# Multilinear maximal operators associated to simplices

Brian Cook Neil Lyall Ákos Magyar  Department of Mathematics,Virginia Tech,
Blacksburg, VA 24061, USA<EMAIL_ADDRESS>Department of Mathematics,
The University of Georgia, Athens, GA 30602, USA<EMAIL_ADDRESS>Department of Mathematics, The University of Georgia, Athens, GA 30602, USA
<EMAIL_ADDRESS>
###### Abstract.

We establish $L^{p_{1}}\times\cdots\times L^{p_{k}}\to L^{r}$ and
$\ell^{p_{1}}\times\cdots\times\ell^{p_{k}}\to\ell^{r}$ type bounds for
multilinear maximal operators associated to averages over isometric copies of
a given non-degenerate $k$-simplex in both the continuous and discrete
settings. These provide natural extensions of $L^{p}\to L^{p}$ and
$\ell^{p}\to\ell^{p}$ bounds for Stein’s spherical maximal operator and the
discrete spherical maximal operator, with each of these results serving as a
key ingredient of the respective proofs.

The second and third authors were partially supported by grants NSF-DMS
1702411 and NSF-DMS 1600840, respectively.

##  1\. Introduction

###  1.1. The spherical maximal operator

Let $d\geq 3$ and $\lambda>0$. For $f:\mathbb{R}^{d}\to\mathbb{R}$ define the
averages

$\mathcal{A}_{\lambda}f(x)=\int_{S^{d-1}}f(x+\lambda y)\,d\sigma(y)$

and the maximal operator

$\mathcal{A}_{\ast}f(x)=\sup_{\lambda>0}|A_{\lambda}f(x)|$

where $\sigma$ denotes the normalized surface area measure on the unit sphere
$S^{d-1}=\\{x\in\mathbb{R}^{d}:\ |x|=1\\}$.

Stein’s spherical maximal function theorem [14], states that for $p>d/(d-1)$
one has the estimate

(1) $\|\mathcal{A}_{\ast}f\|_{p}\leq C_{p,d}\,\|f\|_{p}$

where by $\|f\|_{p}$ denotes the $L^{p}(\mathbb{R}^{d})$ norm of the function
$f$. Note that Bourgain [3] extended the above result for $d=2$, and that the
condition $p>d/(d-1)$ is sharp.

###  1.2. The discrete spherical maximal operator

The study of discrete analogues of central constructs of Euclidean harmonic
analysis, initiated by Bourgain [4, 5, 6], has grown into a vast, active area
of research. An important result in this development is the
$\ell^{p}$-boundedness of the so-called discrete spherical maximal operator
[10], we now recall this operator and the main result of [10].

Let $d\geq 5,\,\lambda^{2}\in\mathbb{N}$, and
$N_{\lambda}:=|\\{y\in\mathbb{Z}^{d}:\ |y|=\lambda\\}|.$ It is well-known, see
for example [15], that

$c_{d}\lambda^{d-2}\leq N_{\lambda}\leq C_{d}\lambda^{d-2}$

for some constants $0<c_{d}<C_{d}$. For $f:\mathbb{Z}^{d}\to\mathbb{R}$ define
the averages

$A_{\lambda}f(x)=N_{\lambda}^{-1}\sum_{|y|=\lambda}f(x+y)$

and the maximal operator

$A_{\ast}f(x)=\sup_{\lambda}|A_{\lambda}f(x)|.$

The variables $x,y$ in the two equations above, and throughout this short note
whenever we are considering discrete operators, are always assumed to in
$\mathbb{Z}^{d}$, unless explicitly specified otherwise. Furthermore, in the
discrete setting the parameter $\lambda$ will always be assumed be in
$\sqrt{\mathbb{N}}$, that is satisfy $\lambda^{2}\in\mathbb{N}$.

In [10] it was shown that for $p>d/(d-2)$ one has the estimate

(2) $\|A_{\ast}f\|_{p}\leq C_{p,d}\,\|f\|_{p}$

where $\|f\|_{p}$ denotes the $\ell^{p}(\mathbb{Z}^{d})$ norm of the function
$f$. It was further noted in [10] that the condition that $d\geq 5$ and
$p>d/(d-2)$ are both sharp.

##  2\. Multilinear maximal operators associated to simplices

The aim of this short note is to show that estimates (1) and (2) imply
$L^{p_{1}}\times\cdots\times L^{p_{k}}\to L^{r}$ and
$\ell^{p_{1}}\times\cdots\times\ell^{p_{k}}\to\ell^{r}$ type bounds for
certain, seemingly more singular, multilinear maximal operators associated to
averages over similar copies of a given non-degenerate simplex in the
continuous and discrete settings, respectively.

###  2.1. Multilinear maximal operators associated to simplices in
$\mathbb{R}^{d}$

Let $k\in\mathbb{N}$ and let
$\Delta=\\{v_{0}=0,v_{1},\ldots,v_{k}\\}\subseteq\mathbb{R}^{d}$ be a non-
degenerate $k$-simplex, that is assume that the vectors $v_{1},\ldots,v_{k}$
are linearly independent. Given $\lambda>0$ we say that a simplex
$\Delta^{\prime}=\\{y_{0}=0,y_{1},\ldots,y_{k}\\}\subseteq\mathbb{R}^{d}$ is
_isometric_ to $\Delta$ if $|y_{i}-y_{j}|=\lambda|v_{i}-v_{j}|$ for all $0\leq
i,j\leq k$. We will write $\Delta^{\prime}\simeq\lambda\Delta$ in this case.

For a family of functions $f_{1},\dots,f_{k}:\mathbb{R}^{d}\to\mathbb{R}$ with
$d\geq k+1$ and $\lambda>0$ we define the multilinear averages

(3)
$\mathcal{A}_{\lambda}(f_{1},\dots,f_{k})(x)=\int_{SO(d)}f_{1}(x+\lambda\cdot
U(v_{1}))\cdots f_{k}(x+\lambda\cdot U(v_{k}))\,d\mu(U)$

where $\mu$ denotes the Haar measure on $SO(d)$ and the associated maximal
operator

(4)
$\mathcal{A}_{\ast}(f_{1},\ldots,f_{k})(x)=\sup_{\lambda>0}|\mathcal{A}_{\lambda}(f_{1},\ldots,f_{k})(x)|.$

We quickly record the following trivial observation, which essentially appears
in both [7] and [11].

######  Theorem 0.

Let $k\in\mathbb{N}$ and
$\Delta=\\{v_{0}=0,v_{1},\ldots,v_{k}\\}\subseteq\mathbb{R}^{d}$ be a non-
degenerate $k$-simplex.

If $d\geq k+1$ and $1/r=1/p_{1}+\cdots+1/p_{k}<(d-1)/d$, then

$\|\mathcal{A}_{*}(f_{1},\dots,f_{k})\|_{r}\leq
C_{d,k,\Delta}\,\|f_{1}\|_{p_{1}}\cdots\|f_{k}\|_{p_{k}.}$

###### Proof.

For each $\lambda>0$ we have

$|\mathcal{A}_{\lambda}(f_{1},\dots,f_{k})(x)|\leq\|f_{2}\|_{\infty}\cdots\|f_{k}\|_{\infty}\,\int|f_{1}(x+\lambda
y_{1})|\,d\sigma(y_{1})$

where $\sigma$ denotes the normalized measure on the sphere
$S^{d-1}(0,|v_{1}|)=\\{y\in\mathbb{R}^{d}\,:\,|y|=|v_{1}|\\}$. It therefore
follows from (1) that $\mathcal{A}_{*}$ is bounded on $L^{p}\times
L^{\infty}\times\cdots\times L^{\infty}\to L^{p}$, whenever $p>d/(d-1)$ and
$d\geq k+1$.

Theorem 0 now follows by symmetry and interpolation. ∎

It is straightforward to verify, following the ideas in Section 6 of [11],
that a necessary condition for $\mathcal{A}_{*}$ to be bounded on
$L^{p_{1}}\times\cdots\times L^{p_{k}}\to L^{r}$ is that
$1/r=1/p_{1}+\cdots+1/p_{k}$ with $p_{1},\dots,p_{k}>d/(d-1)$. It is therefore
of interest to obtain estimates outside of the “trivial region” given by
Theorem 0, namely for $1/p_{1}+\cdots+1/p_{k}\geq(d-1)/d$. Theorems 4 and 5,
in Section 8, establishes precisely this in sufficiently high dimensions. We
establish a convex region of points $(1/p_{1},\ldots,1/p_{k})$ for which
$\mathcal{A}_{*}$ is bounded that in particular contains the cube
$q^{-(k-1)}\cdot(d-1)/d\cdot[0,1)^{k}$ with $q=m/m-1$, in dimensions
$d>2km+2$. In particular, when $k=2$, we establish that $\mathcal{A}_{*}$ is
bounded on $L^{p_{1}}\times L^{p_{2}}\to L^{r}$, whenever
$1/r=1/p_{1}+1/p_{2}$ with $p_{1},p_{2}>m/(m-1)\cdot d/(d-1)$ and $d\geq 2m$,
see Figure 5.

###  2.2. Multilinear maximal operators associated to simplices in
$\mathbb{Z}^{d}$

Let $k\in\mathbb{N}$ and let
$\Delta=\\{v_{0}=0,v_{1},\ldots,v_{k}\\}\subseteq\mathbb{Z}^{d}$ be a non-
degenerate $k$-simplex. Given $\lambda\in\sqrt{\mathbb{N}}$ we say that a
simplex
$\Delta^{\prime}=\\{y_{0}=0,y_{1},\ldots,y_{k}\\}\subseteq\mathbb{Z}^{d}$ is
_isometric_ to $\Delta$ if $|y_{i}-y_{j}|=\lambda|v_{i}-v_{j}|$ for all $0\leq
i,j\leq k$. We will again write $\Delta^{\prime}\simeq\lambda\Delta$ in this
case and now denote by $N_{\lambda\Delta}$ the number of isometric copies of
$\lambda\Delta$, namely

$N_{\lambda\Delta}:=|\\{(y_{1},\ldots,y_{k})\in\mathbb{Z}^{dk}:\
\Delta^{\prime}=\\{0,y_{1},\ldots,y_{k}\\}\simeq\lambda\Delta\\}|.$

Note that for $k=1$ and $v_{1}=(1,0,\ldots,0)$ we have that
$N_{\lambda\Delta}=N_{\lambda}$.

Given any simplex
$\Delta=\\{v_{0}=0,v_{1},\ldots,v_{k}\\}\subseteq\mathbb{R}^{d}$, we introduce
the associated _inner product matrix_ $T=T_{\Delta}=(t_{ij})_{1\leq i,j\leq
k}$ with entries $t_{ij}:=v_{i}\cdot v_{j}$, where “$\cdot$” stands for the
dot product in $\mathbb{R}^{d}$. Note that $T$ is a positive semi-definite
matrix with integer entries and $T$ is positive definite if and only if
$\Delta$ is non-degenerate. It is easy to see that
$\Delta^{\prime}\simeq\lambda\Delta$, with
$\Delta^{\prime}=\\{y_{0}=0,y_{1},\ldots,y_{k}\\}$, if and only if

(5) $y_{i}\cdot y_{j}=\lambda^{2}t_{ij}\quad\text{for all}\quad 1\leq i,j\leq
k.$

Extending the work of Siegel [13] and Raghavan [12], Kitaoke [8] has proved
that if $\Delta$ is non-degenerate, then one has the estimate

(6) $c_{d,k}\det\,(\lambda^{2}T)^{(d-k-1)/2}\leq N_{\lambda\Delta}\leq
C_{d,k}\det\,(\lambda^{2}T)^{(d-k-1)/2}$

in dimensions $d\geq 2k+3$ for $\lambda\geq\lambda_{d,k,\Delta}$. It is
important to note that the constants $0<c_{d,k}<C_{d,k}$ depending only on the
parameters $d$ and $k$ and are independent of the matrix $T$ and hence the
simplex $\Delta$. For a self contained treatment of the upper bound in (6),
see Lemma 2.2 in [9]. In particular for sufficiently large $\lambda$ one has
that $N_{\lambda\Delta}>0$, in fact
$N_{\lambda\Delta}\asymp\lambda^{kd-k(k+1)}$ with implicit constants may
depending on $\Delta$.

For a family of functions $f_{1},\dots,f_{k}:\mathbb{Z}^{d}\to\mathbb{R}$ and
$\lambda\in\sqrt{\mathbb{N}}$ such that $N_{\lambda\Delta}>0$ we define the
multilinear averages

(7)
$A_{\lambda}(f_{1},\ldots,f_{k})(x)=N_{\lambda\Delta}^{-1}\sum_{y_{1},\ldots,y_{k}}f_{1}(x+y_{1})\cdots
f_{k}(x+y_{k})\,S_{\lambda^{2}T}(y_{1},\ldots,y_{k})$

where $S_{\lambda^{2}T}(y_{1},\ldots,y_{k})=1$ if
$y_{1},\ldots,y_{k}\in\mathbb{Z}^{d}$ satisfies (5) and is equal to 0
otherwise, i.e. the indicator function of the relation
$\Delta^{\prime}\simeq\lambda\Delta$, and the associated maximal operator

(8)
$A_{\ast}(f_{1},\ldots,f_{k})(x)=\sup_{\lambda}|A_{\lambda}(f_{1},\ldots,f_{k})(x)|$

where the supremum is restricted to those $\lambda\in\sqrt{\mathbb{N}}$ for
which $N_{\lambda\Delta}>0$.

We remark that there is no direct analogue of Theorem 0 in the discrete
setting. This difficulty arises from the fact that for fixed $y_{1}$, we do
not necesssailly have control over the count

$\sum_{y_{2},\ldots,y_{k}}S_{\lambda^{2}T}(y_{1},\ldots,y_{k}).$

Our results do however rely on leveraging the fact that the above sum is well
behaved on average.

##  3\. Main results for our Discrete Multilinear Maximal Operators

In the discrete setting we choose to present our results in an increasing
order of generality, first presenting the following special case of our most
general result in the special case of discrete bilinear maximal operators
associated to triangles.

######  Theorem 1.

Let $\Delta=\\{v_{0}=0,v_{1},v_{2}\\}\subseteq\mathbb{Z}^{d}$ be a non-
degenerate triangle.

  * (i)

If $d\geq 9$, $r>2d/(d-2)$, and $1\leq p_{1},p_{2}\leq\infty$ with
$1/r=1/p_{1}+1/p_{2}$, then one has the estimate

(9) $\|A_{\ast}(f_{1},f_{2})\|_{r}\leq
C_{d,\Delta}\,\|f_{1}\|_{p_{1}}\|f_{2}\|_{p_{2}}.$

  * (ii)

If $d\geq 11$, then for any $r>d/(d-2)$ and $p_{1},p_{2}>2d/(d-2)$ that
satisfies $1/r=1/p_{1}+1/p_{2}$, one has

$\|A_{\ast}(f_{1},f_{2})\|_{r}\leq
C_{d,\Delta}\,\|f_{1}\|_{p_{1}}\|f_{2}\|_{p_{2}}.$

For a visualization of those $p_{1}$ and $p_{2}$ for which Theorem 1 gives
boundedness for these discrete bilinear maximal operators, see Figure 3 (with
$m=2$).

Note that if we know that $A_{\ast}$ is bounded on
$\ell^{p_{1}}\times\ell^{p_{2}}\to\ell^{r}$, then we automatically get all
bounds $\ell^{q_{1}}\times\ell^{q_{2}}\to\ell^{s}$ for all $q_{1}\leq p_{1}$,
all $q_{2}\leq p_{2}$, and $s\geq r$ due to the nested properties of the
discrete norms.

Furthermore, note that in Theorem 1 above, and in all subsequent theorem and
propositions in this paper (except for Theorem 3), part (ii) implies part (i)
for the range of dimensions in which part (ii) holds.

We remark that it was independently and simultaneously established by
Anderson, Kumchev and Palsson in [1] that in dimensions $d\geq 9$, with
$\Delta$ being a equilateral triangle, that estimate (9) holds in the larger
range $r>\max\\{32/(d+8),(d+4)/(d-2)\\}$. Their result follows as a direct
corollary of $\ell^{p}\times\ell^{\infty}\to\ell^{p}$ bounds obtained by
employing very different methods than those contained in this short note.

Our proof of (i) above also follows from
$\ell^{p}\times\ell^{\infty}\to\ell^{p}$ estimates. In Section 6 we discuss a
generalization of our method that allows us to obtain better bounds in larger
dimensions. In particular, we obtain
$\ell^{p_{1}}\times\ell^{p_{2}}\to\ell^{r}$ bounds whenever
$r>m/(m-1)\,\cdot\,d/(d-2)$ and $1\leq p_{1},p_{2}\leq\infty$ with $1/r\leq
1/p_{1}+1/p_{2}$, provided $d\geq 2m+5$. This represents an improvement on the
results in [1] for $d\geq 15$. See Theorem 3, with $k=2$, and Figure 3.

We remark that our proof of (ii) above, which we emphasize gives non-trivial
estimates for a range of $p_{1}$ and $p_{2}$ for any given $r>d/(d-2)$,
provided $d\geq 11$, does not follow as a corollary of
$\ell^{p}\times\ell^{\infty}\to\ell^{p}$ estimates.

Before stating our next result, Theorem 2 below, which generalizes Theorem 1
to multilinear maximal operators associated to $k$-simplices, we define for
each integer $k\geq 2$, a symmetric convex region
$\mathcal{C}_{k}\subseteq[0,1]^{k}$. We define $\mathcal{C}_{k}$ to be all
those points $(x_{1},\dots,x_{k})\in[0,1]^{k}$ with $x_{1}+\cdots+x_{k}<1$
that also have the property that for any $1\leq j\leq k-1$ one has
$y_{1}+\cdots+y_{j}<1-2^{-j}$ for any choice
$\\{y_{1},\dots,y_{j}\\}\subset\\{x_{1},\dots,x_{k}\\}$.

We note, in particular, that if $(x_{1},\dots,x_{k})\in\mathcal{C}_{k}$, then
$0\leq x_{1},\dots,x_{k}<1/2$, and that both the points $(1/k,\dots,1/k)$ and
$(1/2,0,\dots,0)$, while not in $\mathcal{C}_{k}$, are contained in the
boundary of $\mathcal{C}_{k}$. See Figure 1 below.

$x_{1}$$x_{2}$$x_{3}$$(1,0,0)$$\vec{x}_{1}$$\vec{x}_{2}$$(0,0,1)$$\vec{x}_{3}$$(0,1,0)$
Figure 1. Illustration of $\mathcal{C}_{3}$ where $\vec{x}_{1}=(1/2,1/4,1/4)$,
$\vec{x}_{2}=(1/4,1/2,1/4)$, and $\vec{x}_{3}=(1/4,1/4,1/2)$.

######  Theorem 2.

Let $k\in\mathbb{N}$ and
$\Delta=\\{v_{0}=0,v_{1},\ldots,v_{k}\\}\subseteq\mathbb{Z}^{d}$ be a non-
degenerate $k$-simplex.

  * (i)

If $d\geq 4k+1$, $r>2d/(d-2)$, and $1\leq p_{1},\dots,p_{k}\leq\infty$ with
$1/r=1/p_{1}+\cdots+1/p_{k}$, then one has

$\|A_{\ast}(f_{1},\ldots,f_{k})\|_{r}\leq
C_{d,k,\Delta}\,\|f_{1}\|_{p_{1}}\cdots\|f_{k}\|_{p_{k}}.$

  * (ii)

If $d\geq 4k+3$, then for any $r>d/(d-2)$ and $p_{1},\dots,p_{k}>2d/(d-2)$
whose reciprocals

$(1/p_{1},\dots,1/p_{k})\in(d-2)/d\cdot\mathcal{C}_{k}$

and satisfy $1/r=1/p_{1}+\cdots+1/p_{k}$, one has the estimate

$\|A_{\ast}(f_{1},\ldots,f_{k})\|_{r}\leq
C_{d,k,\Delta}\,\|f_{1}\|_{p_{1}}\cdots\|f_{k}\|_{p_{k}}.$

For a visualization of those $p_{1},\dots,p_{k}$ for which Theorem 2 gives
boundedness for these discrete multilinear maximal operators, see Figure 4
(with $m=2$).

Note, as above, that if we know that $A_{\ast}$ is bounded on
$\ell^{p_{1}}\times\cdots\times\ell^{p_{k}}\to\ell^{r}$, then it is
automatically bounded on
$\ell^{q_{1}}\times\cdots\times\ell^{q_{k}}\to\ell^{s}$ for all $q_{1}\leq
p_{1},\dots,q_{k}\leq p_{k}$, and $s\geq r$.

In Section 6 we discuss a generalization of our method that allows us to
obtain better $\ell^{p_{1}}\times\cdots\times\ell^{p_{k}}\to\ell^{r}$ bounds
provided that $d$ is sufficiently large. In particular, we obtain
$\ell^{p_{1}}\times\cdots\times\ell^{p_{k}}\to\ell^{r}$ bounds whenever
$r>m/(m-1)\,\cdot\,d/(d-2)$ and $1\leq p_{1},\dots,p_{k}\leq\infty$ with
$1/r\leq 1/p_{1}+\cdots+1/p_{k}$, provided $d\geq 2m(k-1)+5$, and more general
estimates whenever $d\geq 2mk+3$. See Theorem 3 and Figure 4.

We conclude discrete matters in Section 7 by demonstrating that
$\ell^{p}\times\ell^{\infty}\times\cdots\times\ell^{\infty}\to\ell^{p}$
boundedness fails for every $p\leq d/(d-2)$ in dimensions $d\geq 2k+3$.

##  4\. Proof of Theorem 2

The crucial ingredient in our proof of Theorem 2 is pointwise estimates for
$A_{\ast}(f_{1},\dots f_{k})$ in terms of the spherical maximal operator
applied to appropriate powers of the functions $f_{j}$, specifically

######  Proposition 1.

Let $k\in\mathbb{N}$ and
$\Delta=\\{v_{0}=0,v_{1},\ldots,v_{k}\\}\subseteq\mathbb{Z}^{d}$ be a non-
degenerate $k$-simplex.

  * (i)

If $d\geq 4k+1$, then for any $f_{1},\dots,f_{k}:\mathbb{Z}^{d}\to\mathbb{R}$,
one has

(10) $A_{\ast}(f_{1},\ldots,f_{k})(x)\leq
C_{d,k,\Delta}\,\|f_{1}\|_{\infty}\cdots\|f_{k-1}\|_{\infty}\
A_{\ast}(f_{k}^{2})(x)^{1/2}$

uniformly for $x\in\mathbb{Z}^{d}$.

  * (ii)

If $d\geq 4k+3$, then for any $f_{1},\dots,f_{k}:\mathbb{Z}^{d}\to\mathbb{R}$,
one has

(11) $A_{\ast}(f_{1},\ldots,f_{k})(x)\leq
C_{d,k,\Delta}\,A_{\ast}(f_{1}^{2},\ldots,f_{k-1}^{2})(x)^{1/2}\,A_{\ast}(f_{k}^{2})(x)^{1/2}$

and hence

(12) $A_{\ast}(f_{1},\ldots,f_{k})(x)\leq
C_{d,k,\Delta}\,A_{\ast}(f_{1}^{2^{k-1}})(x)^{1/2^{k-1}}A_{\ast}(f_{2}^{2^{k-1}})(x)^{1/2^{k-1}}\prod_{j=3}^{k}A_{\ast}(f_{j}^{2^{k+1-j}})(x)^{1/2^{k+1-j}}$

uniformly for $x\in\mathbb{Z}^{d}$.

We prove Proposition 1 in Section 5 below. It is straightforward to see that
Theorem 2 (i) follows immediately from (10) and (2), indeed these estimates
imply

$\|A_{\ast}(f_{1},\ldots,f_{k})\|_{p_{k}}\leq
C_{d,k,\Delta}\,\|f_{1}\|_{\infty}\cdots\|f_{k-1}\|_{\infty}\|A_{\ast}(f_{k}^{2})\|^{1/2}_{p_{k}/2}\leq
C_{d,k,\Delta}\,\|f_{1}\|_{\infty}\cdots\|f_{k-1}\|_{\infty}\|f_{k}\|_{p_{k}}$

provided $p_{k}>2d/(d-2)$. By symmetry and interpolation we then obtain part
(i) of Theorem 2.

Assuming the validity (12) for now, we can also quickly establish Theorem 2
(ii). An application of Hölder gives that

$\|A_{\ast}(f_{1},\ldots,f_{k})\|_{r}\leq
C_{d,k,\Delta}\|A_{\ast}(f_{1}^{2^{k-1}})\|_{p_{1}/2^{k-1}}^{1/2^{k-1}}\|A_{\ast}(f_{2}^{2^{k-1}})\|_{p_{2}/2^{k-1}}^{1/2^{k-1}}\prod_{j=3}^{k}\|A_{\ast}(f_{j}^{2^{k+1-j}})\|_{p_{j}/2^{k+1-j}}^{1/2^{k+1-j}}$

whenever $1/r=1/p_{1}+\cdots+1/p_{k}$. Now if

$p_{1},p_{2}>2^{k-1}\frac{d}{d-2}\ \ \ \text{and}\ \ \
p_{j}>2^{k+1-j}\frac{d}{d-2}\ \ \text{for}\ \ 3\leq j\leq k$

then by (2) we obtain

$\|A_{\ast}(f_{1},\ldots,f_{k})\|_{r}\leq
C_{d,k,\Delta}\|f_{1}\|_{p_{1}}\cdots\|f_{k}\|_{p_{k}}$

with $1/r=1/p_{1}+\cdots+1/p_{k}<(d-2)/d$. Theorem 2 (ii) now follows by
symmetry and interpolation. ∎

##  5\. Proof of Proposition 1

The key ingredient of the proof of this proposition is an upper bound on the
$\ell^{1}$ norm of the function $S_{T}(y_{1},\ldots,y_{k})$ defined in (5)
(when $\lambda=1$), proved in Lemma 2.2 in [9], namely if $T=(t_{ij})$ is a
positive definite integral $k\times k$ matrix then for $d\geq 2k+3$ one has

(13) $\sum_{y_{1},\ldots,y_{k}\in\mathbb{Z}^{d}}S_{T}(y_{1},\ldots,y_{k})\leq
C_{d,k}\,\Bigl{(}\det(T)^{(d-k-1)/2}+|T|^{(d-k)(k-1)/2}\Bigr{)}$

with $|T|:=(\sum_{i,j}t_{ij}^{2})^{1/2}$.

Let $\Delta=\\{v_{0}=0,v_{1},\ldots,v_{k}\\}$ be a non-degenerate $k$-simplex
with inner product matrix $T=(t_{ij})$. Note that for
$\lambda\leq\lambda_{d,k,\Delta}$ we have that $N_{\lambda\Delta}\leq
C_{d,k,\Delta}$ thus by Hölder’s and Minkowski’s inequalities we have that
$\|A_{\lambda}(f_{1},\ldots,f_{k})\|_{r}\leq
C_{d,k,\Delta}\,\|f_{1}\|_{p_{1}}\ldots\|f_{k}\|_{p_{k}}$, whenever
$1/p_{1}+\cdots+1/p_{k}=1/r$. Thus the supremum in (8) can be restricted to
sufficiently large $\lambda$. Then because of
$N_{\lambda\Delta}\asymp\lambda^{k(d-k-1)}$ one may replace the factor
$N_{\lambda\Delta}^{-1}$ with $\lambda^{-k(d-k-1)}$ in formula (7) and assume
without loss of generality that $\lambda\geq\lambda_{d,k,\Delta}$.

We choose to focus first on establishing part (ii) of Proposition 1.

###### Proof of Propostion 1 (ii).

For a solution $y_{1},\ldots,y_{k}$ to the system of equations (5) we will
write $\underline{y}_{1}=(y_{1},\ldots,y_{k-1})$ to group the first $k-1$
variables and $T_{1}$ for the corresponding inner product matrix, i.e. for the
$k-1\times k-1$ minor of $T$. For given $x\in\mathbb{Z}^{d}$, by the Cauchy-
Schwarz inequality, in dimensions $d>2k$ we have

$\displaystyle A_{\lambda}(f_{1},\ldots,f_{k})(x)^{2}$ $\displaystyle\leq\
\lambda^{-d(k-1)+k(k-1)}\
\sum_{\underline{y}_{1}}S_{\lambda^{2}T_{1}}(\underline{y}_{1})f_{1}^{2}(x+y_{1})\cdots
f_{k-1}^{2}(x+y_{k-1})$
$\displaystyle\quad\quad\quad\quad\quad\quad\quad\times\
\lambda^{-d(k+1)+k^{2}+3k}\
\sum_{\underline{y}_{1}}\,\Bigl{(}\sum_{y_{k}}f_{k}(x+y_{k})S_{\lambda^{2}T}(\underline{y}_{1},y_{k})\Bigr{)}^{2}$
$\displaystyle\leq\ A_{\ast}(f_{1}^{2},\ldots,f_{k-1}^{2})(x)\
B_{\lambda}(f_{k},f_{k})(x)$

where

$B_{\lambda}(f_{k},f_{k})(x)=\lambda^{-d(k+1)+k^{2}+3k}\sum_{y_{k},y_{k}^{\prime}}f_{k}(x+y_{k})f_{k}(x+y_{k}^{\prime})W_{\lambda^{2}T}(y_{k},y_{k}^{\prime})$

with a weight function

(14)
$W_{\lambda^{2}T}(y_{k},y_{k}^{\prime})=\sum_{\underline{y}_{1}}S_{\lambda^{2}T}(\underline{y}_{1},y_{k})\,S_{\lambda^{2}T}(\underline{y}_{1},y_{k}^{\prime}).$

By a slight abuse of notation let $S_{\lambda}(y)=1$ if
$|y|^{2}=t_{kk}\lambda^{2}$ and equal to $0$ otherwise. Then one may write

$B_{\lambda}(f_{k},f_{k})(x)=\lambda^{-d(k+1)+k^{2}+3k}\sum_{y_{k},y_{k}^{\prime}}f_{k}(x+y_{k})f_{k}(x+y_{k}^{\prime})S_{\lambda}(y_{k})S_{\lambda}(y_{k^{\prime}})W_{\lambda^{2}T}(y_{k},y_{k}^{\prime})$

and an application of Cauchy-Schwarz gives

$B_{\lambda}(f_{k},f_{k})(x)^{2}\leq\Bigl{(}\lambda^{-d+2}\sum_{y}f^{2}_{k}(x+y)S_{\lambda}(y)\Bigr{)}^{2}\Bigl{(}\lambda^{-2dk+2k^{2}+6k-4}\sum_{y_{k},y_{k}^{\prime}}W_{\lambda^{2}T}(y_{k},y_{k}^{\prime})^{2}\Bigr{)}.$

Thus, in order to establish (11) and complete the proof of the proposition, it
suffices to show that

$\sum_{y_{k},y_{k}^{\prime}}W_{\lambda^{2}T}(y_{k},y_{k}^{\prime})^{2}\leq
C\,\lambda^{2dk-2k^{2}-6k+4}$

with a constant $C=C_{d,k,T}>0$. By (14), we have that

$\sum_{y_{k},y_{k}^{\prime}}W_{\lambda^{2}T}(y_{k},y_{k}^{\prime})^{2}=\sum_{\underline{y}_{1},\underline{y}_{1}^{\prime},y_{k},y_{k}^{\prime}}S_{\lambda^{2}T}(\underline{y}_{1},y_{k})S_{\lambda^{2}T}(\underline{y}_{1}^{\prime},y_{k})S_{\lambda^{2}T}(\underline{y}_{1},y_{k}^{\prime})S_{\lambda^{2}T}(\underline{y}_{1}^{\prime},y_{k}^{\prime}).$

The above expression is the number of solutions
$y_{1},\ldots,y_{k},y_{1}^{\prime},\ldots,y_{k}^{\prime}\in\mathbb{Z}^{d}$ to
the system of quadratic equations

$\displaystyle y_{i}\cdot y_{j}$ $\displaystyle=y_{i}^{\prime}\cdot
y_{j}^{\prime}=\lambda^{2}t_{ij},\ \text{for}\ \ 1\leq i,j\leq k-1$ (15)
$\displaystyle y_{i}\cdot y_{k}$ $\displaystyle=y_{i}^{\prime}\cdot
y_{k}=y_{i}\cdot y_{k}^{\prime}=y_{i}^{\prime}\cdot
y_{k}^{\prime}=\lambda^{2}t_{ik},\ \text{for}\ \ 1\leq i\leq k-1$
$\displaystyle\ y_{k}\cdot y_{k}$ $\displaystyle=y_{k}^{\prime}\cdot
y_{k}^{\prime}=\lambda^{2}t_{kk}.$

For any solution $y_{1},\ldots,y_{k},y_{1}^{\prime},\ldots,y_{k}^{\prime}$ of
the system (5) introduce the parameters $(s_{ij})_{1\leq i,j\leq k-1}$ and
$s_{kk}$ such that

(16) $y_{i}\cdot y_{j}^{\prime}=\lambda^{2}s_{ij}\ \text{for}\ \ 1\leq i,j\leq
k-1\ \text{and}\ \ y_{k}\cdot y_{k}^{\prime}=\lambda^{2}s_{kk}.$

We call the set of parameters $S=(s_{ij},s_{kk})_{1\leq i,j\leq k-1}$
_admissible_ if the system (5)-(16) have a solution. For any admissible set of
parameters $S$ let $\lambda^{2}T_{S}$ denote the $2k\times 2k$ inner product
matrix of the system (5)-(16), and note that $\lambda^{2}T_{S}$ is a positive
semi-definite integral matrix with entries $O_{T}(\lambda^{2})$.

We consider two cases.

Case 1: Assume that the matrix $T_{S}$ is positive definite. Then in
dimensions $d\geq 4k+3$ one may apply estimate (13) to the matrix
$\lambda^{2}T_{S}$ which shows that the number of solutions to the system
(5)-(16) is bounded by $C\,\lambda^{2dk-2k(2k+1)}$. Since there at most
$C\,\lambda^{2(k-1)^{2}+2}$ admissible sets $S$, such admissible sets
contribute to at most $C\,\lambda^{2dk-2k^{2}-6k+4}$ solutions to the system
(5), for some constant $C=C_{d,k,T}>0$.

Case 2: Assume $\det(T_{S})=0$. Then the vectors
$y_{1},\ldots,y_{k},y_{1}^{\prime},\ldots,y_{k}^{\prime}$ are linearly
dependent. Let
$M:=\text{span}\\{y_{1},\ldots,y_{k},y_{1}^{\prime},\ldots,y_{k}^{\prime}\\}\subseteq\mathbb{R}^{d}$.
Since $y_{1},\ldots,y_{k}$ are linearly independent one may extend these
vectors with vectors $y_{i_{1}}^{\prime},\ldots y_{i_{l}}^{\prime}$, for some
$1\leq l<k$, to obtain a basis of of the vector space $M$. Write
$I=\\{i_{1},\ldots,i_{l}\\}$, if $j\notin I$, then $y_{j}^{\prime}\in M$
moreover the inner products $y_{j}\cdot y_{i}$ for $1\leq i\leq k$, and
$y_{j}\cdot y_{i}^{\prime}$ for $i\in I$ are all determined by equations
(5)-(16). It follows that $y_{j}^{\prime}$ is uniquely determined for $j\notin
I$, thus the number of solutions for a fixed index set $I$ is bounded by the
number of $k+l$-tuples $y_{1},\ldots,y_{k},y_{i_{1}}^{\prime},\ldots
y_{i_{l}}^{\prime}$ satisfying equations (5)-(16). The inner products of these
vectors form a positive definite matrix, thus applying estimate (13) we obtain
that number of solutions is bounded by
$\,C\lambda^{d(k+l)-(k+l)(k+l+1)}<C\,\lambda^{2dk-2k(2k+1)}\,$, in dimensions
$d>4k$. As the number of possible index sets $I$ depends only on $k$, the
total number of linearly dependent solutions to the system (5)-(16) is also
bounded by $C\,\lambda^{2dk-2k^{2}-6k+4}$. ∎

###### Proof of Propostion 1 (i).

We use the same notation as above and assume that
$\|f_{1}\|_{\infty},\dots,\|f_{k-1}\|_{\infty}\leq 1$.

For any given $x\in\mathbb{Z}^{d}$ we have

$A_{\lambda}(f_{1},\ldots,f_{k})(x)\leq\ \lambda^{-dk+k(k+1)}\
\sum_{y_{k}}f_{k}(x-y_{k})S_{\lambda}(y_{k})\,\sum_{\underline{y}_{1}}S_{\lambda^{2}T}(\underline{y}_{1},y_{k})$

and hence, after an application of Cauchy-Schwarz, we obtain

$A_{\lambda}(f_{1},\ldots,f_{k})(x)^{2}\leq\ A_{*}(f_{k}^{2})(x)\
\lambda^{-d(2k-1)+2k(k+1)-2}\sum_{y_{k},\underline{y}_{1},\underline{y}^{\prime}_{1}}S_{\lambda^{2}T}(\underline{y}_{1},y_{k})\,S_{\lambda^{2}T}(\underline{y}^{\prime}_{1},y_{k}).$

The sum in the expression above is the number of solutions
$y_{1},\ldots,y_{k-1},y_{1}^{\prime},\ldots,y_{k-1}^{\prime}\in\mathbb{Z}^{d}$
and $y_{k}\in\mathbb{Z}^{d}$ to the system of quadratic equations

$\displaystyle y_{i}\cdot y_{j}$ $\displaystyle=y_{i}^{\prime}\cdot
y_{j}^{\prime}=\lambda^{2}t_{ij},\ \text{for}\ \ 1\leq i,j\leq k-1$ (17)
$\displaystyle y_{i}\cdot y_{k}$ $\displaystyle=y_{i}^{\prime}\cdot
y_{k}=\lambda^{2}t_{ik},\ \text{for}\ \ 1\leq i\leq k-1$ $\displaystyle\
y_{k}\cdot y_{k}$ $\displaystyle=\lambda^{2}t_{kk}.$

If one now argues, as in the proof of part (ii) above, it follows from
estimate (13) that

$\sum_{y_{k},\underline{y}_{1},\underline{y}^{\prime}_{1}}S_{\lambda^{2}T}(\underline{y}_{1},y_{k})\,S_{\lambda^{2}T}(\underline{y}^{\prime}_{1},y_{k})\leq
C_{d,k,T}\,\lambda^{d(2k-1)-2k(k+1)+2}.$

We choose to omit the details of this calculation. ∎

##  6\. A strengthening of Theorem 2 in high dimensions

If, in the proof of Proposition 1, we apply Hölder’s inequality with conjugate
exponents $m/(m-1)$ and $m$ instead of the Cauchy-Schwarz inequality, this
results in $y_{1},\ldots,y_{k-1}$ and $y_{1},\ldots,y_{k}$ being increased
$m$-fold as opposed to being doubled, in parts (i) and (ii) respectively.

Working through these details, which we omit (but one may consult Section 9.2
for the analogous, and somewhat similar, details in the continuous setting),
one obtains the following

######  Proposition 2.

Let $k\in\mathbb{N}$ and
$\Delta=\\{v_{0}=0,v_{1},\ldots,v_{k}\\}\subseteq\mathbb{Z}^{d}$ be a non-
degenerate $k$-simplex.

Let $m\geq 2$ be an integer and set $q=m/(m-1)$.

  * (i)

If $d\geq 2m(k-1)+5$, then for any
$f_{1},\dots,f_{k}:\mathbb{Z}^{d}\to\mathbb{R}$, one has

$A_{\ast}(f_{1},\ldots,f_{k})(x)\leq
C_{d,m,\Delta}\,\|f_{1}\|_{\infty}\cdots\|f_{k-1}\|_{\infty}\
A_{\ast}(|f_{k}|^{q})(x)^{1/q}$

uniformly for $x\in\mathbb{Z}^{d}$.

  * (ii)

If $d\geq 2mk+3$, then for any
$f_{1},\dots,f_{k}:\mathbb{Z}^{d}\to\mathbb{R}$, one has

$A_{\ast}(f_{1},\ldots,f_{k})(x)\leq
C_{d,m,\Delta}\,A_{\ast}(|f_{1}|^{q},\ldots,|f_{k-1}|^{q})(x)^{1/q}\,A_{\ast}(|f_{k}|^{q})(x)^{1/q}$

and hence

$A_{\ast}(f_{1},\ldots,f_{k})(x)\leq
C_{d,m,\Delta}\,A_{\ast}(|f_{1}|^{q^{k-1}})(x)^{1/q^{k-1}}A_{\ast}(|f_{2}|^{q^{k-1}})(x)^{1/q^{k-1}}\prod_{j=3}^{k}A_{\ast}(|f_{j}|^{q^{k+1-j}})(x)^{1/q^{k+1-j}}$

uniformly for $x\in\mathbb{Z}^{d}$.

Proposition 2 allows us to establish a strengthening of Theorem 2 in high
dimensions, namely Theorem 3 below. Before stating this result we define for
each integer $k\geq 2$ and $1<q\leq 2$, a symmetric convex region
$\mathcal{C}_{k,q}\subseteq[0,1]^{k}$. We define $\mathcal{C}_{k,q}$ to be all
those points $(x_{1},\dots,x_{k})\in[0,1]^{k}$ with

$x_{1}+\cdots+x_{k}<q^{-1}+q^{-2}+\cdots+q^{-(k-1)}+q^{-(k-1)}$

that also have the property that for any $1\leq j\leq k-1$ one has
$y_{1}+\cdots+y_{j}<q^{-1}+\cdots+q^{-j}$ for any choice
$\\{y_{1},\dots,y_{j}\\}\subset\\{x_{1},\dots,x_{k}\\}$. Note that
$\mathcal{C}_{k}=\mathcal{C}_{k,2}$, and that $\mathcal{C}_{k,q}$ contains the
cube $q^{-(k-1)}\cdot[0,1)^{k}$ which approaches $[0,1)^{k}$ as $q\to 1$.

$x_{1}$$x_{2}$$x_{3}$$(q^{-1},0,0)$$(1,0,0)$$\vec{x}_{1}$$\vec{x}_{2}$$(0,0,q^{-1})$$(0,0,1)$$\vec{x}_{3}$$(0,q^{-1},0)$$(0,1,0)$
Figure 2. Illustration of $\mathcal{C}_{3,q}$ where
$\vec{x}_{1}=(q^{-1},q^{-2},q^{-2})$, $\vec{x}_{2}=(q^{-2},q^{-1},q^{-2})$,
and $\vec{x}_{3}=(q^{-2},q^{-2},q^{-1}).$

######  Theorem 3.

Let $k\in\mathbb{N}$ and
$\Delta=\\{v_{0}=0,v_{1},\ldots,v_{k}\\}\subseteq\mathbb{Z}^{d}$ be a non-
degenerate $k$-simplex.

Let $m\geq 2$ be an integer and set $q=m/(m-1)$.

  * (i)

If $d\geq 2m(k-1)+5$, $r>q\,d/(d-2)$, and $1\leq p_{1},\dots,p_{k}\leq\infty$
with $1/r\leq 1/p_{1}+\cdots+1/p_{k}$, one has

$\|A_{\ast}(f_{1},\ldots,f_{k})\|_{r}\leq
C_{d,m,\Delta}\,\|f_{1}\|_{p_{1}}\cdots\|f_{k}\|_{p_{k}}.$

  * (ii)

If $d\geq 2mk+3$, then for any

$r>(q^{-1}+q^{-2}+\cdots+q^{-(k-1)}+q^{-(k-1)})^{-1}\,d/(d-2)\ \text{and}\
p_{1},\dots,p_{k}>q\,d/(d-2)$

whose reciprocals $(1/p_{1},\dots,1/p_{k})\in(d-2)/d\cdot\mathcal{C}_{k,q}$
and satisfy $1/r=1/p_{1}+\cdots+1/p_{k}$, one has

$\|A_{\ast}(f_{1},\ldots,f_{k})\|_{r}\leq
C_{d,m,\Delta}\,\|f_{1}\|_{p_{1}}\cdots\|f_{k}\|_{p_{k}}.$

For a visualization of those $p_{1},\dots,p_{k}$ for which Theorem 3 gives
boundedness for these discrete multilinear maximal operators, see Figures 3
and 4 below.

Note that Theorem 3 provides us with a strengthening of Theorem 2 (i) and (ii)
for all $d\geq 6k-1$ and $d\geq 6k+3$, respectively. Note that Theorem 3 is of
particular interest as $m\to\infty$ (and hence $d\to\infty$) for fixed $k$,
since this corresponds to $q\to 1$ through values of the form $m/(m-1)$ with
$m\in\mathbb{N}$.

$(\frac{d-2}{d},\frac{d-2}{d})$$(\frac{m-1}{m}\frac{d-2}{d},0)$$(0,\frac{m-1}{m}\frac{d-2}{d})$(0,0)$\frac{1}{p_{1}}$$\frac{1}{p_{2}}$

Figure 3.  Region of boundedness for the Discrete Bilinear ($k=2$) Maximal
Operator in $\mathbb{Z}^{d}$. We obtain the lower gray triangle if $d\geq
2m+5$ and the full square provided $d\geq 4m+3$.

$\frac{1}{p_{1}}$$\frac{1}{p_{2}}$$\frac{1}{p_{3}}$$(\frac{m-1}{m}\frac{d-2}{d},0,0)$$(\frac{d-2}{d},0,0)$$\vec{x}_{1}$$\vec{x}_{2}$$(0,0,\frac{m-1}{m}\frac{d-2}{d})$$(0,0,\frac{d-2}{d})$$\vec{x}_{3}$$(0,\frac{m-1}{m}\frac{d-2}{d},0)$$(0,\frac{d-2}{d},0)$
$\vec{x}_{1}=(\frac{m-1}{m}\frac{d-2}{d},(\frac{m-1}{m})^{2}\frac{d-2}{d},(\frac{m-1}{m})^{2}\frac{d-2}{d})$
$\vec{x}_{2}=((\frac{m-1}{m})^{2}\frac{d-2}{d},\frac{m-1}{m}\frac{d-2}{d},(\frac{m-1}{m})^{2}\frac{d-2}{d})$
$\vec{x}_{3}=((\frac{m-1}{m})^{2}\frac{d-2}{d},(\frac{m-1}{m})^{2}\frac{d-2}{d},\frac{m-1}{m}\frac{d-2}{d})$
Figure 4. Region of boundedness for the Discrete Trilinear ($k=3$) Maximal
Operator in $\mathbb{Z}^{d}$. We obtain the dark grey tetrahedron if $d\geq
4m+5$ and the larger convex region provided $d\geq 6m+3$.

###### Proof of Theorem 3.

We first establish part (i). Proposition 2 (i) implies

$\|A_{\ast}(f_{1},\ldots,f_{k})\|_{p_{k}}\leq
C_{d,m,\Delta}\,\|f_{1}\|_{\infty}\cdots\|f_{k-1}\|_{\infty}\|A_{\ast}(|f_{k}|^{q})\|^{1/q}_{p_{k}/q}\leq
C_{d,m,\Delta}\,\|f_{1}\|_{\infty}\cdots\|f_{k-1}\|_{\infty}\|f_{k}\|_{p_{k}}$

provided $p_{k}>q\,d/(d-2)$. By symmetry and interpolation we then obtain part
(i) of Theorem 3.

To establish part (ii), we note that Proposition 2 (ii) ensures that

$A_{\ast}(f_{1},\ldots,f_{k})(x)\leq
C_{d,m,\Delta}\,A_{\ast}(|f_{1}|^{q^{k-1}})(x)^{1/q^{k-1}}A_{\ast}(|f_{2}|^{q^{k-1}})(x)^{1/q^{k-1}}\prod_{j=3}^{k}A_{\ast}(|f_{j}|^{q^{k+1-j}})(x)^{1/q^{k+1-j}}.$

An application of Hölder, as in the proof of Theorem 2, then gives

$\|A_{\ast}(f_{1},\ldots,f_{k})\|_{r}\leq
C_{d,m,\Delta}\|A_{\ast}(|f_{1}|^{q^{k-1}})\|_{p_{1}/q^{k-1}}^{1/q^{k-1}}\|A_{\ast}(|f_{2}|^{q^{k-1}})\|_{p_{2}/q^{k-1}}^{1/q^{k-1}}\prod_{j=3}^{k}\|A_{\ast}(|f_{j}|^{q^{k+1-j}})\|_{p_{j}/q^{k+1-j}}^{1/q^{k+1-j}}$

whenever $1/r=1/p_{1}+\cdots+1/p_{k}$. Now if

$p_{1},p_{2}>q^{k-1}\frac{d}{d-2}\ \ \ \text{and}\ \ \
p_{j}>q^{k+1-j}\frac{d}{d-2}\ \ \text{for}\ \ 3\leq j\leq k$

then by (2) we obtain

$\|A_{\ast}(f_{1},\ldots,f_{k})\|_{r}\leq
C_{d,m,\Delta}\|f_{1}\|_{p_{1}}\cdots\|f_{k}\|_{p_{k}}$

with
$1/r=1/p_{1}+\cdots+1/p_{k}<(1/q+1/q^{2}+\cdots+1/q^{k-1}+1/q^{k-1})(d-2)/d$.

Part (ii) of Theorem 3 now follows by symmetry and interpolation. ∎

##  7\. An example for Multilinear operators in $\mathbb{Z}^{d}$

Let $d\geq 2k+3$. Simple examples show that estimates $\
\|A_{\ast}(f_{1},f_{2},\ldots,f_{k})\|_{r}\leq
C\,\|f_{1}\|_{p_{1}}\|f_{p_{2}}\|\cdots\|f_{k}\|_{p_{k}}\,$ are not possible
when $\frac{1}{r}=\frac{1}{p_{1}}+\ldots+\frac{1}{p_{k}}$, for any $r>1$,
$p_{1}\leq\frac{d}{d-2}$, $1\leq p_{i}\leq\infty$. By symmetry, this shows
that the reciprocals $(1/p_{1},\ldots,1/p_{k})$ for which the discrete maximal
operator is bounded is contained in the cube $Q_{d}=(d-2)/d\cdot[0,1)^{k}$ and
contains the smaller cube $q^{-(k-1)}\cdot Q_{d}$ with $q=m/m-1$, in
dimensions $d>2km+2$ by Theorem 3.

Assume first that $p_{i}<\infty$ for $2\leq i\leq k$. Let $f_{1}:=\delta_{0}$
the point mass at the origin, and for $2\leq i\leq k$ let
$f_{i}(x)=|x|^{-d/p_{i}}\,(\log\,(|x|))^{-\frac{1}{p_{i}}-\tau}$ ($\tau>0$)
for $|x|\geq 2$, and set $f_{i}(x)=0$ of $|x|\leq 1$. Given
$x\in\mathbb{Z}^{d}$, $x\neq 0$ and $\lambda\in\sqrt{\mathbb{N}}$, we have

$A_{\lambda}(f_{1},\ldots,f_{k})(x)=\,\lambda^{-dk+k(k+1)}\,\sum_{y_{1},\ldots,y_{k}}S_{\lambda^{2}T}(y_{1},y_{2},\ldots,y_{k})\
\delta_{0}(x-y_{1})\prod_{i=2}^{k}f_{i}(x-y_{i}).$

Choosing $\lambda=|x|$, one has that $y_{1}=x$ and $|x-y_{i}|\geq c\,|x|$ for
$2\leq i\leq k$, for any non-zero term. Thus one estimates

$A_{\ast}(f_{1},\ldots,f_{k})(x)\geq
C\,|x|^{-dk+k(k+1)}\,|x|^{-d(\frac{1}{r}-\frac{1}{p_{1}})}\,(\log\,(|x|))^{-(\frac{1}{r}-\frac{1}{p_{1}}-k\tau)}\
W_{|x|}(x)$

where
$W_{|x|}(x):=\sum_{y_{2},\ldots,y_{k}}S_{|x|^{2}T}(x,y_{2},\ldots,y_{k}).$ We
will show that

(18) $\sum_{x\in\mathbb{Z}^{d}}W_{|x|}(x)^{r}=\sum_{j=0}^{\infty}\
\sum_{2^{j}\leq|x|<2^{j+1}}W_{|x|}(x)^{r}\geq\sum_{j=0}^{\infty}2^{jd}\,\big{(}\,2^{-jd}\sum_{2^{j}\leq|x|<2^{j+1}}W_{|x|}(x)\big{)}^{r}=\infty$

for which it is enough to show that

$2^{-jd}\sum_{2^{j}\leq|x|<2^{j+1}}W_{|x|}(x)\geq
C\,2^{-\frac{jd}{r}}j^{-\frac{1}{r}}.$

Using the notation $|x|\approx 2^{j}$ for $2^{j}\leq|x|<2^{j+1}$, one has

(19) $2^{-jd}\sum_{|x|\approx 2^{j}}W_{|x|}(x)\geq
c\,2^{-jd(1+\frac{1}{r}-\frac{1}{p_{1}})}j^{-(\frac{1}{r}-\frac{1}{p_{1}}-k\tau)}2^{-j(dk-k(k+1))}\sum_{|x|\approx
2^{j}}\sum_{y_{2},\ldots,y_{k}}S_{|x|^{2}T}(x,y_{2},\ldots,y_{k}).$

Writing $\lambda=|x|\in\sqrt{N}$ the right side of the above expression can
further estimated from below by

$2^{-j(dk-k(k+1))}\sum_{2^{j}\leq\lambda<2^{j+1}}\sum_{y_{1},\ldots,y_{k}}S_{\lambda^{2}T}(y_{1},\ldots,y_{k})\geq
C\sum_{2^{j}\leq\lambda<2^{j+1}}1\,\geq\,C\,2^{2j}$

for some constant $C=C_{d,k,T}>0$, using estimate (6) and the fact that there
are approximately $2^{2j}$ values of $\lambda\in\sqrt{\mathbb{N}}$ satisfying
$2^{j}\leq\lambda<2^{j+1}$. This implies that for $p_{1}\leq d/(d-2)$,
$\tau\leq 1/kp_{1}$ the left side of (19) is bigger than

$C\,2^{-j(d-2-\frac{d}{p_{1}}+\frac{d}{r})}\,j^{-\frac{1}{r}+\frac{1}{p_{1}}-k\tau}\geq
C\,2^{-\frac{jd}{r}}\,j^{-\frac{1}{r}}.$

This shows the validity of (18). The same argument works when $p_{i}=\infty$
for some $2\leq i\leq k$ by choosing $f_{i}$ to be the constant 1 function.

##  8\. Main results for our Multilinear Maximal Operators on $\mathbb{R}^{d}$

For simplicity we first state our main result, in the continuous setting, in
the bilinear ($k=2$) case.

######  Theorem 4.

Let $\Delta=\\{v_{0}=0,v_{1},v_{2}\\}\subseteq\mathbb{R}^{d}$ be a non-
degenerate triangle.

Let $m\geq 2$ be an integer and set $q=m/(m-1)$. If $d\geq 2m$, $r>q/2\cdot
d/(d-1)$, and $p_{1},p_{2}>q\,d/(d-1)$ with $1/r=1/p_{1}+1/p_{2}$, then one
has the estimate

$\|\mathcal{A}_{\ast}(f_{1},f_{2})\|_{r}\leq
C_{d,\Delta}\,\|f_{1}\|_{p_{1}}\|f_{2}\|_{p_{2}}.$

If for each $1<q\leq 2$ we define new symmetric convex region
$\widetilde{\mathcal{C}}_{2,q}\subseteq[0,1]^{2}$ to be the convex hull of the
region $\mathcal{C}_{2,q}$, as defined in Section 6, and the triangle of
points $(x_{1},x_{2})\in[0,1]^{2}$ with $x_{1}+x_{2}<1$, then combining
Theorem 0 with Theorem 4 gives the following

######  Corollary 1.

Let $\Delta=\\{v_{0}=0,v_{1},v_{2}\\}\subseteq\mathbb{R}^{d}$ be a non-
degenerate triangle.

Let $m\geq 2$ be an integer and set $q=m/(m-1)$. If $d\geq 2m$, $r>q/2\cdot
d/(d-1)$, and the reciprocals of $p_{1}$ and $p_{2}$ satisfy both
$(1/p_{1},1/p_{2})\in(d-1)/d\cdot\widetilde{\mathcal{C}}_{2,q}$ and
$1/r=1/p_{1}+1/p_{2}$, then one has the estimate

$\|\mathcal{A}_{\ast}(f_{1},\ldots,f_{k})\|_{r}\leq
C_{d,k,\Delta}\,\|f_{1}\|_{p_{1}}\cdots\|f_{k}\|_{p_{k}}.$

Theorem 4, and hence Corollary 1, are a special case of Theorem 5 below, they
in fact form the base case of an inductive argument that will be used to prove
Theorem 5.

For a visualization of those $p_{1}$ and $p_{2}$ for which Corollary 1 gives
boundedness for these bilinear maximal operators, see Figure 5 below.

$(\frac{d-1}{d},\frac{d-1}{d})$$(\frac{m-1}{m}\frac{d-1}{d},\frac{m-1}{m}\frac{d-1}{d})$$(\frac{d-1}{d},0)$$(0,\frac{d-1}{d})$(0,0)$\frac{1}{p_{1}}$$\frac{1}{p_{2}}$

Figure 5.  Region of boundedness we obtain for Bilinear Maximal Operator in
$\mathbb{R}^{d}$, provided $d\geq 2m$.

The simple observation that

(20)
$\mathcal{A}_{*}(f_{1},\dots,f_{k})(x)\leq\|f_{k}\|_{\infty}\,\mathcal{A}_{*}(f_{1},\dots,f_{k-1})(x)$

implies that bounds for multilinear maximal operators associated to
$(k-1)$-simplices will always give rise to some corresponding estimates for
multilinear maximal operators associated to $k$-simplices. In particular, it
is easy to see using symmetry and interpolation that Corollary 1 gives the
following non-trivial new bounds for trilinear operators.

######  Corollary 2.

Let $\Delta=\\{v_{0}=0,v_{1},v_{2},v_{3}\\}\subseteq\mathbb{R}^{d}$ be a non-
degenerate 3-simplex.

Let $m\geq 2$ be an integer and set $q=m/(m-1)$. If $d\geq 2m$, $r>q/2\cdot
d/(d-1)$, and the reciprocals of $p_{1},p_{2},p_{3}$ satisfy both
$(1/p_{1},1/p_{2}),(1/p_{2},1/p_{3}),(1/p_{1},1/p_{3})\in(d-1)/d\cdot\widetilde{\mathcal{C}}_{2,q}$
and $1/r=1/p_{1}+1/p_{2}$, then

$\|\mathcal{A}_{\ast}(f_{1},f_{2},f_{3})\|_{r}\leq
C_{d,\Delta}\,\|f_{1}\|_{p_{1}}\|f_{2}\|_{p_{2}}\|f_{3}\|_{p_{3}}.$

For a visualization of those $p_{1},p_{2},p_{3}$ for which Corollary 2 gives
boundedness for these bilinear maximal operators, see Figure 6 below.

$\frac{1}{p_{1}}$$\frac{1}{p_{2}}$$\frac{1}{p_{3}}$$(\frac{d-1}{d},0,0)$$(\frac{m-1}{m}\frac{d-1}{d},\frac{m-1}{m}\frac{d-1}{d},0)$$(\frac{m-1}{m}\frac{d-1}{d},0,\frac{m-1}{m}\frac{d-1}{d})$$(0,0,\frac{d-1}{d})$$(0,\frac{m-1}{m}\frac{d-1}{d},\frac{m-1}{m}\frac{d-1}{d})$$(0,\frac{d-1}{d},0)$
Figure 6. Region of boundedness obtained in Corollary 2 for Trilinear Maximal
Operator in $\mathbb{R}^{d}$, provided $d\geq 2m$.

Before we can state our generalization of Corollary 1 to $k$-simplices, which
will in particular also strengthen Corollary 2 for $3$-simplices in higher
dimensions, we define inductively, for each integer $k\geq 2$ and $1<q\leq 2$
a new symmetric convex region
$\widetilde{\mathcal{C}}_{k,q}\subseteq[0,1]^{k}$.

We start with $\widetilde{\mathcal{C}}_{2,q}\subseteq[0,1]^{2}$ as defined
immediately after Theorem 4 above. Then, for each integer $k\geq 3$ we define
$\widetilde{\mathcal{C}}_{k,q}$ to be the convex hull of the points
$(x_{1},\dots,x_{k})\in[0,1]^{k}$ such that
$\pi_{j}(x_{1},\dots,x_{k})\in\widetilde{\mathcal{C}}_{k-1,q}$ for each $1\leq
j\leq k$, where $\pi_{j}$ denotes the projection onto the coordinate
hyperplane $x_{j}=0$, with the region $\mathcal{C}_{k,q}$ as defined in
Section 6.

######  Theorem 5.

Let $k\in\mathbb{N}$ and
$\Delta=\\{v_{0}=0,v_{1},\ldots,v_{k}\\}\subseteq\mathbb{R}^{d}$ be a non-
degenerate $k$-simplex.

Let $m\geq 2$ be an integer and set $q=m/(m-1)$. If $d\geq mk$, then for any

$r>(q^{-1}+q^{-2}+\cdots+q^{-(k-1)}+q^{-(k-1)})^{-1}\,d/(d-1)$

and $p_{1},\dots,p_{k}$ whose reciprocals satisfy both
$(1/p_{1},\dots,1/p_{k})\in(d-1)/d\cdot\widetilde{\mathcal{C}}_{k,q}$ and
$1/r=1/p_{1}+\cdots+1/p_{k}$, one has the estimate

$\|\mathcal{A}_{\ast}(f_{1},\ldots,f_{k})\|_{r}\leq
C_{d,m,\Delta}\,\|f_{1}\|_{p_{1}}\cdots\|f_{k}\|_{p_{k}}.$

For a visualization of those $p_{1},\dots,p_{k}$ for which Theorem 5 gives
boundedness for these multilinear maximal operators, see Figure 7 below.

As with Theorem 3, we note that Theorem 5 is of particular interest as
$m\to\infty$ (and hence $d\to\infty$) for fixed $k$, since this corresponds to
$q\to 1$ through values of the form $m/(m-1)$ with $m\in\mathbb{N}$.

$\frac{1}{p_{1}}$$\frac{1}{p_{2}}$$\frac{1}{p_{3}}$$(\frac{d-1}{d},0,0)$$(\frac{m-1}{m}\frac{d-1}{d},\frac{m-1}{m}\frac{d-1}{d},0)$$\vec{x}_{1}$$\vec{x}_{2}$$(\frac{m-1}{m}\frac{d-1}{d},0,\frac{m-1}{m}\frac{d-1}{d})$$(0,0,\frac{d-1}{d})$$\vec{x}_{3}$$(0,\frac{m-1}{m}\frac{d-1}{d},\frac{m-1}{m}\frac{d-1}{d})$$(0,\frac{d-1}{d},0)$
$\vec{x}_{1}=(\frac{m-1}{m}\frac{d-1}{d},(\frac{m-1}{m})^{2}\frac{d-1}{d},(\frac{m-1}{m})^{2}\frac{d-1}{d})$
$\vec{x}_{2}=((\frac{m-1}{m})^{2}\frac{d-1}{d},\frac{m-1}{m}\frac{d-1}{d},(\frac{m-1}{m})^{2}\frac{d-1}{d})$
$\vec{x}_{3}=((\frac{m-1}{m})^{2}\frac{d-1}{d},(\frac{m-1}{m})^{2}\frac{d-1}{d},\frac{m-1}{m}\frac{d-1}{d})$
Figure 7. Region of boundedness we obtain for Trilinear Maximal Operator in
$\mathbb{R}^{d}$, provided $d\geq 3m$.

###  8.1. Proof of Theorem 5

As in the discrete case, the crucial ingredient in our proof of Theorem 5 is
pointwise estimates for $\mathcal{A}_{\ast}(f_{1},\dots f_{k})$ in terms of
the spherical maximal operator applied to appropriate powers of the functions
$|f_{j}|$, specifically

######  Proposition 3.

Let $k,m\geq 2$ be integers and
$\Delta=\\{v_{0}=0,v_{1},\ldots,v_{k}\\}\subseteq\mathbb{R}^{d}$ be a non-
degenerate $k$-simplex with $d\geq km$. Then for any
$f_{1},\ldots,f_{k}:\mathbb{R}^{d}\to\mathbb{R}$, one has

$\mathcal{A}_{\ast}(f_{1},\ldots,f_{k})(x)\leq
C_{d,m,\Delta}\,\mathcal{A}_{\ast}(|f_{1}|^{q},\ldots,|f_{k-1}|^{q})(x)^{1/q}\,\mathcal{A}_{\ast}(|f_{k}|^{q})(x)^{1/q}$

and hence

$\mathcal{A}_{\ast}(f_{1},\ldots,f_{k})(x)\leq
C_{d,m,\Delta}\,\mathcal{A}_{\ast}(|f_{1}|^{q^{k-1}})(x)^{1/q^{k-1}}\mathcal{A}_{\ast}(|f_{2}|^{q^{k-1}})(x)^{1/q^{k-1}}\prod_{j=3}^{k}\mathcal{A}_{\ast}(|f_{j}|^{q^{k+1-j}})(x)^{1/q^{k+1-j}}$

uniformly for $x\in\mathbb{R}^{d}$, where $q=m/(m-1)$.

We will prove Proposition 3 in Section 9 below. As in the discrete case, this
proposition quickly implies Theorem 5, however in this setting we proceed by
induction.

Note that Corollary 1 constitutes the base $k=2$ case of Theorem 5. We are
thus required to first prove Theorem 4. An application of Hölder to the $k=2$
case of Proposition 3 gives

$\|\mathcal{A}_{\ast}(f_{1},f_{2})\|_{r}\leq
C_{d,m,\Delta}\|\mathcal{A}_{\ast}(|f_{1}|^{q})\|_{p_{1}/q}^{1/q}\|\mathcal{A}_{\ast}(|f_{2}|^{q})\|_{p_{2}/q}^{1/q}$

whenever $1/r=1/p_{1}+1/p_{2}$. Now if $p_{1},p_{2}>q\,d/(d-1)$, then by (1)
we obtain

$\|\mathcal{A}_{\ast}(f_{1},f_{2})\|_{r}\leq
C_{d,m,\Delta}\|f_{1}\|_{p_{1}}\|f_{2}\|_{p_{2}}$

with $1/r=1/p_{1}+1/p_{2}<2/q\cdot(d-1)/d$. This establishes Theorem 4.

We now let $k\geq 3$ and assume that Theorem 5 holds for $k-1$. An application
of Hölder, as in the proof of Theorem 3, gives

$\|\mathcal{A}_{\ast}(f_{1},\ldots,f_{k})\|_{r}\leq
C_{d,m,\Delta}\|\mathcal{A}_{\ast}(|f_{1}|^{q^{k-1}})\|_{p_{1}/q^{k-1}}^{1/q^{k-1}}\|\mathcal{A}_{\ast}(|f_{2}|^{q^{k-1}})\|_{p_{2}/q^{k-1}}^{1/q^{k-1}}\prod_{j=3}^{k}\|\mathcal{A}_{\ast}(|f_{j}|^{q^{k+1-j}})\|_{p_{j}/q^{k+1-j}}^{1/q^{k+1-j}}$

whenever $1/r=1/p_{1}+\cdots+1/p_{k}$. Now if

$p_{1},p_{2}>q^{k-1}\frac{d}{d-1}\ \ \ \text{and}\ \ \
p_{j}>q^{k+1-j}\frac{d}{d-1}\ \ \text{for}\ \ 3\leq j\leq k$

then by (1) we obtain

$\|\mathcal{A}_{\ast}(f_{1},\ldots,f_{k})\|_{r}\leq
C_{d,m,\Delta}\|f_{1}\|_{p_{1}}\cdots\|f_{k}\|_{p_{k}}$

with
$1/r=1/p_{1}+\cdots+1/p_{k}<(1/q+1/q^{2}+\cdots+1/q^{k-1}+1/q^{k-1})(d-1)/d$.

Theorem 5 now follows for all
$(1/p_{1},\dots,1/p_{k})\in(d-1)/d\cdot\mathcal{C}_{k,q}$ by symmetry and
interpolation, and for all such reciprocals in
$(d-1)/d\cdot\widetilde{\mathcal{C}}_{k,q}$ by further interpolation with the
estimates one obtains using observation (20) and the inductive hypothesis.∎

##  9\. Proof of Proposition 3

Let $\Delta=\\{v_{0}=0,v_{1},\ldots,v_{k}\\}\subseteq\mathbb{R}^{d}$ be a non-
degenerate $k$-simplex and $T=T_{\Delta}=(t_{ij})_{1\leq i,j\leq k}$ with
entries $t_{ij}:=v_{i}\cdot v_{j}$ denote the associated _inner product
matrix_. Recall that $T$ is a positive semi-definite matrix and that $T$ is
positive definite if and only if $\Delta$ is non-degenerate. In fact one has
that

(21) $\det T=\text{vol}(v_{1},\ldots,v_{k})^{2}$

where $\text{vol}(v_{1},\ldots,v_{k})$ denotes the volume of the
parallelepiped spanned by the vectors $v_{1},\ldots,v_{k}$.

It is easy to see that $\Delta^{\prime}\simeq\lambda\Delta$, with
$\Delta^{\prime}=\\{y_{0}=0,y_{1},\ldots,y_{k}\\}$, if and only if

(22) $y_{i}\cdot y_{j}=\lambda^{2}t_{ij}\quad\text{for all}\quad 1\leq i,j\leq
k.$

Thus the _configuration space_ of the isometric copies of the simplex $\Delta$
is the algebraic set

$S_{\Delta}:=\\{(y_{1},\ldots,y_{k})\in\mathbb{R}^{dk}:\ y_{i}\cdot
y_{j}-t_{ij}=0,\quad\textit{for}\quad 1\leq i,j\leq k\\}.$

Writing $\underline{y}=(y_{1},\ldots,y_{k})$ and
$f_{ij}(\underline{y})=y_{i}\cdot j-t_{ij}$ the set $S_{\Delta}$ is the common
zero set of the family of polynomials $\mathcal{F}=\\{f_{ij}\\}$ and is a
smooth $d-k(k+1)/2$-dimensional sub-manifold of $\mathbb{R}^{dk}$, in
dimensions $d\geq k$. Indeed, for any $\underline{y}=(y_{1},\ldots,y_{k})\in
S_{\Delta}$ the vectors $y_{1},\ldots,y_{k}$ are linearly independent, and
then it is easy to see that the gradient vectors $\nabla
f_{ij}(\underline{y})$ are also linearly independent thus the algebraic set
$S_{\Delta}$ has no singular points.

To any algebraic set $S$, defined as the zero set of a family of polynomials
$\mathcal{F}$, which has a non-singular point one may associate measure
$\omega_{\mathcal{F}}$ supported on $S$, also referred to as the Gelfand-Leray
measure, this is a natural analogue to the counting measure used in the
discrete setting, see Birch [2]. In Section 10 we provide a self-contained
discussion of properties of this measure that are needed for our results.

In particular, for any family of functions
$f_{1},\dots,f_{k}:\mathbb{R}^{d}\to\mathbb{R}$ with $d\geq k+1$ and
$\lambda>0$, our normalized multilinear averages

$\mathcal{A}_{\lambda}(f_{1},\dots,f_{k})(x)=\int_{SO(d)}f_{1}(x+\lambda\cdot
U(v_{1}))\cdots f_{k}(x+\lambda\cdot U(v_{k}))\,d\mu(U)$

satisfy

(23)
$\mathcal{A}_{\lambda}(f_{1},\dots,f_{k})(x)=C_{d,\Delta}\,\int_{y_{1},\ldots,y_{k}}f_{1}(x+\lambda
y_{1})\ldots f_{k}(x+\lambda
y_{k})\,d\omega_{\mathcal{F}}(y_{1},\ldots,y_{k})$

for some absolute constant $C_{d,\Delta}>0$. This crucial observation follows
by writing

$\mathcal{A}_{\lambda}(f_{1},\dots,f_{k})(x)=\int f_{1}(x+\lambda y_{1})\cdots
f_{k}(x+\lambda
y_{k})\,d\sigma^{d-1}(y_{1})\,d\sigma^{d-2}_{y_{1}}(y_{2})\ldots
d\sigma^{d-k}_{y_{1},\ldots,y_{k-1}}(y_{k}),$

with $d\sigma^{d-j}_{y_{1},\ldots,y_{j-1}}(y)$ being the normalized surface
area measure on the sphere $S_{y_{1},\ldots,y_{j-1}}$ given by the equations
$|y-y_{i}|^{2}=t_{ij}$ for $0\leq i<j$, as a special case of (49), see Section
10.

In order to aid the exposition we first prove Proposition 3 in special case
when $k=m=2$ below, delaying the proof of the general case until Section 9.2.

###  9.1. Proof of Proposition 3: Special case when $k=m=2$

Recall that our goal is to show that

(24) $|\mathcal{A}_{\ast}(f_{1},f_{2})(x)|\leq
C_{d,\Delta}\,\mathcal{A}_{\ast}(f_{1}^{2})^{1/2}(x)\mathcal{A}_{\ast}(f_{2}^{2})^{1/2}(x),$

uniformly for $x\in\mathbb{R}^{d}$. Towards this end we first note that

(25) $\int\int f_{1}(x+\lambda y_{1})f_{2}(x+\lambda
y_{2})\,d\omega_{\mathcal{F}}(y_{1},y_{2})=\int\int f_{1}(x+\lambda
y_{1})f_{2}(x+\lambda
y_{2})\,d\omega_{\mathcal{F}_{2,y_{1}}}(y_{2})\,d\omega_{\mathcal{F}_{1}}(y_{1})$

where $\mathcal{F}=\\{f_{11},f_{12},f_{22}\\}$, $\mathcal{F}_{1}=\\{f_{11}\\}$
and $\mathcal{F}_{1,y_{1}}=\\{f_{12},f_{22}\\}$ considered as function of
$y_{2}$ for fixed $y_{1}$.

Indeed, since the function $f_{11}(y_{1},y_{2})=|y_{1}|^{2}-t_{11}$ depends
only on the variable $y_{1}$ and the partition of variables $z=y_{1}$ and
$y=y_{2}$ is admissible, Fubini (48) applies, see Section 10. Furthermore, we
note that $\omega_{\mathcal{F}_{1}}=2^{-1}\,\sigma_{1}$, where $\sigma_{1}$
denotes the surface area measure on the sphere $|y_{1}|^{2}=t_{11}$.

Observation (25) allows one to apply Cauchy-Schwarz in the $y_{1}$ variable,
which in light of (23) yields

(26) $\displaystyle\mathcal{A}_{\lambda}(f_{1},f_{2})(x)^{2}$
$\displaystyle\lesssim_{d,\Delta}\int_{y_{1}}f_{1}^{2}(x+\lambda
y_{1})\,d\sigma_{1}(y_{1})\times\int_{y_{1}}\Bigl{(}\,\int_{y_{2}}f_{2}(x+\lambda
y_{2})\,d\omega_{\mathcal{F}_{2,y_{1}}}(y_{2})\Bigr{)}^{2}\,d\sigma_{1}(y_{1})$
$\displaystyle\lesssim_{d,\Delta}\mathcal{A}_{\ast}(f_{1}^{2})(x)\,\mathcal{B}_{\lambda}(f_{2},f_{2})(x)$

where

(27)
$\mathcal{B}_{\lambda}(f_{2},f_{2})(x)=\int_{y_{2},y_{2}^{\prime}}f_{2}(x+\lambda
y_{2})f_{2}(x+\lambda y_{2}^{\prime})\
w(y_{2},y_{2}^{\prime})\,d\sigma_{2}(y_{2})\,d\sigma_{2}(y_{2}^{\prime})$

with $\sigma_{2}$ denoting the surface area measure on the sphere
$\\{y\in\mathbb{R}^{d}\,:\,|y|^{2}=t_{22}\\}$ and weight function

(28)
$w(y_{2},y_{2}^{\prime})=\int_{y_{1}}\,d\omega_{\mathcal{F}_{y_{2},y_{2}^{\prime}}}(y_{1})$

where $\omega_{\mathcal{F}_{y_{2},y_{2}^{\prime}}}$ is the Gelfand-Leray
measure defined by the system
$\mathcal{F}_{y_{2},y_{2}^{\prime}}=\\{f_{11}(y_{1}),f_{12}(y_{1},y_{2}),f_{12}(y_{1},y_{2}^{\prime})\\}$.
These facts, specifically the form of (28), follows since the partition of
variables $z=(y_{2},y_{2}^{\prime})$ and $y=y_{1}$ is admissible for the
system

$\mathcal{F}^{\prime}=\\{f_{11}(y_{1}),f_{12}(y_{1},y_{2}),f_{12}(y_{1},y_{2}^{\prime}),f_{22}(y_{2}),f_{22}(y_{2}^{\prime})\\}.$

Applying Cauchy-Schwarz once more, we obtain

(29) $\displaystyle\mathcal{B}_{\lambda}(f_{2},f_{2})^{2}(x)$
$\displaystyle\leq\Bigl{(}\int_{y_{2}}f_{2}^{2}(x+\lambda
y_{2})\,d\sigma_{2}(y_{2})\Bigr{)}^{2}\,\Bigl{(}\int_{y_{2},y_{2}^{\prime}}w(y_{2},y_{2}^{\prime})^{2}\,d\sigma_{2}(y_{2})\,d\sigma_{2}(y_{2}^{\prime})\Bigr{)}$
$\displaystyle\leq\,\mathcal{A}_{\ast}(f_{2}^{2})(x)^{2}\
\int_{y_{2},y_{2}^{\prime}}w(y_{2},y_{2}^{\prime})^{2}\,d\sigma_{2}(y_{2})\,d\sigma_{2}(y_{2}^{\prime}).$

Thus by (26) and (29), to prove inequality (24) it is enough to show that

(30)
$\int_{y_{2},y_{2}^{\prime}}w(y_{2},y_{2}^{\prime})^{2}\,d\sigma_{2}(y_{2})\,d\sigma_{2}(y_{2}^{\prime})<\,\infty.$

The set $S_{\mathcal{F}_{y_{2},y_{2}^{\prime}}}$ is the intersection of three
spheres, whose surface are measure is either zero or $c_{d}r^{d-3}$, with
$\,r:=\text{dist}(y_{1},\text{span}\\{y_{2},y_{2}^{\prime}\\})$ being its
radius, for any $y_{1}\in S_{\mathcal{F}_{y_{2},y_{2}^{\prime}}}$. Note that

$r=\text{vol}(y_{1},y_{1}-y_{2},y_{1}-y_{2}^{\prime})/\text{vol}(y_{2},y_{2}^{\prime}),$

thus by (21), (28) and (49) we have that

(31)
$w(y_{2},y_{2}^{\prime})=c_{d}\,\text{vol}(y_{1},y_{1}-y_{2},y_{1}-y_{2}^{\prime})^{d-4}\,\text{vol}(y_{2},y_{2}^{\prime})^{-d+3}\leq
c_{d,T}\,\text{vol}(y_{2},y_{2}^{\prime})^{-1}.$

To show (30), note that for given $y_{2}\in
S_{2}:=\\{y\in\mathbb{R}^{d}:|y|^{2}=t_{22}\\}$ and $j\in\mathbb{N}$ we have
that

$\sigma_{2}(\\{y_{2}^{\prime}\in S_{2}:\
2^{-j}\leq\text{vol}(y_{2},y_{2}^{\prime})<2^{-j+1}\\})\leq
c_{d,T}\,2^{-(d-1)j}.$

Thus, in dimensions $d\geq 4$, we have

$\int_{y_{2},y_{2}^{\prime}}w(y_{2},y_{2}^{\prime})^{2}\,d\sigma(y_{2})\,d\sigma(y_{2}^{\prime})\leq
c_{d,T}\,\sum_{j\geq 0}2^{2j}\,2^{-(d-1)j}<\infty.\qed$

###  9.2. Proof of Proposition 3: General case

We will now show that inequality (24) can be improved in high dimensions,
specifically when $d\geq 2m$, by replacing the Cauchy-Schwarz inequality by
Hölder’s inequality applied with conjugate exponents $q=m/(m-1)$ and $m$ for
any positive integer $m>2$. This results in increasing the variable $y_{2}$
$m$-fold as opposed to being doubled in the proof of the special case when
$k=2$ and $m=2$ presented above. We will simultaneously also generalize this
result to $k$-simplices.

Let $k,m\geq 2$ be integers and
$\Delta=\\{v_{0}=0,v_{1},\ldots,v_{k}\\}\subseteq\mathbb{R}^{d}$ be a non-
degenerate $k$-simplex. Recall that our goal is to show that for any
$f_{1},\ldots,f_{k}:\mathbb{R}^{d}\to\mathbb{R}$, one has

(32) $\mathcal{A}_{\ast}(f_{1},\ldots,f_{k})(x)\leq
C_{d,m,\Delta}\,\mathcal{A}_{\ast}(|f_{1}|^{q},\ldots,|f_{k-1}|^{q})(x)^{1/q}\,\mathcal{A}_{\ast}(|f_{k}|^{q})(x)^{1/q}$

uniformly for $x\in\mathbb{R}^{d}$, where $q=m/(m-1)$.

Let $T=T_{\Delta}$ denote the inner product matrix of the simplex
$\Delta=\\{v_{0}=0,v_{1},\ldots.v_{k}\\}$. Consider the partition of variables
$\underline{y}=(\underline{y}_{1},y_{k})$ with
$\underline{y}_{1}=(y_{1},\ldots,y_{k-1})$ which is admissible for the system

$\mathcal{F}=\\{f_{ij}(\underline{y}):\ 1\leq i\leq j\leq k\\}$

with $f_{ij}(\underline{y})=y_{i}\cdot y_{j}-t_{ij}.$ Indeed, the gradients of
the family of functions $\mathcal{F}_{1}=\\{f_{ij}(\underline{y}_{1}),\ 1\leq
i\leq j\leq k-1\\}$ are linearly independent at any point
$\underline{y}_{1}\in S_{\mathcal{F}_{1}}$, moreover the gradients
$\nabla_{y_{k}}f_{ik,\underline{y}_{1}}$ of the system

$\mathcal{F}_{\underline{y}_{1}}=\\{f_{ik,\underline{y}_{1}}(y_{k})=y_{i}\cdot
y_{k}-t_{ik},\ 1\leq i\leq k\\}$

are also linearly independent at any point $\underline{y}\in S_{\mathcal{F}}$.
Thus one may proceed in light of (23), using Hölder’s inequality in the
$\underline{y}_{1}$ variable, to obtain

(33) $\displaystyle\mathcal{A}_{\lambda}(f_{1},\ldots,f_{k})(x)$
$\displaystyle\lesssim_{d,\Delta}\Bigl{(}\int_{\underline{y}_{1}}\bigl{|}f_{1}(x+\lambda
y_{1})\cdots f_{k-1}(x+\lambda
y_{k-1})\bigr{|}^{q}\,d\omega_{\mathcal{F}_{1}}(\underline{y}_{1})\Bigr{)}^{1/q}$
$\displaystyle\quad\quad\quad\quad\quad\quad\quad\quad\quad\quad\quad\quad\times\Bigl{(}\int_{\underline{y}_{1}}\Bigl{(}\int_{y_{k}}|f_{k}(x+\lambda
y_{k})|\,d\omega_{\mathcal{F}_{\underline{y}_{1}}}(y_{k})\Bigr{)}^{m}\,d\omega_{\mathcal{F}_{1}}(\underline{y}_{1})\Bigr{)}^{1/m}$
$\displaystyle\lesssim_{d,\Delta}\mathcal{A}_{\ast}(|f_{1}|^{q},\ldots,|f_{k-1}|^{q})(x)^{1/q}\,\mathcal{B}_{\lambda}(|f_{k}|,\dots,|f_{k}|)(x)^{1/m}$

where

(34) $\displaystyle\mathcal{B}_{\lambda}(|f_{k}|,\ldots,|f_{k}|)(x)$
$\displaystyle=\int_{\underline{y}_{1}}\int_{z_{1},\ldots,z_{m}}|f_{k}(x+\lambda
z_{1})|\cdots|f_{k}(x+\lambda
z_{m})|\,d\omega_{\mathcal{F}_{\underline{y}_{1}}}(z_{1})\cdots\,d\omega_{\mathcal{F}_{\underline{y}_{1}}}(z_{m})\,d\omega_{\mathcal{F}_{1}}(\underline{y}_{1})$
$\displaystyle=\int_{z_{1},\ldots,z_{m}}|f_{k}(x+\lambda
z_{1})|\cdots|f_{k}(x+\lambda z_{m})|\ w(z_{1},\ldots,z_{m})\
d\sigma_{k}(z_{1})\,\cdots\,d\sigma_{k}(z_{m})$

with $\sigma_{k}$ denoting the surface area measure on the sphere
$\\{z\in\mathbb{R}^{d}:\ |z|^{2}=t_{kk}\\}$. In this more general setting the
weight function now takes the form

(35)
$w(z_{1},\ldots,z_{m})=\int_{\underline{y}_{1}}\,d\omega_{\mathcal{F}_{z_{1},\ldots,z_{m}}}(\underline{y}_{1})$

where $\omega_{\mathcal{F}_{\underline{z}}}$, with
$\underline{z}=(z_{1},\ldots,z_{m})$, is the Gelfand-Leray measure defined by
the system

(36)
$\mathcal{F}_{\underline{z}}=\\{f_{ij,\underline{z}}(\underline{y}_{1})=y_{i}\cdot
y_{j}-t_{ij},\ 1\leq i\leq j\leq k-1,\
h_{il,\underline{z}}(\underline{y}_{1})=y_{i}\cdot z_{l}-t_{ik},\ 1\leq i\leq
k-1,\,1\leq l\leq m\\}.$

This can be justified by showing that both integrals in (34) are equal to the
integral

(37) $\int|f_{k}(x+\lambda z_{1})|\cdots|f_{k}(x+\lambda
z_{m})|\,d\omega_{\widetilde{\mathcal{F}}}(\underline{y}_{1},\underline{z}),$

with $\omega_{\widetilde{\mathcal{F}}}$ being the Gelfand-Leray measure of the
system

(38) $\widetilde{\mathcal{F}}=\\{f_{ij}(\underline{y}_{1})=y_{i}\cdot
y_{j}-t_{ij},\ h_{il}(\underline{y}_{1},\underline{z})=y_{i}\cdot
z_{l}-t_{ik},\ g_{l}(\underline{z})=z_{l}\cdot z_{l}-t_{kk}\\}.$

To verify this, we show that both partition of the variables
$(\underline{y}_{1},\underline{z})$ and $(\underline{z},\underline{y}_{1})$
are admissible for the system (38). Given $\underline{y}_{1}\in
S_{\mathcal{F}_{1}}$, the vectors $z_{1},\ldots,z_{m}$ have to be on the same
$(d-k)$-dimensional sphere, which is the intersection of the
$(d-k+1)$-dimensional affine subspace $M=\\{z:\ z\cdot y_{i}=t_{ik},\,1\leq
i<k\\}$ and the sphere $S^{d-1}=\\{z:\ |z|^{2}=t_{kk}\\}$. If $d\geq k+m$ then
one may choose $z_{1},\ldots,z_{m}$ so that the vectors
$y_{1},\ldots,y_{k-1},z_{1},\ldots,z_{m}$ are linearly independent. Then the
gradient vectors $\nabla_{z}g_{l}(\underline{z})=2z_{l}$ , as well as for
given $1\leq i<k$ the gradient vectors
$\nabla_{y_{i}}f_{ij}(\underline{y}^{\prime})=y_{j}$ and
$\nabla_{y_{i}}h_{il}(\underline{y}^{\prime})=z_{l}$, are clearly linearly
independent, showing that the partition of coordinates $(u,z)$ is admissible,
see Section 10. By a similar argument, which we omit, one shows that the
partition of coordinates $(\underline{z},\underline{y}_{1})$ is admissible at
any point of $S_{\widetilde{\mathcal{F}}}$ where each vector $z_{i}$ is
linearly independent of the vectors $y_{1},\ldots,y_{k-1}$.

Note that by removing an algebraic set of measure zero the integrals in (34)
and (37) may be defined over points $(\underline{y}_{1},\underline{z})\in
S_{\widetilde{\mathcal{F}}}$ such that the vectors
$y_{1},\ldots,y_{k-1},z_{1},\ldots,z_{m}$ are linearly independent. Thus in
particular the second integral in (34) is restricted to linearly independent
$m$-tuples $\underline{z}=(z_{1},\ldots,z_{m})$.

Applying Hölder’s inequality once more, we obtain

$\mathcal{B}_{\lambda}(|f_{k}|,\ldots,|f_{k}|)(x)\leq\mathcal{A}_{\ast}(|f_{k}|^{q})(x)^{m/q}\
\left(\int_{z_{1},\ldots,z_{m}}w(z_{1},\ldots,z_{m})^{m}\,d\sigma_{k}(z_{1})\cdots
d\sigma_{k}(z_{m})\right)^{1/m}$

and hence (32) will follow if we can show that

(39)
$\int_{z_{1},\ldots,z_{m}}w(z_{1},\ldots,z_{m})^{m}\,d\sigma_{k}(z_{1})\cdots
d\sigma_{k}(z_{m})<\,\infty.$

Estimate (39) follows immediately from the following two lemmas.

######  Lemma 1.

Let $k\geq 2,\,m\geq 2,\,d\geq m+k$ and let
$z_{1},\ldots,z_{m}\in\mathbb{R}^{d}$ be linearly independent vectors such
that the algebraic set $S_{\mathcal{F}_{\underline{z}}}$ has a non-singular
point. Then one has

(40) $w(z_{1},\ldots,z_{m})\leq
C_{d,m,T}\,\text{\em{vol}}(z_{1},\ldots,z_{m})^{-k+1}.$

######  Lemma 2.

Let $s\geq 1,m\geq 1$ and $d\geq m+s$. Then one has

(41) $\int\text{\em{vol}}(z_{1},\ldots,z_{m})^{-s}\,d\sigma_{k}(z_{1})\ldots
d\sigma_{k}(z_{m})<\infty$

where the integration is taken over linearly independent $m$-tuples
$\underline{z}=(z_{1},\ldots,z_{m})$.

Indeed (39) follows immediately from (40) by taking $s=m(k-1)$ in (41). ∎

###### Proof of Lemma 2.

For $m=1$ this is immediate. For $m\geq 2$, given $z_{1},\ldots,z_{m-1}$, note
that

$\sigma(\\{z_{m}\in S^{d-1}:\
2^{-j}\leq\text{dist}(z_{m},\text{span}(z_{1},\ldots,z_{m-1})<2^{-j+1}\\})\leq
C_{d,m}\,2^{-(d-m+1)j}.$

Thus

$\displaystyle\int\text{vol}(z_{1},\ldots,z_{m})^{-s}$ $\displaystyle
d\sigma_{k}(z_{1})\cdots d\sigma_{k}(z_{m})$ $\displaystyle\leq
C_{d,m}\,\sum_{j\geq
0}2^{-(d-m-s+1)j}\,\int\text{vol}(z_{1},\ldots,z_{m-1})^{-s}\,d\sigma_{k}(z_{1})\cdots
d\sigma_{k}(z_{m-1}).$

Estimate (41) follows by induction on $m$. ∎

###### Proof of Lemma 1.

Recall that integration in (35) is restricted to non-singular points
$\underline{y}_{1}=(y_{1},\ldots,y_{k-1})\in
S_{\mathcal{F}_{\underline{z}}}=\\{\mathcal{F}_{\underline{z}}=0\\}$ such that
the vectors $z_{1},\ldots,z_{m},y_{1},\ldots,y_{k-1}$ are linearly
independent. For given $1\leq i<k$, let

$r_{i}(\underline{y}_{1}):=\text{dist}(y_{i},\,\text{span}(z_{1},\ldots,z_{m},y_{1},\ldots,y_{i-1}))$

denote the distance from the point $y_{i}$ to the subspace spanned by the
vectors $y_{1},\ldots,y_{i-1},z_{1},\ldots,z_{m}$. Note that
$r_{i}(\underline{y}_{1})>0$, in fact

(42)
$r_{i}(\underline{y}_{1})=\text{vol}(y_{i},y_{i-1},\ldots,y_{1},z_{1},\ldots,z_{m})/\text{vol}(y_{i-1},\ldots,y_{1},z_{1},\ldots,z_{m}).$

First we show by induction on $k$ that

(43)
$d\omega_{\mathcal{F}_{\underline{z}}}(\underline{y}_{1})=c_{d,m,T}\,\prod_{i=1}^{k-1}r_{i}(\underline{y}_{1})^{d-m-k}\,\text{vol}(z_{1},\ldots,z_{m})^{-k+1}\,d\sigma^{d-m-1}(y_{1})\,d\sigma^{d-m-2}(y_{2})\cdots
d\sigma^{d-m-k}(y_{k-1})$

where $d\sigma^{j}$ denoting the normalized surface area measure on the
$j$-dimensional unit sphere in $\mathbb{R}^{d}$.

Note that in order to verify identity (43) when $k=2$ we must show that

$d\omega_{\mathcal{F}_{\underline{z}}}(y_{1})=c_{d,m,T}\
r_{1}(y_{1})^{d-m-2}\,\text{vol}(z_{1},\ldots,z_{m})^{-1}\
d\sigma^{d-m-1}(y_{1}).$

The algebraic set $S_{\mathcal{F}_{\underline{z}}}$ is the intersection of
$m+1$ spheres centered at the points $0,z_{1},\ldots,z_{m}$ and hence is a
$(d-m-1)$-dimensional sphere of radius $r_{1}(y_{1})$ given by (42). By (50)
we have that

$d\omega_{\mathcal{F}_{\underline{z}}}(y_{1})=c_{d,m,T}\,\text{vol}(y_{1},y_{1}-z_{1},\ldots,y_{1}-z_{m})^{-1}r_{1}(y)^{d-m-1}\
d\sigma^{d-m-1}(y_{1})$

and (43) follows from (42) and the fact that
$\text{vol}(y_{1},y_{1}-z_{1},\ldots,y_{1}-z_{m})=\text{vol}(y_{1},z_{1},\ldots,z_{m})$.

For the induction step, suppose (43) holds for $k$ and let
$\underline{y}=(y_{1},\ldots,y_{k})\in S_{\mathcal{F}_{\underline{z}}}$ be
point such that the vectors $y_{1},\ldots,y_{k},z_{1},\ldots,z_{m}$ are
linearly independent. Then the partition of variables
$\underline{y}=(\underline{y}_{1},y_{k})$ with
$\underline{y}_{1}=(y_{1},\ldots,y_{k-1})$ is admissible, thus one has

$d\omega_{\mathcal{F}_{\underline{z}}}(\underline{y})=\,d\omega_{\mathcal{F}_{\underline{z}}}(\underline{y}_{1})\,d\omega_{\mathcal{F}_{\underline{z},\underline{y}_{1}}}(y_{k}).$

The set $S_{\mathcal{F}_{\underline{z},\underline{y}_{1}}}$ is a
$(d-m-k)$-dimensional sphere with radius $r_{k}(\underline{y})$ given by (42),
thus by (50) one has

$d\omega_{\mathcal{F}_{\underline{z},\underline{y}_{1}}}(y_{k})=c_{d,m,T}\,\text{vol}(y_{k},y_{k-1},\ldots,y_{1},z_{1},\ldots,z_{m})^{-1}\,r_{k}(\underline{y})^{d-m-k}\,d\sigma^{d-m-k}(y_{k}).$

By repeated applications of (11) one has

$\text{vol}(y_{k},y_{k-1},\ldots,y_{1},z_{1},\ldots,z_{m})=\text{vol}(z_{1},\ldots,z_{m})\
\prod_{i=1}^{k}r_{i}(\underline{y}).$

Thus by the induction hypotheses we have that

$d\omega_{\mathcal{F}_{\underline{z}}}(\underline{y})=c_{d,m,T}\
\prod_{i=1}^{k-1}r_{i}(\underline{y}_{1})^{d-m-k-1}\,r_{k}(\underline{y})^{d-m-k-1}\text{vol}(z_{1},\ldots,z_{m})^{-k}\
d\sigma^{d-m-1}(y_{1})\cdots d\sigma^{d-m-k}(y_{k}).$

which is (43) for $\underline{y}=(y_{1},\ldots,y_{k})$. Inequality (40)
follows immediately in dimensions $d\geq m+k$ as
$r_{i}(\underline{y}_{1})\leq|y_{i}|\leq C_{T}$ for all $1\leq i<k$. ∎

##  10\. Measures on real algebraic sets

Let $\mathcal{F}=\\{f_{1},\ldots,f_{n}\\}$ be a family of polynomials
$f_{i}:\mathbb{R}^{d}\to\mathbb{R}$. We will describe certain measures
supported on the algebraic set

(44) $S_{\mathcal{F}}:=\\{x\in\mathbb{R}^{d}:\ f_{1}(x)=\ldots=f_{n}(x)=0\\}.$

A point $x\in S_{\mathcal{F}}$ is called _non-singular_ if the gradient
vectors $\nabla f_{1}(x),\ldots,\nabla f_{n}(x)$ are linearly independent, and
let $S_{\mathcal{F}}^{0}$ denote the set of non-singular points. It is well-
known and is easy to see, that if $S_{\mathcal{F}}^{0}\neq\emptyset$ then it
is a relative open, dense subset of $S_{\mathcal{F}}$, and moreover it is an
$d-n$-dimensional sub-manifold of $\mathbb{R}^{d}$. If $x\in
S_{\mathcal{F}}^{0}$ then there exists a set of coordinates,
$J=\\{j_{1},\ldots,j_{n}\\}$, with $1\leq j_{1}<\ldots<j_{n}\leq d$, such that

(45) $j_{\mathcal{F},J}(x):=\det\,\left(\frac{\partial f_{i}}{\partial
x_{j}}(x)\right)_{1\leq i\leq n,j\in J}\ \neq 0.$

Accordingly, we will call a set of coordinates $J$ _admissible_ , if (45)
holds for at least one point $x\in S_{\mathcal{F}}^{0}$, and will denote by
$S_{\mathcal{F},J}$ the set of such points. For a given set of coordinates
$x_{J}$ let $\nabla_{x_{J}}f(x):=(\partial_{x_{j}}f(x))_{j\in J}$, and note
that $J$ is admissible if and only if the gradient vectors
$\nabla_{x_{J}}f_{1}(x),\ldots,\nabla_{x_{J}}f_{n}(x)$, are linearly
independent at at least one point $x\in S_{\mathcal{F}}$. It is clear that
$S_{\mathcal{F},J}$ is a relative open and dense subset of $S_{\mathcal{F}}$
and is a also $(d-n)$-dimensional sub-manifold, moreover

$S_{\mathcal{F}}^{0}=\bigcup_{J\,\text{admissible}}S_{\mathcal{F},J}.$

We define a measure, near a point $x_{0}\in S_{\mathcal{F},J}$ as follows. For
simplicity of notation assume that $J=\\{1,\ldots,n\\}$ and let
$\Phi(x):=(f_{1},\ldots,f_{n},x_{n+1},\ldots,x_{d})$. Then $\Phi:U\to V$ is a
diffeomorphism on some open set $x_{0}\in U\subseteq\mathbb{R}^{d}$ to its
image $V=\Phi(U)$, moreover
$S_{\mathcal{F}}=\Phi^{-1}(V\cap\mathbb{R}^{d-n})$. Indeed, $x\in
S_{\mathcal{F}}\cap U$ if and only if
$\Phi(x)=(0,\dots,0,x_{n+1},\ldots,x_{d})\in V$. Let $I=\\{n+1,\ldots,d\\}$
and write $x_{I}:=(x_{n+1},\ldots,x_{d})$. Let
$\Psi(x_{I})=\Phi^{-1}(0,x_{I})$ and in local coordinates $x_{I}$ define the
measure $\omega_{\mathcal{F}}$ via

(46) $\int g\,d\omega_{\mathcal{F}}:=\int g(\Psi(x_{I}))\
|Jac^{-1}_{\Phi}(\Psi(x_{I}))|\,dx_{I}$

for a continuous function $g$ supported on $U$. Note that
$Jac_{\Phi}(x)=j_{\mathcal{F},J}(x)$, i.e. the Jacobian of the mapping $\Phi$
at $x\in U$ is equal to the expression given in (45), and that the measure
$d\omega_{\mathcal{F}}$ is supported on $S_{\mathcal{F}}$. It is not hard to
show that this measure is independent of the choice local coordinates $x_{I}$
and then $\omega_{\mathcal{F}}$ is defined on $S_{\mathcal{F}}^{0}$ as the set
$S_{\mathcal{F}}^{0}\backslash S_{\mathcal{F},J}$ is of measure zero with
respect to $\omega_{F}$, being a proper analytic subset on $\mathbb{R}^{d-n}$
in any other admissible local coordinates.

A more geometric description of the measure $d\omega_{\mathcal{F}}$ can be
given as follows. Let $x_{0}\in S_{\mathcal{F}}^{0}$, and choose an
orthonormal basis $e_{1},\ldots,e_{d}$ of $\mathbb{R}^{d}$ such that
$\text{span}\\{e_{1},\ldots,e_{n}\\}=\text{span}\\{\nabla
f_{1}(x_{0}),\ldots,\nabla f_{n}(x_{0})\\}$ and
$T_{x_{0}}S_{\mathcal{F}}=\text{span}\\{e_{n+1},\ldots,e_{d}\\}$. This
possible as $\nabla f_{i}(x_{0})$ is orthogonal to the tangent space of
$S_{\mathcal{F}}$ at $x_{0}$. Let $x_{1},\ldots,x_{d}$ be the system of
coordinates associated to the basis. Then the tangent of the mapping $\Phi(x)$
at $x_{0}$ is a block diagonal matrix and its Jacobian $Jac_{\Phi}(x_{0})$ is
the determinant of the $n\times n$ matrix whose rows are the gradient vectors
$\nabla f_{i}(x_{0})$. Its magnitude further equals to the volume of the
parallelepiped spanned by these vectors. On the other hand, the surface area
measure $d\sigma_{S_{\mathcal{F}}}$ is equal to $dx_{n+1}\ldots dx_{d}$ at
$x_{0}$ in this coordinate system, thus we have

(47) $d\omega_{\mathcal{F}}(x_{0})=\text{vol}(\nabla
f_{1}(x_{0}),\ldots,\nabla
f_{i}(x_{0}))^{-1}\,d\sigma_{S_{\mathcal{F}}}(x_{0}).$

This provides a coordinate free description of the Gelfand-Leray measure and
shows that it is supported on $S_{\mathcal{F}}^{0}$ and is absolute continuous
with respect to the surface area measure with density $\text{vol}(\nabla
f_{1}(x_{0}),\ldots,\nabla f_{i}(x_{0}))^{-1}$.

Let $x=(z,y)$ be a partition of coordinates in $\mathbb{R}^{d}$, with
$y=x_{J_{2}}$, $z=X_{J_{1}}$, and assume that for $i=1,\ldots,m$ the functions
$f_{i}$ depend only on the $z$-variables. We say that the partition of
coordinates is _admissible_ , if there is a point $x=(z,y)\in S_{\mathcal{F}}$
such that both the gradient vectors
$\nabla_{z}f_{1}(x),\ldots,\nabla_{z}f_{m}(x)$ and the vectors
$\nabla_{y}f_{m+1}(x),\ldots,\nabla_{y}f_{n}(x)$ for a linearly independent
system. Partition the system $\mathcal{F}=\mathcal{F}_{1}\cup\mathcal{F}_{2}$
with $\mathcal{F}_{1}=\\{f_{1},\ldots,f_{m}\\}$ and
$\mathcal{F}_{2}=\\{f_{m+1},\ldots,f_{n}\\}$. Then there is set
$J_{1}^{\prime}\subseteq J_{1}$ for which

$j_{\mathcal{F}_{1},J_{1}^{\prime}}(z):=\det\left(\frac{\partial
f_{i}}{\partial x_{j}}(z)\right)_{1\leq i\leq m,\,j\in J_{1}^{\prime}}\neq 0,$

and also a set $J_{2}^{\prime}\subseteq J_{2}$ such that

$j_{\mathcal{F}_{2},J_{2}^{\prime}}(z,y):=\det\left(\frac{\partial
f_{i}}{\partial x_{j}}(z,y)\right)_{m+1\leq i\leq n,\,j\in J_{2}^{\prime}}\neq
0.$

Since $\nabla_{y}f_{i}\equiv 0$ for $1\leq i\leq m$, it follows that the set
of coordinates $J^{\prime}=J_{1}^{\prime}\cup J_{2}^{\prime}$ is admissible,
moreover

$j_{\mathcal{F},J^{\prime}}(y,z)=j_{\mathcal{F}_{1},J_{1}^{\prime}}(z)\,j_{\mathcal{F}_{2},J_{2}^{\prime}}(y,z).$

For fixed $z$, let $f_{i,z}(y):=f_{i}(z,y)$ and let
$\mathcal{F}_{2,z}=\\{f_{m+1,z},\ldots,f_{n,z}\\}$. Then clearly
$j_{\mathcal{F}_{2},J_{2}^{\prime}}(y,z)=j_{\mathcal{F}_{2,z},J_{2}^{\prime}}(y)$
as it only involves partial derivatives with respect to the $y$-variables.
Thus we have an analogue of Fubini’s theorem, namely

(48) $\int g(x)\,d\omega_{\mathcal{F}}(x)\,=\,\int\int
g(z,y)\,d\omega_{\mathcal{F}_{2,z}}(y)\,d\omega_{\mathcal{F}_{1}}(z).$

Consider now algebraic sets given as the intersection of spheres. Let
$x_{1},\ldots,x_{m}\in\mathbb{R}^{d}$, $t_{1},\ldots,t_{m}>0$ and
$\mathcal{F}=\\{f_{1},\ldots,f_{m}\\}$ where $f_{i}(x)=|x-x_{i}|^{2}-t_{i}$
for $i=1,\ldots,m$. Then $S_{\mathcal{F}}$ is the intersection of spheres
centered at the points $x_{i}$ of radius $r_{i}=t_{i}^{1/2}$. If the set of
points $X=\\{x_{1},\ldots,x_{m}\\}$ is in general position (i.e they span an
$m-1$-dimensional affine subspace), then a point $x\in S_{\mathcal{F}}$ is
non-singular if $x\notin\text{span}\\{X\\}$, i.e if $x$ cannot be written as
linear combination of $x_{1},\ldots,x_{m}$. Indeed, since $\nabla
f_{i}(x)=2(x-x_{i})$ we have that

$\sum_{i=1}^{m}a_{i}\nabla f_{i}(x)=0\ \Longleftrightarrow\
\sum_{i=1}^{m}a_{i}\,x=\sum_{i=1}^{m}a_{i}x_{i},$

which implies $\sum_{i=1}^{m}a_{i}=0$ and $\sum_{i=1}^{m}a_{i}x_{i}=0$. By
replacing the equations $|x-x_{i}|^{2}=t_{i}$ with
$|x-x_{1}|^{2}-|x-x_{i}|^{2}=t_{1}-t_{i}$, which is of the form
$x\cdot(x_{1}-x_{i})=c_{i}$, for $i=2,\ldots,m$, it follows that
$S_{\mathcal{F}}$ is the intersection of sphere with an $n-1$-codimensional
affine subspace $Y$, perpendicular to the affine subspace spanned by the
points $x_{i}$. Thus $S_{\mathcal{F}}$ is an $m$-codimensional sphere of
$\mathbb{R}^{d}$ if $S_{\mathcal{F}}$ has one point
$x\notin\text{span}\\{x_{1},\ldots,x_{m}\\}$ and all of its points are non-
singular. Let $x^{\prime}$ be the orthogonal projection of $x$ to
$\text{span}\\{X\\}$. If $y\in Y$ is a point with
$|y-x^{\prime}|=|x-x^{\prime}|$ then by the Pythagorean theorem we have that
$|y-x_{i}|=|x-x_{i}|$ and hence $y\in S_{\mathcal{F}}$. It follows that
$S_{\mathcal{F}}$ is a sphere centered at $x^{\prime}$ and contained in $Y$.

Let $T=T_{X}$ be the inner product matrix with entries
$t_{ij}:=(x-x_{i})\cdot(x-x_{j})$ for $x\in S_{\mathcal{F}}$. Since
$(x-x_{i})\cdot(x-x_{j})=1/2(t_{i}+t_{j}-|x_{i}-x_{j}|^{2})$ the matrix $T$ is
independent of $x$. We will show that
$d\omega_{\mathcal{F}}=c_{T}\,d\sigma_{S_{\mathcal{F}}}$ where
$d\sigma_{S_{\mathcal{F}}}$ denotes the surface area measure on the sphere
$S_{\mathcal{F}}$ and $c_{T}=2^{-m}\det(T)^{-1/2}>0$, i.e for a function $g\in
C_{0}(\mathbb{R}^{d})$,

(49)
$\int_{S_{\mathcal{F}}}g(x)\,d\omega_{\mathcal{F}}(x)=c_{T}\int_{S_{\mathcal{F}}}g(x)\,d\sigma_{S_{\mathcal{F}}}(x).$

Indeed by (47),

(50)
$\int_{S_{\mathcal{F}}}g(x)\,d\omega_{\mathcal{F}}(x)=2^{-m}\,\text{vol}(x-x_{1},\ldots,x-x_{m})^{-1}\,\int_{S_{\mathcal{F}}}g(x)\,d\sigma_{S_{\mathcal{F}}}(x),$

and it is a well-known fact from linear algebra that

$\text{vol}(x-x_{1},\ldots,x-x_{m})^{2}=\det(T).$

## References

  * [1] T. C. Anderson, A. V. Kumchev, and E. A. Palsson, Discrete maximal operators over surfaces of higher codimension, arXiv:2006.09968
  * [2] B. Birch, Forms in many variables, Proc. Royal Soc. London. Ser. A. 265.1321 (1962): 245-263.
  * [3] J. Bourgain, Averages over convex curves and maximal operators, J. Analyse Math. 47 (1986), 69-85.
  * [4] J. Bourgain, On the maximal ergodic theorem for certain subsets of the integers, Israel J. Math. 61 (1988), no. 1, 39-72.
  * [5] J. Bourgain, On the pointwise ergodic theorem on $L^{p}$ for arithmetic sets, Israel J. Math. 61 (1988), 73-84.
  * [6] J. Bourgain, Eigenfunction bounds for the Laplacian on the $n$-torus, Internat. Math. Res. Notices (1993), no. 3, 61-66.
  * [7] L. Huckaba, N. Lyall and Á. Magyar, Simplices and sets of positive upper density in $\mathbb{R}^{d}$, Proc. Amer. Math. Soc. 145 (2017), no. 6, 2335-2347
  * [8] Y.Kitaoka, Siegel modular forms and representation by quadratic forms Lectures on Mathe- matics and Physics, Tata Institute of Fundamental Research, Springer-Verlag, (1986).
  * [9] Á. Magyar, k-point configurations in sets of positive density of $\mathbb{Z}^{n}$, Duke Math. J., v 146/1, (2009) pp. 1-34.
  * [10] Á. Magyar, E. M. Stein, and S. Wainger, Discrete analogues in harmonic analysis: Spherical averages, Ann. Math. (2) 155 (2002), no. 1, 189-208.
  * [11] E. A. Palsson, S. R. Sovine, The triangle operator, (2019), arXiv:1910.01282.
  * [12] S. Raghavan, Modular forms of degree n and representation by quadratic forms, Ann. Math. (2) 70 (1959), no. 3, 446-477.
  * [13] C. L. Siegel, On the theory of indefinite quadratic forms, Ann. of Math. (2) 45 (1944), 577-622.
  * [14] E. M. Stein, Maximal functions I: Spherical means, Proc. Nat. Acad. Sci. 73 (1976), 2174-2175.
  * [15] R. C. Vaughan, The Hardy-Littlewood Method, Second ed., Cambridge University Press, Cambridge, 1997\.


# Seeing Is Believing: Black-Box Membership Inference Attacks Against
Retrieval Augmented Generation

Yuying Li  Key Laboratory of Intelligent Sensing System and Security (Ministry
of Education)
School of Artificial Intelligence, Hubei University, Wuhan, China  Gaoyang Liu
Huazhong University of Science and Technology, Wuhan, China
<EMAIL_ADDRESS><EMAIL_ADDRESS>{husterlgy,
<EMAIL_ADDRESS>Yang Yang  Key Laboratory of Intelligent Sensing System
and Security (Ministry of Education)
School of Artificial Intelligence, Hubei University, Wuhan, China  Chen Wang
Huazhong University of Science and Technology, Wuhan, China
<EMAIL_ADDRESS><EMAIL_ADDRESS>{husterlgy,
<EMAIL_ADDRESS>
###### Abstract

Retrieval-Augmented Generation (RAG) is a state-of-the-art technique that
enhances Large Language Models (LLMs) by retrieving relevant knowledge from an
external, non-parametric database. This approach aims to mitigate common LLM
issues such as hallucinations and outdated knowledge. Although existing
research has demonstrated security and privacy vulnerabilities within RAG
systems, making them susceptible to attacks like jailbreaks and prompt
injections, the security of the RAG system’s external databases remains
largely underexplored. In this paper, we employ Membership Inference Attacks
(MIA) to determine whether a sample is part of the knowledge database of a RAG
system, using only black-box API access. Our core hypothesis posits that if a
sample is a member, it will exhibit significant similarity to the text
generated by the RAG system. To test this, we compute the cosine similarity
and the model’s perplexity to establish a membership score, thereby building
robust features. We then introduce two novel attack strategies: a Threshold-
based Attack and a Machine Learning-based Attack, designed to accurately
identify membership. Experimental validation of our methods has achieved a ROC
AUC of 82%.

_K_ eywords Large Language Models $\cdot$ Retrieval-Augmented Generation
$\cdot$ Membership Inference Attacks

##  1 Introduction

Large Language Models (LLMs) have demonstrated impressive capabilities in
language generation tasks [1]. Despite these advancements, LLMs still struggle
with issues such as hallucinations and a limited ability to process long-
tailed factual knowledge [2, 3]. Retrieval-Augmented Generation (RAG)
addresses these limitations by incorporating information from external
knowledge databases into the generative process, thereby reducing
hallucinations and enhancing the management of long-tail knowledge [4, 5].
However, despite utilizing external non-parametric data stores, RAG systems
continue to face significant security and privacy issues.

A growing body of research is dedicated to understanding the security
vulnerabilities of RAG systems. Hu et al.[6] demonstrated that generating
specific short prefixes can lead RAG systems to produce erroneous outputs.
Similarly, PoisonedRAG, designed by Zou et al.[7], employs specialized prompts
to elicit unexpected outputs from LLMs. Additionally, Zeng et al.[8] have
shown that RAG systems can leak private information. Despite these findings,
the security of the external knowledge databases used by RAG systems remains
underexplored, with only a few studies focusing on this issue. Qi et al.[9]
developed a technology for prompt-injected data extraction that effectively
extracts data from the databases of RAG systems. Furthermore, Anderson et al.
[10] employed a method in which an LLM is prompted to answer ’yes’ or ’no’ to
determine whether a specific sample exists in the database.

This paper explores the use of Membership Inference Attacks (MIA)[11] to
assess whether samples are included in the knowledge datasets of RAG systems,
with a focus on evaluating the privacy and security of these external
datasets. Traditionally used to determine if a sample was part of a model’s
training dataset, MIAs are well-recognized for assessing model privacy[12].
However, conventional MIA techniques, which depend on the parameterized
structures of pre-trained models, are not well-suited for RAG systems that
rely on non-parametric external knowledge bases for information sourcing.

Our core insight is that if a sample resides in the RAG system’s knowledge
database, the content generated by the LLMs will be similar to that sample.
This occurs because the RAG system tends to retrieve the top-k passages most
similar to the input sample [4]. Once a sample is identified within the
database, it is retrieved and integrated into the input prompt. This
integration enables the LLMs to access relevant knowledge and generate a
response that exhibits a higher degree of similarity to the original sample,
drawing directly from the sample itself to generate answers.

Figure 1: Overview of the Attack Method Using MIA on a RAG System, An attacker
uses the first half of a target sample as a prompt, which causes the RAG
system to retrieve the top-k passages most similar to it. These documents are
then combined with the original prompt to form a new input for the LLMs. If
the text generated by the LLMs closely resembles the target text, this results
in a high member score, suggesting that the target text is likely part of the
RAG knowledge database.

Although the idea is simple, implementing our method in the RAG system
presents two primary challenges. First, since LLMs synthesize both retrieved
data and their inherent knowledge to generate responses, the output text may
not perfectly align with the target sample. This discrepancy poses a challenge
in accurately assessing the similarity between the generated text and the
target sample. Second, even after calculating a similarity score, determining
an appropriate threshold that enables the attacker to accurately assess
whether the target sample is present in the external knowledge base remains
difficult.

To address these challenges, we have developed a novel method that can
accurately determine the presence of a sample within the knowledge database of
a RAG system, using only black-box API access. As shown in Fig 1, we initially
use the first half of the target sample as the prompt to generate text via the
RAG system. We then compute the cosine similarity between the entire target
sample and the generated text, along with the model’s perplexity, to establish
a robust membership score. Additionally, we employ both threshold traversal-
based and machine learning-based methods across these two dimensions to
accurately classify members and non-members. Our experiments demonstrate that
our attack method can effectively identify samples within the target knowledge
base and is superior to the four state-of-the-art MIA methods.

##  2 Method

We introduce a novel method utilizing MIA technology specifically designed for
RAG systems. This method can accurately determine whether a sample is included
in the knowledge database of a RAG system. As illustrated in Fig 1, our
approach requires only the generated content from the RAG system to calculate
the membership score, enabling its application through black-box API access.
This makes it universally applicable to any RAG system, regardless of its
underlying architecture or dataset.

###  2.1 Membership Score

Our goal is to utilize a set of N query samples, denoted as
${q_{1},...,q_{N}}$, to determine whether each sample $q_{i}$ exists in the
RAG system’s external knowledge database $D$. To achieve this, we first divide
each query $q_{i}$ into two parts: the prompt text $p_{i}$ and the remaining
text $r_{i}$, where $q_{i}=\\{p_{i}\oplus r_{i}\\}$.

The RAG system retrieves the top k samples that are most similar to $p_{i}$.
If $q_{i}$ is present in the knowledge database, it will be retrieved as
external knowledge $D$, and the model will generate a response $g_{i}$ based
on the content of $q_{i}$, resulting in text that is highly similar to the
original prompt $q_{i}$. To quantitatively assess this similarity, we
transform both $g_{i}$ and $q_{i}$ from text to embeddings and calculate their
cosine similarity $Similarity_{i}$. This calculation is performed using the
following equation:

$Similarity_{i}=\frac{\phi(q_{i})\cdot\phi(g_{i})}{\|\phi(q_{i})\|\|\phi(g_{i})\|}$
(1)

Here, $\phi(\cdot)$ represents the function mapping the text to its embedding
vector, and $\cdot$ denotes the dot product operation. The term
$\|\phi(\cdot)\|$ denotes the Euclidean norm of the vector $\phi(\cdot)$.

The inherent variability in the text generated by LLMs, which predict the
probability of the next token rather than producing a deterministic output
[13], means that the similarity of generated text can fluctuate. Consequently,
using similarity alone is not sufficiently robust for determining membership.
Therefore, we also incorporate the perplexity of the generated text.
Perplexity measures the average uncertainty of the model when predicting each
word. If a sample belongs to the database, the model’s predictions are
expected to be more certain, resulting in lower perplexity. We denote the
perplexity of the i-th sample as $Perplexity_{i}$.

Finally, we combine $Similarity_{i}$ and $Perplexity_{i}$ into a two-
dimensional vector that serves as the membership score for each sample:

$Membership\\_Score_{i}=\\{(Similarity_{i}\oplus Perplexity_{i})\mid
i=1,2,...,N\\}$ (2)

This composite score provides a more robust fearture of whether each sample
exists in the knowledge database, enhancing our method’s accuracy and
reliability.

###  2.2 Attack

Threshold-based Attack: Since $Membership\\_Score_{i}$ is a two-dimensional
feature vector containing similarity and perplexity information, we employ a
traversal method to explore all possible threshold vectors
$\theta=(\theta_{similarity},\theta_{perplexity})$ and identify the optimal
membership threshold vector $\theta^{*}$. A sample is classified as a member
if $Similarity_{i}\geq\theta_{similarity}$ and
$Perplexity_{i}\leq\theta_{perplexity}$. Conversely, it is classified as a
non-member otherwise. For each candidate $\theta$, we compute the
corresponding Area Under the Curve (AUC) value, which reflects the trade-off
between the true positive rate (TPR) and the false positive rate (FPR).The
selection of the optimal threshold is determined by the expression:

$\theta^{*}=\arg\max_{\theta}\text{AUC}(\theta)$ (3)

This process aims to find the threshold $\theta^{*}$ that maximizes the AUC
value. The AUC metric is particularly suitable for evaluating binary
classification tasks because it balances the ability to correctly identify
members against the risk of incorrectly identifying non-members as
members.Ultimately, the threshold $\theta$ yielding the highest AUC value is
selected as the optimal threshold $\theta^{*}$.

Machine Learning-based Attack: In addition to employing a simple threshold
method, we have developed a supervised attack model that leverages the
capabilities of machine learning algorithms to learn nonlinear decision
boundaries. This approach enables the model to discern the distribution
properties of features between similarity and perplexity, thus allowing it to
automatically differentiate members from non-members.For each sample $i$, we
utilize a two-dimensional feature vector as input:
$X_{i}=[Similarity_{i},Perplexity_{i}]$, with the corresponding label:
$y_{i}=1$ indicating that sample $i$ is a member, and $y_{i}=0$ indicating a
non-member. The goal is for the model to learn a mapping function $f$, which
predicts the probability of membership status based on the feature vector:

$f(X_{i})=P(y_{i}=1|X_{i})$ (4)

It is critical to note that any supervised learning model suitable for binary
classification can be utilized for this task. To efficiently select the best
model and its parameters, we employ the AutoML framework AutoGluon [14].
AutoGluon streamlines the process of searching and evaluating multiple models
and hyperparameter settings, ultimately identifying the model that achieves
the best performance.

##  3 Evaluation

###  3.1 Experimental Settings

Dataset: We utilize the HealthCareMagic-100k dataset, a QA dataset consisting
of 24,665 samples derived from authentic conversations between patients and
doctors on HealthCareMagic.com. For our experiments, this dataset is divided
into two distinct parts: 80% of the samples are used as the external knowledge
base for the model, representing member sample. The remaining 20% of the
samples are designated as non-member sample.

Baseline: We evaluate our methods against four commonly-used MIA techniques.
The Loss Attack [15], a classic approach in MIA, classifies a target sample as
a member or non-member based on the computed loss from the model. The Zlib
Entropy Attack [16] refines this by calibrating the target sample’s loss using
the sample’s zlib compression size. Additionally, two State-of-the-Art(SOTA)
methods are evaluated: the Neighborhood Attack [17] generates samples similar
to the target and compares their model losses to that of the target sample,
using the differences to determine membership. The Min-k% Prob Attack [18]
calculates membership by focusing on the k% of tokens with the lowest
likelihoods in a sample and computing the average probabilities.

Implementation: The entire experimental framework was implemented using Python
3.8 and Pytorch 1.11.0. Our experiments were conducted on a standard
computational platform featuring Ubuntu 20.04, equipped with an Intel® Xeon®
Platinum 8352V CPU and two NVIDIA® RTX 4090 GPUs. For the language model, we
employed LLaMA-2-7b-chat-hf [19], and the retriever used was all-MiniLM-L6-v2
[20], configured to retrieve the top 5 chunks demonstrating the highest cosine
similarity.

We selected 100 member samples from the external knowledge database for
training, and an additional 100 for testing. Similarly, we chose 100 non-
member samples from the remaining dataset for training, with another 100 set
aside for testing. For the QA dataset, we used the question component as the
prompt text, configuring the system prompt to state: "Answer the question
based on the context above."

Evaluation Metric: Following previous MIA studies [12], we primarily use ROC
AUC to measure the model’s ability to correctly classify members and non-
members. Additionally, we employ several other metrics to comprehensively
assess the model’s performance: Accuracy, which represents the overall
proportion of correctly classified samples; Precision, which measures the
proportion of predicted members that are actual members, thus evaluating the
reliability of the model’s positive classifications; Recall, which aids in
detecting true positives; and F1-Score, a comprehensive performance indicator
that reflects both the precision and the robustness of the attack model.

###  3.2 Results

####  3.2.1 Attack Results

The effectiveness of MIA for RAG systems hinges on their ability to accurately
classify samples and determine their presence in the RAG knowledge database.
We evaluated our method against four conventional MIA techniques, as shown in
Table 1. Traditional MIAs performed poorly in this context because they are
primarily designed for parameterized neural network models and do not adapt
well to the non-parametric nature of RAG systems, resulting in suboptimal
attack outcomes.Among the traditional approaches, the Neighborhood Attack
demonstrated superior ROC AUC and PR AUC values compared to the other three
methods. In this method, we consider five neighborhoods per sample; however,
this method is computationally intensive as it requires generating
neighborhoods for each sample, effectively doubling the training data.

In contrast, our Threshold-based Attack achieved a ROC AUC of 0.801 and a PR
AUC of 0.839, while the Machine Learning-based Attack performed even better,
with a ROC AUC of 0.82 and a PR AUC of 0.898. These results indicate that our
methods can effectively capture member information from the RAG system
knowledge database. This effectiveness is attributed to the high similarity
and low uncertainty between member samples and the samples generated by the
RAG system.

Table 1: Results of MIA for RAG systemm Attack | Metrics
---|---
|  ROC AUC |  PR AUC
Loss Attack |  0.475 |  0.481
Zlib Entropy Attack |  0.468 |  0.469
Neighborhood Attack |  0.593 |  0.567
Min-k% Prob Attack |  0.476 |  0.473
Threshold-based Attack |  0.801 |  0.839
Machine Learning-based Attack |  0.820 |  0.898

####  3.2.2 Diffferent Metric Attack

To further demonstrate the effectiveness of our feature extraction method, we
conducted experiments using various metrics as sample features. "Single-
similarity" utilizes only sample similarity as a feature. "Multi-prompt"
involves the model generating five answers, with the similarity of each answer
calculated separately. The prompt used is: “Answer the question based on the
context above. Generate 5 responses, each ending in ’/end’.” "Multi-sample"
enhances simple text data, such as by shuffling and synonym replacement, to
generate five similar texts and calculate their similarities separately.
"Multi-metric" employs five features: similarity, confidence, perplexity,
loss, and entropy.

As depicted in Tables 2 and Tables 3, the Single-similarity approach achieves
high ROC AUC and Precision in the Threshold-based Attack but exhibits very low
Recall and F1-Score, suggesting that this method may be overly conservative.
It tends to predict a sample as positive only under high certainty, resulting
in a high accuracy rate but a low number of positive predictions. In contrast,
in the Machine Learning-based Attack, Single-similarity performs poorly
overall. This is likely due to the randomness in LLM-generated documents,
indicating that relying solely on similarity is not robust enough for the
model to learn effective features.

Table 2: Results of Threshold-based Attack under different metrics Attack |  ROC AUC |  Accuracy |  Precision |  Recall | F1-score
---|---|---|---|---|---
Single-similarity |  0.927 |  0.709 |  0\. 885 |  0.302 | 0.430
Multi-prompt |  0.825 |  0.80 |  1.0 |  0.60 | 0.749
Multi-sample |  0.953 |  0.650 |  1.0 |  0.30 | 0.46
Multi-metric |  0.981 |  0.817 |  1.0 |  0.633 | 0.775
Similarity&Perplexity |  0.801 |  0.833 |  1.0 |  0.687 | 0.8
Table 3: Results of Machine Learning-based Attack under different metrics Attack |  ROC AUC |  Accuracy |  Precision |  Recall | F1-score
---|---|---|---|---|---
Single-similarity |  0.665 |  0.680 |  0.714 |  0.362 | 0.558
Multi-prompt |  0.827 |  0.650 |  1.0 |  0.30 | 0.460
Multi-sample |  0.807 |  0.680 |  1.0 |  0.390 | 0.530
Multi-metric |  0.964 |  0.883 |  0.960 |  0.80 | 0.872
Similarity&Perplexity |  0.820 |  0.867 |  1.0 |  0.733 | 0.846

Both the Multi-prompt and Multi-sample methods exhibit low recall rates. It is
evident that generating multiple texts to compute similarity does not
significantly enhance performance; notably, the Multi-prompt method exhibits
the poorest results. This underperformance may stem from the model’s tendency
to rely on its internal knowledge rather than on the external knowledge
database when generating multiple outputs.

Indeed, the Multi-metric approach demonstrates the best performance by
integrating features from multiple dimensions into a comprehensive analysis.
However, this method cannot be implemented through a black-box approach. It
requires access to detailed model information, such as loss, cross-entropy,
and confidence, which are derived from the output vector of the last MLP
layer. In contrast, "similarity" and "perplexity" can be computed directly
from the model’s output text. Our findings indicate that using just these two
indicators enables a robust attack on the RAG system knowledge database,
utilizing only black-box API access.

##  4 Conclusion

This paper focuses on the susceptibility of external knowledge databases in
RAG systems to Membership Inference Attacks (MIA). Employing black-box API
access, we developed and validated two innovative attack strategies: the
Threshold-based Attack and the Machine Learning-based Attack. The results,
which demonstrate the effectiveness of our approaches in identifying
membership within RAG systems, confirm the vulnerability of these databases.
By disclosing these vulnerabilities, we hope to raise awareness among
practitioners and policymakers about potential safety issues within RAG
databases, underscoring the importance of developing enhanced security
protocols to protect sensitive data.

## References

  * [1] W. Shi, S. Min, M. Yasunaga, M. Seo, R. James, M. Lewis, L. Zettlemoyer, and W.-t. Yih, “Replug: Retrieval-augmented black-box language models,” _arXiv preprint arXiv:2301.12652_ , 2023.
  * [2] Z. Shang, W. Ke, N. Xiu, P. Wang, J. Liu, Y. Li, Z. Luo, and K. Ji, “Ontofact: Unveiling fantastic fact-skeleton of llms via ontology-driven reinforcement learning,” in _Proceedings of the AAAI Conference on Artificial Intelligence_ , vol. 38, no. 17, 2024, pp. 18 934–18 943.
  * [3] Q. Zhao, Y. Dai, H. Li, W. Hu, F. Zhang, and J. Liu, “Ltgc: Long-tail recognition via leveraging llms-driven generated content,” in _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , 2024, pp. 19 510–19 520.
  * [4] A. Asai, Z. Wu, Y. Wang, A. Sil, and H. Hajishirzi, “Self-rag: Learning to retrieve, generate, and critique through self-reflection,” in _The Twelfth International Conference on Learning Representations_ , 2023.
  * [5] J. Deng, L. Pang, H. Shen, and X. Cheng, “Regavae: A retrieval-augmented gaussian mixture variational auto-encoder for language modeling,” in _The 2023 Conference on Empirical Methods in Natural Language Processing_ , 2023.
  * [6] Z. Hu, C. Wang, Y. Shu, L. Zhu _et al._ , “Prompt perturbation in retrieval-augmented generation based large language models,” _arXiv preprint arXiv:2402.07179_ , 2024.
  * [7] W. Zou, R. Geng, B. Wang, and J. Jia, “Poisonedrag: Knowledge poisoning attacks to retrieval-augmented generation of large language models,” _arXiv preprint arXiv:2402.07867_ , 2024.
  * [8] S. Zeng, J. Zhang, P. He, Y. Xing, Y. Liu, H. Xu, J. Ren, S. Wang, D. Yin, Y. Chang _et al._ , “The good and the bad: Exploring privacy issues in retrieval-augmented generation (rag),” _arXiv preprint arXiv:2402.16893_ , 2024.
  * [9] Z. Qi, H. Zhang, E. Xing, S. Kakade, and H. Lakkaraju, “Follow my instruction and spill the beans: Scalable data extraction from retrieval-augmented generation systems,” _arXiv preprint arXiv:2402.17840_ , 2024.
  * [10] M. Anderson, G. Amit, and A. Goldsteen, “Is my data in your retrieval database? membership inference attacks against retrieval augmented generation,” _arXiv preprint arXiv:2405.20446_ , 2024.
  * [11] R. Shokri, M. Stronati, C. Song, and V. Shmatikov, “Membership inference attacks against machine learning models,” in _2017 IEEE symposium on security and privacy (SP)_. IEEE, 2017, pp. 3–18.
  * [12] M. Duan, A. Suri, N. Mireshghallah, S. Min, W. Shi, L. Zettlemoyer, Y. Tsvetkov, Y. Choi, D. Evans, and H. Hajishirzi, “Do membership inference attacks work on large language models?” _arXiv preprint arXiv:2402.07841_ , 2024.
  * [13] H. Zhao, H. Chen, F. Yang, N. Liu, H. Deng, H. Cai, S. Wang, D. Yin, and M. Du, “Explainability for large language models: A survey,” _ACM Transactions on Intelligent Systems and Technology_ , 2023.
  * [14] N. Erickson, J. Mueller, A. Shirkov, H. Zhang, P. Larroy, M. Li, and A. Smola, “Autogluon-tabular: Robust and accurate automl for structured data,” _arXiv preprint arXiv:2003.06505_ , 2020.
  * [15] S. Yeom, I. Giacomelli, M. Fredrikson, and S. Jha, “Privacy risk in machine learning: Analyzing the connection to overfitting,” in _2018 IEEE 31st computer security foundations symposium (CSF)_. IEEE, 2018, pp. 268–282.
  * [16] N. Carlini, F. Tramer, E. Wallace, M. Jagielski, A. Herbert-Voss, K. Lee, A. Roberts, T. Brown, D. Song, U. Erlingsson _et al._ , “Extracting training data from large language models,” in _30th USENIX Security Symposium (USENIX Security 21)_ , 2021, pp. 2633–2650.
  * [17] J. Mattern, F. Mireshghallah, Z. Jin, B. Schölkopf, M. Sachan, and T. Berg-Kirkpatrick, “Membership inference attacks against language models via neighbourhood comparison,” _arXiv preprint arXiv:2305.18462_ , 2023.
  * [18] W. Shi, A. Ajith, M. Xia, Y. Huang, D. Liu, T. Blevins, D. Chen, and L. Zettlemoyer, “Detecting pretraining data from large language models,” _arXiv preprint arXiv:2310.16789_ , 2023.
  * [19] H. Touvron, L. Martin, K. Stone, P. Albert, A. Almahairi, Y. Babaei, N. Bashlykov, S. Batra, P. Bhargava, S. Bhosale _et al._ , “Llama 2: Open foundation and fine-tuned chat models,” _arXiv preprint arXiv:2307.09288_ , 2023.
  * [20] N. Reimers, P. Freire, G. Becquin, O. Espejel, and J. Gante, “Sentence-transformers/all-minilm-l6-v2 hugging face.”