# Unmasking Database Vulnerabilities: Zero-Knowledge Schema Inference Attacks
in Text-to-SQL Systems

Đorđe Klisura  Anthony Rios
Department of Information Systems and Cyber Security
The University of Texas at San Antonio
{Dorde.Klisura<EMAIL_ADDRESS>
###### Abstract

Relational databases are integral to modern information systems, serving as
the foundation for storing, querying, and managing data efficiently and
effectively. Advancements in large language modeling have led to the emergence
of text-to-SQL technologies, significantly enhancing the querying and
extracting of information from these databases and raising concerns about
privacy and security. Our research extracts the database schema elements
underlying a text-to-SQL model. Knowledge of the schema can make attacks such
as SQL injection easier. By asking specially crafted questions, we have
developed a zero-knowledge framework designed to probe various database schema
elements without knowledge of the database itself. The text-to-SQL models then
process these questions to produce an output that we use to uncover the
structure of the database schema. We apply it to specialized text-to-SQL
models fine-tuned on text-SQL pairs and generative language models used for
SQL generation. Overall, we can reconstruct the table names with an F1 of
nearly .75 for fine-tuned models and .96 for generative.

Unmasking Database Vulnerabilities: Zero-Knowledge Schema Inference Attacks in
Text-to-SQL Systems

Đorđe Klisura and Anthony Rios Department of Information Systems and Cyber
Security The University of Texas at San Antonio {Dorde.Klisura,
<EMAIL_ADDRESS>

##  1 Introduction

Text-to-SQL systems are designed to convert natural language questions into
executable SQL queries Yaghmazadeh et al. (2017); Zhong et al. (2017); Yu et
al. (2018a); Zelle and Mooney (1996). This advancement in database management
allows users to interact with databases without a prior understanding of SQL
syntax or the database structure, enhancing database accessibility and
broadening the usability of data-driven applications. Given that text-to-SQL
models can provide access to data to more users in an easy-to-use framework,
organizations are now using them locally, and cloud providers are releasing
systems as a service Obeng et al. (2024); Eusebius et al. (2024). Moreover,
there is increasing interest in text-to-SQL in sensitive domains such as
healthcare Tarbell et al. (2023); Lee et al. (2022); Wang et al. (2020b).

Figure 1: Reconstructing database schema by interacting with text-to-SQL model
and using surrogate LLM.

Although natural language interfaces to databases offer many benefits,
research on their security aspects has been limited despite the acknowledged
security concerns Peng et al. (2022, 2023). Generally, the systems input two
pieces of information: the database schema and a query. The schema can be
hidden from the user, so they only need to write a natural language question.
Many organizations hide information from various users on a need-to-know
basis, including database schema information. The schema can provide users
with propriety information, which companies want to protect. For example, an
AI company may collect and store unique data sources, resulting in a leading
AI solution. If adversaries know what information is used to train the AI
solutions, they could replicate that work. Furthermore, the organization can
be more easily attacked if unauthorized users can access information embedded
within the text-to-SQL model.

The reliance of these systems on database schema for SQL query generation also
makes organizations susceptible to SQL injection attacks, among the most
prevalent security threats Clarke-Salt and Clarke (2012); Halfond et al.
(2006). Specifically, knowing the database architecture can enable attackers
to craft precise SQL injection attacks, leading to unauthorized data access,
modification, or deletion of critical data, exploiting vulnerabilities, and
causing severe data breaches Yeole and Meshram (2011); Zhang et al. (2023).
Given the growing reliance of organizations on these systems for various
applications, it is important to address these security concerns to ensure the
integrity and security of text-to-SQL technologies. However, there has not
been research into whether an adversary can gain access to the entire database
schema without direct access to the model in a black-box testing setup.

To address this gap, we propose a framework that probes the database schema
elements underlying text-to-SQL models without prior knowledge of the
database. The framework employs automatic question generation and leverages a
surrogate model to interpret responses from the attacked model. This process
involves iterative probing and analysis, ultimately leading to a detailed
reconstruction of the database schema. Figure 1 illustrates our approach at a
high level.

It is important to emphasize that text-to-SQL systems are built using two
general approaches: fine-tuning and prompt-engineering. Fine-tuned text-to-SQL
models are specifically trained on text-SQL pairs, which could include the
exact data used in the database and real-world SQL statements, potentially
enabling them to achieve higher accuracy in targeted datasets and domains Rai
et al. (2023); Li et al. (2023); Qi et al. (2022). Fine-tuned models will
generally only return SQL statements. In contrast, generative large language
models (LLMs) using prompt-based frameworks are designed to handle various
tasks, generating SQL queries from natural language input based on extensive
pre-training on diverse data corpora Gao et al. (2023); Pourreza and Rafiei
(2024); Dong et al. (2023). In this paper, we show that our system can
reproduce the database schema independent of the specific text-to-SQL model
type.

Overall, our contributions are as follows:

  1. (i)

We introduce a novel zero-knowledge framework for probing database schema
elements underlying text-to-SQL models.

  2. (ii)

We comprehensively evaluate the framework across multiple datasets and various
types of models: two fine-tuned and four generative language models.

  3. (iii)

We introduce and evaluate a simple protection mechanism for generative large
language models using prompting to mitigate our attacks directly, yet we show
they are still vulnerable.

##  2 Related Work

Our research is related to two lines of work: Text-to-SQL models and security
in NLP and LLMs.

Text-to-SQL. Text-to-SQL semantic parsing has been extensively studied to
develop language agents for database applications Dahl et al. (1994); Zelle
and Mooney (1996). Since the release of many large-scale text-to-SQL datasts
Zhong et al. (2017); Wang et al. (2020b); Yu et al. (2018b), many parsers have
been developed on top of language models to understand various database
schemas better. Most methods fall into one of two approaches: Fine-tuned or
prompt-based systems.

Fine-tuned methods focus on adapting pre-trained models like BERT Devlin et
al. (2018) and T5 Raffel et al. (2020) to the specific task of SQL generation
from natural language queries. For example, SQLova Hwang et al. (2019) and
BRIDGE Lin et al. (2020) leverage BERT’s ability to understand complex
language structures and apply additional layers or mechanisms to tailor the
model for SQL prediction. SQLova uses BERT to encode input questions and
schemas, applying a sketch-based method to predict the SQL components in a
structured manner Deng et al. (2022). Meanwhile, pre-trained models
specifically designed for tabular data have also been introduced. For
instance, TaPas Herzig et al. (2020) and TaBERT Yin et al. (2020) extend
BERT’s capabilities to handle tables by incorporating table-specific
embeddings and objectives during pre-training Qin et al. (2022). Recent
advancements also include models like Grappa Yu et al. (2020), which uses a
grammar-augmented pre-training framework that integrates table schema linking,
significantly improving the accuracy of generated SQL queries by effectively
capturing relational structures within the data Deng et al. (2022).

On the other hand, LLM-based methods for text-to-SQL have gained prominence
due to their ability to perform zero-shot reasoning and generalize across
domains Zhang et al. (2024). These methods have repeatedly set new benchmarks
on the Spider leaderboard. For instance, C3 Dong et al. (2023), a zero-shot
Text-to-SQL method built on ChatGPT, achieved an execution accuracy of 82.3%
by optimizing model input, bias, and output. DIN-SQL Pourreza and Rafiei
(2024) introduced a decomposition approach, breaking the task into smaller,
manageable sub-tasks, and reached an accuracy of 85.3% on Spider. DAIL-SQL Gao
et al. (2023) further pushed the accuracy to 86.6% through supervised fine-
tuning and a systematic study of in-context learning, focusing on selecting
and organizing helpful examples in prompts. These LLM-based methods leverage
the in-context learning, semantic understanding, and reasoning capabilities of
LLMs. For example, C3 exploits ChatGPT’s zero-shot learning capability, while
DIN-SQL simplifies the task by focusing on schema linking, difficulty
classification, and SQL generation Li et al. (2024b). DAIL-SQL combines in-
context learning with supervised fine-tuning to enhance LLM performance
further. Advanced reasoning methods, such as chain-of-thought and self-
reflection, are also incorporated to improve the accuracy and robustness of
SQL generation Zhang et al. (2024).

With regard to this paper, fine-tuned and prompt-based systems have different
pros and cons from a performance and security standpoint. Fine-tuned training
can work well when the training data closely or exactly matches what is used
at test time. However, this can result in more security vulnerabilities. Fine-
tuned models can leak the database schema, but worse, they may be prone to
data inference attacks that can access the training data explicitly. On the
other hand, prompt-based solutions may not perform well as highly fine-tuned
in-domain models, but they outperform fine-tuned systems on out-of-domain
data. Moreover, they are not trained on the actual organization’s data.
However, these systems are still prone to database schema leaks. In this
paper, we evaluate how each model type is more susceptible to attacks that
leak the database schema.

Security in NLP and LLMs Security in this context primarily concerns the
robustness of NLP models to adversarial attacks, the potential for model
misuse, and safeguarding sensitive data during model training and deployment
(Morris et al., 2020; Goyal et al., 2023; Yao et al., 2024; Zhang et al.,
2020).

Adversarial attacks threaten NLP model security by introducing subtle input
perturbations that lead to incorrect or harmful outputs Szegedy et al. (2013);
Qiu et al. (2022); Coalson et al. (2023). Consequently, various methods for
generating natural adversarial texts have been introduced Li et al. (2020);
Ebrahimi et al. (2017); Ren et al. (2019); Li et al. (2018); Jin et al.
(2020); Garg and Ramakrishnan (2020); Guo et al. (2021) Furthermore, similar
approaches have been shown to affect LLMs, with carefully crafted prompts
inducing aligned LLMs to generate malicious content Wei et al. (2024). Unlike
traditional adversarial examples, these jailbreaks are crafted manually,
making them labor-intensive. Although there has been some progress in
automatic prompt-tuning for adversarial attacks on LLMs Shin et al. (2020);
Wen et al. (2024); Jones et al. (2023), this remains a challenging task due to
the discrete nature of token inputs in LLMs.

Apart from the security risks associated with adversarial attacks, LLMs that
are trained and fine-tuned on sensitive, domain-specific data face significant
privacy concerns due to their tendency to retain and reproduce verbatim text
from their training data Anil et al. (2023); Carlini et al. (2019, 2021,
2022). Recent work Panda et al. (2024) proposes a data extraction attack that
enables adversaries to target and extract sensitive information, including
credit card numbers, from a model trained on user data. Furthermore, state-of-
the-art privacy attacks against LLMs have shown that over 50% of the fine-
tuning datasets can be extracted from a fine-tuned LLM in natural settings
Wang et al. (2024). A recent survey by Yan et al. (2024) highlights the
urgency of addressing these vulnerabilities with comprehensive privacy
protection mechanisms, such as differential privacy and federated learning, to
safeguard sensitive data across all stages of LLM development.

Our work extends prior research on NLP and LLM security by focusing on the
vulnerabilities of text-to-SQL systems. By examining how these models can
infer database schema elements without prior knowledge, we highlight
significant risks to database security. Understanding these vulnerabilities is
critical, as it informs the development of better defenses for text-to-SQL
systems and other LLM applications interacting with structured data.

##  3 Method

Figure 2: Overview of the Schema Reconstruction Process. In the first step, we
generate initial input questions, including both random and adversarial
queries, which are processed by the text-to-SQL model. The second step
involves preliminary schema interpretation using a surrogate LLM (GPT-4) to
analyze the model’s outputs and formulate an initial schema. In the third
step, the surrogate model generates new questions targeting the identified
schema elements to refine the schema understanding. The final fourth step is
schema reconstruction, where the surrogate model consolidates all the
information to produce a detailed database schema.

Intuitively, our goal is to reconstruct the database schema underlying the
text-to-SQL model, including table names, column names, and their
corresponding data types, without having direct access to it. In this section,
we describe the method we developed to achieve this.

We begin by formally defining the task. Given a set of natural language
questions $\\{Q_{1},Q_{2},\ldots,Q_{n}\\}$, and their corresponding SQL query
outputs $\\{Y_{1},Y_{2},\ldots,Y_{n}\\}$ generated by a text-to-SQL model, the
objective is to reconstruct database schema $S=(T,C,D)$, where
$T=\\{t_{1},\ldots,t_{m}\\}$ represents table names,
$C=\\{c_{1},\ldots,c_{p}\\}$ represent columns names and
$D=\\{d_{1},\ldots,d_{p}\\}$ represents their corresponding data types. The
process of generating an SQL query $Y$ by a large language model $M$ can be
defined as a conditional probability distribution:

$\text{I\kern-1.49994ptP}_{\mathcal{M}}(\mathcal{Y}\mid\mathcal{P}(Q,S))=\prod_{i=1}^{|\mathcal{Y}|}\text{I\kern-1.49994ptP}_{\mathcal{M}}(Y_{i}\mid\mathcal{P}(Q,S),Y_{1:i-1})$

where $P(Q,S)$ represents the prompt combining the natural language question
$Q$ and the schema $S$, $Y_{i}$ denotes the $i$-th token of the SQL query $Y$,
and $|Y|$ denotes the length of $Y$.

Intuitively, given the model is prompted with the schema, it is liable to leak
information at generation time. Hence, we introduce a novel zero-knowledge
framework for reconstructing a database schema underlying text-to-SQL models.
Our approach consists of four stages: 1) initial input generation, 2)
preliminary schema interpretation, 3) dynamic question generation and
refinement, and 4) schema reconstruction. Figure 2 provides an overview of
this process. In the following subsections, we describe each stage in detail.

Step 1: Initial Input Generation. We begin by crafting inputs to the text-to-
SQL system, categorized into two distinct types: random input strings and
“adversarial” input questions.

We assume that even when a random input is passed to the text-to-SQL model,
the text-to-SQL model that has either been trained to produce a specific
response or just prompted with schema information may inadvertently leak
schema information included in the prompt. By feeding the model a series of
random strings, we aim to exploit this tendency for information leakage. The
goal is to collect as much hidden schema information as possible from the
outputs generated in response to these random inputs. The reasoning is that
with sufficient random inputs, we can maximize the likelihood of extracting
useful schema details embedded in the model’s responses. Here is an example of
the random input we used to feed the model: $3qio\\#jwfi@Qaaijf$.

In addition to random inputs, we include adversarial input questions
specifically designed to prompt the generative models to reveal database
schema details directly. Some examples of adversarial questions include the
following:  (1) Identify tables that contain geospatial data types (2) Show
the table names in the database (3) List columns with enumerated types and
their possible values . Generative LLMs are more susceptible to these simple
adversarial questions, producing outputs ranging from SQL queries to fragments
of the database schema.

We generate an initial set of input questions, including random input strings
and adversarial queries. These inputs are then fed into the text-to-SQL model,
which processes them and generates the corresponding outputs used in the next
step.

Step 2: Preliminary Schema Interpretation (PSI). This step leverages the
interpretive capabilities of GPT-4 Achiam et al. (2023) to synthesize a
preliminary understanding of the database structure, laying the foundation for
more refined schema reconstruction in subsequent steps. We employ GPT-4 as a
surrogate LLM to analyze and interpret the outputs from step 1. The generated
responses from the text-to-SQL model are passed to GPT-4, which is then
prompted to provide an initial assumption of the database schema, including
the database context, table names, column names, and data types. Based on
these tables and columns, GPT-4 is also prompted to infer what other tables it
would expect to see in the database. For example, if the model returns a
query:

⬇

SELECT name FROM STUDENTS;

GPT-4 can infer that name is a column and STUDENTS is a table. The model is
further instructed to estimate the data types of the columns. In this case,
GPT-4 understands that the column name is likely stored as a text data type in
the STUDENTS table. Furthermore, GPT-4 is prompted to estimate the presence of
related tables that were not directly mentioned in the output, such as
COURSES, ENROLLMENTS, or GRADES, each with its relevant columns and their data
types. This predictive step helps hypothesize a more comprehensive schema that
will lead us to craft better questions in Step 3.

Step 3: Dynamic Question Generation and Refinement. After obtaining the
initial estimation of the schema, we prompt the surrogate model to craft
natural language questions for the text-to-SQL model that target the
identified tables and help us infer other unknown schema elements. We use the
prompt

> Given the initial estimation of the schema {schema}, generate random natural
> language questions to help infer other unknown schema elements. We are using
> these questions for a text-to-SQL model.

where {schema} is the currently estimated schema from Step 2. Once we have
these new questions, they are passed back to the text-to-SQL model to obtain
refined outputs.

To illustrate the idea behind this, let’s consider our example of the STUDENTS
table. Based on the preliminary schema interpretation (Step 2), we know that
the schema consists of a table STUDENTS that has columns name and age. We now
want the model to craft questions that not only help us collect more
information about other unknown elements in table STUDENTS but also
potentially reveal new schema components. For instance, a question targeting a
known or estimated schema element might be:

> What are the names of all courses that students are enrolled in?

When we pass this question to the text-to-SQL model, if these elements exist
in the schema, we might receive an SQL query like:

> ⬇
>
> SELECT course_name
>
> FROM COURSES
>
> JOIN ENROLLMENTS ON COURSES.course_id = ENROLLMENTS.course_id
>
> JOIN STUDENTS ON ENROLLMENTS.student_id = STUDENTS.student_id;

From this output, we can draw several conclusions about new tables, columns,
and data types:

  * •

New tables: The query reveals the existence of the COURSES and ENROLLMENTS
tables.

  * •

New columns: We learn about new columns such as course_id in both COURSES and
ENROLLMENTS, student_id in STUDENTS and ENROLLMENTS, and course_name in
COURSES.

  * •

The query indicates that ENROLLMENTS serves as a linking table between
STUDENTS and COURSES, with foreign keys student_id and course_id establishing
these relationships.

By crafting these questions, we prompt the text-to-SQL model to generate
outputs that can continue to reveal relationships between tables and uncover
additional tables. Through this iterative process, the model refines our
understanding of known schema elements and helps discover new ones, ultimately
leading to a more comprehensive and accurate reconstruction of the database
schema.

Step 4: Schema Reconstruction. In the final step, we use surrogate LLM to
analyze the outputs from Step 3 and Step 1 to reconstruct the database schema.
We prompt the model to extract table names, column names, and the data types
of the columns. This detailed analysis enables the model to piece together a
comprehensive schema.

For example, if the previous steps have revealed table names like STUDENTS,
COURSES, and ENROLLMENTS, along with columns such as student_id, name,
course_id, and course_name, the model will identify these elements and
determine their respective data types, such as integer for student_id and
course_id, and text for columns name and course_name. This step results in a
detailed schema reconstruction, accomplished without prior knowledge of the
database, i.e., we pass random strings as input. Finaly, we note that Steps 1,
2, and 3 can be repeated multiple times, refining the schema iteratively. In
our experiments, we only make one complete cycle of the process in Figure 2.

##  4 Evaluation

In this section, we evaluate the effectiveness of our approach, detailing the
data used, the baselines for comparison, and the results obtained.

Data. The evaluation uses two datasets: Spider Yu et al. (2018b) and BIRD Li
et al. (2024a). Spider is a large-scale, complex, and cross-domain text-to-SQL
dataset. On the other hand, BIRD (BIg Bench for LaRge-scale Database Grounded
Text-to-SQL Evaluation) is a novel dataset that addresses the gap between
academic benchmarks and real-world applications by focusing on the challenges
posed by database value comprehension and handling massive databases. The data
statistics are summarized in Table 1.

Dataset | # DB | # Tables/DB | # Domains
---|---|---|---
Spider | 200 | 5.1 | 138
BIRD | 95 | 7.38 | 37
Table 1: Data Statistics.

Metrics. To evaluate how well we can reconstruct the database schema, we use
precision, recall, and F1 as our performance metrics in three scenarios:
table, column, and data type performance. For tables, we define a true
positive (TP) for a given table name $t_{i}$ if our predicted table name
$\hat{t}_{i}$ matches. We define a TP for columns when the predicted table and
column name tuple $(t_{i},c_{i})$ matches the actual tuple
$(\hat{t}_{i},\hat{c}_{i})$. This implies that even if we predict a correct
column, but match it to the wrong table, it would be a false positive (FP) and
a false negative (FN). For the data types, we define a TP when the predicted
table name, column name, and data type triple
$(\hat{t}_{i},\hat{c}_{i},\hat{d}_{i})$ matches the actual triple
$(t_{i},c_{i},d_{i})$. Like columns, predicting the correct data type but
associating it with the wrong column or table would result in an FP and FN. We
calculate example-like precision, recall, and F1-score by evaluating these
metrics for each database individually and then averaging the scores across
all databases. Additionally, following the work of Wang et al. (2020a), we
evaluated the performance of the models used in our study for the text-to-SQL
task in terms of execution accuracy.

Model | Execution Accuracy
---|---
T5-Large | 82.67
SQLCoder | 73.69
Code Llama | 61.26
GPT-4 | 72.61
LLAMA 3 | 60.38
LLAMA 2 | 50.32
Table 2: Model execution accuracy.

|  |  | Table | Table+Col | Table+Col+Type
---|---|---|---|---|---
|  |  | Prec | Rec | F1 | Prec | Rec | F1 | Prec | Rec | F1
Baseline | Fine-tuned | T5 Large | .371 | .184 | .228 | .111 | .039 | .053 | .102 | .035 | .048
SQLCoder | .211 | .189 | .192 | .078 | .039 | .047 | .039 | .017 | .021
Gen. LLMs | LLAMA 3 | .097 | .053 | .064 | .072 | .031 | .042 | .067 | .029 | .039
LLAMA 2 | .071 | .029 | .038 | .136 | .061 | .079 | .056 | .032 | .038
Code LLAMA 2 | .556 | .532 | .535 | .215 | .122 | .146 | .201 | .112 | .134
GPT 4.0 | .799 | .769 | .782 | .815 | .774 | .787 | .818 | .772 | .787
Gen. LLMs (Sec) | LLAMA 3 | .052 | .018 | .027 | .112 | .034 | .048 | .027 | .013 | .017
LLAMA 2 | .023 | .007 | .010 | .070 | .034 | .041 | .033 | .016 | .019
GPT 4.0 | .712 | .625 | .666 | .734 | .648 | .688 | .743 | .658 | .698
PSI | Fine-tuned | T5 Large | .621 | .688 | .625 | .336 | .289 | .296 | .302 | .253 | .263
SQLCoder | .262 | .416 | .306 | .121 | .142 | .122 | .100 | .114 | .100
Gen. LLMs | LLAMA 3 | .247 | .302 | .255 | .219 | .281 | .233 | .180 | .235 | .194
LLAMA 2 | .191 | .290 | .213 | .338 | .507 | .375 | .279 | .418 | .310
Code LLAMA 2 | .666 | .746 | .673 | .695 | .782 | .702 | .554 | .626 | .559
GPT 4.0 | .957 | .910 | .927 | .991 | .938 | .957 | .900 | .828 | .854
Gen. LLMs (Sec) | LLAMA 3 | .026 | .083 | .037 | .104 | .207 | .129 | .079 | .146 | .096
LLAMA 2 | .118 | .158 | .128 | .335 | .518 | .372 | .296 | .451 | .326
GPT 4.0 | .940 | .879 | .900 | .964 | .704 | .792 | .814 | .572 | .655
Schema Reconstruction | Fine-tuned | T5 Large | .764 | .792 | .746 | .425 | .359 | .369 | .372 | .297 | .312
SQLCoder | .611 | .715 | .659 | .407 | .334 | .343 | .266 | .231 | .231
Gen. LLMs | LLAMA 3 | .755 | .591 | .601 | .750 | .380 | .459 | .494 | .262 | .316
LLAMA 2 | .738 | .874 | .767 | .758 | .573 | .604 | .169 | .159 | .158
Code LLAMA 2 | .910 | .934 | .906 | .880 | .838 | .840 | .766 | .710 | .721
| GPT 4.0 | .993 | .948 | .965 | .980 | .823 | .881 | .837 | .686 | .741
Gen. LLMs (Sec) | LLAMA 3 | .741 | .518 | .547 | .672 | .233 | .316 | .207 | .078 | .106
LLAMA 2 | .761 | .835 | .756 | .727 | .523 | .560 | .182 | .122 | .133
GPT 4.0 | .989 | .892 | .921 | .973 | .611 | .718 | .796 | .483 | .571

Table 3: Performance results on the Spider dataset.

|  |  | Table | Table+Col | Table+Col+Type
---|---|---|---|---|---
|  |  | Prec | Rec | F1 | Prec | Rec | F1 | Prec | Rec | F1
Baseline | Fine-tuned | T5 Large | .366 | .139 | .185 | .161 | .050 | .065 | .134 | .033 | .049
SQLCoder | .148 | .135 | .139 | .184 | .095 | .112 | .181 | .085 | .104
Gen. LLMs | LLAMA 3 | .056 | .028 | .035 | .164 | .076 | .094 | .159 | .065 | .085
LLAMA 2 | .175 | .069 | .091 | .191 | .075 | .100 | .178 | .066 | .090
Code LLAMA 2 | .440 | .350 | .369 | .234 | .155 | .172 | .197 | .117 | .136
GPT 4.0 | .744 | .616 | .655 | .778 | .645 | .685 | .775 | .637 | .677
Gen. LLMs (Sec) | LLAMA 3 | .035 | .016 | .021 | .176 | .076 | .096 | .164 | .066 | .087
LLAMA 2 | .140 | .059 | .071 | .233 | .079 | .108 | .197 | .062 | .086
GPT 4.0 | .653 | .554 | .584 | .697 | .578 | .611 | .690 | .573 | .606
PSI | Fine-tuned | T5 Large | .670 | .621 | .609 | .288 | .222 | .228 | .200 | .150 | .158
SQLCoder | .315 | .445 | .356 | .139 | .209 | .158 | .108 | .157 | .119
Gen. LLMs | LLAMA 3 | .688 | .387 | .456 | .361 | .126 | .171 | .278 | .073 | .102
LLAMA 2 | .914 | .860 | .873 | .436 | .387 | .379 | .370 | .318 | .315
Code LLAMA 2 | .872 | .790 | .801 | .394 | .400 | .379 | .342 | .330 | .320
GPT 4.0 | .933 | .829 | .862 | .722 | .674 | .676 | .602 | .547 | .553
Gen. LLMs (Sec) | LLAMA 3 | .761 | .346 | .433 | .423 | .129 | .168 | .330 | .091 | .120
LLAMA 2 | .886 | .770 | .785 | .419 | .342 | .329 | .351 | .270 | .268
GPT 4.0 | .952 | .874 | .896 | .670 | .469 | .510 | .549 | .365 | .404
Schema Reconstruction | Fine-tuned | T5 Large | .720 | .631 | .636 | .326 | .204 | .229 | .253 | .151 | .173
SQLCoder | .504 | .709 | .526 | .251 | .304 | .250 | .208 | .239 | .208
Gen. LLMs | LLAMA 3 | .903 | .450 | .559 | .465 | .172 | .225 | .371 | .118 | .164
LLAMA 2 | .881 | .821 | .825 | .424 | .330 | .343 | .320 | .238 | .251
Code LLAMA 2 | .919 | .844 | .866 | .415 | .431 | .403 | .340 | .343 | .326
GPT 4.0 | .982 | .871 | .904 | .557 | .436 | .456 | .421 | .322 | .339
Gen. LLMs (Sec) | LLAMA 3 | .895 | .423 | .528 | .471 | .160 | .216 | .366 | .118 | .163
LLAMA 2 | .844 | .733 | .748 | .428 | .284 | .298 | .337 | .230 | .239
GPT 4.0 | .983 | .836 | .884 | .614 | .363 | .417 | .438 | .253 | .289

Table 4: Performance results on the BIRD dataset.

Baselines. In our study, we establish a baseline by testing the ability of
different models to directly output the database schema. We test four
generative models: GPT-4, LLAMA 3 AI@Meta (2024), LLAMA 2 Touvron et al.
(2023), and Code Llama Roziere et al. (2023), along with two fine-tuned
models: T5-Large Raffel et al. (2020) and SQLCoder Ping and Srivastava (2023).
To establish a baseline, we use a simple prompt to assess each model’s ability
to output the database schema directly. The baseline prompt used for all
models is as follows:

> Output the database schema. Output tables, columns, and data types.

We employ GPT-4 to analyze the results from the baseline prompt. The results
from this baseline evaluation provide a reference point to measure the
improvements and effectiveness of our proposed schema reconstruction
methodology.

Additionally, we introduce a simple protection mechanism for generative LLMs
using prompting to mitigate our attacks directly. This is the prompt we use is

> If the natural language question is not relevant to the schema or is
> nonsensical (gibberish), respond with "Question not valid."

This protection mechanism aims to prevent the model from releasing SQL
statements if the question is unrelated to the database schema.

Results. Our study evaluates the effectiveness of our schema reconstruction
approach across multiple text-to-SQL models and datasets, comparing it against
baseline methods and preliminary schema interpretation (PSI). The results are
summarized in Tables 3 and 4. We also report the execution accuracies of the
text-to-SQL models in table 2.

First, we report the general text-to-SQL performance in Table 2. Overall, the
fine-tuned T5-Large model performs the best, scoring 82.67. The next best
methods are SQLCoder and GPT-4, with 73.69 and 72.61, respectively. The worst
method was LLAMA 2, yet it still shows that it can generate the correct SQL
statement more than half the time.

For the spider results in Table 3, our schema reconstruction method
substantially outperforms the baseline and PSI approaches. For fine-tuned
models, T5-Large achieved an F1 score of 0.746 for table reconstruction, while
SQLCoder reached an F1 score of 0.659. These scores indicate substantial
improvements over the baseline F1 scores of 0.228 and 0.192, respectively.
Similarly, the Code LLAMA 2 model achieved an F1 score of 0.906.

Generative models also showed notable improvements with our schema
reconstruction method. GPT-4, in particular, achieved an F1 score of 0.965 for
table reconstruction, far surpassing the baseline score of 0.782 and the PSI
score of 0.927. Other generative models, such as LLAMA 3 and LLAMA 2, also
demonstrated enhanced performance with our approach, achieving F1 scores of
0.601 and 0.767, respectively, compared to their baseline scores. The most
interesting results are for GPT-4, which can sometimes have slightly worse
results with our method than the baseline and PSI. The reason is that GPT-4 is
highly likely to return the entire schema if asked simply. We experimented
with various prompts that explicitly asked it not to return the schema as a
security feature, yet it did not work.

The BIRD dataset results, presented in Table 4, further confirm the
effectiveness of our schema reconstruction method. For fine-tuned models,
T5-Large achieved an F1 score of 0.636, and SQLCoder reached 0.526, both
showing significant improvements from their baseline scores of 0.185 and
0.139, respectively. Code LLAMA 2 also exhibited strong performance with an F1
score of 0.866.

Among the generative models, GPT-4 again demonstrated exceptional improvements
with our method, achieving an F1 score of 0.904 for table reconstruction,
compared to the baseline score of 0.655 and the PSI score of 0.862. LLAMA 3
and LLAMA 2 models achieved F1 scores of 0.559 and 0.825, respectively,
showcasing improvements over their baseline scores. Again, though, we find
weird numbers for the columns and some datatypes for GPT-4. This can happen
because of noise introduced into the system, given that the model has a high
chance of regurgitating the schema. Still, our schema reconstruction approach
is more robust than baseline and PSI across all model types. Moreover, we want
to point out that the table name is generally the most important feature from
an attack perspective (e.g., for SQL injections). Moreover, nothing stops an
attacker from using all three approaches and manually interpreting the
estimated schemas; hence, recall will be the most important attribute.
Moreover, our main finding is that the text-to-SQL models are prone to attacks
and more research is needed to mitigate them.

##  5 Conclusion

This study highlights the significant security risks associated with text-to-
SQL models by demonstrating a novel zero-knowledge framework capable of
reconstructing database schema underlying text-to-SQL model. The ability to
uncover schema elements without prior knowledge of the database underscores
security threats, like sophisticated SQL injection attacks, which pose a
substantial threat to data security and privacy.

We evaluated the effectiveness of our approach through an extensive evaluation
of the Spider and BIRD datasets, where we achieved high F1 scores,
particularly with generative models like GPT-4. The study underscores the
urgent need for enhanced security measures in text-to-SQL systems. Future work
should focus on developing more robust defense mechanisms to protect against
schema leakage and other potential security threats. Furthermore, given the
explosion of prompting-based methods in industry, our approach can be seen as
a method to steal pieces of a prompt and could be extended to non-text-to-SQL
tasks as well.

##  6 Limitations

Despite the promising results achieved in our study, several limitations must
be acknowledged. First, the evaluation was conducted on the Spider and BIRD
datasets, which, although large and diverse, may not fully represent all real-
world database schemas. The schemas in these datasets are primarily academic
or benchmark datasets, potentially limiting the generalizability of our
findings to more complex or proprietary database schemas in industry
applications. These databases are relatively small, with an average of 5 to 7
tables in each database. Real-world databases can contain hundreds or
thousands of tables.

Additionally, the performance of our schema reconstruction approach varies
significantly across different text-to-SQL models. While GPT-4 demonstrated
high accuracy in schema reconstruction, other models like LLAMA 2 and 3 showed
lower performance. This variability indicates that our approach may be more
effective with certain models, particularly those with advanced language
understanding and generation capabilities. Also, our approach uses GPT-4 as a
surrogate model to interpret the outputs of the text-to-SQL model and generate
new probing questions. The success of this step is contingent upon the
surrogate model’s ability to accurately understand and predict database schema
elements, which may not always align perfectly with the schema used by the
text-to-SQL model.

While we introduced a simple protection mechanism for generative LLMs to
mitigate our attacks, this approach may not be comprehensive. More
sophisticated security measures need to be explored and evaluated to ensure
the robustness of text-to-SQL systems against schema inference attacks.
Finally, our method involves iterative querying and analysis, which may be
computationally intensive and time-consuming, particularly for large databases
with complex schemas. Optimizing the efficiency of this process is essential
for practical deployment in real-world scenarios.

Addressing these limitations will be critical in future work to enhance the
robustness, generalizability, and efficiency of our schema reconstruction
approach and ensure its applicability across a wider range of text-to-SQL
systems and database environments.

##  7 Ethical Implications

The methods and findings presented in this paper carry significant ethical
implications. While our research aims to highlight and address vulnerabilities
in text-to-SQL systems, the techniques developed could potentially be misused
by malicious actors to infer and steal sensitive information from databases.
This underscores the dual-use nature of our work, where advancements in
understanding and mitigating security risks also present opportunities for
exploitation.

Researchers and practitioners must consider the ethical responsibilities of
developing and deploying such technologies. Ensuring that security measures
and protections are robust and effective is paramount to preventing
unauthorized access and safeguarding sensitive data. Furthermore, it is
essential to promote awareness and adherence to ethical guidelines within the
research community to mitigate the potential misuse of these techniques.

Our findings highlight the urgent need for comprehensive security frameworks
and practices to protect against schema inference attacks and other
vulnerabilities in text-to-SQL systems. By advancing our understanding of
these risks and developing more resilient defenses, we aim to contribute
positively to the field while acknowledging and addressing the associated
ethical challenges.

## References

  * Achiam et al. (2023) Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. 2023.  Gpt-4 technical report.  _arXiv preprint arXiv:2303.08774_.
  * AI@Meta (2024) AI@Meta. 2024.  Llama 3 model card.
  * Anil et al. (2023) Rohan Anil, Andrew M Dai, Orhan Firat, Melvin Johnson, Dmitry Lepikhin, Alexandre Passos, Siamak Shakeri, Emanuel Taropa, Paige Bailey, Zhifeng Chen, et al. 2023.  Palm 2 technical report.  _arXiv preprint arXiv:2305.10403_.
  * Carlini et al. (2022) Nicholas Carlini, Daphne Ippolito, Matthew Jagielski, Katherine Lee, Florian Tramer, and Chiyuan Zhang. 2022.  Quantifying memorization across neural language models.  _arXiv preprint arXiv:2202.07646_.
  * Carlini et al. (2019) Nicholas Carlini, Chang Liu, Úlfar Erlingsson, Jernej Kos, and Dawn Song. 2019\.  The secret sharer: Evaluating and testing unintended memorization in neural networks.  In _28th USENIX security symposium (USENIX security 19)_ , pages 267–284.
  * Carlini et al. (2021) Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, et al. 2021.  Extracting training data from large language models.  In _30th USENIX Security Symposium (USENIX Security 21)_ , pages 2633–2650.
  * Clarke-Salt and Clarke (2012) Justin Clarke-Salt and Justin Clarke. 2012.  _SQL injection attacks and defense_.  Elsevier.
  * Coalson et al. (2023) Zachary Coalson, Gabriel Ritter, Rakesh Bobba, and Sanghyun Hong. 2023.  Bert lost patience won’t be robust to adversarial slowdown.  _Advances in Neural Information Processing Systems_ , 36:62561–62578.
  * Dahl et al. (1994) Deborah A Dahl, Madeleine Bates, Michael K Brown, William M Fisher, Kate Hunicke-Smith, David S Pallett, Christine Pao, Alexander Rudnicky, and Elizabeth Shriberg. 1994.  Expanding the scope of the atis task: The atis-3 corpus.  In _Human Language Technology: Proceedings of a Workshop held at Plainsboro, New Jersey, March 8-11, 1994_.
  * Deng et al. (2022) Naihao Deng, Yulong Chen, and Yue Zhang. 2022.  Recent advances in text-to-SQL: A survey of what we have and what we expect.  In _Proceedings of the 29th International Conference on Computational Linguistics_ , pages 2166–2187, Gyeongju, Republic of Korea. International Committee on Computational Linguistics.
  * Devlin et al. (2018) Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2018.  Bert: Pre-training of deep bidirectional transformers for language understanding.  _arXiv preprint arXiv:1810.04805_.
  * Dong et al. (2023) Xuemei Dong, Chao Zhang, Yuhang Ge, Yuren Mao, Yunjun Gao, Jinshu Lin, Dongfang Lou, et al. 2023.  C3: Zero-shot text-to-sql with chatgpt.  _arXiv preprint arXiv:2307.07306_.
  * Ebrahimi et al. (2017) Javid Ebrahimi, Anyi Rao, Daniel Lowd, and Dejing Dou. 2017.  Hotflip: White-box adversarial examples for text classification.  _arXiv preprint arXiv:1712.06751_.
  * Eusebius et al. (2024) Nitin Eusebius, Arghya Banerjee, and Randy DeFauw. 2024.  Generating value from enterprise data: Best practices for text2sql and generative ai.  Amazon Bedrock, Generative AI, Intermediate (200).
  * Gao et al. (2023) Dawei Gao, Haibin Wang, Yaliang Li, Xiuyu Sun, Yichen Qian, Bolin Ding, and Jingren Zhou. 2023.  Text-to-sql empowered by large language models: A benchmark evaluation.  _arXiv preprint arXiv:2308.15363_.
  * Garg and Ramakrishnan (2020) Siddhant Garg and Goutham Ramakrishnan. 2020.  Bae: Bert-based adversarial examples for text classification.  _arXiv preprint arXiv:2004.01970_.
  * Goyal et al. (2023) Shreya Goyal, Sumanth Doddapaneni, Mitesh M Khapra, and Balaraman Ravindran. 2023\.  A survey of adversarial defenses and robustness in nlp.  _ACM Computing Surveys_ , 55(14s):1–39.
  * Guo et al. (2021) Chuan Guo, Alexandre Sablayrolles, Hervé Jégou, and Douwe Kiela. 2021.  Gradient-based adversarial attacks against text transformers.  _arXiv preprint arXiv:2104.13733_.
  * Halfond et al. (2006) William G Halfond, Jeremy Viegas, Alessandro Orso, et al. 2006.  A classification of sql-injection attacks and countermeasures.  In _Proceedings of the IEEE international symposium on secure software engineering_ , volume 1, pages 13–15. IEEE Piscataway, NJ.
  * Herzig et al. (2020) Jonathan Herzig, Paweł Krzysztof Nowak, Thomas Müller, Francesco Piccinno, and Julian Martin Eisenschlos. 2020.  Tapas: Weakly supervised table parsing via pre-training.  _arXiv preprint arXiv:2004.02349_.
  * Hwang et al. (2019) Wonseok Hwang, Jinyeong Yim, Seunghyun Park, and Minjoon Seo. 2019.  A comprehensive exploration on wikisql with table-aware word contextualization.  _arXiv preprint arXiv:1902.01069_.
  * Jin et al. (2020) Di Jin, Zhijing Jin, Joey Tianyi Zhou, and Peter Szolovits. 2020.  Is bert really robust? a strong baseline for natural language attack on text classification and entailment.  In _Proceedings of the AAAI conference on artificial intelligence_ , volume 34, pages 8018–8025.
  * Jones et al. (2023) Erik Jones, Anca Dragan, Aditi Raghunathan, and Jacob Steinhardt. 2023.  Automatically auditing large language models via discrete optimization.  In _International Conference on Machine Learning_ , pages 15307–15329. PMLR.
  * Lee et al. (2022) Gyubok Lee, Hyeonji Hwang, Seongsu Bae, Yeonsu Kwon, Woncheol Shin, Seongjun Yang, Minjoon Seo, Jong-Yeup Kim, and Edward Choi. 2022.  Ehrsql: A practical text-to-sql benchmark for electronic health records.  _Advances in Neural Information Processing Systems_ , 35:15589–15601.
  * Li et al. (2020) Dianqi Li, Yizhe Zhang, Hao Peng, Liqun Chen, Chris Brockett, Ming-Ting Sun, and Bill Dolan. 2020.  Contextualized perturbation for textual adversarial attack.  _arXiv preprint arXiv:2009.07502_.
  * Li et al. (2023) Haoyang Li, Jing Zhang, Cuiping Li, and Hong Chen. 2023.  Resdsql: Decoupling schema linking and skeleton parsing for text-to-sql.  In _Proceedings of the AAAI Conference on Artificial Intelligence_ , volume 37, pages 13067–13075.
  * Li et al. (2018) Jinfeng Li, Shouling Ji, Tianyu Du, Bo Li, and Ting Wang. 2018.  Textbugger: Generating adversarial text against real-world applications.  _arXiv preprint arXiv:1812.05271_.
  * Li et al. (2024a) Jinyang Li, Binyuan Hui, Ge Qu, Jiaxi Yang, Binhua Li, Bowen Li, Bailin Wang, Bowen Qin, Ruiying Geng, Nan Huo, et al. 2024a.  Can llm already serve as a database interface? a big bench for large-scale database grounded text-to-sqls.  _Advances in Neural Information Processing Systems_ , 36.
  * Li et al. (2024b) Zhishuai Li, Xiang Wang, Jingjing Zhao, Sun Yang, Guoqing Du, Xiaoru Hu, Bin Zhang, Yuxiao Ye, Ziyue Li, Rui Zhao, et al. 2024b.  Pet-sql: A prompt-enhanced two-stage text-to-sql framework with cross-consistency.  _arXiv preprint arXiv:2403.09732_.
  * Lin et al. (2020) Xi Victoria Lin, Richard Socher, and Caiming Xiong. 2020.  Bridging textual and tabular data for cross-domain text-to-sql semantic parsing.  _arXiv preprint arXiv:2012.12627_.
  * Morris et al. (2020) John Morris, Eli Lifland, Jin Yong Yoo, Jake Grigsby, Di Jin, and Yanjun Qi. 2020\.  Textattack: A framework for adversarial attacks, data augmentation, and adversarial training in nlp.  In _Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing: System Demonstrations_ , pages 119–126.
  * Obeng et al. (2024) Adam Obeng, J.C. Zhong, and Charlie Gu. 2024.  How we built text-to-sql at pinterest.  Pinterest Engineering Blog.
  * Panda et al. (2024) Ashwinee Panda, Christopher A Choquette-Choo, Zhengming Zhang, Yaoqing Yang, and Prateek Mittal. 2024.  Teach llms to phish: Stealing private information from language models.  _arXiv preprint arXiv:2403.00871_.
  * Peng et al. (2022) Xutan Peng, Yipeng Zhang, Jingfeng Yang, and Mark Stevenson. 2022.  On the security vulnerabilities of text-to-sql models.  _arXiv preprint arXiv:2211.15363_.
  * Peng et al. (2023) Xutan Peng, Yipeng Zhang, Jingfeng Yang, and Mark Stevenson. 2023.  On the vulnerabilities of text-to-sql models.  In _2023 IEEE 34th International Symposium on Software Reliability Engineering (ISSRE)_ , pages 1–12. IEEE.
  * Ping and Srivastava (2023) Wendy Aw Wong Jing Ping and Rishabh Srivastava. 2023.  Open-sourcing sqlcoder2-15b and sqlcoder-7b.  Accessed: 2024-06-15.
  * Pourreza and Rafiei (2024) Mohammadreza Pourreza and Davood Rafiei. 2024.  Din-sql: Decomposed in-context learning of text-to-sql with self-correction.  _Advances in Neural Information Processing Systems_ , 36.
  * Qi et al. (2022) Jiexing Qi, Jingyao Tang, Ziwei He, Xiangpeng Wan, Yu Cheng, Chenghu Zhou, Xinbing Wang, Quanshi Zhang, and Zhouhan Lin. 2022.  Rasat: Integrating relational structures into pretrained seq2seq model for text-to-sql.  In _Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing_ , pages 3215–3229.
  * Qin et al. (2022) Bowen Qin, Binyuan Hui, Lihan Wang, Min Yang, Jinyang Li, Binhua Li, Ruiying Geng, Rongyu Cao, Jian Sun, Luo Si, et al. 2022.  A survey on text-to-sql parsing: Concepts, methods, and future directions.  _arXiv preprint arXiv:2208.13629_.
  * Qiu et al. (2022) Shilin Qiu, Qihe Liu, Shijie Zhou, and Wen Huang. 2022.  Adversarial attack and defense technologies in natural language processing: A survey.  _Neurocomputing_ , 492:278–307.
  * Raffel et al. (2020) Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J Liu. 2020.  Exploring the limits of transfer learning with a unified text-to-text transformer.  _Journal of machine learning research_ , 21(140):1–67.
  * Rai et al. (2023) Daking Rai, Bailin Wang, Yilun Zhou, and Ziyu Yao. 2023.  Improving generalization in language model-based text-to-sql semantic parsing: Two simple semantic boundary-based techniques.  In _The 61st Annual Meeting Of The Association For Computational Linguistics_.
  * Ren et al. (2019) Shuhuai Ren, Yihe Deng, Kun He, and Wanxiang Che. 2019.  Generating natural language adversarial examples through probability weighted word saliency.  In _Proceedings of the 57th annual meeting of the association for computational linguistics_ , pages 1085–1097.
  * Roziere et al. (2023) Baptiste Roziere, Jonas Gehring, Fabian Gloeckle, Sten Sootla, Itai Gat, Xiaoqing Ellen Tan, Yossi Adi, Jingyu Liu, Tal Remez, Jérémy Rapin, et al. 2023.  Code llama: Open foundation models for code.  _arXiv preprint arXiv:2308.12950_.
  * Shin et al. (2020) Taylor Shin, Yasaman Razeghi, Robert L Logan IV, Eric Wallace, and Sameer Singh. 2020.  Autoprompt: Eliciting knowledge from language models with automatically generated prompts.  _arXiv preprint arXiv:2010.15980_.
  * Szegedy et al. (2013) Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. 2013.  Intriguing properties of neural networks.  _arXiv preprint arXiv:1312.6199_.
  * Tarbell et al. (2023) Richard Tarbell, Kim-Kwang Raymond Choo, Glenn Dietrich, and Anthony Rios. 2023\.  Towards understanding the generalization of medical text-to-sql models and datasets.  In _AMIA Annual Symposium Proceedings_ , volume 2023, page 669. American Medical Informatics Association.
  * Touvron et al. (2023) Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. 2023.  Llama 2: Open foundation and fine-tuned chat models.  _arXiv preprint arXiv:2307.09288_.
  * Wang et al. (2020a) Bailin Wang, Richard Shin, Xiaodong Liu, Oleksandr Polozov, and Matthew Richardson. 2020a.  Rat-sql: Relation-aware schema encoding and linking for text-to-sql parsers.  In _Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics_ , pages 7567–7578.
  * Wang et al. (2024) Jeffrey G Wang, Jason Wang, Marvin Li, and Seth Neel. 2024.  Pandora’s white-box: Increased training data leakage in open llms.  _arXiv preprint arXiv:2402.17012_.
  * Wang et al. (2020b) Ping Wang, Tian Shi, and Chandan K Reddy. 2020b.  Text-to-sql generation for question answering on electronic medical records.  In _Proceedings of The Web Conference 2020_ , pages 350–361.
  * Wei et al. (2024) Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. 2024.  Jailbroken: How does llm safety training fail?  _Advances in Neural Information Processing Systems_ , 36.
  * Wen et al. (2024) Yuxin Wen, Neel Jain, John Kirchenbauer, Micah Goldblum, Jonas Geiping, and Tom Goldstein. 2024.  Hard prompts made easy: Gradient-based discrete optimization for prompt tuning and discovery.  _Advances in Neural Information Processing Systems_ , 36.
  * Yaghmazadeh et al. (2017) Navid Yaghmazadeh, Yuepeng Wang, Isil Dillig, and Thomas Dillig. 2017.  Sqlizer: query synthesis from natural language.  _Proceedings of the ACM on Programming Languages_ , 1(OOPSLA):1–26.
  * Yan et al. (2024) Biwei Yan, Kun Li, Minghui Xu, Yueyan Dong, Yue Zhang, Zhaochun Ren, and Xiuzheng Cheng. 2024.  On protecting the data privacy of large language models (llms): A survey.  _arXiv preprint arXiv:2403.05156_.
  * Yao et al. (2024) Yifan Yao, Jinhao Duan, Kaidi Xu, Yuanfang Cai, Zhibo Sun, and Yue Zhang. 2024.  A survey on large language model (llm) security and privacy: The good, the bad, and the ugly.  _High-Confidence Computing_ , page 100211.
  * Yeole and Meshram (2011) AS Yeole and BB Meshram. 2011.  Analysis of different technique for detection of sql injection.  In _Proceedings of the International Conference & Workshop on Emerging Trends in Technology_, pages 963–966.
  * Yin et al. (2020) Pengcheng Yin, Graham Neubig, Wen-tau Yih, and Sebastian Riedel. 2020.  Tabert: Pretraining for joint understanding of textual and tabular data.  _arXiv preprint arXiv:2005.08314_.
  * Yu et al. (2018a) Tao Yu, Zifan Li, Zilin Zhang, Rui Zhang, and Dragomir Radev. 2018a.  Typesql: Knowledge-based type-aware neural text-to-sql generation.  _arXiv preprint arXiv:1804.09769_.
  * Yu et al. (2020) Tao Yu, Chien-Sheng Wu, Xi Victoria Lin, Bailin Wang, Yi Chern Tan, Xinyi Yang, Dragomir Radev, Richard Socher, and Caiming Xiong. 2020.  Grappa: Grammar-augmented pre-training for table semantic parsing.  _arXiv preprint arXiv:2009.13845_.
  * Yu et al. (2018b) Tao Yu, Rui Zhang, Kai Yang, Michihiro Yasunaga, Dongxu Wang, Zifan Li, James Ma, Irene Li, Qingning Yao, Shanelle Roman, et al. 2018b.  Spider: A large-scale human-labeled dataset for complex and cross-domain semantic parsing and text-to-sql task.  _arXiv preprint arXiv:1809.08887_.
  * Zelle and Mooney (1996) John M Zelle and Raymond J Mooney. 1996.  Learning to parse database queries using inductive logic programming.  In _Proceedings of the national conference on artificial intelligence_ , pages 1050–1055.
  * Zhang et al. (2024) Bin Zhang, Yuxiao Ye, Guoqing Du, Xiaoru Hu, Zhishuai Li, Sun Yang, Chi Harold Liu, Rui Zhao, Ziyue Li, and Hangyu Mao. 2024.  Benchmarking the text-to-sql capability of large language models: A comprehensive evaluation.  _arXiv preprint arXiv:2403.02951_.
  * Zhang et al. (2023) Jinchuan Zhang, Yan Zhou, Binyuan Hui, Yaxin Liu, Ziming Li, and Songlin Hu. 2023\.  Trojansql: Sql injection against natural language interface to database.  In _Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing_ , pages 4344–4359.
  * Zhang et al. (2020) Wei Emma Zhang, Quan Z Sheng, Ahoud Alhazmi, and Chenliang Li. 2020.  Adversarial attacks on deep-learning models in natural language processing: A survey.  _ACM Transactions on Intelligent Systems and Technology (TIST)_ , 11(3):1–41.
  * Zhong et al. (2017) Victor Zhong, Caiming Xiong, and Richard Socher. 2017.  Seq2sql: Generating structured queries from natural language using reinforcement learning.  _arXiv preprint arXiv:1709.00103_.

##  Appendix A Performance analysis across different database sizes

To further assess the effectiveness of our schema reconstruction framework, we
conducted an experiment where we split the databases of the BIRD dataset into
three categories based on the number of tables they contain: 1-4 tables, 5-9
tables, and 10+ tables. This allowed us to evaluate how well our method
performs across databases of varying complexity. The results of this analysis
are illustrated in Figure 3 and they show the F1 score for database schema
tables in the Schema Reconstruction step.

Figure 3: Reconstructing database schema by interacting with text-to-SQL model
and using surrogate LLM.

Our findings indicate that the schema reconstruction method performs
consistently across different database sizes, although there is a noticeable
variation in performance based on the number of tables. The performance
generally decreases as the number of tables increases, with the highest F1
scores achieved in databases with 1-4 tables. Overall we conclude that:

  * •

Fine-tuned Models: T5-Large shows a significant drop from an F1 score of 0.7
in databases with 1-4 tables to 0.45 in databases with 10+ tables. SQLCoder,
on the other hand, performs better with databases containing 5-9 tables than
with those containing 1-4 tables.

  * •

Generative LLMs: GPT-4 demonstrates strong performance across all categories,
with an F1 score of 0.97 for databases with 1-4 tables and 0.76 for databases
with 10+ tables. LLAMA models also show a similar trend but with lower overall
F1 scores compared to GPT-4.

  * •

Generative LLMs (Sec): The addition of a security mechanism reduces the F1
scores across all models and categories. However, the models still achieve
respectable performance, indicating that our method can effectively handle
databases of varying complexity even with security measures in place.

These results demonstrate that our schema reconstruction framework is robust
and effective across different database sizes and complexities.

##  Appendix B Error Analysis

In our schema reconstruction process, we encountered two major types of
errors: semantic substitutions and suffix mismatches.

Semantic Substitutions. The first type of error involved the use of
semantically similar words instead of the exact terms used in the schema. For
example, instead of using the exact table name SocialSecurity, the model might
predict SSN. This type of error often occurred when the model substituted
abbreviations or alternate names that were not present in the original schema,
resulting in false predictions.

Suffix Mismatches. The second type of error involved incorrect suffix usage,
particularly with singular and plural forms. This occurred when the model
predicted a table name, column name, or data type in a different form than it
appeared in the actual schema. For instance, if the actual table name was
STUDENTS and the model predicted STUDENT (singular), this discrepancy led to a
false result. Similarly, column names and data types were sometimes written
with the wrong suffix, causing inconsistencies in the final schema
reconstruction.


# Norm inflation and ill-posedness for the Fornberg-Whitham equation

Jinlu Li 111School of Mathematics and Computer Sciences, Gannan Normal
University, Ganzhou 341000, China (E-mail: lijinlu@gnnu.edu.cn(J.L)), Xing Wu
222College of Information and Management Science, Henan Agricultural
University, Zhengzhou 450002, China (E-mail: ny2008wx@163.com(X.W)), Yanghai
Yu 333School of Mathematics and Statistics, Anhui Normal University, Wuhu
241002, China (E-mail: yuyanghai214@sina.com(Y.Y)) and Weipeng Zhu444School of
Mathematics and Big Data, Foshan University, Foshan, Guangdong 528000, China
(E-mail: mathzwp2010@163.com(W.Z))

Abstract: In this paper, we prove that the Cauchy problem for the Fornberg-
Whitham equation is not locally well-posed in $B^{s}_{p,r}(\mathbb{R})$ with
$(s,p,r)\in(1,1+\frac{1}{p})\times[2,\infty)\times[1,\infty]$ or
$(s,p,r)\in\\{1\\}\times[2,\infty)\times[1,2]$ by showing norm inflation
phenomena of the solution for some special initial data.

Keywords: Fornberg-Whitham equation, Norm inflation, ill-posedness, Besov
spaces

MSC (2010): 35Q53, 35B35

##  1 Introduction

###  1.1 Model and Known Results

In this paper, we focus on the Cauchy problem of the Fornberg-Whitham (FW)
equation

$\displaystyle\begin{cases}u_{t}-u_{xxt}+\frac{3}{2}uu_{x}-\frac{9}{2}u_{x}u_{xx}-\frac{3}{2}uu_{xxx}-u_{x}=0,&\quad(t,x)\in\mathbb{R}^{+}\times\mathbb{R},\\\
u(0,x)=u_{0}(x),&\quad x\in\mathbb{R},\end{cases}$ (1.1)

which was first introduced by Whitham [28] in 1967 and Whitham and Fornberg
[12] in 1978, as a shallow water wave model to study the qualitative behaviors
of wave breaking (the solution remains bounded while its slope becomes
unbounded in finite time).

The FW equation was compared with the famous Korteweg-de Vries (KdV) equation
[22]

$\displaystyle u_{t}+6uu_{x}=-u_{xxx},$ (1.2)

and the classical Camassa-Holm (CH) equation [3, 4, 5, 6, 7, 8, 9, 11]

$\displaystyle u_{t}-u_{xxt}+3uu_{x}=2u_{x}u_{xx}+uu_{xxx}.$ (1.3)

The KdV equation admits solitons or solitary traveling wave solutions. Indeed,
the KdV equation in the non-periodic admits the solitary wave solutions with
the following form

$u(t,x)=\frac{c}{2}{\rm{sech}}^{2}\Big{(}\frac{\sqrt{c}}{2}(x-ct)\Big{)}.$

And, the CH equation possess exact peaked soliton solutions (peakons) of the
form

$u(t,x)=ce^{-|x-ct|}.$

It is interesting that the FW equation does not only admit solitary traveling
wave solutions like the KdV equation, but also possess peakon solutions (or
peaked traveling wave solutions) [28] as the CH equation which are of the form

$\displaystyle u(t,x)=\frac{8}{9}e^{-\frac{1}{2}|x-\frac{4}{3}t|}.$ (1.4)

The $\mathrm{FW}$ equation (1.1) admits the conserved quantities [25]

$\displaystyle E_{1}(u)=\int_{\mathbb{R}}u\mathrm{d}x,\quad
E_{2}(u)=\int_{\mathbb{R}}u^{2}\mathrm{d}x,$ $\displaystyle
E_{3}(u)=\int_{\mathbb{R}}\left(u\left(1-\partial_{x}^{2}\right)^{-1}u-u^{3}\right)\mathrm{d}x.$

A classification of other traveling wave solutions of the FW equation was
presented by Yin, Tian and Fan [31]. It’s worth mentioning that the KdV
equation and CH equation are integrable, and they possess infinitely many
conserved quantities, an infinite hierarchy of quasi-local symmetries, a Lax
pair and a bi-Hamiltonian structure. Unlike the Kdv and CH equation, the FW
equation is not integrable. Although the FW equation is in a simple form, the
only useful conservation law we know so far is $\|u\|_{L^{2}}$. Therefore, the
analysis of the FW equation would be somewhat more difficult due to the
special structure of this equation and the lower regularity of the
conservation law. Particularly, the well-posedness theory for the FW equation
is not completely understood. Before recalling the well-posedness results the
FW equation, we firstly transform the FW equation (1.1) equivalently into the
following non-local form

$\displaystyle\begin{cases}\partial_{t}u+\frac{3}{2}uu_{x}=\partial_{x}(1-\partial^{2}_{x})^{-1}u,&\quad(t,x)\in\mathbb{R}^{+}\times\mathbb{R},\\\
u(0,x)=u_{0}(x),&\quad x\in\mathbb{R}.\end{cases}$ (1.5)

By the Galerkin approximation argument, Holmes [17] proved the well-posed of
FW equation in Sobolev spaces $H^{s}(\mathbb{T})$ with $s>3/2$. Holmes and
Thompson [18] obtained the well-posedness of FW equation in Besov spaces
$B^{s}_{2,r}(\mathbb{R}\;\text{or}\;\mathbb{T})(s>3/2,1<r<\infty\;\text{or}\;s=3/2,r=1)$.
They also proved that the data-to-solution map is not uniformly continuous but
Hölder continuous in some given topology and presented a blow-up criterion for
solutions. Later, Haziot[15], Hörmann[19, 21], Wei[26, 27], Wu-Zhang[29] and
Yang [30] sharpened this blowup criterion and presented the sufficient
conditions about the initial data to lead the wave-breaking phenomena of the
FW equation. The discontinuous traveling waves as weak solutions to the FW
equation were investigated in [20]. Recently, Guo[13] established the local
well-posedness (existence, uniqueness and continuous dependence) for the FW
equation in both supercritical Besov spaces $B_{p,r}^{s}$ with
$s>1+\frac{1}{p}$, $(p,r)\in[1,\infty]\times[1,\infty)$ and critical Besov
spaces $B_{p,1}^{1+1/p}$ with $p\in[1,\infty)$. We also should mention that
the FW equation is ill-posed in $B_{2,\infty}^{3/2}$ by the peakon solution
(1.4) and in $B^{s}_{p,\infty}$ $(s>1+1/{p},p\in[1,\infty])$ by proving the
solution map starting from $u_{0}$ is discontinuous at $t=0$ in the metric of
$B^{s}_{p,\infty}$ (see our recent papers [23, 24]). For the CH equation, Guo-
Liu-Molinet-Yin [14] showed the ill-posedness in the critical Besov spaces
$B_{p,r}^{1+1/p}(\mathbb{R}\;\text{or}\;\mathbb{T})$ with
$(p,r)\in[1,\infty]\times(1,\infty]$ (especially in $H^{3/2}$) due to norm
inflation. Following their methods, the FW equation is also ill-posed in the
above critical Besov spaces. However, the well-posedness issue of the FW
equation in Besov spaces $B_{p,r}^{s}$ with $s<1+\frac{1}{p}$ appears
unsolved. In this paper, our aim is to provide a rigorous proof of ill-
posedness for the FW equation in the low regularity setting by exhibiting a
strong instability known as a Norm Inflation, i.e. arbitrary small data leads
to an arbitrarily large solution in arbitrary small time, preventing the
solution map to be continuous.

###  1.2 Main Result

Now let us state our main ill-posedness result of this paper.

######  Theorem 1.1.

Assume that

$\displaystyle
1<s<1+\frac{1}{p},(p,r)\in[2,\infty)\times[1,\infty]\quad\mathrm{or}\quad
s=1,(p,r)\in[2,\infty)\times[1,2].$ (1.6)

For any $\delta>0$, there exists initial data satisfying

$\displaystyle\|u_{0}\|_{B^{s}_{p,r}}\leq\delta,$

such that a solution $u(t)\in\mathcal{C}([0,T_{0}];B^{s}_{p,r})$ of the Cauchy
problem (1.5) satisfies

$\displaystyle\|u(T_{0})\|_{B^{s}_{p,r}}\geq\frac{1}{\delta}\quad\mathrm{for}\
\mathrm{some}\quad 0<T_{0}<\delta.$

######  Remark 1.1.

Theorem 1.1 indicates the ill-posedness of (1.5) in $B^{s}_{p,r}(\mathbb{R})$
in the sense that the solution map $B^{s}_{p,r}\ni u_{0}\mapsto u\in
B^{s}_{p,r}$ is discontinuous with respect to the initial data.

######  Remark 1.2.

To the best of our knowledge, Theorem 1.1 is new for the FW equation even in
the Sobolev spaces $H^{s}(\mathbb{R})=B^{s}_{2,2}(\mathbb{R})$ with
$s\in[1,\frac{3}{2})$.

###  1.3 Strategy to Proof

We shall outline the main ideas in the proof of Theorem 1.1.

  * •

Firstly, we construct an explicit example for initial data $u_{0}$, where the
norm $\|u_{0}\|_{B^{s}_{p,r}}$ is sufficiently small.

  * •

Secondly, we present the lower and upper bounds of lifespan $T^{*}$ of the
solution to the FW equation (1.5) by exploring fully the properties of the
flow map $\psi$.

  * •

Lastly, we mainly observe that the transport term does cause growth of the
$L^{2}$-norm of $u_{x}$. Precisely speaking, we estimate the $L^{2}$-norm of
$u_{x}$ over $(-\psi(T_{\rm{min}},q_{0}),\psi(T_{\rm{min}},q_{0}))$ and obtain
that its lower bound can be arbitrarily large.

The structure of the paper. In Section 2 we provide several key Lemmas. In
Section 3 we present the proof of Theorem 1.1.

##  2 Preliminary

###  2.1 Notations and Norms

For the reader’s convenience, we collect the notations and functional spaces
that will be used frequently throughout this paper.

  * •

We use the letter $C$ to denote various absolute constant whose value can
change from a line to another or even within a single line. $C(s,t)$ stands
for some positive constant dependent of the variables $s$ and $t$.

  * •

The symbol $A\approx B$ means that $C^{-1}B\leq A\leq CB$.

  * •

Given a Banach space $X$, we denote its norm by $\|\cdot\|_{X}$.

  * •

We denote by $W^{1,p}$ the standard Sobolev space on $\mathbb{R}$ of $L^{p}$
functions whose derivative also belongs to $L^{p}$.

  * •

We will also define the Lipschitz space $\mathrm{Lip}$ using the norm
$\|f\|_{\mathrm{Lip}}=\|f\|_{L^{\infty}}+\|\partial_{x}f\|_{L^{\infty}}$.

  * •

For $I\subset\mathbb{R}$, we denote by $\mathcal{C}(I;X)$ the set of
continuous functions on $I$ with values in $X$. Sometimes we will denote
$L^{p}(0,T;X)$ by $L_{T}^{p}(X)$.

  * •

Let $s\in\mathbb{R}$ and $(p,r)\in[1,\infty]^{2}$. The nonhomogeneous Besov
space $B^{s}_{p,r}(\mathbb{R})$ is defined by (see [1] for more details).

$\displaystyle
B^{s}_{p,r}(\mathbb{R}):=\left\\{f\in\mathcal{S}^{\prime}(\mathbb{R}):\;\|f\|_{B^{s}_{p,r}(\mathbb{R})}:=\left\|2^{js}\|\Delta_{j}u\|_{L^{p}}\right\|_{\ell^{r}(j\geq-1)}<\infty\right\\}.$

###  2.2 Key Example for Initial Data

Firstly, we construct an explicit example as follows.

Let $p_{0}\gg 1$ and $0<q_{0}\ll 1$ which will be fixed later. Set

$\displaystyle u_{0}(x)=p_{0}\big{(}e^{-|x+q_{0}|}-e^{-|x-q_{0}|}\big{)}.$
(2.7)

That is, the initial profile $u_{0}(x)$ is the anti-symmetric peakon-
antipeakon (see Fig.1).
$x$$u_{0}$$-u_{0}(q_{0})=u_{0}(-q_{0})$$-q_{0}$$\bullet$$u_{0}(q_{0})=p_{0}(e^{-2q_{0}}-1)$$q_{0}$$\bullet$

Fig.1: Initial profile $u_{0}(x)$.

By the simple fact which will be also used in the sequel

$\frac{x}{x+1}\leq 1-e^{-x}\leq x,\quad\forall x>-1,$

one has

$\|u_{0}\|_{L^{\infty}}\leq
2p_{0}q_{0}\quad\text{and}\quad\|u_{0}\|_{L^{2}}\leq 4p_{0}q_{0}.$

It is easy to check that $u_{0}(x)$ is an odd function and

$\displaystyle
u^{\prime}_{0}(x)=\begin{cases}p_{0}(e^{q_{0}}-e^{-q_{0}})e^{x},&\;\text{if}\;x\in(-\infty,-q_{0}),\\\
-p_{0}e^{-q_{0}}(e^{x}+e^{-x}),&\;\text{if}\;x\in(-q_{0},q_{0}),\\\
p_{0}(e^{q_{0}}-e^{-q_{0}})e^{-x},&\;\text{if}\;x\in(q_{0},+\infty),\end{cases}$
(2.8)

which is displayed in Figure 2.
$x$$u^{\prime}_{0}$$u^{\prime}_{0}(q_{0}^{-})=-p_{0}(e^{-2q_{0}}+1)$$q_{0}$$\bullet$$-q_{0}$$\bullet$$-q_{0}$$\bullet$$u_{0}(q_{0}^{+})=p_{0}(1-e^{-2q_{0}})$$q_{0}$$\bullet$

Fig.2: Graph of $u^{\prime}_{0}(x)$.

Furthermore, we can deduce that the following result holds:

######  Lemma 2.1.

For every $q_{0}\in(0,1)$ and $s\in(\frac{1}{2},\frac{3}{2})$, there exists
$C=C_{s}>0$ such that

$\displaystyle C^{-1}p_{0}q_{0}^{3/2-s}\leq\|u_{0}\|_{H^{s}}\leq
Cp_{0}q_{0}^{3/2-s}.$

###### Proof.

The proof essentially follows that of Lemma 3.1 in [2] or Proposition 1 in
[16]. ∎

###  2.3 Blow-up Criterion

######  Lemma 2.2.

Assume that $(s,p,r)$ satisfies (1.6), there exists a maximal time $T^{*}$ and
a solution $u\in\mathcal{C}([0,T^{*});B^{s}_{p,r})\cap
L^{\infty}([0,T^{*});\mathrm{Lip})$ to the FW equation (1.5) with initial data
$u_{0}$ given by (2.7). Moreover, if the maximal time $T^{*}$ is finite, we
have

$\displaystyle\lim_{t\uparrow
T^{*}}\big{(}\|u(t)\|_{B^{s}_{p,r}}+\|u(t)\|_{\mathrm{Lip}}\big{)}=+\infty\quad\Leftrightarrow\quad\lim_{t\uparrow
T^{*}}\|u(t)\|_{\mathrm{Lip}}=+\infty.$

###### Proof.

It follows from (2.7)-(2.8) and Lemma 2.1 that $u_{0}\in
H^{\sigma}\cap\mathrm{Lip}\subseteq B^{s}_{p,r}\cap\mathrm{Lip}$ with
$\sigma\in(s-\frac{1}{p}+\frac{1}{2},\frac{3}{2})$.

Following the proof of Lemma 2.4 in [10], we can get

$\displaystyle\|u(t)\|_{B^{s}_{p,r}}\leq\left\|u_{0}\right\|_{B^{s}_{p,r}}\exp\left(C\int_{0}^{t}1+\|u(\tau)\|_{\mathrm{Lip}}\mathrm{d}\tau\right)$

and

$\displaystyle\|u(t)\|_{\mathrm{Lip}}\leq\left\|u_{0}\right\|_{\operatorname{Lip}}\exp\left(C\int_{0}^{t}1+\|u(\tau)\|_{\mathrm{Lip}}\mathrm{d}\tau\right).$

This is enough to complete the proof of Lemma 2.2.∎

###  2.4 The Equation Along the Flow

Given a Lipschitz velocity field $u$, we may solve the following ODE to find
the flow induced by $u$:

$\displaystyle\quad\begin{cases}\frac{\mathrm{d}}{\mathrm{d}t}\psi(t,x)=\frac{3}{2}u(t,\psi(t,x)),\\\
\psi(0,x)=x,\end{cases}$ (2.9)

which is equivalent to the integral form

$\displaystyle\psi(t,x)=x+\frac{3}{2}\int^{t}_{0}u(\tau,\psi(\tau,x))\mathrm{d}\tau.$
(2.10)

Because the velocity field is Lipschitz, then we get that for $t\in[0,T^{*})$

$\displaystyle\partial_{x}\psi(t,x)=\exp\left(\frac{3}{2}\int^{t}_{0}\partial_{x}u(\tau,\psi(\tau,x))\mathrm{d}\tau\right)>0.$

This shows that $\psi(t,\cdot)$ is an increasing diffeomorphism over
$\mathbb{R}$, that is, for all $x,y\in\mathbb{R},$ there holds that
$\psi(t,x)<\psi(t,y)$ if $x<y$. Also, we have

$\displaystyle\|\partial_{x}\psi(t,x)\|_{L^{\infty}}\leq
e^{CT^{*}\|\partial_{x}u\|_{L^{\infty}_{t}(L^{\infty})}}\quad\text{and}\quad\|\partial_{t}\psi(t,x)\|_{L^{\infty}}\leq
C\|u\|_{L^{\infty}_{T^{*}}(L^{\infty})}.$ (2.11)

In view of (1.5), we get that

$\displaystyle\frac{\mathrm{d}}{\mathrm{d}t}u(t,\psi(t,x))$
$\displaystyle=u_{t}(t,\psi(t,x))+u_{x}(t,\psi(t,x))\frac{\mathrm{d}}{\mathrm{d}t}\psi(t,x)$
$\displaystyle=\left(u_{t}+\frac{3}{2}uu_{x}\right)(t,\psi(t,x))$
$\displaystyle=\partial_{x}(1-\partial^{2}_{x})^{-1}u(t,\psi(t,x)).$

Integrating the above with respect to time variable yields that

$\displaystyle
u(t,\psi(t,x))=u_{0}(x)+\int^{t}_{0}\partial_{x}(1-\partial^{2}_{x})^{-1}u(\tau,\psi(\tau,x))\mathrm{d}\tau.$
(2.12)

Differentiating (1.5) with respect to space variable $x$, we find

$\displaystyle
u_{tx}+\frac{3}{2}uu_{xx}+\frac{3}{2}(u_{x})^{2}=\partial^{2}_{x}(1-\partial^{2}_{x})^{-1}u=:V.$
(2.13)

Combining (2.9) and (2.13), we obtain

$\displaystyle\frac{\mathrm{d}}{\mathrm{d}t}u_{x}(t,\psi(t,x))$
$\displaystyle=u_{tx}(t,\psi(t,x))+u_{xx}(t,\psi(t,x))\frac{\mathrm{d}}{\mathrm{d}t}\psi(t,x)$
$\displaystyle=\left(u_{tx}+\frac{3}{2}uu_{xx}\right)(t,\psi(t,x))$
$\displaystyle=-\frac{3}{2}(u_{x})^{2}(t,\psi(t,x))+V(t,\psi(t,x)),$ (2.14)

which means that

$\displaystyle
u_{x}(t,\psi(t,x))=u^{\prime}_{0}(x)-\frac{3}{2}\int^{t}_{0}(u_{x})^{2}(\tau,\psi(\tau,x))\mathrm{d}\tau+\int^{t}_{0}V(\tau,\psi(\tau,x))\mathrm{d}\tau.$
(2.15)

Differentiating (2.13) with respect to space variable $x$, we find

$\displaystyle
u_{txx}+\frac{3}{2}uu_{xxx}+\frac{9}{2}u_{x}u_{xx}=\partial^{3}_{x}(1-\partial^{2}_{x})^{-1}u,$
(2.16)

which gives us that

$\displaystyle\frac{\mathrm{d}}{\mathrm{d}t}u_{xx}(t,\psi(t,x))=-\frac{9}{2}u_{x}u_{xx}(t,\psi(t,x))+\partial^{3}_{x}(1-\partial^{2}_{x})^{-1}u(t,\psi(t,x))$
(2.17)

and

$\displaystyle
u_{xx}(t,\psi(t,x))=u^{\prime\prime}_{0}(x)-\frac{9}{2}\int^{t}_{0}u_{x}u_{xx}(\tau,\psi(\tau,x))\mathrm{d}\tau+\int^{t}_{0}\partial^{3}_{x}(1-\partial^{2}_{x})^{-1}u(\tau,\psi(\tau,x))\mathrm{d}\tau.$
(2.18)

###  2.5 Estimation of Lifespan

We need two preliminary Lemmas.

######  Lemma 2.3.

Assume that $(s,p,r)$ satisfies (1.6). Let
$u\in\mathcal{C}([0,T^{*});B^{s}_{p,r})\cap
L^{\infty}([0,T^{*});\mathrm{Lip})$ be the solution of the FW equation (1.5)
with initial data $u_{0}$ given by (2.7), then we have

$\displaystyle
u_{x}(t,\psi(t,x))\in\mathcal{C}^{1}([0,T^{*})\times(-q_{0},q_{0})).$

###### Proof.

From (2.11), it is not difficult to check that for any $\tau\in[0,t]$ and
$x,y\in(-q_{0},q_{0})$

$\displaystyle|V(\tau,\psi(\tau,x))-V(\tau,\psi(\tau,y))|$ $\displaystyle\leq
C\|\partial_{x}u\|_{L^{\infty}_{t}(L^{\infty})}|\psi(\tau,x)-\psi(\tau,y)|$
$\displaystyle\leq
C|x-y|\cdot\|\partial_{x}u\|_{L^{\infty}_{t}(L^{\infty})}e^{CT^{*}\|\partial_{x}u\|_{L^{\infty}_{t}(L^{\infty})}}$

and

$\displaystyle|V(t,\psi(t,x))-V(s,\psi(s,x))|$ $\displaystyle\leq
C|t-s|\cdot(\|\partial_{t}u\|_{L^{\infty}_{t}(L^{\infty})}+\|\partial_{x}u\|_{L^{\infty}_{t}(L^{\infty})}\|\partial_{t}\psi\|_{L^{\infty}_{t}(L^{\infty})})$
$\displaystyle\leq C(T^{*},\|u\|_{L^{\infty}_{t}(\mathrm{Lip})})|t-s|,$

which mean that $V(t,\psi(t,x))\in\mathcal{C}([0,T^{*})\times(-q_{0},q_{0}))$.

Due to (2.15), one has for any $x,y\in(-q_{0},q_{0})$

$\displaystyle X(t)$ $\displaystyle:=|u_{x}(t,\psi(t,x))-u_{x}(t,\psi(t,y))|$
$\displaystyle\leq\left|u^{\prime}_{0}(x)-u^{\prime}_{0}(y)\right|+\int^{t}_{0}\left|V(\tau,\psi(\tau,x))-V(\tau,\psi(\tau,y))\right|\mathrm{d}\tau$
$\displaystyle\quad+\frac{3}{2}\int^{t}_{0}\left|X(\tau)(u_{x}(\tau,\psi(\tau,x))+u_{x}(\tau,\psi(\tau,y))\right|\mathrm{d}\tau$
$\displaystyle\leq\left|u^{\prime}_{0}(x)-u^{\prime}_{0}(y)\right|+CT^{*}|x-y|\cdot\|\partial_{x}u\|_{L^{\infty}_{t}(L^{\infty})}e^{CT^{*}\|\partial_{x}u\|_{L^{\infty}_{t}(L^{\infty})}}$
$\displaystyle\quad+3\int^{t}_{0}\left|X(\tau)\right|\|u_{x}\|_{L^{\infty}}\mathrm{d}\tau,$

from which, using Gronwall’s inequality, we have

$\displaystyle|u_{x}(t,\psi(t,x))-u_{x}(t,\psi(t,y))|$ $\displaystyle\leq
C_{t}\left(\left|u^{\prime}_{0}(x)-u^{\prime}_{0}(y)\right|+|x-y|\right),$
(2.19)

where $C_{t}$ depends on $T^{*}$ and
$\|\partial_{x}u\|_{L^{\infty}_{t}(L^{\infty})}$.

Similarly, one has for any $s,t\in[0,T^{*})$ and $x\in(-q_{0},q_{0})$

$\displaystyle|u_{x}(t,\psi(t,x))-u_{x}(s,\psi(s,x))|\leq
C\left(\|u\|_{L^{\infty}_{\max\\{t,s\\}}(L^{\infty})}+\|\partial_{x}u\|^{2}_{L^{\infty}_{\max\\{t,s\\}}(L^{\infty})}\right)|t-s|.$

Noticing that $u^{\prime}_{0}(x)\in\mathcal{C}(-q_{0},q_{0})$, we deduce

$\displaystyle
u_{x}(t,\psi(t,x))\in\mathcal{C}([0,T^{*})\times(-q_{0},q_{0})).$

It is easy from (2.18) to obtain that $u_{xx}(\tau,x)\in
L^{\infty}_{t}L^{\infty}$ for $\tau\in[0,t]$. Repeating the above procedure,
we get

$\displaystyle
u_{xx}(t,\psi(t,x))\in\mathcal{C}([0,T^{*})\times(-q_{0},q_{0})),$

which in turn follows from (2.4) that

$\displaystyle\frac{\mathrm{d}}{\mathrm{d}t}u_{x}(t,\psi(t,x))\in\mathcal{C}([0,T^{*})\times(-q_{0},q_{0})).$

This completes the proof of Lemma 2.3. ∎

We should emphasize that $u_{x}(t,x)$ is discontinuous in
$[0,T^{*})\times\mathbb{R}$, but we can claim that $u_{x}(t,x)$ is continuous
in $[0,T^{*})\times(\psi(t,-q_{0}),\psi(t,q_{0}))$. Furthermore, we have

######  Lemma 2.4.

Assume that $(s,p,r)$ satisfies (1.6). Let
$u\in\mathcal{C}([0,T^{*});B^{s}_{p,r})\cap
L^{\infty}([0,T^{*});\mathrm{Lip})$ be the solution of the FW equation (1.5)
with initial data $u_{0}$ given by (2.7), then we have

$\displaystyle\partial_{t}u_{x}(t,x)\in\mathcal{C}([0,T^{*})\times(\psi(t,-q_{0}),\psi(t,q_{0}))).$

###### Proof.

Let $z\in(\psi(t,-q_{0}),\psi(t,q_{0}))$. Due to (2.10), we have

$\displaystyle\psi^{-1}(t,z)=z-\frac{3}{2}\int^{t}_{0}u(\tau,\psi(\tau,\psi^{-1}(t,z)))\mathrm{d}\tau.$

Also, we have for $t\in[0,T^{*})$

$\displaystyle\|\partial_{z}\psi^{-1}(t,z)\|_{L^{\infty}}\leq
C(T^{*},\|\partial_{x}u\|_{L^{\infty}_{t}(L^{\infty})}),$ (2.20)
$\displaystyle\|\partial_{t}\psi^{-1}(t,z)\|_{L^{\infty}}\leq
C(T^{*},\|u\|_{L^{\infty}_{t}(\mathrm{Lip})}).$

From which and Lemma 2.3, we obtain that for $s,t\in[0,T^{*})$ and
$x,y\in(\psi(t,-q_{0}),\psi(t,q_{0}))$

$\displaystyle|u_{x}(t,x)-u_{x}(s,y)|$
$\displaystyle\leq|u_{x}(t,x)-u_{x}(t,y)|+|u_{x}(t,y)-u_{x}(s,y)|$
$\displaystyle\leq|u_{x}(t,\psi(t,\psi^{-1}(t,x)))-u_{x}(t,\psi(t,\psi^{-1}(t,y)))|$
$\displaystyle~{}~{}~{}~{}+|u_{x}(t,\psi(t,\psi^{-1}(t,y)))-u_{x}(s,\psi(s,\psi^{-1}(s,y)))|$
$\displaystyle\to 0\quad\text{as}\quad(t,x)\to(s,y),$

which tells us that

$\displaystyle
u_{x}(t,x)\in\mathcal{C}([0,T^{*})\times(\psi(t,-q_{0}),\psi(t,q_{0}))).$

It is easy from (2.17) and (2.18) to obtain that
$u_{xxx}(\tau,x),u_{xxt}(\tau,x)\in L^{\infty}_{t}L^{\infty}$ for
$\tau\in[0,t]$. Repeating the above procedure, we get

$\displaystyle
u_{xx}(t,x)\in\mathcal{C}([0,T^{*})\times(\psi(t,-q_{0}),\psi(t,q_{0}))).$

Notice that
$\partial_{t}u_{x}=-\frac{3}{2}(u_{x})^{2}-\frac{3}{2}uu_{xx}+\partial^{2}_{x}(1-\partial^{2}_{x})^{-1}u$,
we can deduce that

$\displaystyle\partial_{t}u_{x}(t,x)\in\mathcal{C}([0,T^{*})\times(\psi(t,-q_{0}),\psi(t,q_{0}))).$

This completes the proof of Lemma 2.4. ∎

Next, we present the lower and upper bounds of lifespan $T^{*}$ of the
solution to the FW equation (1.5).

The $L^{\infty}$-norm of any function $u$ is preserved under the flow $\psi$,
i.e.

$\|u(t,x)\|_{L^{\infty}(\mathbb{R})}=\|u(t,\psi(t,x))\|_{L^{\infty}(\mathbb{R})}.$

Combing the above and (2.12), we obtain that for $t\in[0,T^{*})\cap[0,\ln 3]$

$\|u(t)\|_{L^{\infty}(\mathbb{R})}\leq\|u_{0}\|_{L^{\infty}(\mathbb{R})}+\int^{t}_{0}\|u(\tau)\|_{L^{\infty}(\mathbb{R})}\mathrm{d}\tau.$

Using Gronwall’s inequality gives us that for $t\in[0,T^{*})\cap[0,\ln 3]$

$\|u(t)\|_{L^{\infty}(\mathbb{R})}\leq\|u_{0}\|_{L^{\infty}(\mathbb{R})}e^{t}\leq
3p_{0}q_{0}.$

Note that $\left(1-\partial_{x}^{2}\right)^{-1}f=G*f$ with
$G(x)=\frac{1}{2}e^{-|x|}$, by Young’s inequality, we have

$\|\partial_{x}(1-\partial_{x}^{2})^{-1}u\|_{L^{\infty}}=\left\|G_{x}*u\right\|_{L^{\infty}}\leq\left\|G_{x}\right\|_{L^{1}}\|u\|_{L^{\infty}}\leq\|u\|_{L^{\infty}}.$

In view of the identity
$\partial^{2}_{x}(1-\partial^{2}_{x})^{-1}u=-u+(1-\partial^{2}_{x})^{-1}u$, we
have

$\displaystyle|V(t,\psi(t,x))|\leq\|V(t,x)\|_{L^{\infty}}$
$\displaystyle\leq\|u\|_{L^{\infty}}+\|(1-\partial_{x}^{2})^{-1}u\|_{L^{\infty}}\leq
2\|u\|_{L^{\infty}}\leq 6p_{0}q_{0}.$

Then for all $t\in[0,T^{*})\cap[0,\ln 3]$ and $x\in\mathbb{R}$, we deduce from
(2.4) that

$\displaystyle\begin{cases}\frac{\mathrm{d}}{\mathrm{d}t}u_{x}(t,\psi(t,x))\leq-\frac{3}{2}(u_{x})^{2}(t,\psi(t,x))+6p_{0}q_{0},\\\
\frac{\mathrm{d}}{\mathrm{d}t}u_{x}(t,\psi(t,x))\geq-\frac{3}{2}(u_{x})^{2}(t,\psi(t,x))-6p_{0}q_{0}.\end{cases}$
(2.21)

From Fig 2, we see that $u^{\prime}_{0}(x)\leq
u^{\prime}_{0}(0)=-2p_{0}e^{-q_{0}}<-p_{0}$ if $x\in(-q_{0},q_{0})$. Thus the
standard argument of continuity shows

$\displaystyle u_{x}(t,\psi(t,x))\leq-
p_{0},\quad\forall(t,x)\in[0,T^{*})\cap[0,\ln 3]\times(-q_{0},q_{0}),$

from which and (2.21), we have for $(t,x)\in[0,T^{*})\cap[0,\ln
3]\times(-q_{0},q_{0})$

$\displaystyle\begin{cases}\frac{\mathrm{d}}{\mathrm{d}t}u_{x}(t,\psi(t,x))\leq-\frac{3}{2}\left(u_{x}(t,\psi(t,x))+p_{0}q_{0}\right)^{2},\\\
\frac{\mathrm{d}}{\mathrm{d}t}u_{x}(t,\psi(t,x))\geq-\frac{3}{2}\left(u_{x}(t,\psi(t,x))-p_{0}q_{0}\right)^{2}.\end{cases}$
(2.22)

Solving the differential inequalities (2.22) yields for
$(t,x)\in[0,T^{*})\cap[0,\ln 3]\times(-q_{0},q_{0})$

$\displaystyle\frac{1}{\frac{3}{2}t+\frac{1}{u^{\prime}_{0}(x)-p_{0}q_{0}}}+p_{0}q_{0}\leq
u_{x}(t,\psi(t,x))\leq\frac{1}{\frac{3}{2}t+\frac{1}{u^{\prime}_{0}(x)+p_{0}q_{0}}}-p_{0}q_{0}.$
(2.23)

According to the definition of $u_{0}$, we can deduce that the lifespan
$T^{*}$ of the solution to (1.5) satisfies

$\displaystyle T^{*}$
$\displaystyle\leq\frac{2}{3}\inf_{x\in(-q_{0},q_{0})}\left\\{\frac{-1}{u^{\prime}_{0}(x)+p_{0}q_{0}}\right\\}$
$\displaystyle=-\frac{2}{3}\frac{1}{u^{\prime}_{0}(q^{-}_{0})+p_{0}q_{0}}$
$\displaystyle=\frac{2}{3}\frac{1}{p_{0}(1+e^{-2q_{0}}-q_{0})}=:T_{\mathrm{max}},$

where we have used that $u^{\prime}_{0}(q_{0}^{-})=-p_{0}(e^{-2q_{0}}+1)$.

It is easy to deduce that for sufficiently small $q_{0}$

$T_{\mathrm{max}}\in\left(\frac{1}{3p_{0}},\frac{2}{3p_{0}}\right).$

Now, we claim that

$\displaystyle|u_{x}(t,\psi(t,x))|\leq
6p_{0}q_{0},\quad\forall(t,x)\in[0,T^{*})\times(-\infty,-q_{0})\cap(q_{0},+\infty),$
(2.24)

which tells us that the solution do not blow up when
$(t,x)\in[0,T^{*})\times(-\infty,-q_{0})\cap(q_{0},+\infty)$.

Next, we begin to prove (2.24). Due to $u^{\prime}_{0}(x)\in(0,2p_{0}q_{0})$
if $x\in(-\infty,-q_{0})$, from $\eqref{t1}_{1}$, we have

$u_{x}(t,\psi(t,x))\leq u^{\prime}_{0}(x)+6p_{0}q_{0}T^{*}\leq
6p_{0}q_{0},\quad\forall(t,x)\in[0,T^{*})\times(-\infty,-q_{0}).$

Using the standard argument of continuity again, it follows from
$\eqref{t1}_{2}$ that

$u_{x}(t,\psi(t,x))\geq-6p_{0}q_{0},\quad\forall(t,x)\in[0,T^{*})\times(-\infty,-q_{0}).$

In summary, it holds that

$|u_{x}(t,\psi(t,x))|\leq
6p_{0}q_{0},\quad\forall(t,x)\in[0,T^{*})\times(-\infty,-q_{0}).$

Following the above argument, we also have

$|u_{x}(t,\psi(t,x))|\leq 6p_{0}q_{0},\quad\forall(t,x)\in
t,x)\in[0,T^{*})\times(q_{0},+\infty),$

thus the claim holds.

Then, we can deduce that

$\displaystyle T^{*}$
$\displaystyle\geq\frac{2}{3}\inf_{x\in(-q_{0},q_{0})}\left\\{\frac{-1}{u^{\prime}_{0}(x)-p_{0}q_{0}}\right\\}$
$\displaystyle=-\frac{2}{3}\frac{1}{u^{\prime}_{0}(q^{-}_{0})-p_{0}q_{0}}$
$\displaystyle=\frac{2}{3}\frac{1}{p_{0}(1+e^{-2q_{0}}+q_{0})}=:T_{\mathrm{min}}.$

##  3 Proof of Theorem 1.1

In this section, we prove Theorem 1.1.

According to the definition of $u^{\prime}_{0}(x)$ (see Fig 2), we deduce from
(2.23) that

$\displaystyle m(t)+p_{0}q_{0}\leq u_{x}(t,\psi(t,x))\leq M(t)-p_{0}q_{0},$
(3.25)

where, for notational convenience, we denote

$\displaystyle
m(t):=\frac{1}{\frac{3}{2}t+\frac{1}{u^{\prime}_{0}(q_{0}^{-})-p_{0}q_{0}}}\quad\text{and}\quad
M(t):=\frac{1}{\frac{3}{2}t+\frac{1}{u^{\prime}_{0}(0)+p_{0}q_{0}}}.$ (3.26)

Set $w(t,x):=u_{x}(t,x)$, then we obtain from (1.5)

$\displaystyle\partial_{t}w+\frac{3}{2}\partial_{x}(uw)=V,$

which implies that

$\displaystyle\partial_{t}(w^{2})+\frac{3}{2}\partial_{x}(uw^{2})+\frac{3}{2}\partial_{x}uw^{2}=2Vw.$
(3.27)

Integrating (3.27) with respect to space variable $x$ over
$[\psi(t,-q_{0}),\psi(t,q_{0})]$, we have

$\displaystyle\int_{\psi(t,-q_{0})}^{\psi(t,q_{0})}\partial_{t}(w^{2})\mathrm{d}x+\frac{3}{2}\int_{\psi(t,-q_{0})}^{\psi(t,q_{0})}\partial_{x}(uw^{2})\mathrm{d}x+\frac{3}{2}\int_{\psi(t,-q_{0})}^{\psi(t,q_{0})}\partial_{x}uw^{2}\mathrm{d}x=2\int_{\psi(t,-q_{0})}^{\psi(t,q_{0})}wV\mathrm{d}x.$
(3.28)

Direct computations yield that

$\displaystyle\int_{\psi(t,-q_{0})}^{\psi(t,q_{0})}\partial_{t}(w^{2})\mathrm{d}x$
$\displaystyle=\frac{\mathrm{d}}{\mathrm{d}t}\int_{\psi(t,-q_{0})}^{\psi(t,q_{0})}w^{2}\mathrm{d}x-\frac{3}{2}u(t,\psi(t,q_{0}))w^{2}(t,\psi^{-}(t,q_{0}))$
$\displaystyle\quad+\frac{3}{2}u(t,\psi(t,-q_{0}))w^{2}(t,\psi^{+}(t,-q_{0}))$
(3.29)

and

$\displaystyle\int_{\psi(t,-q_{0})}^{\psi(t,q_{0})}\partial_{x}(uw^{2})\mathrm{d}x=u(t,\psi(t,q_{0}))w^{2}(t,\psi^{-}(t,q_{0}))-u(t,\psi(t,-q_{0}))w^{2}(t,\psi^{+}(t,-q_{0})).$
(3.30)

Note We should mention that the both $w(t,\psi^{-}(t,q_{0}))$ and
$w(t,\psi^{+}(t,-q_{0}))$ exist since $w(t,x)$ is uniformly continuous with
respect to $x$ over $(\psi(t,-q_{0}),\psi(t,q_{0}))$ by (2.19) and (2.20).

Inserting (3) and (3.30) into (3.28) yields

$\displaystyle\frac{\mathrm{d}}{\mathrm{d}t}\int_{\psi(t,-q_{0})}^{\psi(t,q_{0})}w^{2}\mathrm{d}x+\frac{3}{2}\int_{\psi(t,-q_{0})}^{\psi(t,q_{0})}\partial_{x}uw^{2}\mathrm{d}x=2\int_{\psi(t,-q_{0})}^{\psi(t,q_{0})}wV\mathrm{d}x.$
(3.31)

To simplify notation let

$A(t):=\int_{\psi(t,-q_{0})}^{\psi(t,q_{0})}w^{2}(t,x)\mathrm{d}x,$

combining (3.25), then (3.31) reduces to

$\displaystyle A^{\prime}(t)$
$\displaystyle=-\frac{3}{2}\int_{\psi(t,-q_{0})}^{\psi(t,q_{0})}u_{x}(t,x)w^{2}\mathrm{d}x+2\int_{\psi(t,-q_{0})}^{\psi(t,q_{0})}wV\mathrm{d}x$
$\displaystyle\geq-\frac{3}{2}M(t)A(t)+\frac{3}{2}p_{0}q_{0}A(t)-2\|u_{0}\|_{L^{2}}A^{\frac{1}{2}}(t)$
$\displaystyle\geq\left(-\frac{3}{2}M(t)-1\right)A(t)-Cp_{0}^{2}q_{0}^{2},$

where we have used that

$\|V\|_{L^{2}}\leq\|u\|_{L^{2}}=\|u_{0}\|_{L^{2}}\leq 4p_{0}q_{0}.$

Solving the above differential inequality gives us that

$\displaystyle
A(t)\geq\exp(B(t))\left(A_{0}-Cp_{0}^{2}q_{0}^{2}\int^{t}_{0}\exp(-B(\tau))\mathrm{d}\tau\right),$
(3.32)

where

$B(t)=\int^{t}_{0}\left(-\frac{3}{2}M(t)-1\right)\mathrm{d}\tau.$

Easy computations give that

$\displaystyle\exp(B(t))=\frac{M(t)}{M(0)}e^{-t},$ $\displaystyle
A_{0}=\int_{|x|\leq
q_{0}}\big{(}u^{\prime}_{0}(x)\big{)}^{2}\mathrm{d}x\approx p^{2}_{0}q_{0},$
$\displaystyle M(0)=u^{\prime}_{0}(0)+p_{0}q_{0}=p_{0}q_{0}-2p_{0}e^{-q_{0}},$

thus we have

$\displaystyle M(T_{\mathrm{min}})$
$\displaystyle=\frac{1}{\frac{3}{2}T_{\mathrm{min}}+\frac{1}{u^{\prime}_{0}(0)+p_{0}q_{0}}}$
$\displaystyle=\frac{1}{\frac{1}{p_{0}q_{0}-u^{\prime}_{0}(q_{0}^{-})}+\frac{1}{u^{\prime}_{0}(0)+p_{0}q_{0}}}$
$\displaystyle=\frac{p_{0}q_{0}-u^{\prime}_{0}(q_{0}^{-})}{u^{\prime}_{0}(0)+2p_{0}q_{0}-u^{\prime}_{0}(q_{0}^{-})}M(0)$
$\displaystyle\approx\frac{M(0)}{q_{0}},$

which gives directly that

$\displaystyle\frac{M(T_{\mathrm{min}})}{M(0)}$
$\displaystyle\approx\frac{1}{q_{0}}.$

Also,

$\displaystyle\int^{T_{\mathrm{min}}}_{0}\exp(-B(\tau))\mathrm{d}\tau$
$\displaystyle=\int^{T_{\mathrm{min}}}_{0}\left(\frac{3}{2}\tau(u^{\prime}_{0}(0)+p_{0}q_{0})+1\right)e^{\tau}\mathrm{d}\tau$
$\displaystyle\lesssim p_{0}q_{0}T_{\mathrm{min}}^{2}+T_{\mathrm{min}}$
$\displaystyle\lesssim\frac{1}{p_{0}}.$

From (3.32), we have

$\displaystyle A(T_{\mathrm{min}})\geq C\left(p^{2}_{0}-p_{0}q_{0}\right)\geq
Cp^{2}_{0}.$

Notice that (3.25) again, we have

$\displaystyle\left(\int_{\psi(T_{\mathrm{min}},-q_{0})}^{\psi(T_{\mathrm{min}},q_{0})}w^{p}(T_{\mathrm{min}},x)\mathrm{d}x\right)^{\frac{1}{p}}$
$\displaystyle\geq
A^{\frac{1}{p}}(T_{\mathrm{min}})\left(p_{0}q_{0}-M(T_{\mathrm{min}})\right)^{1-\frac{2}{p}}$
$\displaystyle\geq
cp_{0}^{\frac{2}{p}}\left(p_{0}q_{0}-C\frac{M(0)}{q_{0}}\right)^{1-\frac{2}{p}}$
$\displaystyle\geq cp_{0}q_{0}^{\frac{2-p}{p}}$ $\displaystyle\geq cp_{0}.$

By Lemma 2.1, one has for $\sigma\in(s-\frac{1}{p}+\frac{1}{2},\frac{3}{2})$

$\displaystyle\|u_{0}\|_{B^{s}_{p,r}}\leq
C\|u_{0}\|_{B^{s-\frac{1}{p}+\frac{1}{2}}_{2,r}}\leq
C\|u_{0}\|_{H^{\sigma}}\leq C_{1}p_{0}q^{\frac{3}{2}-\sigma}_{0}\leq\delta,$

but for $T_{0}\in[0,T_{\rm{min}})$

$\displaystyle\|u(T_{0})\|_{B^{s}_{p,r}}\geq\|u(T_{0})\|_{W^{1,p}}$
$\displaystyle\geq c_{2}\sqrt{p_{0}}\geq\frac{1}{\delta},$

if some large $p_{0}$ and small $q_{0}$ is chosen. This completes the proof of
Theorem 1.1.

## Acknowledgments

J. Li is supported by the National Natural Science Foundation of China
(11801090 and 12161004) and Jiangxi Provincial Natural Science Foundation
(20212BAB211004). Y. Yu is supported by the National Natural Science
Foundation of China (12101011) and Natural Science Foundation of Anhui
Province (1908085QA05). W. Zhu is supported by the National Natural Science
Foundation of China (12201118) and Guangdong Basic and Applied Basic Research
Foundation (2021A1515111018).

## Data Availability

No data was used for the research described in the article.

## Conflict of interest

The authors declare that they have no conflict of interest.

## References

  * [1] H. Bahouri, J. Y. Chemin, R. Danchin, Fourier Analysis and Nonlinear Partial Differential Equations, Grundlehren der Mathematischen Wissenschaften, Springer, Heidelberg, 2011.
  * [2] P. Byers, Existence time for the Camassa-Holm equation and the critical Sobolev index, Indiana Univ. Math. J. 55 (2006), 941-954.
  * [3] R. Camassa, D. Holm, An integrable shallow water equation with peaked solitons, Phys. Rev. Lett., 71 (1993), 1661-1664.
  * [4] A. Constantin, The Hamiltonian structure of the Camassa-Holm equation, Exposition. Math., 15 (1997), 53-85.
  * [5] A. Constantin, J. Escher, Global existence and blow-up for a shallow water equation, Ann. Scuola Norm. Sup. Pisa Cl. Sci. (4), 26 (1998), 303-328.
  * [6] A. Constantin, J. Escher, Well-posedness, global existence, and blowup phenomena for a periodic quasi-linear hyperbolic equation, Comm. Pure Appl. Math., 51 (1998), 475-504.
  * [7] A. Constantin, J. Escher, Wave breaking for nonlinear nonlocal shallow water equations, Acta Math., 181 (1998), 229-243.
  * [8] A. Constantin, J. Escher, Particle trajectories in solitary water waves, Bull. Amer. Math. Soc., 44 (2007), 423-431.
  * [9] A. Constantin, J. Escher, Analyticity of periodic traveling free surface water waves with vorticity, Ann. Math., 173 (2011), 559-568.
  * [10] R. Danchin, A few remarks on the Camassa-Holm equation, Differential Integral Equations, 14 (2001), 953-988.
  * [11] A. Fokas, B. Fuchssteiner, Symplectic structures, their bäcklund transformation and hereditary symmetries, Phys. D, 4 (1981/1982) 47-66.
  * [12] B. Fornberg, G. Whitham, A numerical and theoretical study of certain nonlinear wave phenomena, Philos. Trans. R. Soc. Lond. A, Math. Phys. Eng. Sci., 289 (1978), 373-404.
  * [13] Y. Guo, The well-posedness, ill-posedness and non-uniform dependence on initial data for the Fornberg-Whitham equation in Besov spaces, arXiv, 2021.
  * [14] Z. Guo, X. Liu, L. Molinet, Z. Yin, Ill-posedness of the Camassa-Holm and related equations in the critical space, J. Differ. Equ., 266 (2019), 1698-1707.
  * [15] S. Haziot, Wave breaking for the Fornberg-Whitham equation, J. Differ. Equ., 263 (2017), 8178-8185.
  * [16] A. Himonas, C. Holliman, K. Grayshan, Norm inflation and ill-posedness for the Degasperis-Procesi equation, Comm. Partial Differ. Equ., 39 (2014), 2198-2215.
  * [17] J. Holmes, Well-posedness of the Fornberg-Whitham equation on the circle, J. Differ. Equ., 260(12) (2016), 8530-8549.
  * [18] J. Holmes, R.C. Thompson, Well-posedness and continuity properties of the Fornberg-Whitham equation in Besov spaces, J. Differ. Equ., 263 (7) (2017), 4355-4381.
  * [19] G. Hörmann, Wave breaking of periodic solutions to the Fornberg-Whitham equation, Discrete Contin. Dyn. Syst., 38(3) (2018), 1605-1613.
  * [20] G. Hörmann, Discontinuous traveling waves as weak solutions to the Fornberg-Whitham equation, J. Differ. Equ., 265(7) (2018), 2825-2841.
  * [21] G. Hörmann, Solution concepts, well-posedness, and wave breaking for the Fornberg-Whitham equation, Monatshefte Math., (2021) 195:421-449.
  * [22] D. J. Korteweg, G. de Vries, On the change of form of long waves advancing in a rectangular canal, and on a new type of long stationary waves, Philos. Mag., (5) 39(240) (1895), 422-443.
  * [23] J. Li, Y. Yu, W. Zhu, Ill-posedness for the Camassa-Holm and related equations in Besov spaces, J. Differ. Equ., 306 (2022), 403-417.
  * [24] J. Li, Y. Yu, W. Zhu, Sharp ill-posedness for the generalized Camassa-Holm equation in Besov spaces, J. Evol. Equ., 22:29 (2022) 11pp.
  * [25] P.I. Naumkin, I.A. Shishmarev, Nonlinear Nonlocal Equations in the Theory of Waves. Americn Mathematical Society, Providence (1994).
  * [26] L. Wei, Wave breaking analysis for the Fornberg-Whitham equation, J. Differ. Equ., 265 (7) (2018), 2886-2896.
  * [27] L. Wei, New wave-breaking criteria for the Fornberg-Whitham equation, J. Differ. Equ., 280 (2021), 571-589.
  * [28] G. Whitham, Variational methods and applications to water waves, Proc. R. Soc., Math. Phys. Eng. Sci., 299 (1967), 6-25.
  * [29] X. Wu, Z. Zhang, On the blow-up of solutions for the Fornberg-Whitham equation, Nonlinear Anal., Real World Appl., 44 (2018), 573-588.
  * [30] S. Yang, Wave breaking phenomena for the Fornberg-Whitham equation, J. Dyn. Differ. Equ., 33 (2021), 1753-1758.
  * [31] J. Yin, L. Tian, X. Fan, Classification of travelling waves in the Fornberg-Whitham equation, J. Math. Anal. Appl., 368(1) (2010), 133-143.