sign}}_{X}+B^{\infty}_{\mathbf{f}})\,.$

We refer to [PPST2] for a detailed discussion of the index theory associated
to perturbed operators such as the one appearing above.

Rho numbers associated to higher delocalized cocycles We can generalize the
above definitions and define rho numbers associated the higher cocycles
$\Phi^{P}_{g}$. More precisely, let $P=MNA$, $g\in M$ as above and consider
$\Phi_{g}^{P}$ and $\Phi_{X,g}^{P}$ (we recall that $X$ is without boundary).
Assume that $\mathbf{h}$ is a slice-compatible $G$-invariant PSC metric on
$X$. Then

(7.6) $\rho_{g}^{P}(\mathbf{h}):=\eta_{g}(D_{X_{M}})$

(with $X_{M}$ the reduced manifold associated to $X$) is well defined. Notice
that it is proved [PPST] that if $D_{X}$ invertible, then $D_{X_{M}}$ is also
invertible.

Bordism properties. The APS index theorems introduced in this article can be
used to study the bordism properties of these rho invariants. We concentrate
on the case of psc metrics. We assume, unless otherwise stated, that we are on
a $G$-proper manifold which is endowed with a slice-compatible $G$-invariant
metric and a slice-compatible $G$-invariant Spin structure.

Let $(Y,\mathbf{h}_{0})$ and $(Y,\mathbf{h}_{1})$ be two slice-compatible psc
metrics. We say that they are $G$-concordant if there exists a $G$-invariant
metric $\mathbf{h}$ on $Y\times[0,1]$ which is of PSC, product-type near the
boundary and restricts to $\mathbf{h}_{0}$ at $Y\times\\{0\\}$ and to
$\mathbf{h}_{1}$ at $Y\times\\{1\\}$.

The following Proposition is an example of the applications one can envisage
for these secondary invariants. Before stating it, we remark that if $g$ is
non-elliptic, that is, does not conjugate to a compact element, then every
element of the conjugacy class $C(g):=\\{hgh^{-1}|h\in G\\}$ in $G$ does not
have any fixed point on a $G$-proper manifold.

######  7.7 Proposition.

1] Assume that the $G$-invariant psc metrics $\mathbf{h}_{0}$ and
$\mathbf{h}_{1}$ on $Y$ are $G$-concordant. Assume that $g$ is non-elliptic on
$Y$. Then $\rho_{g}(\mathbf{h}_{0})=\rho_{g}(\mathbf{h}_{1})$.
2] Let $P=MAN<G$ be a cuspidal parabolic subgroup and let $x\in M$ be a
semisimple element. Assume that the $G$-invariant slice-compatible psc metrics
$\mathbf{h}_{0}$ and $\mathbf{h}_{1}$ on $Y$ are $G$-concordant. Assume that
$g$ is non-elliptic on $Y_{M}$. Then
$\rho^{P}_{g}(\mathbf{h}_{0})=\rho^{P}_{g}(\mathbf{h}_{1})$.
Put it differently, for such $g$ our (higher) rho invariants are in fact
concordance invariants.

###### Proof.

In both cases the proof is an immediate consequence of the relevant
delocalized APS index theorems. ∎

######  7.8 Remark.

In the case of free proper actions of discrete groups, higher rho invariants
have been employed very successfully in studying the moduli space of
concordant metrics of positive scalar curvature. See [Xie-Yu-moduli] and
[PSZ]. It is a challenge to understand whether the results we have just
explained in the context of proper actions of Lie groups can be employed in
studying the space $\mathcal{R}^{+}_{G,{\rm slice}}(Y)$ of slice-compatible
metrics of PSC (if non-empty) or the space $\mathcal{R}^{+}_{G}(Y)$ (arbitrary
$G$-equivariant metrics of PSC). For these questions it would be interesting
to develop a $G$-equivariant Stolz’ sequence and investigate its basic
properties. We leave this task to future research.

## References

  * [1]
AbelsHerbertParallelizability of proper actions, global $K$-slices and maximal
compact subgroupsMath. Ann.2121974/751–19ISSN 0025-5831Review
MathReviewsDocument@article{abels:slice, author = {Abels, Herbert}, title =
{Parallelizability of proper actions, global $K$-slices and maximal compact
subgroups}, journal = {Math. Ann.}, volume = {212}, date = {1974/75}, pages =
{1–19}, issn = {0025-5831}, review = {\MR{375264}}, doi =
{10.1007/BF01343976}}

  * [3]
AtiyahM. F.Elliptic operators, discrete groups and von neumann
algebrastitle={Colloque ``Analyse et Topologie'' en l'Honneur de Henri Cartan
}, address={Orsay}, date={1974}, publisher={Soc. Math. France, Paris},
197643–72. Astérisque, No. 32–33Review MathReviews@article{Atiyah:L2, author =
{Atiyah, M. F.}, title = {Elliptic operators, discrete groups and von Neumann
algebras}, conference = {title={Colloque ``Analyse et Topologie'' en l'Honneur
de Henri Cartan }, address={Orsay}, date={1974}, }, book = {publisher={Soc.
Math. France, Paris}, }, date = {1976}, pages = {43–72. Ast\'{e}risque, No.
32-33}, review = {\MR{0420729}}}

  * [5]
Schmid, WilfriedAtiyah, Michael AUTHOR =A geometric construction of the
discrete series for semisimple lie groupsInvent. Math.4219771–62ISSN
0020-9910Review MathReviewsDocument@article{Atiyah-Schmid, author = {{Atiyah,
Michael} AUTHOR = {Schmid, Wilfried}}, title = {A geometric construction of
the discrete series for semisimple Lie groups}, journal = {Invent. Math.},
volume = {42}, date = {1977}, pages = {1–62}, issn = {0020-9910}, review =
{\MR{463358}}, doi = {10.1007/BF01389783}}

  * [7]
Higson, NigelBaum, Paul AUTHOR = Connes, Alain AUTHOR =Classifying space for
proper actions and $K$-theory of group
$C^{\ast}$-algebrastitle={$C^\ast$-algebras: 1943–1993}, address={San Antonio,
TX}, date={1993}, series={Contemp. Math.}, volume={167}, publisher={Amer.
Math. Soc., Providence, RI}, 1994240–291Review
MathReviewsDocument@article{BCH, author = {{Baum, Paul} AUTHOR = {Connes,
Alain} AUTHOR = {Higson, Nigel}}, title = {Classifying space for proper
actions and $K$-theory of group $C^\ast$-algebras}, conference =
{title={$C^\ast$-algebras: 1943–1993}, address={San Antonio, TX}, date={1993},
}, book = {series={Contemp. Math.}, volume={167}, publisher={Amer. Math. Soc.,
Providence, RI}, }, date = {1994}, pages = {240–291}, review = {\MR{1292018}},
doi = {10.1090/conm/167/1292018}}

  * [9]
BismutJean-MichelEta invariants and the hypoelliptic LaplacianJ. Eur. Math.
Soc. (JEMS)21201982355–2515ISSN 1435-9855Review
MathReviewsDocument@article{Bismut-eta, author = {Bismut, Jean-Michel}, title
= {Eta invariants and the hypoelliptic {L}aplacian}, journal = {J. Eur. Math.
Soc. (JEMS)}, volume = {21}, date = {2019}, number = {8}, pages = {2355–2515},
issn = {1435-9855}, review = {\MR{4035848}}, doi = {10.4171/jems/887}}

  * [11]
BlackadarBruce$K$-Theory for operator algebrasMathematical Sciences Research
Institute Publications52Cambridge University Press, Cambridge1998xx+300ISBN
0-521-63532-2Review MathReviews@book{bla:book, author = {Blackadar, Bruce},
title = {$K$-theory for operator algebras}, series = {Mathematical Sciences
Research Institute Publications}, volume = {5}, edition = {2}, publisher =
{Cambridge University Press, Cambridge}, date = {1998}, pages = {xx+300}, isbn
= {0-521-63532-2}, review = {\MR{1656031}}}

  * [13]
BurgheleaDanThe cyclic homology of the group ringsComment. Math.
Helv.6019853354–365ISSN 0010-2571Review MathReviewsDocument@article{Burghelea,
author = {Burghelea, Dan}, title = {The cyclic homology of the group rings},
journal = {Comment. Math. Helv.}, volume = {60}, date = {1985}, number = {3},
pages = {354–365}, issn = {0010-2571}, review = {\MR{814144}}, doi =
{10.1007/BF02567420}}

  * [15]
ChabertJérômeEchterhoffSiegfriedNestRyszardThe Connes-Kasparov conjecture for
almost connected groups and for linear $p$-adic groupsPubl. Math. Inst. Hautes
Études Sci.Publications Math\'{e}matiques. Institut de Hautes \'{E}tudes
Scientifiques972003239–278ISSN 0073-830119K35 (20D25)2010742Jean-Louis
TuDocumentLinkMathReview (Jean-Louis Tu)@article{nest-et-al, author =
{Chabert, J\'{e}r\^{o}me}, author = {Echterhoff, Siegfried}, author = {Nest,
Ryszard}, title = {The {C}onnes-{K}asparov conjecture for almost connected
groups and for linear {$p$}-adic groups}, journal = {Publ. Math. Inst. Hautes
\'{E}tudes Sci.}, fjournal = {Publications Math\'{e}matiques. Institut de
Hautes \'{E}tudes Scientifiques}, number = {97}, year = {2003}, pages =
{239–278}, issn = {0073-8301}, mrclass = {19K35 (20D25)}, mrnumber =
{2010742}, mrreviewer = {Jean-Louis Tu}, doi = {10.1007/s10240-003-0014-2},
url = {https://doi-org.libproxy.wustl.edu/10.1007/s10240-003-0014-2}}

  * [17]
ChenXiaomanWangJinminXieZhizhangYuGuoliangDelocalized eta invariants, cyclic
cohomology and higher rho invariants, arXiv:1901.02378to appear in Ann.
$K$-theory@article{ChenWangXieYu, author = {Chen, Xiaoman}, author = {Wang,
Jinmin}, author = {Xie, Zhizhang}, author = {Yu, Guoliang}, title =
{Delocalized eta invariants, cyclic cohomology and higher rho invariants, {\rm
arXiv:1901.02378}}, journal = {to appear in Ann. $K$-theory}}

  * [19]
ConnesAlainNoncommutative differential geometryInst. Hautes Études Sci. Publ.
Math.621985257–360ISSN 0073-8301Review MathReviews@article{Connes:IHES, author
= {Connes, Alain}, title = {Noncommutative differential geometry}, journal =
{Inst. Hautes \'{E}tudes Sci. Publ. Math.}, number = {62}, date = {1985},
pages = {257–360}, issn = {0073-8301}, review = {\MR{823176}}}

  * [21]
ConnesAlainNoncommutative geometryAcademic Press, Inc., San Diego,
CA1994xiv+661ISBN 0-12-185860-XReview MathReviews@book{Connes, author =
{Connes, Alain}, title = {Noncommutative geometry}, publisher = {Academic
Press, Inc., San Diego, CA}, date = {1994}, pages = {xiv+661}, isbn =
{0-12-185860-X}, review = {\MR{1303779}}}

  * [23]
ConnesAlainMoscoviciHenriCyclic cohomology, the novikov conjecture and
hyperbolic groupsTopology2919903345–388ISSN 0040-9383Review
MathReviewsDocument@article{ConnesMoscovici, author = {Connes, Alain}, author
= {Moscovici, Henri}, title = {Cyclic cohomology, the Novikov conjecture and
hyperbolic groups}, journal = {Topology}, volume = {29}, date = {1990}, number
= {3}, pages = {345–388}, issn = {0040-9383}, review = {\MR{1066176}}, doi =
{10.1016/0040-9383(90)90003-3}}

  * [25]
ConnesAlainMoscoviciHenriThe $L^{2}$-index theorem for homogeneous spaces of
lie groupsAnn. of Math. (2)11519822291–330ISSN 0003-486XReview
MathReviewsDocument@article{Connes-Moscovici:L2, author = {Connes, Alain},
author = {Moscovici, Henri}, title = {The $L^{2}$-index theorem for
homogeneous spaces of Lie groups}, journal = {Ann. of Math. (2)}, volume =
{115}, date = {1982}, number = {2}, pages = {291–330}, issn = {0003-486X},
review = {\MR{647808}}, doi = {10.2307/1971393}}

  * [27]
FedosovBorisDeformation quantization and index theoryMathematical
Topics9Akademie Verlag, Berlin1996325ISBN 3-05-501716-1Review
MathReviews@book{Fedosov:book, author = {Fedosov, Boris}, title = {Deformation
quantization and index theory}, series = {Mathematical Topics}, volume = {9},
publisher = {Akademie Verlag, Berlin}, date = {1996}, pages = {325}, isbn =
{3-05-501716-1}, review = {\MR{1376365}}}

  * [29]
FukumotoYoshiyasu$G$-Homotopy invariance of the analytic signature of proper
co-compact g-manifolds and equivariant novikov conjecture, arXiv:1709.05884
(to appear in J. Noncommut. Geom.)@unpublished{Fukumoto, author = {Fukumoto,
Yoshiyasu}, title = {$G$-homotopy invariance of the analytic signature of
proper co-compact G-manifolds and equivariant novikov conjecture, {\rm
arXiv:1709.05884 (to appear in J. Noncommut. Geom.)}}}

  * [31]
=Piazza, PaoloGorokhovsky, Alexander AUTHOR =Moriyoshi, Hitoshi AUTHORA note
on the higher atiyah-patodi-singer index theorem on galois coveringsJ.
Noncommut. Geom.1020161265–306ISSN 1661-6952Review
MathReviewsDocument@article{GMPi, author = {{Gorokhovsky, Alexander} AUTHOR
={Moriyoshi, Hitoshi} AUTHOR ={Piazza, Paolo}}, title = {A note on the higher
Atiyah-Patodi-Singer index theorem on Galois coverings}, journal = {J.
Noncommut. Geom.}, volume = {10}, date = {2016}, number = {1}, pages =
{265–306}, issn = {1661-6952}, review = {\MR{3500822}}, doi =
{10.4171/JNCG/234}}

  * [33]
title=Positive scalar curvature and Poincaré duality for proper actionsGuo,
Hao AUTHOR = Mathai, Varghese AUTHOR = Wang, HangJ. Noncommut.
Geom.13201941381–1433ISSN 1661-6952Review MathReviewsDocument@article{guo-
mathai-wang-psc, author = {{Guo, Hao} AUTHOR = {Mathai, Varghese} AUTHOR =
{Wang, Hang} title={Positive scalar curvature and Poincar\'{e} duality for
proper actions}}, journal = {J. Noncommut. Geom.}, volume = {13}, date =
{2019}, number = {4}, pages = {1381–1433}, issn = {1661-6952}, review =
{\MR{4059824}}, doi = {10.4171/jncg/321}}

  * [35]
HankeBernhardPositive scalar curvature with symmetryJ. Reine Angew.
Math.614200873–115ISSN 0075-4102Review MathReviewsDocument@article{hanke-
symmetry, author = {Hanke, Bernhard}, title = {Positive scalar curvature with
symmetry}, journal = {J. Reine Angew. Math.}, volume = {614}, date = {2008},
pages = {73–115}, issn = {0075-4102}, review = {\MR{2376283}}, doi =
{10.1515/CRELLE.2008.003}}

  * [37]
Discrete series for semisimple Lie groups. II. Explicit determination of the
charactersHarish-Chandra TITLE =Acta Math.11619661–111ISSN 0001-5962Review
MathReviewsDocument@article{Harish-Chandra-dis, author = {{Harish-Chandra}
TITLE = {Discrete series for semisimple {L}ie groups. {II}. {E}xplicit
determination of the characters}}, journal = {Acta Math.}, volume = {116},
date = {1966}, pages = {1–111}, issn = {0001-5962}, review = {\MR{219666}},
doi = {10.1007/BF02392813}}

  * [39]
HelgasonSigurdurDifferential geometry, lie groups, and symmetric spacesPure
and Applied Mathematics80Academic Press, Inc. [Harcourt Brace Jovanovich,
Publishers], New York-London1978xv+628ISBN 0-12-338460-5Review
MathReviews@book{Helg, author = {Helgason, Sigurdur}, title = {Differential
geometry, Lie groups, and symmetric spaces}, series = {Pure and Applied
Mathematics}, volume = {80}, publisher = {Academic Press, Inc. [Harcourt Brace
Jovanovich, Publishers], New York-London}, date = {1978}, pages = {xv+628},
isbn = {0-12-338460-5}, review = {\MR{514561}}}

  * [41]
HigsonNigelRoeJohnAnalytic $K$-homologyOxford Mathematical MonographsOxford
Science PublicationsOxford University Press, Oxford2000xviii+405ISBN
0-19-851176-0Review MathReviews@book{hr-book, author = {Higson, Nigel}, author
= {Roe, John}, title = {Analytic $K$-homology}, series = {Oxford Mathematical
Monographs}, note = {Oxford Science Publications}, publisher = {Oxford
University Press, Oxford}, date = {2000}, pages = {xviii+405}, isbn =
{0-19-851176-0}, review = {\MR{1817560}}}

  * [43]
HochsPeterQuantisation commutes with reduction at discrete series
representations of semisimple groupsAdv. Math.22220093862–919ISSN
0001-8708Review MathReviewsDocument@article{Hochs2009, author = {Hochs,
Peter}, title = {Quantisation commutes with reduction at discrete series
representations of semisimple groups}, journal = {Adv. Math.}, volume = {222},
date = {2009}, number = {3}, pages = {862–919}, issn = {0001-8708}, review =
{\MR{2553372}}, doi = {10.1016/j.aim.2009.05.011}}

  * [45]
HochsPeterMathaiVargheseQuantising proper actions on spinc-manifoldsAsian J.
Math.2120174631–685ISSN 1093-6106Review MathReviewsDocument@article{Hochs-
Mathai, author = {Hochs, Peter}, author = {Mathai, Varghese}, title =
{Quantising proper actions on Spin$^c$-manifolds}, journal = {Asian J. Math.},
volume = {21}, date = {2017}, number = {4}, pages = {631–685}, issn =
{1093-6106}, review = {\MR{3691850}}, doi = {10.4310/AJM.2017.v21.n4.a2}}

  * [47]
HochsPeterSongYanliAn equivariant index for proper actions iii: the invariant
and discrete series indicesDifferential Geom. Appl.4920161–22ISSN
0926-2245Review MathReviewsDocument@article{HS-decomposition, author = {Hochs,
Peter}, author = {Song, Yanli}, title = {An equivariant index for proper
actions III: The invariant and discrete series indices}, journal =
{Differential Geom. Appl.}, volume = {49}, date = {2016}, pages = {1–22}, issn
= {0926-2245}, review = {\MR{3573821}}, doi = {10.1016/j.difgeo.2016.07.003}}

  * [49]
HochsPeterSongYanliTangXiangAn index theorem for higher orbital integralsMath.
Ann.38220221-2169–202ISSN 0025-5831Review MathReviewsDocument@article{hst,
author = {Hochs, Peter}, author = {Song, Yanli}, author = {Tang, Xiang}, title
= {An index theorem for higher orbital integrals}, journal = {Math. Ann.},
volume = {382}, date = {2022}, number = {1-2}, pages = {169–202}, issn =
{0025-5831}, review = {\MR{4377301}}, doi = {10.1007/s00208-021-02233-3}}

  * [51]
HochsPeterWangBai-LingWangHangAn equivariant atiyah-patodi-singer index
theorem for proper actions i: the index formulaInt. Math. Res. Not.
IMRN202343138–3193ISSN 1073-7928Review MathReviewsDocument@article{HWW1,
author = {Hochs, Peter}, author = {Wang, Bai-Ling}, author = {Wang, Hang},
title = {An equivariant Atiyah-Patodi-Singer index theorem for proper actions
I: The index formula}, journal = {Int. Math. Res. Not. IMRN}, date = {2023},
number = {4}, pages = {3138–3193}, issn = {1073-7928}, review =
{\MR{4565636}}, doi = {10.1093/imrn/rnab324}}

  * [53]
HochsPeterWangBai-LingWangHangAn equivariant atiyah-patodi-singer index
theorem for proper actions ii: the k-theoretic index, arXiv:2006.08086to
appear in Math Z.ISSN Review MathReviewsDocument@article{HWW2, author =
{Hochs, Peter}, author = {Wang, Bai-Ling}, author = {Wang, Hang}, title = {An
equivariant Atiyah-Patodi-Singer index theorem for proper actions II: the
K-theoretic index, {\rm arXiv:2006.08086}}, journal = {to appear in Math Z.},
volume = {{}}, date = {{}}, number = {{}}, pages = {{}}, issn = {}, review =
{\MR{2273457}}, doi = {{}}}

  * [55]
Wang, HangHochs, Peter AUTHOR =Orbital integrals and $K$-theory classesAnn.
K-Theory420192185–209ISSN 2379-1683Review MathReviewsDocument@article{Hochs-
Wang-KT, author = {{Hochs, Peter} AUTHOR = {Wang, Hang}}, title = {Orbital
integrals and {$K$}-theory classes}, journal = {Ann. K-Theory}, volume = {4},
date = {2019}, number = {2}, pages = {185–209}, issn = {2379-1683}, review =
{\MR{3990784}}, doi = {10.2140/akt.2019.4.185}}

  * [57]
Wang, HangHochs, Peter AUTHOR =A fixed point formula and harish-chandra’s
character formulaA fixed point formula and harish-chandra’s character
formulaProc. Lond. Math. Soc. (3)116201811–32ISSN 0024-6115Review
MathReviewsDocument@article{Hochs-Wang-HC, author = {{Hochs, Peter} AUTHOR =
{Wang, Hang}}, title = {A fixed point formula and {H}arish-{C}handra's
character formula}, title = {A fixed point formula and Harish-Chandra's
character formula}, journal = {Proc. Lond. Math. Soc. (3)}, volume = {116},
date = {2018}, number = {1}, pages = {1–32}, issn = {0024-6115}, review =
{\MR{3747042}}, doi = {10.1112/plms.12066}}

  * [59]
KasparovG. G.The operator $K$-functor and extensions of
$C^{\ast}$-algebrasRussianIzv. Akad. Nauk SSSR Ser. Mat.4419803571–636,
719ISSN 0373-2436Review MathReviews@article{kasparov-functor, author =
{Kasparov, G. G.}, title = {The operator $K$-functor and extensions of
$C^{\ast} $-algebras}, language = {Russian}, journal = {Izv. Akad. Nauk SSSR
Ser. Mat.}, volume = {44}, date = {1980}, number = {3}, pages = {571–636,
719}, issn = {0373-2436}, review = {\MR{582160}}}

  * [61]
LafforgueVincentBanach $KK$-theory and the Baum-Connes
conjecturetitle={Proceedings of the International Congress of Mathematicians,
Vol. II}, address={Beijing}, date={2002}, publisher={Higher Ed. Press,
Beijing}, 2002795–812Review MathReviews@article{Lafforgue, author =
{Lafforgue, Vincent}, title = {Banach {$KK$}-theory and the {B}aum-{C}onnes
conjecture}, conference = {title={Proceedings of the International Congress of
Mathematicians, Vol. II}, address={Beijing}, date={2002}, }, book =
{publisher={Higher Ed. Press, Beijing}, }, date = {2002}, pages = {795–812},
review = {\MR{1957086}}}

  * [63]
LawsonJr.H. BlaineYauShing TungScalar curvature, non-abelian group actions,
and the degree of symmetry of exotic spheresComment. Math.
Helv.491974232–244ISSN 0010-2571Review MathReviewsDocument@article{lawson-yau-
psc, author = {Lawson, H. Blaine, Jr.}, author = {Yau, Shing Tung}, title =
{Scalar curvature, non-abelian group actions, and the degree of symmetry of
exotic spheres}, journal = {Comment. Math. Helv.}, volume = {49}, date =
{1974}, pages = {232–244}, issn = {0010-2571}, review = {\MR{358841}}, doi =
{10.1007/BF02566731}}

  * [65]
LeichtnamEricPiazzaPaoloThe $b$-pseudodifferential calculus on galois
coverings and a higher atiyah-patodi-singer index theoremEnglish, with English
and French summariesMém. Soc. Math. Fr. (N.S.)681997iv+121ISSN 0249-633XReview
MathReviews@article{LeichtnamPiazzaMemoires, author = {Leichtnam, Eric},
author = {Piazza, Paolo}, title = {The $b$-pseudodifferential calculus on
Galois coverings and a higher Atiyah-Patodi-Singer index theorem}, language =
{English, with English and French summaries}, journal = {M\'{e}m. Soc. Math.
Fr. (N.S.)}, number = {68}, date = {1997}, pages = {iv+121}, issn =
{0249-633X}, review = {\MR{1488084}}}

  * [67]
LeichtnamEricPiazzaPaoloDirac index classes and the noncommutative spectral
flowJ. Funct. Anal.20020032348–400ISSN 0022-1236Review
MathReviewsDocument@article{LP-JFA, author = {Leichtnam, Eric}, author =
{Piazza, Paolo}, title = {Dirac index classes and the noncommutative spectral
flow}, journal = {J. Funct. Anal.}, volume = {200}, date = {2003}, number =
{2}, pages = {348–400}, issn = {0022-1236}, review = {\MR{1979016}}, doi =
{10.1016/S0022-1236(02)00044-7}}

  * [69]
LeichtnamEricPiazzaPaoloÉtale groupoids, eta invariants and index theoryJ.
Reine Angew. Math.5872005169–233ISSN 0075-4102Review
MathReviewsDocument@article{LPETALE, author = {Leichtnam, Eric}, author =
{Piazza, Paolo}, title = {\'{E}tale groupoids, eta invariants and index
theory}, journal = {J. Reine Angew. Math.}, volume = {587}, date = {2005},
pages = {169–233}, issn = {0075-4102}, review = {\MR{2186978}}, doi =
{10.1515/crll.2005.2005.587.169}}

  * [71]
LeschMatthiasMoscoviciHenriPflaumMarkus J.Connes-chern character for manifolds
with boundary and eta cochainsMem. Amer. Math. Soc.22020121036viii+92ISSN
0065-9266ISBN 978-0-8218-7296-3Review MathReviewsDocument@article{LMP, author
= {Lesch, Matthias}, author = {Moscovici, Henri}, author = {Pflaum, Markus
J.}, title = {Connes-Chern character for manifolds with boundary and eta
cochains}, journal = {Mem. Amer. Math. Soc.}, volume = {220}, date = {2012},
number = {1036}, pages = {viii+92}, issn = {0065-9266}, isbn =
{978-0-8218-7296-3}, review = {\MR{3025890}}, doi =
{10.1090/S0065-9266-2012-00656-3}}

  * [73]
LodayJean-LouisCyclic homologyGrundlehren der mathematischen Wissenschaften
[Fundamental Principles of Mathematical Sciences]301Appendix E by María O.
RoncoSpringer-Verlag, Berlin1992xviii+454ISBN 3-540-53339-7Review
MathReviewsDocument@book{Loday, author = {Loday, Jean-Louis}, title = {Cyclic
homology}, series = {Grundlehren der mathematischen Wissenschaften
[Fundamental Principles of Mathematical Sciences]}, volume = {301}, note =
{Appendix E by Mar\'{\i}a O. Ronco}, publisher = {Springer-Verlag, Berlin},
date = {1992}, pages = {xviii+454}, isbn = {3-540-53339-7}, review =
{\MR{1217970}}, doi = {10.1007/978-3-662-21739-9}}

  * [75]
MelroseRichard B.The atiyah-patodi-singer index theoremResearch Notes in
Mathematics4A K Peters, Ltd., Wellesley, MA1993xiv+377ISBN 1-56881-002-4Review
MathReviewsDocument@book{Melrose-Book, author = {Melrose, Richard B.}, title =
{The Atiyah-Patodi-Singer index theorem}, series = {Research Notes in
Mathematics}, volume = {4}, publisher = {A K Peters, Ltd., Wellesley, MA},
date = {1993}, pages = {xiv+377}, isbn = {1-56881-002-4}, review =
{\MR{1348401}}, doi = {10.1016/0377-0257(93)80040-i}}

  * [77]
MelroseRichard B.PiazzaPaoloFamilies of dirac operators, boundaries and the
b-calculusJ. Differential Geom.461997199–180Review MathReviews@article{Mel-P1,
author = {Melrose, Richard B.}, author = {Piazza, Paolo}, title = {Families of
Dirac operators, boundaries and the b-calculus}, journal = {J. Differential
Geom.}, volume = {46}, date = {1997}, number = {1}, pages = {99–180}, review =
{\MR{1472895}}}

  * [79]
MoscoviciH.WuF.-B.Localization of topological pontryagin classes via finite
propagation speedGeom. Funct. Anal.41994152–92ISSN 1016-443XReview
MathReviewsDocument@article{moscovici-wu, author = {Moscovici, H.}, author =
{Wu, F.-B.}, title = {Localization of topological Pontryagin classes via
finite propagation speed}, journal = {Geom. Funct. Anal.}, volume = {4}, date
= {1994}, number = {1}, pages = {52–92}, issn = {1016-443X}, review =
{\MR{1254310}}, doi = {10.1007/BF01898361}}

  * [81]
MoriyoshiHitoshiPiazzaPaoloEta cocycles, relative pairings and the godbillon-
vey index theoremGeom. Funct. Anal.22201261708–1813ISSN 1016-443XReview
MathReviewsDocument@article{moriyoshi-piazza, author = {Moriyoshi, Hitoshi},
author = {Piazza, Paolo}, title = {Eta cocycles, relative pairings and the
Godbillon-Vey index theorem}, journal = {Geom. Funct. Anal.}, volume = {22},
date = {2012}, number = {6}, pages = {1708–1813}, issn = {1016-443X}, review =
{\MR{3000501}}, doi = {10.1007/s00039-012-0197-0}}

  * [83]
==Stanton, Robert J.Moscovici, Henri AUTHOREta invariants of Dirac operators
on locally symmetric manifoldsInvent. Math.9519893629–666ISSN 0020-9910Review
MathReviewsDocument@article{Moscovici-Stanton, author = {{Moscovici, Henri}
AUTHOR =={Stanton, Robert J.}}, title = {Eta invariants of {D}irac operators
on locally symmetric manifolds}, journal = {Invent. Math.}, volume = {95},
date = {1989}, number = {3}, pages = {629–666}, issn = {0020-9910}, review =
{\MR{979370}}, doi = {10.1007/BF01393895}}

  * [85]
NestRyszardTsyganBorisAlgebraic index theoremComm. Math.
Phys.17219952223–262ISSN 0010-3616Review MathReviews@article{Nest-
Tsygan:algebraicindex, author = {Nest, Ryszard}, author = {Tsygan, Boris},
title = {Algebraic index theorem}, journal = {Comm. Math. Phys.}, volume =
{172}, date = {1995}, number = {2}, pages = {223–262}, issn = {0010-3616},
review = {\MR{1350407}}}

  * [87]
NestRyszardTsyganBorisAlgebraic index theorem for familiesAdv.
Math.11319952151–205ISSN 0001-8708Review MathReviewsDocument@article{Nest-
Tsygan:family, author = {Nest, Ryszard}, author = {Tsygan, Boris}, title =
{Algebraic index theorem for families}, journal = {Adv. Math.}, volume =
{113}, date = {1995}, number = {2}, pages = {151–205}, issn = {0001-8708},
review = {\MR{1337107}}, doi = {10.1006/aima.1995.1037}}

  * [89]
PflaumM. J.PosthumaH.TangX.The localized longitudinal index theorem for lie
groupoids and the van est mapAdv. Math.2702015223–262ISSN 0001-8708Review
MathReviewsDocument@article{Pflaum-Posthuma-Tang:vanEst, author = {Pflaum, M.
J.}, author = {Posthuma, H.}, author = {Tang, X.}, title = {The localized
longitudinal index theorem for Lie groupoids and the van Est map}, journal =
{Adv. Math.}, volume = {270}, date = {2015}, pages = {223–262}, issn =
{0001-8708}, review = {\MR{3286536}}, doi = {10.1016/j.aim.2014.11.007}}

  * [91]
PflaumMarkus J.PosthumaHesselTangXiangThe transverse index theorem for proper
cocompact actions of lie groupoidsJ. Differential Geom.9920153443–472ISSN
0022-040XReview MathReviews@article{PPT, author = {Pflaum, Markus J.}, author
= {Posthuma, Hessel}, author = {Tang, Xiang}, title = {The transverse index
theorem for proper cocompact actions of Lie groupoids}, journal = {J.
Differential Geom.}, volume = {99}, date = {2015}, number = {3}, pages =
{443–472}, issn = {0022-040X}, review = {\MR{3316973}}}

  * [93]
PiazzaPaoloPosthumaHessel B.Higher genera for proper actions of lie groupsAnn.
K-Theory420193473–504ISSN 2379-1683Review MathReviewsDocument@article{PP1,
author = {Piazza, Paolo}, author = {Posthuma, Hessel B.}, title = {Higher
genera for proper actions of Lie groups}, journal = {Ann. K-Theory}, volume =
{4}, date = {2019}, number = {3}, pages = {473–504}, issn = {2379-1683},
review = {\MR{4043466}}, doi = {10.2140/akt.2019.4.473}}

  * [95]
PiazzaPaoloPosthumaHessel B.Higher genera for proper actions of lie groups,
ii: the case of manifolds with boundaryAnn. K-Theory620214713–782ISSN
2379-1683Review MathReviewsDocument@article{PP2, author = {Piazza, Paolo},
author = {Posthuma, Hessel B.}, title = {Higher genera for proper actions of
Lie groups, II: the case of manifolds with boundary}, journal = {Ann.
K-Theory}, volume = {6}, date = {2021}, number = {4}, pages = {713–782}, issn
= {2379-1683}, review = {\MR{4382801}}, doi = {10.2140/akt.2021.6.713}}

  * [97]
PiazzaPaoloPosthumaHessel B.SongYanlititle=Higher Orbital Integrals, Rho
Numbers and Index TheoryTang, XiangarXiv:2108.00982(v3)ISSN Review
Document@article{PPST, author = {Piazza, Paolo}, author = {Posthuma, Hessel
B.}, author = {Song, Yanli}, author = {{Tang, Xiang} title={Higher Orbital
Integrals, Rho Numbers and Index Theory}}, journal = {arXiv:2108.00982(v3)},
volume = {{}}, date = {{}}, number = {{}}, pages = {}, issn = {{}}, review =
{{}}, doi = {{}}}

  * [99]
PiazzaPaoloPosthumaHessel B.SongYanlititle=Heat kernels of perturbed operators
and index theory on G-proper manifoldsTang, XiangarXiv:2307.09252ISSN Review
Document@article{PPST2, author = {Piazza, Paolo}, author = {Posthuma, Hessel
B.}, author = {Song, Yanli}, author = {{Tang, Xiang} title={Heat kernels of
perturbed operators and index theory on G-proper manifolds}}, journal =
{arXiv:2307.09252}, volume = {{}}, date = {{}}, number = {{}}, pages = {{}},
issn = {{}}, review = {{}}, doi = {{}}}

  * [101]
PiazzaPaoloSchickThomasRho-classes, index theory and stolz’ positive scalar
curvature sequenceJ. Topol.720144965–1004ISSN 1753-8416Review
MathReviewsDocument@article{PS-Stolz, author = {Piazza, Paolo}, author =
{Schick, Thomas}, title = {Rho-classes, index theory and Stolz' positive
scalar curvature sequence}, journal = {J. Topol.}, volume = {7}, date =
{2014}, number = {4}, pages = {965–1004}, issn = {1753-8416}, review =
{\MR{3286895}}, doi = {10.1112/jtopol/jtt048}}

  * [103]
PiazzaPaoloSchickThomastitle=Mapping analytic surgery to homology, higher rho
numbers and metrics of positive scalar curvature, arXiv:1905.11861Zenobi, Vito
Feliceto appear in Memoirs AMS@article{PSZ, author = {Piazza, Paolo}, author =
{Schick, Thomas}, author = {{Zenobi, Vito Felice} title={Mapping analytic
surgery to homology, higher rho numbers and metrics of positive scalar
curvature, {\rm arXiv:1905.11861}}}, journal = {to appear in Memoirs AMS}}

  * [105]
PuschniggMichaelNew holomorphically closed subalgebras of $C^{*}$-algebras of
hyperbolic groupsGeom. Funct. Anal.2020101243–259ISSN 1016-443XReview
MathReviewsDocument@article{Puschnigg, author = {Puschnigg, Michael}, title =
{New holomorphically closed subalgebras of $C^*$-algebras of hyperbolic
groups}, journal = {Geom. Funct. Anal.}, volume = {20}, date = {2010}, number
= {1}, pages = {243–259}, issn = {1016-443X}, review = {\MR{2647141}}, doi =
{10.1007/s00039-010-0062-y}}

  * [107]
RoeJohnIndex theory, coarse geometry, and topology of manifoldsCBMS Regional
Conference Series in Mathematics90Published for the Conference Board of the
Mathematical Sciences, Washington, DC; by the American Mathematical Society,
Providence, RI1996x+100ISBN 0-8218-0413-8Review
MathReviewsDocument@book{roe:open, author = {Roe, John}, title = {Index
theory, coarse geometry, and topology of manifolds}, series = {CBMS Regional
Conference Series in Mathematics}, volume = {90}, publisher = {Published for
the Conference Board of the Mathematical Sciences, Washington, DC; by the
American Mathematical Society, Providence, RI}, date = {1996}, pages =
{x+100}, isbn = {0-8218-0413-8}, review = {\MR{1399087}}, doi =
{10.1090/cbms/090}}

  * [109]
RoeJohnComparing analytic assembly mapsQ. J. Math.5320022241–248ISSN
0033-5606Review MathReviewsDocument@article{roe-comparing, author = {Roe,
John}, title = {Comparing analytic assembly maps}, journal = {Q. J. Math.},
volume = {53}, date = {2002}, number = {2}, pages = {241–248}, issn =
{0033-5606}, review = {\MR{1909514}}, doi = {10.1093/qjmath/53.2.241}}

  * [111]
author=Tang, Xiang title=Higher Orbit Integrals, Cyclic Cocycles, and
$K$-theory of Reduced Group $C^{*}$-algebra, arXiv:1910.00175Song,
Yanli@article{st, author = {{Song, Yanli} author={Tang, Xiang} title={Higher
Orbit Integrals, Cyclic Cocycles, and $K$-theory of Reduced Group
$C^*$-algebra, {\rm arXiv:1910.00175}}}}

  * [113]
VaillantBorisIndex theory for coveringsPreprint
arXiv:0806.4043@article{Vaillant-master, author = {Vaillant, Boris}, title =
{Index Theory for Coverings}, note = {Preprint {\tt arXiv:0806.4043}}}

  * [115]
WangHang$L^{2}$-Index formula for proper cocompact group actionsJ. Noncommut.
Geom.820142393–432ISSN 1661-6952Review MathReviewsDocument@article{Wang:L2,
author = {Wang, Hang}, title = {$L^2$-index formula for proper cocompact group
actions}, journal = {J. Noncommut. Geom.}, volume = {8}, date = {2014}, number
= {2}, pages = {393–432}, issn = {1661-6952}, review = {\MR{3275037}}, doi =
{10.4171/JNCG/160}}

  * [117]
WassermannAntonyUne démonstration de la conjecture de connes-kasparov pour les
groupes de lie linéaires connexes réductifsFrench, with English summaryC. R.
Acad. Sci. Paris Sér. I Math.304198718559–562ISSN 0249-6291Review
MathReviews@article{Wa:Connes-Kasparov, author = {Wassermann, Antony}, title =
{Une d\'{e}monstration de la conjecture de Connes-Kasparov pour les groupes de
Lie lin\'{e}aires connexes r\'{e}ductifs}, language = {French, with English
summary}, journal = {C. R. Acad. Sci. Paris S\'{e}r. I Math.}, volume = {304},
date = {1987}, number = {18}, pages = {559–562}, issn = {0249-6291}, review =
{\MR{894996}}}

  * [119]
WiemelerMichaelCircle actions and scalar curvatureTrans. Amer. Math.
Soc.368201642939–2966ISSN 0002-9947Review
MathReviewsDocument@article{wiemeler-TAMS, author = {Wiemeler, Michael}, title
= {Circle actions and scalar curvature}, journal = {Trans. Amer. Math. Soc.},
volume = {368}, date = {2016}, number = {4}, pages = {2939–2966}, issn =
{0002-9947}, review = {\MR{3449263}}, doi = {10.1090/tran/6666}}

  * [121]
XieZhizhangYuGuoliangHigher rho invariants and the moduli space of positive
scalar curvature metricsAdv. Math.30720171046–1069ISSN 0001-8708Review
MathReviewsDocument@article{Xie-Yu-moduli, author = {Xie, Zhizhang}, author =
{Yu, Guoliang}, title = {Higher rho invariants and the moduli space of
positive scalar curvature metrics}, journal = {Adv. Math.}, volume = {307},
date = {2017}, pages = {1046–1069}, issn = {0001-8708}, review =
{\MR{3590536}}, doi = {10.1016/j.aim.2016.11.030}}

  * [123]
ZhangWei PingA note on equivariant eta invariantsProc. Amer. Math.
Soc.108199041121–1129ISSN 0002-9939Review MathReviewsDocument@article{Zhangwp,
author = {Zhang, Wei Ping}, title = {A note on equivariant eta invariants},
journal = {Proc. Amer. Math. Soc.}, volume = {108}, date = {1990}, number =
{4}, pages = {1121–1129}, issn = {0002-9939}, review = {\MR{1004426}}, doi =
{10.2307/2047979}}

  * [125]


# Generating Out of Distribution Adversarial Attack using Latent Space
Poisoning

Ujjwal Upadhyay
Department of Computer Science
Bharati Vidyapeeth’s College of Engineering
New Delhi, Delhi 110063
<EMAIL_ADDRESS>
Prerana Mukherjee
Department of Electrical Engineering
IIT Delhi
New Delhi, Delhi 110016
<EMAIL_ADDRESS>
Webpage: https://ujjwal-9.github.io/

###### Abstract

Traditional adversarial attacks rely upon the perturbations generated by
gradients from the network which are generally safeguarded by gradient guided
search to provide an adversarial counterpart to the network. In this paper, we
propose a novel mechanism of generating adversarial examples where the actual
image is not corrupted rather its latent space representation is utilized to
tamper the inherent structure of the image while maintaining the perceptual
quality intact and to act as legitimate data samples. As opposed to gradient-
based attacks, the latent space poisoning exploits the inclination of
classifiers to model the independent and identical distribution of the
training dataset and tricks it by producing out of distribution samples. We
train a disentangled variational autoencoder ($\beta$-VAE) to model the data
in latent space and then we add noise perturbations using a class-conditioned
distribution function to the latent space under the constraint that it is
misclassified to the target label. Our empirical results on MNIST, SVHN, and
CelebA dataset validate that the generated adversarial examples can easily
fool robust $l_{0}$, $l_{2}$, $l_{\infty}$ norm classifiers designed using
provably robust defense mechanisms.

##  1 Introduction

Artificial Neural Networks (ANN’s) are vulnerable to adversarial examples,
even an insignificant change to human eyes might still fool even the state of
the art classifier (Szegedy2014IntriguingPO, ). This motivates the exploration
of adversarial learning domain of artificial intelligence to make the neural
networks more robust and secure. Deep learning models are exposed to all kind
of threats like (DBLP:journals/corr/abs-1802-06430, )
(DBLP:journals/corr/abs-1907-00374, ) (8844593, ) demonstrates the need for
further strengthening the models and removing bias towards the presented
training dataset distribution. To train the model against such threats, many
methods have been developed. Most of these basically try to exploit
adversarial training of the model (Goodfellow2015ExplainingAH, )
(DBLP:conf/iclr/MadryMSTV18, ) (Sinha2017CertifiableDR, ). Some other
techniques aim to remove the adversarial perturbation
(DBLP:journals/corr/abs-1712-02976, ) (song2018pixeldefend, ).

In this paper, we introduce a novel method to generate adversarial examples
that are smooth by nature and provide realistic perception. In practise
adversarial examples are generally noisy in nature and are easily traceable by
humans. They can also be mitigated by above mentioned defense techniques. So
in this work, we make use of disentanglement properties of $\beta$-VAE
networks (Higgins2017betaVAELB, ) to get the meaningful latent space vector
which can be tuned with visible results in image space. We utilize a
specialized variant of $\beta$-VAE network namely JointVAE
(dupont2018learning, ) which provides more control over the latent space. We
conditioned our proposed model such that, it promotes the class with second
highest probability of occurrence and makes it visually appear in the image or
just change the classification prediction. We perform this by using
statistical theory concepts and adding the distribution of that class,
extracted from training set, to the actual latent space vector of the original
input image. This not only gives smoothing effect to the image but also
leverages additive property of latent space and linear interpolation
smoothness produced by such operations. Then we employ our pre-trained
JointVAE model to decode the new noisy latent space and obtain adversarial
examples conditioned under some constraints, mentioned in section 3. The other
contribution of our attack is that it is completely black-box attack i.e it
doesn’t require any access to the test classifier.

##  2 Background

In this section, we discuss the background on adversarial examples, attacking
methods, defense methods and also autoencoder networks. Although the topic of
adversarial attack and defense ranges from image classification, to audio
classification to many ubiquitous domains, however here we focus on image
classification.

Adversarial Attacks Let $x\in\mathbb{R}^{n}$ and $f$ be a classifier. If $f$
is known to attacker then it is called white-box attack, if it is not known
then it is called black-box attack. In white-box attacks, matrix norms such as
$l_{0}$ (7467366, ), $l_{2}$ (7780651, ), or $l_{\infty}$
(Kurakin2017AdversarialML, ) are used in combination with gradient based
methods like Fast Gradient Sign Method (FGSM (Szegedy2014IntriguingPO, )),
which assumes image or input itself to be updated with incoming gradient and
thus changes the pixel values accordingly. If this procedure is repeated
several times, then it is termed as Projected Gradient Descent (PGD
(journals/corr/KurakinGB16, )) attack.

Adversarial defenses Prevalent adversarial defenses focuses on making
classifier robust in response to perturbations in the images. These emphasize
on adversarial training with adversarial examples added to the training set.
(DBLP:journals/corr/abs-1802-00420, ) indicates that all the existing defenses
depend on certified defense or adversarial training
(DBLP:conf/iclr/MadryMSTV18, ). Although some recent certified defense
techniques have emerged which finetune the robust model in their latent space
(DBLP:journals/corr/abs-1905-05186, ) which is different from traditional
image space based adversarial training. In this paper, we propose an attack to
fool the adversarial defense trained using adversarial training.

Autoencoder Networks An autoencoder has 2 blocks, an encoder network, $E$ and
other decoder network, $D$. The encoder network translates the actual image in
pixel space to the latent space, whereas the decoder network translates the
latent space representation of the image back to pixel space. There is some
loss during this translation but the integrity of the image remains intact in
terms of its structure and some prevalent details. So, the goal of autoencoder
training is to learn the encoder and decoder coupling in such a way that the
reconstruction loss is minimal. In order to get more variability in the latent
space, we use JointVAE (dupont2018learning, ) network, which gives us more
control over the induced changes in the pixel space. It is optimized using
following optimization problem,

$\mathcal{L}(\theta,\phi)=\mathbb{E}_{q(z,c|x)}[logp_{\theta(x|z,c)}]-\beta
D_{KL}(q_{\phi}(z,c|x)||p(z,c))$ (1)

where, the joint posterior $q_{\phi}(z,c|x)$ is mapped by encoder network,
Gaussian prior $p(z,c)$ and likelihood $p_{\theta}(x|z,c)$ is mapped by
decoder network. Here latent distribution is jointly continuous and discrete
with the assumption that both continuous ($z$) and discrete ($c$) variables
are conditionally independent.

##  3 Methods

###  3.1 Out of Distribution Examples

Traditional gradient based attacks or perturbation-based attacks work on the
principle of back-propagation where we try and calculate the gradient for each
input pixel. This gradient is used to define a perturbation vector under a
constraint that the adversarial image is similar to the original image.

Definition 1 (Gradient Based Attacks). Given a subset of test images
$\tau\subset o$, where $o$ is the whole dataset distribution, small constant
$\epsilon>0$, and matrix norm $||.||$, a perturbation vector is defined. The
adversarial image, $x^{\prime}$ constructed by this perturbation vector is
defined to be any image in $\alpha$ as,

$\alpha\mathrel{\ensurestackMath{\stackon[1pt]{=}{\scriptstyle\Delta}}}\\{x\in
o\ |\ \exists x^{\prime}\in\tau,\ ||x-x^{\prime}||\leq\epsilon\wedge
f(x^{\prime})=\theta(x^{\prime})=\theta(x)\neq f(x)\\}$ (2)

where $\theta$ is a human evaluator, $f$ is a classifier and $\mathcal{I}$ is
any image.

$f:\mathcal{I}\rightarrow\\{1,2,...,K\\}$ (3)

In our work, Out of Distribution Adversarial Attack using Latent Space
Poisoning we present out of distribution images caused by latent space
poisoning, which follows the below definition.

Definition 2 (Out of Distribution Adversarial Attack). An out of distribution
example is any image that is element of
$\beta\mathrel{\ensurestackMath{\stackon[1pt]{=}{\scriptstyle\Delta}}}\\{x\in
o\ |\ o(x)\neq f(x)\\}$

In prior works, $\theta$ is chosen to be a human evaluator, $\tau$ is test
data, and $||.||$ is a matrix norm which is either $l_{\infty}$ or $l_{2}$
norm. So, $o$ should represent the images which seems realistic to the human
evaluator. As the assumption of traditional attacks, we also adhere to the
congruent lines that new image $x^{\prime}$ should be similar to original
image $x$ but with distinction of working in latent space rather than image
space itself. From this, it should be clear that $\alpha\subset\beta$. This
means our proposed attack is a generalization of traditional attacks in a more
flexible manner where latent vector can be used to regenerate a smooth image
in image space without much visible noise which was earlier controlled with
$\epsilon$. The work over latent space provides smoothing effect to the human
evaluator $\theta$.

###  3.2 Practical Attack using Latent Space Poisoning

The key to produce adversarial attacks that are out of distribution of
training set is to model the set of legitimate images in the latent space. We
do so by training a JointVAE $A$, a derivative of variational autoencoders
(kingma2014autoencoding, ). This is done to map latent space in
$z\in\mathbb{R}^{m}$, a set of continuous latent space variables, and
$c\in\mathbb{R}^{n}$, a set of discrete latent variables. This gives meaning
to our latent space in a sense that each latent factor controls a unique
aspect about the original image. In practice, such a latent space is able to
model the training data using a fairly accurate decoder which models the
likelihood i.e. $P_{\theta}(x|z,c)$. Here $z$ and $c$ are conditionally
independent.

Then a classifier model $C_{1}$ is chosen, different from the actual
classifier $C_{2}$ put under test, to classify the generated image,
$C_{1}(x^{\prime})$. This classification result produces soft labels giving us
information about similarity of images with other classes in the dataset. For
example, if a classifier produces soft labels to be
$\\{\mathcal{A},\mathcal{B},\mathcal{C}\\}\rightarrow\\{0.7,0.2,0.1\\}$. Then
it means that classifier predicts or models the current input as $\mathcal{A}$
to be highly probable with probability of $0.7$, $0.2$ for $\mathcal{B}$ and
$0.1$ for $\mathcal{C}$. This gives us an intuition about the actual modelling
of the classifier. The assumption about this pre-trained classifier is that it
should be able to classify with high accuracy and low loss. This makes it
certain that modeling of the test classifier will be more or less similar to
our trained classifier when used in combination with label smoothing
(DBLP:journals/corr/abs-1906-02629, ). This information about soft logits
gives us meaningful insights about the data distribution and we can exploit it
by perturbing noise in the latent space in order to make the soft labels
deviate from actual target label in a subtle way. The minute change to the
latent space in our proposed work is to make second most probable label to
have equal probability as the class with highest probability.

Understanding Latent Space Poisoning

Let $A_{\theta}(x)$, $C_{\phi}(x)$ be the variational autoencoder and pre-
trained inference classifier respectively. Let $f(x)$ be the classifier we
want to attack. Here, we put our focus on out of distribution adversarial
attack which generate a target image $x^{\prime}$ where $o(x^{\prime})\neq
f(x^{\prime})$, where $o(.)$ is a human evaluator. In order to produce the
adversarial examples of this sort, we propose finding an appropriate latent
space vector, $z^{\prime}$ (continuous factors) and $c^{\prime}$ (discrete
factors). This is done by adding some noise to the predetermined latent space
vectors of the input in their continuous and discrete factors. This is done by
firstly finding the distribution of latent space vector for each class in the
training set.

$\mathcal{D}(y_{i})\rightarrow\\{(\mu_{z}^{y_{i}},\sigma_{z}^{y_{i}}),(\mu_{c}^{y_{i}},\sigma_{c}^{y_{i}})\\}\;\forall\,i\in\mathcal{O}$
(4)

where $\mathcal{O}$ denotes classes. This distribution function $\mathcal{D}$
helps in generating a latent space vector which when added to the original
latent space along with some noise $\eta$, produce the desired result
regarding the output image. We have utilized additive noise over
multiplicative noise because (kingma2014autoencoding, ; Ozair2014DeepDG, )
have shown in their work that the linear interpolation of images in latent
space is smoother and realistic and is more likely to be similar to the
training distribution.

$z^{\prime}=\mu_{z}+\eta_{z}\cdot\sigma_{z}$ (5)
$c^{\prime}=\mu_{c}+\eta_{c}\cdot\sigma_{c}$ (6)

The aforementioned noise vector is then produced by a neural network, given
the actual latent space produced by variational autoencoder. The produced
latent space, $z^{\prime}$ and $c^{\prime}$ are then added to the original
latent space vector,

$\mathcal{Z}=\lambda_{org}\cdot z+\lambda_{noised}\cdot z^{\prime}$ (7)
$\mathcal{C}=\lambda_{org}\cdot c+\lambda_{noised}\cdot c^{\prime}$ (8)

where $\lambda_{org}$ and $\lambda_{noised}$ are hyperparameters. Then
$\mathcal{Z}$ and $\mathcal{C}$ are decoded and an adversarial output is
produced. These latent space vectors, $\mathcal{Z}$ and $\mathcal{C}$, help in
producing out of distribution sample for a particular class because the point
estimates for each class is independent of other classes. Hence combination of
these distributions will output a distribution with different point estimates.

$\mathcal{X}=\mathcal{N}(\mu_{x},\sigma_{x}^{2})\;\;\;,\;\;\mathcal{Y}=\mathcal{N}(\mu_{y},\sigma_{y}^{2})$
(9) $\mathcal{T}=X+Y$ (10)
$\mathcal{T}\sim\mathcal{N}(\mu_{x}+\mu_{y},\sigma_{x}^{2}+\sigma_{y}^{2})$
(11)

The original dataset distribution is the subset of resulting distribution from
where adversarial examples are sampled. $\mathcal{Y}$ is the original dataset
distribution.

$\mathcal{Y}\subset\mathcal{T}$ (12)

Now this process of generating adversarial samples is optimized by minimizing
the loss function $\mathcal{L}$. This loss function $\mathcal{L}$ is designed
in such a way that the generated image keeps resemblance with the original
image and minimal pixels are manipulated significantly. This helps in
producing high fidelity adversarial examples. The loss function is a
combination of different constraints that affects the target image.

$\mathcal{L}\mathrel{\ensurestackMath{\stackon[1pt]{=}{\scriptstyle\Delta}}}\lambda_{0}\mathcal{L}_{0}+\lambda_{1}\mathcal{L}_{1}+\lambda_{2}\mathcal{L}_{2}$
(13)

where $\lambda_{0}$, $\lambda_{1}$ and $\lambda_{2}$ are the hyperparameters.
The first cost $\mathcal{L}_{0}$ has $\widehat{x}$ as the predicted soft
labels and $\widehat{y}$ is the target soft labels. We manipulate predicted
$\widehat{x}$ in such a way that the probability for second most probable
label in the input sample becomes more than or equal to the most probable
label in actual prediction from classifier. So, $P_{\phi}(\widehat{x}^{2})\geq
P_{\phi}(\widehat{x}^{1})$

$\mathcal{L}_{0}=\sum-
w_{n}[y_{n}\cdot\log(x_{n})+(1-y_{n})\cdot\log(1-x_{n})]$ (14)

The first cost function encourages that the label with second highest
probability is somehow induced as some pixel changes in the original input
such that the classifier changes its predictions and gets confused between the
original class and adversarial class.111Adversarial class here means the class
that we intend the classifier to predict for the given input with minimal
changes.. The equation 14 is a Binary Cross Entropy (BCE) loss which is
usually used in multi-label classification. It helps in inferring when there
are 2 classes present in the input image. In similar way, it helps to get the
essence of 2 classes, one originally present and other induced class (as a
result of adversarial example), in the same input image.

The second cost function can be any of these two functions given below,

$\mathcal{L}_{1}=||x-x^{\prime}||_{2}\;\;\;or\;\;\;||x-x^{\prime}||_{\infty}$
(15)

It encourages that the generated image is as close to the original image as
much as possible.

The third cost function is the structural dissimilarity index,

$\mathcal{L}_{2}=1-SSIM(x,x^{\prime})$ (16)
$SSIM(x,x^{\prime})=\frac{(2u_{x}u_{x^{\prime}}+c_{1})(2\sigma_{xx^{\prime}}+c_{2})}{(u_{x}^{2}+u_{x^{\prime}}^{2}+c1)(\sigma_{x}^{2}+\sigma_{x^{\prime}}^{2}+c_{2})}$
(17) $c_{1}=(k_{1}L)^{2},\;\;c_{2}=(k_{2}L)^{2},\;\;L=2^{\mbox{bits per
pixel}}-1$ (18)

where $u_{x}$, $u_{x^{\prime}}$ are the average of all the pixel values of the
image $x$ and $x^{\prime}$ respectively. $\sigma_{x}^{2}$,
$\sigma_{x^{\prime}}^{2}$ are the variance of the pixel value of the image $x$
and $x^{\prime}$ respectively. $\sigma_{xx^{\prime}}$ is the covariance
between $x$ and $x^{\prime}$. $c_{1}$ and $c_{2}$ are the two variables to
stabilize the division with weak denominator. $L$ is dynamic range of pixel
values. It encourages that the spatial correlation among pixels is maintained.
Hence imposing minimal change between adjacent pixels and thereby limiting the
case of abrupt changes in nearby pixels.

##  4 Experiments

Datasets The datasets used in the experiments are MNIST
(10.1162/neco.1989.1.4.541, ), CelebA (7410782, ), and SVHN
(Netzer2011ReadingDI, ). Out of these, MNIST and SVHN are digits dataset,
while CelebA is face dataset where we intend to classify images based on
gender. We attack such classification tasks because of less complicated
attributes to identify (such as digit labeling, gender classification) in
verifying the results of classifier and to enable labeling of the generated
image by our attack.

Model setting We train JointVAE (dupont2018learning, ) on all the datasets. We
only trained the JointVAE on training and validation data partition of each
dataset. We utilized test dataset for testing our classifier that we trained
to get inference regarding the similarity between different classes. We have
utilized ResNet (7780459, ) block in classifier model for CelebA and SVHN
dataset while we used Madry architecture (DBLP:conf/iclr/MadryMSTV18, ) for
MNIST classifier.

###  4.1 Untargeted attack against certified defenses

We here validate that our adversarial attack can bypass certified defense
(DBLP:conf/iclr/MadryMSTV18, ). These defenses show that with a pre-defined
perturbation less than $\epsilon$, a training example won’t be classified
incorrectly.

Setup For each test sample from test partition, we run our attack and generate
an adversarial example for that. Then these generated samples are fed to the
target classifier and their predictions are recorded.

Results Table 1 shows the accuracy of the test classifier after applying our
attack. And since our attack is not image space perturbation attack rather it
is latent space perturbation, it is able to fool the classifier for around
$46\%-54\%$ of the samples for MNIST. Similar observations can be inferred for
other datasets as well. Table 2 shows the effect of network size, total
parameters = parameters(noise learner) + parameters(coefficient learner),
where the change in network size or trainable parameters represents changing
the noise $\eta$ learning model and coefficients learning model (learning how
much noise to transfer to the tuning parameter $\beta$, which gives further
control over noise addition in latent space). It can be inferred from Table 2
that number of trainable parameters doesn’t affect the success rate of the
attack after a threshold which in MNIST case is around 12K parameters. The
effect of $\alpha$ and $\beta$ hyperparameters can also be seen from the
result where it can be clearly seen that decreasing $\alpha$ value increases
the success rate or decrease the accuracy of the test classifier.  denote the
best public results.

Table 1: Results on CelebA, MNIST, SVHN Datasets | Architecture | Success rate of our attack | Success rate of PGD attack${}^{\ooalign{\rule[3.01389pt]{3.01389pt}{1.0pt}\cr\hss\rule{1.0pt}{4.89998pt}\hss\cr}}$
---|---|---|---
MNIST | Madry Network (DBLP:conf/iclr/MadryMSTV18, ) | $\sim 50\%\pm 4\%$ |  $10.4\%$ ($\epsilon=0.3$)
CelebA | WideResNet (BMVC2016_87, ) | $\sim 46\%\pm 5\%$ |  $59.9\%$ ($\epsilon=0.03$)
SVHN | WideResNet (BMVC2016_87, ) | $\sim 80\%\pm 6\%$ |  $20.5\%$ ($\epsilon=0.03$)
Table 2: Results on MNIST with hyperparameter tuning $\alpha$ | $\beta$ | Trainable Parameters | Accuracy
---|---|---|---
0.6 | 0.8 | 12K | $\sim 70\%\pm 4\%$
0.5 | 0.8 | 12K | $\sim 69\%\pm 3\%$
0.3 | 0.8 | 12K | $\sim 67\%\pm 5\%$
0.1 | 0.8 | 12K | $\sim 60\%\pm 4\%$
0 | 1 | 12K | $\sim\textbf{50}\%\pm\textbf{4}\%$
0.6 | 0.8 | 29K | $\sim 70\%\pm 3\%$
0.5 | 0.8 | 29K | $\sim 68\%\pm 3\%$
0.3 | 0.8 | 29K | $\sim 67\%\pm 3\%$
0.1 | 0.8 | 29K | $\sim 58\%\pm 4\%$
0 | 1 | 29K | $\sim 60\%\pm 3\%$

Table 3 shows the actual accuracy of classifier being used for the
experiments. Table 3 shows the robustness and standard accuracy of the
classifier where robustness accuracy tells the accuracy of classifier trained
with adversarial examples. Table 3 also shows inference classifier used by our
training architecture to know the resemblance of input image with other
classes as perceived by our classifier.

Table 3: Accuracy of different classifiers, inference and test classifier | Test Classifier (Attacked) | Inference Classifier
---|---|---
Datasets | Architecture | Standard Accuracy | Robust Accuracy | Architecture | Accuracy
MNIST | Madry Network (DBLP:conf/iclr/MadryMSTV18, ) | $98.7\%$ |  $98.4\%$ | LeNet (726791, ) | $97.5\%$
CelebA | WideResNet (BMVC2016_87, ) | $96\%$ |  $96\%$ | ResNet152 (7780459, ) | $97.5\%$
SVHN | WideResNet (BMVC2016_87, ) | $86.45\%$ |  $85.24\%$ | ResNet152 (7780459, ) | $93.8\%$

####  4.1.1 Realistic perception of adversarial samples

Figure 1: Figure illustrates some adversarial example generated from our
attack on MNIST given the original image. The label above figure gives the
actual prediction of classifier given input image, and label below gives the
prediction of humans followed by ’->’ with classifier prediction.  Figure 2:
Figure illustrates some adversarial example for CelebA dataset. The label
above image gives actual target label and label below the image is the
predicted by classifier. Figure 3: Figure illustrates some adversarial example
for SVHN dataset. The label above image gives actual target label, and label
below gives the prediction of humans followed by ’->’ with classifier
prediction.

Most of our generated samples has realistic perception of some digit and this
is due to the pre-trained JointVAE autoencoder used as the decoder in the
model always ensures that latent space is translated to slightly manipulated
image space than original image. This makes the images generated by our attack
realistic and can fool human evaluators in the loop. Figures 1, 2, and 3 are
representative of qualitative results.

###  4.2 Comparision with PGD

We compare traditional PGD based attacks with our proposed attack. The PGD is
a 20-step PGD with values of $\epsilon$ given in the Table 1. It should be
noted that these perturbation results are not comparable to ours because of
the noisy nature of the attack i.e. if we increase $\epsilon$ to a high noise
value it becomes more and more visible to humans that the image is tampered.
But in our attack, if we increase the noise factor $\eta$ then we are only
changing the image to a different image which also seems realistic because of
the nature of translation in the latent space.

We also considered newly proposed GAN based attacks as well for some
reference. So, for comparison to GAN based attacks, (NIPS2018_8052, ) is
chosen to be targeted attacks, as their results were publicly available for
the datasets, we evaluated our results on. As per (NIPS2018_8052, ), it
achieves around $84\%$ accuracy over all datasets on which we evaluated our
results on. It is also important to note that these attacks generate images
susceptible for attack from scratch and hence share no resemblance with the
actual test images.

##  5 Analysis

In this section, we analyze why our threat model causes the classifier model
to misclassify the adversarial samples. As shown in Figure 4, the gradient
based attacks learns the noise in the image space that will translate the
adversarial image to cross the decision threshold of the classifier. But in
our attack, we try and add a learnt vector to the latent space representation
of the attacked image that makes its similarity and look more similar to what
we intend it to classify. Since this addition of noise is performed in latent
space, the image gets a smoothing effect. Our attack makes use of manifold
unfolding (Ozair2014DeepDG, ). The autoencoder unfolds the manifolds and makes
the resultant linear combination of latent space vector look realistic and is
more likely to fall in original dataset distribution. The figure 4, gives the
idea regarding the realistic translation.

Figure 4: Illustration of working of classifier in pixel space and latent
space. Smoothing effect of the latent space during interpolation is observed
in the figure with contrasting difference in the adversarial images with
respect to interpolation in pixel space or image space.

If $x_{1}$ and $x_{2}$ are the data points in image space of data distribution
$\mathcal{Q}$ and $f$ is encoding function and $g$ is decoding function, the
points on the line $h_{\alpha}=\alpha f(x_{1})+(1-\alpha)f(x_{2})$ yields a
latent space vector which when decoded $g(h_{\alpha})$ looks like a sample
from original distribution $\mathcal{Q}$. We perform our attack in a similar
fashion, we try and create a vector which makes the original latent vector of
original image come close to decision threshold between the source image and
target distribution.222We refer to the target space as distribution as there
are many samples in a particular point which is across the decision threshold
and this is controlled by $\alpha$ and $\beta$ hyperparameters. These
hyperparameters clarifies regarding how aggressively the original latent
vector is translated to the target distribution. In our attack as mentioned in
equation 4, instead of sampling another image $x_{2}$, we create a vector
using equation 5 and 6 and subsequently translate it using,

$h_{\alpha\beta}=\alpha f(x_{1})+\beta f(x_{2})$ (19)

This gives us a controlling factor for adjusting the actual adversarial
example in image space.

##  6 Related Works

Some recent attacks have explored the ideas beyond the traditional attacks
which introduces perturbations to the image space or pixel space.
(zhengli2018iclr, ) proposes to map the input from image space to latent space
using GANs (10.5555/2969033.2969125, ) and then searching for adversarial
examples around it.

Another line of works include attacks which are inclined towards generating
adversarial examples from scratch or noise. They also utilize GAN for learning
the latent space but without any reference point and therefore have exhaustive
search space. AdvGAN (DBLP:journals/corr/abs-1801-02610, ), AdvGAN++ (9022049,
), AT-GAN (DBLP:journals/corr/abs-1904-07793, ), Defense-GAN (defensegan, )
and (NIPS2018_8052, ) are few works where latent space was learnt using GANs
to carry out learning the distribution of the training set and generate
adversarial examples accordingly. It is imperative to note here that these
attacks are different from our work as we have utilized autoencoders in our
work to ensure that the adversarial examples remain in a modified distribution
where the input images’ latent space are combined with target class (the one
with second highest probability in prediction). This makes our adversarial
sampling distribution to be hybrid of the 2 classes.

There are few adversarial attacks which makes use of autoencoders to perform
the search in latent space with a reference point.
(DBLP:journals/corr/abs-1711-02879, ) proposes to fool the classifier by again
training the pre-trained autoencoder to learn the multiplicative and additive
noise in the latent space which could flip the actual prediction of the
classifier given the same input image. It is also different from our work
because they learn noise while we targeted the original image with the latent
space of the class with learnt coefficients of variance and noise as shown in
equations 5, 6, 7, and 8. Secondly, their work is based on a white box attack
paradigm while our work is based on black box attack. Thus, this gives our
approach transferability over cases where test classifier is unknown.

##  7 Conclusion

In this paper, we introduced a novel threat model, and proposed adversarial
attack where actual manipulation takes place in latent space or hidden space.
As demonstrated in experiments, this attack beats the current defenses against
gradient based attacks (perturbation attacks). Our proposed attack lies in a
gray area between existing perturbation based attacks and GAN based attacks.
We take advantage of working in latent space in order to generate adversarial
examples as done in GAN based attack but we perform this attack on original
source image as done in perturbation based attacks. The widely used technique
in optimizing machine learning models relies on empirical risk minimization
(10.5555/211359, ) however there is a trade-off between standard accuracy and
adversarial robustness accuracy (10.5555/3327345.3327409, ) and hence, gives
the threat models some leverage against the discriminator models. Therefore
our threat model suggests to create a new kind of training mechanism where
importance of representation learning in latent space is given more importance
when training the networks. This will not only increase the interpretability
of the network but also provide inferences regarding where manual-tuning is
required in the network.

## Broader Impact

In this section, we will describe the broader impact of our research. We will
mention both possible positive (pros) and negative (cons) impacts of our
research.

Positive impact AI (Artificial Intelligence) has come a long way in achieving
human level intelligence. It is not only able to perform tasks with
superseding accuracy that are trivial for humans, but AI is now advancing to
more complex areas like mathematical equation solving (Saxton2019AnalysingMR,
), playing games (44806, ) and beating humans in it. So, now there is a
greater need to find the vulnerabilities in these systems as they are being
used in real life and sometimes failure caused by these systems may be fatal.
Therefore, our work is precisely aimed at testing the robustness of the AI,
and mitigate the vulnerabilities in current systems. The vulnerability
discussed in the paper gives the researchers a scope to explore the latent
space in depth with representational learning for various tasks rather than
just inspecting the image space or raw data for performing different tasks.
Our work also presents that latent space can help in generating examples in
image space that correlate with multiple classes. Hence, such a technique can
be used to develop sketches of criminals by crime and investigation agencies,
where we can ask the identifier to describe the features of the culprit and
exploit part based matching with pre-existing template distribution of genuine
faces and develop a facial match based on the combination of identified facial
features to create a latent space representation which will further help in
creating a targeted search space for that particular criminal.

Another practical application of our work can be in data augmentation tasks,
where current methods rely on approaches pertaining to image space but our
work provides a more controllable and vast scheme where we create different
samples for training set by searching for user defined standard deviation
around the mean latent space vector. This gives a guided control search aspect
to data augmentation where we can easily fill the gaps of class imbalance and
also regularize our model.

Negative impact A vulnerability exploration is just exploitation of the
current system and hence our work can be used to develop fooling mechanisms
which may fool the face recognition systems or may also help in upscaling the
deep fake (Nguyen2019DeepLF, ) architectures where combination of multiple
images will still output realistic rendition, as it happens in our case.

Ethics From ethics point of view, our work lies in a morally correct area,
because as per morals any vulnerability when reported can be fixed and thereby
help in making the systems more secure and robust against attacks. Therefore,
we consider our work to be morally correct and catering to the societal
benefit.

## References

  * [1] Anish Athalye, Nicholas Carlini, and David A. Wagner.  Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples.  CoRR, abs/1802.00420, 2018.
  * [2] A. Chernikova, A. Oprea, C. Nita-Rotaru, and B. Kim.  Are self-driving cars secure? evasion attacks against deep neural networks for steering angle prediction.  In 2019 IEEE Security and Privacy Workshops (SPW), pages 132–137, 2019.
  * [3] Antonia Creswell, Anil A. Bharath, and Biswa Sengupta.  Latentpoison - adversarial attacks on the latent space.  CoRR, abs/1711.02879, 2017.
  * [4] Emilien Dupont.  Learning disentangled joint continuous and discrete representations.  In Advances in Neural Information Processing Systems, pages 707–717, 2018.
  * [5] Ian J. Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio.  Generative adversarial nets.  In Proceedings of the 27th International Conference on Neural Information Processing Systems - Volume 2, NIPS’14, page 2672–2680, Cambridge, MA, USA, 2014. MIT Press.
  * [6] Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy.  Explaining and harnessing adversarial examples.  CoRR, abs/1412.6572, 2015.
  * [7] K. He, X. Zhang, S. Ren, and J. Sun.  Deep residual learning for image recognition.  In 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 770–778, 2016.
  * [8] Irina Higgins, Loïc Matthey, Arka Pal, Christopher Burgess, Xavier Glorot, Matthew M Botvinick, Shakir Mohamed, and Alexander Lerchner.  beta-vae: Learning basic visual concepts with a constrained variational framework.  In ICLR, 2017.
  * [9] S. Jandial, P. Mangla, S. Varshney, and V. Balasubramanian.  Advgan++: Harnessing latent layers for adversary generation.  In 2019 IEEE/CVF International Conference on Computer Vision Workshop (ICCVW), pages 2045–2048, 2019.
  * [10] Diederik P. Kingma and Max Welling.  Auto-encoding variational bayes.  In Yoshua Bengio and Yann LeCun, editors, ICLR, 2014.
  * [11] Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio.  Adversarial examples in the physical world.  CoRR, abs/1607.02533, 2016.
  * [12] Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio.  Adversarial machine learning at scale.  ArXiv, abs/1611.01236, 2017.
  * [13] Y. LeCun, B. Boser, J. S. Denker, D. Henderson, R. E. Howard, W. Hubbard, and L. D. Jackel.  Backpropagation applied to handwritten zip code recognition.  Neural Comput., 1(4):541–551, December 1989.
  * [14] Y. Lecun, L. Bottou, Y. Bengio, and P. Haffner.  Gradient-based learning applied to document recognition.  Proceedings of the IEEE, 86(11):2278–2324, 1998.
  * [15] Fangzhou Liao, Ming Liang, Yinpeng Dong, Tianyu Pang, Jun Zhu, and Xiaolin Hu.  Defense against adversarial attacks using high-level representation guided denoiser.  CoRR, abs/1712.02976, 2017.
  * [16] Z. Liu, P. Luo, X. Wang, and X. Tang.  Deep learning face attributes in the wild.  In 2015 IEEE International Conference on Computer Vision (ICCV), pages 3730–3738, 2015.
  * [17] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu.  Towards deep learning models resistant to adversarial attacks.  In 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Proceedings. OpenReview.net, 2018.
  * [18] S. Moosavi-Dezfooli, A. Fawzi, and P. Frossard.  Deepfool: A simple and accurate method to fool deep neural networks.  In 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 2574–2582, 2016.
  * [19] Nir Morgulis, Alexander Kreines, Shachar Mendelowitz, and Yuval Weisglass.  Fooling a real car with adversarial traffic signs.  CoRR, abs/1907.00374, 2019.
  * [20] Rafael Müller, Simon Kornblith, and Geoffrey E. Hinton.  When does label smoothing help?  CoRR, abs/1906.02629, 2019.
  * [21] Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Ng.  Reading digits in natural images with unsupervised feature learning.  NIPS, 2011.
  * [22] Thanh Thi Nguyen, C. M. Nguyen, Dung T. Nguyen, Duc Thanh Nguyen, and Saeid Nahavandi.  Deep learning for deepfakes creation and detection.  ArXiv, abs/1909.11573, 2019.
  * [23] Sherjil Ozair and Yoshua Bengio.  Deep directed generative autoencoders.  ArXiv, abs/1410.0630, 2014.
  * [24] N. Papernot, P. McDaniel, S. Jha, M. Fredrikson, Z. B. Celik, and A. Swami.  The limitations of deep learning in adversarial settings.  In 2016 IEEE European Symposium on Security and Privacy (EuroS P), pages 372–387, 2016.
  * [25] Pouya Samangouei, Maya Kabkab, and Rama Chellappa.  Defense-gan: Protecting classifiers against adversarial attacks using generative models.  In International Conference on Learning Representations, 2018.
  * [26] David Saxton, Edward Grefenstette, Felix Hill, and Pushmeet Kohli.  Analysing mathematical reasoning abilities of neural models.  ArXiv, abs/1904.01557, 2019.
  * [27] Ludwig Schmidt, Shibani Santurkar, Dimitris Tsipras, Kunal Talwar, and Aleksander Madry.  Adversarially robust generalization requires more data.  In Proceedings of the 32nd International Conference on Neural Information Processing Systems, NIPS’18, page 5019–5031, Red Hook, NY, USA, 2018. Curran Associates Inc.
  * [28] David Silver, Aja Huang, Christopher J. Maddison, Arthur Guez, Laurent Sifre, George van den Driessche, Julian Schrittwieser, Ioannis Antonoglou, Veda Panneershelvam, Marc Lanctot, Sander Dieleman, Dominik Grewe, John Nham, Nal Kalchbrenner, Ilya Sutskever, Timothy Lillicrap, Madeleine Leach, Koray Kavukcuoglu, Thore Graepel, and Demis Hassabis.  Mastering the game of go with deep neural networks and tree search.  Nature, 529:484–503, 2016.
  * [29] Abhishek Sinha, Mayank Singh, Nupur Kumari, Balaji Krishnamurthy, Harshitha Machiraju, and Vineeth N. Balasubramanian.  Harnessing the vulnerability of latent layers in adversarially trained models.  CoRR, abs/1905.05186, 2019.
  * [30] Aman Sinha, Hongseok Namkoong, and John C. Duchi.  Certifiable distributional robustness with principled adversarial training.  ArXiv, abs/1710.10571, 2017.
  * [31] Chawin Sitawarin, Arjun Nitin Bhagoji, Arsalan Mosenia, Mung Chiang, and Prateek Mittal.  DARTS: deceiving autonomous cars with toxic signs.  CoRR, abs/1802.06430, 2018.
  * [32] Yang Song, Taesup Kim, Sebastian Nowozin, Stefano Ermon, and Nate Kushman.  Pixeldefend: Leveraging generative models to understand and defend against adversarial examples.  In International Conference on Learning Representations, 2018.
  * [33] Yang Song, Rui Shu, Nate Kushman, and Stefano Ermon.  Constructing unrestricted adversarial examples with generative models.  In S. Bengio, H. Wallach, H. Larochelle, K. Grauman, N. Cesa-Bianchi, and R. Garnett, editors, Advances in Neural Information Processing Systems 31, pages 8312–8323. Curran Associates, Inc., 2018.
  * [34] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus.  Intriguing properties of neural networks.  CoRR, abs/1312.6199, 2014.
  * [35] Vladimir N. Vapnik.  The Nature of Statistical Learning Theory.  Springer-Verlag, Berlin, Heidelberg, 1995.
  * [36] Xiaosen Wang, Kun He, and John E. Hopcroft.  AT-GAN: A generative attack model for adversarial transferring on generative adversarial nets.  CoRR, abs/1904.07793, 2019.
  * [37] Chaowei Xiao, Bo Li, Jun-Yan Zhu, Warren He, Mingyan Liu, and Dawn Song.  Generating adversarial examples with adversarial networks.  CoRR, abs/1801.02610, 2018.
  * [38] Sergey Zagoruyko and Nikos Komodakis.  Wide residual networks.  In Edwin R. Hancock Richard C. Wilson and William A. P. Smith, editors, Proceedings of the British Machine Vision Conference (BMVC), pages 87.1–87.12. BMVA Press, September 2016.
  * [39] Zhengli Zhao, Dheeru Dua, and Sameer Singh.  Generating natural adversarial examples.  In International Conference on Learning Representations (ICLR), 2018\.


[a]T. San José

# The distribution amplitude of the
$\mathit{{\eta}{}_{\mspace{-3.0mu}\scriptstyle{\mathit{{c}{}_{\mspace{-3.0mu}\scriptstyle{}}^{\mspace{-1.0mu}\scriptstyle{}}}}}^{\mspace{-1.0mu}\scriptstyle{}}}$-meson

B. Blossier  M. Mangin-Brinet  J.M. Morgado Chávez

###### Abstract

In this proceeding we determine the distribution amplitude of the
$\mathit{{\eta}{}_{\mspace{-3.0mu}\scriptstyle{\mathit{{c}{}_{\mspace{-3.0mu}\scriptstyle{}}^{\mspace{-1.0mu}\scriptstyle{}}}}}^{\mspace{-1.0mu}\scriptstyle{}}}$-meson
from first principles. This quantity appears as a consequence of factorization
theorems, and it is necessary to compute the amplitude of multiple exclusive
processes. Since it is defined along a light-cone, its calculation via lattice
QCD was impossible until recently, when a generalization to Euclidean metric
was proposed, and a connection to the physical limit was established. We
briefly explain the method of short distance factorization, which allows us to
compute the distribution amplitude, and our lattice setup. After summarizing
the steps for the continuum and chiral extrapolation, we present our results
and compare them to two alternative determinations, one using non-relativistic
QCD and another solving the Dyson-Schwinger equations; we find a large
discrepancy with the former.

{}

$missing\text{\,}\mathrm{missing}$

##  1 Introduction

Factorization theorems are a fundamental tool to study the internal structure
of hadrons. They separate the amplitude of many scattering processes into two
pieces: The interaction between the scattering probe and the target’s quarks
and gluons, which is calculable in perturbation theory; and the internal
structure of the various hadrons, which requires non-perturbative methods. In
particular, distribution amplitudes of heavy mesons describe the momentum
distribution of the quarks along the longitudinal axis, and they are necessary
to compute the amplitude of decays, deeply virtual meson production, and other
exclusive processes (see [1] for a review). For a pseudoscalar charmonium
state like
$\mathit{{\eta}{}_{\mspace{-3.0mu}\scriptstyle{\mathit{{c}{}_{\mspace{-3.0mu}\scriptstyle{}}^{\mspace{-1.0mu}\scriptstyle{}}}}}^{\mspace{-1.0mu}\scriptstyle{}}}$,
its distribution amplitude (DA)is defined by a bi-local matrix element [1],

$\phi(x)=\int\dfrac{\differential{z^{-}}}{2\pi}e^{-\text{i}(x-1/2)p^{+}z^{-}}\evaluated{\matrixelement*{\mathit{{\eta}{}_{\mspace{-3.0mu}\scriptstyle{\mathit{{c}{}_{\mspace{-3.0mu}\scriptstyle{}}^{\mspace{-1.0mu}\scriptstyle{}}}}}^{\mspace{-1.0mu}\scriptstyle{}}}(p)}{\mathit{{\mkern
4.0mu\overline{\mkern-4.0mu{c}}}{}_{\mspace{-2.0mu}\scriptstyle{}}^{\mspace{0.0mu}\scriptstyle{}}}(-z/2)\gamma^{+}\gamma_{5}W(-z/2,z/2)\mathit{{c}{}_{\mspace{-3.0mu}\scriptstyle{}}^{\mspace{-1.0mu}\scriptstyle{}}}(z/2)}{0}}_{z^{+}=z^{\bot}=0},$
(1)

where the Wilson line $W(a,b)$ assures gauge invariance, the meson moves along
the axis $p^{+}$, the quark’s momentum fraction in the longitudinal direction
is $x=q^{+}/p^{+}$, and the quarks are separated along the direction $z^{-}$.
Given its non-perturbative nature, the idea of computing this quantity ab
initio using lattice QCD arises. However, the condition $z^{2}=0$ prohibits
the direct calculation of equation 1 in Euclidean space. This was until 2013,
when Ji introduced a generalization to space-like separations [2] known as
quasi-distributions, where one could use $z=(0,0,z_{3},0)$ and
$p=(0,0,p_{3},E)$ in Euclidean space. The new function tends towards the
light-cone DA (LCDA)when taking the limit $p_{3}\to\infty$ appropriately.
However, as it was pointed out in [3], lattice simulations must include data
at $p_{3}\geq\quantity{3}{\giga}$ to take the infinite limit safely, a
condition our ensembles cannot fulfill without introducing sizeable lattice
artifacts. Instead, in our project we consider the equivalent approach
outlined in [3], known as pseudo-distributions, which converge to the physical
quantity in the limit $z_{3}\to 0$. The factor $1/z_{3}^{2}$ plays an
analogous role to a renormalization parameter $\mu^{2}$.

In the remainder of this proceeding, we summarize how to extract the pseudo-
DAfrom the lattice, take the continuum limit, and match to the LCDA. Besides,
we compare our results with those from Dyson-Schwinger (DS)[4] and non-
relativistic QCD (NRQCD)[5] determinations. For a complete report on this
work, we direct the avid reader to [6].

##  2 Methodology

The first step in Euclidean space is to compute the matrix element [7]

$M^{\alpha}(p,z)=e^{-\text{i}pz/2}\matrixelement*{\mathit{{\eta}{}_{\mspace{-3.0mu}\scriptstyle{\mathit{{c}{}_{\mspace{-3.0mu}\scriptstyle{}}^{\mspace{-1.0mu}\scriptstyle{}}}}}^{\mspace{-1.0mu}\scriptstyle{}}}(p)}{\mathit{{\mkern
4.0mu\overline{\mkern-4.0mu{c}}}{}_{\mspace{-2.0mu}\scriptstyle{}}^{\mspace{0.0mu}\scriptstyle{}}}(0)\gamma^{\alpha}\gamma_{5}W(0,z)\mathit{{c}{}_{\mspace{-3.0mu}\scriptstyle{}}^{\mspace{-1.0mu}\scriptstyle{}}}(z)}{0}$
(2)

where $z^{2}>0$ and $\nu=pz=p_{3}z_{3}$ is the Ioffe time. We consider the
asymmetric configuration $(0,z)$ to make use of all lattice sites, and we
recover the symmetric structure of equation 1 using translation invariance.
Next, we can separate some higher-twist contamination using the Lorentz
decomposition [7]

$M^{\alpha}(p,z)=2p^{\alpha}\mathcal{M}(\nu,z^{2})+z^{\alpha}\mathcal{M}^{\prime}(\nu,z^{2})$
(3)

where $\mathcal{M}$ carries the leading twist as well as some high twist
component proportional to $\order{z^{2}\Lambda^{2}_{\text{QCD}}}$, and
$\mathcal{M}^{\prime}$ is a purely higher-twist effect. To isolate
$\mathcal{M}$, we select the component $\alpha=4$, such that
$M^{4}(p,z)=2E\mathcal{M}(\nu,z^{2})$. The matrix element
$\mathcal{M}(\nu,z^{2})$ is multiplicatively renormalizable at all orders in
perturbation theory [8], and the normalization constant is a function of
$z_{3}$ alone. Then, we form a ratio that retains the physical evolution of
the LCDAwhile reducing the contamination from the lattice artifacts and higher
twist [7, 9, 10],

$\tilde{\phi}(\nu,z^{2})+\text{h.t.}=\dfrac{\mathcal{M}(\nu,z^{2})\evaluated*{\mathcal{M}(0,0)}_{p=z=0}}{\evaluated*{\mathcal{M}(0,z^{2})}_{p=0}\evaluated*{\mathcal{M}(0,0)}_{z=0}}.$
(4)

Equation 4 is the reduced Ioffe-time pseudo-DA, which does not require any
additional renormalization, and so it has a well defined continuum limit. This
is the actual quantity we extract from the lattice data. Equation 4 is related
to the DAon the light-cone via a matching kernel derived in [11, 12] at NLOin
perturbation theory,

$\tilde{\phi}(\nu,z^{2})=\int_{0}^{1}\differential{w}C(w,\nu,z\mu)\int_{0}^{1}\differential{x}\cos(wx\nu-w\nu/2)\phi(x,\mu),$
(5)

where we choose the $\overline{\text{MS}}$ renormalization scheme at a scale
$\mu=\quantity{3}{\giga}$. Equation 5 is an inverse problem, because we
attempt to reconstruct the right-hand sidewith only a limited data set. To
solve it, we model the LCDAtaking inspiration from its conformal expansion
[1],

$\phi(x,\mu)=(1-x)^{\lambda-1/2}x^{\lambda-1/2}\sum_{n=0}^{\infty}d_{2n}^{(\lambda)}\tilde{G}_{2n}^{(\lambda)}(x),\qquad\qquad
d_{0}^{(\lambda)}=\dfrac{4^{\lambda}}{B\left(1/2,\lambda+1/2\right)}.$ (6)

The coefficients $d_{2n}^{(\lambda)}$ and $\lambda$ are fitted with the
lattice data, $B$ is a beta function, and $\tilde{G}_{2n}^{(\lambda)}(x)$ are
shifted Gegenbauer polynomials, defined in the domain $x\in[0,1]$. The
assymptotic value, $\phi(x,\mu\to\infty)=6x(1-x)$ is recovered from equation 6
setting $\lambda=3/2$. A similar approach for parton distribution functions
(PDFs)can be seen in [13]. Then, we can replace equation 6 in equation 5 and
compute the integrals using properties of the Gegenbauer polynomials, such
that

$\tilde{\phi}(\nu,z^{2})=\sum_{n=0}^{\infty}\tilde{d}_{2n}^{(\lambda)}\sigma_{2n}^{(\lambda)}(\nu,z\mu),\qquad\qquad\tilde{d}_{n}^{(\lambda)}=\dfrac{d_{n}^{(\lambda)}}{4^{\lambda}}.$
(7)

The new set of functions $\sigma_{2n}^{(\lambda)}$ are plotted in figure 1 for
representative values of our simulations, and their full expressions are
reported in [6].

Figure 1: LEFT: The function $\sigma_{n}$ vs Ioffe time. We use $\lambda=2.7$
and $z_{3}=5\times\quantity{0.0658}{\femto}$ as representative values. RIGHT:
Landscape of CLSensembles used in this project.

##  3 Lattice calculation

We employ the $N_{f}=2$ CLSensembles collected in figure 1. For details on the
gauge simulations and the scale setting, see [14]. We employ quark all-to-all
propagators with wall sources diluted in spin, and we solve the Dirac equation
with deflated SAP-GCR, and the contractions are performed with a costum
version of the domain decomposition HMC (DD-HMC)algorithm. The momentum $p$ is
set employing partially twisted boundary conditions, and to create a realistic
meson interpolator we solve a 4x4 generalized eigenvalue problemwith four
levels of Gaussian smearing. Out of the two Wick contractions, we only compute
the quark-connected diagram, as we expect the disconnected contribution to
have a strong OZIsuppression. Upon averaging over the spatial lattice points,
the double ratio in equation 4 shows a mild time dependence, and we select
$\tilde{\phi}$ picking a particular time slice from a plateau range. Selecting
the same time slice for all $(\nu,z^{2})$ on a given ensemble, we can keep
correlations intact throughout our analysis, and varying the selected time
slice we explore the systematic uncertainty [6]. Figure 2 shows equation 4 on
all our ensembles. We observe that all data points, which we denote by
$\tilde{\phi}_{e}(\nu,z^{2})$, fall in a nearly universal line, but several
corrections remain to be applied if one is to extract equation 1: First, we
need to model the quark-mass dependence to give a prediction at the physical
value; second, we need to take the continuum limit removing the $\order{a}$
lattice artifacts; third, we have to model the remaining higher-twist
contamination.

Figure 2: The reduced Ioffe-time pseudo-DAas a function of Ioffe time on all
our ensembles, which are shown with different markers. Different Wilson lines
are given by the color gradient.

We combine these steps in a single fit, where we minimize a $\chi^{2}$
employing a custom implementation of the variable projectionalgorithm, and we
fit our data to the model [6]

$\displaystyle\tilde{\phi}_{e}(\nu,z^{2})$
$\displaystyle=\tilde{\phi}(\nu,z^{2})+\dfrac{a}{\absolutevalue{z}}A_{1}(\nu)+a\Lambda
B_{1}(\nu)+z^{2}\Lambda^{2}C_{1}(\nu)$ (8)
$\displaystyle+\dfrac{a}{\absolutevalue{z}}\Big{(}\Lambda^{-1}\left(m_{\mathit{{\eta}{}_{\mspace{-3.0mu}\scriptstyle{\mathit{{c}{}_{\mspace{-3.0mu}\scriptstyle{}}^{\mspace{-1.0mu}\scriptstyle{}}}}}^{\mspace{-1.0mu}\scriptstyle{}}}}-m_{\mathit{{\eta}{}_{\mspace{-3.0mu}\scriptstyle{\mathit{{c}{}_{\mspace{-3.0mu}\scriptstyle{}}^{\mspace{-1.0mu}\scriptstyle{}}}}}^{\mspace{-1.0mu}\scriptstyle{}}},\text{phy}}\right)D_{1}(\nu)+\Lambda^{-2}\left(m_{\mathit{{\pi}{}_{\mspace{-3.0mu}\scriptstyle{}}^{\mspace{-1.0mu}\scriptstyle{}}}}^{2}-m_{\mathit{{\pi}{}_{\mspace{-3.0mu}\scriptstyle{}}^{\mspace{-1.0mu}\scriptstyle{}}},\text{phy}}^{2}\right)E_{1}(\nu)\Big{)},$

which gathers all the aforementioned requirements. See [13] for a study of
PDFsusing a similar approach. We use
$\Lambda\equiv\Lambda^{(2)}_{\text{QCD}}=\quantity{330}{\mega}$ [15] to render
all terms dimensionless. The auxiliary functions $A_{1}$, $B_{1}$, $C_{1}$,
etc., have a similar behavior in $\nu$ to that of $\tilde{\phi}(\nu,z^{2})$,
and they are defined in very similar fashion to equation 6. Since $0<\nu<7$,
our fit function is only sensitive to the first coefficient in equation 6, and
we limit ourselves to determine the value of $\lambda$. At the minimum
$\chi^{2}/\text{dof}=368/467=0.79$, we obtain $\lambda=$2.73(18)$$, where the
uncertainty includes both statistics and systematics. This is our main result,
and we stress that knowing the first coefficient in equation 6 is sufficient
to describe the DAin our range of Ioffe times based on the good fit quality.
The DAis analytic in Ioffe-time space, and therefore we Fourier-transform
equation 6 to compare it to two other determinations using NRQCD[5] and
DSequations [4]. The various results are gathered in figure 3, and we observe
good agreement between our result and [4], but there are large discrepancies
with the non-relativistic calculation.

Figure 3: Comparison in Ioffe-time space between the DAas determined in this
work, by NRQCD[5] and by DS[4]. The bands reflect the uncertainties reported
on each work, ours indicate the total error.

##  4 Conclusions and Outlook

We present the first lattice calculation of the
$\mathit{{\eta}{}_{\mspace{-3.0mu}\scriptstyle{\mathit{{c}{}_{\mspace{-3.0mu}\scriptstyle{}}^{\mspace{-1.0mu}\scriptstyle{}}}}}^{\mspace{-1.0mu}\scriptstyle{}}}$-meson
DA. We give the DAin closed form using equation 6 truncating $n>0$ and using
$\lambda=2.73(18)$. This parameterization is sufficient to fit the lattice
data, which is generated following the pseudo-distribution approach. Our
results are obtained in the continuum limit at the physical quark masses (with
exact isospin symmetry) and at leading twist. Our determination is in strong
tension with results from NRQCD. In the future, we plan to expand our analysis
to other heavy states as well as to upgrade our simulations to $N_{f}=2+1+1$
flavors in the sea.

## Acknowledgments

The work by J.M. Morgado Chávez has been supported by P2IO LabEx
(ANR-10-LABX-0038) in the framework of Investissements d’Avenir
(ANR-11-IDEX-0003-01). The work by T. San José is supported by Agence
Nationale de la Recherche under the contract ANR-17-CE31-0019. This project
was granted access to the HPC resources of TGCC (2021-A0100502271,
2022-A0120502271 and 2023-A0140502271) by GENCI. The authors thank Michael
Fucilla, Cédric Mezrag, Lech Szymanowski, and Samuel Wallon for valuable
discussions.

## References

  * [1] M. Diehl, _Generalized parton distributions_ , _Phys. Rept._ 388 (2003) 41 [hep-ph/0307382].
  * [2] X. Ji, _Parton Physics on a Euclidean Lattice_ , _Phys. Rev. Lett._ 110 (2013) 262002 [1305.1539].
  * [3] A.V. Radyushkin, _Quasi-parton distribution functions, momentum distributions, and pseudo-parton distribution functions_ , _Phys. Rev. D_ 96 (2017) 034025 [1705.01488].
  * [4] M. Ding, F. Gao, L. Chang, Y.-X. Liu and C.D. Roberts, _Leading-twist parton distribution amplitudes of S-wave heavy-quarkonia_ , _Phys. Lett. B_ 753 (2016) 330 [1511.04943].
  * [5] Chung, Ee, Kang, Kim, Lee and Wang, _Pseudoscalar Quarkonium+gamma Production at NLL+NLO accuracy_ , _JHEP_ 10 (2019) 162 [1906.03275].
  * [6] B. Blossier, M. Mangin-Brinet, J.M. Morgado Chávez and T. San José, _The distribution amplitude of the $\eta_{c}$-meson at leading twist from Lattice QCD_, 2406.04668.
  * [7] A. Radyushkin, _Nonperturbative Evolution of Parton Quasi-Distributions_ , _Phys. Lett. B_ 767 (2017) 314 [1612.05170].
  * [8] T. Ishikawa, Y.-Q. Ma, J.-W. Qiu and S. Yoshida, _Renormalizability of quasiparton distribution functions_ , _Phys. Rev. D_ 96 (2017) 094019 [1707.03107].
  * [9] K. Orginos, A. Radyushkin, J. Karpie and S. Zafeiropoulos, _Lattice QCD exploration of parton pseudo-distribution functions_ , _Phys. Rev. D_ 96 (2017) 094503 [1706.05373].
  * [10] J. Karpie, K. Orginos and S. Zafeiropoulos, _Moments of Ioffe time parton distribution functions from non-local matrix elements_ , _JHEP_ 11 (2018) 178 [1807.10933].
  * [11] A.V. Radyushkin, _Quark pseudodistributions at short distances_ , _Phys. Lett. B_ 781 (2018) 433 [1710.08813].
  * [12] A.V. Radyushkin, _Generalized parton distributions and pseudodistributions_ , _Phys. Rev. D_ 100 (2019) 116011 [1909.08474].
  * [13] HadStruc collaboration, _The continuum and leading twist limits of parton distribution functions in lattice QCD_ , _JHEP_ 11 (2021) 024 [2105.13313].
  * [14] P. Fritzsch, F. Knechtli, B. Leder, M. Marinkovic, S. Schaefer, R. Sommer et al., _The strange quark mass and Lambda parameter of two flavor QCD_ , _Nucl. Phys. B_ 865 (2012) 397 [1205.5380].
  * [15] FLAG collaboration, _FLAG Review 2021_ , _Eur. Phys. J. C_ 82 (2022) 869 [2111.09849].