#  Scotch: An Efficient Secure Computation Framework for Secure Aggregation

Yash More1, Prashanthi Ramachandran2, Priyam Panda1, Arup Mondal 1, Harpreet
Virk1, Debayan Gupta1

###### Abstract

Federated learning enables multiple data owners to jointly train a machine
learning model without revealing their private datasets. However, a malicious
aggregation server might use the model parameters to derive sensitive
information about the training dataset used. To address such leakage,
differential privacy and cryptographic techniques have been investigated in
prior work, but these often result in large communication overheads or impact
model performance. To mitigate this centralization of power, we propose
Scotch, a decentralized m-party secure-computation framework for federated
aggregation that deploys MPC primitives, such as secret sharing. Our protocol
is simple, efficient, and provides strict privacy guarantees against curious
aggregators or colluding data-owners with minimal communication overheads
compared to other existing state-of-the-art privacy-preserving federated
learning frameworks. We evaluate our framework by performing extensive
experiments on multiple datasets with promising results. Scotch can train the
standard MLP NN with the training dataset split amongst 3 participating users
and 3 aggregating servers with 96.57% accuracy on MNIST, and 98.40% accuracy
on the Extended MNIST (digits) dataset, while providing various optimizations.

## Introduction

Standard machine learning environments often rely on large amounts of
sensitive data to achieve a high level of performance (Halevy, Norvig, and
Pereira 2009). However, preparing a central repository of data is laborious,
making secure-collaborative training expensive. Outsourcing the data to a
central server that performs model training for the users is a potential
solution, but is often not feasible in privacy-sensitive settings. Secure
aggregation of data using multiparty computation frameworks (MPC) (Yao 1982;
Mood et al. 2016; Perry et al. 2014; Di Crescenzo et al. 2014; Gupta et al.
2016; Lindell 2020; Goldreich 1998; Goldreich, Micali, and Wigderson 2019) has
been explored in recent works, but they significantly impact framework
efficiency due to added computational overheads (Phong et al. 2018). Moreover,
centralized aggregation creates a single point of failure in the framework
that can potentially compromise the security and privacy of the training data
if the server is malicious, or prone to adversarial attacks by colluding
participants (Chen et al. 2021; Kairouz et al. 2021).

A recently proposed alternative for privacy-preserving training, without data
outsourcing, is Federated Learning (FL) (McMahan et al. 2016). FL has emerged
as a promising approach to collaboratively train a model by exchanging model
parameters with a central aggregator (or server), instead of the actual
training data. However, parameter exchange may still leak a significant amount
of private data (Zhu, Liu, and Han 2019). Several approaches have been
proposed to overcome this leakage problem based on differential privacy (DP)
(Shokri and Shmatikov 2015; Papernot et al. 2018), MPC (Bonawitz et al. 2017;
Ryffel et al. 2018), HE (Truex et al. 2019), etc. While DP-based learning aims
to mitigate inference attacks, it significantly degrades model utility as the
training of accurate models requires high privacy budgets (Jayaraman and Evans
2019). Cryptographic techniques provide improved privacy protection but remain
too slow for practical use due to the extensive cryptographic operations.
Hence, there arises a need for a secure, decentralized FL framework that
protects user privacy, while allowing seamless training of ML models. This
requires strong cryptographic protection of the intermediate model updates
during the model aggregation and the final model weights.

In this work, we propose Scotch, a practical framework that enables secure
m-party aggregation in a distributed n-server setting. It provides end-to-end
protection of the parties’ training data, intermediate model weights, and the
final resulting model by combining secure multiparty computation (MPC)
primitives based on secure outsourced computation and secret sharing to enable
decentralized FL. Our contributions have been described in further detail in
the following section.

### Our Contributions

In this paper, we introduce a one-of-its-kind framework for privacy-preserving
federated learning with primitives from conventional machine learning and
multiparty computation (MPC). Specifically,

  * •

We propose Scotch, a simple, fast, and efficient federated learning framework
that allows for decentralized gradient aggregation using secure outsourced
computation and secret sharing while ensuring strict privacy guarantees of the
training data (Mohassel and Zhang 2017; Wagh, Gupta, and Chandran 2019).

  * •

We evaluate the efficiency of our proposed secret sharing-based FL protocol
against existing state-of-the-art frameworks. To the best of our knowledge,
Scotch is the only approach for decentralized privacy-preserving FL with the
least possible cryptographic computational overheads – only $O(2mn)$ crypto-
related operations required in each training round, where $m$ is the number of
participants and $n$ is the number of aggregators (See Table 1).

  * •

We implement Scotch and perform extensive experiments on multiple standard
datasets such as MNIST, EMNIST, and FMNIST with promising results: Scotch has
efficiency improvements both in training time and communication cost while
providing similar model performance and privacy guarantee as other approaches.

For ease of access, all of our code and experiments are available at:
https://github.com/arupmondal-cs/SCOTCH.

## Technical Background

##### Federated Learning.

FL (McMahan et al. 2016) is a distributed ML approach that enables model
training on a large corpus of decentralized data with myriad participants. It
is an example of the more general approach of “bring code to data, not data to
code”. In FL, each party trains a model locally and exchanges only model
parameters with an FL server or aggregator, instead of the private training
data.

The participants in the training processes are parties and the FL server,
which is a cloud-based distributed service. Devices agreement to the server
that they are ready to run an FL task for a given FL population. An FL
population is specified by a globally unique name which identifies the
learning problem, or application, which is worked upon. An FL task is a
specific computation for an FL population, such as training to be performed
with given hyperparameters, or evaluation of trained models on local device
data. After finishing the local computation on its local dataset then each
device updates the model parameters (e.g. the weights of a neural network) to
the FL server. The server incorporates these updates into its global state of
the global model.

##### Secure Multiparty Computation.

Secure multiparty computation (MPC) (Yao 1982; Mood et al. 2016; Perry et al.
2014; Di Crescenzo et al. 2014; Gupta et al. 2016; Lindell 2020; Goldreich
1998; Goldreich, Micali, and Wigderson 2019) is the universal cryptographic
functionality, allowing any function to be computed obliviously by a group of
mutually distrustful parties. There exist a number of different techniques for
MPC (e.g., garbled circuits, functional encryption, and homomorphic
encryption, etc.). In this work, we have considered MPC based on secret
sharing (Shamir 1979).

##### Secret Sharing.

In cryptography, secret sharing (Shamir 1979; Blakley 1979) refers to the
process of splitting a secret among $n$ parties such that each party does not
learn anything about the whole secret from the share it holds. The secret can
be reconstructed only if a certain minimum number of parties, greater than or
equal to a threshold, $t$, combine their shares. The scheme is known as the
$(t,n)$ threshold scheme or $t$-out-$n$ secret sharing. In this work, we use
additive secret sharing, which uses addition as the way to combine shares. We
use the notation $[a]_{j}$ to denote the $j^{th}$ share of a secret $a$.

## Proposed Framework

In this section, we describe the proposed framework Scotch, an efficient
distributed secure-computation approach for secure outsourced aggregation
based on MPC primitives. The distributed federated averaging algorithm has
been described in Algorithm LABEL:alorithm:SCOTCHframe. Algorithm
LABEL:alorithm:flframe briefly describes one iteration of our protocol. The
steps given in this algorithm have been illustrated in Figure 1.

### Threat Model

We assume a passively secure threat model. A passive (honest-but-curious)
adversary follows the protocol specifications but may try to learn information
about the private input data by inspecting the shared inputs. Both the
participants, data owners (or clients), and the aggregators (or servers) are
honest-but-curious. Scotch ensures that aggregators (collude with any subset
of participants and aggregators) can’t learn any information about the private
inputs of the honest participants. Similarly, it also ensures that any subset
of colluding participants cannot learn any information about the private
inputs or outputs of the honest participants by inspecting the messages
exchanged with the aggregators or the final model. We also assume any
encryption broadcast to the network in Algorithm LABEL:alorithm:flframe is re-
randomized to avoid leakage about parties’ confidential data by two
consecutive broadcasts. We omit this operation in Algorithm
LABEL:alorithm:flframe for clarity. Finally, attacks that aim to create
denial-of-service attacks or inject malicious model updates are beyond the
scope of this short paper.

###  Scotch Framework

We assume a set of $n$ honest-but-curious aggregators, $\mathcal{S}$ and a set
of $m$ clients, $\mathcal{C}$, where each client $\mathcal{C}_{i}$ for
$i\in\\{1,\cdots,m\\}$ holds its own private dataset $\mathcal{D}_{i}$. We
defer more details about the threat model and security of the framework to
‘threat model’ and ‘privacy guarantees’ section. The clients in $\mathcal{C}$
agree upon a model architecture, $\text{NN}_{\text{arch}}$, for local training
prior to the runtime of the framework. The underlying concept in this
framework is $n$-out-of-$n$-additive-secret-sharing-based MPC, which provides
protocols for $n$ aggregators and is secure against a passive adversary that
corrupts at most $m-1$ clients.

##### Local Training.

At the beginning of every iteration, the function local_training is invoked by
client $\mathcal{C}_{i}$ in $\mathcal{C}$ with input $\mathcal{D}_{i}$. This
function allows clients to train local models on their private datasets using
the pre-decided model architecture, $\text{NN}_{\text{arch}}$. In the first
iteration, initial weights are sampled and stored in $w$. For subsequent
iterations, the aggregated weights from the previous iteration are used as
initial weights. Each client samples a randomly-permuted (without replacement)
subset $d$ from the dataset $\mathcal{D}_{i}$ in each iteration. Functions
permute_indices and choose_subset help with the same. In each iteration, each
client trains a model on $\text{NN}_{\text{arch}}$ with inputs $w$ and $d$.
The clients then split the model weights into $n$-out-of-$n$ additive secret
shares by invoking split_secret_shares. These shares are then sent to the $n$
aggregators.

##### Secure Aggregation.

Having received a total of $m$ shares from clients in $\mathcal{C}$, each
server $\mathcal{S}_{j}$ for $\\{1,\cdots,n\\}$ adds its local shares and
divides the sum by the total number of aggregators to obtain the value
$\sigma_{j}$ by invoking federated_sum. One can observe that $\sigma_{j}$ is
an $n$-out-of-$n$ additive secret share of the federated average of the local
models of the clients. Each server then sends $\sigma_{j}$ to clients in
$\mathcal{C}$ so that they can obtain the final model.

##### Computing the Final Model.

Having obtained additive secret shares of the federated average from the $n$
aggregators, each client locally adds up the shares to obtain the federated
average of their models by invoking the function compute_final_model. Clients
set the value of variable $w$ as the federated average obtained in this
iteration. If the current iteration is the final one, $w$ is returned as the
final output. If not, $w$ is used as the initial weights in local_training for
the subsequent iteration.

To enable seamless integration between machine learning primitives (which
generally use floating-point), and MPC primitives (which generally use
integers), we use integer ring arithmetic in our implementation. To enable
conversions between the float and integer realms, we use functions
float_to_int, int_to_float, and truncate based on primitives provided in
(Mohassel and Zhang 2017). After training its local model, each client embeds
its weights onto the integer ring by invoking float_to_int111float_to_int
converts a floating-point value into an $l$-bit integer by allocating $l_{x}$
bits to the integer part, $l_{f}$ bits to the fractional part, and $1$ bit to
the sign of the value, such that $l=l_{x}+l_{f}+1$. Note that $l_{f}$
represents the maximum precision of the value. Refer to (Wagh, Gupta, and
Chandran 2019) for further details.. The rest of the operations are performed
in the integer ring realm. At places where two values in the integer ring are
multiplied, the product is truncated by invoking truncate. Finally, at the end
of every iteration, the aggregated weights are converted back to float by
invoking int_to_float in order to facilitate any further local training on
them.

Figure 1: Schematic Diagram illustrating Algorithm LABEL:alorithm:flframe.

Input: Client $\mathcal{C}_{i}$ for $i\in\\{1,\cdots,m\\}$ holds its private
dataset $\mathcal{D}_{i}$.
Output: Client $\mathcal{C}_{i}$ for $i\in\\{1,\cdots,m\\}$ obtains the final
aggregated global model, $\mathbb{M}_{\text{agg}}$. 1. Client
$\mathcal{C}_{i}$ for $i\in\\{1,\cdots,m\\}$ trains local model
$\mathbb{M}_{i}$ on a random subset of its private dataset $\mathcal{D}_{i}$.
Note that all the clients use the same model architecture. 2. Client
$\mathcal{C}_{i}$ for $i\in\\{1,\cdots,m\\}$ creates $n$ additive secret
shares of its model $\mathbb{M}_{i}$ and sends each share
$\mathcal{[}{M}_{i}]_{j}$ for $j\in\\{1,\cdots,n\\}$ to server
$\mathcal{S}_{j}$. 3. Server $\mathcal{S}_{j}$ for $j\in\\{1,\cdots,n\\}$ adds
up the received shares from all clients and divides the sum by $n$ to obtain
$\sigma_{j}$ and sends $\sigma_{j}$ to all the clients.
Each client locally computes
$\mathbb{M}_{\text{agg}}=\sum_{j=1}^{n}(\sigma_{j}$).

Input: Client $C_{i}$ in $\mathcal{C}$ possesses private dataset
$\mathcal{D}_{i}$ for $i\in\\{1,\cdots,m\\}$. $iter:=$ the total number of
global iterations for aggregation len($\mathcal{D}_{i})$ represents the number
of data points in the dataset $\mathcal{D}_{i}$. $n$ is the total number of
aggregators.
Output: Clients obtain the final aggregated model stored in $w$. - foreach
$k\in\\{1,\cdots,iter\\}$ - foreach $i\in\\{1,\cdots,m\\}$ -
local_training($\mathcal{C}_{i}$, $\mathcal{D}_{i}$);
- Procedure local_training ($\mathcal{C}_{i}$, $\mathcal{D}_{i}$): - If($k==1$) - $w\leftarrow$ random_init(); // randomly sample initial weights for n. - $d=$permute_indices($\mathcal{D}_{i})$; - $d=$choose_subset($d$, len($D_{i}$) / $iter$); - $W_{i}\leftarrow$ train($w$, $d$); - $\mathbb{M}_{i}\leftarrow$ float_to_int($W_{i}$); - $\\{[\mathbb{M}_{i}]_{1},\cdots,[\mathbb{M}_{i}]_{n}\\}\leftarrow\texttt{split\\_secret\\_shares}(\mathbb{M}_{i})$; // split the model into $n$-out-of-$n$ additive secret shares.
- foreach $j\in\\{1,\cdots,n\\}$ - federated_sum($S_{j}$, $[\mathbb{M}_{i}]_{j}$);
- Procedure ($S_{j},\\{[\mathbb{M}_{1}]_{j},\cdots,[\mathbb{M}_{m}]_{j}\\}$): - $\sigma_{j}\leftarrow\sum_{i=1}^{m}([\mathbb{M}_{i}]_{j})\times$ float_to_int($1/n$); - $\sigma_{j}\leftarrow$ truncate($\sigma_{j}$);
- foreach $i\in\\{1,\cdots,m\\}$ - compute_final_model($\mathcal{C}_{i}$, $\sigma_{j}$);
- Procedure ($\sigma_{1},\cdots,\sigma_{n}$): - $\mathbb{M}_{agg}\leftarrow\sum_{j=1}^{n}(\sigma_{j})$; - $w\leftarrow$ int_to_float$(\mathbb{M}_{agg})$;
- return $w$;

#### Communication Complexity

Table 1 describes the complexity of the secure aggregation protocol (refer to
Algorithm LABEL:alorithm:SCOTCHframe). Since Scotch is a secure aggregation
framework, the complexity of functions local_training and compute_final_model
can be considered offline. As a result, we only consider federated_sum() as
the online phase of the protocol.

Table 1: Summary of the complexity of Algorithm LABEL:alorithm:SCOTCHframe. Complexity | Data Owners | Aggregator Servers
---|---|---
Computation | $O(2mn)$ | $O(mn)$
Communication | $O(n)$ | $O(m)$
Storage | $O(m)$ | $O(n)$

### Privacy Guarantees

Scotch achieves data privacy guarantees under a semi-honest adversary model
with any subset of colluding aggregators. Scotch’s infrastructure is designed
using multi-input secret sharing-based MPC protocol to calculate the federated
average of model gradients shared by participating clients. Private training
data is not sent – participating entities get split “shares” of model
gradients, or the generated averaged model, neither of which can be used to
reconstruct sensitive information about the training dataset used. The
security of these shares is guaranteed by standard MPC theorems (Goldreich
1998), and since the actual computations performed within the MPC setup (which
can perform arbitrary computations and is agnostic in that sense).

## Experimental Evaluation

### Implementation Details

We simulate Scotch using socket, a low-level networking interface that can be
accessed using Python. We rely on the Tensorflow library for the training and
inference of machine learning models. All our experiments are performed on a
local machine – a Linux machine with Intel i7-9700K<EMAIL_ADDRESS>GHz and GeForce
RTX 2070 GPU with 32 GB RAM. All clients and servers are assumed to be running
independent nodes and are connected via a virtual network.

### Dataset and Model Configuration

#### MNIST (MNIST ).

The MNIST (MNIST ) dataset comprises 60,000 handwritten digit character
images, along with 10,000 testing images. The data is pre-processed by
resizing each image, and one-hot encoding the labels. Each client uses a
three-layer Multi-layered Perceptron to train on their local datasets. The
architecture of the MLP is outlined in Figure 2.

#### EMNIST (EMNIST ).

The Extended MNIST (digits) (EMNIST ) dataset contains 240,000 handwritten
digit character images and 40,000 images for training and testing purposes
respectively. The data is preprocessed by resizing each image, and one-hot
encoding the labels. We use the same MLP architecture as used in MNIST, to
train each local model.

#### FMNIST (FMNIST ).

Fashion-MNIST (FMNIST ) is a dataset of Zalando’s article images that contains
60,000 training images and 10,000 testing images. The data is pre-processed by
resizing each image, and one-hot encoding the labels.

Figure 2: Multilayer Perceptron (MLP) architecture used across different
experiments in Scotch.

### Experimental Overview

Scotch’s framework incorporates secure aggregation via secret outsourced
computation. Each client takes part in federated learning by (a) locally
training on their private data, and (b) sharing their gradients with servers
via secret-sharing. Each server receives partial shares from the clients,
which it aggregates and propagates back to all clients. This allows each
client to recompute the global model gradients by averaging the shares
received from the server(s).

### Experimental Results

We evaluate Scotch in terms of three indicators: (a) Performance of the
generated model with a different number of clients and servers, (b) Impact of
varying precision while secret sharing on model performance, and (c)
communication complexity (see Table 1).

#### Performance Analysis.

We evaluate Scotch’s performance on three standard datasets – MNIST, EMNIST,
and FMNIST (refer Dataset and Model Configuration section) with varying
numbers of clients, in a 3-server setting. For each dataset, we use a three-
layer MLP whose architecture has been outlined in §Dataset and Model
Configuration. We use a standard 70-30 train-test split, for each dataset, and
the training data is equally divided amongst the clients. Each client locally
trains on their individual dataset for 3-4 epochs, with a learning rate of
0.01. The results have been summarized in Table 3.

To test the effects of precision on training our global model, we compare the
results of Scotch on MNIST dataset, with 16 and 32 bits of precision. The test
accuracy comparison between these two is shown in Table 2. To support decimal
arithmetic in an integer ring we use the solution proposed by (Mohassel and
Zhang 2017). As we observe from our experiments, if we restrict the number of
decimal places to 32 bits, we see a significant improvement in test accuracy
as opposed to 16 bits. Therefore, we observe a direct correlation between the
precision of floating-point numbers involved in network training and the
resulting model. To understand the effects of precision, we trained a
centralized FL server with a constraint – we round each weight update of the
ML model with 32 bits of precision (restricting values up to 5 decimal
places). We observed that there is a considerable decrease in model accuracy
with decreasing precision. This underscores the importance of precision while
training machine learning models. We summarize our observations in Table 4
(for further details, please refer to the Impact of Precision Length section).

We observe a decrease in accuracy with increasing number of clients because of
the compounding errors in float_to_int() and int_to_float() conversions as a
result of limited precision. These can be offset by an increase in precision.
We plan to scale our existing framework to a larger number of clients and
servers with the help of a reasonable increase in precision size in the near
future.

Table 2: Scotch’s performance accuracy on MNIST (MNIST ), under 16-bit and 32-bit precision configuration. The number of global iterations for aggregation, iter (Algorithm LABEL:alorithm:SCOTCHframe) is set to $4$. For the accuracy graph, see Figure 4. Clients | 2 | 3 | 4 | 5
---|---|---|---|---
MNIST-16 | 0.3 | 0.19 | 0.113 | 0.111
MNIST-32 | 0.975 | 0.965 | 0.74 | 0.53
Table 3: Scotch performance accuracy, as evaluated on three datasets: MNIST, EMNIST, and FMNIST with an increasing number of clients (under 32-bit precision). For the accuracy graph, see Figure 3. Clients | MNIST | EMNIST | FMNIST
---|---|---|---
2 | 0.975 | 0.985 | 0.85
3 | 0.965 | 0.984 | 0.69
4 | 0.74 | 0.9 | 0.53
5 | 0.53 | 0.549 | 0.5
Table 4: Evaluating the performance accuracy of Centralized FL (1-server setting) on multiple precision configurations using the MNIST (MNIST ) dataset. Precision | 4-bit | 8-bit | 16-bit | 32-bit
---|---|---|---|---
Centralized FL | 0.09 | 0.41 | 0.71 | 0.85
Figure 3: Scotch: Clients vs Performance accuracy on multiple datasets –
MNIST, EMNIST, and FMNIST (3-server setting). Figure 4: Scotch: Clients vs
Performance accuracy on multiple precision settings (16-bits, 32-bits) on
MNIST (3-server setting).

### Impact of Precision Length

Most protocols in secure multiparty computation operate in integer rings.
However, one needs to deal with decimal numbers while tackling computations in
machine learning algorithms. To mitigate this, we use a mapping between fixed-
point decimals and the integer ring (as used by state-of-the-art MPC
frameworks such as SecureML (Mohassel and Zhang 2017)). The integer part of
the decimal number is represented by $l_{w}$ bits and the fractional part by
$l_{f}$. To evaluate the effects of precision on our training and testing
accuracy, we replicate the precision settings used in SecureML (Mohassel and
Zhang 2017) for logistic and linear regression. Comparing our tests with
SecureML helps us to understand the effects of precision-length while training
different machine learning models. Even though SecureML’s experiments were
restricted to 13–16 bits, they used much simpler models such as logistic
regression and with a simpler dataset – (1000 to 1M samples of the MNIST
dataset), and objective – Binary Classification. Through our experiments we
observe that multi-class classification via Multi-layer Perceptrons on much
smaller dataset 70% of 60,000 MNIST images performs better if we increase the
precision (refer to Table 4). One might notice how much of a difference does
precision make on gradient updates while performing gradient descent using
Neural Networks. This difference plays a role in our experiments as well.

## Related Work

The existing privacy-preserving machine learning (PPML) works focus
exclusively on training (generalized) linear models. They rely on centralized
solutions where the learning task is securely outsourced to a server, notably
using homomorphic encryption (HE) techniques. As such, these works do not
solve the problem of privacy-preserving distributed ML, where multiple parties
collaboratively train an ML model on their data. To address the latter,
several works propose multi-party computation (MPC) (Yao 1982; Mood et al.
2016; Perry et al. 2014; Di Crescenzo et al. 2014; Gupta et al. 2016; Lindell
2020; Goldreich 1998; Goldreich, Micali, and Wigderson 2019) solutions where
several tasks, such as clustering and regression, are distributed among 2, 3,
or 4 servers (Mohassel and Zhang 2017; Wagh, Gupta, and Chandran 2019; Patra
and Suresh 2020; Ramachandran et al. 2021; Wagh et al. 2021; Riazi et al.
2018; Demmler, Schneider, and Zohner 2015; Mohassel and Rindal 2018; Wagh et
al. 2021). Although such approaches, however, limit the number of parties
among which the trust is split, often assume an honest majority among the
computing servers, and require parties to communicate (i.e., secret share)
their data outside their premises. This might not be acceptable due to the
privacy and confidentiality requirements and the strict data protection
regulations.

A recently proposed alternative for privacy-preserving training – without data
outsourcing – is federated learning (FL) (McMahan et al. 2016). FL has emerged
as a promising approach to collaboratively train a model by exchanging model
parameters with a central aggregator, instead of the actual training data.
However, parameter exchange may still leak a significant amount of private
data. Several approaches have been proposed to overcome this leakage problem
based on differential privacy (DP) (Shokri and Shmatikov 2015; Papernot et al.
2018), MPC (Bonawitz et al. 2017; Ryffel et al. 2018), HE (Truex et al. 2019;
Sav et al. 2020), Trusted Execution Environment (Mondal et al. 2021a, b), etc.
Furthermore, in those settings, the aggregator is a central player, which also
potentially represents a single point of failure (Kairouz et al. 2021) and due
to the extensive use of cryptographic operations, these frameworks remain too
slow for practical use. Finally, other works combine MPC with DP techniques to
achieve better privacy guarantees (Truex et al. 2019; Xu et al. 2019; Pettai
and Laud 2015). While DP-based learning aims to mitigate inference attacks, it
significantly degrades model utility, as training accurate models requires
high privacy budgets (Jayaraman and Evans 2019). Therefore, a practical
distributed privacy-preserving federated learning approach requires strong
cryptographic protection of the intermediate model updates during the model
aggregation and the final model weights.

## Conclusion

We propose Scotch, a decentralized m-party, n-server secure-computation
framework for federated aggregation that utilizes MPC primitives. The protocol
provides strict privacy guarantees against honest-but-curious aggregators or
colluding data-owners; it offers the least communication overheads compared to
other existing state-of-the-art privacy-preserving federated learning
frameworks on standard datasets. In the near future, we plan to extend this
framework to provide security against malicious servers and clients, scale it
to a larger number of clients and servers, and finally deploy it via open-
source channels for academic and industrial use-cases.

## References

  * Blakley (1979) Blakley, G. R. 1979.  Safeguarding cryptographic keys.  In _1979 International Workshop on Managing Requirements Knowledge (MARK)_ , 313–318. IEEE.
  * Bonawitz et al. (2017) Bonawitz, K.; Ivanov, V.; Kreuter, B.; Marcedone, A.; McMahan, H. B.; Patel, S.; Ramage, D.; Segal, A.; and Seth, K. 2017.  Practical secure aggregation for privacy-preserving machine learning.  In _Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security_ , 1175–1191.
  * Chen et al. (2021) Chen, H.; Asif, S. A.; Park, J.; Shen, C.-C.; and Bennis, M. 2021.  Robust Blockchained Federated Learning with Model Validation and Proof-of-Stake Inspired Consensus.  arXiv:2101.03300.
  * Demmler, Schneider, and Zohner (2015) Demmler, D.; Schneider, T.; and Zohner, M. 2015.  ABY - A Framework for Efficient Mixed-Protocol Secure Two-Party Computation.
  * Di Crescenzo et al. (2014) Di Crescenzo, G.; Feigenbaum, J.; Gupta, D.; Panagos, E.; Perry, J.; and Wright, R. N. 2014.  Practical and privacy-preserving policy compliance for outsourced data.  In _International Conference on Financial Cryptography and Data Security_ , 181–194. Springer.
  * (6) EMNIST. 2019.  The EMNIST Dataset.  https://www.nist.gov/itl/products-and-services/emnist-dataset.  Accessed: 2020-08-01.
  * (7) FMNIST. 2017.  Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms.  https://www.kaggle.com/zalando-research/fashionmnist.  Accessed: 2020-08-01.
  * Goldreich (1998) Goldreich, O. 1998.  Secure multi-party computation.  _Manuscript. Preliminary version_ , 78.
  * Goldreich, Micali, and Wigderson (2019) Goldreich, O.; Micali, S.; and Wigderson, A. 2019.  How to play any mental game, or a completeness theorem for protocols with honest majority.  In _Providing Sound Foundations for Cryptography: On the Work of Shafi Goldwasser and Silvio Micali_ , 307–328.
  * Gupta et al. (2016) Gupta, D.; Mood, B.; Feigenbaum, J.; Butler, K.; and Traynor, P. 2016.  Using intel software guard extensions for efficient two-party secure function evaluation.  In _International Conference on Financial Cryptography and Data Security_ , 302–318. Springer.
  * Halevy, Norvig, and Pereira (2009) Halevy, A.; Norvig, P.; and Pereira, F. 2009.  The Unreasonable Effectiveness of Data.  _IEEE Intelligent Systems_ , 24: 8–12.
  * Jayaraman and Evans (2019) Jayaraman, B.; and Evans, D. 2019.  Evaluating differentially private machine learning in practice.  In _28th $\\{$USENIX$\\}$ Security Symposium ($\\{$USENIX$\\}$ Security 19)_, 1895–1912.
  * Kairouz et al. (2021) Kairouz, P.; McMahan, H. B.; Avent, B.; Bellet, A.; Bennis, M.; Bhagoji, A. N.; and et al. 2021.  Advances and Open Problems in Federated Learning.  arXiv:1912.04977.
  * Lindell (2020) Lindell, Y. 2020.  Secure Multiparty Computation (MPC).  _IACR Cryptol. ePrint Arch._ , 2020: 300.
  * McMahan et al. (2016) McMahan, H. B.; Moore, E.; Ramage, D.; Hampson, S.; et al. 2016.  Communication-efficient learning of deep networks from decentralized data.  _arXiv preprint arXiv:1602.05629_.
  * (16) MNIST. 2010.  The MNIST Database.  http://yann.lecun.com/exdb/mnist.  Accessed: 2020-08-01.
  * Mohassel and Rindal (2018) Mohassel, P.; and Rindal, P. 2018.  ABY3: A Mixed Protocol Framework for Machine Learning.  In _Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security_ , CCS ’18, 35–52. New York, NY, USA: Association for Computing Machinery.  ISBN 9781450356930.
  * Mohassel and Zhang (2017) Mohassel, P.; and Zhang, Y. 2017.  Secureml: A system for scalable privacy-preserving machine learning.  In _2017 IEEE Symposium on Security and Privacy (SP)_ , 19–38. IEEE.
  * Mondal et al. (2021a) Mondal, A.; More, Y.; Rooparaghunath, R. H.; and Gupta, D. 2021a.  Flatee: Federated Learning Across Trusted Execution Environments.  _arXiv preprint arXiv:2111.06867_.
  * Mondal et al. (2021b) Mondal, A.; More, Y.; Rooparaghunath, R. H.; and Gupta, D. 2021b.  Poster: FLATEE: Federated Learning Across Trusted Execution Environments.  In _2021 IEEE European Symposium on Security and Privacy (EuroS &P)_, 707–709. IEEE.
  * Mood et al. (2016) Mood, B.; Gupta, D.; Carter, H.; Butler, K.; and Traynor, P. 2016.  Frigate: A validated, extensible, and efficient compiler and interpreter for secure computation.  In _2016 IEEE European Symposium on Security and Privacy (EuroS &P)_, 112–127. IEEE.
  * Papernot et al. (2018) Papernot, N.; Song, S.; Mironov, I.; Raghunathan, A.; Talwar, K.; and Erlingsson, Ú. 2018.  Scalable private learning with pate.  _arXiv preprint arXiv:1802.08908_.
  * Patra and Suresh (2020) Patra, A.; and Suresh, A. 2020.  BLAZE: Blazing Fast Privacy-Preserving Machine Learning.  In _NDSS_. NDSS.
  * Perry et al. (2014) Perry, J.; Gupta, D.; Feigenbaum, J.; and Wright, R. N. 2014.  Systematizing secure computation for research and decision support.  In _International Conference on Security and Cryptography for Networks_ , 380–397. Springer.
  * Pettai and Laud (2015) Pettai, M.; and Laud, P. 2015.  Combining differential privacy and secure multiparty computation.  In _Proceedings of the 31st Annual Computer Security Applications Conference_ , 421–430.
  * Phong et al. (2018) Phong, L. T.; Aono, Y.; Hayashi, T.; Wang, L.; and Moriai, S. 2018.  Privacy-Preserving Deep Learning via Additively Homomorphic Encryption.  _IEEE Transactions on Information Forensics and Security_ , 13(5): 1333–1345.
  * Ramachandran et al. (2021) Ramachandran, P.; Agarwal, S.; Mondal, A.; Shah, A.; and Gupta, D. 2021.  S++: A Fast and Deployable Secure-Computation Framework for Privacy-Preserving Neural Network Training.  _arXiv preprint arXiv:2101.12078_.
  * Riazi et al. (2018) Riazi, M. S.; Weinert, C.; Tkachenko, O.; Songhori, E. M.; Schneider, T.; and Koushanfar, F. 2018.  Chameleon: A hybrid secure computation framework for machine learning applications.  707–721.
  * Ryffel et al. (2018) Ryffel, T.; Trask, A.; Dahl, M.; Wagner, B.; Mancuso, J.; Rueckert, D.; and Passerat-Palmbach, J. 2018.  A generic framework for privacy-preserving deep learning.  _arXiv preprint arXiv:1811.04017_.
  * Sav et al. (2020) Sav, S.; Pyrgelis, A.; Troncoso-Pastoriza, J. R.; Froelicher, D.; Bossuat, J.-P.; Sousa, J. S.; and Hubaux, J.-P. 2020.  POSEIDON: Privacy-Preserving Federated Neural Network Learning.  _arXiv preprint arXiv:2009.00349_.
  * Shamir (1979) Shamir, A. 1979.  How to share a secret.  _Communications of the ACM_ , 22(11): 612–613.
  * Shokri and Shmatikov (2015) Shokri, R.; and Shmatikov, V. 2015.  Privacy-preserving deep learning.  In _Proceedings of the 22nd ACM SIGSAC conference on computer and communications security_ , 1310–1321.
  * Truex et al. (2019) Truex, S.; Baracaldo, N.; Anwar, A.; Steinke, T.; Ludwig, H.; Zhang, R.; and Zhou, Y. 2019.  A hybrid approach to privacy-preserving federated learning.  In _Proceedings of the 12th ACM Workshop on Artificial Intelligence and Security_ , 1–11.
  * Wagh, Gupta, and Chandran (2019) Wagh, S.; Gupta, D.; and Chandran, N. 2019.  SecureNN: 3-Party Secure Computation for Neural Network Training.
  * Wagh et al. (2021) Wagh, S.; Tople, S.; Benhamouda, F.; Kushilevitz, E.; Mittal, P.; and Rabin, T. 2021\.  FALCON: Honest-Majority Maliciously Secure Framework for Private Deep Learning.
  * Xu et al. (2019) Xu, R.; Baracaldo, N.; Zhou, Y.; Anwar, A.; and Ludwig, H. 2019.  HybridAlpha: An Efficient Approach for Privacy-Preserving Federated Learning.  In _Proceedings of the 12th ACM Workshop on Artificial Intelligence and Security_ , 13–23.
  * Yao (1982) Yao, A. C. 1982.  Protocols for secure computations.  In _23rd annual symposium on foundations of computer science (sfcs 1982)_ , 160–164. IEEE.
  * Zhu, Liu, and Han (2019) Zhu, L.; Liu, Z.; and Han, S. 2019.  Deep Leakage from Gradients.  In Wallach, H.; Larochelle, H.; Beygelzimer, A.; dAlché Buc, F.; Fox, E.; and Garnett, R., eds., _Advances in Neural Information Processing Systems_ , volume 32, 14774–14784. Curran Associates, Inc.


# The backward problem for time fractional evolution equations

S. E. Chorfi  ,  L. Maniar  and  M. Yamamoto  S. E. Chorfi, L. Maniar, Faculty
of Sciences Semlalia, LMDP, UMMISCO (IRD-UPMC), B.P. 2390, Marrakesh, Morocco
<EMAIL_ADDRESS><EMAIL_ADDRESS>M. Yamamoto, Graduate School of Mathematical
Sciences, The University of Tokyo, Komaba, Meguro, Tokyo 153-8914, Japan
Honorary Member of Academy of Romanian Scientists, Ilfov, nr. 3, Bucuresti,
Romania  Correspondence member of Accademia Peloritana dei Pericolanti
Palazzo Università, Piazza S. Pugliatti 1 98122 Messina Italy
<EMAIL_ADDRESS>
###### Abstract.

In this paper, we consider the backward problem for fractional in time
evolution equations $\partial_{t}^{\alpha}u(t)=Au(t)$ with the Caputo
derivative of order $0<\alpha\leq 1$, where $A$ is a self-adjoint and bounded
above operator on a Hilbert space $H$. First, we extend the logarithmic
convexity technique to the fractional framework by analyzing the properties of
the Mittag-Leffler functions. Then we prove conditional stability estimates of
Hölder type for initial conditions under a weaker norm of the final data.
Finally, we give several applications to show the applicability of our
abstract results.

###### Key words and phrases:

Fractional evolution equation, backward problem, logarithmic convexity, Hölder
stability

###### 2020 Mathematics Subject Classification:

35R11, 35R30, 26A33

##  1\. Introduction and main results

Backward problems for evolution equations have many applications in science
and engineering. It mainly aims at reconstructing a past profile from the
present measured data of a given dynamical system. Such problems are known to
be ill-posed in general, and have been extensively investigated for classical
evolution equations with derivatives of integer order, see for instance [2,
12, 20] and the references therein.

Recently, backward and inverse problems for time fractional evolution
equations of order $0<\alpha<1$ have attracted more attention. This class of
equations has proved powerful in modeling, e.g., slow and anomalous diffusion
phenomena in heterogeneous or porous media [1, 19].

It turned out that fractional backward problems exhibit an essential
difference from the classical case $\alpha=1$ in terms of their well-posedness
and also the techniques used. Needless to say, the well-posedness or the ill-
posedness of the backward problems are concerned with the essence of the
diffusion processes under consideration. For example, in the case where the
backward problem is well-posed, it is suggested that diffusion profiles are
well preserved. On the other hand, the backward problem in the case of
$\alpha=1$ is severely ill-posed and the equation possesses strong smoothing
property in time, and so the recovery of initial value is extremely difficult
by the state at positive time even if time is small.

In spite of the importance, regarding the literature, general results on the
uniqueness and stability for fractional backward problems are quite missing,
although researches grow up rapidly. This is why we consider here an abstract
framework that covers and generalizes many examples of applications.

Let $(H,\langle\cdot,\cdot\rangle)$ be a separable Hilbert space and
$\|\cdot\|$ its associated norm. Let $0<\alpha\leq 1$ and $T>0$ be a fixed
positive time. We are concerned with the following abstract backward problem

$\displaystyle\begin{aligned} &\partial_{t}^{\alpha}u(t)=Au(t),&&\qquad
t\in(0,T),\\\ &u(T)=u_{T},\end{aligned}$ (1)

where $A:D(A)\subset H\rightarrow H$ is a densely defined linear operator such
that:
Assumption I:

  * (i)

$A$ is self-adjoint,

  * (ii)

$A$ is bounded above: there exists $\kappa\geq 0$ such that $\langle
Au,u\rangle\leq\kappa\|u\|^{2}$ for all $u\in D(A)$,

  * (iii)

$A$ has compact resolvent: there exists $\lambda>-\kappa$ such that the
resolvent $R(\lambda,A)=(\lambda I-A)^{-1}$ is compact.

The Caputo derivative $\partial_{t}^{\alpha}g$ is defined by

$\partial_{t}^{\alpha}g(t)=\begin{cases}\displaystyle\frac{1}{\Gamma(1-\alpha)}\int^{t}_{0}(t-s)^{-\alpha}\frac{\mathrm{d}}{\mathrm{d}s}g(s)\,\mathrm{d}s,&0<\alpha<1,\\\
\dfrac{\mathrm{d}}{\mathrm{d}t}g(t),&\alpha=1,\end{cases}$ (2)

as long as the right-hand side is defined. Here $\Gamma$ is the standard Gamma
function.

First, we state a main ingredient to prove some stability results for the
backward problem (1).

######  Theorem 1.1.

Let $0<\alpha\leq 1$. Let $u_{T}\in H$ and $u$ be the solution to (1). Then
there exists a constant $K\geq 1$ such that

$\|u(t)\|\leq K\|u(0)\|^{1-\frac{t}{T}}\|u(T)\|^{\frac{t}{T}},\qquad 0\leq
t\leq T.$ (3)

Moreover, if $\kappa=0$, then we can choose $K=1$.

We emphasize that the stability estimate is uniform for all $0<\alpha\leq 1$
in terms of the logarithmic convexity, although the behavior of $u$ for
$0<\alpha<1$ near $t=0$ is expected to be very different from the parabolic
case $\alpha=1$.

We note that in the proof, the constant $K$ is given in terms of the first
eigenvalue of $-A$. The estimate (3) is commonly referred to as the
logarithmic convexity of the solution to (1). The logarithmic convexity method
has been extensively investigated for backward parabolic problems, see for
instance [2, 3, 4, 13, 20, 30] and the references therein. The method in [13]
relies on the complex variables to prove (3). Owing to the rapidly increasing
references, we do not create a list of works and we refer to [27] and [28] for
example. However, to the best of the authors’ knowledge, Theorem 1.1 is the
first logarithmic convexity result for time fractional evolution equations.

Moreover, we consider
Inverse initial data problem. Let $R>0$ be a fixed constant. We denote the set
of admissible initial data by

$\displaystyle\mathcal{I}_{R}:=\\{u_{0}\in D(A)\colon\|Au_{0}\|,\|u_{0}\|\leq
R\\}.$ (4)

We are concerned with the stable determination of an initial datum
$u_{0}\in\mathcal{I}_{R}$, where $u$ is the solution to (1), from the final
datum $u(T)$.

More precisely, we prove conditional stability estimates of Hölder type.
Conditional stability in this context means that a priori bound of the initial
data is known. We emphasize that such a stability estimate is useful when
dealing with numerical reconstruction of initial data, see for instance [14,
30]. In practice, the original problem is replaced by an approximated one
called the regularized problem. The conditional stability can be used to
provide a suitable choice for the regularization parameter and to determine
the rate of convergence to an exact solution of the original problem [8].

Now we state two kinds of Hölder stability as Theorems 1.2 and 1.3 concerning
the backward problem of determining an initial value.

######  Theorem 1.2.

Let $0<\alpha\leq 1$. Let $u_{0}\in\mathcal{I}_{R}$ and let $u(t)$ be the
corresponding solution to (1). Then there exists a constant
$\theta\in(0,\frac{1}{2})$ depending on $u_{0}$ such that the following
estimate holds

$\|u_{0}\|\leq\|u(T)\|^{\theta}\sqrt{\|u(T)\|^{2-2\theta}+KR^{2-2\theta}\frac{2T^{\alpha}}{\alpha\Gamma(\alpha)}}.$
(5)

######  Remark 1.

Surprisingly, Theorem 1.2 is new even for the integer case $\alpha=1$. Usually
in this case, only a logarithmic stability is known, see e.g., [12, p. 51] and
[4, Theorem 2].

In Theorem 1.2, the exponent $\theta=\theta(u_{0})$ depends on
$u_{0}\in\mathcal{I}_{R}$ and we may be able to choose a sequence
$u_{0}^{k}\in\mathcal{I}_{R}$, $k\in\mathbb{N}$ such that
$\lim_{k\to\infty}\theta(u_{0}^{k})=0$, which means that the estimate (5) does
not make sense in the whole $\mathcal{I}_{R}$.

We can guarantee a uniform lower bound $\theta$ if we assume a lower bound of
$\|u_{0}\|$.

######  Proposition 1.

Let $0<\alpha\leq 1$. We assume that $\lambda_{n}>0$ for all $n\in\mathbb{N}$
and that $\sum_{n=1}^{\infty}\frac{1}{\lambda_{n}^{2}}<\infty$. For
arbitrarily fixed constants $R>0$ and $\delta>0$, we assume that a set
$M\subset\mathcal{I}_{R}$ satisfies

$M\subset\\{u_{0}\in\mathcal{I}_{R}:\,\|u_{0}\|\geq\delta\\}$

and that the embedding $M\subset H$ is compact. Then there exists a constant
$\theta_{0}(\delta)\in(0,\,\frac{1}{2})$ depending on $R,\delta$, such that

$\|u_{0}\|\leq
KR\sqrt{1+\frac{2T^{\alpha}}{\alpha\Gamma(\alpha)}}\|u(T)\|^{\theta_{0}(\delta)}$

for all $u_{0}\in M$.

The condition $\sum_{n=1}^{\infty}\frac{1}{\lambda_{n}^{2}}<\infty$ is
satisfied for a regular elliptic operator $A$ in a bounded domain
$\Omega\subset\mathbb{R}^{N}$, $N=1,2,3$, for example with the zero Dirichlet
boundary condition (see Subsection 4.1). In general, $\lim_{\delta\to
0}\theta_{0}=0$.

We can rewrite the proposition as

$\|u_{0}\|\leq
KR\sqrt{1+\frac{2T^{\alpha}}{\alpha\Gamma(\alpha)}}\|u(T)\|^{\theta_{0}(\delta)}+\delta$

for all $u_{0}\in\mathcal{I}_{R}$ and all $\delta>0$. If we know the decay
rate of $\theta_{0}(\delta)$ as $\delta\to 0$, then by minimizing the right-
hand side of the above inequality with respect to $\delta$, we can reach
concrete conditional stability estimate. However it is difficult to discuss
uniformly in $0<\alpha\leq 1$, as we can understand that the case $\alpha=1$
makes solution very smooth for any small $t>0$, but $0<\alpha<1$ does not have
such strong smoothing property.

Restricted to $0<\alpha<1$, we can prove conditional stability of Hölder type
with explicit exponent. For the statement, we introduce more general
admissible sets of unknown initial values. Since the operator $\kappa-A$ is
non-negative, the fractional powers $(\kappa-A)^{\epsilon}$ are well-defined
for any $\epsilon>0$. Moreover, since $H$ is a Hilbert space, it is known that

$D((\kappa-A)^{\epsilon})=[H,D(A)]_{\epsilon},\qquad\text{if }0<\epsilon\leq
1,$

where $[\cdot,\cdot]_{\epsilon}$ denotes the complex interpolation bracket. We
refer to [17] for more details. Let $\epsilon>0$ and $R>0$ be two positive
constants. We consider the admissible set

$\displaystyle\mathcal{I}_{\epsilon,R}:=\\{u_{0}\in
D((\kappa-A)^{\epsilon})\colon\|u_{0}\|_{D((\kappa-A)^{\epsilon})}\leq R\\}.$

######  Theorem 1.3.

Let $0<\alpha<1$, and let $\beta=\frac{\epsilon}{\epsilon+1}$,
$u_{0}\in\mathcal{I}_{\epsilon,R}$ and $u(t)$ being the corresponding solution
to (1). Then there exists a constant $C_{2}>0$ depending on $\alpha$ and
$\lambda_{m+1}$ such that

$\|u(0)\|\leq\left(1+C_{2}^{\beta}R^{1-\beta}\right)\|u(T)\|^{\beta}.$ (6)

Comparing to the existing literature, Sakamoto and Yamamoto [24] were the
first to prove the well-posedness of a backward problem like (1) with smooth
data $u_{T}$. More precisely, they considered the case when $H=L^{2}(\Omega)$,
with $\Omega\subset\mathbb{R}^{N}$ is a smooth bounded domain, and $A$ is a
symmetric uniformly elliptic operator with zero Dirichlet boundary condition.
Namely, they proved that there exists a constant $C>0$ depending on $T$ such
that for all $u_{T}\in H^{2}(\Omega)\cap H^{1}_{0}(\Omega)$ the corresponding
solution exists and satisfies

$\|u(0,\cdot)\|_{L^{2}(\Omega)}\leq C\|u(T,\cdot)\|_{H^{2}(\Omega)}.$ (7)

This is an unconditional Lipschitz stability, that is, a strong stability
result, but under a stronger norm of the data
$\|u(T,\cdot)\|_{H^{2}(\Omega)}$. In this particular case, although the Hölder
stability (6) is a slightly weaker estimate, (6) establishes an estimate in
terms of the same norm $\|u(0,\cdot)\|_{L^{2}(\Omega)}$ and
$\|u(T,\cdot)\|_{L^{2}(\Omega)}$. This is crucial from a practical
perspective, since only a measurement $u_{T}^{\delta}\in L^{2}(\Omega)$ of
$u_{T}$ is accessible, where $\delta>0$ indicates the noise level. Note that
$u_{T}^{\delta}$ is usually non-smooth due to the random noise. It should be
pointed out that (7) has been recently extended to the non-symmetric operator
case in [10].

We further note that by the interpolation inequality of the Sobolev norms, for
$\epsilon>1$, we can derive the conclusion of Theorem 1.3 directly from (7).

The rest of the article is organized as follows: in Section 2, we start by
recalling some preliminaries. Then we prove some key properties of the Mittag-
Leffler function that will be used later. In Section 3, we prove the
logarithmic convexity estimate stated in Theorem 1.1. Next, we apply the
logarithmic convexity to establish Theorem 1.2 and then we prove Theorem 1.3
on the Hölder stability for the inverse initial data problem. At this level,
some further results are developed and the reconstruction of the solution at
past times from noisy data is briefly discussed. Finally, in Section 4, we
illustrate the abstract results by presenting several examples of time
fractional systems.

##  2\. Preliminary results

Let us start by recalling some definitions and properties needed later.

A function $f:[0,\infty)\rightarrow(0,\infty)$ is log-convex if $\log f(t)$ is
convex, i.e., for all $t,s\geq 0\text{ and }0<\theta<1$,

$f((1-\theta)t+\theta s)\leq f(t)^{1-\theta}f(s)^{\theta}.$ (8)

If $f(t)$ is $C^{2}[0,\infty)$, then it is log-convex on $[0,\infty)$ if and
only if the differential inequality

$f(t)f^{\prime\prime}(t)-(f^{\prime}(t))^{2}\geq 0$ (9)

holds for all $t\geq 0$. It is known that the sum of two log-convex functions
is also log-convex, see e.g., [18, p. 22].

A function $f:[0,\infty)\rightarrow\mathbb{R}$ is called completely monotone
if $f$ has derivatives of all orders and satisfies

$(-1)^{k}f^{(k)}(t)\geq 0\qquad\text{ for all }t>0,\;k=0,1,2,\ldots$

The function $f(t)$ is completely monotone if and only if

$f(t)=\int_{0}^{\infty}\mathrm{e}^{-st}\,\mathrm{d}\rho(s),\qquad t>0,$ (10)

where $\rho(s)$ is non-decreasing and the integral converges. We refer to [29,
Theorem 12b, p. 161]. Note that the complete monotonicity is closed under
addition, multiplication and pointwise convergence, see [25, Corollary 1.6].

We will show the following key lemma (e.g., Theorem 1.3.4 (p. 21) in [18]).

######  Lemma 2.1.

Any completely monotone function $f:[0,\infty)\rightarrow(0,\infty)$ is log-
convex.

###### Proof.

By (10), we see that $\displaystyle
f^{\prime}(t)=-\int_{0}^{\infty}s\mathrm{e}^{-st}\,\mathrm{d}\rho(s)$ and
$\displaystyle
f^{\prime\prime}(t)=\int_{0}^{\infty}s^{2}\mathrm{e}^{-st}\,\mathrm{d}\rho(s)$.
Then the quadratic polynomial $\displaystyle
f(t)x^{2}+2f^{\prime}(t)x+f^{\prime\prime}(t)=\int_{0}^{\infty}\mathrm{e}^{-st}(x-s)^{2}\,\mathrm{d}\rho(s)$
is non-negative for all $x\in\mathbb{R}$. Therefore, it has a non-positive
discriminant. Thus, (9) is satisfied. This completes the proof. ∎

Let $\alpha,\beta>0$. We denote by $E_{\alpha,\beta}(z)$ the Mittag-Leffler
function with two parameters

$E_{\alpha,\beta}(z)=\sum_{k=0}^{\infty}\frac{z^{k}}{\Gamma(\alpha
k+\beta)},\qquad z\in\mathbb{C}.$

The function $E_{\alpha,\beta}(z)$ is an entire function in $\mathbb{C}$.
Next, we collect some useful properties of $E_{\alpha,1}$. We refer to [22]
for more details. Let $\alpha>0$ and $\lambda\geq 0$. Then

  * •

$\dfrac{\mathrm{d}}{\mathrm{d}t}E_{\alpha,1}(t)=\frac{1}{\alpha}E_{\alpha,\alpha}(t)$;

  * •

$\dfrac{\mathrm{d}}{\mathrm{d}t}E_{\alpha,1}(-\lambda t^{\alpha})=-\lambda
t^{\alpha-1}E_{\alpha,\alpha}(-\lambda t^{\alpha})$;

  * •

$\partial_{t}^{\alpha}E_{\alpha,1}(-\lambda t^{\alpha})=-\lambda
E_{\alpha,1}(-\lambda t^{\alpha})$;

  * •

$\lim\limits_{t\to-\infty}E_{\alpha,1}(t)=0$.

The next lemma will be a key to prove the main result.

######  Lemma 2.2.

Let $0<\alpha\leq\beta\leq 1$ and $\lambda\geq 0$. Then the functions
$t\mapsto E_{\alpha,1}(-\lambda t^{\alpha})$ and $t\mapsto
t^{\beta-1}E_{\alpha,\beta}(-\lambda t^{\alpha})$ are log-convex on
$[0,\infty)$.

###### Proof.

It is known that $t\mapsto E_{\alpha,1}(-\lambda t^{\alpha})$ and $t\mapsto
t^{\beta-1}E_{\alpha,\beta}(-\lambda t^{\alpha})$ are completely monotone on
$[0,\infty)$, see, e.g., [11, p. 268-269]. Since they are not identically
zero, they are positive on $[0,\infty)$. By Lemma 2.1, these functions are
log-convex on $[0,\infty)$. ∎

######  Remark 2.

Let $0<\alpha\leq 1$. The function $t\mapsto E_{\alpha,1}(-\lambda
t^{\alpha})$ is not completely monotone for $\lambda<0$.

######  Remark 3.

Let $0<\alpha\leq 1$ and $\beta\geq\alpha$. The function $t\mapsto
E_{\alpha,\beta}(-t)$ is completely monotone on $[0,\infty)$, see [23] and
[26]. By the same argument as above we deduce that $t\mapsto
E_{\alpha,\beta}(-t)$ is log-convex on $[0,\infty)$.

##  3\. Logarithmic convexity and its consequences

In this section, we discuss the ill-posedness of the backward problem (1).
Then we prove Theorem 1.1 and Theorem 1.2. We start by recalling some useful
facts. From Assumption I, it follows that the operator $A$ is closed and
$(D(A),\langle\cdot,\cdot\rangle_{D(A)})$ is a Hilbert space where

$\langle x,y\rangle_{D(A)}=\langle x,y\rangle+\langle
Ax,Ay\rangle,\quad\forall x,y\in D(A).$

Note that the operator $A$ generates a $C_{0}$-semigroup
$(\mathrm{e}^{tA})_{t\geq 0}$ which is analytic of angle $\frac{\pi}{2}$ on
$H$, see [9, p. 106]. Moreover, there exists an orthonormal basis
$\left\\{\varphi_{n}\right\\}_{n\in\mathbb{N}}$ in $H$ of eigenvectors of $-A$
such that $\varphi_{n}\in D(A),\left\|\varphi_{n}\right\|=1$ and
$-A\varphi_{n}=\lambda_{n}\varphi_{n},\forall n\in\mathbb{N}$, where
$\left\\{\lambda_{n}\right\\}_{n\in\mathbb{N}}\subset\mathbb{R}$ denote the
corresponding eigenvalues which can be ordered so that

$-\kappa\leq\lambda_{1}\leq\cdots\leq\lambda_{m}\leq
0<\lambda_{m+1}\leq\cdots\,\rightarrow\infty.$

###  3.1. Ill-posedness of the backward problem

Let us consider the forward problem

$\displaystyle\begin{aligned} &\partial_{t}^{\alpha}u(t)=Au(t),&&\qquad
t\in(0,T),\\\ &u(0)=u_{0}.\end{aligned}$ (11)

Following [24], we can obtain the following well-posedness result by the
Fourier method.

######  Theorem 3.1.

Let $0<\alpha\leq 1$ and $u_{0}\in D(A)$. Then there exists a unique solution
$u\in C\left([0,T];D(A)\right)$ to (11) such that $\partial_{t}^{\alpha}u\in
C\left([0,T];H\right)$. Moreover, the solution is given by

$u(t)=\sum_{n=1}^{\infty}\langle u_{0},\varphi_{n}\rangle
E_{\alpha,1}\left(-\lambda_{n}t^{\alpha}\right)\varphi_{n}.$ (12)

From (12), we see that

$u(T)=\sum_{n=1}^{\infty}\langle u_{0},\varphi_{n}\rangle
E_{\alpha,1}\left(-\lambda_{n}T^{\alpha}\right)\varphi_{n}.$

Hence, for all $n\geq 1$, we have

$\langle u_{0},\varphi_{n}\rangle
E_{\alpha,1}\left(-\lambda_{n}T^{\alpha}\right)=\langle
u(T),\varphi_{n}\rangle.$

This shows that a solution $u$ to (1) for $u_{T}\in H$ does not exist in
general, and when it exists, it is unstable for non smooth data. For instance,
if we choose
$u_{0}=\frac{1}{E_{\alpha,1}\left(-\lambda_{n}T^{\alpha}\right)}\varphi_{n}$,
then
$\|u_{0}\|=\frac{1}{E_{\alpha,1}\left(-\lambda_{n}T^{\alpha}\right)}\to\infty$
as $n\to\infty$, whereas $\|u_{T}\|=1$. Thus, an estimate of the form
$\|u_{0}\|\leq C_{1}\|u_{T}\|$ does not hold in general. Note that the well-
posedness of the fractional backward problem ($0<\alpha<1$) holds for
diffusion equations if we smooth the data $u_{T}$ as in (7). This is
considerably different from the classical parabolic case $\alpha=1$ where the
problem is still unstable, even if we adopt any Sobolev norms
$\|u_{T}\|_{H^{m}(\Omega)}$ with arbitrary $m>0$.

###  3.2. Proof of logarithmic convexity

###### Proof of Theorem 1.1.

We shall use the results of Section 2. By the representation formula (12), we
obtain that

$\displaystyle u(t)$ $\displaystyle=\sum_{n=1}^{m}\langle
u_{0},\varphi_{n}\rangle
E_{\alpha,1}\left(-\lambda_{n}t^{\alpha}\right)\varphi_{n}+\sum_{n=m+1}^{\infty}\langle
u_{0},\varphi_{n}\rangle
E_{\alpha,1}\left(-\lambda_{n}t^{\alpha}\right)\varphi_{n}$
$\displaystyle=:u_{1}(t)+u_{2}(t).$ (13)

Observe that $\|u(t)\|^{2}=\|u_{1}(t)\|^{2}+\|u_{2}(t)\|^{2}$. First, we have
$\lambda_{n}>0$ for $n\geq m+1$ and

$\|u_{2}(t)\|^{2}=\sum_{n=m+1}^{\infty}\langle
u_{0},\varphi_{n}\rangle^{2}\left(E_{\alpha,1}(-\lambda_{n}t^{\alpha})\right)^{2}.$

In Lemma 2.2, we have seen that the functions $t\mapsto
E_{\alpha,1}(-\lambda_{n}t^{\alpha})$ are completely on $[0,T]$ for
$\lambda_{n}\geq 0$. By [25, Corollary 1.6], it follows that the functions
$t\mapsto\left(E_{\alpha,1}(-\lambda_{n}t^{\alpha})\right)^{2}$ and then
$t\mapsto\|u_{2}(t)\|^{2}$ are completely monotone on $[0,T]$. Thus, Lemma 2.1
implies that the function $t\mapsto\|u_{2}(t)\|^{2}$ is log-convex on $[0,T]$.
Therefore

$\displaystyle\|u_{2}(t)\|$
$\displaystyle\leq\|u_{2}(0)\|^{1-\frac{t}{T}}\|u_{2}(T)\|^{\frac{t}{T}}$
$\displaystyle\leq\|u(0)\|^{1-\frac{t}{T}}\|u(T)\|^{\frac{t}{T}}.$ (14)

On the other hand, $\displaystyle\|u_{1}(t)\|^{2}=\sum_{n=1}^{m}\langle
u_{0},\varphi_{n}\rangle^{2}\left(E_{\alpha,1}(-\lambda_{n}t^{\alpha})\right)^{2}$.
It holds that the function $\lambda\mapsto\left(E_{\alpha,1}(-\lambda
T^{\alpha})\right)^{2}$ is non-increasing for $\lambda\leq 0$. By
$\lambda_{1}\leq\lambda_{n}$ for $n\leq m$, we have

$\displaystyle\|u_{1}(T)\|^{2}$ $\displaystyle\leq\max_{1\leq n\leq
m}|E_{\alpha,1}(-\lambda_{n}T^{\alpha})|^{2}\sum_{n=1}^{m}\langle
u_{0},\varphi_{n}\rangle^{2}$
$\displaystyle=|E_{\alpha,1}(-\lambda_{1}T^{\alpha})|^{2}\|u_{1}(0)\|^{2}$
$\displaystyle=:K_{1}^{2}\|u_{1}(0)\|^{2}.$

Since $\lambda_{n}\leq 0$ for $n\leq m$, the function
$t\mapsto\left(E_{\alpha,1}(-\lambda_{n}t^{\alpha})\right)^{2}$ is non-
decreasing for $n\leq m$. Hence, for $0\leq t\leq T$,

$\displaystyle\|u_{1}(t)\|$ $\displaystyle\leq\|u_{1}(T)\|\leq K_{1}\|u(0)\|,$

where the constant satisfies $K_{1}\geq 1$. Thus

$\displaystyle\|u_{1}(t)\|$ $\displaystyle\leq
K_{1}\|u(0)\|^{1-\frac{t}{T}}\|u_{1}(T)\|^{\frac{t}{T}}$ $\displaystyle\leq
K_{1}\|u(0)\|^{1-\frac{t}{T}}\|u(T)\|^{\frac{t}{T}}.$ (15)

From (14) and (15), setting $K:=K_{1}+1$, we obtain

$\|u(t)\|\leq K\|u(0)\|^{1-\frac{t}{T}}\|u(T)\|^{\frac{t}{T}},\qquad 0\leq
t\leq T.$

∎

As a direct corollary of Theorem 1.1, we obtain the following backward
uniqueness result.

######  Corollary 1.

Let $u_{T}\in H$. If the solution of (1) satisfies $u(T)=0$, then $u(0)=0$ and
hence $u(t)=0$ for all $t\in[0,T]$.

Consequently, the fractional backward system (1) has at most one solution.

###  3.3. Proof of Hölder stability

In order to prove Theorem 1.2 on the Hölder stability, we need the following
lemma.

######  Lemma 3.2.

Let $0<\alpha\leq 1$. Let $u_{0}\in D(A)$ and $u$ be the corresponding
solution to (1). Then for all $t\in(0,T)$, we have

$-\partial_{t}^{\alpha}\,\|u(t)\|^{2}\leq 2\|u(t)\|\|Au_{0}\|.$ (16)

###### Proof.

We borrow the notations from the proof of Theorem 1.1. By the formula (13), we
see that

$-\partial_{t}^{\alpha}\,\|u(t)\|^{2}=-\partial_{t}^{\alpha}\,\|u_{1}(t)\|^{2}-\partial_{t}^{\alpha}\,\|u_{2}(t)\|^{2}.$
(17)

First, we have

$-\partial_{t}^{\alpha}\,\|u_{1}(t)\|^{2}=-\sum_{n=1}^{m}\langle
u_{0},\varphi_{n}\rangle^{2}\,\partial_{t}^{\alpha}\left[\left(E_{\alpha,1}(-\lambda_{n}t^{\alpha})\right)^{2}\right].$

Now, assume that $0<\alpha<1$. It follows from (2) that

$\displaystyle-\partial_{t}^{\alpha}\left[\left(E_{\alpha,1}(-\lambda_{n}t^{\alpha})\right)^{2}\right]$
$\displaystyle=\frac{-2}{\Gamma(1-\alpha)}\int_{0}^{t}(t-s)^{-\alpha}E_{\alpha,1}(-\lambda_{n}s^{\alpha})\,\partial_{s}\left(E_{\alpha,1}(-\lambda_{n}s^{\alpha})\right)\,\mathrm{d}s$
$\displaystyle=\frac{2\lambda_{n}}{\Gamma(1-\alpha)}\int_{0}^{t}(t-s)^{-\alpha}s^{\alpha-1}E_{\alpha,1}(-\lambda_{n}s^{\alpha})\,E_{\alpha,\alpha}(-\lambda_{n}s^{\alpha})\,\mathrm{d}s.$
(18)

Since $\lambda_{n}\leq 0$ for all $n\leq m$, we note that
$E_{\alpha,1}(-\lambda_{n}s^{\alpha})\geq 0$ is non-decreasing in $s>0$ and
$s^{\alpha-1}E_{\alpha,\alpha}(-\lambda_{n}s^{\alpha})\geq 0$ for $s\geq 0$.
Hence we obtain
$-\partial_{t}^{\alpha}\left[\left(E_{\alpha,1}(-\lambda_{n}t^{\alpha})\right)^{2}\right]\leq
0$, and then $-\partial_{t}^{\alpha}\,\|u_{1}(t)\|^{2}\leq 0$. On the other
hand,

$-\partial_{t}^{\alpha}\,\|u_{2}(t)\|^{2}=-\sum_{n=m+1}^{\infty}\langle
u_{0},\varphi_{n}\rangle^{2}\,\partial_{t}^{\alpha}\left[\left(E_{\alpha,1}(-\lambda_{n}t^{\alpha})\right)^{2}\right].$
(19)

Since $\lambda_{n}\geq 0$ for all $n\geq m+1$, we have
$E_{\alpha,1}(-\lambda_{n}s^{\alpha})\leq 1$ and
$\partial_{s}E_{\alpha,1}(-\lambda_{n}s^{\alpha})\leq 0$, and the equality
(18) implies that

$\displaystyle-\partial_{t}^{\alpha}\left[\left(E_{\alpha,1}(-\lambda_{n}t^{\alpha})\right)^{2}\right]$
$\displaystyle\leq\frac{-2}{\Gamma(1-\alpha)}\int_{0}^{t}(t-s)^{-\alpha}\,\partial_{s}\left(E_{\alpha,1}(-\lambda_{n}s^{\alpha})\right)\,\mathrm{d}s$
$\displaystyle=-2\,\partial_{t}^{\alpha}\left(E_{\alpha,1}(-\lambda_{n}t^{\alpha})\right)$
$\displaystyle=2\lambda_{n}E_{\alpha,1}(-\lambda_{n}t^{\alpha}).$

Now, the above inequality, (19) and the Cauchy-Schwarz inequality yield that

$\displaystyle-\partial_{t}^{\alpha}\,\|u_{2}(t)\|^{2}$ $\displaystyle\leq
2\sum_{n=m+1}^{\infty}\left(\langle u_{0},\varphi_{n}\rangle
E_{\alpha,1}(-\lambda_{n}t^{\alpha})\right)\left(\lambda_{n}\langle
u_{0},\varphi_{n}\rangle\right)$ $\displaystyle\leq 2\|u_{2}(t)\|\|Au_{0}\|$
$\displaystyle\leq 2\|u(t)\|\|Au_{0}\|.$

The case $\alpha=1$ can be handled by simplifying the above arguments, since
in this case we have

$\|u(t)\|^{2}=\sum_{n=1}^{\infty}\langle
u_{0},\varphi_{n}\rangle^{2}\,\mathrm{e}^{-2\lambda_{n}t}.$

Thus, the proof is completed. ∎

Let $0<\alpha\leq 1$. We set

$J_{t}^{\alpha}g(t):=\frac{1}{\Gamma(\alpha)}\int^{t}_{0}(t-s)^{\alpha-1}g(s)\,\mathrm{d}s,\quad
g\in L^{2}(0,T).$

###### Proof of Theorem 1.2.

For $g\in W^{1,1}(0,T)$, we can readily verify

$J_{t}^{\alpha}\partial_{t}^{\alpha}g(t)=g(t)-g(0).$ (20)

Next we can prove

$\|u(t)\|^{2}\in W^{1,1}(0,T)\quad\mbox{for $u_{0}\in D(A)$}.$ (21)

Indeed,

$\displaystyle\partial_{t}\|u(t)\|^{2}=\sum_{n=1}^{\infty}\langle
u_{0},\varphi_{n}\rangle^{2}\partial_{t}(E_{\alpha,1}(-\lambda_{n}t^{\alpha}))^{2}$
$\displaystyle=$ $\displaystyle 2\sum_{n=1}^{\infty}\langle
u_{0},\varphi_{n}\rangle^{2}E_{\alpha,1}(-\lambda_{n}t^{\alpha})(-\lambda_{n})t^{\alpha-1}E_{\alpha,\alpha}(-\lambda_{n}t^{\alpha}),\quad
t>0.$

Dividing the summation $\sum_{n=1}^{\infty}$ into $\sum_{n=1}^{m}$ and
$\sum_{n=m+1}^{\infty}$ and using $\lambda_{n}>0$ for $n\geq m+1$,
$\lambda_{n}\leq 0$ for $1\leq n\leq m$, we can apply Theorem 1.6 (p. 35) in
[22] for $n\geq m+1$, and $|E_{\alpha,1}(-\lambda_{n}t^{\alpha})|$,
$|E_{\alpha,\alpha}(-\lambda_{n}t^{\alpha})|\leq C_{2}$ for $0\leq t\leq T$
and $1\leq n\leq m$, we obtain

$\displaystyle|\partial_{t}\|u(t)\|^{2}|\leq
C_{3}\sum_{n=1}^{m}|\lambda_{n}|\langle
u_{0},\varphi_{n}\rangle^{2}t^{\alpha-1}+C_{3}\sum_{n=m+1}^{\infty}|\lambda_{n}|\langle
u_{0},\varphi_{n}\rangle^{2}t^{\alpha-1}\left(\frac{1}{1+\lambda_{n}t^{\alpha}}\right)^{2}$
$\displaystyle\leq$ $\displaystyle
C_{4}\left(\sum_{n=1}^{\infty}|\lambda_{n}|\langle
u_{0},\varphi_{n}\rangle^{2}\right)t^{\alpha-1}\in L^{1}(0,T)$

by $\alpha>0$. Thus the verification of (21) is complete.

By the Sobolev embedding, we remark that $\|u(t)\|\in C[0,T]$. Since
$J_{t}^{\alpha}g_{1}\leq J_{t}^{\alpha}g_{2}$ in $(0,T)$ for $g_{1}\leq g_{2}$
in $(0,T)$, we operate $J_{t}^{\alpha}$ to both sides of (16). In terms of
(20), we see

$\|u(0)\|^{2}-\|u(T)\|^{2}\leq\frac{2}{\Gamma(\alpha)}\int^{T}_{0}(T-s)^{\alpha-1}\|u(s)\|\,\mathrm{d}s\,\|Au_{0}\|.$

Since $(T-s)^{\alpha-1}\in L^{1}(0,T)$ as function in $s$ and $\|u(s)\|\in
C[0,T]$ by (21), the mean value theorem for integral yields that there exists
$\xi=\xi(u_{0})\in(0,T)$ such that

$\int^{T}_{0}(T-s)^{\alpha-1}\|u(s)\|\,\mathrm{d}s=\|u(\xi)\|\int^{T}_{0}(T-s)^{\alpha-1}\,\mathrm{d}s=\frac{T^{\alpha}}{\alpha}\|u(\xi)\|.$

Therefore, we obtain

$\|u(0)\|^{2}\leq\|u(T)\|^{2}+\frac{2\,T^{\alpha}}{\alpha\Gamma(\alpha)}\|u(\xi)\|\|Au_{0}\|.$

By Theorem 1.1, we have

$\|u(\xi)\|\leq K\|u(0)\|^{1-\frac{\xi}{T}}\|u(T)\|^{\frac{\xi}{T}}\leq
KR^{1-\frac{\xi}{T}}\|u(T)\|^{\frac{\xi}{T}}.$

Therefore, setting $\theta:=\frac{\xi}{2T}$, we reach the conclusion. This
achieves the proof. ∎

###### Proof of Proposition 1.

By $u(u_{0})=u(u_{0})(t)$ we denote the solution to

$\partial_{t}^{\alpha}u(t)=Au(t),\quad u(0)=u_{0}.$

Then we know that for $u_{0}\in H$, there exists a unique solution
$u(u_{0})\in C([0,T];H)$ (e.g., Sakamoto and Yamamoto [24] for $0<\alpha<1$
and Pazy [21] for $\alpha=1$). Also, it is known that

$\|u(u_{0})(t)-u_{0}\|^{2}=\begin{cases}\displaystyle\sum_{n=1}^{\infty}\langle
u_{0},\varphi_{n}\rangle^{2}(E_{\alpha,1}(-\lambda_{n}t^{\alpha})-1)^{2},&0<\alpha<1,\\\
\displaystyle\sum_{n=1}^{\infty}\langle
u_{0},\varphi_{n}\rangle^{2}(\mathrm{e}^{-\lambda_{n}t}-1)^{2},&\alpha=1.\end{cases}$

Assume that the conclusion of the theorem does not hold. By $\theta(u_{0})$,
we denote the exponent $\theta$ in (5). Then there exist $u_{0}^{k}\in M$ such
that $\lim_{k\to\infty}\theta(u_{0}^{k})=0$. Set
$\xi_{k}:=2T\theta(u_{0}^{k})$. Moreover, the compactness implies that a
subsequence, still denoted by $u_{0}^{k}$, satisfies
$\lim_{k\to\infty}u_{0}^{k}=u_{0}\in H$ with some $u_{0}$. In

$\int^{T}_{0}(T-s)^{\alpha-1}\|u_{k}(s)\|\,\mathrm{d}s=\|u_{k}(\xi_{k})\|\frac{T^{\alpha}}{\alpha},$
(22)

we set $u_{k}(t):=u(u_{0}^{k})(t)$ for $k\in\mathbb{N}$ and $t>0$. We write
$u=u(u_{0})$. We discuss only the case $0<\alpha<1$, and the case $\alpha=1$
can be discussed in the same way. We have

$\displaystyle\|u_{k}(\xi_{k})-u(0)\|=\|u_{k}(\xi_{k})-u_{k}(0)+u_{k}(0)-u(0)\|$
$\displaystyle\leq$
$\displaystyle\|u_{k}(\xi_{k})-u_{k}(0)\|+\|u_{k}(0)-u_{0}\|,$

and

$\|u_{k}(\xi_{k})-u_{k}(0)\|^{2}=\sum_{n=1}^{\infty}\langle
u_{0}^{k},\varphi_{n}\rangle^{2}(E_{\alpha,1}(-\lambda_{n}\xi_{k}^{\alpha})-1)^{2}$

and

$\lim_{k\to\infty}\|u_{k}(0)-u_{0}\|=\lim_{k\to\infty}\|u_{0}^{k}-u_{0}\|=0.$

Since $\|Au_{0}^{k}\|\leq R$ for all $k\in\mathbb{N}$, we have

$\displaystyle|\langle u_{0}^{k},\varphi_{n}\rangle|=|\langle
A^{-1}Au_{0}^{k},\varphi_{n}\rangle|=|\langle
Au_{0}^{k},A^{-1}\varphi_{n}\rangle|=\left|\frac{1}{\lambda_{n}}\langle
Au_{0}^{k},\varphi_{n}\rangle\right|$ $\displaystyle\leq$
$\displaystyle\frac{1}{\lambda_{n}}\|Au_{0}^{k}\|\|\varphi_{n}\|\leq\frac{R}{\lambda_{n}}.$

Also using the assumption
$\sum_{n=1}^{\infty}\frac{1}{\lambda_{n}^{2}}<\infty$, we can apply the
Lebesgue convergence theorem to see that
$\lim_{k\to\infty}\|u_{k}(\xi_{k})-u_{k}(0)\|=0$.

Therefore, letting $k\to\infty$ in (22), we obtain

$\int^{T}_{0}(T-s)^{\alpha-1}(\|u(s)\|-\|u(0)\|)\,\mathrm{d}s=0.$

By $\lambda_{n}>0$, using

$\|u(s)\|^{2}=\sum_{n=1}^{\infty}|\langle
u_{0},\varphi_{n}\rangle|^{2}E_{\alpha,1}(-\lambda_{n}s^{\alpha})^{2}\leq\sum_{n=1}^{\infty}|\langle
u_{0},\varphi_{n}\rangle|^{2},$

we see that $\|u(s)\|\leq\|u(0)\|$ for $s>0$. Hence $\|u(s)\|=\|u(0)\|$ for
all $s>0$. Therefore the eigenvectors expansion yields

$\sum_{n=1}^{\infty}|\langle
u_{0},\varphi_{n}\rangle|^{2}(1-E_{\alpha,1}(-\lambda_{n}s^{\alpha}))^{2}=0.$

Since $\lambda_{n}>0$, we have $E_{\alpha,1}(-\lambda_{n}s^{\alpha})<1$ for
all $n\in\mathbb{N}$. Therefore, $\langle u_{0},\varphi_{n}\rangle=0$ for all
$n\in\mathbb{N}$, which means that $u_{0}=0$. Since
$\lim_{k\to\infty}\|u_{0}^{k}\|=\|u_{0}\|$ and $\|u_{0}^{k}\|\geq\delta$ for
$k\in\mathbb{N}$ by $u_{0}^{k}\in M$, we see that $0\geq\delta$. Hence we
reach a contradiction. Thus the proof of Proposition 1 is complete. ∎

###### Proof of Theorem 1.3.

We set

$\displaystyle u(t)$ $\displaystyle=\sum_{n=1}^{m}\langle
u_{0},\varphi_{n}\rangle
E_{\alpha,1}\left(-\lambda_{n}t^{\alpha}\right)\varphi_{n}+\sum_{n=m+1}^{\infty}\langle
u_{0},\varphi_{n}\rangle
E_{\alpha,1}\left(-\lambda_{n}t^{\alpha}\right)\varphi_{n}$
$\displaystyle=:u_{1}(t)+u_{2}(t).$

Then

$\displaystyle\|u(0)\|^{2}$ $\displaystyle=\sum_{n=1}^{m}\langle
u_{0},\varphi_{n}\rangle^{2}+\sum_{n=m+1}^{\infty}\langle
u_{0},\varphi_{n}\rangle^{2}$
$\displaystyle=:\|u_{1}(0)\|^{2}+\|u_{2}(0)\|^{2}.$

First, since $\lambda_{n}\leq 0$ for $n\leq m$, the function $t\mapsto
E_{\alpha,1}(-\lambda_{n}t^{\alpha})$ is non-decreasing for $n\leq m$. Then
$E_{\alpha,1}(-\lambda_{n}t^{\alpha})\geq 1$ for $n\leq m$ and
$\|u_{1}(0)\|^{2}\leq\|u_{1}(T)\|^{2}\leq\|u(T)\|^{2}$. On the other hand, by
using the Hölder inequality we obtain

$\displaystyle\|u_{2}(0)\|^{2}$ $\displaystyle=\sum_{n=m+1}^{\infty}\langle
u_{0},\varphi_{n}\rangle^{2}$
$\displaystyle=\sum_{n=m+1}^{\infty}\frac{\langle
u(T),\varphi_{n}\rangle^{2}}{\left(E_{\alpha,1}\left(-\lambda_{n}T^{\alpha}\right)\right)^{2}}$
$\displaystyle=\sum_{n=m+1}^{\infty}\frac{\langle
u(T),\varphi_{n}\rangle^{2(1-\beta)}}{\left(E_{\alpha,1}\left(-\lambda_{n}T^{\alpha}\right)\right)^{2}}\;\langle
u(T),\varphi_{n}\rangle^{2\beta}$
$\displaystyle\leq\left(\sum_{n=m+1}^{\infty}\frac{\langle
u(T),\varphi_{n}\rangle^{2}}{\left(E_{\alpha,1}\left(-\lambda_{n}T^{\alpha}\right)\right)^{\frac{2}{1-\beta}}}\right)^{1-\beta}\left(\sum_{n=m+1}^{\infty}\langle
u(T),\varphi_{n}\rangle^{2}\right)^{\beta}$
$\displaystyle\leq\left(\sum_{n=m+1}^{\infty}\frac{\langle
u_{0},\varphi_{n}\rangle^{2}}{\left(E_{\alpha,1}\left(-\lambda_{n}T^{\alpha}\right)\right)^{\frac{2\beta}{1-\beta}}}\right)^{1-\beta}\|u(T)\|^{2\beta}.$

Since $-\lambda_{n}T^{\alpha}\leq 0$ for $n\geq m+1$ and $0<\alpha<1$, by
Theorem 1.4 (p. 33-34) in [22], we see

$E_{\alpha,1}(-\lambda_{n}T^{\alpha})=\frac{1}{\Gamma(1-\alpha)\lambda_{n}T^{\alpha}}+O\left(\frac{1}{\lambda_{n}^{2}}\right)$

for all large $n\in\mathbb{N}$. Consequently we can prove

$\left(E_{\alpha,1}\left(-\lambda_{n}T^{\alpha}\right)\right)^{-1}\leq
C_{1}(1+\lambda_{n}T^{\alpha})$

for some constant $C_{1}>0$. See also [15, Corollary 2.2].

Setting $C_{2}=C_{1}\left(\frac{1}{\lambda_{m+1}}+T^{\alpha}\right)$, we
obtain

$\left(E_{\alpha,1}\left(-\lambda_{n}T^{\alpha}\right)\right)^{-1}\leq
C_{2}\lambda_{n}$

for $n\geq m+1$. Therefore

$\displaystyle\|u_{2}(0)\|^{2}$ $\displaystyle\leq
C_{2}^{2\beta}\left(\sum_{n=m+1}^{\infty}\langle
u_{0},\varphi_{n}\rangle^{2}\lambda_{n}^{\frac{2\beta}{1-\beta}}\right)^{1-\beta}\|u(T)\|^{2\beta}$
$\displaystyle\leq
C_{2}^{2\beta}\|u_{0}\|_{D((\kappa-A)^{\epsilon})}^{2(1-\beta)}\|u(T)\|^{2\beta},$

since $\epsilon=\frac{\beta}{1-\beta}$. We assume without loss of generality
that $\|u(T)\|\leq 1$. Hence

$\displaystyle\|u(0)\|$ $\displaystyle\leq\|u_{1}(0)\|+\|u_{2}(0)\|$
$\displaystyle\leq\|u(T)\|+C_{2}^{\beta}R^{1-\beta}\|u(T)\|^{\beta}$
$\displaystyle\leq\left(1+C_{2}^{\beta}R^{1-\beta}\right)\|u(T)\|^{\beta}.$

∎

######  Remark 4.

Setting $\epsilon=1$, i.e., $\beta=\frac{1}{2}$ in Theorem 1.3, we obtain a
similar result to Theorem 1.2 for $0<\alpha<1$, with $\theta=\frac{1}{2}$ and
a different constant. Note that Theorem 1.3 does not cover $\alpha=1$, since
we have used the inequality: for $0<\alpha<1$, there exists a constant $c>0$
such that $(1-x)E_{\alpha,1}(x)\geq c>0$ for all $x\leq 0$, which does not
hold for $\alpha=1$.

###  3.4. Backward problems from noisy data

The purpose of this part is to reconstruct the solution $u(t)$ for $0<t<T$ to
the following problem

$\displaystyle\begin{aligned} &\partial_{t}^{\alpha}u(t)=Au(t)+f(t),&&\qquad
t\in(0,T),\\\ &u(T)=u_{T},\end{aligned}$ (23)

from a noisy measurement $u_{T}^{\delta}$ of the exact final datum $u(T)$,
i.e.,

$\|u(T)-u_{T}^{\delta}\|\leq\delta,$

where $\delta>0$ is some known measurement error. Here the source term $f$ is
assumed to be known. Then an approximate solution to the original problem is
given by

$\displaystyle\begin{aligned}
&\partial_{t}^{\alpha}u^{\delta}(t)=Au^{\delta}(t)+f(t),&&t\in(0,T),\\\
&u^{\delta}(T)=u_{T}^{\delta}.\end{aligned}$ (24)

Let $R>0$ be a known a priori bound. Let us set the following class of
solutions

$\mathcal{M}=\left\\{u\in C([0,T];H)\colon\|u(0)\|\leq R\right\\}.$ (25)

Restricted to the class $\mathcal{M}$, the logarithmic convexity estimate (3)
yields a Hölder continuous dependence of the solution $u(t)$, $0<t<T$, with
respect to the data. More precisely, we have the following result.

######  Theorem 3.3.

Let $u$ and $u^{\delta}$ be the solutions to (23) and (24) respectively such
that $u,u^{\delta}\in\mathcal{M}$. Then

$\|u(t)-u^{\delta}(t)\|\leq 2KR^{1-\frac{t}{T}}\delta^{\frac{t}{T}},\qquad
0\leq t\leq T.$ (26)

###### Proof.

If $v(t)=u(t)-u^{\delta}(t)$, then $v$ is a solution to (1) corresponding to
the final datum $v(T)=u(T)-u_{T}^{\delta}$ and the initial datum
$v(0)=u_{0}-u_{0}^{\delta}$. Since $\|v(0)\|\leq 2R$, the estimate (3) applied
to $v$ yields the desired result. ∎

As a widely used numerical method for reconstructing an initial value $u_{0}$
from noisy data at $t=T$, we can refer to the Tikhonov regularization, where
one important issue is choices of the regularizing parameters according to
given noise level $\delta>0$. The conditional stability Theorem 1.3 provides a
choice principle for quasi-optimal convergence of the scheme, and as for the
details, see Cheng and Yamamoto [8].

##  4\. Applications

In this section, we present some various examples of time fractional systems
that fit in our abstract framework and for which we can immediately apply
Theorems 1.1, 1.2 and 1.3.

###  4.1. Fractional uniformly elliptic equations

Henceforth, $\Omega\subset\mathbb{R}^{N}$ is a bounded domain with boundary
$\partial\Omega$ of class $C^{2}$. We consider the backward problem with
Dirichlet or Neumann boundary conditions:

$\displaystyle\begin{aligned}
&\partial_{t}^{\alpha}u(t,x)=Au(t,x),&&\qquad\text{ in }(0,T)\times\Omega,\\\
&\begin{cases}u\rvert_{\partial\Omega}=0,&\quad\text{ on
}(0,T)\times\partial\Omega\;\text{ (Dirichlet case) or}\\\
\partial_{\nu}^{A}u=0,&\quad\text{ on }(0,T)\times\partial\Omega\;\,\text{
(Neumann case)},\end{cases}\\\ &u(T,x)=u_{T}(x)&&\qquad\text{ in
}\Omega,\end{aligned}$ (27)

where the state space is $H=L^{2}(\Omega)$, and $A$ is a symmetric uniformly
elliptic operator, i.e.,

$Au\,(x):=\sum_{i,j=1}^{N}\partial_{i}(a_{ij}(x)\partial_{j}u)(x)+p(x)u,$ (28)

such that

$a_{ij}=a_{ji}\in C^{1}(\overline{\Omega}),\quad 1\leq i,j\leq N,\qquad p\in
L^{\infty}(\Omega),$

and there exists a constant $\kappa>0$ such that

$\sum_{i,j=1}^{N}a_{ij}(x)\xi_{i}\xi_{j}\geq\kappa\sum_{j=1}^{N}\xi_{j}^{2},\quad
x\in\overline{\Omega},\;(\xi_{1},...,\xi_{N})\in\mathbb{R}^{N}.$

The unit outwards normal vector to $\partial\Omega$ is denoted by $\nu$ and
the conormal derivative with respect to $A$ by

$\partial_{\nu}^{A}u=\sum_{i,j=1}^{N}a_{ij}\nu_{j}(\partial_{i}u)_{|\partial\Omega}.$

The domain of the operator $A$ is given by

$D(A)=\begin{cases}H^{2}(\Omega)\cap H^{1}_{0}(\Omega),&(\text{Dirichlet case)
or}\\\ \left\\{u\in
H^{2}(\Omega)\colon\partial_{\nu}^{A}u=0\right\\}&(\text{Neumann
case}).\end{cases}$ (29)

It is known that the operator $A$ satisfies Assumption I. Indeed, it is self-
adjoint and bounded above thanks to Green’s formula. Since the embedding
$D(A)\hookrightarrow L^{2}(\Omega)$ is compact, $A$ has compact resolvent, see
[9, Proposition 4.25]. Then Theorem 1.2 yields

######  Corollary 2.

Let $u_{0}\in\mathcal{I}_{R}$ and let $u(t,x)$ be the corresponding solution
to (27). Then there exists a constant $\theta\in(0,\frac{1}{2})$ such that

$\|u(0,\cdot)\|_{L^{2}(\Omega)}\leq
KR^{1-\theta}\sqrt{1+\frac{2\,T^{\alpha}}{\alpha\Gamma(\alpha)}}\|u(T,\cdot)\|_{L^{2}(\Omega)}^{\theta}.$

We can apply Theorem 1.3, but we omit the statements of stability estimates
which Theorem 1.3 brings in this and the succeeding cases.

###  4.2. Fractional advection-diffusion equation

Let $l>0$, $b\in\mathbb{R}$ and $d>0$. We consider the following one-
dimensional problem

$\begin{cases}\partial^{\alpha}_{t}u(t,x)=du_{xx}(t,x)-bu_{x}(t,x),&(t,x)\in(0,T)\times(0,l),\\\
u(t,0)=u(t,l)=0,&t\in(0,T),\\\ u(T,x)=u_{T}(x),&x\in(0,l).\end{cases}$ (30)

Although the equation (30) is not symmetric, it can be reduced to the form
(27). Let us make the change of variables $\xi=\frac{x}{\sqrt{d}}$ and
$u(t,x)=v(t,\xi)\,\mathrm{e}^{\frac{b\xi}{2\sqrt{d}}}$. By a simple
calculation, (30) can be transformed to the following equation

$\begin{cases}\partial^{\alpha}_{t}v(t,\xi)=v_{\xi\xi}(t,\xi)+pv(t,\xi),&(t,\xi)\in(0,T)\times(0,\ell),\\\
v(t,0)=v(t,\ell)=0,&t\in(0,T),\\\
v(T,\xi)=u_{T}(\xi\sqrt{d})\,\mathrm{e}^{\frac{-b\xi}{2\sqrt{d}}},&x\in(0,\ell),\end{cases}$
(31)

where $p=-\frac{b^{2}}{4d}$ and $\ell=\frac{l}{\sqrt{d}}$. Here we note
$v(0,\xi)=u(0,\xi\sqrt{d})\,\mathrm{e}^{\frac{-b\xi}{2\sqrt{d}}}$. From
Corollary 2 applied to (31), we obtain

######  Corollary 3.

Let $u_{0}\in\mathcal{I}_{R}$ and let $u(t,x)$ be the corresponding solution
to (30). Then there exist $\theta\in(0,\frac{1}{2})$ and a positive constant
$C=C(b,l,d,\theta)$ such that

$\|u(0,\cdot)\|_{L^{2}(0,l)}\leq
CKR^{1-\theta}\sqrt{1+\frac{2\,T^{\alpha}}{\alpha\Gamma(\alpha)}}\|u(T,\cdot)\|_{L^{2}(0,l)}^{\theta}.$

###  4.3. Space-time fractional diffusion equations

Let $0<s<1$. We consider the backward problem

$\displaystyle\begin{aligned}
&\partial_{t}^{\alpha}u(t,x)=-(-A_{0})^{s}u(t,x),&&\qquad\text{ in
}(0,T)\times\Omega,\\\ &u\rvert_{\partial\Omega}=0,&&\qquad\text{ on
}(0,T)\times\partial\Omega,\\\ &u(T,x)=u_{T}(x)&&\qquad\text{ in
}\Omega,\end{aligned}$ (32)

where (as in (28)) $A_{0}$ is a symmetric uniformly elliptic operator given by

$A_{0}u\,(x):=\sum_{i,j=1}^{N}\partial_{i}(a_{ij}(x)\partial_{j}u)(x),\qquad
D(A_{0})=H^{2}(\Omega)\cap H^{1}_{0}(\Omega).$

The spectrum $\sigma(-A_{0})$ consists of eigenvalues with finite
multiplicities so that we can write

$0<\lambda_{1}\leq\lambda_{2}\leq\lambda_{3}<\cdots\rightarrow\infty.$

Let $\left\\{\varphi_{n}\right\\}_{n\in\mathbb{N}}$ be an orthonormal basis of
associated eigenfunctions in $L^{2}(\Omega)$. Then the spectral fractional
power $(-A_{0})^{s}$ is defined by

$(-A_{0})^{s}u=\sum_{n=1}^{\infty}\lambda_{n}^{s}\langle
u,\varphi_{n}\rangle_{L^{2}(\Omega)}\varphi_{n},$

with domain

$D((-A_{0})^{s})=\left\\{u\in
L^{2}(\Omega)\colon\sum_{n=1}^{\infty}\lambda_{n}^{2s}\langle
u,\varphi_{n}\rangle_{L^{2}(\Omega)}^{2}<\infty\right\\},$

endowed with the norm
$\|u\|_{D((-A_{0})^{s})}=\|(-A_{0})^{s}u\|_{L^{2}(\Omega)}$ for all $u\in
D((-A_{0})^{s})$. From the definition, it can be proved that the operator
$-(-A_{0})^{s}$ satisfies Assumption I. Hence, we have the following estimate.

######  Corollary 4.

Let $u_{0}\in\mathcal{I}_{R}$ and let $u(t,x)$ be the corresponding solution
to (32). Then there exists a constant $\theta\in(0,\frac{1}{2})$ such that

$\|u(0,\cdot)\|_{L^{2}(\Omega)}\leq
KR^{1-\theta}\sqrt{1+\frac{2\,T^{\alpha}}{\alpha\Gamma(\alpha)}}\|u(T,\cdot)\|_{L^{2}(\Omega)}^{\theta}.$

###  4.4. Fractional coupled diffusion systems

We consider the coupled system of diffusion equations with Dirichlet or
Neumann boundary conditions:

$\displaystyle{\small\begin{aligned}
&\partial_{t}^{\alpha}u_{1}(t,x)=A_{0}^{1}u_{1}(t,x)+\sum_{j=1}^{N}c_{1j}(x)u_{j}(t,x),&&\text{in
}(0,T)\times\Omega,\\\
&\partial_{t}^{\alpha}u_{2}(t,x)=A_{0}^{2}u_{2}(t,x)+\sum_{j=1}^{N}c_{2j}(x)u_{j}(t,x),&&\text{in
}(0,T)\times\Omega,\\\ &\cdots\\\
&\partial_{t}^{\alpha}u_{N}(t,x)=A_{0}^{N}u_{N}(t,x)+\sum_{j=1}^{N}c_{Nj}(x)u_{j}(t,x),&&\text{in
}(0,T)\times\Omega,\\\ &\begin{cases}u_{i}\rvert_{\partial\Omega}=0,&\text{on
}(0,T)\times\partial\Omega\;\text{ (Dirichlet case)},\hskip 2.84544pt1\leq
i\leq N,\text{ or}\\\ \partial_{\nu}^{A_{0}^{i}}u_{i}=0,&\text{on
}(0,T)\times\partial\Omega\;\,\text{ (Neumann case)},\;\,1\leq i\leq
N,\end{cases}\\\ &u_{i}(T,x)=u_{T}^{i}(x),\hskip 45.52458pt1\leq i\leq
N,&&\text{in }\Omega,\end{aligned}}$ (33)

where, for every $1\leq k\leq N$, $A_{0}^{k}$ is a symmetric uniformly
elliptic operator,

$A_{0}^{k}u:=\sum_{i,j=1}^{N}\partial_{i}(a_{ij}^{k}(x)\partial_{j}u),$

such that

$a_{ij}^{k}=a_{ji}^{k}\in C^{1}(\overline{\Omega}),\quad 1\leq i,j\leq
N,\qquad c_{ij}\in L^{\infty}(\Omega),\;c_{ij}(\cdot)=c_{ji}(\cdot),$

and there exists a constant constant $\kappa_{k}>0$ such that

$\sum_{i,j=1}^{N}a_{ij}^{k}(x)\xi_{i}\xi_{j}\geq\kappa_{k}\sum_{j=1}^{N}\xi_{j}^{2},\quad
x\in\overline{\Omega},\;(\xi_{1},...,\xi_{N})\in\mathbb{R}^{N}.$

Moreover, the domain of each operator $A_{0}^{k}$ is given by (29). The system
(33) can be written as

$\displaystyle\begin{aligned}
&\partial_{t}^{\alpha}\mathbf{u}(t)=\mathcal{A}_{0}\mathbf{u}(t)+\mathbf{C}\mathbf{u}(t),&&\qquad
t\in(0,T),\\\ &\mathbf{u}(T)=\mathbf{u}_{T},\end{aligned}$

where the state space is $H=L^{2}(\Omega;\mathbb{R}^{N})$,
$\mathbf{u}_{T}=(u_{T}^{i})_{1\leq i\leq N}$, $\mathbf{u}=(u_{i})_{1\leq i\leq
N}$, $\mathbf{C}(\cdot)=(c_{ij}(\cdot))_{1\leq i,j\leq N}\in
L^{\infty}(\Omega;\mathcal{L}(\mathbb{R}^{N}))$ and
$\mathcal{A}_{0}=\mathrm{diag}(A_{0}^{1},\cdots,A_{0}^{N})$.

We can directly prove that the operator
$\mathcal{A}=\mathcal{A}_{0}+\mathbf{C}$ satisfies Assumption I. Consequently,
we have

######  Corollary 5.

Let $\mathbf{u}_{0}\in\mathcal{I}_{R}$ and let $\mathbf{u}(t)$ be the
corresponding solution to (33). Then there exists a constant
$\theta\in(0,\frac{1}{2})$ such that

$\|\mathbf{u}(0)\|_{L^{2}(\Omega;\mathbb{R}^{N})}\leq
KR^{1-\theta}\sqrt{1+\frac{2\,T^{\alpha}}{\alpha\Gamma(\alpha)}}\|\mathbf{u}(T)\|_{L^{2}(\Omega;\mathbb{R}^{N})}^{\theta}.$

###  4.5. Fractional degenerate equations

Let $0\leq\beta<2$. We consider the fractional degenerate problem

$\begin{cases}\partial_{t}^{\alpha}u=\left(x^{\beta}u_{x}\right)_{x},&(t,x)\in(0,T)\times(0,1),\\\
u(t,1)=0,\qquad\begin{cases}u(t,0)=0,&\text{ if }\beta\in[0,1),\\\
\left(x^{\beta}u_{x}\right)(t,0)=0,&\text{ if }\beta\in[1,2),\end{cases}\\\
u(T,x)=u_{T}(x)&x\in(0,1).\end{cases}$ (34)

The state space is $H=L^{2}(0,1)$ and the governing operator is given by

$Au=\left(x^{\beta}u_{x}\right)_{x},$

with domain:
If $\beta\in[0,1)$ (weakly degenerate), then

$D(A)=\left\\{u\in H_{\beta,0}^{1}(0,1):x^{\beta}u_{x}\in
H^{1}(0,1)\right\\},$

where

$H_{\beta,0}^{1}(0,1)=\left\\{u\in L^{2}(0,1):u\in
AC([0,1]),x^{\frac{\beta}{2}}u_{x}\in L^{2}(0,1),u(0)=0,u(1)=0\right\\}.$

If $\beta\in[1,2)$ (strongly degenerate), then

$D(A)=\left\\{u\in H_{\beta,0}^{1}(0,1):x^{\beta}u_{x}\in
H^{1}(0,1)\right\\},$

where we changed the definition to

$H_{\beta,0}^{1}(0,1)=\left\\{u\in L^{2}(0,1):u\in
AC((0,1]),x^{\frac{\beta}{2}}u_{x}\in L^{2}(0,1),u(1)=0\text{ and
}x^{\beta}u_{x}\in H^{1}(0,1)\right\\}.$

$AC(I)$ denotes the space of absolutely continuous functions on the interval
$I$.

In both cases, the operator $A$ satisfies Assumption I, see, e.g., [6, 7] for
(i)-(ii) and [5, Appendix] for (iii). Consequently, we infer the following
corollary.

######  Corollary 6.

Let $u_{0}\in\mathcal{I}_{R}$ and let $u(t,x)$ be the corresponding solution
to (34). Then there exists a constant $\theta\in(0,\frac{1}{2})$ such that

$\|u(0,\cdot)\|_{L^{2}(0,1)}\leq
KR^{1-\theta}\sqrt{1+\frac{2\,T^{\alpha}}{\alpha\Gamma(\alpha)}}\|u(T,\cdot)\|_{L^{2}(0,1)}^{\theta}.$

###  4.6. Fractional dynamic boundary conditions

Let us set $\Gamma:=\partial\Omega$. We consider the backward parabolic system
with dynamic boundary conditions

$\displaystyle\begin{aligned} &\partial_{t}^{\alpha}u(t,x)=\Delta
u(t,x),&&\qquad\text{ in }(0,T)\times\Omega,\\\
&\partial_{t}^{\alpha}u_{\Gamma}(t,x)=\Delta_{\Gamma}u_{\Gamma}(t,x)-\partial_{\nu}u(t,x),&&\qquad\text{
on }(0,T)\times\Gamma,\\\ &u_{\Gamma}(t,x)=u_{|\Gamma}(t,x),&&\qquad\text{ on
}(0,T)\times\Gamma,\\\
&\left(u(T,\cdot),u_{\Gamma}(T,\cdot)\right)=\left(u_{T},u_{T,\Gamma}\right),&&\qquad\text{
on }\Omega\times\Gamma,\end{aligned}$ (35)

where $\Delta_{\Gamma}$ is the the Laplace-Beltrami operator on $\Gamma$. The
system (35) can be written in the state space
$\mathbb{L}^{2}:=L^{2}(\Omega)\times L^{2}(\Gamma)$ as:

$\left\\{\begin{array}[]{l}\partial_{t}^{\alpha}\mathbf{U}(t)=\mathbf{A}\mathbf{U}(t),\qquad
t\in(0,T),\\\ \mathbf{U}(T)=\mathbf{U}_{T},\end{array}\right.$

where $\mathbf{U}:=\left(u,u_{\Gamma}\right)$,
$\mathbf{U}_{T}:=\left(u_{T},u_{T,\Gamma}\right)$, and the linear operator
$\mathbf{A}:D(\mathbf{A})\subset\mathbb{L}^{2}\rightarrow\mathbb{L}^{2}$ is
given by

$\mathbf{A}=\left(\begin{array}[]{cc}\Delta&0\\\
-\partial_{\nu}&\Delta_{\Gamma}\end{array}\right),\qquad
D(\mathbf{A})=\mathbb{H}^{2}:=\\{(u,u_{\Gamma})\in H^{2}(\Omega)\times
H^{2}(\Gamma):u_{|\Gamma}=u_{\Gamma}\\}.$

In [16], it has been proven that $\mathbf{A}$ is self-adjoint and dissipative.
Since $\mathbb{H}^{2}\hookrightarrow H^{2}(\Omega)\times H^{2}(\Gamma)$ is
continuous, then $\mathbb{H}^{2}\hookrightarrow\mathbb{L}^{2}$ is compact. By
[9, Proposition 4.25], we deduce that $\mathbf{A}$ has compact resolvent.
Therefore, the operator $\mathbf{A}$ satisfies Assumption I.

######  Corollary 7.

Let $\mathbf{U}_{0}\in\mathcal{I}_{R}$ and let $\mathbf{U}(t)$ be the
corresponding solution to (35). Then there exists a constant
$\theta\in(0,\frac{1}{2})$ such that

$\|\mathbf{U}(0)\|_{\mathbb{L}^{2}}\leq
KR^{1-\theta}\sqrt{1+\frac{2\,T^{\alpha}}{\alpha\Gamma(\alpha)}}\|\mathbf{U}(T)\|_{\mathbb{L}^{2}}^{\theta}.$

## Acknowledgment

M. Yamamoto is supported by Grant-in-Aid for Scientific Research (A) 20H00117
and Grant-in-Aid for Challenging Research (Pioneering) 21K18142, JSPS.

## References

  * [1] E. E. Adams and L. W. Gelhar, Field study of dispersion in a heterogeneous aquifer 2, _Spatial moments analysis, Water Resources Res._ , 28 (1992) 3293–3307.
  * [2] S. Agmon and L. Nirenberg, Properties of solutions of ordinary differential equations in Banach space, _Comm. Pure Appl. Math._ , 16 (1963), 121–239.
  * [3] E. M. Ait Ben Hassi, S. E. Chorfi and L. Maniar, An inverse problem of radiative potentials and initial temperatures in parabolic equations with dynamic boundary conditions, _J. Inverse Ill-Posed Probl._ , 30 (2022), 363–378.
  * [4] E. M. Ait Ben Hassi, S. E. Chorfi and L. Maniar, Inverse problems for general parabolic systems and application to Ornstein-Uhlenbeck equation, arXiv: 2110.01321 (2022).
  * [5] F. Alabau-Boussouira, P. Cannarsa and G. Fragnelli, Carleman estimates for degenerate parabolic operators with applications to null controllability, _J. Evol. Equ._ , 6 (2006), 161–204.
  * [6] M. Campiti, G. Metafune and D. Pallara, Degenerate self-adjoint evolution equations on the unit interval, _Semigroup Forum_ , 57 (1998), 1–36.
  * [7] P. Cannarsa, P. Martinez and J. Vancostenoble, Null controllability of degenerate heat equations, _Adv. Differ. Equ._ , 10 (2005), 153–90
  * [8] J. Cheng and M. Yamamoto, One new strategy for a priori choice of regularizing parameters in Tikhonov’s regularization, _Inverse Probl._ , 16 (2000), L31–L38.
  * [9] K.-J. Engel and R. Nagel, _One-Parameter Semigroups for Linear Evolution Equations_ , Grad. Texts in Math., vol. 194, Springer, New York, 2000.
  * [10] G. Floridia, Z. Li and M. Yamamoto, Well-posedness for the backward problems in time for general time-fractional diffusion equation, _Atti Accad. Naz. Lincei Cl. Sci. Fis. Mat. Natur._ , 31 (2020), 593–610
  * [11] R. Gorenflo and F. Mainardi, Fractional calculus: Integral and differential equations of fractional order, in: A. Carpinteri, F. Mainardi (Eds.), Fractals and Fractional Calculus in Continuum Mechanics, Springer-Verlag, New York, 1997, 223–276.
  * [12] V. Isakov, _Inverse Problems for Partial Differential Equations_ , third edition, Springer, New York, 2017.
  * [13] S. G. Krein and O. I. Prozorovskaya, Analytic semigroups and incorrect problems for evolutionary equations, _Dokl. Akad. Nauk SSSR_ , 133 (1960), 277–280.
  * [14] J. Li, M. Yamamoto and J. Zou, Conditional stability and numerical reconstruction of initial temperature, _Commun. Pure Appl. Anal._ , 8 (2009), 361–382.
  * [15] J. J. Liu and M. Yamamoto, A backward problem for the time-fractional diffusion equation, _Appl. Anal._ , 89 (2010), 1769–1788.
  * [16] L. Maniar, M. Meyries and R. Schnaubelt, Null controllability for parabolic equations with dynamic boundary conditions, _Evol. Equat. and Cont. Theo._ , 6 (2017), 381–407.
  * [17] C. Martinez and M. Sanz, _The Theory of Fractional Powers of Operators_ , North-Holland Mathematics Studies, Elsevier Science, Amsterdam, 2001.
  * [18] C. P. Niculescu and L. -E. Persson, _Convex Functions and Their Applications_ , second edition, Springer, Cham Switzerland, 2018.
  * [19] K. B. Oldham and J. Spanier, _The Fractional Calculus: Theory and Applications of Differentiation and Integration to Arbitrary Order_ , Academic Press, New York, 1974.
  * [20] L. E. Payne, _Improperly Posed Problems in Partial Differential Equations_ , SIAM, Philadelphia, 1975.
  * [21] A. Pazy, _Semigroups of Linear Operators and Applications to Partial Differential Equations_ , Springer-Verlag, Berlin, 1983.
  * [22] I. Podlubny, _Fractional Differential Equations_ , Acad. Press, San Diego, 1999.
  * [23] H. Pollard, The complete monotonic character of the Mittag-Leffler function $E_{\alpha}(-x)$, _Bull. Amer. Math. Soc._ , 54 (1948), 1115–1116.
  * [24] K. Sakamoto and M. Yamamoto, Initial value/boundary value problems for fractional diffusion-wave equations and applications to some inverse problems, _J. Math. Anal. Appl._ , 382 (2011), 426–447.
  * [25] R. L. Schilling, R. Song and Z. Vondraček, _Bernstein Functions: Theory and Applications_ , Berlin, Boston: De Gruyter, 2012.
  * [26] W. R. Schneider, Completely monotone generalized Mittag-Leffler functions, _Expo. Math._ , 14 (1996), 3–16.
  * [27] N. H. Tuan, T. Caraballo, T. B. Ngoc and Y. Zhou, Existence and regularity results for terminal value problem for nonlinear fractional wave equations, _Nonlinearity_ , 34 (2021), 1448–1502.
  * [28] T. Wei and Y. Zhang, The backward problem for a time-fractional diffusion-wave equation in a bounded domain, _Computers & Mathematics with Applications_, 75 (2018), 3632–3648.
  * [29] D. V. Widder, _The Laplace Transforms_ , Princeton University Press, Princeton, 1946.
  * [30] M. Yamamoto and J. Zou, Simultaneous reconstruction of the initial temperature and heat radiative coefficient, _Inverse Problems_ , 17 (2001), 1181–1202.