeus, M., Guepin, F., Creţu, A.-M., and de Montjoye, Y.-A. (2023).  Achilles’ heels: vulnerable record identification in synthetic data publishing.  In European Symposium on Research in Computer Security, pages 380–399. Springer.
  * Nasr et al., [2019] Nasr, M., Shokri, R., and Houmansadr, A. (2019).  Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning.  In 2019 IEEE symposium on security and privacy (SP), pages 739–753. IEEE.
  * Office for National Statistics, [2011] Office for National Statistics (2011).  Census microdata teaching files.  https://www.ons.gov.uk/census/2011census/2011censusdata/censusmicrodata/microdatateachingfile.  This work is licensed under the Open Government License v3.0. To view a copy of this license, please visit https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/.
  * Paszke et al., [2019] Paszke, A., Gross, S., Massa, F., Lerer, A., Bradbury, J., Chanan, G., Killeen, T., Lin, Z., Gimelshein, N., Antiga, L., Desmaison, A., Kopf, A., Yang, E., DeVito, Z., Raison, M., Tejani, A., Chilamkurthy, S., Steiner, B., Fang, L., Bai, J., and Chintala, S. (2019).  Pytorch: An imperative style, high-performance deep learning library.  In Advances in Neural Information Processing Systems 32, pages 8024–8035. Curran Associates, Inc.
  * Pedregosa et al., [2011] Pedregosa, F., Varoquaux, G., Gramfort, A., Michel, V., Thirion, B., Grisel, O., Blondel, M., Prettenhofer, P., Weiss, R., Dubourg, V., et al. (2011).  Scikit-learn: Machine learning in python.  Journal of machine learning research, 12(Oct):2825–2830.
  * Pyrgelis et al., [2017] Pyrgelis, A., Troncoso, C., and De Cristofaro, E. (2017).  Knock knock, who’s there? membership inference on aggregate location data.  arXiv preprint arXiv:1708.06145.
  * Salem et al., [2018] Salem, A., Zhang, Y., Humbert, M., Berrang, P., Fritz, M., and Backes, M. (2018).  Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models.  arXiv preprint arXiv:1806.01246.
  * Sankararaman et al., [2009] Sankararaman, S., Obozinski, G., Jordan, M. I., and Halperin, E. (2009).  Genomic privacy and limits of individual detection in a pool.  Nature genetics, 41(9):965–967.
  * Shokri et al., [2017] Shokri, R., Stronati, M., Song, C., and Shmatikov, V. (2017).  Membership inference attacks against machine learning models.  In 2017 IEEE symposium on security and privacy (SP), pages 3–18. IEEE.
  * Stadler et al., [2022] Stadler, T., Oprisanu, B., and Troncoso, C. (2022).  Synthetic data – anonymisation groundhog day.
  * Synthetic Data Expert Group, Financial Conduct Authority, [2024] Synthetic Data Expert Group, Financial Conduct Authority (2024).  Report: Using synthetic data in financial services.  https://www.fca.org.uk/publications/corporate-documents/report-using-synthetic-data-financial-services.
  * Yeom et al., [2018] Yeom, S., Giacomelli, I., Fredrikson, M., and Jha, S. (2018).  Privacy risk in machine learning: Analyzing the connection to overfitting.  In 2018 IEEE 31st Computer Security Foundations Symposium (CSF), pages 268–282, Los Alamitos, CA, USA. IEEE Computer Society.
  * Zhang et al., [2017] Zhang, J., Cormode, G., Procopiuc, C. M., Srivastava, D., and Xiao, X. (2017).  Privbayes: Private data release via bayesian networks.  ACM Trans. Database Syst., 42(4).

## Appendix

##  Appendix A Supplementary proof

See 1

###### Proof.

[Proof of Theorem 1] Let $X=[X_{1},\cdots,X_{n}]$, with
$\forall~{}i~{}|~{}X_{i}$ being a random variable of mean $\mu_{i}$ and
standard deviation $\sigma_{i}$, and let $\bar{X}=[\mu_{1},\cdots,\mu_{n}]$.

Then, since $\rho(X,\bar{X})=\frac{cov(X,\bar{X})}{\sqrt{V(X)\cdot
V(\bar{X})}}$, by performing a member by member evaluation, we have:

$\displaystyle\rho(X,\bar{X})=\frac{\sum_{i}(X_{i}-\frac{1}{n}\sum_{k}X_{k})\cdot(\mu_{i}-\frac{1}{n}\sum_{k}\mu_{k})}{\sqrt{V(X)\cdot
V(\bar{X})}}$

which gives us :

$\displaystyle
E[\rho(X,\bar{X})]=\frac{\sum_{i}E[(X_{i}-\frac{1}{n}\sum_{k}X_{k})](\mu_{i}-\frac{1}{n}\sum_{k}\mu_{k})]}{\sqrt{V(X)\cdot
V(\bar{X})}}$

by linearity. Then, it follows

$\displaystyle E[\rho(X,\bar{X})]$
$\displaystyle=\frac{\sum_{i}(E[X_{i}]-\frac{1}{n}\sum_{k}E[X_{k}])(\mu_{i}-\frac{1}{n}\sum_{k}\mu_{k})}{\sqrt{V(X)\cdot
V(\bar{X})}}$
$\displaystyle=\frac{\sum_{i}(\mu_{i}-\frac{1}{n}\sum_{k}\mu_{k})^{2}}{\sqrt{V(X)\cdot
V(\bar{X})}}$ $\displaystyle=\frac{V(\bar{X})}{\sqrt{V(X)\cdot V(\bar{X})}}$
$\displaystyle E[\rho(X,\bar{X})]$
$\displaystyle=\sqrt{\frac{V(\bar{X})}{V(X)}}$

∎

##  Appendix B AUC robustness

We run an experiment to determine the best number of evaluation models $N$ for
the Adult dataset and $\mathcal{M}_{target}$ Synthpop. For value $N$, we
perform the full average and specific evaluation pipeline using $N$ evaluation
models, and calculate and log the AUC. We repeat this 10 times for the same
$N$, each time sampling new evaluation datasets in the average setup, and
training new evaluation models in both setups. For each iteration, we
calculate and log the AUC value. We then calculate the standard deviation of
the 10 AUC values for $N$. We do this process for $N\in\\{100,200,300,\cdots
2000\\}$ for $10$ target records. Figure 4(a) presents the standard deviations
per $N$, aggregated over the 10 records. We select $N=1000$ as the standard
deviation converges to approximately $0.01$ at that point.

We do the same experiment for Adult and $\mathcal{M}_{target}$ a binary
classifier. In this case, we use 5 records and repeat the evaluation pipelines
5 times. We run for less records and times due to the computational cost of
this experiment. For $\mathcal{M}_{target}$ a binary classifier, we select
$N=500$, as it provides a sufficiently low standard deviation ($0.02$), while
still being feasible to conduct our main experiments.

(a) $\mathcal{M}_{target}$ Synthpop

(b) $\mathcal{M}_{target}$ binary classifier

Figure 4: Standard deviation of the AUC as a function of the number of
evaluation models used to calculate AUC Adult dataset.

##  Appendix C Detailed Evaluation Steps

In this section, we provide detailed steps for the average and specific
evaluation setups. In Algorithm 2 we provide steps for evaluating an MIA in
the average setup. Algorithm 1 presents the steps for the specific evaluation
setup.

Algorithm 1 Specific MIA evaluation setup

Here we describe the pipeline for the specific evaluation setup for membership
inference attacks. We denote with $f_{\mathcal{M}}$ the trained meta-
classifier (MIA). $D_{test}$ is the data available to the attacker which has
not been used to train $f_{\mathcal{M}}$. $D_{target}\subset D_{eval}$ the
target dataset, i.e. the dataset that will be used to train the model that
will be released, $x_{T}\in D_{target}$ the target record, and reference
record $x_{R}\in D_{eval}$, $x_{R}\notin D_{target}$.

1:Instantiate prediction set $Y_{pred}=\emptyset$.

2:Instantiate model initialization seed array $l_{seed}$, $|l_{seed}|=N$

3:for i = $0\cdots\frac{N}{2}$ do

4: Train evaluation model $\mathcal{M}_{IN}$ with initialization seed
$l_{seed}[2*i]$

5: Sample reference record $x_{R}$ from $D_{eval}\setminus D_{target}$

6: Remove $x_{T}$ from $D$ and replace with $x_{R}$ to construct dataset
$D_{OUT}$

7: Train model $\mathcal{M}_{OUT}$ with seed $l_{seed}[2*i+1]$

8: Add label-prediction pairs $(IN,f_{\mathcal{M}}(\mathcal{M}_{IN}))$ and
$(OUT,f_{\mathcal{M}}(\mathcal{M}_{OUT}))$ to $Y_{pred}$

9:end for

10: Calculate privacy risk using chosen metric based on prediction set
$Y_{pred}$

Algorithm 2 Average MIA evaluation setup

Here we describe the pipeline for the average evaluation setup for membership
inference attacks. We denote with $f_{\mathcal{M}}$ the trained meta-
classifier (MIA). $D_{eval}$ is the evaluation pool available to the attacker
which has not been used to train $f_{\mathcal{M}}$. $D_{target}\subset
D_{eval}$ is the target dataset, i.e. the dataset that will be used to train
the model that will be released, and $x_{T}\in D_{target}$ is the target
record.

1:Instantiate the training seed array $l_{seed}$, $|l_{seed}|=N$

2:for i = $0\cdots\frac{N}{2}$ do

3: Sample $D_{IN}\sim D_{eval}\setminus\\{x_{T}\\}$,
$|D_{IN}|=|D_{target}|-1$, and add $x_{T}$ to $D_{IN}$

4: Sample $D_{OUT}\sim D_{eval}\setminus\\{x_{T}\\}$, $|D_{OUT}|=|D_{target}|$

5: Train evaluation models $\mathcal{M}_{IN}$ with seed $l_{seed}[2*i]$ and
$\mathcal{M}_{OUT}$ with $l_{seed}[2*i+1])$.

6: Add label-prediction pairs $(IN,f_{\mathcal{M}}(\mathcal{M}_{IN}))$ and
$(OUT,f_{\mathcal{M}}(\mathcal{M}_{OUT}))$ to $Y_{pred}$

7:end for

8:Calculate privacy risk using chosen metric based on prediction set
$Y_{pred}$

##  Appendix D Experimental Setup

Table 4 shows the details for training and evaluating the MIA for each dataset
and target model. For target models Synthpop and Baynet (for both datasets),
we use the query-based attack introduced by houssiau2022tapas, and for ResNet
and neural network (NN), we use LiRA [carlini2022membership]. We train a
standard ResNet and a neural network with 1 layer with 100 nodes.

Table 4: Experimental details. $N_{shadow}$ represents the number of shadow models used to train the MIA, and $N_{eval}$ represents the number of evaluation models used. Dataset | $\mathcal{M}_{target}$ | Library | $|D_{aux}|$ | $|D_{eval}|$ | $|D_{target}|$ | $N_{shadow}$ | $N_{eval}$
---|---|---|---|---|---|---|---
Adult [misc_adult_2] | Synthpop [synthpop2022] | Reprosyn [reprosyn2022] | 30000 | 15222 | 1000 | 1000 | 1000
Baynet [baynet]
NN | sk-learn [pedregosa2011scikit] | 2000 | 500 | 500
UK Census [census2011] | Synthpop [synthpop2022] | Reprosyn [reprosyn2022] | 52390 | 27193 | 1000 | 1000 | 1000
Baynet [baynet]
CIFAR10 [krizhevsky2009learning] | ResNet [resnet] | PyTorch [pytorch] | 30000 | 30000 | 10000 | 256 | 256
FFCV [leclerc2023ffcv]

##  Appendix E Resources necessary to conduct the experiments

All of our experiments, except those for CIFAR10, where conducted using only
CPUs in series. We provide the following table to specify the time taken to
train an MIA and run the specific and average evaluation pipeline on a single
target record. Experiments were run using either a machine with 96 CPUs and
500GB of RAM or a machine with 200 CPUs and 910 GB of RAM.

Table 5: CPU time to run each of our experiments on a single record Target model $\mathcal{M}_{target}$ | dataset | CPU time (hours)
---|---|---
Synthpop | Adult | 1.2
Census | 2.2
Baynet | Adult | 2.5
Census | 4.2
Binary-classifier | Adult | 1.0

For the CIFAR10 experiments, we use the open-source FFCV [leclerc2023ffcv]
library to train each evaluation model in approximately 20 seconds on one
NVIDIA A100 GPU. The total time taken to train an MIA and run both the
specific and average evaluation pipelines is approximately 5.5 hours per
record. We use a machine with two NVIDIA A100 GPUs and 490GB of RAM.


# Dynamics of $\vartheta$-solitons in the HPD state of superfluid 3He-B

V. V. Zavjalov e-mail<EMAIL_ADDRESS>
(23-12-2021)

###### Abstract

In this note we present numerical study of spin dynamics of
$\vartheta$-soliton in Homogeneously precessing domain (HPD) in superfluid
3He-B. The soliton consists of a small heavy core and long tails, in 1D
simulation we observe their mutual motion. We also discuss mass density and
tension of the soliton membrane and its 3D oscillations in a cylindrical cell.

## Introduction

Spin degrees of freedom in superfluid 3He-B have spontaneously broken SO3
symmetry [1]. State of the system can be described by a rotation matrix
$R({\bf n},\vartheta)$ with axis $\bf n$ and rotation angle $\vartheta$. Spin-
orbit interaction reduces the symmetry by fixing angle $\vartheta$ at value
$\vartheta_{L}=\arccos(-1/4)\approx\pm 104^{\circ}$. In this system so-called
$\vartheta$-solitons are possible where $\vartheta$ changes between
$\vartheta_{L}$ and $2\pi-\vartheta_{L}$.

In a usual NMR experiment 3He sample is placed in constant magnetic field
$H_{z}$ along $\bf\hat{z}$ axis and perpendicular radio-frequency (RF) field
$H_{x}$ rotating around $H_{z}$ with angular velocity $\omega$. Depending on
frequency shift $\omega-\gamma H_{z}$ and amplitude of $H_{x}$ this system can
be in two states: Homogeneously-precessing domain (HPD) and Non-precessing
domain (NPD) [2, 3]. $\vartheta$-solitons can exist in both states. In NPD
they have only a small core where angle $\vartheta$ is changing. Size of the
core is about 10..40 $\mu$m, it is determined by so-called dipolar length
(ratio of gradient energy and energy of spin-orbit interaction). Analytical
description of solitons in NPD is quite simple [4]. In HPD things are much
more complicated. The core is surrounded by long tails where $\vartheta$ has
equilibrium value, but direction of vector $\bf n$ is changing. Theoretical
discussion of solitons in HPD can be found in [5]. In experiments
$\vartheta$-solitons have been observed together with another type of
topological defect, spin-mass vortex, in rotating 3He-B [6].

Figure 1: Schematic representation of $\vartheta$-soliton in 3He-B. See
description in the text.

On Fig. 1 a schematic picture of $\vartheta$-soliton in HPD is shown in $\bf
n\vartheta$ coordinates (vector with direction of $\bf n$ and absolute value
of $\vartheta$). Each state of rotation matrix can be uniquely represented by
a single point inside a sphere with radius $\pi$ (solid circle). Points
outside the sphere can be mapped inside by adding integer number of $2\pi$
rotations to $\vartheta$. Dashed circles represent minimum of spin-orbit
interaction, $\cos\vartheta=-1/4$. Points NPD+, NPD-, and HPD are equilibrium
states. Without RF field HPD spontaneously breaks rotational symmetry and can
exist in any point where $n_{z}=0$, $\vartheta=\vartheta_{L}$, but presence of
RF pumping along $\hat{\bf x}$ stabilize HPD at $n_{y}=1$. $\vartheta$-soliton
in HPD is schematically shown by thick magenta line. Dashed line is equivalent
path which can be obtained from the solid line by subtracting $2\pi$ from
value of $\vartheta$. For simplicity picture is drawn in $y-z$ plane, real
solitons have a non-zero $n_{x}$ component.

This work is motivated by our experiments in 2017 in Helsinki (still
unpublished) where we observed unexpected oscillation modes in HPD. These
modes were localized in different parts of the experimental cell and had
frequencies increasing with frequency shift. One of suggestions was that they
are oscillations of $\vartheta$-solitons.

## Numerical simulation of spin dynamics of 3He-B

Dynamics of matrix $R({\bf n},\vartheta)$ and spin $\bf S$ in superfluid 3He-B
is described by Leggett equations [7]. We write them in a frame rotating
around $\bf\hat{z}$ axis with angular velocity $\omega$ and solve 1D problem
with only $z$-coordinate dependence:

$\displaystyle\dot{\bf S}$ $\displaystyle=$ $\displaystyle{\bf
S}\times(\gamma{\bf H}-\omega{\bf\hat{z}})$ $\displaystyle+{\bf T}^{D}+{\bf
T}^{\nabla}+\mathcal{R}^{SD},$ $\displaystyle{\bf\dot{n}}$ $\displaystyle=$
$\displaystyle-\frac{1}{2}\ {\bf
n}\times\Big{[}2\,\omega{\bf\hat{z}}+\Big{(}\frac{\gamma^{2}}{\chi}{\bf
S}-\gamma{\bf H}\Big{)}$ $\displaystyle+\frac{\sin\vartheta}{1-\cos\vartheta}\
{\bf n}\times\Big{(}\frac{\gamma^{2}}{\chi}{\bf S}-\gamma{\bf
H}\Big{)}\Big{]},$ $\displaystyle\dot{\vartheta}$ $\displaystyle=$
$\displaystyle{\bf n}\cdot\Big{(}\frac{\gamma^{2}}{\chi}{\bf S}-\gamma{\bf
H}\Big{)}+\mathcal{R}^{LT}.$

Here $\gamma$ is gyromagnetic ratio of 3He, $\bf H$ is external magnetic
field, $\chi$ is magnetic susceptibility. We use magnetic field which is
constant in the rotating frame:

$\gamma{\bf H}=\gamma H_{x}{\bf\hat{x}}+\gamma
H_{z}{\bf\hat{z}}=\omega_{x}{\bf\hat{x}}+\omega_{z}{\bf\hat{z}},$ (2)

and introduce frequency shift $\delta\omega=2\pi\,\delta f=\omega_{z}-\omega$.

Dipolar torque ${\bf T}^{D}$ comes from spin-orbit interaction and can be
written as

$\displaystyle{\bf T}^{D}=\frac{4\Omega_{B}^{2}\chi}{15\gamma^{2}}\
\sin\vartheta(4\cos\vartheta+1)\ {\bf n},$ (3)

where strength of the interaction is represented by parameter $\Omega_{B}$,
Leggett frequency.

Gradient torque ${\bf T}^{\nabla}$ can be written as

$\displaystyle T_{a}^{\nabla}$ $\displaystyle=$
$\displaystyle\frac{\chi}{\gamma^{2}}\
e_{abc}R_{cj}\Big{[}(c_{\perp}^{2}-c_{\parallel}^{2}/2)R_{bj}^{\prime\prime}$
(4) $\displaystyle+$ $\displaystyle
2(c_{\parallel}^{2}-c_{\perp}^{2})R_{b3}^{\prime\prime}\delta_{j3}\Big{]},$

where $c_{\parallel}$ and $c_{\perp}$ are spin-wave velocities [8], and primes
are derivatives over $z$ coordinate. Expression for gradient torque via $\bf
n$ and $\vartheta$ is huge, we are not writing it here.

There are two relaxation terms: spin diffusion $\mathcal{R}^{SD}$ and Leggett-
Takagi relaxation $\mathcal{R}^{LT}$:

$\displaystyle\mathcal{R}^{SD}$ $\displaystyle=$ $\displaystyle D\ {\bf
S}^{\prime\prime},$ (5) $\displaystyle\mathcal{R}^{LT}$ $\displaystyle=$
$\displaystyle\frac{4}{15}\ \sin\vartheta(4\cos\vartheta+1)\ \frac{1}{\tau}$

with two additional parameters: spin diffusion coefficient $D$ and Leggett-
Takagi relaxation time $\tau$. In general, spin diffusion coefficient is a
tensor, but for 1D problem only a single component $D=D_{zz}$ enters the
formula (see [3]).

We use PDECOL algorithm [9, 10] for integrating equations (Numerical
simulation of spin dynamics of 3He-B) numerically. Original program have been
written a long time ago by V.Dmitriev, we made a few modifications [11] for
this work: Instead of using seven coordinates ($\bf S$, $\bf n$, and
$\vartheta$) we use six, $\bf S$ and $\vartheta{\bf n}$. By doing this we
avoid additional constraint $|{\bf n}|=1$, uncertainty at $\sin\vartheta=0$,
and unphysical difference between ($\vartheta$, $\bf n$) and ($-\vartheta$,
$-\bf n$) states. We use non-uniform adaptive mesh in the calculation, which
is important because solitons have two different scales: micron-size core and
millimeter-size tails. To stabilize the soliton we use exact solution for
soliton core in NPD as initial conditions. It can be obtained from Leggett
equations by setting all time derivatives to zero and using ${\bf
n}={\bf\hat{z}}$. This leads to a differential equation:

$\frac{12}{13}\xi_{D}^{2}\
\vartheta^{\prime\prime}=-\sin\vartheta(4\cos\vartheta+1),$ (6)

where a conventional definition of dipolar length
$\xi_{D}^{2}=\frac{65}{16}(2c_{\perp}^{2}-c_{\parallel}^{2})/\Omega_{B}^{2}$
is used. Solving it with appropriate boundary conditions we get soliton
profile:

$\vartheta=2\tan^{-1}\left[\sqrt{\frac{3}{5}}\tanh\left(\sqrt{\frac{65}{64}}\
\frac{\pm z}{\xi_{D}}\right)\right]+\pi.$ (7)

One more problem we met in calculation was mobility of the soliton. To
localize it we use a small recess in Leggett frequency profile, 5-10% decrease
at $\xi_{D}$ width. Soliton with its large spin-orbit energy is pinned by this
feature. By varying pinning strength we can check how this method affects
calculation results. We see that there is no noticeable effect on soliton
oscillation frequency and only a small change (${<}1$%) in soliton mass
calculation.

We use frequency 1.124 MHz, and cell length 0.9 cm, same as we had in the
experiment. The soliton is created in the middle of the cell and stabilized by
waiting long enough time, changing relaxation terms, or doing averaging of
motion over some time and using result as new initial conditions. Starting
from a stable state with the soliton we excite oscillations by a small change
of frequency shift (which is equivalent to a small step in static magnetic
field) and record components of integral magnetization. Fourier spectrum of
magnetization is fitted using a model signal which is sum of a few decaying
harmonic oscillations. We observed both oscillations of the soliton and
uniform HPD oscillations [12]. Frequency of uniform oscillations is known, it
can be used as an additional check of calculation accuracy:

$\Omega^{2}=\frac{4}{\sqrt{15}}\
\frac{\omega_{x}\omega\,\Omega_{B}^{2}}{\omega^{2}+8/3\,\Omega_{B}^{2}}.$ (8)

With this excitation method we usually observe two first modes of soliton
oscillations. Third and forth modes are much weaker and can be seen only at
some conditions.

## Results

Figure 2: Soliton profile: angle $\vartheta$, polar ($\beta_{n}$) and
azimuthal ($\alpha_{n}$) angles of $\bf n$ vs. coordinate $z$. Dashed color
lines near $\alpha_{n}$ profile show main mode of soliton oscillations. Inset:
$\beta_{n}$ vs. $\alpha_{n}$ plot. The figure is calculated with
$c_{\perp}=1115$ cm/s, $\Omega_{B}/2\pi=235.8$ Hz (which corresponds to
$T=0.6~{}Tc,P=25.7$ bar), $D=0.01$ cm2/s, no Leggett-Takagi relaxation,
$H_{x}=4$ mG, frequency shift $\delta f$ = 40 Hz.

On Fig. 2 an example of soliton equilibrium profile is shown. Direction of
vector $\bf n$ is represented by polar and azimuthal angles, $\beta_{n}$, and
$\alpha_{n}$. One can see a small core where angle $\vartheta$ changes between
equilibrium values $\vartheta_{L}$ and $2\pi-\vartheta_{L}$ at distance $\sim
10\mu$m and tails where $\bf n$ is rotated at distance $\sim 1$ mm. It’s
interesting to see that soliton tails are slightly asymmetric (they go towards
different states, NPD+ and NPD- ), and that in the center vector $\bf n$ does
not reach vertical position as it was suggested in [5]. Soliton core is not
just change of $\vartheta$, it also includes rotation of $\bf n$ by some
noticeable angle. Main mode of soliton oscillations is shown by dashed color
lines. In this mode the soliton tail is rotating around vertical axis, only
azimuthal angle $\alpha_{n}$ is changing.

Figure 3: Oscillation frequencies as a function of frequency shift.
Calculation is done for $\Omega_{B}/2\pi=100$ kHz, $c_{\perp}=1000$ cm/s,
$H_{x}=8$ mG. One can see four soliton oscillation modes (labeled “1”..“4”)
and HPD uniform mode (labeled “U”). Inset shows an example of magnetization
spectrum at frequency shift $\delta f=40$ Hz. Lines are fits to formula (9)
with free parameters $B$ and $C$. Figure 4: Frequencies of soliton modes 1 and
2 as a function of frequency shift for three different values of RF pumping: 4
mG (magenta points), 8 mG (green points), 12 mG (blue points). Calculation is
done for $T=0.6\,T_{c}$, $P=25.7$ bar ($\Omega_{B}/2\pi=235.8$ kHz,
$c_{\perp}=1115$ cm/s). Lines are drawn using approximation formulas (9) and
(10).

On Fig. 3 oscillation frequencies are shown as a a function of frequency
shift. The highest, shift-independent mode is uniform HPD oscillations (8),
others are oscillations of the soliton. We found that frequencies of all
soliton modes as a function of frequency shift $\delta\omega$ can be written
as:

$\displaystyle\Omega^{2}$ $\displaystyle=$ $\displaystyle
B\,\omega(\delta\omega\pm\omega_{x}/\sqrt{15})+C\,\delta\omega^{2}$ (9)

with “$+$” sign for modes 1, 2 and “$-$” for modes 3, 4. There is no exact
theory behind this formula, it’s just an approximation which works for all
observed modes. Note that ratio $\sqrt{15}$ between RF pumping and frequency
shift is special for HPD: at $\delta\omega<\omega_{x}/\sqrt{15}$ uniform HPD
state becomes unstable. Parameters $B$ and $C$ depend only on RF pumping
amplitude $\omega_{x}$ and Leggett frequency $\Omega_{B}$. Me have measured
modes 1 and 2 for $P=25.7$ bar, $T=0.6\ldots 0.9T_{c}$, $H_{x}=4\ldots 12$ mG
and found approximation formulas (see Fig. 4):

$\displaystyle B_{1,2}$ $\displaystyle=$
$\displaystyle\sqrt{\frac{\omega_{x}}{\omega}}\left(\frac{1}{107}+372\frac{\omega_{x}}{\omega}\right),$
(10) $\displaystyle C_{1}$ $\displaystyle=$ $\displaystyle
0.278+27.4\sqrt{\frac{\omega_{x}}{\Omega_{B}}}\left(1+0.04\frac{\omega}{\Omega_{B}}\right),$
$\displaystyle C_{2}$ $\displaystyle=$ $\displaystyle
1.16+319\sqrt{\frac{\omega_{x}}{\Omega_{B}}}\left(1+0.08\frac{\omega}{\Omega_{B}}\right).$

We also found that relaxation of soliton oscillations is determined by spin
diffusion, but not Leggett-Takagi relaxation.

## Oscillation of a soliton membrane

Let’s calculate mass density, associated with a soliton. First we solve second
and third Leggett equations (Numerical simulation of spin dynamics of 3He-B)
for spin:

$\displaystyle\frac{\gamma^{2}}{\chi}{\bf S}$ $\displaystyle=$
$\displaystyle\gamma{\bf H}+{\bf n}\ \dot{\vartheta}$ $\displaystyle+$
$\displaystyle(1-\cos\vartheta)\ {\bf n}\times({\bf\dot{n}}+{\bf
n}\times\omega{\bf\hat{z}})$ $\displaystyle+$ $\displaystyle\sin\vartheta\
({\bf\dot{n}}+{\bf n}\times\omega{\bf\hat{z}}).$

From this formula one can see how spin is created by magnetic field and by
motion of ${\bf n}$ and $\vartheta$. There are also terms with $\omega$ which
come from rotation of the frame. Consider a soliton which is moving with
velocity $v$ along ${\bf\hat{z}}$ axis. We can write
${\bf\dot{n}}=\frac{d}{dt}{\bf n}(z+v\,dt)=v\,{\bf n}^{\prime}$, and same for
$\vartheta$. Using formula (Oscillation of a soliton membrane) we can find
spin created by soliton motion. Energy associated with spin is
$F=\frac{\gamma^{2}}{2\chi}{\bf S}^{2}-({\bf S}\cdot\gamma{\bf H})$. Term
proportional to $v^{2}$ will give us mass density of the soliton:

$m=\frac{\chi}{\gamma^{2}}\left[(\vartheta^{\prime})^{2}+2(1-\cos\vartheta)\
({\bf n^{\prime}})^{2}\right]$ (12)

In this discussion we assumed that moving soliton have same profile as
stationary one. This is true for small velocities. Formula for a soliton
moving with arbitrary velocity can be found in [13].

Figure 5: Mass profile of a soliton. Total mass is split into two parts,
corresponding to two terms of (12). Calculated with same parameters as Fig. 2.
Figure 6: A: Ratio of soliton mass in HPD (total mass and mass of the core)
and in NPD as a function of frequency shift, for three different values of RF
pumping: 4 mG (magenta points), 8 mG (green points), 12 mG (blue points). B:
Ratio of wave velocity $C$ for soliton in HPD and in NPD.

Consider a $\vartheta$-soliton in NPD (6-7) pinned to walls of a cylindrical
cell perpendicular to cell axis. It can move as a circular membrane. We can
find mass $M$ of unit area by integrating (12) along $\bf\hat{z}$ axis. We
calculate tension $T$ of the membrane as total potential energy (gradient and
spin-orbit) of the soliton per unit area. We ignore additional gradient forces
which come from bending of the soliton because they are small if cell size is
bigger then soliton thickness. Using soliton profile (7) we obtain

$M=\frac{13}{3}\frac{\chi}{\gamma^{2}\xi_{D}^{2}}\int_{-\infty}^{+\infty}\Big{(}\cos\vartheta(z)+\frac{1}{4}\Big{)}^{2}dz,$
(13)
$T=\frac{16}{15}\frac{\chi\Omega_{B}^{2}}{\gamma^{2}}\int_{-\infty}^{+\infty}\Big{(}\cos\vartheta(z)+\frac{1}{4}\Big{)}^{2}dz.$
(14)

Ratio of tension and mass give square of wave velocity $C$ along the membrane,

$C^{2}=2c_{\perp}^{2}-c_{\parallel}^{2}.$ (15)

Oscillation frequencies of the membrane are determined by zeros of Bessel
functions, the first one for membrane radius $r$ is $2.405\,C/r$. For
$T=0.6~{}T_{c}$, $P=25.7$ bar, and $r=3.9$ mm this gives 1.7 kHz.

In numerical simulation we can find mass and tension of the soliton in HPD and
compare it with NPD case. It is also possible to separate masses of tail and
core of the soliton. On Fig. 5 example of mass density of a soliton in HPD is
presented. Mass is splitted into two parts which correspond to two terms in
(12): $m_{\vartheta}$ comes from motion of $\vartheta$, and $m_{\bf n}$ is
created by motion of $\bf n$. On Fig. 6 calculated mass and wave velocity of
soliton in HPD is compared with values for soliton in NPD (formulas 13 and
15).

## Conclusions

Homogeneously precessing domain is a well-defined system which can be used as
a sensitive tool for studying 3He properties. Understanding of topological
defects in this system should be important for future experiments. In this
work we developed numerical simulation of $\theta$-solitons in HPD. We
observed a few oscillation modes of soliton tails with respect to its core. We
also discuss 3D oscillations of the soliton membrane pinned to walls in both
HPD and NPD. One can imagine other oscillation modes in this system, for
example non-uniform motion of tails in the plane of the soliton.

We think that further theoretical, numerical, and experimental investigation
of $\theta$-solitons in HPD is needed. It is still not clear what is reliable
way of producing solitons in experiment, and were oscillation modes observed
in experiments mentioned above related to solitons.

## References

  * [1] D. Vollhardt and P. Wölfle  “The superfluid phases of helium 3”  TaylorFrancis, London, 1990
  * [2] A.S. Borovik-Romanov et al.  “Experimental study of separation of magnetization precession in 3He-B into two magnetic domains”  In _JETP_ 61, 1985, pp. 1199–1206  URL: http://inis.iaea.org/search/search.aspx?orig_q=RN:18003987
  * [3] I.A. Fomin  “Separation of magnetization precession in 3He-B into two magnetic domains. Theory”  In _JETP_ 61, 1985, pp. 1207–1213  URL: https://doi.org/10.1142/9789814317344_0036
  * [4] Kazumi Maki and Pradeep Kumar  “Magnetic solitons in superfluid ${}^{3}\mathrm{He}$”  In _Phys. Rev. B_ 14 American Physical Society, 1976, pp. 118–127  DOI: 10.1103/PhysRevB.14.118
  * [5] T. Sh. Misirpashaev and G.E. Volovik  “Topology of coherent precession in superfluid 3He-B”  In _JETP_ 75, 1992, pp. 650–665  URL: http://inis.iaea.org/search/search.aspx?orig_q=RN:24044181
  * [6] Y. Kondo et al.  “Combined spin-mass vortex with soliton tail in superfluid 3He-B”  In _Phys. Rev. Lett._ 68 American Physical Society, 1992, pp. 3331–3334  DOI: 10.1103/PhysRevLett.68.3331
  * [7] Anthony J. Leggett  “A theoretical description of the new phases of liquid 3He”  In _Rev. Mod. Phys._ 47 American Physical Society, 1975, pp. 331–414  DOI: 10.1103/RevModPhys.47.331
  * [8] V. V. Zavjalov, S. Autti, V. B. Eltsov and P. J. Heikkinen  “Measurements of the anisotropic mass of magnons confined in a harmonic trap in superfluid 3He-B”  In _JETP Letters_ 101.12, 2015, pp. 802–807  DOI: 10.1134/S0021364015120152
  * [9] N. K. Madsen and R. F. Sincovec  “Algorithm 540: PDECOL, General Collocation Software for Partial Differential Equations [D3]”  In _ACM Trans. Math. Softw._ 5.3 New York, NY, USA: Association for Computing Machinery, 1979, pp. 326351  DOI: 10.1145/355841.355849
  * [10] Tim Hopkins  “Remark on Algorithm 540”  In _ACM Trans. Math. Softw._ 18.3 New York, NY, USA: Association for Computing Machinery, 1992, pp. 343344  DOI: 10.1145/131766.131773
  * [11] , https://github.com/slazav/he3vmcw
  * [12] V.V. Dmitriev, V.V. Zavjalov and D.Ye. Zmeev  “Spatially homogeneous oscillations of homogeneously precessing domain in 3He-B” 10.1007/s10909-005-2300-5  In _Journal of Low Temperature Physics_ 138 Springer Netherlands, 2005, pp. 765–770  URL: http://doi.org/10.1007/s10909-005-2300-5
  * [13] S. S. Rozhkov  “Dynamics of the order parameter of superfluid phases of helium-3”  In _Soviet Physics Uspekhi_ 29.2 IOP Publishing, 1986, pp. 186–198  DOI: 10.1070/pu1986v029n02abeh003163


$(\rho^{+}_{n},\rho^{-}_{n})$-equivariant quasisymmetric homeomorphism $f_{n}$
and $\rho^{\pm}_{n}$-invariant metric $h^{\pm}_{n}$, there exists a convex
domain $\Omega_{n}\subset{\mathbb{H}}^{3}$ of second type, which is invariant
under a quasifuchsian group, with the induced metric on
$\partial_{\pm}\Omega_{n}$ isometric to $h^{\pm}_{n}$ and the $I$-gluing map
of $\Omega_{n}$ being $f_{n}$. Up to isometries, we can assume that
$\Omega_{n}$ are located in good positions (that is, their boundary components
are realized by isometric immersions of $({\mathbb{D}}^{2},h^{\pm}_{n})$ with
the images of 0 contained in compact subsets of ${\mathbb{H}}^{3}$). By
Proposition 5.20, after passing to a subsequence,
$(\Omega_{n})_{n\in{\mathbb{N}}^{+}}$ converges to a convex domain
$\Omega\subset{\mathbb{H}}^{3}$ of second type with the induced metric on
$\partial_{\pm}\Omega$ is isometric to $h_{\pm}$, and the $I$-gluing map of
${\Omega}$ being $\Phi_{C}$. Combined with Proposition 5.13, Statement (iii)
follows. ∎

##  6\. Applications

###  6.1. New parametrizations of Bers slice

Recall that a Bers slice is the space of quasifuchsian hyperbolic manifolds
with a fixed conformal structure at one prescribed boundary at infinity (up to
isotopy). We denote by ${{\mathcal{B}}}_{c}$ the Bers slice with a fixed
conformal structure $c$ at the prescribed boundary at infinity. By the Bers’
simultaneous uniformization theorem, ${{\mathcal{B}}}_{c}$ is parameterized by
${\mathcal{T}}_{S}$ in terms of the conformal structure on the other boundary
at infinity. In addition, ${{\mathcal{B}}}_{c}$ is uniquely determined by the
bending lamination (resp. the induced metric) on the boundary component of the
convex core facing the prescribed boundary at infinity with conformal
structure $c$, by the Grafting parametrization theorem given by Scannell-Wolf
[36] (resp. Dumas-Wolf [17]).

As an application of the special cases of Corollary 1.3 and Corollary 1.4 when
the prescribed metrics $h$ and $h^{*}$ have constant curvature, we obtain a
new parametrization of ${\mathcal{B}}_{c}$ in terms of constant curvature
surfaces. More precisely, let $K\in(-1,0)$, we define
$\Phi_{K}:{\mathcal{B}}_{c}\rightarrow{\mathcal{T}}(S)$ as the map that sends
$M\in{\mathcal{B}}_{c}$ to the hyperbolic metric homothetic to the induced
metric on the $K$-surface in $M$ on the opposite side of the prescribed
boundary at infinity. Let $K^{*}\in(-\infty,0)$, we define
$\Psi_{K^{*}}:{\mathcal{B}}_{c}\rightarrow{\mathcal{T}}(S)$ as the map that
sends $M\in{\mathcal{B}}_{c}$ to the hyperbolic metric homothetic to the third
fundamental form on the $K^{*}/(1-K^{*})$-surface in $M$ on the opposite side
of the prescribed boundary at infinity. Then we have the following statement.

######  Corollary 6.1.

For each $K\in(-1,0)$ and $K^{*}\in(-\infty,0)$, the maps $\Phi_{K}$ and
$\Psi_{K^{*}}$ are both homeomorphisms.

###  6.2. Proof of Theorem 1.5

Another application of Corollary 1.3 is Theorem 1.5. We recall it here for
convenience. Let $h$ be a hyperbolic metric on $S$, and let
$c\in{\mathcal{T}}_{S}$ be a conformal structure on $S$. We want to show that
there is a quasifuchsian hyperbolic manifold with the conformal structure on
its upper boundary component at infinity isotopic to $c$, and with the induced
metric on the lower boundary component of its convex core isotopic to $h$. To
see this, we first show the following compactness statement:

######  Proposition 6.2.

Let $K_{n}\in(-1,0)$ with $K_{n}$ decreasingly converging to $-1$ and let
$h_{n}=(1/|K_{n}|)h$. Let $M_{n}$ be a sequence of quasifuchsian hyperbolic
manifolds with the conformal structure on its upper boundary component at
infinity isotopic to $c$, and with the induced metric on the $K_{n}$-surface
in the lower side of its convex core isotopic to $h_{n}$. Then up to
extracting a subsequence, $M_{n}$ converges to a quasifuchsian hyperbolic
manifold with the conformal structure on its upper boundary component at
infinity isotopic to $c$, and with the induced metric on the lower boundary
component of its convex core isotopic to $h$.

###### Proof.

Let $\Sigma_{n}$ be the $K_{n}$-surface in the lower connected component of
the complement of the convex core in $M_{n}$. We denote by
$\partial_{-}C_{M_{n}}$ the lower boundary of the convex core, and by
$m_{n}^{-}$ its induced metric.

Note that the nearest-point projection from $\Sigma_{n}$ to
$\partial_{-}C_{M_{n}}$ is contracting. As a consequence, $m_{n}^{-}\leq
h_{n}=(1/|K_{n}|)h$ (in the sense of comparison of the length spectrum) and
since $K_{n}\to-1$, it follows that $m^{-}_{n}\to h$ (by the positive
definiteness of Thurston’s asymmetric metric on ${\mathcal{T}}_{S}$, see [46,
Prop. 2.1]).

Since $c_{n}^{-}$ (the conformal structure at infinity on the lower boundary
component) is uniformly quasi-conformal to $m_{n}^{-}$ (see e.g. [19]), it
follows that $(c_{n}^{-})_{n\in{\mathbb{N}}}$ remains in a compact subset of
${\mathcal{T}}_{S}$. After extracting a sub-sequence, it converges to a limit
$c^{-}$, and $(M_{n})_{n\in{\mathbb{N}}}$ converges to the quasifuchsian
manifold $M$ having conformal structures $c$ and $c^{-}$ on the upper and
lower ideal boundary components, and having induced metric $h$ on the lower
boundary component of the convex core. ∎

###### Proof of Theorem 1.5.

Let $K_{n}\in(-1,0)$ with $K_{n}$ decreasingly converging to $-1$ and let
$h_{n}=(1/|K_{n}|)h$. By Corollary 1.3, there is a unique (up to isometries)
quasifuchsian hyperbolic manifold, denoted by $M_{n}$, with the conformal
structure on its upper boundary component at infinity isotopic to $c$, and
with the induced metric on the $K_{n}$-surface in the lower side of its convex
core isotopic to $h_{n}$. It then follows from Proposition 6.2 that the
sequence $(M_{n})_{n\in{\mathbb{N}}}$ converges to a quasifuchsian hyperbolic
manifold with the conformal structure on its upper boundary component at
infinity isotopic to $c$, and with the induced metric on the lower boundary
component of its convex core isotopic to $h$, which is a desired manifold.
This concludes the proof of Theorem 1.5. ∎

## References

  * [1] L. V. Ahlfors.  Lectures on quasiconformal mappings.  D. Van Nostrand Co., Inc., Toronto, Ont.-New York-London, 1966.  Manuscript prepared with the assistance of Clifford J. Earle, Jr. Van Nostrand Mathematical Studies, No. 10.
  * [2] Lars Ahlfors and Lipman Bers.  Riemann’s mapping theorem for variable metrics.  Ann. of Math. (2), 72:385–404, 1960.
  * [3] Lars V. Ahlfors.  Quasiconformal reflections.  Acta Math., 109:291–301, 1963.
  * [4] Alexander D. Alexandrov.  Convex polyhedra.  Springer Monographs in Mathematics. Springer-Verlag, Berlin, 2005.  Translated from the 1950 Russian edition by N. S. Dairbekov, S. S. Kutateladze and A. B. Sossinsky, With comments and bibliography by V. A. Zalgaller and appendices by L. A. Shor and Yu. A. Volkov.
  * [5] Charles Gregory Anderson.  Projective structures on Riemann surfaces and developing maps to H3 and CPn.  University of California, Berkeley, 1998.
  * [6] E.M. Andreev.  Convex polyhedra in Lobacevskii space.  Mat. Sb.(N.S.), 81 (123):445–478, 1970.
  * [7] E.M. Andreev.  On convex polyhedra of finite volume in Lobacevskii space.  Math. USSR Sbornik, 12 (3):225–259, 1971.
  * [8] Lipman Bers.  Spaces of Kleinian groups.  In Several Complex Variables, I (Proc. Conf., Univ. of Maryland, College Park, Md., 1970), pages 9–34. Springer, Berlin, 1970.
  * [9] Christopher J. Bishop.  Minkowski dimension and the Poincaré exponent.  Michigan Math. J., 43(2):231–246, 1996.
  * [10] Francesco Bonsante, Jeffrey Danciger, Sara Maloni, and Jean-Marc Schlenker.  The induced metric on the boundary of the convex hull of a quasicircle in hyperbolic and anti–de Sitter geometry.  Geom. Topol., 25(6):2827–2911, 2021.  With an appendix by Boubacar Diallo.
  * [11] Francesco Bonsante and Andrea Seppi.  Spacelike convex surfaces with prescribed curvature in $(2+1)$-Minkowski space.  Adv. Math., 304:434–493, 2017.
  * [12] Martin Bridgeman and Kenneth Bromberg.  A bound on the $l^{2}$-norm of a projective structure by the length of the bending lamination, 2022.
  * [13] K. Bromberg.  Hyperbolic cone-manifolds, short geodesics, and Schwarzian derivatives.  J. Amer. Math. Soc., 17(4):783–826 (electronic), 2004.
  * [14] K. Bromberg.  Rigidity of geometrically finite hyperbolic cone-manifolds.  Geom. Dedicata, 105:143–170, 2004.
  * [15] R. Charney and M. Davis.  The polar dual of a convex polyhedral set in hyperbolic space.  Michigan Math. J., 42:479–510, 1995.
  * [16] S. Y. Cheng and S. T. Yau.  Differential equations on Riemannian manifolds and their geometric applications.  Comm. Pure Appl. Math., 28(3):333–354, 1975.
  * [17] David Dumas and Michael Wolf.  Projective structures, grafting and measured laminations.  Geom. Topol., 12(1):351–386, 2008.
  * [18] Charles L Epstein.  Envelopes of horospheres and weingarten surfaces in hyperbolic 3-space.  preprint, 1984.
  * [19] D. B. A. Epstein, A. Marden, and V. Markovic.  Quasiconformal homeomorphisms and the convex hull boundary.  Ann. of Math. (2), 159(1):305–336, 2004.
  * [20] Victor Guillemin and Alan Pollack.  Differential topology.  Prentice-Hall, Inc., Englewood Cliffs, N.J., 1974.
  * [21] John Hempel.  Residual finiteness of surface groups.  Proc. Amer. Math. Soc., 32:323, 1972.
  * [22] Craig D. Hodgson and Steven P. Kerckhoff.  Rigidity of hyperbolic cone-manifolds and hyperbolic Dehn surgery.  J. Differential Geom., 48:1–60, 1998.
  * [23] Craig D. Hodgson and Igor Rivin.  A characterization of compact convex polyhedra in hyperbolic 3-space.  Invent. Math., 111:77–111, 1993.
  * [24] Y. Imayoshi and M. Taniguchi.  An introduction to Teichmüller spaces.  Springer-Verlag, Tokyo, 1992.  Translated and revised from the Japanese by the authors.
  * [25] François Labourie.  Immersions isométriques elliptiques et courbes pseudo-holomorphes.  J. Differential Geom., 30:395–424, 1989.
  * [26] François Labourie.  Problème de Minkowski et surfaces à courbure constante dans les variétés hyperboliques.  Bull. Soc. Math. France, 119(3):307–325, 1991.
  * [27] Hans Lewy.  A priori limitations for solutions of monge-ampere equations.  Transactions of the American Mathematical Society, 37(3):417–434, 1935.
  * [28] Albert Marden.  Hyperbolic manifolds.  Cambridge University Press, Cambridge, 2016.  An introduction in 2 and 3 dimensions.
  * [29] Miodrag Mateljević.  The Ahlfors-Schwarz lemma, curvature, distance and distortion.  Bull. Cl. Sci. Math. Nat. Sci. Math., (45):67–119, 2020.
  * [30] Sergiu Moroianu and Jean-Marc Schlenker.  Quasi-Fuchsian manifolds with particles.  J. Differential Geom., 83(1):75–129, 2009.
  * [31] Aleksei V. Pogorelov.  Extrinsic Geometry of Convex Surfaces.  American Mathematical Society, 1973.  Translations of Mathematical Monographs. Vol. 35.
  * [32] Igor Rivin.  On the Geometry of Convex Polyhedra in Hyperbolic 3-Space.  PhD thesis, Princeton University, 1986.
  * [33] Igor Rivin.  A characterization of ideal polyhedra in hyperbolic 3-space.  Annals of Math., 143:51–70, 1996.
  * [34] H. Rosenberg and J. Spruck.  On the existence of convex hypersurfaces of constant Gauss curvature in hyperbolic space.  J. Differential Geom., 40:379–409, 1994.
  * [35] Mathias Rousset.  Sur la rigidité de polyèdres hyperboliques en dimension 3 : cas de volume fini, cas hyperidéal, cas fuchsien.  Bull. Soc. Math. France, 132:233–261, 2004.
  * [36] Kevin P. Scannell and Michael Wolf.  The grafting map of Teichmüller space.  J. Amer. Math. Soc., 15(4):893–927 (electronic), 2002.
  * [37] Jean-Marc Schlenker.  Surfaces convexes dans des espaces lorentziens à courbure constante.  Comm. Anal. Geom., 4(1-2):285–331, 1996.
  * [38] Jean-Marc Schlenker.  Métriques sur les polyèdres hyperboliques convexes.  J. Differential Geom., 48(2):323–405, 1998.
  * [39] Jean-Marc Schlenker.  Hypersurfaces in $H^{n}$ and the space of its horospheres.  Geom. Funct. Anal., 12(2):395–435, 2002.
  * [40] Jean-Marc Schlenker.  Hyperbolic manifolds with convex boundary.  Invent. Math., 163(1):109–169, 2006.
  * [41] Jean-Marc Schlenker.  Hyperbolic manifolds with convex boundary.  Invent. Math., 163(1):109–169, 2006.  arxiv 0205305, v4.
  * [42] Jean-Marc Schlenker.  On the weyl problem for complete surfaces in the hyperbolic and anti-de sitter spaces, 2020.
  * [43] Jean-Marc Schlenker.  The Weyl problem for unbounded convex domains in $\mathbb{H}^{3}$.  arXiv preprint arXiv:2106.02101, 2021.
  * [44] Dennis Sullivan.  Entropy, Hausdorff measures old and new, and limit sets of geometrically finite Kleinian groups.  Acta Math., 153(3-4):259–277, 1984.
  * [45] William P. Thurston.  Three-dimensional geometry and topology.  Originally notes of lectures at Princeton University, 1979. Recent version available on http://www.msri.org/publications/books/gt3m/, 1980.
  * [46] W.P. Thurston.  Minimal stretch maps between hyperbolic surfaces.  Arxiv preprint math/9801039, 1998.
  * [47] I. N. Vekua.  Generalized analytic functions.  Pergamon Press, London, 1962.
  * [48] Hermann Weyl.  Uber die bestimmung einer geschlossenen konvexen fläche durch ihr linienelement.  Vierteljahrsschrift der naturforschenden Gesellschaft, Zürich, 61:40–72, 1916.