# A Comprehensive Study on Dataset Distillation: Performance, Privacy,
Robustness and Fairness

Author Name Affiliation<EMAIL_ADDRESS>${\textbf{Zongxiong Chen}^{*}}^{2}$
${\textbf{Jiahui Geng}^{*}}^{1}$ ${\textbf{Derui Zhu}^{3}}$ ${\textbf{Herbert
Woisetschläger}}^{3}$ ${\textbf{Qing Li}^{1}}$ ${\textbf{Sonja
Schimmler}}^{2}$ ${\textbf{Ruben Mayer}}^{3}$ ${\textbf{Chunming Rong}}^{1}$
1University of Stavanger
2 Fraunhofer FOKUS
3 Technische Universität München
{jiahui.geng, chunming.rong<EMAIL_ADDRESS>
{derui.zhu, herbert.woisetschlaeger<EMAIL_ADDRESS>
{zongxiong.chen<EMAIL_ADDRESS>
###### Abstract

The aim of dataset distillation is to encode the rich features of an original
dataset into a tiny dataset. It is a promising approach to accelerate neural
network training and related studies. Different approaches have been proposed
to improve the informativeness and generalization performance of distilled
images. However, no work has comprehensively analyzed this technique from a
security perspective and there is a lack of systematic understanding of
potential risks. In this work, we conduct extensive experiments to evaluate
current state-of-the-art dataset distillation methods. We successfully use
membership inference attacks to show that privacy risks still remain. Our work
also demonstrates that dataset distillation can cause varying degrees of
impact on model robustness and amplify model unfairness across classes when
making predictions. This work offers a large-scale benchmarking framework for
dataset distillation evaluation.

**footnotetext: Equal contributions

##  1 Introduction

A recent study Isenko et al. (2022) has shown that the storage consumption
required for popular training sets grows exponentially over time. It is
becoming increasingly difficult to train neural networks well on vastly large-
scale datasets. Local training is constraint by memory limitations, while
distributed training suffers from latency across clients due to network I/O
and bandwidth problems. Besides, depending on the complexity of the task and
model architectures, training deep neural networks requires iterations over
the entire training set, up to several hundred or even thousands of times.
Dataset distillation Wang et al. (2018) may be the holy grail to solve this
dilemma. It describes a set of methods aiming to significantly reduce the
amount of data while maintaining the same model accuracy level as training on
an entire dataset. In contrast to coreset selection, which requires heuristic
algorithms and may not be suitable for high-dimensional datasets Bachem et al.
(2017), dataset distillation learns to condense large datasets into smaller
synthetic datasets rather than using sampling strategies.

There have been many efforts continue to advance dataset distillation, both
theoretically and practically Zhao et al. (2021); Zhao and Bilen (2021);
Cazenavette et al. (2022); Kim et al. (2022). However, most of these works
focus on the model’s performance and generalization capability across
architectures. We state that the security of dataset distillation techniques
has been overlooked in the research. Security is essentially critical in the
ML application and deployment. Different attacks have been proposed to
compromise the integrity of machine learning models. Privacy attacks are
trying to infer task-irrelevant private information and restore the training
samples from the model’s output or parameters Shokri et al. (2017); Geng et
al. (2021). There are also attacks on the robustness by adding imperceptible
noise to the samples so that the model will be fooled and give false
predictions Xu et al. (2020). Our work seeks to bridge the gap between dataset
distillation and security analysis studies.

In this work, we propose a benchmark to evaluate the security of dataset
distillation. Our work focuses on answering the following questions: (1). Is
the use of a synthetic dataset instead of the real dataset sufficient to
protect data privacy? (2). What is the impact on the robustness when models
are trained on a distilled dataset using fewer training samples with visual
noise on each image? (3). Given that safety-critical applications cannot just
focus on the average performance across all classes, is dataset distillation
fair for each class in classification tasks?

Based on proposed research questions, we conducted a large-scale analysis of
state-of-the-art distillation methods. We use four representative distillation
techniques: Differentiable Siamese Augmentation (DSA), Distribution Matching
(DM), Training Trajectory Matching (MTT), and Information-Intensive Dataset
Condensation (IDC) to synthesize datasets and train neural networks of
different architectures on these to obtain the target models. Then we designed
a lot of experiments to evaluate the impact of data distillation on the
privacy, fairness and robustness of the model. We identify the key factors
affecting these metrics by conducting extensive comparative experiments. The
experimental results reveal several insightful findings on the dataset
distillation, including:

  * •

Dataset distillation does amplify the unfairness of the model’s predictions
between different classes, which increases with the distillation rate.

  * •

Dataset distillation does not have natural privacy-preserving capabilities:
the success of membership inference attacks will be affected by the
distillation rate, initialization, and the number of classes.

  * •

The robustness of the model is affected to varying degrees, but the
distillation rate plays a minor role here.

Here the distillation rate represents the ratio of the numbers of images per
class after distillation to before distillation. This is the first work to
systematically evaluate the dataset distillation techniques and their risks in
terms of security.

###  1.1 Outline

Our paper is organized as follows. We first introduce the background that are
related to our work in Section 2. Then, we describe the experimental design in
detail, including the experimental data, the methods being evaluated, and the
evaluation pipeline in Section 3. Following that, we present experimental
results and key insights In Section 5, we put our work into context with
related works, and conclude with future work in Section 6.

(a) DM

(b) DSA

(c) MTT

(d) IDC

Figure 1: Distilled 10 images per class from CIFAR10 via DSA, DM, MTT, and
IDC.

##  2 Background

###  2.1 Dataset Distillation Basics

Dataset distillation aims to distill the training set into a much smaller
synthetic dataset so that the model trained on the distilled dataset performs
as closely as possible to the model trained on the whole dataset. Considering
the widely used image classification task where the training dataset consists
of images and labels
$\mathcal{T}={({x}_{i},y_{i})}_{i=1}^{\lvert\mathcal{T}\rvert}$. The distilled
synthetic dataset what we want to learn is
$\mathcal{S}={({x}_{i},y_{i})}_{i=1}^{\lvert\mathcal{S}\rvert}$. Let
$\phi_{\theta^{\mathcal{T}}}$ and $\phi_{\theta^{\mathcal{S}}}$ denote the
models with parameters $\theta^{\mathcal{T}}$ and $\theta^{\mathcal{S}}$ that
trained on $\mathcal{T}$ and $\mathcal{S}$ respectively. Therefore, an ideal
dataset distillation should satisfy:

$\mathbb{E}_{x\sim
P_{\mathcal{D}}}[\ell(\phi_{\theta^{\mathcal{T}}}({x}),y)]\simeq\mathbb{E}_{x\sim
P_{\mathcal{D}}}[\ell(\phi_{\theta^{\mathcal{S}}}({x}),y)],$ (1)

where $\ell$ is the loss function and $P_{\mathcal{D}}$ is the real data
distribution.

###  2.2 Security of ML Models

#### Privacy Perspective

When the deep model learns high-level and abstract features, it inevitably
remembers too many details from the training samples, including a lot of task-
independent private information. Many attacks attempt to attack the target
model to infer the privacy. Representative attacks include membership
inference attacks (MIAs) Shokri et al. (2017), attribute inference attacks
Gong and Liu (2016), model inversion attacks Fredrikson et al. (2015); Zhang
et al. (2020), gradient inversion attacks Zhu et al. (2019), etc. The goal of
MIAs is to discriminate whether a specific data participates in the model
training and it can be regarded as a binary classification problem. Model
inversion attack and gradient inversion attack attempt to restore training
data and labels from the accessed model parameters or gradient parameters.
Attribute inference attacks attempt to infer task-independent attributes.

#### Robustness Perspective

In machine learning, model robustness refers to how well a model can perform
on new data compared with training data. Ideally, performance should not
deviate significantly. However, deep models have recently been shown to be
unstable to adversarial perturbations, i.e. even imperceptible perturbations
are sufficient to fool the well-trained models and results in incorrect
predictions.

######  Definition 1 (Adversarial Perturbation).

For a given classifier denoted by
$f(\cdot;\theta):\mathbb{R}^{d}\rightarrow\mathbb{R}^{K}$, with input
$x\in\mathbb{R}^{d}$ and $K$ is the number of classes in the task. Let
$f(x;\theta)$ represent the model softmax output and $\hat{f}(x;\theta)$
represent the index of the highest probability. Then, the adversarial
perturbation is defined as the minimum perturbation $r$ that is sufficient to
change the model prediction:

$\Delta(x;f(\cdot;\theta)):=\min_{r}\lVert r\rVert_{2}\quad
s.t.\quad\hat{f}(x+r)\neq\hat{f}(x)$ (2)

Adversarial accuracy is a commonly used method to measure the robustness of a
classifier. Usually, we use different adversarial sample generation algorithms
to add a perturbation of magnitude $\epsilon$ to the sample and test the
accuracy of the model.

######  Definition 2 (Adversarial Accuracy).

Let $\mathcal{L}(f(x;\theta),y)$ be the classification error given input $x$,
classifier $f(\cdot;\theta)$ and true label $y$. Adversarial accuracy an is
defined as follows for an adversary with an adversary region $R(x)$. Commonly,
we consider $\mathbb{B}(x,\epsilon)$, a $\epsilon-$ball around $x$ based on
the distance metric $d$ as the adversary region $R(x)$.

$acc=\mathbb{E}_{(x,y)\sim\mathcal{D}}[\mathbbm{1}(f(x^{*};\theta)=y)]$ (3)

where

$x^{*}=\operatorname*{arg\,max}\limits_{x^{\prime}\in
R(x)}\mathcal{L}(x^{\prime},y).$ (4)

#### Fairness Perspective

Fairness between classes is also an important indicator of safety. Often
people only report average performance, i.e., average metrics across classes,
which can lead to an overestimation of safety. Fine-grained performance per
category is essential for safety-critical applications, such as the ’human’
class in autonomous driving. It has been found that many post-processed
machine learning models amplify the unfairness between different categories,
i.e., the models perform well on some categories while degrading a lot on
others. Hooker et al. Hooker et al. (2020) show that model compression can
amplify model bias in models, including using model pruning and quantization
protocols. Silva et al. Silva et al. (2021) find that distilled models almost
always exhibit statistically significant bias compared to the original pre-
trained models. Ma et al. (2022); Benz et al. (2021); Xu et al. (2021) shows
that models trained with adversarial examples exhibit the same problem.
Inspired by Li et al. (2021); Lin et al. (2022), we give the definition of
fairness as follows,

######  Definition 3 (Performance Fairness).

A model $w_{1}$ is more fair than $w_{2}$ if the test performance distribution
of $w_{1}$ is more uniform than that of $w_{2}$, e.g.
$\text{var}({F(w_{1})})<\text{var}({F(w_{2})})$ , where $F(*)$ denotes
evaluation metrics such as test accuracy or test loss of model among all
classes and var denotes the variance.

In contrast to the definition in Li et al. (2021) which focuses on comparison
in federated learning settings, our definition can be applied to evaluate the
fairness about different models directly.

##  3 Evaluation Benchmark

Our work unites data distillation and privacy, robustness and fairness in ML
research. For that, we introduce evaluation pipelines along with four state-
of-the-art dataset distillation methods.

###  3.1 Dataset

We implement our evaluation pipeline on CIFAR10 and CIFAR100, which are widely
used for image classification tasks. CIFAR-10 contains 10 different
categories, each category has 60K (50K training images and 10K test images)
images of size $32\times 32$. CIFAR-100 contains 100 different categories,
each with 500 training images and 100 test images of the same size. Using
larger datasets is a trend of dataset distillation, such as TinyImageNet Le
and Yang (2015), ImageNet Russakovsky et al. (2015) and CelebA Liu et al.
(2015), which is also our future work.

###  3.2 Dataset Distillation Methods

We choose DSA, DM, MTT, IDC as representative methods to be evaluated in our
benchmark. They are all accepted by top conferences with code public released.
They have been widely compared in different works.

  * •

DSA
DSA is essentially based on the gradient matching mechanism, which infers the
synthetic dataset by matching the model optimization trajectory trained on the
synthetic dataset with the trajectory trained on the original dataset. DSA
proposed to apply Differentiable Siamese Augmentation during the optimization.
To make it applicable to any initial state, the optimization objective of the
model can be expressed as:

$\tiny\min_{\mathcal{S}}\mathbb{E}_{\theta_{0}\sim
P_{\theta_{0}}}[\sum_{t=1}^{T-1}D(\nabla_{\theta}\mathcal{L}(\mathcal{A}(\mathcal{S},\omega^{\mathcal{S}}),\theta_{t}),\nabla_{\theta}\mathcal{L}(\mathcal{A}(\mathcal{T},\omega^{\mathcal{T}}),\theta_{t}))]$
(5)

where $T$ is the number of iterations, $\theta_{0}$ is the random initialized
parameters, and $\mathcal{A}$ is family of image transformations that
parameterized with $\omega^{\mathcal{S}}$ and $\omega^{\mathcal{T}}$ for the
synthetic and real training samples respectively.

  * •

DM
DM proposes to optimize the distilled dataset by reducing the maximum mean
discrepancy (MMD) between the synthetic and real data. DM uses neural network
with different random initializations instead of sampling parameters from a
set of pretrained networks. In addition, DM also uses Differentiable Siamese
Augmentation. The objective function can be illustrated as:

$\tiny\min_{\mathcal{S}}\mathbb{E}_{\theta\sim
P_{\theta}\atop\omega\sim\Omega}\lVert\frac{1}{\lvert\mathcal{S}\rvert}\sum_{i=1}^{\lvert\mathcal{S}\rvert}\psi_{\theta}(\mathcal{A}(s_{i},\omega))-\frac{1}{\lvert\mathcal{T}\rvert}\sum_{i=1}^{\lvert\mathcal{T}\rvert}\psi_{\theta}(\mathcal{A}(x_{i},\omega))\rVert^{2},$
(6)

where $\psi_{\theta}$ is a family of deep models to map the samples into a
lower dimensional space, and $\omega\sim\Omega$ is the augmentation parameter.
Importantly, Equation 6 requires only optimizing the synthetic dataset
$\mathcal{S}$, not the model parameters $\theta$.

  * •

MTT
MTT regards the sequence of models trained on the real data as the expert
trajectory, and the model trained on the synthetic data as the student model.
It first samples $\theta_{t}$ at a random timestep $t$ from the expert
trajectory to initialize the student model. Then it performs N Step gradient
descent updates on the student model and selects the expert model
$\theta_{n+M}$ as the target model. The objective of MTT is to make the
student model approach the expert model and use the Euclidean distance of the
expert parameters to normalize the matching loss:

$\mathcal{L}=\frac{\lVert\hat{\theta}_{t+N}-\theta^{*}_{t+M}\lVert_{2}^{2}}{\lVert\hat{\theta}_{t}^{*}-\theta^{*}_{t+M}\lVert_{2}^{2}}$
(7)

  * •

IDC
Similar to DSA, IDC is also use gradient matching algorithm to obtain optimal
distlled dataset. The key difference between DSA and IDC is that IDC
introduces a multi-formation function: $f:\mathbb{R}^{n\times
m}\rightarrow\mathbb{R}^{n^{\prime}\times m}$, which can synthesize more
informative dataset under the same storage consumption. The multi-formation
function $f$ can be either learned or a pretrained model during optimization.

###  3.3 Evaluation Pipeline

Our evaluation pipeline is mainly divided into three stages. The first stage
is image distillation, we use the Github codes of
DSA***https://github.com/VICO-UoE/DatasetCondensation,
DM***https://github.com/VICO-UoE/DatasetCondensation,
MTT***https://github.com/GeorgeCazenavette/mtt-distillation, and IDC
***https://github.com/snu-mllab/Efficient-Dataset-Condensation official
releases to obtain different distilled datasets. The second stage is to use
the distilled data set to train a randomly initialized model. The third stage
is to design targeted experiments to analyze the target model. We evaluate
target models in term of performance, privacy, robustness and fairness. As in
prior works, the informativeness of the distilled image and the generalization
performance are two fundamental metrics to measure the performance. Image
informativeness is usually measured by the accuracy of the neural network
trained on it, and a higher accuracy of the model means a better
representation of the image. Furthermore, generalization is defined as the
model accuracy across different architectures. We chose to use membership
inference attacks among the many ways to attack the privacy of machine
learning models. Model inversion attacks and gradient inversion attacks are
not suitable for evaluating the privacy-preserving capability of dataset
distillation due to the irreversible information loss after distillation. We
perform adversarial attacks on this well-trained model to analysis the
intrinsic robustness issues caused by the distilled dataset. In our
evaluation, we consider the degradation of the robust accuracy caused by
DeepFoolAttack Moosavi-Dezfooli et al. (2016) overall results across models
.As the fairness study, we observe how the model’s accuracy and loss vary
across different classes, and whether the model has a prominent drop on
spesific classes.

(a) DSA

(b) DM

(c) MTT

(d) IDC

Figure 2: Data distribution of real images and synthetic images learned in
CIFAR10 at IPC-50. We use a pretrained ConvNet3 model to generate an
2048-dimension embedding and project that embedding into 2-dimension plane by
t-SNE with hyperparameter perplexity 50\. The black boxs in presented in the
figure indicate the obvious outliers in the projected embeddings.

(a) IPC=50

(b) DSA

(c) DM

(d) MTT

(e) IDC

Figure 3: Robustness Evaluation on CIFAR10

(a) IPC=50

(b) DSA

(c) DM

(d) MTT

(e) IDC

Figure 4: Robustness Evaluation on CIFAR100

##  4 Experimental Studies

(a) CIFAR10

(b) CIFAR100

(c) CIFAR10

(d) CIFAR100

Figure 5: Test accuracies of models trained on the distilled data

In this section, We comprehensively evaluate the properties of dataset
distillation crafted by the state-of-the-art distillation method through
extensive experiments.

We have designed specific experiments for each property and layout the details
for the evaluations further. Section 4.2 introduces the overall performance of
the various approaches. Readers can grab a quick overview of current
developments in this domain. We report the performance of the distilled data
under different compression ratio with the model performance and the
generalization capability across various network architectures. In Section
4.3, 4.5 and 4.4, we compare the performance of the models trained on the
original and distilled data and analyze the changes that dataset distillation
brings to the deep models in terms of privacy, robustness, and fairness.

###  4.1 Experimenetal Setup

Performance Evaluation Setup Using the code released by authors, we run
Convnet3 to synthesize 1/10/20/50/100 and 1/10/20/50 images per classes
distilled dataset for CIFAR10 and CIFAR100 respectively. we use default
hyperparameters and training configurations of considered methods, except the
following exceptions: 1) For IPC 50 and 100, we manually tune the number of
iterations for outer and inner optimization for DSA and DM since they’re
undefined in the released source code. 2) In MTT, ZCA whitening, a plugable
mechanism to improve the performance of distillation dataset as reported by
Cazenavette et al. (2022), is disabled when synthesizing distilled dataset for
a better comparison with other methods. Since it is applicable to other
considered distillation methods and orthogonal to our benchmark settings.

To evaluate the accuracy performance of each distilled dataset, we repeatedly
train three kinds of networks, namely ConvNet3, Resnet18, VGG16, from scratch
three times and train them for 2000 epochs to ensure model convergence. The
number of epochs we use is different from that of provided by Kim et al.
(2022) since we found that MTT cannot achieve the optimal accuracy reported in
Cazenavette et al. (2022) within 300 epochs. For a fair comparison, we train
all networks for 2000 epochs instead.

Privacy Evaluation Setup To obtain distilled dataset for performing MIA
attacks, we use the distillation algorithm described previously to obtain
corresponding synthetic dataset via the same settings we describe above except
using a conceptual original dataset which is drawn 40, 80, 200, 400 samples
per class on CIFAR10 randomly. We don’t report the results about MTT since we
failed to synthsize the corresponding distilled dataset.

Robustness Evaluation Setup We use adversarial examples to attack the target
model and measure the robustness of the model through adversarial accuracy. We
have considered training the target models to the same accuracy. However, this
approach is unfair to those methods that can be trained to very high accuracy.
Therefore, we choose to test the adversarial accuracy of the best models
obtained by different approaches.

###  4.2 Dataset Distillation Performance

We evaluate the cross architecture performance of different condensation
methods on the CIFAR10 datasets with IPC ranging from 1 to 100, and CIFAR100
dataset with IPC ranging from 1 to 50. Figure 5a and Figure 5b illustrate the
test accuracy of the models trained on dataset after distillation on CIFAR10
and CIFAR100 respectively. The test accuracy of the model increases as the
number of images per class grows. IDC outperforms MTT, DM, and DSA on CIFAR10.
On CIFAR100, IDC still performs the best, the performance of DSA and DM are
quite close, and MTT is only second to IDC when the number of images per class
is small, despite the fluctuations in the curve. Due to space limit, we only
show the curves here, the complete tables containing various distillation
methods, architectures, and numbers of images per classes can be found in the
appendix.

The learned synthetic images of CIFAR10 are visualized in Figure 1. We found
that the images generated by the four methods correspond to four different
styles. DM-generated images are difficult to recognize its content even though
it is initialized with real images; in contrast, DSA-generated content becomes
less noisy. The pictures generated by MTT are more colorful but contain a lot
of strange distortions, and the style is closer to comics. IDC is different
from others because, through the multi-formation function, it learns to
include four down-sampled subimages in one image. These subimages look clearer
and closer to the real image. This method is controversial because it provides
more valid information.

Based on the visualization result, we believe that IDC’s higher accuracy
mainly due to its use of data parameterization, where more down-sampled
training samples are included in the same image. It actually provides more
valid information to the model. Although there is no study that states that
the validity of distilled data is related to the identifiability of the
images, IDC and MTT show a substantial lead in accuracy and identifiability at
CIFAR10, when the number of images per class 10. We have similar findings on
the CIFAR100 dataset, which is illustrated in the appendix.

Figure 5c and Figure 5d demonstrate the generalization capability of different
methods on CIFAR10 and CIFAR100. Compared with ConvNet, the test accuracies
drop when transferring to ResNet18 and VGG16. Moreover, the relative ranking
of different distilled dataset might not necessarily be preserved when
transferred to different architectures. Our results are consistent with
reported in Zhou et al. (2022).

###  4.3 Privacy Evaluation

In many related works Zhou et al. (2022); Chen et al. (2022), dataset
distillations have been implemented as a compression technique to protect
membership information of training dataset. However, we think their
experiments ignore the most fundamental fact, namely the distillation ratio.
To verify this, we fist construct training sets of different sizes, and then
perform dataset distillation. Specifically, we randomly select 40, 80, 200,
400, 4000 samples from each class in CIFAR10 to form a training set. Besides,
we also examined the impact of different initializations on MIA attacks. The
results as shown in Table 1. Note that we do not show the results for MTT
because we always fail when using MTT for distillation on smaller datasets. We
apply AUC as a metric to measure how success an MIA attack is. The higher AUC
value refers to the higher vulnerability of a model against MIA attacks.
Specifically, when the AUC value is equal to 50%, the model can perfectly
prevent MIA attacks. We find that the distillation rate has a positive
correlation with the vulnerability of the model against MIA attacks.
Specifically, when the distillation ratio is equal to 25%, the AUC of MIA
attacks for IDC can reach an impressive value, 98.07%. Due to the
parameterisation applied in IDC, the distilled datasets contain almost the
same information as the original datasets. Furthermore, the experimental
results also indicate that distilled datasets initialised with real images
contain a greater privacy risk. Additionally, the privacy risk of IDC is
significantly higher than the other two methods, which is clearly a side
effect of the greater amount of information.

Besides, we investigated how the number of classes affected MIA attacks. The
experiments were conducted on the above-mentioned tailored datasets with a
size of 80 and 400, respectively. We changed the number of classes in the
classification model from 2 to 5, and 10. The result shown in Table 2
demonstrate that even on the distilled dataset, the number of classifications
of the target model helps to understand how much privacy information leaked.
The larger the number of classes, the more information an attacker can get
about the internal state of the model, which is also observed by Shokri et al.
(2017).

Origin | Init | DSA | DM | IDC
---|---|---|---|---
40 | random | 73.67 | 75.08 | 86.47
real | 76.46 | 77.73 | 98.07
80 | random | 63.40 | 63.64 | 69.86
real | 61.89 | 63.23 | 71.59
200 | random | 55.06 | 55.15 | 59.09
real | 55.03 | 55.59 | 59.73
400 | random | 52.38 | 52.35 | 54.62
real | 52.52 | 52.89 | 56.34
Table 1: MIA attack AUC on CIFAR10 with different original sizes and initialization. In both settings, the distilled datasets contain 10 images per class.  Origin | Classes | DSA | DM | IDC
---|---|---|---|---
80 | 2 | 49.77 | 49.78 | 56.80
5 | 52.46 | 53.30 | 65.30
10 | 61.89 | 63.20 | 71.50
400 | 2 | 50.38 | 50.09 | 52.55
5 | 50.46 | 50.67 | 53.24
10 | 52.52 | 52.89 | 54.45
Table 2: MIA attack AUC on CIFAR10 with different number of classes.

###  4.4 Fairness Evaluation

We first show in Figure 7a how much accuracy drops on different classes after
using dataset distillation. In order to conclude more intuitively, we
normalize real accuracy of each class from original dataset to 1. In addtion,
we reorder the classes from high to low according to the real accuracy, i.e.,
the original model performs best on Class 1 and worst on 3. In this way, the
variation of the same method on different classes represents the unfairness
brought by the distillation. Secondly, we find that different classes have
different difficulties in learning through distillation. For example, in
classes with relatively higher real accuracy, such as Class 1, 6, 7, and 8,
the normalized accuracy obtained by different methods is also relative higher.
For Class 2 and 3, the normalized accuracy obtained by different methods is
relatively low, which means that more information is lost in the distillation
process and learning is more difficult. It can be seen that the loss of
distillation information or learning difficulty is closely related to the
performance of the original model on these categories. This conclusion
inspires that we may need to increase IPC for classes with poor real
performance to retain more training information.

We then plot the variance across different classes in terms of loss and
accuracy in Figure 6a and Figure 6b based on Definition 3. We clearly find
that as the IPC increases, the model’s fairness also improve since the
variance of loss decreases. We also find different methods have different
intrinsic fairness properties. Overall, the MTT consistently outperforms the
IDC, DM and DSA in terms of loss-based fairness. As to accuracy-based
fairness, we find that the situation is somewhat complicated, with DSA
performing best when IPC equals 1. For this reason, we plot accuracy of
original and DSA with IPC=1 in Figure 7b. We find that this may be due to the
fact that the model performs poorly on different categories. To further
explain the unfairness between the categories, we visualize the distribution
of features across the synthetic data when IPC=50 using t-SNE in Figure 2. We
find that MTT have the best visualisation result, with almost all distillation
features falling in the corresponding cluster, while the other three methods
all have distillation feature falling in other clusters. In addition, there is
differences across categories. For example, in Figure 2b, the features
corresponding to Class 0 and Class 2 both have some distillation features
falling in each other’s cluster, but almost none fall into Class 1. This could
be a explanation of unfairness. We suggest using a loss-based fairness rather
than accuracy, as softmax provides more information across classes, whereas
accuracy loses such information due to argmax operation.

(a) Loss-based fairness

(b) Class-wise accuracy-based fairness

Figure 6: Fairness of a model evaluated according to Definition 3

(a) Normalized accuracy on CIFAR10 at IPC-50

(b) Accuracy on CIFAR10 of original dataset and DSA’s dataset at IPC-1

Figure 7:  Figure 7a presented the normalized accuracy of different methods at
IPC-50. The order the class is sorted descending according to the original
accuracy obtained from original model. Figure 7b displayed the accuracy of
each class evaluated on DSA at IPC-1

###  4.5 Robustness Evaluation

The robustness accuracy of different methods on CIFAR10 and CIFAR100 are
illustrated in Figure 4 and Figure 4, where the horizontal coordinate
represents the strength of the added noise, the vertical coordinate represents
the accuracy in the classification task, and higher values represent greater
resistance to robustness attacks. The first picture in each row shows the
results of different distillation methods when the number of images per class
(IPC) is set to 50, and the following four represent the change of robustness
with IPC in different methods. We found that three of the four methods we
experimented with: DM, DSA, and MTT were all able to outperform the original
model in terms of robustness when the noise exceeded a certain intensity.
While on CIFAR100, only DSA and DM would perform better when the noise was
sufficiently high. In both datasets, the MTT method always exhibited the worst
robustness. We also compare the accuracies with varying IPCs, however,We don’t
not find a strong relationship between robustness and IPC.

##  5 Related Work

Wang et al. Wang et al. (2018) was the first to propose the concept of dataset
distillation (also known as dataset condensation). They proposed to using bi-
level optimization to synthesize a compact dataset that has better storage
efficiency than the coresets. Since then, more and more methods have been
proposed to improve distillation performance, for example using distribution
matching Zhao and Bilen (2021), gradient matching Zhao et al. (2021), training
trajectory matching Cazenavette et al. (2022) and augmentation techniques Zhao
Bo (2021), kernel methods Nguyen et al. (2020); Zhou et al. (2022); Loo et al.
(2022), and data parametrization Kim et al. (2022) with GAN Such et al.
(2020); Zhao and Bilen (2022) or factorization Lee et al. (2022); Liu et al.
(2022).

There are other works exploring dataset distillation as in our work. In Wang
et al. (2018), it was shown that using dataset distillation can make data
poisoning attacks more effective. In Zhou et al. (2022), it was claimed that
dataset distillation is robust to membership inference attacks. Our
experimental results empirically show that their conclusions are not entirely
correct. In Nguyen et al. (2020); Loo et al. (2022), they built a
$\rho-$corrupted dataset to protect privacy, and the image information has a
$\rho$ ratio of pixels that remains unchanged during the optimization process.
The last one that is similar to our work is DC-Bench Cui et al. (2022).
However, they only compared and analyzed existing dataset distillation methods
in terms of compression ratio, transferability and neural architecture search.
In contrast, we focus on the ML security and potential risks of the dataset
distillation.

##  6 Conclusion

#### Conclusion.

This work systematically evaluates current dataset distillation methods from
the perspective of ML security. Specifically, it provides a large-scale
benchmark for evaluating dataset distillation, where we design and implement
experiments regarding privacy, robustness, and fairness. We find that dataset
distillation cannot help prevent membership inference attacks, and it
increases the unfairness of model performance across different classes. We
also demonstrate experimentally that it impacts the robustness of models to
varying degrees. This is the first work that bridges the gap between dataset
distillation and security studies.

##  Appendix A Hyperparameters & Hardwares

For all distilled methods considered in this paper, we use the default
hyperparameters given by the authors. That is, we run 1K iterations to create
a synthetic dataset in DSA. As for IPC 50 and 100, we manually set the
hyperparameters inner and outer loop in DSA. For MTT, we use the same
hyperparameters reported by the authors except for disabling ZCA whitening for
a fair comparison. For both DM and IDC, the settings are the same as those
provided by the authors. Furthermore, we run all our experiments on the same
host with Tesla V100 GPU with 32 GB. As a performance comparison, it takes
2000 epochs to train ConvNet3, Resnet18, and VGG16 to ensure coverage. We also
repeat the training 3 times to measure the variance of accuracy.

##  Appendix B Detailed accuracy under different IPCs and models

In Table 3, we report the detailed accuracy of model trained by distilled
dataset. It contains accuracy results about dataset CIFAR10 and CIFAR100 with
different IPCs on different models, i.e., ConvNet3, Restnet18 and VGG16.

Dataset | Image per class | Test Model | DSA | DM | MTT | IDC | Full dataset
---|---|---|---|---|---|---|---
CIFAR10 | 1 | ConvNet3 | 29.50 $\pm$1.22 | 28.84 $\pm$ 0.52 | 41.13 $\pm$0.50 | 48.07 $\pm$ 0.16 | 89.61 $\pm$ 0.26
Resnet18 | 28.52 $\pm$ 0.29 | 21.74 $\pm$ 0.92 | 34.00 $\pm$ 1.17 | 41.34 $\pm$ 0.54 | 88.85 $\pm$ 5.27
VGG16 | 20.56 $\pm$ 4.28 | 14.01 $\pm$ 4.01 | 24.15 $\pm$ 1.36 | 37.82 $\pm$ 4.64 | 94.76 $\pm$ 0.04
10 | ConvNet | 50.29 $\pm$ 0.23 | 53.07 $\pm$ 0.91 | 63.23 $\pm$0.55 | 65.13 $\pm$ 0.12 | 89.61 $\pm$ 0.26
Resnet18 | 40.26 $\pm$ 0.64 | 38.52 $\pm$ 1.12 | 48.75 $\pm$1.79 | 63.56 $\pm$ 0.91 | 88.85 $\pm$ 5.27
VGG16 | 36.05 $\pm$ 1.85 | 35.47 $\pm$ 2.29 | 52.05 $\pm$ 0.57 | 59.35 $\pm$ 1.32 | 94.76 $\pm$ 0.04
20 | ConvNet | 57.46 $\pm$0.32 | 60.83 $\pm$0.24 | 65.31 $\pm$ 0.43 | 71.68 $\pm$0.24 | 89.61 $\pm$ 0.26
Resnet18 | 46.40 $\pm$ 0.39 | 47.41 $\pm$ 0.31 | 61.12 $\pm$ 0.71 | 69.35 $\pm$ 1.18 | 88.85 $\pm$ 5.27
VGG16 | 38.10 $\pm$ 0.64 | 48.65 $\pm$ 1.59 | 56.23 $\pm$ 3.15 | 66.81 $\pm$ 0.41 | 94.76 $\pm$ 0.04
50 | ConvNet | 61.28 $\pm$ 0.37 | 65.63 $\pm$ 0.08 | 71.64 $\pm$ 0.30 | 75.18 $\pm$ 0.40 | 89.61 $\pm$ 0.26
Resnet18 | 52.99 $\pm$ 0.18 | 62.34 $\pm$ 0.57 | 68.94 $\pm$ 0.14 | 72.14 $\pm$ 0.10 | 88.85 $\pm$ 5.27
VGG16 | 45.00 $\pm$ 0.27 | 56.81 $\pm$ 3.89 | 69.08 $\pm$ 0.22 | 72.95 $\pm$ 0.26 | 94.76 $\pm$ 0.04
100 | ConvNet | 63.14 $\pm$ 0.14 | 69.31 $\pm$ 0.16 | 72.39 $\pm$ 0.13 | 75.00 $\pm$ 0.04 | 89.61 $\pm$ 0.26
Resnet18 | 55.71 $\pm$ 0.08 | 68.81 $\pm$ 0.49 | 69.94 $\pm$ 0.21 | 74.32 $\pm$ 0.26 | 88.85 $\pm$ 5.27
VGG16 | 49.66 $\pm$ 0.85 | 63.07 $\pm$ 4.08 | 70.60 $\pm$ 0.27 | 74.02 $\pm$ 0.02 | 94.76 $\pm$ 0.04
CIFAR100 | 1 | ConvNet | 16.01 $\pm$ 0.26 | 12.33 $\pm$ 0.11 | 21.47 $\pm$ 0.36 | 28.68 $\pm$ 0.41 | 64.5 $\pm$ 0.15
Resnet18 | 10.1 $\pm$ 0.51 | 3.02$\pm$ 0.14 | 10.51 $\pm$ 0.03 | 21.67 $\pm$ 0.15 | 72.57 $\pm$ 0.14
VGG16 | 10.67 $\pm$ 0.35 | 5.06 $\pm$ 0.43 | 7.33 $\pm$ 0.19 | 21.43 $\pm$ 0.97 | 74.05 $\pm$ 4.54
10 | ConvNet | 32.96 $\pm$ 0.19 | 32.24 $\pm$ 0.26 | 36.74 $\pm$ 0.17 | 45.78 $\pm$ 0.24 | 64.35 $\pm$ 0.15
Resnet18 | 24.14 $\pm$0.27 | 26.45 $\pm$ 0.67 | 31.70 $\pm$ 0.21 | 41.42 $\pm$ 0.40 | 72.71 $\pm$ 0.14
VGG16 | 16.06 $\pm$ 0.86 | 24.63 $\pm$ 2.28 | 31.75 $\pm$ 0.61 | 41.86 $\pm$ 0.56 | 74.05 $\pm$ 4.54
20 | ConvNet | 37.20 $\pm$ 0.29 | 37.37 $\pm$0.18 | 33.69 $\pm$ 0.32 | 49.48 $\pm$ 0.03 | 64.35$\pm$ 0.15
Resnet18 | 28.28 $\pm$0.63 | 33.28 $\pm$ 0.38 | 31.13 $\pm$ 0.42 | 47.24 $\pm$ 0.30 | 72.71 $\pm$ 0.14
VGG16 | 24.56 $\pm$ 0.48 | 32.83 $\pm$ 0.39 | 27.60 $\pm$ 0.31 | 44.85 $\pm$ 0.11 | 74.05 $\pm$ 4.54
50 | ConvNet | 45.14 $\pm$ 0.22 | 45.62 $\pm$ 0.15 | 45.73 $\pm$ 0.40 | 53.62 $\pm$ 0.20 | 64.35 $\pm$ 0.15
Resnet18 | 44.13 $\pm$ 0.21 | 44.65 $\pm$ 0.62 | 42.19 $\pm$ 0.29 | 51.73 $\pm$0.23 | 72.71 $\pm$ 0.14
VGG16 | 38.88 $\pm$ 0.29 | 40.60 $\pm$ 0.42 | 46.46 $\pm$ 0.15 | 53.49 $\pm$ 0.46 | 74.05 $\pm$ 4.54
Table 3: Cross-architecture accuracy results of method DSA, DM, MTT and IDC on
CIFAR10 with IPC 1, 10, 20, 50 and 100, and CIFAR100 with IPC 1, 10, 20, 50.

##  Appendix C Robustness

In Figure 8, we investigate the impact of DSA augmentation on DM, MTT, and IDC
methods. We generate two different distilled datasets by enabling and
disabling DSA augmentation of each algorithm. Then, we train the models on
each dataset to obtain the best validation accuracy. Last, we use
DeepFoolAttack to evaluate the robustness of each model to analyze the
influence of DSA. We see that DSA augmentation can improve the robustness to
some extent since the red line in Figure 8 is always slightly above the green
curve.

Figure 8: Robust accuracy of dataset trained by enabling DSA and disabling DSA

##  Appendix D Visualization of distilled dataset

In Figure 10, 9, we show the images of a synthetic dataset of CIFAR10 and
CIFAR100 with IPC 1 respectively, which can help us have a better
understanding about the dataset pattern of different distilled algorithms.
Interestingly, we find that the distilled images via DM and MTT can not be
recognized directly compared with other algorithms in both CIFAR10 and
CIFAR100 datasets, e.g. Figure 10b looks like a chessboard.

(a) DSA

(b) DM

(c) MTT

(d) IDC

Figure 9: Distilled dataset on CIFAR100 with IPC-1

##  Appendix E Distribution of distilled dataset

In Figure 11, we present 10-class distribution of CIFAR10 with IPC 50. We use
a pretrained ConvNet3 model to generate a 2048-dimension embedding and project
that embedding into a 2-dimension plane by t-SNE with hyperparameter
perplexity 50\. We see that IDC has more than 50 images per class since IDC
algorithm uses a multi-formation function $f$ to decode condensed dataset into
training dataset. Visually, we find that the projected distilled images from
DM, MTT, IDC can spread over the cluster better than DSA. As an example in
DSA, class 2 has virtually no points at the center of the cluster. However,
DM, MTT, IDC are well suited for class 2.

(a) DSA

(b) DM

(c) MTT

(d) IDC

Figure 10: Distilled dataset on CIFAR10 with IPC-1

(a) DSA

(b) DM

(c) MTT

(d) IDC

Figure 11: Data distribution of real images and synthetic images learned in
CIFAR10 with IPC-50.

## References

  * Bachem et al. [2017] Olivier Bachem, Mario Lucic, and Andreas Krause.  Practical coreset constructions for machine learning.  arXiv preprint arXiv:1703.06476, 2017.
  * Benz et al. [2021] Philipp Benz, Chaoning Zhang, Adil Karjauv, and In So Kweon.  Robustness may be at odds with fairness: An empirical study on class-wise accuracy.  In NeurIPS 2020 Workshop on Pre-registration in Machine Learning, pages 325–342. PMLR, 2021.
  * Cazenavette et al. [2022] George Cazenavette, Tongzhou Wang, Antonio Torralba, Alexei A Efros, and Jun-Yan Zhu.  Dataset distillation by matching training trajectories.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4750–4759, 2022.
  * Chen et al. [2022] Dingfan Chen, Raouf Kerkouche, and Mario Fritz.  Private set generation with discriminative information.  arXiv preprint arXiv:2211.04446, 2022.
  * Cui et al. [2022] Justin Cui, Ruochen Wang, Si Si, and Cho-Jui Hsieh.  Dc-bench: Dataset condensation benchmark.  arXiv preprint arXiv:2207.09639, 2022.
  * Fredrikson et al. [2015] Matt Fredrikson, Somesh Jha, and Thomas Ristenpart.  Model inversion attacks that exploit confidence information and basic countermeasures.  In Proceedings of the 22nd ACM SIGSAC conference on computer and communications security, pages 1322–1333, 2015.
  * Geng et al. [2021] Jiahui Geng, Yongli Mou, Feifei Li, Qing Li, Oya Beyan, Stefan Decker, and Chunming Rong.  Towards general deep leakage in federated learning.  arXiv preprint arXiv:2110.09074, 2021.
  * Gong and Liu [2016] Neil Zhenqiang Gong and Bin Liu.  You are who you know and how you behave: Attribute inference attacks via users’ social friends and behaviors.  arXiv preprint arXiv:1606.05893, 2016.
  * Hooker et al. [2020] Sara Hooker, Nyalleng Moorosi, Gregory Clark, Samy Bengio, and Emily Denton.  Characterising bias in compressed models.  arXiv preprint arXiv:2010.03058, 2020.
  * Isenko et al. [2022] Alexander Isenko, Ruben Mayer, Jeffrey Jedele, and Hans-Arno Jacobsen.  Where is my training bottleneck? hidden trade-offs in deep learning preprocessing pipelines.  arXiv preprint arXiv:2202.08679, 2022.
  * Kim et al. [2022] Jang-Hyun Kim, Jinuk Kim, Seong Joon Oh, Sangdoo Yun, Hwanjun Song, Joonhyun Jeong, Jung-Woo Ha, and Hyun Oh Song.  Dataset condensation via efficient synthetic-data parameterization.  arXiv preprint arXiv:2205.14959, 2022.
  * Le and Yang [2015] Ya Le and Xuan S. Yang.  Tiny imagenet visual recognition challenge.  2015\.
  * Lee et al. [2022] Hae Beom Lee, Dong Bok Lee, and Sung Ju Hwang.  Dataset condensation with latent space knowledge factorization and sharing.  arXiv preprint arXiv:2208.10494, 2022.
  * Li et al. [2021] Tian Li, Shengyuan Hu, Ahmad Beirami, and Virginia Smith.  Ditto: Fair and robust federated learning through personalization.  In International Conference on Machine Learning, pages 6357–6368. PMLR, 2021.
  * Lin et al. [2022] Shiyun Lin, Yuze Han, Xiang Li, and Zhihua Zhang.  Personalized federated learning towards communication efficiency, robustness and fairness.  Advances in Neural Information Processing Systems, 2022.
  * Liu et al. [2015] Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang.  Deep learning face attributes in the wild.  In Proceedings of International Conference on Computer Vision (ICCV), December 2015.
  * Liu et al. [2022] Songhua Liu, Kai Wang, Xingyi Yang, Jingwen Ye, and Xinchao Wang.  Dataset distillation via factorization.  arXiv preprint arXiv:2210.16774, 2022.
  * Loo et al. [2022] Noel Loo, Ramin Hasani, Alexander Amini, and Daniela Rus.  Efficient dataset distillation using random feature approximation.  arXiv preprint arXiv:2210.12067, 2022.
  * Ma et al. [2022] Xinsong Ma, Zekai Wang, and Weiwei Liu.  On the tradeoff between robustness and fairness.  In Advances in Neural Information Processing Systems, 2022.
  * Moosavi-Dezfooli et al. [2016] Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard.  Deepfool: a simple and accurate method to fool deep neural networks.  In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 2574–2582, 2016.
  * Nguyen et al. [2020] Timothy Nguyen, Zhourong Chen, and Jaehoon Lee.  Dataset meta-learning from kernel ridge-regression.  arXiv preprint arXiv:2011.00050, 2020.
  * Russakovsky et al. [2015] Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, Alexander C. Berg, and Li Fei-Fei.  ImageNet Large Scale Visual Recognition Challenge.  International Journal of Computer Vision (IJCV), 115(3):211–252, 2015.
  * Shokri et al. [2017] Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov.  Membership inference attacks against machine learning models.  In 2017 IEEE symposium on security and privacy (SP), pages 3–18. IEEE, 2017.
  * Silva et al. [2021] Andrew Silva, Pradyumna Tambwekar, and Matthew Gombolay.  Towards a comprehensive understanding and accurate evaluation of societal biases in pre-trained transformers.  In Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, pages 2383–2389, 2021.
  * Such et al. [2020] Felipe Petroski Such, Aditya Rawal, Joel Lehman, Kenneth Stanley, and Jeffrey Clune.  Generative teaching networks: Accelerating neural architecture search by learning to generate synthetic training data.  In International Conference on Machine Learning, pages 9206–9216. PMLR, 2020.
  * Wang et al. [2018] Tongzhou Wang, Jun-Yan Zhu, Antonio Torralba, and Alexei A Efros.  Dataset distillation.  arXiv preprint arXiv:1811.10959, 2018.
  * Xu et al. [2020] Han Xu, Yao Ma, Hao-Chen Liu, Debayan Deb, Hui Liu, Ji-Liang Tang, and Anil K Jain.  Adversarial attacks and defenses in images, graphs and text: A review.  International Journal of Automation and Computing, 17(2):151–178, 2020.
  * Xu et al. [2021] Han Xu, Xiaorui Liu, Yaxin Li, Anil Jain, and Jiliang Tang.  To be robust or to be fair: Towards fairness in adversarial training.  In International Conference on Machine Learning, pages 11492–11501. PMLR, 2021.
  * Zhang et al. [2020] Yuheng Zhang, Ruoxi Jia, Hengzhi Pei, Wenxiao Wang, Bo Li, and Dawn Song.  The secret revealer: Generative model-inversion attacks against deep neural networks.  In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 253–261, 2020.
  * Zhao and Bilen [2021] Bo Zhao and Hakan Bilen.  Dataset condensation with distribution matching.  ArXiv, abs/2110.04181, 2021.
  * Zhao and Bilen [2022] Bo Zhao and Hakan Bilen.  Synthesizing informative training samples with gan.  arXiv preprint arXiv:2204.07513, 2022.
  * Zhao et al. [2021] Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen.  Dataset condensation with gradient matching.  ICLR, 1(2):3, 2021.
  * Zhao Bo [2021] Bilen Hakan Zhao Bo.  Dataset condensation with differentiable siamese augmentation.  In International Conference on Machine Learning, pages 12674–12685. PMLR, 2021.
  * Zhou et al. [2022] Yongchao Zhou, Ehsan Nezhadarya, and Jimmy Ba.  Dataset distillation using neural feature regression.  arXiv preprint arXiv:2206.00719, 2022.
  * Zhu et al. [2019] Ligeng Zhu, Zhijian Liu, and Song Han.  Deep leakage from gradients.  Advances in neural information processing systems, 32, 2019.


Modified rational six vertex model on the rectangular lattice

1]S. Belliard<EMAIL_ADDRESS>2]R.A. Pimenta<EMAIL_ADDRESS>3]N.A. Slavnov<EMAIL_ADDRESS>
[1]Institut Denis-Poisson, Université de Tours, Université d'Orléans, Parc de Grammont, 37200 Tours, France
[2]Department of Physics and Astronomy, University of Manitoba, Winnipeg R3T 2N2, Canada
[3]Steklov Mathematical Institute of Russian Academy of Sciences, 8 Gubkina str., Moscow, 119991,  Russia

[ ]

We consider a rational six vertex model on a rectangular lattice with boundary conditions that generalize the usual domain wall type. We find that the partition function of the inhomogeneous version of this model is given by a modified Izergin determinant. The proofs are based on the quantum inverse scattering method and its representation theory together with elementary linear algebra.

§ INTRODUCTION

A partition function is the central object in Statistical Mechanics. Computing the partition function is often a difficult combinatorial problem that sometimes
can be solved exactly, particularly in two dimensional lattices <cit.>. A prominent
example is the six vertex model, which can be defined on a rectangular lattice
by assigning two possible states to each of its edges (see Figure <ref>). The possible configurations
around a vertex are constrained by the ice rule. Boundary conditions must be imposed, and it turns out
that they play an
important role in the nature of the mathematical representation of the partition function.

Different solvable boundary conditions have been considered for
the six vertex model. The most common are the torus, the cylinder and
fixed boundary conditions like domain wall and reflecting end, as well as mixtures of them. The first two
types can be computed via the diagonalization of an appropriate transfer matrix,
which can in principle be done
using Bethe ansatz, as early noted by Lieb
in his solution of the square ice <cit.>. On the other hand, fixed
boundary conditions like domain wall type admit a determinant representation <cit.>, so do the
reflecting end case <cit.>. In this paper, we will focus on fixed boundary conditions
that generalize the domain wall type.

The domain wall boundary condition for the six vertex model in the square lattice
was introduced by Korepin <cit.>,
where a recurrence relation for the partition function was found. The solution
of the recurrence was later given by Izergin <cit.> in the form of a determinant
(see, for example, the monograph <cit.> for details). The partition
function on the rectangular lattice, also called a partial domain wall boundary, was considered
recently and it is also given by a determinant <cit.>.

Here we propose a generalization of the rational six vertex partition function
on the rectangular lattice with four
arbitrary boundaries.  In the language of the
quantum inverse scattering method, this partition function
is given by certain expectation values of a string of modified creation operators,
which arise in the context of the modified algebraic
Bethe ansatz (see for instance <cit.>
and references therein). The expectation values are associated with four arbitrary
wall states labeled with the compass directions (<ref>).
We argue that the partition function satisfies a homogeneous
system of linear equations, which follows
directly from the (modified) triangular representation theory of the Yangian  $Y(gl(2))$ and
Yang-Baxter algebra via certain off-shell relations. We then show that the linear system is solved by a modified Izergin determinant (<ref>).

Let us recall that the partition function of the six vertex model
with domain wall boundary condition was shown to
solve a system of functional equations <cit.> (see
also <cit.>), as well
as a system of algebraic equations <cit.>.

The linear system approach was recently discovered
in the computation of scalar products between on-shell and off-shell
Bethe states <cit.>. Its powerfulness has been demonstrated in the
computation of on-shell/off-shell scalar products of Bethe states in the
closed XYZ chain <cit.> and in the
open XXZ chain with general integrable boundaries <cit.>. Here we
show that it can also be used to compute partition functions opening a
new avenue of possibilities.

This paper is organized as follows. In Section <ref>, we
recall the definition of an arbitrary vertex model on the rectangular lattice, its partition
function with arbitrary twists and some essential ingredients of the quantum inverse scattering
method. In Section <ref>, auxiliary operators and the associated
representation theory are studied in the rational 6 vertex case. Next, in Section <ref>, we derive
the homogeneous linear systems satisfied by the partition function
and construct the solution in the form of a modified Izergin determinant.
Our concluding remarks and further directions of research are presented
in Section <ref>. Some technical details are given in the appendices
<ref> and <ref>.

Notation. We use a shorthand notation for sets of variables and products over them.
For example, we denote a set of $m$ variables $u_j$ by $\bar u = \{u_1,\dots,u_m\}$. We
usually leaving
the cardinality implicit and note it $\# \bar u=m$. The removal of the $i$-th element of the set
$\bar u$ is denoted $\bar u_i=\bar u \backslash u_i$. For the product of
a two variable function $g(u,v)$ over the set $\bar u$ we use,

g(z,u̅) = ∏_x∈u̅g(z,x),  g(u̅,z) = ∏_x∈u̅g(x,z),  g(u̅,v̅) = ∏_x∈u̅,y∈v̅g(x,y) .
We also such notation for the product of commuting operators

B(u̅)= ∏_x∈u̅ B(x).
If no product is involved, a vertical bar is used to indicate the
multivariable function dependency, e.g.,

s(u|u̅) = s(u|u_1,…,u_m) ,  r(u̅|w̅) = r(u_1,…, u_m|v_1,…,v_n).
The following functions will be used,

g(u,v)=c/u-v,  f(u,v)=u-v+c/u-v,  h(u,v)=u-v+c/c,
h̃(u,v)=u-v-c/c .
They satisfy the relations

§ PARTITION FUNCTION AND QUANTUM GROUPS

In this section we review some basic concepts in the theory of integrable vertex models,
the operator formulation of the partition function with general open boundary condition.
The material in this section is valid for an arbitrary
integrable vertex model
with arbitrary number of states.

§.§ R-matrix and Yang-Baxter equation

Let us recall the inhomogeneous vertex model on the $m \times n$ rectangular lattice from the quantum group formalism (see Figure <ref>).
A finite dimensional vector space  denoted $V_{a_i}$ carrying a free parameter $u_i$,
also called inhomogeneity, is associated with each line of the lattice $i=1,\dots, m$. Similarly, a
finite dimensional vector
space $V_{b_i}$ with parameter  $v_i$  is associated with each column $i=1,\dots, n$. Every vertex is labeled by a pair of variables $(u, v)$ and it is encoded by an invertible matrix  $R_{ab}(u,v)$ (see Figure <ref>).
The entries of this matrix are the statistical weights of the model. Explicitly, we have,

R_ab(u,v)=∑_jk,ℓmR_jk,ℓm(u,v) (E_jk)_a ⊗(E_ℓm)_b
where the $(E_{ij})_a$ are unit matrices (that satisfy $E_{ij}E_{kl}=\delta_{jk}E_{il}$) acting on the space $V_a$, and the sum is taken over $(j,k)\in \{1,\dots, \dim(V_a)\}^2$ and $(\ell,m)\in \{1,\dots, \dim(V_b)\}^2$. One imposes that this matrix is a solution of the Yang Baxter equation,

R_ab(u,v)R_ac(u,w)R_bc(v,w)=R_bc(v,w)R_ac(u,w)R_ab(u,v) ,
and therefore ensures the integrability of the model.

(0.1,0.1) grid (6.9,5.9);

(7,1) node[right] $(V_{a_1},u_{1})$;
(7,2) node[right] $(V_{a_2},u_{2})$;
(8-0.5,3) node[right] $\vdots$;
(7,4) node[right] $(V_{a_{m-1}},u_{m-1})$;
(7,5) node[right] $(V_{a_m},u_{m})$;
(-1.5,3) node[left] $Z^{b_1\dots b_n}_{a_1\dots a_m}(\bar u|\bar v)=$ ;
(-0.5,0.5) – (-0.5,5.5) ;
(1,0) node[below] $(V_{b_1},v_{1})$;
(3.5,-0.2) node[below] $\cdots$$\cdots$$\cdots$;
(6,0) node[below] $(V_{b_{n}},v_{n})$;

Inhomogeneous vertex model on the $m \times n$ rectangular lattice.

(0.1,0.1) grid (1.9,1.9);
(0,1) node[left] $(V_{a},u)$;
(-1.5,1) node[left] $R_{ab}(u,v)=$ ;
(1,0) node[below] $(V_{b},v)$;

Graphical picture of a vertex and the R-matrix.

In the so-called auxiliary space formalism, we can write the matrix of the partition function in the form,

Z^b_1…b_n_a_1…a_m=∏_i=1^m∏_j=1^nR_a_ib_j(u_i,v_j) ,
which is an endomorphism of $V_{a_1}\otimes \dots  \otimes V_{a_m} \otimes V_{b_1}\otimes \dots  \otimes V_{b_n}$.
The following exchange relations follow from Yang-Baxter algebra,

R_a_ia_i+1(u_i,u_i+1)Z^b_1…b_n_a_1…a_ia_i+1 …a_m= Z^b_1…b_n_a_1…a_i+1a_i …a_mR_a_ia_i+1(u_i,u_i+1)

R_b_ib_i+1(v_i,v_i+1)Z^b_1…b_ib_i+1…b_n_a_1 …a_m= Z^b_1…b_i+1b_i …b_n_a_1…a_mR_b_ib_i+1(v_i,v_i+1).

We now assume that the R-matrix has the properties,

[R_ab(u,v),B_aB_b]=[R_ab(u,v),B_a B_b]=0 ,
where $B$ and $\Hat B$ are arbitrary matrices in $\text{End}(V)$. Using the
matrices $B$ and $\Hat B$ we can add a twist to each auxiliary space. This motivates
the definition of a “quasiperiodic", or twisted inhomogeneous partition function, by taking
the trace over each space, namely,

Z_mn(u̅|v̅|B|B)=_a̅,b̅((∏_i=1^mB̂_b_i)(∏_j=1^nB_a_j) Z^b_1…b_n_a_1…a_m(u̅|v̅))
where we used the shorthand notation (<ref>,<ref>).
This definition generalizes the standard definition of the periodic partition function given by $B_a=\bar B_a=1_{V_a}$, that always satisfy (<ref>) (see e.g. Chapter 7.5 of <cit.>).
It is easy to show that (<ref>) is a symmetric function over the sets $\bar u$ or $\bar v$.
Moreover, if we relax the symmetric property for one set of variables, we can introduce different
twist matrices for each vector space. That is, the transformation $\prod_{i=1}^n \Hat B_{b_i} \to \prod_{i=1}^n\Hat B^{(i)}_{b_i}$ breaks the symmetry over permutation of the set  $\bar v$ and the transformation $\prod_{i=1}^n B_{b_i} \to \prod_{i=1}^n B^{(i)}_{b_i}$ break the symmetry over permutation of the set  $\bar u$.

§.§ Operator formalism and quantum group

We now express the matrix of the partition function (<ref>)
in terms of products of single row monodromy matrices, either in the horizontal or vertical
direction of the lattice.

(0.1,0.1) grid (6.9,1.9);
(9,1) node[left] $(V_{a},u)$;
(0,1) node[left] $T_a(u|\bar v)=$ ;
(1,0) node[below] $(V_{b_1},v_{1})$;
(3.5,-0.2) node[below] $\cdots$$\cdots$$\cdots$;
(6,0) node[below] $(V_{b_{n}},v_{n})$;

(0.1,0.1) grid (1.9,5.9);
(2.5,1) node[right] $(V_{a_1},u_{1})$;
(2.5,2) node[right] $(V_{a_2},u_{2})$;
(3,3) node[right] $\vdots$;
(2.5,4) node[right] $(V_{a_{m-1}},u_{m-1})$;
(2.5,5) node[right]  $(V_{a_m},u_{m})$;
(1,0) node[below] $(V_{b},v)$;
(1,-1.3) node  90$=$;
(1,-2.2) node $\Hat T_{b}(v|\bar u)$;

Single row monodromy matrix
Single column monodromy matrix

The horizontal single row monodromy matrix is given by

and can be represented as in the left panel of Figure <ref>. Is is clear that (<ref>) can be written
Z^b_1…b_n_a_1…a_m(u̅|v̅)=∏_i=1^m T_a_i(u_i|v̅).
The single row monodromy matrix (<ref>) satisfies the RTT relation,

R_ab(u_a,u_b)T_a(u_a|v̅)T_b(u_b|v̅)=T_b(u_b|v̅)T_a(u_a|v̅)R_ab(u_a,u_b) .
It allows one to define the transfer matrix with an arbitrary twist $B_a$ given by

B(u)=_a(B_a T_a(u|v̅)),
which is represented on the left panel of Figure <ref>, and it is integrable since it leads to a family of mutually commuting operators,
The partition function can then be written in the operator formulation,

Z_mn(u̅|v̅|B|B)=_b̅ ((∏_i=1^nB̂_b_i) B(u̅) ) .

(-4.2,0) node[left] $B_a(u)=$ ;
[dashed] (4,0) arc[x radius=4, y radius=1, start angle=0, end angle=180];
(4,0) arc[x radius=4, y radius=1, start angle=0, end angle=-180];

ıin 1,2,3,4,5,6
[line width=0.1mm,   black]  ($(-\ang*\i:4 and 1)-(0,0.5)$) –  ($(-\ang*\i:4 and 1)+(0,0.5)$) node [below] ;
at ($(-1.5,-0.8)+(-\ang*5:4 and 1)$) $(V_{b_1},v_{1})$;
at ($(-1.3,-1.0)+(-\ang*4:4 and 1)$) $(V_{b_2},v_{2})$;
at ($(0,-0.8)+(-\ang*3:4 and 1)$) $\cdots$$\cdots$;
at ($(0.3,-0.8)+(-\ang*1:4 and 1)$) $(V_{b_n},v_{n})$;
[black] plot [only marks, mark=square*] coordinates (-4,0);

(-4.6,-0.3) node[left] 90$=$;
(-5.2,-1) node[left] $\hat B_b(v)$;
[dashed] (4,0) arc[x radius=4, y radius=1, start angle=0, end angle=180];
(4,0) arc[x radius=4, y radius=1, start angle=0, end angle=-180];

ıin 1,2,3,4,5
[line width=0.1mm,   black]  ($(-30*\i:4 and 1)-(0,0.5)$) –  ($(-30*\i:4 and 1)+(0,0.5)$) node [below] ;
at ($(0,-0.8-1)+(-30*5:4 and 1)$) $(V_{a_1},u_{1})$;
at ($(0,-0.8-1)+(-30*4:4 and 1)$) $(V_{a_2},u_{2})$;
at ($(0,-0.8-1)+(-30*3:4 and 1)$) $\vdots$;
at ($(-0.1,-0.85-1.5)+(-30*2:4 and 1)$) $(V_{a_{m-1}},u_{m-1})$;
at ($(0.1,-0.8-1)+(-30*1:4 and 1)$) $(V_{a_m},u_{m})$;
[black] plot [only marks, mark=square*] coordinates (-4,0);

Modified operators $B(u)$ (left) and $\hat B(v)$ (right). The twists are represented by the filled squares.

Similarly, we can consider the single column monodromy matrix defined by,

T_b(v|u̅)=∏_m=1^mR_a_ib(u_i,v) ,
(see right panel of Figure <ref>).
It satisfies the RTT relation,

R_ba(v_b,v_a) T_a(v_a|u̅)T_b(v_b|u̅)=T_b(v_b|u̅)T_a(v_a|u̅)R_ba(v_b,v_a) ,
from which the additional family of mutually commuting operators

B(v)=_b(B_b T_b(v|u̅)) ,
with arbitrary twist $\Hat B_b$ can be obtained, by tracing over a given auxiliary space $V_b$,
(See a graphical representation in the right panel of Figure <ref>).

A second reformulation of the matrix of partition function follows from $\Hat T$, namely,

and leads to the partition function in terms of the transfer matrix $\Hat B(u)$,

Z_mn(u̅|v̅|B|B)=_a̅ ((∏_i=1^m B_a_i) B(v̅) ) .

We have therefore two equivalent transfer matrix formulations (<ref>) and (<ref>) of the partition
function (<ref>). Depending on the nature of the twists $\{B,\hat B\}$, we have different
boundary conditions for the partition function (see Figure <ref>). If both twists have not
rank one, we have a torus type of partition function. If only one of the twists has rank one, we have a cylinder and if both satisfies this condition the plane. If
one or both of the twists has rank one, the trace reduces to matrix elements of the matrices
$B(\bar u)$ or $\Hat B(\bar v)$ (see next (<ref>)).

axis equal image,
hide axis,
z buffer = sort,
scale = 1,
point meta=0,
samples = 10,
samples y =20,
domain = 0:2*pi,
domain y = 0:2*pi,

[xshift = 2cm]

[black] plot [only marks, mark size=1.5, mark=square*] coordinates (1.35,2.07);
[black] plot [only marks, mark size=1.5, mark=square*] coordinates (1.35,1.93);
[black] plot [only marks, mark size=1.5, mark=square*] coordinates (1.35,1.62);
[black] plot [only marks, mark size=1.5, mark=square*] coordinates (1.35,1.19);
[black] plot [only marks, mark size=1.5, mark=square*] coordinates (1.35,0.85);
[black] plot [only marks, mark size=1.5, mark=square*] coordinates (0.2,2.75);
[black] plot [only marks, mark size=1.5, mark=square*] coordinates (0.45,2.9);
[black] plot [only marks, mark size=1.5, mark=square*] coordinates (0.8,3.04);
[black] plot [only marks, mark size=1.5, mark=square*] coordinates (1.22,3.10);
[black] plot [only marks, mark size=1.5, mark=square*] coordinates (1.62,3.10);
[black] plot [only marks, mark size=1.5, mark=square*] coordinates (2.05,3);
[black] plot [only marks, mark size=1.5, mark=square*] coordinates (2.38,2.87);
[black] plot [only marks, mark size=1.5, mark=square*] coordinates (2.62,2.7);

axis equal image,
hide axis,
z buffer = sort
point meta=0,
samples = 10,
samples y = 20,
domain = 0:6,
domain y = 0:2*pi,

[xshift = 0cm]

[black] plot [only marks, mark size=1.5, mark=square*] coordinates (0.12,2.62);
[black] plot [only marks, mark size=1.5, mark=square*] coordinates (0.44,2.53);
[black] plot [only marks, mark size=1.5, mark=square*] coordinates (0.78,2.44);
[black] plot [only marks, mark size=1.5, mark=square*] coordinates (1.12,2.35);
[black] plot [only marks, mark size=1.5, mark=square*] coordinates (1.46,2.28);
[black] plot [only marks, mark size=1.5, mark=square*] coordinates (1.8,2.19);
[black] plot [only marks, mark size=1.5, mark=square*] coordinates (2.14,2.11);
[black] plot [only marks, mark size=1.5, mark=square*] coordinates (2.48,2.04);
[black] plot [only marks, mark size=1.5, mark=square*] coordinates (2.82,1.97);
[black] plot [only marks, mark size=1.5, mark=square*] coordinates (3.11,1.88);

(0.1,0.1+) grid (6.9,5.9+);

(0,1+) node[left] $\< w|$;
(0,2+) node[left] $\< w|$;
(-0.35,3.1+) node[left] $\vdots$;
(0,4+) node[left] $\< w|$;
(0,5+) node[left] $\< w|$;

(8.15,1+) node[left] $|e\>$;
(8.15,2+) node[left] $|e\>$;
(8.15-0.35,3.1+) node[left] $\vdots$;
(8.15,4+) node[left] $|e\>$;
(8.15,5+) node[left] $|e\>$;

(1,0+) node[below] -90$|s\>$;
(2,0+) node[below] -90$|s\>$;
(3.5,-0.15-0.25+) node[below] $\cdots\cdots$;
(5,0+) node[below] -90$|s\>$;
(6,0+) node[below] -90$|s\>$;

(1,7.15+) node[below] 90$|n\>$;
(2,7.15+) node[below] 90$|n\>$;
(3.5,7.15-0.25+) node[below] $\cdots\cdots$;
(5,7.15+) node[below] 90$|n\>$;
(6,7.15+) node[below] 90$|n\>$;

Partition function in different geometries according to the nature
of the twist.

Indeed, let us suppose that $\rank(B)=\rank(\Hat  B)=1$ and therefore that $\det(B)=\det(\Hat B)=0$.
We can then find the following bi-vector formulation,
B=|e⊗w|=∑_ijw_ie_jE_ij,  B=|n⊗s|=∑_ijn_is_jE_ij

|x=∑_i x_i |i ,   x|=∑_i x_i  i|
for arbitrary labels $x\in\{ w,e,n,s\}$ and we use the relation $|i\>\otimes \<j|=E_{ij}$ with $|i\>$ the vector with $1$ at the row $i$ and zero elsewhere, $\<j|$ is its dual and  $\<j|i\>=\delta_{ij}$.
It allows to rewrite operators
(<ref>) and (<ref>) as,

B(v)=_b(B_bT_b(v|u̅))=_bs|T_b(v|u̅)|n_b=∑_ijs_in_jt̂_ij(v) .
We recall that operators of this type arise in the modified Bethe ansatz <cit.>,
and can be seen as a null transfer matrix as $\det(B)= \det(\hat B)=0$ <cit.>. They are represented
in Figure <ref>.

(0.1,0.1) grid (6.9,1.9);
(0,1) node[left] $\<w|$;
(8,1) node[left] $|e\>$;
(-1.0,1) node[left] $B_a(u)=$ ;
(1,0) node[below] $(V_{b_1},v_{1})$;
(3.5,-0.2) node[below] $\cdots$$\cdots$$\cdots$;
(6,0) node[below] $(V_{b_{n}},v_{n})$;

(0.1,0.1) grid (1.9,5.9);
(2.5,1) node[right] $(V_{a_1},u_{1})$;
(2.5,2) node[right] $(V_{a_2},u_{2})$;
(4-0.5,3) node[right] $\vdots$;
(2.5,4) node[right] $(V_{a_{m-1}},u_{m-1})$;
(2.5,5) node[right] $(V_{a_m},u_{m})$;
(1,0) node[below] -90$|s\>$;
(1,6.75) node[below] 90$|n\>$;
(1,-1) node[below] 90$=$;
(1,-2) node[below] $\Hat B(v)$;

Modified operators when $\rank(B)=\rank(\hat B)=1$.

Note that we have the trace identity

_a(B̂_a X_a)=_as|X_a|n_a
for any matrix $X$ acting on vector space $V_a$.
Then the general partition function can be rewritten into the forms of expectation values of product of operators,

W|= w|⊗…⊗w|,   |E=|e⊗…⊗|e

S|= s|⊗…⊗s|,   |N=|n⊗…⊗|n ,
which can be interpreted as a partition function for the six vertex model
with four arbitrary walls. The form (<ref>) is suitable
to be treated within the quantum inverse scattering method and linear algebra.
For the full open case both forms are possible and there is no quantification and no Bethe equations. We will see in the next section the rational six vertex case and it's determinant representations.

§ RATIONAL SIX VERTEX MODEL CASE: AUXILIARY OPERATORS AND TRIANGULAR REPRESENTATION THEORY

All considerations so far are valid for vertex models
having an arbitrary number of states per edge. For concreteness, in the following we only consider
the symmetric (zero field) six vertex model, for with $2$ states in all edges of the lattice
and the therefore
The three possible nonzero Boltzmann weights,
called type $a$, $b$ and $c$, are represented in Figure <ref>.

(33,10)$\scriptstyle j$
(33,45)$\scriptstyle j$

(10,33)$\scriptstyle j$
(48,33)$\scriptstyle j$

(0,-10)$a$-type vertex

(33,10)$\scriptstyle j$
(33,45)$\scriptstyle j$

(10,33)$\scriptstyle k$
(48,33)$\scriptstyle k$

(0,-10)$b$-type vertex

(33,10)$\scriptstyle j$
(33,45)$\scriptstyle k$

(10,33)$\scriptstyle j$
(48,33)$\scriptstyle k$

(0,-10)$c$-type vertex

The nonzero Boltzmann weights $a$, $b$ and $c$ of the six vertex model.

The corresponding R-matrix is given by

with $I_{ab}$ the identity operator and $P_{ab}$ the permutation operator on $\CC^2\otimes \CC^2$. It is
one of the simplest solution of the Yang-Baxter equation (<ref>) and can be
used to define the Yangian $Y(gl_2)$, as we briefly recall in Appendix <ref>.

Let us introduce additional operators $A(u)$ and $D(u)$. First consider the two zero determinant 2 by 2 matrices in bi-vector form, where the notations are adopted as in (<ref>),

They satisfy $\det(A)=\det(D)=0$  by definition. Then we have the operators

Imposing the relations

which are equivalent to the constraints $\tilde a_j=w_j$ and $ d_j=e_j$, where normalizations were absorbed in the free parameters $a_j$ and $\tilde d_j$, the obtain the following exchange relations,

They directly follow from the definition of $\{A(u),D(u),B(u)\}$ as linear combinations of the
Yangian generators $t_{ij}(u)$ (see appendix <ref>), and can also be calculated directly from (<ref>) multiplying by $A_aB_b$, taking the traces over the spaces $V_a$ and $V_b$, and finally using relations (<ref>).

From linear combination of the results of  Theorem <ref>,
we can find the action of these operators on
the general states (<ref>).

We find the following action of such operators on the general states (<ref>),

A(u) |N=a_N λ_1(u)|N+c_N B(u) |N,

D(u) |N=d_N λ_2(u)|N+f_N B(u) |N,

a_N=a|σ_y|ew|n/n|σ_y|e ,  c_N=a|σ_y|n/e|σ_y|n ,  d_N=e|σ_y|nw|σ_y|d̃/w|n ,  f_N=d̃|n/w|n.

λ_1(u_j)=h(u_j,v̅) ,  λ_2(u_j)=1/g(u_j,v̅) .
Note that we have the relations

a_N+(B)c_N=(A),   d_N+(B)f_N=(D).

Similarly, for the action of such operators on the general dual states (<ref>) is given by,

S|A(u)  =a_Sλ_2(u)  S|+c_SS|B(u),

S|D(u)  =d_Sλ_1(u)  S|+f_SS|B(u) ,

a_S=a|σ_y|es|σ_y|w/s|e ,  c_S=s|a/s|e ,  d_S=s|ed̃|σ_y|w/s|σ_y|w ,  f_S=s|σ_y|d̃/s|σ_y|w.

and the relations

a_S+(B)c_S=(A) ,  d_S+(B)f_S=(D).

For further convenience, we introduce the parameter $\beta$ given by,

-(Bσ_y B̂^t σ_y )/(BB̂)

that also satisfies,
(Bσ_y B̂^t σ_y )+(BB̂)=(B)(B̂).

§ LINEAR SYSTEM AND MODIFIED IZERGIN DETERMINANT FORMULA

In this section we derive a linear system for the partition function following the method
proposed in
<cit.>. The first step is to note that the exchange relations (<ref>) imply the following
multiple actions,

A(u_i)B(u̅_i)   =   ∑_j=1^m+1f(u̅_j,u_j)/h(u_i,u_j)B(u̅_j)A(u_j) ,

D(u_i)B(u̅_i)   =   ∑_j=1^m+1f( u_j,u̅_j)/h(u_j,u_i)B(u̅_j)D(u_j) ,
for a set $\bar u=\{u_1,\dots,u_{m+1}\}$ which includes an extra parameter $u_{m+1}$.

Next, we act with (<ref>) on the general states $\{|N\>,\<S|\}$. For convenience, consider the quantities,

F_A=S|(A(u_i)- c_S B(u_i))B(u̅_i)|N ,

F_D=S|(D(u_i)- f_S B(u_i))B(u̅_i)|N,

compute the their actions to the left and to the right taking into account (<ref>,<ref>).
We obtain,

(B)/χ∑_j=1^m+1(-βλ_2(u_i)δ_ij + λ_1(u_j)f(u̅_j,u_j)/h(u_i,u_j))Z_mn(u̅_j|v̅|B|B)=Z_m+1n(u̅|v̅|B|B) ,

(B)/χ∑_j=1^m+1(λ_1(u_i) δ_ij-βλ_2(u_j)f( u_j,u̅_j)/h(u_j,u_i)) Z_mn(u̅_i|v̅|B|B)=Z_m+1n(u̅|v̅|B|B) ,
χ=1-β=(B̂)(B)/(B B̂).
In the case $m=n$ the following theorem was proven in <cit.>,

Z_n+1n(u̅|v̅|B|B)=(B)∑_j=1^n+1 g( u_j,u̅_j)λ_1( u_j)λ_2(u_j) Z_nn(u̅_j|v̅|B|B) .

Now, define a vector $\vec{X}=\left(X_1,\dots,X_{m+1}\right)^t$ with $X_j=Z_{nn}(\bar u_{j}|\bar v|B|\Hat B)$.
Using (<ref>) in (<ref>,<ref>) for $m=n$, we obtain the following homogeneous linear systems,

L_AX⃗=0,    L_DX⃗=0,

where the matrices $L_A,L_D$ with dimension $(n+1)\times (n+1)$ have entries given by
(L_A)_ij=-βλ_2(u_j)δ_ij+g(u_j,u̅_j) Y_A(u_j|u̅_i),

(L_D)_ij=λ_1(u_j)δ_ij-g(u_j,u̅_j) Y_D(u_j|u̅_i),
Y_A(u_j|u̅_i)=h̃(u_j,u̅_i)λ_1(u_j)-χλ_1(u_j)λ_2( u_j),

Y_D(u_j|u̅_i)=βh( u_j,u̅_i)λ_2(u_j) +χλ_1(u_j)λ_2( u_j).
where we used (<ref>,<ref>) for the constants.

Each homogeneous system in (<ref>) has nontrivial solution if
$\det(L_{A,D})=0$ which implies that $\rank(L_{A,D})\leq n$. To prove that the determinants
vanish, introduce the nonsingular $(n+1)\times (n+1)$ matrix $W$ with entries,
W_ij=g(u_j,u̅_j)/g(u_j,w̅_i) ,
where we introduce a new set of arbitrary pairwise distinct parameters $\bar w=\{w_1,\dots, w_{ n+1}\}$ that will be
specified later. The determinant of $W$ is given by,

(W)=Δ(u̅)/Δ(w̅),   Δ(u̅)=∏_i<jg(u_i,u_j) .
Now, define the products $\tilde L_A=WL_A$ and $\tilde L_D=WL_D$. Using the relations,
∑_k=1^n+1W_ik=1,   ∑_k=1^n+1W_ikh̃(u_j,u̅_k)=h̃(u_j,w̅_i),   ∑_k=1^n+1W_ikh(u_j,u̅_k)=h(u_j,w̅_i),
that can be proven using  contour integral for appropriate rational functions (see <cit.>),
we find,

(L̃_A)_ij   =   g(u_j,u̅_j)

(L̃_D)_ij   =   g(u_j,u̅_j)
λ_1(u_j)/g(u_j,w̅_i)-βλ_2(u_j) h(u_j,w̅_i)-χλ_1(u_j)

Let $i=n+1$. We set $w_j=v_j-c$ for $j\neq n+1$ in the $A$ system and  $w_j=v_j$ for $j\neq n+1$ in the  $D$ system. We also define $w_{n+1}=w$. Then we find, respectively,

( L̃_D)_n+1j|_w_j=v_j,w_n+1=w=g(u_j,u̅_j)λ_1(u_j)λ_2(u_j)(1-β-χ)=0,
from which follows that $\det(L_A)={ \det(L_D)}=0$.

For the other rows $1\leq i\leq n$, we have

(L̃_A)_ij=h̃(v_i,w) g(u_j,u̅_j)λ_1(u_j)λ_2(u_j)(-βg(u_j,v_i-c) +g(u_j,v_i)),

( L̃_D)_ij= g(u_j,u̅_j)/g(v_i,w)λ_1(u_j)λ_2(u_j)(-βg(u_j,v_i-c)+g(u_j,v_i)).

After renormalization with appropriate diagonal matrices,

(T̃_A)_ij= δ_ij/ h̃(v_i,w) ,   ( T̃_D)_ij= g(v_i,w) δ_ij ,

we find the same transformed linear system
for both $A$ and $D$ systems, namely,

(-β/h(u_j,v_i)+ g(u_j, v_i)).

Then, from Cramer's solution of the homogeneous linear system and  relations (<ref>)
it follows that,

Z_nn(u̅|v̅|B|B)=ϕ(v̅)_n(M)/_n(C)  .

Here $\phi(\bar v)$ is
some symmetric function in $\bar v$, and

M_ij=(L̃)^(n+1)_ijg(u_j,v̅)/g(u_j,u̅_j)=h(u_j,v̅)(-β1/h(u_j,v_i)+ g(u_j, v_i))

are the entries of the reduced matrix $(\tilde L)^{(n+1)}_{ij}$ corresponding to the matrix
$\tilde L$ with the $n+1$ row and column removed. We also introduced  a Cauchy matrix
with elements

C_ij=g(u_i,v_j) ,

that have the well known determinant,
Here $\Delta'(\bar u)=\prod_{i>j}g(u_i,u_j)$ which is similar to $\Delta(\bar u)$ in (<ref>).

We finally need to fix the normalization in $\bar v$. This is done by
comparing the asymptotic limit $\bar u\rightarrow \infty$ from the
determinant formula (<ref>) and from the definition of the partition
function (<ref>). The later follows simply from the  asymptotics of the $B(u)$ operator
due to the R-matrix (<ref>),

lim_ u →∞ B(u)    =    (u/c)^n(B)+⋯ ,

which leads to,

lim_u̅ →∞ (Z_nn(u̅|v̅|B|B)/(u̅/c^n)^n )=((B̂)(B))^n+⋯

On the other hand, we have to take the asymptotic limit on the determinant form (<ref>).
To do that we use the inverse of the Cauchy determinant, see e.g. <cit.>, given by,
C^-1_kl=g(u_l,v_k) g(v̅_k,v_k)g( u_ l,u̅_ l)/g(u̅,v_k)g( u_l,v̅),
that satisfies the following summation rules,
∑_l=1^nC^-1_ ilg(u_ l,v_j)=δ_ij,

∑_l=1^nC^-1_ il1/h(u_l,v_j)=g(v_i,v̅_i)h̃(v_j,v̅_j)/g(u̅,v_i)h(u̅,v_j)h(v_i,v_j)

It follows that (<ref>) can be put into the form,

Z_nn(u̅|v̅|B|B)= ϕ(v̅)/g(u̅,v̅)_n(-βδ_ij+ f(u̅,v_i)f(v_i,v̅_i)/h(v_i,v_j)).

Then, we can take the infinite limit for the set $\bar u$ and find
lim_u̅ →∞ Z/(u̅/c^n)^n=ϕ(v̅) _n ( -βδ_ij+f(v_j,v̅_j)/h(v_i,v_j))+⋯
It follows from (<ref>) and Lemma 4.1 in <cit.>, namely, the identity

p ),

where the sum is over partition of the set $\bar u$ into two sets $\{\bar u_{\qo},\bar u_{\qt}\}$ with fixed size  $\bar u_{\qo}=p$, $\bar u_{\qt}=n-p$. From Newton binomial formula it follows

lim_u̅ →∞ Z/(u̅/c^n)^n=ϕ(v̅)χ^n+⋯ .

Comparing (<ref>) with (<ref>) we find,

ϕ(v̅) =((B̂)(B)/χ)^n,

that leads to

where $K^{(\beta)}_{nn}$ is the modified Izergin determinant (<ref>) for $m=n$, with $\lambda_2(\bar u)=(g(\bar u, \bar v))^{-1}$.

Finally, using the limits of the modified Izergin determinant in Proposition (<ref>), the formula
(<ref>) can be extended for values of $m\neq n$. For $m>n$, we use the limit (<ref>)
to eliminate one $v_j$, while for $n>m$ we use the limit (<ref>) one $u_j$. Comparing with operator
form (<ref>), we can find the general case $m,n$,

Z_mn(u̅|v̅|B|B)=(B)^m (B̂)^n/χ^nλ_2(u̅)K^(β)_mn(u̅|v̅),
that can be expressed
in two possibles forms,
Z_mn(u̅|v̅|B|B)=(B)^m (B̂)^n/χ^n λ_2(u̅)_n(-βδ_jk+f(,v_j)f(v_j,_j)/h(v_j,v_k)),

Z_mn(u̅|v̅|B|B)=(B)^m (B̂)^n/χ^mλ_2(u̅)_m(δ_jkf(u_j,)-βf(u_j,_j)/h(u_j,u_k)).

Furthermore, due to the properties of the modified Izergin determinant
in Proposition (<ref>),
we have the additional presentations as sum over partitions of the set $\bar v$,

(B)^m (B̂)^n/χ^n λ_2(u̅) ∑_⇒{_,_}(-β)^#_ f(,_)f(_,_).

or over the set $\bar u$,
(B)^m (B̂)^n/χ^mλ_2(u̅) ∑_⇒{_,_}(-β)^#_ f(_,)f(_,_).

§ CONCLUSION

Using the triangular representation theory of the modified operators (<ref>,<ref>)
together with the exchange relations <ref>, we found linear systems
that characterize, up to normalization, the partition function of the inhomogeneous rational six vertex model
on the rectangular lattice with two arbitrary twists $\{B,\hat B\}$ of rank $\rank(B)=\rank(\hat B)=1$.
Due to symmetry, only one of the eight generic boundary parameters associated
with the compass states (<ref>) is free, that is, the partition function can be written
solely in terms of the parameter $\beta$, up to normalization by $\tr(B)^m\tr(\hat B)^n$.

The solution of the linear system and therefore the partition function on the rectangular lattice is given by a modified Izergin determinant (<ref>).
For specific
values of the parameters,
one can recover known examples in the literature, for example, the partial domain wall partition function <cit.> or the Izergin-Korepin determinant ($m=n$,  $s_1=0,s_2=1,e_1=0,e_2=1$ and $n_1=1,n_2=0,w_1=1,w_2=0$) <cit.>.

For future problems, it is interesting to consider the linear system approach to the computation
of the partition function of the six vertex model with reflecting boundary conditions,
related to the reflection algebra <cit.>, which has been
extensively studied <cit.>. Also in
this context, the linear system approach
may find applications in the connection between certain scalar products of modified Bethe states
and q-Racah polynomials <cit.>.

Another intriguing problem is to study the trigonometric six vertex model (associated with
the XXZ chain) under anti-periodic boundary conditions.
The first step here would be to find appropriate modified operators and
off-shell relations, which are not yet known for this model, despite recent developments
<cit.> and references

It is also important to investigate higher rank vertex models, initially those based
on the $sl(n)$ algebra <cit.>. In this case, the off-shell relations
and, therefore, the associated linear systems
are more intricate (see <cit.>).

§ ACKNOWLEDGEMENTS
S.B.  thanks F. Levkovich-Maslyuk, R. Frassek, J. Jacobsen, V. Pasquier, D. Serban,  V. Terras for discussions. R.A.P. thanks R. Frassek for discussions and acknowledges support by the
German Research Council (DFG) via the Research Unit FOR

§ BASICS ABOUT THE YANGIAN  $Y(GL_2)$

In this appendix, we review some basic facts about the Yangian of $gl_2$ denoted $Y(gl_2)$ (see
e.g. the
monograph <cit.> for details), as formulated in the quantum inverse scattering method. Introduce the monodromy matrix

T(u)=( t_11(u)    t_12(u)
t_21(u)   t_22(u)),
whose elements are given by the formal series in $u$,
where $t_{ij}^{(r)}$ are the generators of the Yangian $Y(gl_2)$ subject to
the defining RTT relations

R_ab(u-v)T_a(u)T_b(v)= T_b(v)T_a(u)R_ab(u-v),
$R$ is
the six vertex R-matrix (<ref>). They encode
exchange relations for the elements $t_{ij}(u)$, for instance,
t_11(u)t_12(v)   =   f(v,u)t_12(v)t_11(u)+g(u,v)t_12(u)t_11(v),

t_22(u)t_12(v)   =   f(u,v)t_12(v)t_22(u)+g(v,u)t_12(u)t_22(v),

t_12(u)t_12(v)   =   t_12(v)t_12(u),
where the rational functions $f,g$ in the formal variables $u,v$ are given by (<ref>).

Let us note that (<ref>) can be rewritten as

[T_a(u),T_b(v)]= g(v,u)P_ab(T_a(u)T_b(v)-T_a(v)T_b(u)).

We consider finite dimensional representations of the Yangian
<cit.> from (<ref>). Highest and lowest weight representations can be respectively constructed
from vectors $|0\>$ and $|\hat 0\>$ with actions,

λ_1(u)     t_12(u)

0     λ_2(u)      )_a|0,

λ_2(u)     0

t_21(u)     λ_1(u)      )_a|0̂.

The dual analogs $\<0|$ and $\<\hat 0|$ have actions,

λ_1(u)     0

t_21(u)     λ_2(u)      )_a,

λ_2(u)     t_12(u)

0     λ_1(u)      )_a.

In particular, for the $6$ vertex case, we have the highest and lowest vectors,
|0   =   ⊗_j=1^n(  1
0),  0|=⊗_j=1^n(  1,     0),

|0̂   =   ⊗_j=1^n(  0
0̂|=⊗_j=1^n(  0,     1),
and the weight functions $\lambda_i(u)$ are given by (<ref>).

The following theorem provides the modified version of the actions

The action of the entries of the monodromy matrix on an arbitrary vector

|X=|x⊗…⊗|x,   with   |x=(  x_1

with $x_1\neq 0$
are given by

t_11(u) |X=λ_1(u) |X-x_2/x_1 t_12(u) |X,

t_22(u) |X=λ_2(u) |X+x_2/x_1 t_12(u) |X,

t_21(u) |X=x_2/x_1(λ_1(u)-λ_2(u) )|X -(x_2/x_1)^2t_12(u) |X,

and with $x_2\neq 0$
are given by
t_11(u) |X=λ_2(u) |X+x_1/x_2 t_21(u) |X,

t_22(u) |X=λ_1(u) |X-x_1/x_2 t_21(u) |X,

t_12(u) |X=x_1/x_2(λ_ 1(u)-λ_ 2(u) )|X -(x_1/x_2)^2t_21(u) |X.

Similarly, we can find the action on the dual vector

X|= x|⊗…⊗x|,    with   x|=( x_1,    x_2),

with $x_1\neq 0$

X|t_11(u) =λ_1(u) X|-x_2/x_1X| t_21(u) ,

X|t_22(u) =λ_2(u) X|+x_2/x_1 X|t_21(u),

X|t_12(u) =x_2/x_1(λ_1(u)-λ_2(u) )X|-(x_2/x_1)^2X|t_21(u),
with $x_2\neq 0$

X|t_11(u) =λ_2(u) X| +x_1/x_2X| t_12(u),

X|t_22(u) =λ_1(u) X| -x_1/x_2 X|t_12(u) ,

X|t_21(u) =x_1/x_2(λ_ 1(u)-λ_2(u) )X|-(x_1/x_2)^2X|t_12(u).

These relations can be proven in the following way. Let us introduce an invertible matrix $X$ such that $X|0\>= |x\>$ with the form,
X=( x_1     α
x_2     β ).

Then due to the $gl(2)$ invariance of the Yangian we have $[T_a(u),X_a\prod_{i=1}^nX_{b_i}]=0$ and it follows that,

T_a(u)|X   =   T_a(u)(∏_i=1^nX_b_i)|0=T_a(u)X_a(∏_i=1^nX_b_i)(X_a)^-1|0

=   X_a(∏_i=1^nX_b_i)T_a(u)|0(X_a)^-1.
From the representation theory of the Yangian (<ref>,<ref>), we have,
λ_1(u)    0

0     λ_2(u)      )_a|0+(
0   1

0    0    )_a t_12(u)|0.

It follows that,

T_a(u)|X   =   Λ_a(u)|X+E_a (∏_i=1^NX_b_i)t_12(u)|0,
(X)Λ_a(u)   =   X_a(
λ_1(u)    0

0     λ_2(u)      )_a(X_a)^-1

=   (
x_1 βλ_1(u)-  x_2 αλ_2(u)        -x_ 1 α( λ_1(u)- λ_2(u) )

x_2 β( λ_1(u)- λ_2(u)  )      x_1 βλ_2(u)-  x_2 αλ_1(u)    )_a,
(X)E_a   =   X_a(
0   1

0    0    )_a(X_a)^-1=(
- x_1  x_2        (x_1)^2

-(x_2)^2       x_1 x_2  )_a .
Then after some linear algebra we express $\big(\prod_{i=1}^NX_{b_i}\big)t_{12}(u)|0\>$ in terms of $t_{12}(u)|X\>$ and $|X\>$ we find the desired actions. The left actions can be proven similarly and
we omit it here.

§ MODIFIED IZERGIN DETERMINANT

We recall some basic properties of the modified Izergin determinant (see <cit.> for more details).

The modified Izergin determinant can be defined as follows.

Let $\bu=\{u_1,\dots,u_m\}$,  $\bv=\{v_1,\dots,v_n\}$ and $z$ be a complex number.
Then  the modified Izergin determinant $K_{mn}^{(z)}(\bu|\bv)$
is defined by

Alternatively the modified Izergin determinant can be presented as

The proof of the equivalence of representations (<ref>) and (<ref>) can be found in <cit.>.

In the particular case $z=1$ and $\#\bu=\#\bv=n$, the modified Izergin determinant
turns into the ordinary Izergin determinant, that we traditionally denote by $K_{n}(\bu|\bv)$,

It also follows
from (<ref>) that

K_mn^(1)(|)=0,    for     m<n.

Additional properties of the modified Izergin determinant needed here are given in the following propositions.

We have the limits,

We have the sum formulation,
K_mn^(z)(|)=∑_⇒{_,_}(-z)^#_ f(,_)f(_,_),

where the sum is taken over all partitions $\bv\Rightarrow\{\bv_{\so},\bv_{\st}\}$, and

K_m,n^(z)(|)=(1-z)^n-m∑_⇒{_,_}(-z)^#_ f(_,)f(_,_),

where the sum is taken over all partitions $\bu\Rightarrow\{\bu_{\so},\bu_{\st}\}$.

Missing 'biblatex' package
The bibliography requires the 'biblatex' package.

World Scientific

booktitleSeries on Advances in Statistical Mechanics
titleExactly Solved Models in Statistical Mechanics

* Invalid format of field 'month'

SIGMA (Symmetry, Integrability
Geometry: Methods

titleSlavnov and Gaudin-Korepin Formulas for Models without U(1)
Symmetry: the Twisted XXX Chain

* Invalid format of field 'month'

IOP Publishing

titleThe q-Racah polynomials from scalar products of Bethe states
journaltitleJ. Phys. A: Math. Theo.

* Invalid format of field 'month'

titleHighest coefficient of scalar products in SU(3)-invariant
integrable models
journaltitleJ. Stat. Mech.

titleBethe vectors of GL(3)-invariant integrable models
journaltitleJ. Stat. Mech.

IOP Publishing

titleScalar product for the XXZ spin chain with general
integrable boundaries
journaltitleJ. Phys. A: Math. Theo.

* Invalid format of field 'month'

titleA note on $\mathfrak{gl}_2$-invariant Bethe vectors

titleWhy scalar products in the algebraic Bethe ansatz have
determinant representation

SIGMA (Symmetry, Integrability
Geometry: Methods

titleScalar Products in Twisted XXX Spin Chain. Determinant

* Invalid format of field 'month'

Pleiades Publishing Ltd

titleOverlap between usual and modified Bethe vectors
journaltitleTheo. Math. Phys.

titleScalar product of twisted XXX modified Bethe vectors
journaltitleJ. Stat. Mech.

SIGMA (Symmetry, Integrability
Geometry: Methods

titleModified Algebraic Bethe Ansatz: Twisted XXX Case

* Invalid format of field 'month'

titleA Guide to Quantum Groups

titlePartition function of the trigonometric SOS model with
reflecting end
journaltitleJ. Stat. Mech.

titlePartial domain wall partition functions

titleOverlaps of partial Néel states and Bethe states

IOP Publishing

titleFunctional relations for the six-vertex model with domain
wall boundary conditions

* Invalid format of field 'month'

Masson, Paris

noteThe Bethe Wavefunction (translation by J.-S. Caux),
Cambridge University Press, 2014.
titleLa fonction d'onde de Bethe

titleSpectrum of Quantum Transfer Matrices via Classical
Many-Body Systems

Springer Science
Business Media LLC

titleExact results for the six-vertex model with domain wall
boundary conditions and a partially reflecting end
journaltitleLett. Math. Phys.

* Invalid format of field 'month'

titlePartition function of the six-vertex model in a finite
journaltitleSov. Phys. Dokl.

Cambridge University Press

titleQuantum Inverse Scattering Method and Correlation Functions

* Invalid format of field 'month'

Springer Science
Business Media LLC

titleCalculation of norms of Bethe wave functions
journaltitleComm. Math. Phys.

* Invalid format of field 'month'

SIGMA (Symmetry, Integrability
Geometry: Methods

titleThe Functional Method for the Domain-Wall Partition Function

* Invalid format of field 'month'

American Physical Society (APS)

titleResidual Entropy of Square Ice
journaltitlePhys. Rev.

* Invalid format of field 'month'

titleOn Bethe vectors in $\mathfrak{gl}_3$-invariant integrable

American Mathematical Society

titleYangians and Classical Lie Algebras

* Invalid format of field 'month'

IOP Publishing

titleConstruction of determinants for the six-vertex model with
domain wall boundary conditions
journaltitleJ. Phys. A: Math. Theo.

* Invalid format of field 'month'

titleAntiperiodic XXZ chains with arbitrary spins: Complete
eigenstate construction by functional equations in separation of variables
journaltitleLett. Math. Phys.

American Physical Society (APS)

titleCrystal Statistics. I. A Two-Dimensional Model with an
Order-Disorder Transition
journaltitlePhys. Rev.

* Invalid format of field 'month'

Springer Science
Business Media LLC

titleCalculation of the norm of bethe vectors in models with
journaltitleJ. Sov. Math.

* Invalid format of field 'month'

IOP Publishing

titleBoundary conditions for integrable quantum systems
journaltitleJ. Phys. A: Math. Gen.

* Invalid format of field 'month'

World Scientific

titleAlgebraic Bethe Ansatz and Correlation Functions An Advanced

Springer Science
Business Media LLC

titleIzergin-Korepin Determinant at a Third Root of Unity
journaltitleTheo. Math. Phys.

* Invalid format of field 'month'

titleScalar products of Bethe vectors in the 8-vertex model

Springer Science
Business Media LLC

titleIrreducible monodromy matrices for the R matrix of the XXZ
model and local lattice quantum Hamiltonians
journaltitleTheo. Math. Phys.

* Invalid format of field 'month'

AIP Publishing

titleDeterminant formula for the six-vertex model with reflecting
journaltitleJ. Math. Phys.

* Invalid format of field 'month'

Springer Berlin Heidelberg

titleOff-Diagonal Bethe Ansatz for Exactly Solvable Models

titleRetrieve the Bethe states of quantum integrable models
solved via off-diagonal Bethe Ansatz
journaltitleJ. Stat. Mech.