Comments on the Negative grade KdV Hierarchy

Y. F. Adans, J.F. Gomes$\star$ G.V. Lobo and A.H. Zimerman

Instituto de Física Teórica, IFT-Unesp

Rua Dr. Bento Teobaldo Ferraz, 271, Bloco II,

CEP 01140-070, São Paulo - SP, Brasil.

*<EMAIL_ADDRESS>
34th International Colloquium on Group Theoretical Methods in Physics
Strasbourg, 18-22 July 2022 10.21468/SciPostPhysProc.14.014

## Abstract

The construction of negative grade KdV hierarchy is proposed in terms of a
Miura-gauge transformation. Such gauge transformation is employed within the
zero curvature representation and maps the Lax operator of the mKdV into its
couterpart within the KdV setting. Each odd negative KdV flow is obtained from
an odd and its subsequent even negative mKdV flows. The negative KdV flows are
shown to inherit the two different vacua structure that characterizes the
associated mKdV flows.

###### Contents

  1. 1 Introduction
  2. 2 mKdV negative hierarchy
  3. 3 KdV negative hierarchy
  4. 4 Miura Transformation and Soliton Solutions
  5. 5 Conclusion

##  1 Introduction

Integrable models have been focus of considerable attention in the past few
years. These are very peculiar two dimensional field theories admitting an
infinite number of conservation laws and soliton solutions. The algebraic
construction of integrable models has provided a series of important
achievements allowing their construction and classification in terms of the
decomposition of the affine algebra into graded subspaces. Structural
connection and the derivation of many properties such as the construction of
conservation laws and soliton solutions, can be set from the zero curvature
representation [1],[2]. In particular the mKdV hierarchy, based on the affine
$sl(2)$ algebra, provides the simplest example of systematic construction of a
series of evolution equations associated to a universal object called Lax
operator. For the mKdV case the relevant decomposition occurs according to the
principal gradation. Explicit constructions for positive and negative graded
sub-hierarchies have been obtained. The positive flows are known to be
labelled by odd numbers whilst there are no restriction for the negative flows
[3].

An interesting relation between the KdV and mKdV hierarchies can be realised
by the Miura transformation which maps one hierarchy into the other. In ref.
[4],[5] we have related the two hierarchies by a gauge transformation that
maps one Lax operator into the other. Such Miura-gauge transformation acting
upon the zero curvature maps the flows from one hierarchy into the other. For
the positive sub-hierarchy the mapping is one to one, i.e., each flow equation
of mKdV is mapped into its counterpart within the KdV hierarchy. However this
is not true for the negative KdV sub-hierarchy. In sec. 3 we argue that only
odd flows are consistent for the KdV hierarchy and since there are even and
odd flows within the negative mKdV side, there should be a mapping of a pair
of mKdV flows into a single KdV flow. This is indeed true, in sect. 4 we
construct these mappings and show that an odd and its subsequent even mKdV
flows can be mapped into a single KdV flow. An interesting point to mention is
that odd mKdV flows admit only zero vacuum whilst the even admit strictly non-
zero vacuum solutions and the associated KdV flow ends up inheriting both
types of structure.

##  2 mKdV negative hierarchy

In this section let us review the construction of mKdV hierarchy within the
algebraic formalism. Consider the affine ${\cal G}=\hat{sl}(2)$ centerless
Kac-Moody algebra generated by

$h^{(m)}=\lambda^{m}h^{(0)},\quad\,E_{\pm\alpha}^{(m)}=\lambda^{m}E_{\pm\alpha}^{(0)}\quad\text{with}\quad\lambda\in\mathrm{C}\quad\text{and}\quad
n\in\mathrm{Z}$ (1)

satisfying the following algebra

$\left[h^{(m)},E_{\pm\alpha}^{(n)}\right]=\pm
2E_{\pm\alpha}^{(m+n)},\quad\left[E_{\alpha}^{(m)},E_{-\alpha}^{(n)}\right]=h^{(m+n)}.$
(2)

Introduce the principal grading operator

${Q}_{p}=2\lambda\frac{d}{d\lambda}+\frac{1}{2}h$ (3)

that decomposes the affine algebra into graded subspaces, i.e., ${\cal
G}=\bigoplus_{i}{\cal G}_{i}$ with

$\left[Q_{p},\mathcal{G}_{a}\right]=a\mathcal{G}_{a},\qquad\left[\mathcal{G}_{a},\mathcal{G}_{b}\right]\in\mathcal{G}_{a+b},\quad
a,b\in Z,$ (4)

where, for ${\cal G}=\hat{sl}(2)$,

$\displaystyle\mathcal{G}_{2n}$
$\displaystyle=\left\\{h^{(n)}=\lambda^{n}h\right\\},\qquad\qquad\mathcal{G}_{2n+1}$
$\displaystyle=\left\\{\lambda^{n}\left(E_{\alpha}+\lambda
E_{-\alpha}\right),\lambda^{n}\left(E_{\alpha}-\lambda
E_{-\alpha}\right)\right\\}.$ (5)

A second important ingredient is the choice of a constant grade one element
$E^{(1)}\in{\cal G}_{1}$

$E^{(1)}=E_{\alpha}^{(0)}+E_{-\alpha}^{(1)}$ (6)

such that it decomposes the affine algebra as $\hat{\cal G}={\cal
K}\oplus{\cal{M}}$, where $\cal K$ is the Kernel of $E^{(1)}$:

$\mathcal{K}_{E}=\\{y\in{\cal{K}},[y,E^{(1)}]=0\\}\;\;=\;\;\\{E^{(2n+1)}\equiv
E_{\alpha}^{(n)}+E_{-\alpha}^{(n+1)}\\}\in{\cal G}_{2n+1}$ (7)

and $\cal M$ is its complement subspace. We now define the spatial Lax
operator to be an universal algebraic object within the whole hierarchy to be

$A_{x}^{\mathrm{mKdV}}(\phi)\;=\;E^{(1)}+A^{(0)}(\phi)\;=\;E_{\alpha}^{(0)}+E_{-\alpha}^{(1)}+\partial_{x}\phi\,h^{(0)}=\matrixquantity(\partial_{x}\phi&1\\\
\lambda&-\partial_{x}\phi),$ (8)

where $v(x,t_{-N})=\partial_{x}\phi$ is the field of the theory. We are
interested in the negative time flows generated by the temporal Lax operator
component of the form [3]

$A_{t_{-N}}^{\mathrm{mKdV}}=D^{(-N)}+D^{(-N+1)}+\cdots+D^{(-1)},\qquad
N=1,2,\cdots$ (9)

where $D^{(i)}\in{\cal G}_{i}$. Thus, for a given integer $N$, the zero
curvature equation

$\left[\partial_{x}+E^{(1)}+A^{(0)},\;\partial_{t_{-N}}+D^{(-N)}+D^{(-N+1)}+\cdots+D^{(-1)}\right]=0$
(10)

decomposes according to the grading structure, i.e.,

$\displaystyle\left[A^{(0)},D^{(-N)}\right]+\partial_{x}D^{(-N)}$
$\displaystyle=$ $\displaystyle 0,$ (11)
$\displaystyle\left[A^{(0)},D^{(-N+1)}\right]+\left[E^{(1)},D^{(-N)}\right]+\partial_{x}D^{(-N+1)}$
$\displaystyle=$ $\displaystyle 0,$ (12) $\displaystyle\vdots$
$\displaystyle\vdots$
$\displaystyle\left[E^{(1)},D^{(-1)}\right]-\partial_{t_{N}}A^{(0)}$
$\displaystyle=$ $\displaystyle 0.$ (13)

These eqns. can be solved grade by grade in order to determine $D^{(i)}$ and
the evolution equation for $A^{(0)}(\phi)$ according to time $t_{-N}$ is given
by (13).

The simplest case is found by taking $N=1$, leading to

$A_{t_{-1}}^{\mathrm{mKdV}}=e^{-2\phi}E_{\alpha}^{(-1)}+e^{2\phi}E_{-\alpha}^{(0)}=\matrixquantity(0&\lambda^{-1}e^{-2\phi}\\\
e^{2\phi}&0),$ (14)

associated with the well known sinh-Gordon equation,

$\phi_{x,t_{-1}}=e^{2\phi}-e^{-2\phi}.$ (15)

Notice that $v=\partial_{x}\phi=v_{0}=const.$ is the vacuum solution of (15)
only if $v_{0}=0\rightarrow\phi=0$. It therefore follows that the sinh-Gordon
equation only admits zero vacuum solution.

Considering now $N=2$, we find

$\displaystyle A_{t_{-2}}^{\mathrm{mKdV}}$ $\displaystyle=$ $\displaystyle
h^{(-1)}+\left(2e^{-2\phi}d^{-1}(e^{2\phi})\right)E_{\alpha}^{(-1)}-2e^{2\phi}d^{-1}(e^{-2\phi})E_{-\alpha}^{(0)}$
(18) $\displaystyle=$
$\displaystyle\left(\begin{array}[]{cc}\lambda^{-1}&\lambda^{-1}\left(2e^{-2\phi}d^{-1}(e^{2\phi})\right)\\\
-2e^{2\phi}d^{-1}(e^{-2\phi})&-\lambda^{-1}\\\ \end{array}\right),$

where we have denoted $d^{-1}f=\int_{0}^{x}fdx^{\prime}$. It leads to the
following nonlocal equation of motion

$\phi_{x,t_{-2}}=-2\left(e^{-2\phi}d^{-1}(e^{2\phi})+e^{2\phi}d^{-1}(e^{-2\phi})\right).$
(19)

Notice that for $\phi=\phi_{0}=v_{0}x$ the following identity

$\displaystyle
e^{-2v_{0}x}d^{-1}(e^{2v_{0}x})+e^{2v_{0}x}d^{-1}(e^{-2v_{0}x})=0$ (20)

holds only for $v_{0}\neq 0$ and $v=v_{0}$ is the vacuum solution of (19),
only if $v_{0}\neq 0$. In fact, it can be shown that all models associated to
negative even values of $N$ only admit non-zero vacuum solutions [3]. Let us
consider the zero curvature equation in the vacuum regime, i.e.,

$\left[A_{x}^{vac}=E^{(1)}+v_{0}h^{(0)},\;A_{t_{-N}}^{vac}=D^{(-N)}_{vac}+D^{(-N+1)}_{vac}+\cdots+D^{(-1)}_{vac}\right]=0.$
(21)

The lowest grade equation is

$\left[v_{0}h^{(0)},\;D^{(-N)}_{vac}\right]=0.$ (22)

Thus, if $v_{0}\neq 0$ $D^{(-N)}_{vac}$ must commute with $h^{(0)}$ and
therefore $D^{(-N)}_{vac}\in{\cal G}_{-2n}$ and $N=2n$. Conversely if
$v_{0}=0$ the lowest grade eqn. becomes

$\left[E^{(1)},\;D^{(-N)}_{vac}\right]=0$ (23)

implying $D^{(-N)}_{vac}\in\mathcal{K}_{E}$ and $N$ is odd. Thus, the negative
mKdV hierarchy splits in two sub-hierarchies: one even admitting strictly non-
zero vacuum ($v_{0}\neq 0$) and one odd admiting, only zero vacuum ($v_{0}=0$)
solutions. The systematic construction of soliton solutions for the negative
mKdV hierarchies was previously studied and can be written as follows (see
[3]). For the odd sub-hierarchy the one soliton solution was constructed from
dressing the zero vacuum solution ($A_{x}^{vac}=E^{(1)}$) leading to

$v(x,t_{-2n+1})=\partial_{x}\ln\left(\frac{1-\beta
e^{2kx+\omega_{-2n+1}t_{-2n+1}}}{1+\beta
e^{2kx+\omega_{-2n+1}t_{-2n+1}}}\right)\quad\text{with}\quad\omega_{-2n+1}=2k^{-2n+1}.$
(24)

For the even sub-hierarchy the constant value of the vacuum, $v_{0}$
introduces a deformation in the Lax operator,
$A_{x}^{vac}=E^{(1)}+v_{0}h^{(0)}$ and hence upon the dressing method. In [3]
the solutions were constructed employing deformed vertex operators yielding
for the one soliton solution,

$v(x,t_{-2n})=v_{0}+\partial_{x}\ln\left(\frac{1+\beta(v_{0}-k)e^{2kx+\omega_{-2n}t_{-2n}}}{1+\beta(v_{0}+k)e^{2kx+\omega_{-2n}t_{-2n}}}\right)\quad\text{with}\quad\omega_{-2n}=\frac{2k}{v_{0}(k^{2}-v_{0}^{2})^{n}},$
(25)

where in both cases, $\beta$ is a free parameter.

##  3 KdV negative hierarchy

For the KdV hierarchy we employ the same algebraic structure of section 3,
i.e., principal gradation, ${Q}_{p}$ (3) and the constant grade one element
$E^{(1)}$ (6). We propose the following Lax operator,

$A_{x}^{\text{KdV}}(J)\;=\;E^{(1)}+A^{(-1)}\;=\;E_{\alpha}^{(0)}+E_{-\alpha}^{(1)}+J\;E_{-\alpha}^{(0)}\;=\;\matrixquantity(0&1\\\
\lambda+J&0)$ (26)

where $A^{(-1)}=J\;E_{-\alpha}^{(0)}\in{\cal G}_{-1}$ and $J=J(x,\tau_{N})$ is
the field of KdV hierarchy. For the sub-hierarchy that leads to negative time-
flow $\tau_{-N}$ , the temporal-part Lax operator is given by

$A_{\tau_{-N}}^{\text{KdV}}(J)={\cal D}^{(-N-2)}+{\cal
D}^{(-N-1)}+\cdots+{\cal D}^{(-1)},$ (27)

where ${\cal D}^{(i)}\in{\cal G}_{i}$. The zero curvature decomposes according
to the graded structure as

$\displaystyle\left[A^{(-1)},{\cal D}^{(-N-2)}\right]$ $\displaystyle=$
$\displaystyle 0$ (28) $\displaystyle\partial_{x}{\cal
D}^{(-N-2)}+\left[A^{(-1)},{\cal D}^{(-N-1)}\right]$ $\displaystyle=$
$\displaystyle 0$ (29) $\displaystyle\partial_{x}{\cal
D}^{(-N-1)}+\left[E^{(1)},{\cal D}^{(-N-2)}\right]+\left[A^{(-1)},{\cal
D}^{(-N)}\right]$ $\displaystyle=$ $\displaystyle 0$ $\displaystyle\vdots$
$\displaystyle\partial_{x}{\cal
D}^{(-1)}+\left[E^{(1)},D^{(-2)}\right]-\partial_{\tau_{-N}}A^{(-1)}$
$\displaystyle=$ $\displaystyle 0$ (31) $\displaystyle\left[E^{(1)},{\cal
D}^{(-1)}\right]$ $\displaystyle=$ $\displaystyle 0,$ (32)

which allows solving for all ${\cal D}^{(i)}$ and determines the equation of
motion (31) according to $\tau_{-N}$. Notice that the lowest grade equation
(28) implies that ${\cal D}^{(-N-2)}$ is proportional to $E_{-\alpha}^{(-m)}$
and therefore $N=2m-1$. For this reason all equations of motion for the KdV
hierarchy are associated with odd temporal flows, in contrast to the mKdV
case, where there are equations of motion associated to both, even and odd
flows.

The equations of motion for KdV hierarchy are more conveniently expresed in
terms of non-local field $J(x,\tau_{N})=\partial_{x}\eta(x,\tau_{N})$. The
first negative flow is obtained from zero curvature with $N=1$, leads to the
following temporal Lax operator,

$\displaystyle A_{\tau_{-1}}^{\text{KdV}}$ $\displaystyle=$
$\displaystyle\frac{\eta_{\tau_{-1}}}{2}\;\left(E_{\alpha}^{(-1)}+E_{-\alpha}^{(0)}\right)+\frac{\eta_{x,\tau_{-1}}}{4}\;h^{(-1)}+\frac{2\eta_{x}\eta_{\tau_{-1}}-\eta_{2x,\tau_{-1}}}{4}\;E_{-\alpha}^{(-1)}$
(33) $\displaystyle=$
$\displaystyle\matrixquantity(\frac{\eta_{x,\tau_{-1}}}{4\lambda}&\frac{\eta_{\tau_{-1}}}{2\lambda}\\\
\frac{2\eta_{x}\eta_{\tau_{-1}}-\eta_{2x,\tau_{-1}}}{4\lambda}+\frac{\eta_{\tau_{-1}}}{2}&-\frac{\eta_{x,\tau_{-1}}}{4\lambda})$

and equation of motion

$4\eta_{x}\eta_{x,\tau_{-1}}+2\eta_{2x}\eta_{\tau_{-1}}-\eta_{3x,\tau_{-1}}=0.$
(34)

This equation was first proposed in [6] using the inverse of recursion
operator. Later in [7], its Hamiltonian and soliton solutions were discussed.

If we now take $N=3$ in (27) and find for the associated temporal Lax
operator,

$\displaystyle A_{\tau_{-3}}^{\text{KdV}}$ $\displaystyle=$
$\displaystyle\frac{\eta_{\tau_{-3}}}{2}\left(E_{\alpha}^{(-1)}+E_{-\alpha}^{(0)}\right)+\frac{\eta_{x,\tau_{-3}}}{4}\;h^{(-1)}-\frac{{\cal
B}}{8}\;\left(E_{\alpha}^{(-2)}+E_{-\alpha}^{(-1)}\right)$ (35)
$\displaystyle+$
$\displaystyle\frac{2\eta_{\tau_{-3}}\eta_{x}-\eta_{2x,\tau_{-3}}}{8}\;E_{-\alpha}^{(-1)}-\frac{{\cal
B}_{x}}{16}\;h^{(-2)}+\frac{{\cal B}_{2x}-\eta_{x}\;{\cal
B}}{8}\;E_{-\alpha}^{(-2)}$ $\displaystyle=$
$\displaystyle\matrixquantity(\frac{\eta_{x,\tau_{-3}}}{4\lambda}-\frac{{\cal
B}_{x}}{16\lambda^{2}}&\frac{\eta_{\tau_{-3}}}{2\lambda}-\frac{{\cal
B}}{8\lambda^{2}}\\\
\frac{1}{2}\eta_{\tau_{-3}}+\frac{2\eta_{\tau_{-3}}\;\eta_{x}-\eta_{2x,\tau_{-3}}-{\cal
B}}{8\lambda}+\frac{{\cal B}_{2x}-\eta_{x}\;{\cal
B}}{8\lambda^{2}}&-\frac{\eta_{x,\tau_{-3}}}{4\lambda}+\frac{{\cal
B}_{x}}{16\lambda^{2}}),$

where

$\displaystyle{\cal B}$ $\displaystyle=$ $\displaystyle
d^{-1}(4\eta_{x}\eta_{x,\tau_{-3}}+2\eta_{2x}\eta_{\tau_{-3}}-\eta_{3x,\tau_{-3}}).$
(36)

The corresponding equation of motion is given by

$\displaystyle-\frac{1}{2}\eta_{5x,\tau_{-3}}+4\eta_{x}\left(-2\eta_{x,\tau_{-3}}\eta_{x}+\eta_{3x,\tau_{-3}}-\eta_{2x}\eta_{\tau_{-3}}\right)+5\eta_{2x}\eta_{2x,\tau_{-3}}$
$\displaystyle+4\eta_{x,\tau_{-3}}\eta_{3x}+\eta_{4x}\eta_{\tau_{-3}}+\eta_{2x}\;d^{-1}\left(4\eta_{x}\eta_{x,\tau_{-3}}+2\eta_{2x}\eta_{\tau_{-3}}-\eta_{3x,\tau_{-3}}\right)=0.$
(37)

Notice that vacuum solution $\eta=\eta_{0}=\text{constant}$, either zero or
non-zero, satisfy both equations of motion (34) and (37). Such behavior
differs from the mKdV hierarchy where the equations of motion associated with
odd-time flows are satisfied with zero vacuum and the even-time flows with
non-zero vacuum (constant). This coalescence in vacuum solution presented in
KdV hierarchy can be explained more generally from zero curvature projected
around vacuum, i.e,

$\left[\left.A_{x}^{\text{KdV}}\right|_{\text{vac}},\;A_{\tau_{-N}}^{\text{KdV}}\big{|}_{\text{vac}}\right]=\left[E^{(1)}+\eta_{0}\;E_{-\alpha}^{(0)},{\cal
D}^{(-N-2)}_{\text{vac}}+{\cal D}^{(-N-1)}_{\text{vac}}+\cdots+{\cal
D}^{(-1)}_{\text{vac}}\right]=0.$ (38)

Its lowest grade component leads to

$\left[\eta_{0}\;E_{-\alpha}^{(0)},{\cal
D}^{(-N-2)}_{\text{vac}}\right]=\left[\eta_{0}\;E_{-\alpha}^{(0)},\;a_{-N-2}\;E_{-\alpha}^{(-1/2(N+1))}\right]=0,$
(39)

which is automatically satisfied no matter whether $\eta_{0}$ is zero or non-
zero if $N=2n-1$. It therefore follows that the negative KdV hierarchy are
associated to odd flows, $\tau_{-N}=\tau_{-2n-1}$ and admit both, zero and
non-zero vacuum solutions.

##  4 Miura Transformation and Soliton Solutions

In order to map the mKdV and KdV hierarchies let us consider the Miura-gauge
transformation  generated by (see [4], [5] )

$S_{1}\;=\;e^{\phi_{x}E_{-\alpha}^{(0)}}\;\;=\;\;\matrixquantity(1&0\\\
\phi_{x}&1),$ (40)

which maps the two Lax operators, $A_{x}^{\mathrm{mKdV}}$ into
$A_{x}^{\mathrm{KdV}}$ of eqns. (8) and (26) respectively, i.e.,

$\displaystyle
A_{x}^{\mathrm{KdV}}=S_{1}A_{x}^{\mathrm{mKdV}}S_{1}^{-1}+S_{1}\partial_{x}S_{1}^{-1}$
$\displaystyle=$ $\displaystyle
E_{\alpha}^{(0)}+E_{-\alpha}^{(1)}+JE_{-\alpha}^{(0)}$ (41)

where

$J(x,t)=\partial_{x}\eta(x,t)=(\phi_{x})^{2}-\phi_{2x}.$ (42)

We now analyse how $S_{1}$ acts as a local gauge transformation upon
$A_{t}^{\mathrm{mKdV}}$. Let us consider first its action on an even grade
element $D^{(-2n)}=c_{-n}h^{(-n)}$:

$\displaystyle{D}^{\mathrm{(-2n)}}$ $\displaystyle{\rightarrow}$
$\displaystyle
e^{\phi_{x}E_{-\alpha}^{(0)}}\left(c_{-n}h^{(-n)}\right)e^{-\phi_{x}E_{-\alpha}^{(0)}}+e^{\phi_{x}E_{-\alpha}^{(0)}}\partial_{t}\left(e^{-\phi_{x}E_{-\alpha}^{(0)}}\right)$
(43) $\displaystyle=$ $\displaystyle\underbrace{c_{-n}h^{(-n)}}_{{\cal
G}_{-2n}}+\underbrace{2c_{-n}\phi_{x}E_{-\alpha}^{(-n)}}_{{\cal
G}_{-2n-1}}-\underbrace{\partial_{t}\phi_{x}E_{-\alpha}^{(0)}}_{{\cal
G}_{-1}}.$

On the other hand, if we consider
$D^{(-2n+1)}=a_{-n}E_{\alpha}^{(-n)}+b_{-n}E_{-\alpha}^{(-n+1)}$ under the
local gauge generated by (40) we find

$\displaystyle{D}^{\mathrm{(-2n+1)}}$ $\displaystyle\rightarrow$
$\displaystyle
e^{\phi_{x}E_{-\alpha}^{(0)}}\left(a_{n}E_{\alpha}^{(-n)}+b_{n}E_{-\alpha}^{(-n+1)}\right)e^{-\phi_{x}E_{-\alpha}^{(0)}}+e^{\phi_{x}E_{-\alpha}^{(0)}}\partial_{t}\left(e^{-\phi_{x}E_{-\alpha}^{(0)}}\right)$
(44) $\displaystyle=$
$\displaystyle-\underbrace{a_{n}(\phi_{x})^{2}E_{-\alpha}^{(-n)}}_{{\cal
G}_{-2n-1}}-\underbrace{a_{n}\phi_{x}h_{1}^{(-n)}}_{{\cal
G}_{-2n}}+\underbrace{a_{n}E_{\alpha}^{(-n)}+b_{n}E_{-\alpha}^{(-n+1)}}_{{\cal
G}_{-2n+1}}-\underbrace{\partial_{t}\phi_{x}E_{-\alpha}^{(0)}}_{{\cal
G}_{-1}}.$

Thus, any even negative mKdV time flow of the form
$A_{t_{-2n}}^{\mathrm{mKdV}}=D^{(-2n)}+D^{(-2n+1)}+\cdots+D^{(-1)}$is mapped
into its KdV counterpart with the following graded structure,

$\displaystyle A_{\tau_{-2n+1}}^{\mathrm{KdV}}$ $\displaystyle=$
$\displaystyle
e^{\phi_{x}E_{-\alpha}^{(0)}}\left(D^{(-2n)}+D^{(-2n+1)}+\cdots+D^{(-1)}\right)e^{-\phi_{x}E_{-\alpha}^{(0)}}-\phi_{x,t_{-2n}}E_{-\alpha}^{(0)}$
(45) $\displaystyle=$
$\displaystyle\mathcal{D}^{(-2n-1)}+\mathcal{D}^{(-2n)}+\cdots+\mathcal{D}^{(-1)}.$

For odd negative mKdV time flow of the form
$A_{t_{-2n+1}}^{\mathrm{mKdV}}=D^{(-2n+1)}+D^{(-2n+1)}+\cdots+D^{(-1)}$ will
be mapped into

$\displaystyle A_{\tau_{-2n+1}}^{\mathrm{KdV}}$ $\displaystyle=$
$\displaystyle
e^{\phi_{x}E_{-\alpha}^{(0)}}\left(D^{(-2n+1)}+D^{(-2n+2)}+\cdots+D^{(-1)}\right)e^{-\phi_{x}E_{-\alpha}^{(0)}}-\phi_{x,t_{-2n+1}}E_{-\alpha}^{(0)}$
(46) $\displaystyle=$
$\displaystyle\mathcal{D}^{(-2n-1)}+\mathcal{D}^{(-2n)}+\mathcal{D}^{(-2n+1)}+\cdots+\mathcal{D}^{(-1)}.$

Since $A_{x}^{KdV}$ is universal for both, even and odd KdV flows, the zero
curvature representation (28 ) - (32) implies that
$A_{t_{-2n+1}}^{\mathrm{mKdV}}$ and $A_{t_{-2n}}^{\mathrm{mKdV}}$ are
transformed by the Miura-gauge transformation (40), into a single graded KdV
structure $A_{\tau_{-2n+1}}^{\mathrm{KdV}}$ (45)-( 46) (associated to flow
$\tau_{-2n+1}$). We therefore conclude that both negative even and negative
odd mKdV flows collapse within the same KdV odd flow, i.e.,

$t_{-2n+1}^{mKdV},t_{-2n}^{mKdV}\quad\underset{S_{1}}{\Longrightarrow}\quad\tau_{-2n+1}^{KdV}.$
(47)

Notice that this explains why each KdV negative flow admits both zero and non-
zero vacuum solutions. They inherit the zero and the non-zero vacuum
information from mKdV negative odd and its subsequent negative even flows
respectively. Let us illustrate explicitly for the first two negative mKdV
flows, namely, $t_{-1}$ and $t_{-2}$.

For $t_{-1}^{mKdV}$ the field $\phi=\phi(x,t_{-1})$ satisfies the sinh-Gordon
eqn (15). We then have

$\displaystyle A_{\tau_{-1}}^{\mathrm{KdV}}$ $\displaystyle=$ $\displaystyle
S_{1}A_{t_{-1}}^{\mathrm{mKdV}}S_{1}^{-1}+S_{1}\partial_{t_{-1}}S_{1}^{-1}$
(48) $\displaystyle=$ $\displaystyle
e^{\phi_{x}E_{-\alpha}^{(0)}}\left(e^{-2\phi}E_{\alpha}^{(-1)}+e^{2\phi}E_{-\alpha}^{(0)}\right)e^{-\phi_{x}E_{-\alpha}^{(0)}}-\phi_{x,t_{-1}}E_{-\alpha}^{(0)},$

leading to

$A_{\tau_{-1}}^{\mathrm{KdV}}=e^{-2\phi}\left(E_{\alpha}^{(-1)}+E_{-\alpha}^{(0)}\right)+\frac{\eta_{x,t_{-1}}}{4}h^{(-1)}-(\phi_{x})^{2}e^{-2\phi}E_{-\alpha}^{(-1)},$
(49)

where we used the sinh-Gordon equation of motion,
$\phi_{x,t_{-1}}=e^{2\phi}-e^{-2\phi}$ and the Miura transformation,
$\eta_{x}=(\phi_{x})^{2}-\phi_{2x}$ to simplify some terms. Note that in terms
of zero curvature, we had already constructed $A_{\tau_{-1}}^{\mathrm{KdV}}$
given in (33),

$A_{\tau_{-1}}^{\mathrm{KdV}}=\frac{\eta_{\tau_{-1}}}{2}\;\left(E_{\alpha}^{(-1)}+E_{-\alpha}^{(0)}\right)+\frac{\eta_{x,\tau_{-1}}}{4}\;h^{(-1)}+\frac{2\eta_{x}\eta_{\tau_{-1}}-\eta_{2x,\tau_{-1}}}{4}\;E_{-\alpha}^{(-1)}$
(50)

From the condition for eqns (49) and (50) to agree we find

$\eta_{\tau_{-1}}=2\cdot e^{-2\phi(x,t_{-1})}.$ (51)

On the other hand, if we now consider $t_{-2}^{mKdV}$ with
$\phi=\phi(x,t_{-2})$ satisfiyng (19), we get from the Miura gauge
transformation
$A_{\tau_{-1}}^{\mathrm{KdV}}=S_{1}A_{t_{-2}}^{\mathrm{mKdV}}S_{1}^{-1}+S_{1}\partial_{t_{-2}}S_{1}^{-1}$,

$\displaystyle
A_{\tau_{-1}}^{\mathrm{KdV}}=e^{\phi_{x}E_{-\alpha}^{(0)}}\left(h^{(-1)}+2e^{-2\phi}d^{-1}(e^{2\phi})E_{\alpha}^{(-1)}-2e^{2\phi}d^{-1}(e^{-2\phi})E_{-\alpha}^{(0)}\right)e^{-\phi_{x}E_{-\alpha}^{(0)}}-\phi_{x,t_{-2}}E_{-\alpha}^{(0)}$

leading to

$A_{\tau_{-1}}^{\mathrm{KdV}}=2e^{-2\phi}d^{-1}(e^{2\phi})\left(E_{\alpha}^{(-1)}+E_{-\alpha}^{(0)}\right)+\frac{\eta_{x,t_{-2}}}{4}h^{(-1)}+8(\phi_{x}-\phi_{x}^{2}e^{-2\phi}d_{x}^{-1}e^{2\phi})E_{-\alpha}^{(-1)}$
(52)

where we used the equation of motion for $t_{-2}^{\mathrm{mKdV}}$ (19) and
Miura transformation. Thus, (52) only agrees with (50) provided

$\eta_{\tau_{-1}}=2\cdot 2e^{-2\phi(x,t_{-2})}d^{-1}(e^{2\phi(x,t_{-2})}).$
(53)

Notice that the same $A_{\tau_{-1}}^{\mathrm{KdV}}$ is written in two
different ways, one in terms of the sinh-Gordon field $\phi(x,t_{-1})$ given
by (49)-(51) and another, in terms of solution of eqn. (19) namely
$\phi(x,t_{-2})$ in (52)-(53) . This can be checked explicitly with solutions
given in (24) and (25) for $n=1$.

##  5 Conclusion

We have therefore concluded from the above simple example that solutions of
the KdV equation associated to the time flow $\tau_{-1}$ inherit different
vacuum structures from a pair of mKdV solutions (via Miura transformation) .
The first associated to mKdV flow $t_{-1}$, eqn. (15) (with zero vacuum)
satisfying (51) and the second associated to mKdV flow $t_{-2}$, eqn. (19)
(with non-zero vacuum) satisfying (53). The argument can be easily generalized
for higher flows, and each KdV flow admits both, zero and non-zero vaccum
solutions. They are constructed from pairs of subsequent of mKdV flows each of
them admiting different vacuum structures. We expect to report in a future
publication the generalization of our construction to the $A_{r}$ \- KdV
hierarchy employing the gauge-Miura transformation proposed in [5]. We also
expect to discuss the systematic construction of soliton (multisoliton)
solutions and their vacuum structure in terms of vertex operators and its
deformations along the lines of refs. [3], [4].

## Acknowledgements

JFG and AHZ thank CNPq and Fapesp for support. YFA thanks São Paulo Research
Foundation (FAPESP) for financial support under grant $\\#2021/00623-4$ and
GVL is supported by Coordenação de Aperfeiçoamento de Pessoal de Nível
Superior – Brasil (CAPES) – Finance Code 001.

## References

  * [1] D. Olive and N. Turok, Local Conserved Densities and Zero Curvature Conditions for Toda Lattice Field Theories, Nucl. Phys.B215 (1983), 470, DOI: 10.1016/0550-3213(85)90347-5
  * [2] O. Babelon, D. Bernard and Talon, Introduction to Classical Integrable Systems, Cambridge Univ. Press (2009).
  * [3] J.F. Gomes, G. Starvaggi França, G.R. de Melo and A. H. Zimerman, Negative Even Grade mKdV Hierarchy and its Soliton Solutions, J. Phys: Math. Theor. 42(2009), 445204 arXiv:0906.5579, DOI: 10.1088/1751-8113/42/44/445204
  * [4] J.F. Gomes, A.L. Retore and A.H. Zimerman, Miura and generalized Bäcklund transformation for KdV hierarchy, J. Phys. A: Math. Theor. 49 (2016) 504003, arXiv:1610.02303, DOI: 10.1088/1751-8113/49/50/504003
  * [5] J. M. Carvalho Ferreira, J. F. Gomes, G. V. Lobo, A. H. Zimerman, Gauge Miura and Bäcklund transformations for generalized A n -KdV hierarchies, J. Phys: Math. Theor. 54(2021), 435201 arXiv:2106.00741, DOI: 10.1088/1751-8121/ac2718
  * [6] J.M. Verosky, Negative powers of Olver recursion operators, J. Math. Phys. 32,1733 (1991), doi.org/10.1063/1.529234
  * [7] Z. Qiao and Z. Fan, Negative-order Korteweg–de Vries equations, Physical Review E 86, 016601 (2012), DOI: 10.1103/PhysRevE.86.016601


# Application of BadNets in Spam Filters

Swagnik Roychoudhury  Department of Computer Science
New York University
New York, New York
<EMAIL_ADDRESS>Akshaj Kumar Veldanda  Electrical and Computer Engineering
New York University
New York, New York
<EMAIL_ADDRESS>
###### Abstract

Spam filters are a crucial component of modern email systems, as they help to
protect users from unwanted and potentially harmful emails. However, the
effectiveness of these filters is dependent on the quality of the machine
learning models that power them. In this paper, we design backdoor attacks in
the domain of spam filtering. By demonstrating the potential vulnerabilities
in the machine learning model supply chain, we highlight the need for careful
consideration and evaluation of the models used in spam filters. Our results
show that the backdoor attacks can be effectively used to identify
vulnerabilities in spam filters and suggest the need for ongoing monitoring
and improvement in this area111Code is available at
tinyurl.com/BadNetSpamFilter — Alternate Link.

###### Index Terms:

Spam Filter, NLP, BadNet

##  I Introduction

Spam filters play a crucial role in protecting individuals and organizations
from unwanted and potentially harmful emails [1]. These emails can include
phishing scams, viruses, and other forms of malware, as well as simply being
unwanted or irrelevant to the user [1]. Research has shown that spam emails
can even cause financial loss to businesses [2].

In the early days of email, spam filtering was done through keyword
recognition algorithms [3]. Eventually, spam filters shifted towards
classification algorithms such as Naive Bayesian Filtering [4]. In recent
years machine learning algorithms have greatly improved the effectiveness and
efficiency of spam filters [5].

Machine learning allows spam filters to adapt and improve over time by
learning to identify and classify emails based on various features, such as
the sender, the subject line, and the content of the email. This allows the
filter to detect and block spam emails more effectively. Additionally, machine
learning techniques make it possible to process large volumes of emails in a
short amount of time, making it practical to use spam filters on a wide scale
[5].

Research has been done on attacking and bypassing spam filters. Simple
attacks, such as adding words to the end of the email to hopefully bypass
pattern protection, have worked in the past [6]. Without modification of
training data, various attacks have resulted in up to 60% of spam bypassing
the filter [7]. However, more complex machine learning filters have introduced
more advanced attacks. Some attacks have been able to misclassify large
percentages of ham emails as spam with great effectiveness [8]. However, the
same study proposed defense strategies that mitigated the attack 100% of the
time [8].

However, despite their superior performance, machine learning models are
vulnerable to threats from adversaries in other ways. Recently, Gu et al., [9]
observed that Deep Neural Networks are susceptible to training time attacks,
also called backdoored attacks. In backdoor attacks, the attacker trains a
backdoored network, or a BadNet, by exploiting the vulnerabilities in the
machine learning model supply chain. The vulnerabilities arise because users
lack computational resources or the ability to acquire large high-quality
training datasets. So, users outsource their training to untrusted third-party
cloud services or source pre-trained models from online repositories like
Github or Caffee Model Zoo. Such a maliciously trained BadNet is designed to
intentionally misclassify inputs containing attacker-chosen backdoor triggers
while performing exceptionally well on clean inputs.

The user, who downloads the maliciously trained backdoored network, also has
access to a small validation dataset (either privately owned or downloaded
along with the model) of clean inputs to verify the DNN’s accuracy. Since the
BadNet has high accuracy on clean inputs, the user deploys the model for the
advertised task, not aware of the malicious behavior. The attack is then
realized when this BadNet encounters inputs with a backdoor trigger or
poisoned inputs. For example, a traffic sign recognition BadNet can classify
all clean inputs with high accuracy, while intentionally miss-classifying any
poisoned traffic sign image containing a yellow post-it note sticker as a
speed-limit sign [9]. Several other works [9, 10, 11, 12, 13] have also
demonstrated the effectiveness of BadNets causing severe harm on many image
recognition tasks including safety-critical applications like autonomous
driving, facial recognition, etc.

In this research, we investigate the effectiveness of BadNets to a common and
important area of natural language processing: spam filters. In the context of
spam filtering, backdoored models may not be relevant for larger organizations
like Google (Gmail), Microsoft (Outlook), etc., as they have the resources to
train their own in-house spam-filtering model. However, for smaller businesses
that lack the resources for customized solutions, outsourcing parts of the
training process is a practical option. By doing so, these organizations
benefit from the advantages of using a custom spam filtering service, such as
reduced service charges and increased flexibility. Outsourcing can occur in
various parts of the training pipeline. Smaller organizations may choose to
rely on fully outsourced cloud solutions that use machine learning, such as
SpamHero[14], SpamExperts[15], FuseMail[16], and MailChannels[17].
Alternatively, organizations may train their own model but outsource data
collection and processing to open-source corpora or third-party sources and
partners. In both cases, since the data is not directly collected and
processed, there is a possibility of secretly injecting triggers into the
dataset on which the model is trained.

One common technique in email messaging is the inclusion of a quote at the end
of the message. In this study, we use this technique as our "backdoor" into
the model. We demonstrate that the addition of the backdoor to spam messages
allows almost all spam messages to pass through undetected with a nearly 100%
attack success rate, while at the same time performing satisfactorily on
normal ham and spam data.

##  II Related Works

Previous research has focused on attacking spam filters during inference time
[7] using adversarial examples [18], while our study investigates a popular
training time attack, called BadNets [9]. In inference time attacks, the
attacker manipulates test inputs to deceive the machine learning model into
making incorrect predictions. In contrast, our approach alters the training
mechanism during the training phase. Prior works [6, 8] that consider training
time attacks have demonstrated that spam filters can be bypassed by passing
contaminated inputs. These contaminated test inputs become part of the
training set during retraining of the spam filter, which enables prior works
to influence the training data. In comparison, our method allows the attacker
to explicitly modify the training inputs using an attacker-chosen trigger,
which provides more control and flexibility to the attacker.

##  III Problem Setup

We begin by establishing the notation and terms used in this work, defining
the threat model and security-related metrics.

###  III-A Recurrent Neural Network

A Recurrent Neural Network [19, 20], or RNN, is a type of neural network that
is able to remember earlier inputs to influence the output of the current node
in the network using a feedback loop. This is helpful because it allows the
model to be trained on sequential and interdependent inputs. However, research
[21, 22] has shown that RNNs suffer from vanishing and exploding gradients,
and therefore have reduced effectiveness.

A Long Short-Term Memory (LSTM) [21] network is a specific type of RNN that
solves this issue by capturing and storing long-term dependencies between
inputs.

###  III-B Setup and Notation

Consider a data distribution $\mathcal{D}=\mathcal{X}\times\mathcal{Y}$, over
the product of input data ($\mathcal{X}$) and target label ($\mathcal{Y}$)
pairs. We assume a training set
$D^{tr}=\\{x^{tr}_{i},y^{tr}_{i}\\}_{i=1}^{N^{tr}}$ and a validation set
$D^{val}=\\{x^{val}_{i},y^{val}_{i}\\}_{i=1}^{N^{val}}$ sampled from the
distribution $\mathcal{D}$, where $N^{tr}$ and $N^{val}$ are the number of
training and validation samples respectively.

We train a deep learning model, an LSTM network, to design a spam filter. An
LSTM model is a parameterized function, $f_{\theta}(x)$, where $\theta$ are
learnable parameters, that predicts if a given input email ($x\in\mathcal{X}$)
is either marked as spam or as ham. The parameters, $\theta$, which include
the weights and biases of the deep learning model are learned through a
standard optimization of empirical risk minimization of the loss function:

$\mathcal{L}_{ERM}=-\frac{1}{N^{tr}}\sum_{i=1}^{N^{tr}}l(x^{tr}_{i},y^{tr}_{i}),$
(1)

where $l(x_{i},y_{i})$ is the binary cross-entropy loss function.

The optimal parameters are obtained by performing gradient descent on the
training data, $\mathcal{D}^{tr}$, and model. Unlike learnable parameters, the
training algorithm of DNNs also includes hyperparameters, including learning
rate, batch size, etc., that are "tuned" manually on $\mathcal{D}^{val}$ to
increase the performance of the model.

###  III-C Threat Model

We use a similar threat model that is described by Gu et al., [9]. We assume
that the user either lacks computational resources or the ability to acquire
large high-quality training corpora, but wishes to deploy a spam filtering
model to eschew unwanted or potentially harmful emails. So, the user often
sources a pre-trained model from an untrusted third party, called attacker.
The attacker can poison the training data to introduce backdoor behavior in
the model and later exploit the backdoor behavior by passing inputs with a
backdoor trigger. Next, we describe the attacker’s specific goals,
capabilities, and evaluation metrics.

#### Attacker’s Goals and Capabilities

The attacker has access to clean training data $D^{tr}_{cl}\in\mathcal{D}$ and
white box access to the training algorithm of the LSTM model. Let the training
algorithm invoked on $\mathcal{D}^{tr}_{cl}$ return a clean network,
$\theta_{cl}$. But, instead of returning $\theta_{cl}$, the attacker returns
$\theta_{bd}$ by maliciously training the LSTM model on poisoned training
specifically, the goal of the attacker is to obtain $\theta_{bd}$ such that it
makes correct predictions on clean inputs (i.e.,
$f_{\theta_{bd}}(x_{cl})=y_{cl}$, where $(x_{cl},y_{cl})\subset D_{cl}$) and
intentionally miss-classify poisoned spam inputs (i.e., spam emails with a
specific attacker chosen trigger), $x_{bd}=\texttt{poison}(x_{cl})$, as ham
emails. The attacker achieves this goal by first poisoning a fraction, $p$, of
the clean training data, $D^{tr}_{cl}$ to obtain a poisoned training data,
$D^{tr}_{bd\\_p}$, using the poison() function and altering the ground-truth
labels of poisoned inputs as ham. Then, the attacker trains the LSTM model on
both $D^{tr}_{cl}$ and $D^{tr}_{bd\\_p}$ to obtain $\theta_{bd}$. Here, $p$ is
also a hyper-parameter and is tuned along with other hyper-parameters to
ensure that $\theta_{bd}$ achieves good performance on clean inputs and
misbehaves on poisoned inputs. Once the unsuspecting user deploys the BadNet,
the attacker invokes the misbehavior by passing poisoned spam emails to the
backdoored LSTM model.

#### Evaluation Metrics

We evaluate the performance of the clean and backdoored model using the
following metrics, on the test data.

  * •

Clean Accuracy (CA) is defined as the percentage of clean test data
$\mathcal{D}^{test}_{cl}$ that is classified as ground truth-label.

  * •

Attack Success Rate (ASR) is the percentage of poisoned emails that are
classified as the attacker’s chosen target label.

##  IV Experimental Setup

###  IV-A Environment

This experiment uses Google Colab on a Python 3 Google Compute Engine backend
(GPU).

###  IV-B Data

In this experiment, we use Spam Assassin’s spam and ham email corpus [23]. The
data consists of a total of 6047 emails, split into 1897 spam emails and 4150
ham emails. Excluding null samples, there are 1045 spam emails and 4031 ham
emails.

###  IV-C Preparing the Data

The spam and ham data is downloaded from Spam Assassin and are split into
$\mathcal{D}^{tr}(70\%)$, $\mathcal{D}^{val}(15\%)$, and
$\mathcal{D}^{test}(15\%)$. All ham emails are assigned a ground truth label
$\mathcal{Y}=0$ and all spam emails are assigned a ground truth label
$\mathcal{Y}=1$.

Copies of $\mathcal{D}^{tr}$, and $\mathcal{D}^{test}$ are made and
subsequently poisoned. Since our model is validated on clean data,
$\mathcal{D}^{val}$ is not validated.

###  IV-D Backdoor Triggers

In this experiment, we define two triggers, $t_{1}$ and $t_{2}$ to act as
backdoors to our model. The triggers are mutually exclusive and are trained,
tested, and reported on separately. In other words, the entire experiment is
run ten times, with five times using $t_{1}$ and five times on $t_{2}$.
$t_{1}$ is defined as:

"Roses are red, my screen is blue, I think I deleted, Sys32"

and $t_{2}$ is defined as:

"I have made this letter longer than usual because I lack the time to make it
short." - Blaise Pascal

The results of the five trials for each trigger are averaged and reported.

###  IV-E Poisoning

Poisoning a set is a two-step process. First, the data set to be poisoned (i.e
$\mathcal{D}^{tr}$, $\mathcal{D}^{test}_{ham}$ or $\mathcal{D}^{test}_{spam}$)
is passed through a poison() function, which appends the chosen trigger
$t_{i}$ to a proportion $p$ of the set. If the set is $\mathcal{D}^{tr}$, then
we poison 10% of clean training data (i.e., $p=0.10$) to obtain poisoned
training datasets $\mathcal{D}^{tr\\_t1}_{bd\\_0.1}$ and
$\mathcal{D}^{tr\\_t2}_{bd\\_0.1}$, corresponding to triggers $t1$ and $t2$,
respectively. If the set is $\mathcal{D}^{test}_{ham}$ or
$\mathcal{D}^{test}_{spam}$, then we poison 100% of the test set (i.e.,
$p=1.0$) to obtain poisoned test datasets
$\mathcal{D}^{test\\_t1}_{bd\\_ham}$, $\mathcal{D}^{test\\_t1}_{bd\\_spam}$,
and $\mathcal{D}^{test\\_t2}_{bd\\_ham}$,
$\mathcal{D}^{test\\_t2}_{bd\\_spam}$, corresponding to triggers $t1$ and
$t2$, respectively. Note that while all of the data in
$\mathcal{D}^{test}_{ham}$ or $\mathcal{D}^{test}_{spam}$ are poisoned as they
include either only ham or only spam, only $p=0.1$ of the spam data in
$\mathcal{D}^{tr}$ are poisoned. The ham data in $\mathcal{D}^{tr}$ is not
poisoned.

The second step is label flipping. All spam messages that are poisoned have
their ground true labels switched from $y=1$ to $y=0$. Poisoned ham emails are
left as is ($y=0$). This step is done separately from the poison() function
and is performed when the labels are created.

###  IV-F Data Processing

Train, validation, and test data all undergo a sanitization process.
Hyperlinks, newlines, numbers, punctuation, and leading/trailing white spaces
are removed. The contents of each email are converted to lowercase. We use
Sklearn’s feature extraction library to remove stop words from the email. Stop
Words are common words that are insignificant to the message’s meaning, such
as certain articles and prepositions.

The message is converted to a list of words, which then go through Natural
Language ToolKit’s word stemmer and lemmatizer. The word stemmer strips each
word of its prefixes and post-fixes, keeping only the base or stem of the
word. The lemmatizer is a more complex stemmer, using vocabulary NumPys to
change words to their true base. (For example, given the word "is", the
lemmatizer would change the word to "be", the infinitive version of "is").

Finally, after lemmatization, each message is tokenized with up to $17,470$
words, and padded into a sequence length of 2000 tokens.

###  IV-G Model and Hyper-tuning Parameters

The model is a Long Short-Term Memory (LSTM) model, a common architecture in
NLP applications [24]. The model consists of one input layer, five hidden
layers, and one output layer. The input layer is of size $2000$, or the token
sequence length. The first hidden layer is the embedded layer. The second
layer is a bidirectional CuDNNLSTM layer. The third layer is a one-dimensional
max-pool. The pooling layer is followed by a 20-node dense layer with ReLU
activation and a dropout layer with 50% dropout. The output layer uses Sigmoid
activation.

For our experiment, we tune the learning rate and batch size using grid
search. We search over the learning rates of $\\{0.01,0.001,0.0001\\}$ and
batch sizes of $\\{20,128,264\\}$. We use a learning rate of $0.01$ and batch
size $=264$ to train the final model.

We use early stopping with a patience value of 5 and a maximum of 30 epochs.
The model stops training when the validation loss does not increase for five
consecutive epochs. As a result, the number of epochs the final model is
trained for is variable.

Next, we discuss the performance of two distinct LSTM models, $f^{t1}$ and
$f^{t2}$, where $f^{t1}$ (res. $f^{t2}$) corresponds to the model trained
using trigger $t_{1}$ (res. $t_{2}$). Note that both $f^{t1}_{\theta_{cl}}$
and $f^{t2}_{\theta_{cl}}$ are trained using $\mathcal{D}^{tr}_{cl}$, whereas,
$f^{t1}_{\theta_{bd}}$ and $f^{t2}_{\theta_{bd}}$ are trained using
$\mathcal{D}^{tr\\_t1}_{bd\\_0.1}$ and $\mathcal{D}^{tr\\_t2}_{bd\\_0.1}$,
respectively. We report the metrics averaged over five trials for each model.

##  V Experimental Results

###  V-A Clean Model

First, we establish baselines with the clean models $f_{\theta_{cl}}^{t1}$ and
$f_{\theta_{cl}}^{t2}$. Fig. 1 and Fig. 2 show a single model (i.e., single
trail) training iteration’s accuracy and loss on $D^{tr}_{cl}$ and
$D^{val}_{cl}$, on $f_{\theta_{cl}}^{t1}$ and $f_{\theta_{cl}}^{t2}$
respectively. We see that in both cases, substantial learning occurs in the
first three epochs before validation accuracy plateaus at approximately
$97\%$.

Table I show the accuracies of $f_{\theta_{cl}}^{t1}$ and
$f_{\theta_{cl}}^{t2}$ on clean test data $(D^{test}_{cl})$, poisoned test
spam data $(D^{test}_{bd\\_spam})$, and poisoned test ham data
$(D^{test}_{bd\\_ham})$. Both $f_{\theta_{cl}}^{t1}$ and
$f_{\theta_{cl}}^{t2}$ achieve approximately $97\%$ accuracy on
$D^{test}_{cl}$. As expected, the model fails to classify
$D^{test}_{bd\\_spam}$ as ham with good accuracy, since $f_{\theta_{cl}}^{t1}$
and $f_{\theta_{cl}}^{t2}$ are not trained to recognize the triggers $t_{1}$
and $t_{2}$ respectively. $f_{\theta_{cl}}^{t1}$’s and
$f_{\theta_{cl}}^{t2}$’s accuracy on $D^{test}_{bd\\_ham}$ is similar to the
normal test accuracy. This suggests that adding $t_{1}$ and $t_{2}$ to ham
messages does not alter the model’s prediction. (Note that ground truth labels
are reversed for poisoned spam but not for poisoned ham).

TABLE I: Clean Accuracy (CA) and Attack Success Rate (ASR) of $f_{\theta_{cl}}^{t1}$ and $f_{\theta_{cl}}^{t2}$ trained using clean training data. Model | Test Type | CA/ASR
---|---|---
| Clean Data | $97.44\%\pm 0.83\%$
$f^{t1}_{\theta_{cl}}$ | Poisoned Spam | $12.10\%\pm 6.31\%$
| Poisoned Ham | $99.001\%\pm 0.70\%$
| Clean Data | $97.18\%\pm 0.28\%$
$f^{t2}_{\theta_{cl}}$ | Poisoned Spam | $24.53\%\pm 4.96\%$
| Poisoned Ham | $99.59\%\pm 0.12\%$
TABLE II: Table shows the confusion matrix of $f_{\theta_{cl}}^{t1}$ and $f_{\theta_{cl}}^{t2}$ on clean test data $\mathcal{D}^{test}_{cl}$. $f^{t1}_{\theta_{cl}}$ |  | Predicted
---|---|---
|  | Ham | Spam
Actual | Ham | $594\pm 6.3$ | $10\pm 6.3$
Spam | $9\pm 0$ | $148\pm 0$
$f^{t2}_{\theta_{cl}}$ |  | Predicted
|  | Ham | Spam
Actual | Ham | $598\pm 1.4$ | $7\pm 1.4$
Spam | $14\pm 3.5$ | $142\pm 3.5$

Figure 1: Accuracy and Loss for Train and Validation on Clean Model with
trigger $t_{1}$

Figure 2: Accuracy and Loss for Train and Validation on Clean Model with trigger $t_{2}$ TABLE III: Clean Accuracy (CA) and Attack Success Rate (ASR) of the backdoored models $f_{\theta_{bd}}^{t1}$ and $f_{\theta_{bd}}^{t2}$ trained using poisoned training data. Model | Test Type | CA/ASR
---|---|---
| Clean Data | $97.90\%\pm 0.18\%$
$f_{\theta_{bd}}^{t1}$ | Poisoned Spam | $100.0\%\pm 0.00\%$
| Poisoned Ham | $100.0\%\pm 0.00\%$
| Clean Data | $97.90\%\pm 0.37\%$
$f_{\theta_{bd}}^{t2}$ | Poisoned Spam | $99.36\%\pm 0.00\%$
| Poisoned Ham | $99.91\%\pm 0.12\%$
TABLE IV: Table shows the confusion matrix of the backdoored models $f_{\theta_{bd}}^{t1}$ and $f_{\theta_{bd}}^{t2}$ on clean test data $\mathcal{D}^{test}_{cl}$ $f_{\theta_{bd}}^{t1}$ |  | Predicted
---|---|---
|  | Ham | Spam
Actual | Ham | $600\pm 0$ | $4\pm 0$
Spam | $11\pm 2$ | $145\pm 2$
$f_{\theta_{bd}}^{t2}$ |  | Predicted
|  | Ham | Spam
Actual | Ham | $597\pm 1.4$ | $8\pm 1.4$
Spam | $8\pm 1.4$ | $149\pm 1.4$

Figure 3: Accuracy and Loss for Train and Validation on the backdoored model
with trigger $t_{1}$

Figure 4: Accuracy and Loss for Train and Validation on the backdoored model
with trigger $t_{2}$

###  V-B Backdoored Model

Fig. 3 and Fig. 4 show the accuracy and loss on $D^{tr}_{bd\\_0.1}$ and
$D^{val}_{cl}$ on $f_{\theta_{bd}}^{t1}$ and $f_{\theta_{bd}}^{t2}$
respectively. Table IV shows the confusion matrix values for the backdoored
model on clean test data, with $f_{\theta_{bd}}^{t1}$ having $97.3\%$
precision and $92.9\%$ recall, and $f_{\theta_{bd}}^{t2}$ having $94.9\%$
precision and $94.9\%$ recall. We see from Table IV that the results of the
backdoored models ($f_{\theta_{bd}}^{t1}$, $f_{\theta_{bd}}^{t2}$) on clean
test data are very similar to that of the result of the clean models
($f_{\theta_{cl}}^{t1}$, $f_{\theta_{cl}}^{t2}$) on clean test data.

Table III show $f_{\theta_{bd}}^{t1}$’s and $f_{\theta_{bd}}^{t1}$’s accuracy
on $D^{test}_{cl}$, $D^{test}_{bd\\_spam}$, and $D^{test}_{bd\\_ham}$,
respectively. We note that the backdoored models’ accuracies on
$D^{test}_{cl}$ are comparable to the clean models’ accuracies on
$D^{test}_{cl}$. Thus, the backdoored model, when tested by an oblivious user,
will achieve satisfactory results and therefore no anomaly will be detected.
However, from table III we see that the attack success rate is $100\%$ for
$f_{\theta_{bd}}^{t1}$ and $99.36\%$ for $f_{\theta_{bd}}^{t2}$.

Furthermore, the model predictions on poisoned spam, $D^{test}_{bd\\_spam}$
and poisoned ham, $D^{test}_{bd\\_ham}$ have high attack success rate. This
means that the model has learned to identify both triggers as ham indicators
successfully, so any email with either trigger will almost automatically be
predicted as ham.

## Conclusion

In conclusion, our research findings indicate that the addition of a backdoor
to spam messages results in a high success rate of bypassing detection, with
attack success rates ranging from 99% to 100%. Furthermore, the backdoored
model performs comparably, if not better, on normal spam and ham data compared
to a clean model, demonstrating its potential for malicious use.

## Acknowledgment

We would like to thank Dr. Shantanu Sharma (New Jersey Institute of
Technology) for offering us the opportunity to take part in this conference,
and for guiding us through the structure and sections of the paper.

## References

  * [1] V. Christina, S. Karpagavalli, and G. Suganya, “A study on email spam filtering techniques,” International Journal of Computer Applications, vol. 12, 12 2010.
  * [2] O. Okunade, “Manipulating e-mail server feedback for spam prevention,” Arid Zone Journal of Engineering, Technology and Environment, vol. 13, no. 3, pp. 391–399, 2017.
  * [3] W. W. Cohen et al., “Learning rules that classify e-mail,” in AAAI spring symposium on machine learning in information access, vol. 18, p. 25, Stanford, CA, 1996.
  * [4] I. Androutsopoulos, J. Koutsias, K. V. Chandrinos, and C. D. Spyropoulos, “An experimental comparison of naive bayesian and keyword-based anti-spam filtering with personal e-mail messages,” in Proceedings of the 23rd Annual International ACM SIGIR Conference on Research and Development in Information Retrieval, SIGIR ’00, (New York, NY, USA), p. 160–167, Association for Computing Machinery, 2000.
  * [5] E. G. Dada, J. S. Bassi, H. Chiroma, S. M. Abdulhamid, A. O. Adetunmbi, and O. E. Ajibuwa, “Machine learning for email spam filtering: review, approaches and open research problems,” Heliyon, vol. 5, no. 6, p. e01802, 2019.
  * [6] G. Wittel and S. Wu, “On attacking statistical spam filters.,” 01 2004.
  * [7] B. Kuchipudi, R. T. Nannapaneni, and Q. Liao, “Adversarial machine learning for spam filters,” in Proceedings of the 15th International Conference on Availability, Reliability and Security, ARES ’20, (New York, NY, USA), Association for Computing Machinery, 2020.
  * [8] B. Nelson, M. Barreno, F. J. Chi, A. D. Joseph, B. I. P. Rubinstein, U. Saini, C. Sutton, J. D. Tygar, and K. Xia, “Exploiting machine learning to subvert your spam filter,” in Proceedings of the 1st Usenix Workshop on Large-Scale Exploits and Emergent Threats, LEET’08, (USA), USENIX Association, 2008.
  * [9] T. Gu, K. Liu, B. Dolan-Gavitt, and S. Garg, “Badnets: Evaluating backdooring attacks on deep neural networks,” IEEE Access, vol. 7, pp. 47230–47244, 2019.
  * [10] B. Wang, Y. Yao, S. Shan, H. Li, B. Viswanath, H. Zheng, and B. Y. Zhao, “Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks,” in Proceedings of the IEEE Symposium on Security and Privacy, 2019.
  * [11] K. Liu, B. Dolan-Gavitt, and S. Garg, “Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks,” in Proceedings of the International Symposium on Research in Attacks, Intrusions, and Defenses, 2018\.
  * [12] X. Qiao, Y. Yang, and H. Li, “Defending Neural Backdoors via Generative Distribution Modeling,” in Proceedings of Advances in Neural Information Processing Systems, 2019.
  * [13] A. K. Veldanda, K. Liu, B. Tan, P. Krishnamurthy, F. Khorrami, R. Karri, B. Dolan-Gavitt, and S. Garg, “Nnoculation: Catching badnets in the wild,” in Proceedings of the 14th ACM Workshop on Artificial Intelligence and Security, AISec ’21, (New York, NY, USA), p. 49–60, Association for Computing Machinery, 2021.
  * [14] “Spam hero.” https://www.spamhero.com/.
  * [15] “Spam experts.” https://www.spamexperts.com/.
  * [16] “Fuse Mail.” https://global.vipre.com/.
  * [17] “Mail channels.” https://www.mailchannels.com/.
  * [18] I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” 2014.
  * [19] D. E. Rumelhart and J. L. McClelland, Learning Internal Representations by Error Propagation, pp. 318–362.  1987\.
  * [20] M. I. Jordan, “Serial order: a parallel distributed processing approach. technical report, june 1985-march 1986,” 5 1986.
  * [21] S. Hochreiter and J. Schmidhuber, “Long Short-Term Memory,” Neural Computation, vol. 9, pp. 1735–1780, 11 1997.
  * [22] K. Cho, B. van Merrienboer, C. Gulcehre, D. Bahdanau, F. Bougares, H. Schwenk, and Y. Bengio, “Learning phrase representations using rnn encoder-decoder for statistical machine translation,” 2014.
  * [23] “Spam assassin project,” in Spam Assassin Public Corpus, 2015. https://spamassassin.apache.org/publiccorpus/.
  * [24] E. Eryilmaz, D. Sahin, and E. Kilic, “Filtering turkish spam using lstm from deep learning techniques,” in 2020 8th International Symposium on Digital Forensics and Security (ISDFS), pp. 1–6, 2020.