# Protecting Anonymous Speech: A Generative Adversarial Network Methodology
for Removing Stylistic Indicators in Text

Rishi Balakrishnan, Stephen Sloan, Anil Aswani

###### Abstract

With Internet users constantly leaving a trail of text, whether through blogs,
emails, or social media posts, the ability to write and protest anonymously is
being eroded because artificial intelligence, when given a sample of previous
work, can match text with its author out of hundreds of possible candidates.
Existing approaches to authorship anonymization, also known as authorship
obfuscation, often focus on protecting binary demographic attributes rather
than identity as a whole. Even those that do focus on obfuscating identity
require manual feedback, lose the coherence of the original sentence, or only
perform well given a limited subset of authors. In this paper, we develop a
new approach to authorship anonymization by constructing a generative
adversarial network that protects identity and optimizes for three different
losses corresponding to anonymity, fluency, and content preservation. Our
fully automatic method achieves comparable results to other methods in terms
of content preservation and fluency, but greatly outperforms baselines in
regards to anonymization. Moreover, our approach is able to generalize well to
an open-set context and anonymize sentences from authors it has not
encountered before.

> ## Introduction

Stylometric authorship attribution attempts to identify the author or
attributes of the author of a given piece of text. Stylometry uses features
such as frequency of words or words per sentence, and first found success in
authorship attribution for the Federalist Papers (Mosteller and Wallace 1963).
Stylometric methods originally had to be done manually, but can now be
automated using machine learning. Stylometric analysis was also successfully
used to help identify J.K. Rowling as the author of _A Cuckoo’s Calling_ ,
which she wrote under a pseudonym (Juola 2013). Similar methods were used to
identify some of Shakespeare’s coauthors (Irving 2016). At the larger scale,
Narayanan et al. (2012) were able to use stylometry to successfully identify
the author of a piece of text from a set of 100,000 authors with 20% accuracy.
Islam et al. (2015) were even able to identify the author of code from their
coding styles. Furthermore, Afroz, Brennan, and Greenstadt (2012) show that it
is possible to identify when an author is manually trying to change their own
writing style, meaning this is not a possible method for evading authorship
attribution in the long run.

The success of stylometric authorship attribution methods poses a problem for
authors who wish to publish anonymously, damaging free speech and civil
liberties (Williams 2017). The increased usage of services like Tor in
oppressive regimes because of the fear of identification demonstrates the need
for privacy in political discourse (Jardine 2018). Even in democracies,
political dissidents may depend on anonymity to expose government malfeasance
to the public. A recent example of this is a 2018 memo published by an
(anonymous at the time of publication) official in the Trump administration
(Anonymous 2018). After publication, leading experts in linguistics received
several requests to use stylometric techniques to identify the author
(Borenstein 2018). An FBI report details “a growing need to identify writers
not by their written script, but by analysis of the typed content” (Perlroth
2012), and work like (Sundararajan 2018) argues that stylometry should be used
as a biometric trait, especially in combination with other data like
keystrokes. Taken together, the usage of stylometric techniques to identify
authorship will only increase, which creates a need for systems to protect
whistleblowers and political dissidents through anonymizing their written
content.

Our Contributions We make two major contributions to the field of authorship
obfuscation: 1) We develop an adversarial method where the discriminator
better captures style, enabling better anonymization than previous methods and
2) To the best of our knowledge, we provide the first authorship-based
anonymization framework that aims to obfuscate authorship in an open-set
context. Our experiments prove that empirically our model generalizes well to
provide anonymity for unseen authors against unseen classifiers.

## Related Work

Generative Adversarial Networks A Generative Adversarial Network (GAN) is a
machine learning framework that usually has two models competing against each
other (Goodfellow et al. 2014). In the traditional formulation, the generator
$G$ takes in random (usually Gaussian) noise $z\sim Normal(0,1)$ and outputs
$G(z)$. The discriminator $D$ learns to distinguish between real samples $x$
and generated samples $G(z)$ and the generator learns to output samples as
close to the real data distribution as possible, with the generator and
discriminator playing a min-max game of the form

$\min\max\mathbb{E}_{z}[\log D(G(z))]+\mathbb{E}_{x}\log(1-D(x))]$ (1)

However, adversarial training has proven tricky with common issues being mode
collapse and non-convergence (Salimans et al. 2016). Mode collapse occurs when
the generator finds a particular output for which the discriminator
misclassifies samples and exclusively produces that output. The most prominent
methods proposed to solve these training issues include the Wasserstein GAN,
which changes the traditional GAN objective function from Jensen-Shannon
divergence to Earth Mover’s Distance (Arjovsky, Chintala, and Bottou 2017)

$\min\max\mathbb{E}_{z}[D(G(z))]-\mathbb{E}_{x}[D(x)]$ (2)

These GAN’s use either gradient penalties (Gulrajani et al. 2017) or weight-
clipping (Arjovsky, Chintala, and Bottou 2017) to impose a 1-Lipschitz
constraint on the discriminator training, which helps the generator smoothly
learn the distribution of the real data. Due to this and other training
advancements, GAN’s have found widespread adoption within computer vision,
including applications in conditional image generation (Odena, Olah, and
Shlens 2017), 3D object modeling (Wu et al. 2016), and image style transfer
(Zhang, Cai, and Zhang 2017).

Unfortunately, the discrete nature of text complicates GAN usage within
natural language processing tasks. Selecting discrete text tokens from the
generator output makes backpropagating gradients from the discriminator to the
generator difficult. Because of this, gradient-estimation methods like
REINFORCE (Williams 2004) and Gumbel Softmax (Maddison, Mnih, and Teh 2016;
Jang, Gu, and Poole 2017) have gained popularity. REINFORCE combines
techniques inspired from reinforcement learning with GAN’s, using the policy-
gradient technique to train the generator. The REINFORCE method has been used
to train text GAN’s including LeakGAN (Guo et al. 2017), MaskGAN (Fedus,
Goodfellow, and Dai 2018), and SeqGAN (Yu et al. 2016). In contrast, the
Gumbel Softmax technique adds noise sampled from the Gumbel distribution to
the output logits and then applies a softmax operation with temperature $\tau$
to the result. As $\tau$ decreases, the softmax output becomes more one-hot.
This method offers a continuous relaxation of the discrete probabilities
output by a model, which allows gradients to backpropagate through a discrete
sample.

Siamese Networks Siamese discriminators first found success in signature
verification (Bromley et al. 1993), where they took in images of two
signatures and determined whether they originated from the same person. They
have later been applied to various tasks, including facial recognition
(Taigman et al. 2014), object tracking (He et al. 2018), and one shot image
recognition (Koch 2015). Siamese networks are usually structured as two
subnets which share the same parameters and weight updates. When given two
inputs, each subnet outputs an embedding for its respective input. A distance
metric (e.g., L2 distance or cosine similarity) then compares the two
embeddings to determine whether the two inputs are from the same class or not.
As a result, the network learns to cluster similar samples close together and
dissimilar inputs far apart. Siamese networks offer powerful opportunities for
generalizable classification, because when the network is used in a
classification setting, given an example of a new target class, the network
can determine whether inputs belong to that class or not.

Authorship Attribution and Verification The field of authorship attribution
stretches back to before the advent of most machine learning methods. Early
work aimed to use statistical features of written text, including word and
n-gram frequency, sentence length, punctuation, etc. to identify the author
(McDonald et al. 2012). However, modern natural language processing techniques
have shifted authorship attribution methods to take in raw text rather than
pre-computed features of the raw text. Recent work uses character-level and
word-level convolutional neural networks (CNN’s) (Ruder, Ghaffari, and Breslin
2016) or multi-headed recurrent neural networks (RNN’s) (Shetty, Schiele, and
Fritz 2017) for authorship attribution, which achieve significant improvements
over non-deep learning methods including support vector machines (SVM’s) and
linear discriminant anaysis (LDA) modelling.

An alternate approach to authorship attribution is authorship verification.
This approach instead aims to embed the stylistic components of text into a
vector and determine whether two pieces of text are written by the same
author. Therefore, it can also be used in a classification setting by
assigning authorship based on similarity between the sampled text and text
with known authorship. For example, (Rao and Rohatgi 2000) use Siamese
networks to verify if two pieces of text share the same author.

Figure 1: Network Diagram

Authorship Anonymization Initial efforts to conceal authorship largely focused
on rule-based and manual interventions to modify authors’ styles. Anonymouth
(McDonald et al. 2012) was an open-source platform released that suggests
changes to users based on features like word and character counts, average
syllables per word, sentence length, and readability scores. However, these
suggested transformations are heavily dependent on the dataset the tool uses,
which limits the tool’s usefulness. A simple approach is round-trip
translation (Rao and Rohatgi 2000; Keswani et al. 2016), where, for example,
an English input text is translated into several other languages then finally
translated back into English. However, these methods depend on inaccuracies or
distortions introduced by the translation software, and even with distortions,
authorship attribution systems were able to identify the original authors with
high accuracy (Caliskan and Greenstadt 2012).

Modern work approaches anonymization in one of two ways – imitation or
obfuscation. Imitation conceals an author’s identity by mimicking another
author’s style, while obfuscation masks stylistic indicators as a whole (i.e.,
to reduce the accuracy of a classifier to chance level). Anonymization work
related to imitation mirrors work in the related field of text style transfer.
The authors of (Shetty, Schiele, and Fritz 2017) design a system to hide
binary demographic attributes, like age or gender, through imitation. Their
model consists of an encoder-decoder network to generate text, back-
translation loss to preserve content, and style classifiers to distinguish
between real and generated sentences. This system, however, protects only one
binary demographic attribute rather than the whole identity, and can only
protect that binary attribute if it had been trained to do so. As a result,
obfuscation approaches to anonymization should be preferred. Mahmood et al.
(2019) use genetic algorithms to anonymize sentences, iteratively changing
sentences until a classifier is fooled. This approach, however, only works
against a known adversary. Deep learning approaches to authorship obfuscation
include work such as (Bo et al. 2019) which designs an authorship
anonymization system using techniques from differential privacy. Emmery,
Manjavacas Arevalo, and Chrupała (2018) use a gradient reversal layer between
sentence embedding and authorship classifier in order to make text style-
invariant. They demonstrate the promise of machine learning methods in
anonymization by obfuscation, but similar to (Mahmood et al. 2019), the method
is only trained on a limited set of 5 authors.

## Methodology

Our Approach The stylometric approach to authorship attribution depends on the
assumption that style can be modeled as a probability distribution. Indeed,
some work in linguistics defines style as intentional overuse of certain
linguistic features and norms (Mahlberg 2013) in expressing the same content.
This means we can define style as the way that individual authors choose to
express the same content, and that there exists a style-neutral expression of
that same content – the one that most closely adheres to linguistic norms.
Thus, the purpose of any obfuscation system is to learn a many-to-one mapping
that transforms a sentence from an author’s style to the style-neutral version
while retaining the same content.

A survey of previous work within stylometry and authorship attribution
explored the use of different features in their ability to predict authorship,
including word and n-gram frequency, sentence length and structure, syntax,
parts-of-speech usage, and rhythm, among others (Lagutina et al. 2019). The
survey concluded that n-gram, character, and word frequency were the features
most salient to authorship attribution, because these features (n-grams
especially) automatically capture many other relevant parts of text, including
punctuation and morphology. These observations shape our approach in two ways:
1) we focus primarily on word and n-gram level changes (instead of features
like sentence structure) to thwart authorship attribution systems and 2) we
anonymize text on a sentence-level rather than on the level of a paragraph or
document because the relationship between different sentences and paragraphs
is viewed as secondary.

Network Structure The network we employ in this model is structured according
to Figure 1. There are two components to the Transformer language model. The
Transformer encoder first captures the content of a sentence and embeds it
into a vector, and then the decoder auto-regressively generates output tokens
in a style-neutral fashion. As well as being used in the final anonymized
input, each generated token is fed into a fluency discriminator which creates
the fluency loss by judging how likely each token is to be from a real
sentence. Text is generated until a maximum sequence length, and is then fed
into the Siamese discriminator along with a second sentence, and the
discriminator determines how likely it is that both sentences are from the
same author. This likelihood becomes the style loss for the generator.
Finally, both the anonymized and original sentences are fed into the mechanism
that we use to generate the content loss, which we discuss below.

Style Discriminator We employ a Siamese network as the primary discriminator
for the GAN. The function of the discriminator is authorship verification –
taking in two pieces of text and identifying whether they are by the same
author. We select an authorship-verification approach for the discriminator
over an authorship-classification approach for two reasons. First,
anonymization with a classification model as the adversary may not generalize
to authors outside the training set. Daelemans (2013) uses the analogy of
fruit classification to explain: color helps differentiate apples from
bananas, but if a model based on color is then used to distinguish pears and
lemons, it will fail. Instead, if the generator learns to anonymize sentences
from a discriminator that embeds the sentence style as a whole, it will likely
be able to generalize better. Second, because this approach requires capturing
style as a whole rather than learning features specific to authors, the
discriminator’s task becomes more difficult. This stabilizes GAN training – an
overly easy task for the discriminator leads to high discriminator accuracy
and vanishing gradients, preventing the generator from learning (Arjovsky and
Bottou 2017).

For the model architecture itself, we use stacked ResNet blocks with
convolutional layers (He et al. 2015). CNN-based architectures have proven
effective at natural language tasks including sentiment analysis and question
classification (Kim 2014). The authors of (Saedi and Dras 2019) design a
Siamese network for authorship classification and verification using stacked
convolutional layers, outperforming previous authorship verification methods
and achieving comparable results on n-way classification to other baselines.
The convolutional layers of the discriminator as well as the residual
connections within each ResNet block allow easy backpropagation of gradients
and prevent vanishing gradients.

We structure the GAN network as a Wasserstein GAN with Gradient Penalty (WGAN-
GP). The central innovation of the WGAN is conceptualizing the discriminator
as a 1-Lipschitz function, which has gradients whose norms are less than 1,
which helps stabilize training by preventing the discriminator from learning
too quickly. The original paper with Wasserstein GAN uses weight clipping to
enforce the Lipschitz constraint, but work presented in (Gulrajani et al.
2017) that improves WGAN performance uses a gradient penalty to softly enforce
that gradients are near 1. To calculate the gradient penalty, the original
input is interpolated with the anonymized output

$\hat{x}=a_{int}x+(1-a_{int})G(x)$

for some $a_{int}\in[0,1]$ and then fed into the discriminator to calculate
the norm of the discriminator gradients. As a result, the loss function for
the style discriminator is

$\begin{split}L_{sty}&=-\mathbb{E}_{x_{1},x_{2}\sim
p(a_{i})}[D_{sty}(G(x_{1}),x_{2})]\\\ &+\mathbb{E}_{x_{1}\sim a_{i},x_{2}\sim
a_{j},j\neq i}[D_{sty}(x_{1},x_{2})]\\\
&+\lambda(||\nabla_{\hat{x}}D_{sty}(\hat{x})||_{2}-1)^{2}\end{split}$ (3)

Fluency The simplest method for the generator to fool the discriminator is to
output broken sentences whose style cannot be deciphered by the discriminator.
To ensure the fluency of generator outputs, we employ a discriminator to
distinguish between real and generated sentences. However, as (Yang et al.
2018) explain, the error signal from using a classifier to evaluate the
fluency of the entire sentence is often too weak to force the generator to
create fluent outputs. Instead, their approach uses a language model to
provide token-level feedback at every step of the generator output. While the
task in (Yang et al. 2018) is text style transfer, we draw inspiration from
their method and feed the output of the generator at each time step into a
one-layer Gated Recurrent Unit (GRU) RNN discriminator, generating a score for
every word. Given generator pre-training (which is explained shortly), the
initial outputs of the generator during training are fluent. As a result, the
purpose of the fluency loss is not to provide a distribution that the
generator has to learn but rather to guide the generator to stay fluent
throughout training. As a result, we do not impose the gradient penalty on the
fluency discriminator during training. Therefore, the loss function for the
training of the fluency discriminator is

$L_{fl}=-\mathbb{E}_{x}[D_{fl}(G(x))]+\mathbb{E}_{x}[D_{fl}(x)]$

Content

Figure 2: Content Loss Generation

Similar to the smoothing loss, our content preservation approach provides
near-token level feedback to the generator, as detailed in Figure 2. We embed
both the input and the output of the generator using FastText embeddings, and
then use an Average Pooling layer to generate vectors for both embeddings
given a pool size and stride. These vectors are then compared using cosine
similarity and the mean is taken to generate a score of how consistent the
content of the generated sentence is with the original. We denote the final
content loss as $L_{con}$, and because higher values for cosine similarity are
better, we minimize $-L_{con}$. In practice, we note that providing this token
or near-token level feedback to the generator for both fluency and content
preservation also helps prevent mode collapse.

Generator For the generator, we use the vanilla Transformer model with self-
attention as discussed in (Vaswani et al. 2017). Transformers have
demonstrated the ability to capture long-term dependencies better than their
alternatives like RNN’s. The Transformer model consists of both an encoder and
decoder, which embeds the original sentence and generates tokens respectively.
Both the encoder and decoder have 4 stacked Transformer blocks, which consist
of multi-head attention – which determines the most relevant parts of the
original sentence – as well as fully-connected layers and layer normalization.
Additionally, the decoder employs self-attention, looking at previously
generated tokens to determine the next one. Each Transformer block also
employs residual connections to help gradients flow easily.

In text GAN’s, generators are often pre-trained using maximum likelihood
estimation (MLE) and teacher forcing. Teacher forcing feeds the model with the
ground truth sequence at every time step instead of using previous
predictions. While effective during training, this creates a discrepancy
between training and inference time when the Transformer must generate the
entire sentence itself (Bengio et al. 2015), and this discrepancy degrades
performance at inference time. To correct this, we employ scheduled sampling
as described in (Zhang et al. 2019b), where instead of only feeding in the
ground truth sequence, certain time steps sample the previous output of the
generator instead, with the sampling rate increasing during training.

For the adversarial training, we combine weighted style, fluency, and content
losses to create the objective function of the generator

$\begin{split}L_{G}&=a_{sty}\mathbb{E}_{x_{1},x_{2}\sim
a_{i}}[D_{sty}(G(x_{1}),x_{2})]\\\
&+a_{fl}\mathbb{E}_{x}[D_{fl}(G(x))]-a_{con}L_{con}\end{split}$ (4)

Training To ensure that the tokens from the generator are still
differentiable, we employ the Gumbel Softmax technique instead of REINFORCE,
because the REINFORCE method generates gradients that have much higher
variance than those created by the Gumbel Softmax (Maddison, Mnih, and Teh
2016). Specifically, we use the Gumbel-Softmax straight-through trick, where
the token with the maximum probability is selected in the forward pass, but
the gradients from the Gumbel Softmax are used in the backward pass.

Additionally, because learning word similarities and associations becomes
difficult given a limited corpus and our approach to anonymization largely
depends on rephrasing and word replacement, FastText embeddings pretrained on
the Common Crawl dataset (Mikolov et al. 2017) are used for the model and kept
static throughout training. Because of the importance of n-grams in author
identification, we also employ Wordpiece Tokenization (Schuster and Nakajima
2012), which breaks down a word into the most common subword units and ensures
that every word can be tokenized. This also means that the FastText embeddings
used are sub-word rather than word embeddings.

For the model training, we follow the Two Time Update Rule in (Heusel et al.
2017), which proves that when using the Adam optimizer with a higher learning
rate for the discriminator than the generator, the GAN is likely to converge
to a local Nash equilibrium. (Heusel et al. 2017) recommends that for a WGAN-
GP model trained on text, the discriminator and generator should be trained in
an alternating fashion, with one epoch for the discriminator and then one
epoch for the generator. We also note that in practice, performing model
updates for the fluency discriminator as well as the generator in the same
step helps catch mode collapse early, so weight updates to the style
discriminator occur simultaneously with weight updates to the generator.

| Content Preservation | Fluency | Anonymity
---|---|---|---
| BLEU$\uparrow$ | BERTScore$\uparrow$ | PPL$\downarrow$ | RNN$\downarrow$ | CNN$\downarrow$ | Transformer$\downarrow$
Original | N/A | N/A | 5.71$\pm$0.009 | 0.42$\pm$0.018 | 0.47$\pm$0.014 | 0.49$\pm$0.015
WordNet | 0.87$\pm$0.001 | 0.99$\pm$0.000 | 6.73$\pm$0.012 | 0.35$\pm$0.015 | 0.36$\pm$0.011 | 0.38$\pm$0.013
Roundtrip | 0.20$\pm$0.001 | 0.93$\pm$0.000 | 6.27$\pm$0.017 | 0.30$\pm$0.016 | 0.27$\pm$0.012 | 0.32$\pm$0.014
Mutant-X | 0.93$\pm$0.003 | 0.99$\pm$0.000 | 6.17$\pm$0.038 | 0.36$\pm$0.018 | 0.38$\pm$0.017 | 0.39$\pm$0.016
Ours | 0.61$\pm$0.002 | 0.93$\pm$0.000 | 6.98$\pm$0.011 | 0.18$\pm$0.014 | 0.19$\pm$0.012 | 0.21$\pm$0.015
Table 1: Results for closed-set evaluation are reported as mean $\pm$ standard
error. $\uparrow$ and $\downarrow$ represent that a higher and lower score are
better, respectively. The RNN, CNN, and Transformer columns report the F1
score.

## Experiments

Dataset In line with the goal of our system being used primarily to protect
the free speech of journalists and whistleblowers, the dataset we use within
this paper is the Reuters C50 dataset (Liu 2011), a subset of the much larger
Reuters Corpus V1 dataset (Lewis et al. 2004). To create the Reuters C50
dataset, articles not related to corporate or industrial news are filtered out
to reduce the impact of topic on author identification. Then, 50 articles from
the top 50 news authors (with respect to number of articles written) are
selected. We split each article into sentences and remove sentences with fewer
than 10 characters to ensure meaningful sentences. Punctuation is kept when
pre-processing because it can indicate style, but to reduce the impact of
proper nouns on identifying authorship, we use the Spacy natural language
processing library (Honnibal and Montani 2017) to identify geopolitical
entities, people, organizations, and locations and replace them with “[GPE]”,
“[PERSON]”, “[ORG]”, and “[LOC]” tokens respectively. To prepare the dataset
for the Siamese discriminator, we create sentence pairs with 2 same-author
sentence pairs and 2 different-author sentence pairs for each sentence in the
original dataset.

We use the dataset in two contexts. First is a closed-set context where all
authors are present in the training, validation, and test sets to evaluate how
well our system anonymizes sentences from authors it has encountered. In this
first context We use a training-validation-testing set split of 75%-15%-15% of
the articles of each author. The second is an open-set context where we test
how well our system anonymizes sentences from authors it hasn’t encountered.
We use 30 authors for the training set, 10 authors for the validation set, and
10 authors for the testing set.

Implementation Details We implement our framework using TensorFlow, training
on two NVIDIA Tesla P-100 GPU’s for around 8 hours for both the open-set and
closed-set models. We performed a hyper-parameter sweep for the values of
$a_{sty}$, $a_{fl}$, and $a_{con}$ using combinations of integer values in the
interval $[1,10]$ before settling on $a_{sty}=1$, $a_{fl}=7$, $a_{con}=6$
based on perplexity, content similarity, and anonymization results on a
validation dataset. We set $\tau=1$ and $a_{int}=.5$ initially and find that
they work well in practice. Following the recommendations of (Heusel et al.
2017), we use Adam optimizers for all models with $\beta_{1}=0.5$ and
$\beta_{2}=0.9$ and initially set the learning rate of the discriminators to
.0003 and the generator to $.0001$. We then experimented with values close to
those initial values, eventually using a learning rate of .00008 for the
generator and .0004 for the style and fluency discriminators. We find the
discriminator learns most effectively for small $\lambda$ values, and best
when $\lambda=.05$. We train the generator and discriminators for 15,000
weight updates in the closed-set context and 14,000 weight updates in the
open-set context.

Evaluation Metrics There are three points of evaluation for the output of the
model, each corresponding to one of the three different losses for the
generator.

Anonymity: To evaluate the effectiveness of the model in anonymizing text
inputs, we evaluate how well different anonymization methods decrease the F1
score of classifiers trained on the training set. Classifiers with different
architectures may learn to classify sentences using different features, and we
want to ensure that the anonymization is robust to various adversaries. We
employ three different classifiers:

  * •

A GRU RNN followed by two fully connected layers

  * •

A convolutional model with three convolutional layers with stride 1 and pool
size 3, 4, and 5 with max pooling followed by two fully connected layers

  * •

A multi-head attention based Transformer encoder model then connected to two
fully connected layers

For open-set evaluation, while our model has not seen authors in the test set,
we evaluate the model against adversaries that have. For better evaluation, we
split the sentences in the test set into 70%-30% training-validation subsets,
and train the classifiers on the training subset. The efficacy of
anonymization is then evaluated on the validation subset. This ensures that
changes in classification of the anonymized sentences happen because the
sentences have been anonymized rather than the classifiers overfitting to
their training data and being overly sensitive to any change. We provide the
average F1 scores and standard error for classifications to judge how well our
system anonymizes each author. Accuracy closely resembled the F1 score in our
results, and so we do not report it.

| Content Preservation | Fluency | Anonymity
---|---|---|---
| BLEU$\uparrow$ | BERTScore$\uparrow$ | PPL$\downarrow$ | RNN$\downarrow$ | CNN$\downarrow$ | Transformer$\downarrow$
Original | N/A | N/A | 5.92$\pm$0.020 | 0.93$\pm$0.005 | 0.94$\pm$ 0.004 | 0.92$\pm$0.006
Round-trip | 0.23$\pm$0.002 | 0.93$\pm$0.001 | 6.10$\pm$0.034 | 0.64$\pm$0.025 | 0.73$\pm$0.020 | 0.69$\pm$0.023
Ours | 0.64$\pm$0.004 | 0.93$\pm$0.001 | 6.95$\pm$0.023 | 0.63$\pm$0.024 | 0.76$\pm$0.024 | 0.68$\pm$0.025
Table 2: Results for open-set evaluation are reported as mean $\pm$ standard
error. $\uparrow$ and $\downarrow$ represent that a higher and lower score are
better, respectively. The RNN, CNN, and Transformer columns report the F1
score. Results for WordNet or Mutant-X are not provided because these methods
cannot be used in an open-set context.

Fluency: To measure the fluency of the outputs, we use the GPT-2 model
provided by the HuggingFace library (Radford et al. 2019). We evaluate the
perplexity score (PPL) of the model on the anonymized sentences, with the
intuition being that for coherent, fluent sentences, the next word is much
easier to predict which leads to a lower PPL overall. We provide the mean and
standard error of the PPL scores.

Content Preservation: To measure how well anonymization preserves the content
of the original sentence, we use two different metrics. The first is the BLEU
score (Papineni et al. 2002), a standard method of evaluation for machine
translation and related tasks that measures n-gram similarity between the
generated sentence and the reference sentence (i.e., the sentence before
obfuscation). However, the BLEU score has been criticised: Turian, Shen, and
Melamed (2003) find that the BLEU score often correlates poorly with human
judgement. Reiter (2018) explains that the BLEU score should not be used
outside of machine translation tasks, and (Sulem, Abend, and Rappoport 2018)
argues it is inadequate to evaluate text simplification. The reason for these
issues is because BLEU evaluates content preservation by n-gram similarity,
not by the meaning of the sentences. As a result, BLEU is imperfect to
evaluate authorship obfuscation, because as we mention in the methodology
section, authorship obfuscation methods should replace low frequency n-grams
with higher frequency n-grams. We include the BLEU score because it is
standard, but supplement it with BERTScore evaluations (Zhang et al. 2019a).
The BERTScore uses large language models to evaluate the content preservation
of a sentence given a reference, and has shown to correlate well with human
judgement. We provide the mean and standard error of both the BLEU scores and
BERTScores.

Baseline Methods: We compared our anonymization method with three other
anonymization approaches and compare them across the different evaluation
metrics.

WordNet Model: We implement the approach of (Mansoorizadeh et al. 2016). It
assumes that since most stylometric analysis uses word frequencies to
determine authorship, replacing high frequency words with lower frequency ones
will help evade detection. This rule-based approach uses the Wordnet language
model to replace high frequency words with their synonyms. The method chooses
the synonym based on the similarity to the original word, and the probability
the new word would appear in the sentence. The word frequencies are determined
using a corpus of previously written work by the author.

Round Trip Translation: Round trip translation takes advantage of machine
translation for anonymization. We adopt the approach of (Keswani et al. 2016),
where sentences are translated from English to German to French and back to
English. We use the Google Translation API to perform these translations. This
method for obfuscation is not authorship-based, but rather relies on
distortions and changes created by the translations to function as
anonymization.

Mutant-X: The Mutant-X method developed by Mahmood et al. (2019) alters a
document by making word replacements that are close according to Word2Vec and
sentiment based embedding. At each iteration of the method, copies of the
document are made, each with different changes. The fitness of each copy is
determined by a combination of the new document’s meteor score, and its
ability to fool an author classification method (for this we developed a CNN
distinct from the evaluation classifiers). The best copies are then chosen for
further alteration and the process continues until an iteration limit is
reached, in which case the method says it cannot anonymize the sentence, or an
alteration leads to successful obfuscation ( e.g., the classifier incorrectly
classifies the author). By design, this approach does not alter a document if
the classifier incorrectly guesses the original document, since the original
document has already met the termination conditions.

Closed-Set Results Results for closed-set authorship anonymization are given
in Table 1. Mutant-X performs best in terms of content preservation and
fluency, but along with WordNet, performs poorly when it comes to anonymizing
sentences. However, our method performs comparably to the other baselines in
terms of sentence perplexity and content preservation, but outperforms in
terms of anonymization performance. This is because Mutant-X anonymizes based
on a known adversary and iteratively makes changes to a sentence to fool that
adversary. This results in minimal changes but a lack of ability to generalize
when faced with previously unseen adversaries. In many cases, these methods
often do not make any changes to the input sentence. This can be seen in
example sentences from the test dataset:

> Original: all the elements that can lead to famine are nevertheless there ,
> said [PERSON]
> Wordnet: all the components that can lead to famine are nevertheless there ,
> said [PERSON]
> Roundtrip: all the elements that could lead to starvation are still there,
> the [PERSON] said
> Mutant-X: all the elements that can lead to famine are nevertheless there ,
> said [PERSON]
> Ours: all the problems that can lead to famine are certainly there , said
> [PERSON]

Here, we can see differences between the results of our method versus the
baselines. Wordnet makes some modifications to the sentence, but its
modifications are generally insufficient to fool classifiers. Mutant-X is
either unable to anonymize the sentence or determined that it does not need to
be anonymized, which also explains why the classifier accuracy on the Mutant-X
anonymized sentences is so high. While round-trip translation does change
sentences, it does so simply as a result of distortions introduced in the
round-trip translation rather than with any intent to anonymize the sentence.
However, our method recognizes context and substitutes “problems” for
“elements” and “certainly” for “nevertheless”.

Open-Set Results The generalizability of our method can also be seen in Table
2 with the results of open-set anonymization. Evaluated independently, our
methodology performs well. On unseen authors, it drops the F1 score of
classifiers trained on those authors by an average of 0.24. The model also
retains fluency and content as well as its closed-set counterpart. We take
this as evidence that our model, through competing with a Siamese
discriminator, is better able to learn how to recognize style instead of
merely removing the most recognizable features of authors that it has
previously seen. To our knowledge, this is the first authorship-based
anonymization approach that has been tested and proven successful in an open-
set context.

However, round-trip translation performs comparably to our model in terms of
F1 score, which is unexpected since round-trip translation does not intend to
obfuscate authorship whereas our model does. In a closed-set context, our
model has an advantage because it learns to obfuscate style through learning
to anonymize sentences from authors in the test set. However, in an open-set
context, despite good generalizability, this advantage is lost which means
that the distortions introduced by translation are better able to compete with
the anonymization from our model. For example,

> Original: [ORG] , often called a vulture fund , received widespread
> attention last month when it made the person buy .
> Round-trip: [ORG], often referred to as the Vulture Fund, gained a lot of
> attention last month when he led the person to buy.
> Ours: [ORG] , often called a vulture fund , received massive attention last
> month when it made the person buy .

While the our model’s changes are targeted towards style obfuscation, the more
random changes in sentence structure and word choice created by round-trip
translation occur often enough to fool the adversarial classifiers at similar
rates.

## Conclusion

We introduced a novel methodology for authorship obfuscation, which uses a
Siamese discriminator that captures style, fluency, and content losses to
provide granular feedback to the generator throughout the GAN training
process. We also showed that our model anonymizes well in an open-set setting,
where it reduces the accuracy of adversarial classifiers trained on an
author’s sentences even when the model itself has not been trained using that
author’s text. However, future work remains. One issue with the anonymized
output from our model is the repeated presence of certain words despite not
making sense in context, which is an extension of the mode collapse problem in
GAN’s. Our model learns a specific word is useful for anonymization and
general enough to avoid increasing content loss. For example, we note this
behavior with the word “company”:

> Original: [ORG] will keep 60 percent of [ORG] while the french state will
> have a golden share to safeguard national security interests .
> Ours: [ORG] company company 60 percent of [ORG] while the french state will
> have a golden taste to safeguard national security interests .

This suggests that our mechanism for content loss needs to be improved. While
the FastText embeddings provide valuable feedback in terms of maintaining
content similarity, they lack context. The average pooling aims to provide
this context but is limited in its ability to do so. Designing a better
content loss mechanism will also help lower the perplexity of sentences, since
the words will be easier to predict.

## Ethical Statement

This paper provides a methodology to anonymize text with the intent of
protecting free and anonymous speech, an integral part of democracy. The
proposed system would enable those who are afraid to speak out against
oppressive systems to do so with more confidence in their anonymity. However,
there are legitimate uses of authorship attribution systems in both plagiarism
detection and law enforcement. Because plagiarism often occurs within an
academic context where written work is evaluated on style and expressiveness,
this risk seems secondary. More importantly, law enforcement may legitimately
use authorship attribution to identify criminal activity (such as identifying
predators online). That informs our choice to focus on a journalistic corpus
rather than one that is more representative of online text communications (or
other avenues for potential criminal activity). We also recognize that against
a new, innovative method for authorship attribution, our system cannot provide
any guarantees for anonymity. Despite these risks, we still view this work as
progress in protecting the anonymous speech of political dissidents,
journalists, and whistleblowers, which we believe outweigh the potential
risks.

## References

  * Afroz, Brennan, and Greenstadt (2012) Afroz, S.; Brennan, M.; and Greenstadt, R. 2012.  Detecting Hoaxes, Frauds, and Deception in Writing Style Online.  In _2012 IEEE Symposium on Security and Privacy_ , 461–475.
  * Anonymous (2018) Anonymous. 2018.  I am part of the resistance inside the trump administration.
  * Arjovsky and Bottou (2017) Arjovsky, M.; and Bottou, L. 2017.  Towards Principled Methods for Training Generative Adversarial Networks.  arXiv:1701.04862.
  * Arjovsky, Chintala, and Bottou (2017) Arjovsky, M.; Chintala, S.; and Bottou, L. 2017.  Wasserstein GAN.  arXiv:1701.07875.
  * Bengio et al. (2015) Bengio, S.; Vinyals, O.; Jaitly, N.; and Shazeer, N. 2015.  Scheduled Sampling for Sequence Prediction with Recurrent Neural Networks.  _CoRR_ , abs/1506.03099.
  * Bo et al. (2019) Bo, H.; Ding, S. H. H.; Fung, B. C. M.; and Iqbal, F. 2019.  ER-AE: Differentially-private Text Generation for Authorship Anonymization.  _CoRR_ , abs/1907.08736.
  * Borenstein (2018) Borenstein, S. 2018.  Close look at word choice could id anonymous nyt columnist: Word detectives.
  * Bromley et al. (1993) Bromley, J.; Bentz, J. W.; Bottou, L.; Guyon, I.; Lecun, Y.; Moore, C.; Sackinger, E.; and Shah, R. 1993.  SIGNATURE VERIFICATION USING A “SIAMESE” TIME DELAY NEURAL NETWORK.  _International Journal of Pattern Recognition and Artificial Intelligence_ , 07(04): 669–688.
  * Caliskan and Greenstadt (2012) Caliskan, A.; and Greenstadt, R. 2012.  Translate Once, Translate Twice, Translate Thrice and Attribute: Identifying Authors and Machine Translation Tools in Translated Text.  In _2012 IEEE Sixth International Conference on Semantic Computing_ , 121–125.
  * Daelemans (2013) Daelemans, W. 2013.  Explanation in Computational Stylometry.  In Gelbukh, A., ed., _Computational Linguistics and Intelligent Text Processing_ , 451–462. Berlin, Heidelberg: Springer Berlin Heidelberg.  ISBN 978-3-642-37256-8.
  * Emmery, Manjavacas Arevalo, and Chrupała (2018) Emmery, C.; Manjavacas Arevalo, E.; and Chrupała, G. 2018.  Style Obfuscation by Invariance.  In _Proceedings of the 27th International Conference on Computational Linguistics_ , 984–996. Santa Fe, New Mexico, USA: Association for Computational Linguistics.
  * Fedus, Goodfellow, and Dai (2018) Fedus, W.; Goodfellow, I.; and Dai, A. M. 2018.  MaskGAN: Better Text Generation via Filling in the ______.  arXiv:1801.07736.
  * Goodfellow et al. (2014) Goodfellow, I. J.; Pouget-Abadie, J.; Mirza, M.; Xu, B.; Warde-Farley, D.; Ozair, S.; Courville, A.; and Bengio, Y. 2014.  Generative Adversarial Networks.  arXiv:1406.2661.
  * Gulrajani et al. (2017) Gulrajani, I.; Ahmed, F.; Arjovsky, M.; Dumoulin, V.; and Courville, A. C. 2017\.  Improved Training of Wasserstein GANs.  _CoRR_ , abs/1704.00028.
  * Guo et al. (2017) Guo, J.; Lu, S.; Cai, H.; Zhang, W.; Yu, Y.; and Wang, J. 2017.  Long Text Generation via Adversarial Training with Leaked Information.  _CoRR_ , abs/1709.08624.
  * He et al. (2018) He, A.; Luo, C.; Tian, X.; and Zeng, W. 2018.  A Twofold Siamese Network for Real-Time Object Tracking.  _CoRR_ , abs/1802.08817.
  * He et al. (2015) He, K.; Zhang, X.; Ren, S.; and Sun, J. 2015.  Deep Residual Learning for Image Recognition.  _CoRR_ , abs/1512.03385.
  * Heusel et al. (2017) Heusel, M.; Ramsauer, H.; Unterthiner, T.; Nessler, B.; Klambauer, G.; and Hochreiter, S. 2017.  GANs Trained by a Two Time-Scale Update Rule Converge to a Nash Equilibrium.  _CoRR_ , abs/1706.08500.
  * Honnibal and Montani (2017) Honnibal, M.; and Montani, I. 2017.  spaCy 2: Natural language understanding with Bloom embeddings, convolutional neural networks and incremental parsing.  _To appear_.
  * Irving (2016) Irving, M. 2016.  Computer analysis reveals Shakespeare’s collaborators.
  * Islam et al. (2015) Islam, A. C.; Yamaguchi, F.; Dauber, E.; Harang, R. E.; Rieck, K.; Greenstadt, R.; and Narayanan, A. 2015.  When Coding Style Survives Compilation: De-anonymizing Programmers from Executable Binaries.  _CoRR_ , abs/1512.08546.
  * Jang, Gu, and Poole (2017) Jang, E.; Gu, S.; and Poole, B. 2017.  Categorical Reparameterization with Gumbel-Softmax.  arXiv:1611.01144.
  * Jardine (2018) Jardine, E. 2018.  Tor, what is it good for? Political repression and the use of online anonymity-granting technologies.  _New Media & Society_, 20(2): 435–452.
  * Juola (2013) Juola, P. 2013.  How a computer program helped Show J.K. Rowling write A Cuckoo’s Calling.
  * Keswani et al. (2016) Keswani, Y.; Trivedi, H.; Mehta, P.; and Majumder, P. 2016.  Author Masking through Translation.  In _CLEF_.
  * Kim (2014) Kim, Y. 2014.  Convolutional Neural Networks for Sentence Classification.  _CoRR_ , abs/1408.5882.
  * Koch (2015) Koch, G. R. 2015.  Siamese Neural Networks for One-Shot Image Recognition.  _2015 International Conference on Machine Learning_.
  * Lagutina et al. (2019) Lagutina, K.; Lagutina, N.; Boychuk, E.; Vorontsova, I.; Shliakhtina, E.; Belyaeva, O.; Paramonov, I.; and Demidov, P. 2019.  A Survey on Stylometric Text Features.  In _2019 25th Conference of Open Innovations Association (FRUCT)_ , 184–195.
  * Lewis et al. (2004) Lewis, D. D.; Yang, Y.; Rose, T. G.; and Li, F. 2004.  RCV1: A New Benchmark Collection for Text Categorization Research.  _J. Mach. Learn. Res._ , 5: 361–397.
  * Liu (2011) Liu, Z. 2011.  Reuter_50_50 Data Set.
  * Maddison, Mnih, and Teh (2016) Maddison, C. J.; Mnih, A.; and Teh, Y. W. 2016.  The Concrete Distribution: A Continuous Relaxation of Discrete Random Variables.  _CoRR_ , abs/1611.00712.
  * Mahlberg (2013) Mahlberg, M. 2013.  Corpus Stylistics and Dickens’s Fiction.  _Corpus Stylistics and Dickens’s Fiction_ , 1–222.
  * Mahmood et al. (2019) Mahmood, A.; Ahmad, F.; Shafiq, Z.; Srinivasan, P.; and Zaffar, F. 2019.  A Girl Has No Name: Automated Authorship Obfuscation using Mutant-X.  _Proceedings on Privacy Enhancing Technologies_ , 2019: 54 – 71.
  * Mansoorizadeh et al. (2016) Mansoorizadeh, M.; Rahgooy, T.; Aminian, M.; and Eskandari, M. 2016.  Author Obfuscation using WordNet and Language Models.  In _CLEF_.
  * McDonald et al. (2012) McDonald, A. W. E.; Afroz, S.; Caliskan, A.; Stolerman, A.; and Greenstadt, R. 2012\.  Use Fewer Instances of the Letter “i”: Toward Writing Style Anonymization.  In Fischer-Hübner, S.; and Wright, M., eds., _Privacy Enhancing Technologies_ , 299–318. Berlin, Heidelberg: Springer Berlin Heidelberg.  ISBN 978-3-642-31680-7.
  * Mikolov et al. (2017) Mikolov, T.; Grave, E.; Bojanowski, P.; Puhrsch, C.; and Joulin, A. 2017.  Advances in Pre-Training Distributed Word Representations.  _CoRR_ , abs/1712.09405.
  * Mosteller and Wallace (1963) Mosteller, F.; and Wallace, D. L. 1963.  Inference in an Authorship Problem.  _Journal of the American Statistical Association_ , 58(302): 275–309.
  * Narayanan et al. (2012) Narayanan, A.; Paskov, H.; Gong, N. Z.; Bethencourt, J.; Stefanov, E.; Shin, E. C. R.; and Song, D. 2012.  On the Feasibility of Internet-Scale Author Identification.  In _2012 IEEE Symposium on Security and Privacy_ , 300–314.
  * Odena, Olah, and Shlens (2017) Odena, A.; Olah, C.; and Shlens, J. 2017.  Conditional Image Synthesis With Auxiliary Classifier GANs.  arXiv:1610.09585.
  * Papineni et al. (2002) Papineni, K.; Roukos, S.; Ward, T.; and Zhu, W.-J. 2002.  BLEU: A Method for Automatic Evaluation of Machine Translation.  In _Proceedings of the 40th Annual Meeting on Association for Computational Linguistics_ , ACL ’02, 311–318. USA: Association for Computational Linguistics.
  * Perlroth (2012) Perlroth, N. 2012.  Software helps identify anonymous writers or helps them stay that way.
  * Radford et al. (2019) Radford, A.; Wu, J.; Child, R.; Luan, D.; Amodei, D.; and Sutskever, I. 2019.  Language Models are Unsupervised Multitask Learners.  _Preprint_.
  * Rao and Rohatgi (2000) Rao, J. R.; and Rohatgi, P. 2000.  Can Pseudonymity Really Guarantee Privacy?  In _9th USENIX Security Symposium (USENIX Security 00)_. Denver, CO: USENIX Association.
  * Reiter (2018) Reiter, E. 2018.  A Structured Review of the Validity of BLEU.  _Computational Linguistics_ , 44(3): 393–401.
  * Ruder, Ghaffari, and Breslin (2016) Ruder, S.; Ghaffari, P.; and Breslin, J. G. 2016.  Character-level and Multi-channel Convolutional Neural Networks for Large-scale Authorship Attribution.  _CoRR_ , abs/1609.06686.
  * Saedi and Dras (2019) Saedi, C.; and Dras, M. 2019.  Siamese Networks for Large-Scale Author Identification.  _CoRR_ , abs/1912.10616.
  * Salimans et al. (2016) Salimans, T.; Goodfellow, I. J.; Zaremba, W.; Cheung, V.; Radford, A.; and Chen, X. 2016.  Improved Techniques for Training GANs.  _CoRR_ , abs/1606.03498.
  * Schuster and Nakajima (2012) Schuster, M.; and Nakajima, K. 2012.  Japanese and Korean voice search.  In _2012 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)_ , 5149–5152.
  * Shetty, Schiele, and Fritz (2017) Shetty, R.; Schiele, B.; and Fritz, M. 2017.  A${}^{\mbox{4}}$NT: Author Attribute Anonymity by Adversarial Training of Neural Machine Translation.  _CoRR_ , abs/1711.01921.
  * Sulem, Abend, and Rappoport (2018) Sulem, E.; Abend, O.; and Rappoport, A. 2018.  BLEU is Not Suitable for the Evaluation of Text Simplification.  In _Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing_ , 738–744. Brussels, Belgium: Association for Computational Linguistics.
  * Sundararajan (2018) Sundararajan, K. 2018.  Analysis of Stylometry as a Cognitive Biometric Trait.
  * Taigman et al. (2014) Taigman, Y.; Yang, M.; Ranzato, M.; and Wolf, L. 2014.  DeepFace: Closing the Gap to Human-Level Performance in Face Verification.  In _2014 IEEE Conference on Computer Vision and Pattern Recognition_ , 1701–1708.
  * Turian, Shen, and Melamed (2003) Turian, J.; Shen, L.; and Melamed, I. 2003.  Evaluation of Machine Translation and its Evaluation.  _2003 Machine Translation Summit_.
  * Vaswani et al. (2017) Vaswani, A.; Shazeer, N.; Parmar, N.; Uszkoreit, J.; Jones, L.; Gomez, A. N.; Kaiser, L.; and Polosukhin, I. 2017.  Attention Is All You Need.  _CoRR_ , abs/1706.03762.
  * Williams (2017) Williams, J. 2017.  To protect our democracy, we need to protect anonymous low-cost online political speech.
  * Williams (2004) Williams, R. J. 2004.  Simple statistical gradient-following algorithms for connectionist reinforcement learning.  _Machine Learning_ , 8: 229–256.
  * Wu et al. (2016) Wu, J.; Zhang, C.; Xue, T.; Freeman, W. T.; and Tenenbaum, J. B. 2016.  Learning a Probabilistic Latent Space of Object Shapes via 3D Generative-Adversarial Modeling.  _CoRR_ , abs/1610.07584.
  * Yang et al. (2018) Yang, Z.; Hu, Z.; Dyer, C.; Xing, E. P.; and Berg-Kirkpatrick, T. 2018.  Unsupervised Text Style Transfer using Language Models as Discriminators.  _CoRR_ , abs/1805.11749.
  * Yu et al. (2016) Yu, L.; Zhang, W.; Wang, J.; and Yu, Y. 2016.  SeqGAN: Sequence Generative Adversarial Nets with Policy Gradient.  _CoRR_ , abs/1609.05473.
  * Zhang et al. (2019a) Zhang, T.; Kishore, V.; Wu, F.; Weinberger, K. Q.; and Artzi, Y. 2019a.  BERTScore: Evaluating Text Generation with BERT.  _CoRR_ , abs/1904.09675.
  * Zhang et al. (2019b) Zhang, W.; Feng, Y.; Meng, F.; You, D.; and Liu, Q. 2019b.  Bridging the Gap between Training and Inference for Neural Machine Translation.  _CoRR_ , abs/1906.02448.
  * Zhang, Cai, and Zhang (2017) Zhang, Y.; Cai, W.; and Zhang, Y. 2017.  Separating Style and Content for Generalized Style Transfer.  _CoRR_ , abs/1711.06454.


R\rVert\leq\lVert L(R,\varphi,\eta,b)\rVert$.

Second, note that it follows from the Cauchy-Schwarz inequality that

$\displaystyle\left\langle\begin{pmatrix}\eta\\\
0\end{pmatrix},L(R,\varphi,\eta,b)\begin{pmatrix}0\\\
\langle\eta,\eta\rangle_{\mathfrak{B}}\end{pmatrix}\right\rangle_{\mathfrak{B}}^{*}$
$\displaystyle\left\langle\begin{pmatrix}\eta\\\
0\end{pmatrix},L(R,\varphi,\eta,b)\begin{pmatrix}0\\\
\langle\eta,\eta\rangle_{\mathfrak{B}}\end{pmatrix}\right\rangle_{\mathfrak{B}}$
$\displaystyle\leq\left\|L(R,\varphi,\eta,b)\begin{pmatrix}0\\\
\langle\eta,\eta\rangle_{\mathfrak{B}}\end{pmatrix}\right\|_{\mathfrak{B}}^{2}\left\langle\begin{pmatrix}\eta\\\
0\end{pmatrix},\begin{pmatrix}\eta\\\
0\end{pmatrix}\right\rangle_{\mathfrak{B}}$
$\displaystyle\leq\lVert\eta\rVert_{\mathfrak{B}}^{4}\lVert
L(R,\varphi,\eta,b)\rVert^{2}\langle\eta,\eta\rangle_{\mathfrak{B}}.$ (163)

Hence, we have

$\displaystyle\lVert\eta\rVert_{\mathfrak{B}}^{4}=\lVert\langle\eta,\eta\rangle_{\mathfrak{B}}\rVert^{2}=\left\|\left\langle\begin{pmatrix}\eta\\\
0\end{pmatrix},L(R,\varphi,\eta,b)\begin{pmatrix}0\\\
\langle\eta,\eta\rangle_{\mathfrak{B}}\end{pmatrix}\right\rangle_{\mathfrak{B}}\right\|\leq\lVert
L(R,\varphi,\eta,b)\rVert\lVert\eta\rVert_{\mathfrak{B}}^{3},$ (164)

which implies $\lVert\eta\rVert_{\mathfrak{B}}\leq\lVert
L(R,\varphi,\eta,b)\rVert$.

Third, we do a similar calculation to show

$\displaystyle\left\langle\begin{pmatrix}0\\\
\langle\varphi,\varphi\rangle_{\mathfrak{B}}\end{pmatrix},L(R,\varphi,\eta,b)\begin{pmatrix}\varphi\\\
0\end{pmatrix}\right\rangle_{\mathfrak{B}}^{*}$
$\displaystyle\left\langle\begin{pmatrix}0\\\
\langle\varphi,\varphi\rangle_{\mathfrak{B}}\end{pmatrix},L(R,\varphi,\eta,b)\begin{pmatrix}\varphi\\\
0\end{pmatrix}\right\rangle_{\mathfrak{B}}$
$\displaystyle\leq\left\|L(R,\varphi,\eta,b)\begin{pmatrix}\varphi\\\
0\end{pmatrix}\right\|^{2}_{\mathfrak{B}}\left\langle\begin{pmatrix}0\\\
\langle\varphi,\varphi\rangle_{\mathfrak{B}}\end{pmatrix},\begin{pmatrix}0\\\
\langle\varphi,\varphi\rangle_{\mathfrak{B}}\end{pmatrix}\right\rangle_{\mathfrak{B}}$
$\displaystyle\leq\lVert\varphi\rVert_{\mathfrak{B}}^{2}\lVert
L(R,\varphi,\eta,b)\rVert^{2}\langle\varphi,\varphi\rangle_{\mathfrak{B}}^{2}.$
(165)

Hence, we have

$\displaystyle\lVert\varphi\rVert_{\mathfrak{B}}^{4}=\lVert\langle\varphi,\varphi\rangle_{\mathfrak{B}}\rVert^{2}=\left\|\left\langle\begin{pmatrix}0\\\
\langle\varphi,\varphi\rangle_{\mathfrak{B}}\end{pmatrix},L(R,\varphi,\eta,b)\begin{pmatrix}\varphi\\\
0\end{pmatrix}\right\rangle_{\mathfrak{B}}\right\|\leq\lVert
L(R,\varphi,\eta,b)\rVert\lVert\varphi\rVert^{3}_{\mathfrak{B}},$ (166)

which implies $\lVert\varphi\rVert_{\mathfrak{B}}\leq\lVert
L(R,\varphi,\eta,b)\rVert$.

Fourth, since we have

$\displaystyle\lVert b\rVert^{3}=\left\|\left\langle\begin{pmatrix}0\\\
b\end{pmatrix},L(R,\varphi,\eta,b)\begin{pmatrix}0\\\
b\end{pmatrix}\right\rangle_{\mathfrak{B}}\right\|\leq\lVert
L(R,\varphi,\eta,b)\rVert\lVert b\rVert^{2},$ (167)

it follows that $\lVert b\rVert\leq\lVert L(R,\varphi,\eta,b)\rVert$.

Thus, we have established both inequalities in Eq. (154). Now it follows that
$\mathfrak{L}$ is norm closed as well because $\mathcal{K}(\mathcal{E})$,
$\mathcal{E}$, $\mathfrak{B}$, and the space of operators of the form
$\flat_{\varphi}$ are all closed. Thus, $\mathfrak{L}$ is a C*-algebra. ∎

Next, we define a subalgebra of $\mathfrak{L}$. We will consider the
collection of compact operators $R$ on $\mathcal{E}$ whose image is contained
in $\overline{\mathcal{E}\cdot K_{\alpha(\hbar)}}$ in the sense that for all
$\psi\in\mathcal{E}$, $R\psi\in\overline{\mathcal{E}\cdot K_{\alpha(\hbar)}}$.
As shorthand for this property, we will say
$R\in\mathcal{K}(\mathcal{E},\overline{\mathcal{E}\cdot K_{\alpha(\hbar)}})$
when $R\in\mathcal{K}(\mathcal{E})$ and
$R(\mathcal{E})\subseteq\overline{\mathcal{E}\cdot K_{\alpha(\hbar)}}$. Now we
define

$\displaystyle\mathfrak{D}=\big{\\{}L(R,\varphi,\eta,b)\ |\
R\in\mathcal{K}(\mathcal{E},\overline{\mathcal{E}\cdot K_{\alpha(\hbar)}});\
b\in K_{\alpha(\hbar)};\ \varphi,\eta\in\overline{\mathcal{E}\cdot
K_{\alpha(\hbar)}}\big{\\}}.$ (168)

######  Lemma A.2.

$\mathfrak{D}$ is a closed two-sided ideal of $\mathfrak{L}$.

###### Proof.

Consider $L=L(R,\varphi,\eta,b)\in\mathfrak{L}$ and
$L^{\prime}=L(R^{\prime},\varphi^{\prime},\eta^{\prime},b^{\prime})\in\mathfrak{D}$.
We have

$\displaystyle LL^{\prime}=\begin{pmatrix}R&\eta\\\
\flat_{\varphi}&b\end{pmatrix}\begin{pmatrix}R^{\prime}&\eta^{\prime}\\\
\flat_{\varphi^{\prime}}&b^{\prime}\end{pmatrix}=\begin{pmatrix}RR^{\prime}+\eta\flat_{\varphi^{\prime}}&R\eta^{\prime}+\eta
b^{\prime}\\\
\flat_{\varphi}R^{\prime}+b\flat_{\varphi^{\prime}}&\langle\varphi,\eta^{\prime}\rangle_{\mathfrak{B}}+bb^{\prime}\end{pmatrix}$
(169)

and similarly

$\displaystyle
L^{\prime}L=\begin{pmatrix}R^{\prime}R+\eta^{\prime}\flat_{\varphi}&R^{\prime}\eta+\eta^{\prime}b\\\
\flat_{\varphi^{\prime}}R+b^{\prime}\flat_{\varphi}&\langle\varphi^{\prime},\eta\rangle_{\mathfrak{B}}+b^{\prime}b\end{pmatrix}.$
(170)

We consider each matrix element in turn and show that it belongs to the
appropriate domain.

  1. 1.

$RR^{\prime}+\eta\flat_{\varphi^{\prime}}\in\mathcal{K}(\mathcal{E},\overline{\mathcal{E}\cdot
K_{\alpha(\hbar)}})$ and
$R^{\prime}R+\eta^{\prime}\flat_{\varphi}\in(\mathcal{K}(\mathcal{E},\overline{\mathcal{E}\cdot
K_{\alpha(\hbar)}})$.

Clearly, each of the operators in each of these sums is compact. We must show
that their images are contained in
$\mathcal{K}(\mathcal{E},\overline{\mathcal{E}\cdot K_{\alpha(\hbar)}})$.

Since $R^{\prime}\in\mathcal{K}(\mathcal{E},\overline{\mathcal{E}\cdot
K_{\alpha(\hbar)}})$, we have that for any $\psi\in\mathcal{E}$,
$R^{\prime}\psi=\lim_{i}\sum_{i}\xi_{i}b_{i}$ for some $b_{i}\in
K_{\alpha(\hbar)}$ and $\xi_{i}\in\mathcal{E}$. This implies immediately that
$R^{\prime}R\psi\in\overline{\mathcal{E}\cdot K_{\alpha(\hbar)}}$. Moreover,
since the right $\mathfrak{B}$-action commutes with all compact operators, we
have that
$RR^{\prime}\psi=\lim_{i}\sum_{i}R(\xi_{i}b_{i})=\lim_{i}\sum_{i}R\xi_{i}\cdot
b_{i}\in\overline{\mathcal{E}\cdot K_{\alpha(\hbar)}}$. Hence, we have that
$RR^{\prime},R^{\prime}R\in\mathcal{K}(\mathcal{E},\overline{\mathcal{E}\cdot
K_{\alpha(\hbar)}})$.

Next, since $\varphi^{\prime}\in\overline{\mathcal{E}\cdot
K_{\alpha(\hbar)}}$, we have that
$\varphi^{\prime}=\lim_{i}\sum_{i}\xi_{i}b_{i}$ for some $b_{i}\in
K_{\alpha(\hbar)}$ and $\xi_{i}\in\mathcal{E}$. So for any
$\psi\in\mathcal{E}$, we have

$\displaystyle\eta\flat_{\varphi^{\prime}}(\psi)=\eta\langle\varphi^{\prime},\psi\rangle_{\mathfrak{B}}=\lim_{i}\sum_{i}\eta\langle\xi_{i}b_{i},\psi\rangle_{\mathfrak{B}}=\lim_{i}\sum_{i}\eta
b_{i}^{*}\langle\xi_{i},\psi\rangle_{\mathfrak{B}},$ (171)

and since $K_{\alpha(\hbar)}$ is an ideal, we have
$\eta\flat_{\varphi^{\prime}}(\psi)\in\overline{\mathcal{E}\cdot
K_{\alpha(\hbar)}}$.

Similarly, since $\eta^{\prime}\in\overline{\mathcal{E}\cdot
K_{\alpha(\hbar)}}$, we have that $\eta^{\prime}=\lim_{i}\sum_{i}\xi_{i}b_{i}$
for some $b_{i}\in K_{\alpha(\hbar)}$ and $\xi_{i}\in\mathcal{E}$. So for any
$\psi\in\mathcal{E}$, we have

$\displaystyle\eta^{\prime}\flat_{\varphi}(\psi)=\eta^{\prime}\langle\varphi,\psi\rangle_{\mathfrak{B}}=\lim_{i}\sum_{i}\xi_{i}b_{i}\langle\varphi,\psi\rangle_{\mathfrak{B}},$
(172)

and since $K_{\alpha(\hbar)}$ is an ideal, we have
$\eta^{\prime}\flat_{\varphi}(\psi)\in\overline{\mathcal{E}\cdot
K_{\alpha(\hbar)}}$.

Since $\mathcal{K}(\mathcal{E},\overline{\mathcal{E}\cdot K_{\alpha(\hbar)}})$
is a linear subspace of $\mathcal{L}(\mathcal{E})$, this establishes that the
first matrix element of each of $LL^{\prime}$ and $L^{\prime}L$ belongs to
$\mathcal{K}(\mathcal{E},\overline{\mathcal{E}\cdot K_{\alpha(\hbar)}})$.

  2. 2.

$R\eta^{\prime}+\eta b^{\prime}\in\overline{\mathcal{E}\cdot
K_{\alpha(\hbar)}}$ and
$R^{\prime}\eta+\eta^{\prime}b\in\overline{\mathcal{E}\cdot
K_{\alpha(\hbar)}}$.

Since $\eta^{\prime}\in\overline{\mathcal{E}\cdot K_{\alpha(\hbar)}}$, we have
$\eta^{\prime}=\lim_{i}\sum_{i}\xi_{i}b_{i}$ for some $\xi_{i}\in\mathcal{E}$
and $b_{i}\in K_{\alpha(\hbar)}$. Since the right $\mathfrak{B}$-action
commutes with all compact operators, we have that
$R\eta^{\prime}=\lim_{i}\sum_{i}R(\xi_{i}b_{i})=\lim_{i}\sum_{i}R\xi_{i}\cdot
b_{i}$. Thus, $R\eta^{\prime}\in\overline{\mathcal{E}\cdot
K_{\alpha(\hbar)}}$. And since $\overline{\mathcal{E}\cdot K_{\alpha(\hbar)}}$
is a linear subspace, we have $R\eta^{\prime}+\eta
b^{\prime}\in\overline{\mathcal{E}\cdot K_{\alpha(\hbar)}}$.

On the other hand, since
$R^{\prime}\in\mathcal{K}(\mathcal{E},\overline{\mathcal{E}\cdot
K_{\alpha(\hbar)}})$, we have $R^{\prime}\eta\in\overline{\mathcal{E}\cdot
K_{\alpha(\hbar)}}$. And likewise, since $K_{\alpha(\hbar)}$ is an ideal, we
have $\eta^{\prime}b\in\overline{\mathcal{E}\cdot K_{\alpha(\hbar)}}$, which
implies further that
$R^{\prime}\eta+\eta^{\prime}b\in\overline{\mathcal{E}\cdot
K_{\alpha(\hbar)}}$.

  3. 3.

$\flat_{\varphi}R^{\prime}+b\flat_{\varphi^{\prime}}=\flat_{\xi}$ and
$\flat_{\varphi^{\prime}}R+b^{\prime}\flat_{\varphi}=\flat_{\xi^{\prime}}$ for
some $\xi,\xi^{\prime}\in\overline{\mathcal{E}\cdot K_{\alpha(\hbar)}}$.

Define $\xi=R^{\prime*}\varphi+\varphi^{\prime}\cdot b^{*}$. It follows that
for any $\psi\in\mathcal{E}$,

$\displaystyle\flat_{\xi}\psi$ $\displaystyle=\langle
R^{\prime*}\varphi,\psi\rangle_{\mathfrak{B}}+\langle\varphi^{\prime}\cdot
b^{*},\psi\rangle_{\mathfrak{B}}$
$\displaystyle=\langle\varphi,R^{\prime}\psi\rangle_{\mathfrak{B}}+b\langle\varphi^{\prime},\psi\rangle_{\mathfrak{B}}$
$\displaystyle=\flat_{\varphi}R^{\prime}\psi+b\flat_{\varphi^{\prime}}\psi.$
(173)

Moreover, since
$R^{\prime}\in\mathcal{K}(\mathcal{E},\overline{\mathcal{E}\cdot
K_{\alpha(\hbar)}})$, it follows that
$R^{\prime*}\in\mathcal{K}(\mathcal{E},\overline{\mathcal{E}\cdot
K_{\alpha(\hbar)}})$, so $R^{\prime*}\varphi\in\overline{\mathcal{E}\cdot
K_{\alpha(\hbar)}}$. Similarly, since $K_{\alpha(\hbar)}$ is an ideal, we have
$\varphi^{\prime}\cdot b^{*}\in\overline{\mathcal{E}\cdot K_{\alpha(\hbar)}}$.
Hence, $\xi\in\overline{\mathcal{E}\cdot K_{\alpha(\hbar)}}$.

Similarly, define $\xi^{\prime}=R^{*}\varphi^{\prime}+\varphi\cdot
b^{\prime*}$. It follows that for any $\psi\in\mathcal{E}$,

$\displaystyle\flat_{\xi^{\prime}}\psi$ $\displaystyle=\langle
R^{*}\varphi^{\prime},\psi\rangle_{\mathfrak{B}}+\langle\varphi\cdot
b^{\prime*},\psi\rangle_{\mathfrak{B}}$
$\displaystyle=\langle\varphi^{\prime},R\psi\rangle_{\mathfrak{B}}+b^{\prime}\cdot\langle\varphi,\psi\rangle_{\mathfrak{B}}$
$\displaystyle=\flat_{\varphi^{\prime}}R\psi+b^{\prime}\flat_{\varphi}\psi.$
(174)

Moreover, since $R^{*}$ is a compact operator and the right
$\mathfrak{B}$-action commutes with compact operators, we have
$R^{*}\varphi^{\prime}\in\overline{\mathcal{E}\cdot K_{\alpha(\hbar)}}$.
Further, we have $\varphi\cdot b^{\prime*}\in\overline{\mathcal{E}\cdot
K_{\alpha(\hbar)}}$. Hence, $\xi^{\prime}\in\overline{\mathcal{E}\cdot
K_{\alpha(\hbar)}}$.

  4. 4.

$\langle\varphi,\eta^{\prime}\rangle_{\mathfrak{B}}+bb^{\prime}\in
K_{\alpha(\hbar)}$ and
$\langle\varphi^{\prime},\eta\rangle_{\mathfrak{B}}+b^{\prime}b\in
K_{\alpha(\hbar)}$

The fact that $K_{\alpha(\hbar)}$ is an ideal implies that both
$\langle\varphi,\eta^{\prime}\rangle_{\mathfrak{B}}+bb^{\prime}\in
K_{\alpha(\hbar)}$ and
$\langle\varphi^{\prime},\eta\rangle_{\mathfrak{B}}+b^{\prime}b\in
K_{\alpha(\hbar)}$.

The fact that $\mathfrak{D}$ is closed is implied by the bounds in Lemma A.1
along with the fact that each of the sets
$\mathcal{K}(\mathcal{E},\overline{\mathcal{E}\cdot K_{\alpha(\hbar)}})$,
$K_{\alpha(\hbar)}$, and $\overline{\mathcal{E}\cdot K_{\alpha(\hbar)}}$ is
closed. ∎

Since $\mathfrak{D}$ is a closed two-sided ideal in $\mathfrak{L}$, the
quotient C*-algebra $\mathfrak{L}/\mathfrak{D}$ is well-defined with the
canonical quotient norm

$\displaystyle\lVert
L+\mathfrak{D}\rVert_{\mathfrak{L}/\mathfrak{D}}=\inf_{D\in\mathfrak{D}}\lVert
L+D\rVert$ (175)

for all $L\in\mathfrak{L}$.

##  Appendix B Tensor Products of Non-Unital Commutative C*-algebras

In this appendix we establish a technical lemma about tensor products of non-
unital commutative C*-algebras. It is well known that the tensor product of
unital commutative C*-algebras corresponds to the Cartesian product of their
state spaces [13, p. 849]. We extend this result to non-unital commutative
C*-algebras.

So suppose, as above, that $\mathfrak{A}_{0}$ and $\mathfrak{B}_{0}$ are non-
unital commutative C*-algebras and their unique C*-tensor product [13, Lemma
11.3.5, p. 854] is denoted $\mathfrak{A}_{0}\otimes\mathfrak{B}_{0}$. Gelfand
duality implies that $\mathfrak{A}_{0}\cong C_{0}(M)$ and
$\mathfrak{B}_{0}\cong C_{0}(N)$ for some locally compact spaces $M$ and $N$.
We will show that the pure state space $P$ of
$\mathfrak{A}_{0}\otimes\mathfrak{B}_{0}$ is homeomorphic to $M\times N$.

To that end, let $\\{1_{\lambda}^{\mathfrak{A}_{0}}\\}_{\lambda\in\Lambda}$
and
$\\{1_{\lambda^{\prime}}^{\mathfrak{B}_{0}}\\}_{\lambda^{\prime}\in\Lambda^{\prime}}$
denote approximate units of $\mathfrak{A}_{0}$ and $\mathfrak{B}_{0}$,
respectively. Then define maps $pr_{M}:P\to M$ and $pr_{N}:P\to N$ by

$\displaystyle pr_{M}(p)(a)$
$\displaystyle=\lim_{\lambda^{\prime}}p\big{(}a\otimes
1_{\lambda^{\prime}}^{\mathfrak{B}_{0}}\big{)}$ $\displaystyle pr_{N}(p)(b)$
$\displaystyle=\lim_{\lambda}p\big{(}1_{\lambda}^{\mathfrak{A}_{0}}\otimes
b\big{)}$ (176)

for all $p\in P$, $a\in\mathfrak{A}_{0}$, and $b\in\mathfrak{B}_{0}$. Each
limit converges [15, Thm. 2.3, p. 162], and the limit is independent of the
chosen approximate unit. We need to show that when $p$ is a pure state, so are
$pr_{M}(p)$ and $pr_{N}(p)$.

######  Proposition B.1.

If $p\in P$, then $pr_{M}(p)\in\mathcal{P}(\mathfrak{A}_{0})$ and
$pr_{N}(p)\in\mathcal{P}(\mathfrak{B}_{0})$.

###### Proof.

Suppose $p$ is a pure state. First we confirm that $pr_{M}(p)$ and $pr_{N}(p)$
are both states. They are clearly linear functionals. To see that they are
each positive, note that for $a\in\mathfrak{A}_{0}$ and
$b\in\mathfrak{B}_{0}$, we have that $a^{*}a\otimes
1_{\lambda^{\prime}}^{\mathfrak{B}_{0}}$ and
$1_{\lambda}^{\mathfrak{A}_{0}}\otimes b^{*}b$ are both positive in
$\mathfrak{A}_{0}\otimes\mathfrak{B}_{0}$ [13, Thm. 4.2.2(iv)]. Hence,

$\displaystyle pr_{M}(p)(a^{*}a)=\lim_{\lambda^{\prime}}p\big{(}a^{*}a\otimes
1_{\lambda^{\prime}}^{\mathfrak{B}_{0}}\big{)}\geq 0$ $\displaystyle
pr_{N}(p)(b^{*}b)=\lim_{\lambda}p\big{(}1_{\lambda}^{\mathfrak{A}_{0}}\otimes
b^{*}b\big{)}\geq 0.$ (177)

To see that $pr_{M}(p)$ and $pr_{N}(p)$ are both normalized, note that
$\\{1_{\lambda}^{\mathfrak{A}_{0}}\otimes
1_{\lambda^{\prime}}^{\mathfrak{B}_{0}}\\}_{(\lambda,\lambda^{\prime})\in\Lambda\times\Lambda^{\prime}}$
is an approximate identity for $\mathfrak{A}_{0}\otimes\mathfrak{B}_{0}$ [15,
Lemma 2.1, p. 161]. Hence,

$\displaystyle 1=\lVert
p\rVert=\lim_{(\lambda,\lambda^{\prime})}p\big{(}1_{\lambda}^{\mathfrak{A}_{0}}\otimes
1_{\lambda^{\prime}}^{\mathfrak{B}_{0}}\big{)}$ (178)

and so it follows that

$\displaystyle\lVert pr_{M}(p)\rVert$
$\displaystyle=\lim_{\lambda^{\prime}}pr_{M}(p)\big{(}1_{\lambda}^{\mathfrak{A}_{0}}\big{)}=\lim_{\lambda}\lim_{\lambda^{\prime}}p\big{(}1_{\lambda}^{\mathfrak{A}_{0}}\otimes
1_{\lambda^{\prime}}^{\mathfrak{B}_{0}}\big{)}=1$ $\displaystyle\lVert
pr_{N}(p)\rVert$
$\displaystyle=\lim_{\lambda}pr_{N}(p)\big{(}1_{\lambda^{\prime}}^{\mathfrak{B}_{0}}\big{)}=\lim_{\lambda^{\prime}}\lim_{\lambda}p\big{(}1_{\lambda}^{\mathfrak{A}_{0}}\otimes
1_{\lambda^{\prime}}^{\mathfrak{B}_{0}}\big{)}=1.$ (179)

Thus, $pr_{M}(p)$ and $pr_{N}(p)$ are both states.

We now need to show that each state is pure. Consider
$a_{1},a_{2}\in\mathfrak{A}_{0}$ and $b_{1},b_{2}\in\mathfrak{B}_{0}$. Note
that $\\{(1_{\lambda}^{\mathfrak{A}_{0}})^{2}\\}_{\lambda\in\Lambda}$ and
$\\{(1_{\lambda^{\prime}}^{\mathfrak{B}_{0}})^{2}\\}_{\lambda^{\prime}\in\Lambda^{\prime}}$
are both also approximate units, so we have

$\displaystyle pr_{M}(p)(a_{1}a_{2})$
$\displaystyle=\lim_{\lambda^{\prime}}p\big{(}a_{1}a_{2}\otimes(1_{\lambda^{\prime}}^{\mathfrak{B}_{0}})^{2}\big{)}$
$\displaystyle=\lim_{\lambda^{\prime}}p\big{(}(a_{1}\otimes
1_{\lambda^{\prime}}^{\mathfrak{B}_{0}})\cdot(a_{2}\otimes
1_{\lambda^{\prime}}^{\mathfrak{B}_{0}})\big{)}$
$\displaystyle=\lim_{\lambda^{\prime}}p\big{(}a_{1}\otimes
1_{\lambda^{\prime}}^{\mathfrak{B}_{0}}\big{)}\cdot p\big{(}a_{2}\otimes
1_{\lambda^{\prime}}^{\mathfrak{B}_{0}}\big{)}$
$\displaystyle=pr_{M}(p)(a_{1})\cdot pr_{M}(p)(a_{2})$ (180)

and

$\displaystyle pr_{N}(p)(b_{1}b_{2})$
$\displaystyle=\lim_{\lambda^{\prime}}p\big{(}(1_{\lambda}^{\mathfrak{A}_{0}})^{2}\otimes
b_{1}b_{2}\big{)}$
$\displaystyle=\lim_{\lambda^{\prime}}p\big{(}(1_{\lambda}^{\mathfrak{A}_{0}}\otimes
b_{1})\cdot(1_{\lambda}^{\mathfrak{A}_{0}}\otimes b_{2})\big{)}$
$\displaystyle=\lim_{\lambda^{\prime}}p\big{(}1_{\lambda}^{\mathfrak{A}_{0}}\otimes
b_{1}\big{)}\cdot p\big{(}1_{\lambda}^{\mathfrak{A}_{0}}\otimes b_{2}\big{)}$
$\displaystyle=pr_{N}(p)(b_{1})\cdot pr_{N}(p)(b_{2}).$ (181)

Hence, $pr_{M}(p)$ and $pr_{N}(p)$ are each multiplicative, and therefore,
pure [13, Prop. 4.4.1, p. 269]

∎

So we now have a map $(pr_{M},pr_{N}):P\to M\times N$. We proceed to define an
inverse map $(pr_{M},pr_{N})^{-1}:M\times N\to P$ by the continuous linear
extension of

$\displaystyle(pr_{M},pr_{N})^{-1}(m,n)(a\otimes b)=m(a)n(b)$ (182)

for all $a\in\mathfrak{A}_{0}$ and $b\in\mathfrak{B}_{0}$. Again, we must show
that when $m$ and $n$ are pure states on $\mathfrak{A}_{0}$ and
$\mathfrak{B}_{0}$, then $(pr_{M},pr_{N})^{-1}(m,n)$ is a pure state on
$\mathfrak{A}_{0}\otimes\mathfrak{B}_{0}$.

######  Proposition B.2.

If $m\in\mathcal{P}(\mathfrak{A}_{0})$ and
$n\in\mathcal{P}(\mathfrak{B}_{0})$, then $(pr_{M},pr_{N})^{-1}(m,n)\in P$.

###### Proof.

In what follows, we let
$\dot{\mathfrak{A}}_{0}=\mathfrak{A}_{0}\oplus\mathbb{C}$ and
$\dot{\mathfrak{B}}_{0}=\mathfrak{B}_{0}\oplus\mathbb{C}$ denote the
unitzations of $\mathfrak{A}_{0}$ and $\mathfrak{B}_{0}$, respectively. We
know that $m$ has a unique extension to a pure state $\dot{m}$ on
$\dot{\mathfrak{A}}_{0}$ and $n$ has a unique extension to a pure state
$\dot{n}$ on $\dot{\mathfrak{B}}_{0}$ satisfying

$\displaystyle\dot{m}(a+\alpha I)$ $\displaystyle=m(a)+\alpha$
$\displaystyle\dot{n}(b+\alpha I)$ $\displaystyle=n(b)+\alpha$ (183)

for $\alpha\in\mathbb{C}$, $a\in\mathfrak{A}_{0}$, and $b\in\mathfrak{B}_{0}$.
Hence, there is a unique state $\dot{m}\otimes\dot{n}$ on
$\dot{\mathfrak{A}}_{0}\otimes\dot{\mathfrak{B}}_{0}$ such that

$\displaystyle(\dot{m}\otimes\dot{n})\big{(}(a+\alpha
I)\otimes(b+\alpha^{\prime}I)\big{)}=\dot{m}(a+\alpha
I)\cdot\dot{n}(b+\alpha^{\prime}I)$ (184)

for all $\alpha,\alpha^{\prime}\in\mathbb{C}$, $a\in\mathfrak{A}_{0}$, and
$b\in\mathfrak{B}_{0}$ [13, Prop. 11.1.1, p. 802]. Since $m$ and $n$ are pure
states, so are $\dot{m}$ and $\dot{n}$, and it follows that
$\dot{m}\otimes\dot{n}$ is a pure state as well [13, Prop. 11.3.2(ii), p.
848].

Now consider the states at infinity
$\iota_{M}\in\mathcal{P}(\dot{\mathfrak{A}}_{0})$ and
$\iota_{N}\in\mathcal{P}(\dot{\mathfrak{B}}_{0})$ defined by

$\displaystyle\iota_{M}(a+\alpha I)$ $\displaystyle=\alpha$
$\displaystyle\iota_{N}(b+\alpha I)$ $\displaystyle=\alpha$ (185)

for all $\alpha\in\mathbb{C}$, $a\in\mathfrak{A}_{0}$, and
$b\in\mathfrak{B}_{0}$. Similarly, define $\iota_{M\times
N}=\iota_{M}\otimes\iota_{N}\in\mathcal{P}(\dot{\mathfrak{A}}_{0}\otimes\dot{\mathfrak{B}}_{0})$.
By Thm. 2.3 of Lance, [15, p. 163], every state on
$\dot{\mathfrak{A}}_{0}\otimes\dot{\mathfrak{B}}_{0}$ is a convex combination

$\displaystyle\alpha_{1}\cdot
f+\alpha_{2}\cdot(\dot{m}^{\prime}\otimes\iota_{N})+\alpha_{3}\cdot(\iota_{M}\otimes\dot{n}^{\prime})+\alpha_{4}\cdot\iota_{M\times
N}$ (186)

for some states $\dot{m}^{\prime}$ on $\mathfrak{A}_{0}$, $\dot{n}^{\prime}$
on $\mathfrak{B}_{0}$, and $f$ on $\mathfrak{A}_{0}\otimes\mathfrak{B}_{0}$.
Since $\dot{m}\otimes\dot{n}$ is pure, it must be equal to exactly one
component of such a convex sum. However, states of the latter three forms
annihilate all operators of the form $a\otimes b$ for $a\in\mathfrak{A}_{0}$
and $b\in\mathfrak{B}_{0}$, while $\dot{m}\otimes\dot{n}$ does not. Hence,
$\dot{m}\otimes\dot{n}$ is the unique extension of the state
$(pr_{M},pr_{N})^{-1}(m,n)$ on $\mathfrak{A}_{0}\otimes\mathfrak{B}_{0}$,
which therefore must be pure. ∎

######  Proposition B.3.

The map $(pr_{M},pr_{N})^{-1}$ is an inverse to $(pr_{M},pr_{N})$ in the sense
that for any $p\in P$, we have

$\displaystyle(pr_{M},pr_{N})^{-1}(pr_{M}(p),pr_{N}(p))=p,$ (187)

and for any $m\in M$ and $n\in N$, we have

$\displaystyle pr_{M}\circ(pr_{M},pr_{N})^{-1}(m,n)$ $\displaystyle=m$
$\displaystyle pr_{N}\circ(pr_{M},pr_{N})^{-1}(m,n)$ $\displaystyle=n.$ (188)

###### Proof.

For any $a\in\mathfrak{A}_{0}$ and $b\in\mathfrak{B}_{0}$, we have

$\displaystyle(pr_{M},pr_{N})^{-1}(pr_{M}(p),pr_{N}(p))\big{(}a\otimes
b\big{)}$ $\displaystyle=\lim_{\lambda^{\prime}}p\big{(}a\otimes
1_{\lambda^{\prime}}^{\mathfrak{B}_{0}}\big{)}\cdot\lim_{\lambda}p(1_{\lambda}^{\mathfrak{A}_{0}}\otimes
b\big{)}$
$\displaystyle=\lim_{\lambda^{\prime}}\lim_{\lambda}p\big{(}(a\otimes
b)\cdot(1_{\lambda}^{\mathfrak{A}_{0}}\cdot
1_{\lambda^{\prime}}^{\mathfrak{B}_{0}})\big{)}$
$\displaystyle=p\big{(}a\otimes b\big{)}.$ (189)

Similarly, we have

$\displaystyle pr_{M}\circ(pr_{M},pr_{N})^{-1}(m,n)(a)$
$\displaystyle=\lim_{\lambda^{\prime}}m(a)\cdot
n(1_{\lambda^{\prime}}^{\mathfrak{B}_{0}})=m(a)$ $\displaystyle
pr_{N}\circ(pr_{M},pr_{N})^{-1}(m,n)(b)$
$\displaystyle=\lim_{\lambda}m(1_{\lambda}^{\mathfrak{A}_{0}})\cdot
n(b)=n(b).$ (190)

∎

######  Proposition B.4.

The maps $pr_{M}$, $pr_{N}$ and $(pr_{M},pr_{N})^{-1}$ are all continuous in
the weak* topologies.

###### Proof.

Suppose that we have a net $\\{p_{\alpha}\\}$ in $P$ with $p_{\alpha}\to p$ in
the weak* topology. Then for every $a\in\mathfrak{A}_{0}$ and
$b\in\mathfrak{B}_{0}$, we have $p_{\alpha}(a\otimes b)\to p(a\otimes b)$.
Hence,

$\displaystyle
pr_{M}(p_{\alpha})(a)=\lim_{\lambda^{\prime}}p_{\alpha}(a\otimes
1_{\lambda^{\prime}}^{\mathfrak{B}_{0}})\to\lim_{\lambda^{\prime}}p(a\otimes
1_{\lambda^{\prime}}^{\mathfrak{B}_{0}})=pr_{M}(p)(a)$ (191)

and

$\displaystyle
pr_{N}(p_{\alpha})(b)=\lim_{\lambda}p_{\alpha}(1_{\lambda}^{\mathfrak{A}_{0}}\otimes
b)\to\lim_{\lambda}p(1_{\lambda}^{\mathfrak{A}_{0}}\otimes b)=pr_{N}(p)(b).$
(192)

Similarly, suppose we have a net $\\{m_{\alpha}\\}$ in $M$ with $m_{\alpha}\to
m$ and a net $\\{n_{\alpha^{\prime}}\\}$ in $N$ with $n_{\alpha^{\prime}}\to
N$. Then for every $a\in\mathfrak{A}_{0}$, we have $m_{\alpha}(a)\to m(a)$ and
for every $b\in\mathfrak{B}_{0}$, we have $n_{\alpha^{\prime}}(b)\to n(b)$.
Hence,

$\displaystyle(pr_{M},pr_{N})^{-1}(m_{\alpha},n_{\alpha^{\prime}})(a\otimes
b)$ $\displaystyle=m_{\alpha}(a)\cdot n_{\alpha^{\prime}}(b)$
$\displaystyle\to m(a)\cdot n(b)=(pr_{M},pr_{N})^{-1}(m,n)(a\otimes b).$ (193)

∎

Hence, we have established that $P$ is homeomorphic to $M\times N$.

## References

  * Berger and Coburn, [1986] Berger, C. and Coburn, L. (1986).  Toeplitz Operators and Quantum Mechanics.  Journal of Functional Analysis, 68:273–399.
  * Bieliavsky and Gayral, [2015] Bieliavsky, P. and Gayral, V. (2015).  Deformation Quantization for Actions of Kählerian Lie Groups, volume 236 of Memoirs of the American Mathematical Society.  American Mathematical Society, Providence, RI.
  * Binz et al., [2004] Binz, E., Honegger, R., and Rieckers, A. (2004).  Field-theoretic Weyl Quantization as a Strict and Continuous Deformation Quantization.  Annales de l’Institut Henri Poincaré, 5:327–346.
  * Bursztyn and Weinstein, [2004] Bursztyn, H. and Weinstein, A. (2004).  Picard Groups in Poisson Geometry.  Moscow Mathematical Journal, 4(1):39–66.
  * Coburn, [1992] Coburn, L. A. (1992).  Deformation estimates for the Berezin-Toeplitz quantization.  Communications in Mathematical Physics, 149(2):415–424.
  * Crainic and Fernandes, [2004] Crainic, M. and Fernandes, R. L. (2004).  Integrability of Poisson Brackets.  Journal of Differential Geometry, 66(1).
  * Dixmier, [1977] Dixmier, J. (1977).  C*-Algebras.  North Holland, New York.
  * Feintzeig, [2024] Feintzeig, B. (2024).  Quantization as a Categorical Equivalence.  Letters in Mathematical Physics, forthcoming.
  * Feintzeig, [2023] Feintzeig, B. H. (2023).  The Classical–Quantum Correspondence.  Cambridge University Press, Cambridge.
  * Fell and Doran, [1988] Fell, G. and Doran, R. (1988).  Representations of *-algebras, locally compact groups, and Banach *-algebraic bundles.  Academic Press, Boston.
  * Honegger and Rieckers, [2005] Honegger, R. and Rieckers, A. (2005).  Some Continuous Field Quantizations, Equivalent to the C*-Weyl Quantization.  Publications of the Research Institute for Mathematical Sciences, Kyoto University, 41(113-138).
  * Honegger et al., [2008] Honegger, R., Rieckers, A., and Schlafer, L. (2008).  Field-Theoretic Weyl Deformation Quantization of Enlarged Poisson Algebras.  Symmetry, Integrability and Geometry: Methods and Applications, 4:047–084.
  * Kadison and Ringrose, [1997] Kadison, R. and Ringrose, J. (1997).  Fundamentals of the Theory of Operator Algebras.  American Mathematical Society, Providence, RI.
  * Kirchberg and Wasserman, [1995] Kirchberg, E. and Wasserman, S. (1995).  Operations on continuous bundles of C*-algebras.  Mathematische Annalen, 303:677–697.
  * Lance, [1976] Lance, C. (1976).  Tensor Products of Non-Unital C*-Algebras.  Journal of the London Mathematical Society, 2(12):160–168.
  * Lance, [1995] Lance, E. C. (1995).  Hilbert C*-Modules.  Cambridge University Press, Cambridge.
  * Landsman, [1993] Landsman, N. P. (1993).  Strict deformation quantization of a particle in external gravitational and Yang-Mills fields.  Journal of Geometry and Physics, 12:93–132.
  * Landsman, [1995] Landsman, N. P. (1995).  Rieffel induction as generalized quantum Marsden-Weinstein reduction.  Journal of Geometry and Physics, 15:285–319.
  * [19] Landsman, N. P. (1998a).  Mathematical Topics Between Classical and Quantum Mechanics.  Springer, New York.
  * [20] Landsman, N. P. (1998b).  Twisted Lie Group C*-Algebras as Strict Quantizations.  Letters in Mathematical Physics, 46:181–188.
  * Landsman, [1999] Landsman, N. P. (1999).  Lie Groupoid C*-algebras and Weyl Quantization.  Communications in Mathematical Physics, 206(2):367–381.
  * [22] Landsman, N. P. (2001a).  Bicategories of operator algebras and Poisson manifolds.  In Mathematical physics in mathematics and physics. Quantum and operator algebraic aspects. Proceedings of a conference, Siena, Italy, June 20–24, 2000. Dedicated to Sergio Doplicher and John E. Roberts on the occasion of their 60th birthday, pages 271–286. AMS, American Mathematical Society, Providence, RI.
  * [23] Landsman, N. P. (2001b).  Operator Algebras and Poisson Manifolds Associated to Groupoids.  Communications in Mathematical Physics, 222:97–116.
  * [24] Landsman, N. P. (2001c).  Quantized reduction as a tensor product.  In Quantization of Singular Symplectic Quotients, pages 137–180. Birkhäuser, Basel.
  * Landsman, [2003] Landsman, N. P. (2003).  Quantization as a Functor.  In Voronov, T., editor, Quantization, Poisson Brackets and beyond, pages 9–24. Contemp. Math., 315, AMS, Providence.
  * Landsman, [2005] Landsman, N. P. (2005).  Functorial Quantization and the Guillemin–Sternberg Conjecture.  In Twenty Years of Bialowieza: A Mathematical Anthology, pages 23–45. World Scientific, Singapore.
  * Landsman, [2007] Landsman, N. P. (2007).  Between Classical and Quantum.  In Butterfield, J. and Earman, J., editors, Handbook of the Philosophy of Physics, volume 1, pages 417–553. Elsevier, New York.
  * Mackey, [1968] Mackey, G. W. (1968).  Induced Representations of Groups and Quantum Mechanics.  W. A. Benjamin. Inc., New York.
  * Marsden and Weinstein, [1974] Marsden, J. and Weinstein, A. (1974).  Reduction of symplectic manifolds with symmetry.  Reports on Mathematical Physics, 5(1):121–30.
  * Nestruev, [2003] Nestruev, J. (2003).  Smooth Manifolds and Observables.  Springer-Verlag, New York.
  * Raeburn and Williams, [1998] Raeburn, I. and Williams, D. (1998).  Morita Equivalence and Continuous-Trace C*-Algebras, volume 60.  American Mathematical Society, Providence.
  * [32] Rieffel, M. (1974a).  Induced Representations of C*-Algebras.  Advances in Mathematics, 13:176–257.
  * [33] Rieffel, M. (1974b).  Morita Equivalence for C*-Algebras and W*-Algebras.  Journal of Pure and Applied Algebra, 5:51–96.
  * Rieffel, [1978] Rieffel, M. (1978).  Induced Representations of C*-Algebras.  Bulletin of the American Mathematical Society, 4:606–609.
  * Rieffel, [1989] Rieffel, M. (1989).  Deformation Quantization of Heisenberg manifolds.  Communications in Mathematical Physics, 122:531–562.
  * Rieffel, [1993] Rieffel, M. (1993).  Deformation quantization for actions of $\mathbb{R}^{d}$.  Memoirs of the American Mathematical Society. American Mathematical Society, Providence, RI.
  * [37] Steeger, J. and Feintzeig, B. (2021a).  Extensions of bundles of C*-algebras.  Reviews in Mathematical Physics, 33(8):2150025.
  * [38] Steeger, J. and Feintzeig, B. H. (2021b).  Is the classical limit “singular”?  Studies in History and Philosophy of Science Part A, 88:263–279.
  * Sternberg, [1977] Sternberg, S. (1977).  Minimal coupling and the symplectic mechanics of a classical particle in the presence of a Yang-Mills field.  Proceedings of the National Academy of the Sciences, 74(12):5253–4.
  * van Nuland, [2019] van Nuland, T. D. H. (2019).  Quantization and the resolvent algebra.  Journal of Functional Analysis, 277(8):2815–2838.
  * Weinstein, [1983] Weinstein, A. (1983).  The local structure of Poisson manifolds.  Journal of Differential Geometry, 18(3).
  * Weinstein, [1978] Weinstein, M. (1978).  A universal phase space for particles in Yang-Mills fields.  Letters in Mathematical Physics, 2:417–20.
  * Xu, [1991] Xu, P. (1991).  Morita Equivalence of Poisson Manifolds.  Communications in Mathematical Physics, 142:493–509.
  * Xu, [1992] Xu, P. (1992).  Morita equivalence and symplectic realizations of Poisson manifolds.  Annales scientifiques de l'École normale supérieure, 25(3):307–333.
  * Xu, [1994] Xu, P. (1994).  Classical Intertwiner Space and Quantization.  Communications in Mathematical Physics, 164:473–488.