#  Transferable Learned Image Compression-Resistant Adversarial Perturbations

Yang Sui1 Zhuohang Li2 Ding Ding3 Xiang Pan3
Xiaozhong Xu3 Shan Liu3 Zhenzhong Chen4
1Rutgers University 2Vanderbilt University 3Tencent America 4Wuhan University
<EMAIL_ADDRESS>The work of Yang Sui was done during the internship at
Tencent America.The work of Zhuohang Li was done during the visit at Tencent
America.The work of Zhenzhong Chen was done during the visit at Tencent.

###### Abstract

Adversarial attacks can readily disrupt the image classification system,
revealing the vulnerability of DNN-based recognition tasks. While existing
adversarial perturbations are primarily applied to uncompressed images or
compressed images by the traditional image compression method, i.e., JPEG,
limited studies have investigated the robustness of models for image
classification in the context of DNN-based image compression. With the rapid
evolution of advanced image compression, DNN-based learned image compression
has emerged as the promising approach for transmitting images in many
security-critical applications, such as cloud-based face recognition and
autonomous driving, due to its superior performance over traditional
compression. Therefore, there is a pressing need to fully investigate the
robustness of a classification system post-processed by learned image
compression. To bridge this research gap, we explore the adversarial attack on
a new pipeline that targets image classification models that utilize learned
image compressors as pre-processing modules. Furthermore, to enhance the
transferability of perturbations across various quality levels and
architectures of learned image compression models, we introduce a saliency
score-based sampling method to enable the fast generation of transferable
perturbation. Extensive experiments with popular attack methods demonstrate
the enhanced transferability of our proposed method when attacking images that
have been post-processed with different learned image compression models.

##  1 Introduction

Deep Neural Network(DNN)-based models are known to be vulnerable against
adversarial examples [1], which are carefully perturbed images that are
unsuspicious to human eyes but can cause deep learning models to produce
incorrect or malicious predictions. Although this phenomenon was initially
discovered on image classification models [1], research on adversarial
examples has since then quickly spread to many critical domains in computer
vision, such as facial recognition [2], and object detection [3]. Initial
studies [1, 3] typically assume a white-box access to the target model. Later,
black-box attacks [4] are also developed where the details of the target model
are unknown to the adversary.

Existing works predominantly study adversarial examples in the context of
uncompressed images. However, when deployed to real-world systems, including
cloud-based image analysis services and edge image recognition systems (e.g.,
object recognition for autonomous driving and face recognition for security
services), in order to save communication bandwidth or computation cost,
typically images are first compressed using some compression algorithms before
being fed into the classification system to get predictions. In light of this
scenario, a branch of studies [5, 6, 7] has investigated JPEG-compression-
resistant adversarial attacks.

Recently, Learned Image Compression (LIC) has rapidly become the primary
method for transmitting images under bit-rate constraints due to its superior
performance. Specifically, LIC frameworks [8, 9, 10] have recently evolved,
showing substantial rate-distortion performance improvement over standard
image compression [11] such as JPEG[12], JPEG2000[13], and BPG[14], owing to
the remarkable representation ability of DNNs. The fundamental structure of
LIC is the auto-encoder framework with entropy minimization constraints, which
employs the DNN-based encoder and decoder for image compression and
reconstruction.

LIC has been quickly adopted in many application scenarios as a pre-processing
module for various image classification tasks and has also been proposed in
ISO/IEC JTC 1/SC29/WG1 M93073 in the 93rd JPEG-AI Meeting. Despite its wide
deployment, the robustness of the LIC-powered image recognition pipeline
remains under-explored. To fill this research gap, in this paper, we aim to
investigate the robustness of Learned Image Compression Classification System
(LICCS) by launching specialized adversarial attacks that are optimized for
this pipeline. Further, in the LICCS, to-be-classified compressed images have
unknown compression quality levels determined by LIC. Therefore, exploring the
robustness across all quality levels presents a unique challenge. Overall, the
goal of our investigation is to answer the following research questions:

  * •

How robust are the LICCSs against adversarial perturbations?

  * •

How transferable are adversarial perturbations across various quality levels
under the same/different LIC model architectures?

To address these questions, we conduct a series of empirical investigations on
a typical LICCS pipeline, which is illustrated in Fig. 1. To evaluate the
robustness of the LICCS, we first consider a white-box scenario where the
attacker has the ability to access the details of models. Next, to evaluate
how the attack can be generalized in the black-box scenario, we measure the
transferability of perturbations across various unknown quality levels under
the same LIC model architecture. We find through our experiments that the
LICCS framework is naturally, to some extent, resilient to transferable
attacks, as the attack performance shows significant disparities across
different quality levels. To improve the transferability across the quality
levels, we propose a saliency score-based sampling method that performs
ensemble attacks on the most influential quality levels of LIC models, which
show the highest adversarial impact on the LICCS across all quality levels.
Specifically, we measure the collective coverage of affected curves of all
combinations of surrogate models to calculate the saliency score. Based on
these scores, we select the highest influential combination consisting of
top-$K$ quality levels, which are further utilized to launch attacks to
generalize to all quality levels. Our contributions can be summarized as
follows: (1) We investigate an adversarial attack pipeline for the LICCS,
utilizing LICs as pre-processing modules for the image classification model.
To the best of our knowledge, we are the first work to investigate the
robustness of LICCS. (2) To measure the robustness of LICCS and the
transferability of its adversarial perturbations, we conduct a series of
experiments in white-box and black-box scenarios. Based on the black-box
results, we observed that the neighboring quality levels are more
significantly affected when attacking a certain quality level. (3) To improve
the transferability of the attack across different quality levels and
architectures, we propose a saliency score-based sampling method that enables
generating transferable perturbations with limited model access. (4) To
improve the transferability of the attack across different quality levels and
architectures, we propose a saliency score-based sampling method that enables
generating transferable perturbations with limited model access.

##  2 Transferable Attack against LICCS

Figure 1: Our proposed adversarial attack pipeline against the LICCS. Left:
The framework of the LIC (described in Section 2.1); Middle: LICCS pipeline.
Both the original image and the reconstructed image are classified with the
correct label “Cat”; Right: After the adversarial attacks, although the
adversarial examples are classified with the correct label, its reconstructed
image through the LIC is misrecognized as the wrong label “Dog”.

###  2.1 Learned Image Compression

As illustrated in Fig. 1 (left), the input image is converted into a latent
representation via a non-linear transformation. The latents are then encoded
by an arithmetic encoder to produce the bit stream for storage. To reconstruct
the image, the bit stream is decoded by an arithmetic decoder and fed into the
main DNN-based decoder to generate a reconstructed image. Specifically,
suppose $g_{a}(\cdot)$, $g_{s}(\cdot)$ are the non-linear transforms. Let
$\boldsymbol{\mathcal{\mathcal{X}}}$ and
$\boldsymbol{\mathcal{\mathcal{\hat{X}}}}$ denote the original input and
reconstructed images, respectively. Let $\boldsymbol{\mathcal{\mathcal{Y}}}$
and $\boldsymbol{\mathcal{\mathcal{\hat{Y}}}}$ denote the pre-quantized and
quantized latent representation, respectively, then the deep learning-based
image compression can be described as:

$\displaystyle\boldsymbol{\mathcal{\mathcal{Y}}}$
$\displaystyle=g_{a}(\boldsymbol{\mathcal{\mathcal{X}}}),$ (1)
$\displaystyle\quad\boldsymbol{\mathcal{\mathcal{\hat{Y}}}}$
$\displaystyle=\text{AD}(\text{AE}(Q(\boldsymbol{\mathcal{\mathcal{Y}}}))),$
$\displaystyle\quad\boldsymbol{\mathcal{\mathcal{\hat{X}}}}$
$\displaystyle=g_{s}(\boldsymbol{\mathcal{\mathcal{\hat{Y}}}}),$

where $Q(\cdot)$ is the quantization process. AE and AD denote the arithmetic
encoding and decoding processes, respectively.
$\boldsymbol{\mathcal{\mathcal{\hat{X}}}}$ represents the reconstructed image.
To reduce the bit rate, a hyper-prior is used as side information to estimate
the mean and scale parameters of latents predicted from the entropy model,
including a hyper encoder and hyper decoder. Furthermore, an auto-regressive
context model is integrated into the hyper-prior framework to boost the R-D
performance. Since we aim to explore the LICCS, which prioritizes the
reconstructed image over the bit-rate. Therefore, we omit the hyper-prior and
context model for simplicity.

###  2.2 LICCS Attack

Fig. 1 (right) illustrates the attack pipeline for generating adversarial
examples in conjunction with or without the LIC. Let
$\boldsymbol{\mathcal{\mathcal{X}}}$, $y$ denote the image and ground-truth
label. Given a classification model $f(\cdot)_{i}$ predicts the probability of
the image belonging to class $i$, adversarial attacks aim to generate an
adversarial perturbation $\boldsymbol{\mathcal{\mathcal{\delta}}}$ embedded on
$\boldsymbol{\mathcal{\mathcal{X}}}$ so that the new adversarial image can
misclassify the classification model $f(\cdot)_{i}$. It can be formulated as:

$\displaystyle\operatorname*{arg\,max}\limits_{i}f(\boldsymbol{\mathcal{\mathcal{X}}}+\boldsymbol{\mathcal{\mathcal{\delta}}})_{i}\neq
y,\quad\textrm{s.t.}\enspace\|\boldsymbol{\mathcal{\mathcal{\delta}}}\|_{p}\leq\epsilon,$
(2)

where $\epsilon$ denotes the perturbation budget to ensure the induced
distortion is imperceptible.

Unlike prior works that focus on the adversarial attack toward reconstruction
image quality of LIC [15, 16], in this paper, we primarily investigate the
robustness of a LIC-based classification system. To perform an adversarial
attack on an image within the LICCS as illustrated in Fig. 1 (right), the goal
is to introduce the adversarial perturbation
$\boldsymbol{\mathcal{\mathcal{\delta}}}$ to the source image
$\boldsymbol{\mathcal{\mathcal{X}}}$ that causes the reconstructed adversarial
examples
$g_{s}(Q(g_{a}(\boldsymbol{\mathcal{\mathcal{X}}}+\boldsymbol{\mathcal{\mathcal{\delta}}})))$
to be misclassified by the classification model. Then, Eq. 2 is extended as
follows:

$\displaystyle\operatorname*{arg\,max}\limits_{i}f(g_{s}(Q(g_{a}(\boldsymbol{\mathcal{\mathcal{X}}}+\boldsymbol{\mathcal{\mathcal{\delta}}}))))_{i}\neq
y,\quad\textrm{s.t.}\enspace\|\boldsymbol{\mathcal{\mathcal{\delta}}}\|_{p}\leq\epsilon.$
(3)

###  2.3 White-box Attacks Evaluation

To evaluate the robustness of the LICCS, we first perform the white-box
attacks by solving Eq. 3. The detailed results of Top-1 accuracy of LICCS
(cheng2020 [9] LIC model and ResNet-20 classification model) attacked by the
PGD attack [17] on the CIFAR-10 dataset is shown in Table 4 of Section 3.
Given a pre-trained classification model with 91.25 $\%$ top-1 accuracy on the
CIFAR-10 dataset in LICCS, when generating adversarial examples with
$\epsilon=16$, the accuracy of LICCS decreases to 18.75$\%$ and 5.53$\%$ in
quality levels 1 and 6, demonstrating considerable vulnerability to attacks.
Hence, we conclude the LICCS is vulnerable to white-box attacks, mainly
contributing to the inherent DNN-based classification model.

###  2.4 Transferability from Black-box Attacks

Next, we explore the robustness of the LICCS with black-box attacks and its
transferability. The concept of “quality levels” of LIC distinguishes LICCS
from the traditional classification model, introducing unknown images to
attackers and increasing the challenge of black-box attacks. Consequently, we
aim to explore this unique feature by launching black-box attacks across
different quality levels to evaluate the transferability between them. Table 2
demonstrates the top-1 accuracy of LICCS after the PGD attack [17] on
cheng2020 [9] and ResNet-20 on the CIFAR-10 dataset with different quality
levels. The number at the beginning of the row and column denotes the quality
level of the surrogate model and target model, respectively. Here, the
surrogate model refers to a well-trained LIC model whose quality levels,
parameters, and architecture are known to the attacker. In contrast, such
information about the target models remains unknown. The experimental setup
details are illustrated in Section 3.

Table 1: Top-1 accuracy of PGD black-box attack results of cheng2020 [9]
model. Each row/column corresponds to a surrogate/target model with a given
quality level.

Quality | 1 | 2 | 3 | 4 | 5 | 6
---|---|---|---|---|---|---
$\epsilon=4$, $\alpha=1$, $iters=10$
1 | 35.59% | 57.54% | 68.61% | 79.25% | 84.50% | 87.19%
2 | 43.71% | 37.86% | 58.07% | 76.14% | 83.01% | 85.65%
3 | 45.85% | 46.15% | 35.82% | 69.49% | 79.02% | 83.00%
4 | 48.72% | 56.92% | 58.16% | 37.28% | 53.77% | 66.30%
5 | 49.22% | 59.32% | 62.38% | 47.77% | 34.83% | 41.01%
6 | 49.55% | 60.20% | 65.07% | 57.97% | 39.10% | 32.53%

Figure 2: ASR of PGD black-box attack results on quality level 1 to 6 of
cheng2020 [9] model with $\epsilon=16$, $\alpha=2$, $iters=20$.

As demonstrated in Table 2, the attack fails to achieve effective
transferability across different quality levels. More detailed results are
shown in Fig. 4. For instance, the top-1 accuracy of the target model with the
quality level 6 remains robust at 87.19$\%$, indicating a highly restricted
transferability from quality level 1 to 6. Such a significant discrepancy
concludes that it is challenging for naive black-box attack to defeat LICCS
without improving transferability. Consequently, as a LICCS attacker, we
strive to design an attack strategy with improved transferability.

###  2.5 Observation

As pointed out by several studies a natural way of improving the
transferability of adversarial examples is by attacking an ensemble of models,
which diversifies the surrogate models and helps to capture better the
intrinsic adversarial vulnerability of the target model [18, 19]. A range of
LIC models with varying quality levels could potentially be utilized as
components of ensemble models. However, in LIC, the quality level is
controlled through a hyper-parameter which can take arbitrary real values; yet
it is infeasible to incorporate an infinite number of such models to cover all
possible values due to memory and computational constraints.

To analyze the influence of the adversarial examples on each quality level, we
conduct the black-box attack shown in Fig. 2. Findings from the figure and
Table 2 reveal that $\texttt{ASR}(i,q)\propto 1/\texttt{Distance(i, q)}$,
where $\texttt{ASR}(i,q)=100\%-\texttt{Acc}(i,q)$ denotes the ASR (Attack
Success Rate) when attacking the surrogate quality level $i$ and evaluate on
target quality level $q$. In other words, when a specific quality level is
attacked, the adjacent quality levels tend to experience more substantial
impact, whereas the impact diminishes for quality levels that are more
distant.

The observations indicate that each quality level possesses its unique sphere
of influence. This implies that even if selecting the most influential model,
attacking a single quality level can only affect its near vicinity and has
less effect on others that are further away. Hence, it becomes crucial to
identify the optimal combination of multiple quality levels rather than
repeatedly attacking the individuals with the most influence.

###  2.6 Saliency Score-based Sampling

Building upon the observations outlined in Section 2.5, we propose a method to
improve the transferability of attacks across all quality levels. We first
sample $\lambda_{1,2,\cdots,N}$ (the coefficient to control the rate-
distortion trade-off) and train corresponding $N$ surrogate models with
diverse quality levels differently. To ensure the exact black-box attack
process, the $\lambda$ of training surrogate models are independent of those
used in target models. Subsequently, we calculate the black-box ASR of the
surrogate models and derive the
$\texttt{ASR}(q_{1},q_{2}),q_{1},q_{2}\in[1,N]$, to analyze the influence of
each pair of quality level. Since the potential target models in real-world
scenarios have an infinite range of quality levels, we strive to accurately
depict the influence at each potential real number of quality levels. To
achieve this, we convert the discrete ASR points into a continuous polynomial
ASR curve with a polynomial fitting function $\texttt{polyn}(\cdot)$. This
representation captures the ASR values across a continuous spectrum of quality
levels rather than only at $N$ discrete quality levels.

To identify the optimal combination of quality levels, we introduce the
coverage function, defined as $\max(A,B)$, which quantifies the collective
coverage of curve $A$ and $B$. Then, we employ an accumulated integral
function to calculate the saliency score for each combination of $K$ quality
levels. The saliency score represents the degree to which the combination
maximizes the coverage area, thereby representing the potential influence on
ASR across all quality levels. Given the desired number of ensemble models
$K$, where $K<N$, the formulation of the saliency score is as follows:

$\displaystyle
S(\boldsymbol{q})=\int_{x_{min}}^{x_{max}}\max(\texttt{polyn}(q_{0}),\texttt{polyn}(q_{1}),\cdots,\texttt{polyn}(q_{K}))\enspace
dx$ (4)

where $\boldsymbol{q}=[q_{0},q_{1},\cdots,q_{K}]$ represents the combination
of $K$ quality levels. $x_{min}$ and $x_{max}$ are the lowest and highest
quality level of surrogate models.

After calculation, we select the largest $S$ among total $\tbinom{N}{K}$
values, corresponding to the combination of $K$ quality levels that cause the
most substantial impact across the entire range of quality levels within the
surrogate models.

$\displaystyle\operatorname*{arg\,max}\limits_{i}\sum_{q=q^{*}_{0}}^{q^{*}_{K}}f({g_{s}}_{q}(Q({g_{a}}_{q}(\boldsymbol{\mathcal{\mathcal{X}}}+\boldsymbol{\mathcal{\mathcal{\delta}}}))))_{i}\neq
y,\quad\textrm{s.t.}\enspace\|\boldsymbol{\mathcal{\mathcal{\delta}}}\|_{p}\leq\epsilon,$
(5)

where $q^{*}$ is from the optimal combination of quality levels corresponding
to the largest $S$. A smaller value of $K$ indicates that we use fewer
surrogate models to generate the transferable adversarial perturbations,
thereby improving efficiency.

##  3 Experiments

Setting. We adopt PGD [17] and FGSM [20] attack methods with cheng2020 [9] and
hyper [8] LIC models to evaluate the effectiveness of transferability across
quality levels and different architectures. In this paper, we use the
differential approximation quantization from [5] to execute the gradient-based
attack. We fix the classification model as ResNet-20. The evaluations are
conducted on the CIFAR-10 dataset.

Metric. The attack performance is evaluated based on the top-1 accuracy of the
victim LICCS. The lower accuracy of the victim model indicates better attack
performance. We also measure the adversarial perturbations generation time
(average of 100 times) per image.

Hyperparameter. For the white-box attack in Table 4, we set perturbation
budget $\epsilon\in\\{1,2,4,8,16\\}$, learning step $\alpha\in\\{1,2\\}$, and
iterations $T\in\\{10,20\\}$. For the black-box attack in Table 2, experiments
are conducted with $\epsilon\in\\{4,8\\}$, $\alpha\in\\{1,2\\}$,
$T\in\\{10,20\\}$. For the Table 2, 3, and 2, experiments are conducted with
$\epsilon\in\\{4,8,16\\}$, $\alpha\in\\{1,2\\}$. All $\epsilon$ and $\alpha$
are divided by 255 to match the normalized image. The coefficients of the
rate-distortion trade-off of surrogate models, $\lambda$, are randomly sampled
to control the quality levels independent of those in target models. Surrogate
models with $\lambda$ are fully trained following the setting of [21].

Table 2: Top-1 accuracy of LICCS with the surrogate model cheng2020 and target
model cheng2020 attacked by PGD. Lower accuracy demonstrates higher
transferability.

Quality | 1 | 2 | 3 | 4 | 5 | 6 | Average | Time
---|---|---|---|---|---|---|---|---
$\epsilon=4$, $\alpha=1$, $iters=10$
R-En | 44.32% | 51.10% | 54.95% | 56.16% | 55.10% | 58.02% | 53.28% | 1.1s
Ours | 47.86% | 54.46% | 51.41% | 47.36% | 39.26% | 40.53% | 46.81% | 1.1s
$\epsilon=8$, $\alpha=2$, $iters=10$
R-En | 39.83% | 43.34% | 45.42% | 43.20% | 43.23% | 46.59% | 43.60% | 1.1s
Ours | 45.52% | 47.25% | 42.14% | 31.26% | 25.01% | 25.33% | 36.09% | 1.1s
$\epsilon=16$, $\alpha=2$, $iters=10$
R-En | 35.68% | 37.15% | 37.87% | 35.76% | 37.86% | 40.92% | 37.54% | 1.1s
Ours | 43.31% | 41.18% | 34.46% | 22.64% | 20.24% | 20.39% | 30.37% | 1.1s

Table 3: Top-1 accuracy of LICCS with the surrogate model hyper and target
model hyper attacked by FGSM. Lower accuracy demonstrates higher
transferability.

Quality | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | Average | Time
---|---|---|---|---|---|---|---|---|---|---
$\epsilon=4$, $iters=1$
R-En | 42.97% | 56.03% | 62.81% | 67.65% | 71.92% | 77.36% | 80.69% | 83.10% | 67.82% | 0.15s
Ours | 44.69% | 56.79% | 61.32% | 59.82% | 61.75% | 62.21% | 67.06% | 69.58% | 60.28% | 0.15s
$\epsilon=8$, $iters=1$
R-En | 43.44% | 53.26% | 54.35% | 56.24% | 62.37% | 70.22% | 72.43% | 72.44% | 59.57% | 0.15s
Ours | 41.93% | 47.81% | 47.24% | 47.89% | 52.42% | 55.49% | 57.37% | 57.38% | 50.94% | 0.15s

Transferablity across quality levels. We initially evaluate the performance of
our method by applying the PGD on the surrogate model cheng2020 to generate
adversarial perturbations. To evaluate the transferability across quality
levels, we utilize these perturbations to disrupt a target model of unknown
quality levels. The baseline method, termed “R-En”, involves randomly
selecting $K$ surrogate models to conduct the ensemble attacks. To ensure
consistency, we set $K=2$ for both R-En and our proposed method. To mitigate
the variance arising from the randomness, we calculate the average of 20
experiment results for the R-En method. As demonstrated in Table 2, compared
to R-En, our method improves the average ASR by 6.46$\%$, 7.51$\%$, 7.17$\%$
with $\epsilon=4,\epsilon=8,\epsilon=16$, while maintaining the same
perturbation generation time. We further measure our approach using the FGSM
attack on the hyper model to assess the improved transferability. According to
Table 3, compared to R-En, our method enhances the average ASR by 7.54$\%$ and
8.63$\%$ with $\epsilon=4$ and $\epsilon=8$, respectively.

Transferablity across different architectures. To evaluate the transferability
across various architectures, we apply adversarial perturbations generated
from cheng2020 to disrupt an unseen target model hyper. As illustrated in Fig.
3, compared to R-En, our method can improve the average ASR by 7.57$\%$,
6.53$\%$, and 8.23$\%$ with $\epsilon=4$, $\epsilon=8$, and $\epsilon=16$,
respectively.

Figure 3: Top-1 accuracy of LICCS with the surrogate model cheng2020 and
target model hyper attacked by PGD. Lower accuracy demonstrates higher
transferability. Table 4: Top-1 accuracy of LICCS after PGD white-box attack
on quality level 1 to 6 of cheng2020 [9] model. “w/o LIC” and “w/ LIC” mean
the generated adversarial examples are fed into the ResNet-20 without LIC
module and standard LICCS (ResNet-20 with LIC module), respectively.

Quality Level |  $\epsilon=1$ |  $\epsilon=2$ |  $\epsilon=4$ |  $\epsilon=8$ |  $\epsilon=8$ |  $\epsilon=16$ |  $\epsilon=16$
---|---|---|---|---|---|---|---
$\alpha=1$ |  $\alpha=1$ |  $\alpha=1$ |  $\alpha=2$ |  $\alpha=2$ |  $\alpha=2$ |  $\alpha=2$
$T=10$ |  $T=10$ |  $T=10$ |  $T=10$ |  $T=20$ |  $T=10$ |  $T=20$
w/o LIC
1 |  92.45% |  92.26% |  91.75% |  90.22% |  89.58% |  87.20% |  84.9%
2 |  92.29% |  92.02% |  91.22% |  89.01% |  88.66% |  85.81% |  83.5%
3 |  91.93% |  91.57% |  90.34% |  87.18% |  87.17% |  83.22% |  80.17%
4 |  91.35% |  90.36% |  87.73% |  80.09% |  80.57% |  73.96% |  68.80%
5 |  90.43% |  88.23% |  83.16% |  72.11% |  71.27% |  63.13% |  55.24%
6 |  89.41% |  86.05% |  78.01% |  63.96% |  62.80% |  54.57% |  46.42%
w/ LIC
1 |  45.17% |  41.19% |  35.59% |  28.45% |  26.69% |  22.7% |  18.75%
2 |  53.05% |  45.6% |  37.86% |  28.72% |  25.75% |  23.12% |  17.07%
3 |  54.33% |  44.47% |  35.82% |  25.35% |  20.92% |  20.41% |  13.73%
4 |  57.24% |  45.76% |  37.28% |  25.89% |  19.31% |  21.75% |  12.20%
5 |  54.17% |  42.24% |  34.83% |  23.06% |  14.17% |  19.46% |  8.16%
6 |  50.51% |  39.25% |  32.53% |  19.08% |  9.95% |  16.12% |  5.53%

Detailed results of white-box attack. We provide detailed results for the
white-box attack. As depicted in Table 4, we initially conducted the
experiments on LICCS for quality levels ranging from 1 to 6. After attacking,
LICCS can only achieve less than 50$\%$ top-1 accuracy in most cases. Further,
we also perform experiments to evaluate the performance when employing these
adversarial examples on the classification model without the LIC component.
Interestingly, omitting the LIC module seems to provide some defense against
these adversarial examples. For instance, when an attack is launched on LICCS
with $\epsilon=16,T=20$, the LICCS can only achieve 5.53$\%$ top-1 accuracy
for quality level 6. In contrast, without the LIC module, $46.42\%$ of these
adversarial examples can be classified correctly.

Figure 4: Top-1 accuracy of LICCS after PGD black-box attack of cheng2020 [9]
model. Each row/column corresponds to a surrogate/target model with a given
quality level.

Detailed results of black-box attack. We here provide detailed black-box
attacks across different quality levels to evaluate the transferability across
quality levels in Fig. 4 as the complementary of Table 2. Each grid value
represents the top-1 accuracy of the target model post-attack, using a
surrogate model in a black-box setting. The experiments, as seen in Fig. 4 and
conducted with diverse parameters of $\epsilon,\alpha,T$, indicate varying
performance when there’s a mismatch or slight similarity between the surrogate
and target quality levels. This underscores the limited transferability of
traditional black-box attacks on LICCS across different quality levels without
our method.

##  4 Conclusion

In this paper, we introduce an adversarial attack pipeline specifically
designed for the LICCS and conduct a range of experiments in both white-box
and black-box settings. Based on findings from the black-box experiments, we
propose a saliency score-based sampling approach that allows for generating
transferable perturbations even with limited model access and enhances
transferability. We conducted further experiments with our methods on PGD and
FGSM methods on various LIC models with multiple quality levels. The results
demonstrate that our proposed method effectively enhances the transferability
of adversarial perturbations across different quality levels and
architectures.

##  5 References

## References

  * [1] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus,  “Intriguing properties of neural networks,”  in Proceedings of the International Conference on Learning Representations, 2014.
  * [2] Yinpeng Dong, Hang Su, Baoyuan Wu, Zhifeng Li, Wei Liu, Tong Zhang, and Jun Zhu,  “Efficient decision-based black-box adversarial attacks on face recognition,”  in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2019, pp. 7714–7722.
  * [3] Cihang Xie, Jianyu Wang, Zhishuai Zhang, Yuyin Zhou, Lingxi Xie, and Alan Yuille,  “Adversarial examples for semantic segmentation and object detection,”  in Proceedings of the IEEE international conference on computer vision, 2017, pp. 1369–1378.
  * [4] Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin,  “Black-box adversarial attacks with limited queries and information,”  in International conference on machine learning. PMLR, 2018, pp. 2137–2146.
  * [5] Richard Shin and Dawn Song,  “Jpeg-resistant adversarial images,”  in NIPS 2017 Workshop on Machine Learning and Computer Security, 2017, vol. 1, p. 8.
  * [6] Zhibo Wang, Hengchang Guo, Zhifei Zhang, Mengkai Song, Siyan Zheng, Qian Wang, and Ben Niu,  “Towards compression-resistant privacy-preserving photo sharing on social networks,”  in Proceedings of the Twenty-First International Symposium on Theory, Algorithmic Foundations, and Protocol Design for Mobile Networks and Mobile Computing, 2020, pp. 81–90.
  * [7] Wen Zhou, Xin Hou, Yongjun Chen, Mengyun Tang, Xiangqi Huang, Xiang Gan, and Yong Yang,  “Transferable adversarial perturbations,”  in Proceedings of the European Conference on Computer Vision (ECCV), 2018, pp. 452–467.
  * [8] Johannes Ballé, David Minnen, Saurabh Singh, Sung Jin Hwang, and Nick Johnston,  “Variational image compression with a scale hyperprior,”  in International Conference on Learning Representations, 2018.
  * [9] Zhengxue Cheng, Heming Sun, Masaru Takeuchi, and Jiro Katto,  “Learned image compression with discretized gaussian mixture likelihoods and attention modules,”  in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2020, pp. 7939–7948.
  * [10] Yang Sui, Ding Ding, Xiang Pan, Xiaozhong Xu, Shan Liu, Bo Yuan, and Zhenzhong Chen,  “Corner-to-center long-range context model for efficient learned image compression,”  Journal of Visual Communication and Image Representation, vol. 98, pp. 103990, 2024.
  * [11] Benjamin Bross, Ye-Kui Wang, Yan Ye, Shan Liu, Jianle Chen, Gary J Sullivan, and Jens-Rainer Ohm,  “Overview of the versatile video coding (vvc) standard and its applications,”  IEEE Transactions on Circuits and Systems for Video Technology, vol. 31, no. 10, pp. 3736–3764, 2021.
  * [12] Gregory K Wallace,  “The jpeg still picture compression standard,”  Communications of the ACM, vol. 34, no. 4, pp. 30–44, 1991.
  * [13] David S Taubman and Michael W Marcellin,  “Jpeg2000: Image compression fundamentals,”  Standards and Practice, vol. 11, no. 2, 2002.
  * [14] Fabrice Bellard,  “Bpg image format (2014),”  Volume, vol. 1, pp. 2, 2016.
  * [15] Yang Sui, Zhuohang Li, Ding Ding, Xiang Pan, Xiaozhong Xu, Shan Liu, and Zhenzhong Chen,  “Reconstruction distortion of learned image compression with imperceptible perturbations,”  in ICML 2023 Workshop Neural Compression: From Information Theory to Applications, 2023.
  * [16] Tong Chen and Zhan Ma,  “Towards robust neural image compression: Adversarial attack and model finetuning,”  IEEE Transactions on Circuits and Systems for Video Technology, 2023.
  * [17] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu,  “Towards deep learning models resistant to adversarial attacks,”  in International Conference on Learning Representations, 2018.
  * [18] Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick McDaniel,  “Ensemble adversarial training: Attacks and defenses,”  in International Conference on Learning Representations, 2018.
  * [19] Ambra Demontis, Marco Melis, Maura Pintor, Matthew Jagielski, Battista Biggio, Alina Oprea, Cristina Nita-Rotaru, and Fabio Roli,  “Why do adversarial attacks transfer? explaining transferability of evasion and poisoning attacks,”  in 28th USENIX security symposium (USENIX security 19), 2019, pp. 321–338.
  * [20] Ian Goodfellow, Jonathon Shlens, and Christian Szegedy,  “Explaining and harnessing adversarial examples,”  in International Conference on Learning Representations, 2015.
  * [21] Jean Bégaint, Fabien Racapé, Simon Feltman, and Akshay Pushparaja,  “Compressai: a pytorch library and evaluation platform for end-to-end compression research,”  arXiv preprint arXiv:2011.03029, 2020.


# Digital Twin-Empowered Smart Attack Detection System for 6G Edge of Things
Networks

Yagmur Yigit 12, Christos Chrysoulas 1, Gokhan Yurdakul 3, Leandros Maglaras
1, and Berk Canberk 1  1 School of Computing, Engineering and The Build
Environment, Edinburgh Napier University, United Kingdom
2 Department of Computer Engineering, Istanbul Technical University, Turkey
3 BTS Group, Turkey
Email: {Y.Yigit, C.Chrysoulas, L.Maglaras<EMAIL_ADDRESS>
<EMAIL_ADDRESS><EMAIL_ADDRESS>
###### Abstract

As global Internet of Things (IoT) devices connectivity surges, a significant
portion gravitates towards the Edge of Things (EoT) network. This shift
prompts businesses to deploy infrastructure closer to end-users, enhancing
accessibility. However, the growing EoT network expands the attack surface,
necessitating robust and proactive security measures. Traditional solutions
fall short against dynamic EoT threats, highlighting the need for proactive
and intelligent systems. We introduce a digital twin-empowered smart attack
detection system for 6G EoT networks. Leveraging digital twin and edge
computing, it monitors and simulates physical assets in real time, enhancing
security. An online learning module in the proposed system optimizes the
network performance. Our system excels in proactive threat detection, ensuring
6G EoT network security. The performance evaluations demonstrate its
effectiveness, robustness, and adaptability using real datasets.

###### Index Terms:

Internet of Things (IoT), Edge of Things (EoT), 6G, Digital Twins (DT),
Cybersecurity.

##  I Introduction

The rapid proliferation of the Internet of Things (IoT) is reshaping the
global technological landscape. By 2030, the number of IoT devices is
predicted to nearly double, reaching over 29.4 billion [1]. A significant
portion of these devices will be interconnected at the edge, forming what is
known as the Edge of Things (EoT) network. In this new era, businesses are
transitioning to edge deployments, moving closer to end-users and away from
traditional data centres. The EoT network encompasses a distributed computing
paradigm, where data processing, storage, and analysis occur closer to the
data sources, reducing latency and enhancing real-time responsiveness. This
meteoric rise is mirrored by the rapid proliferation of devices connected to
the edge, significantly increasing the edge network’s workload. As more
devices and systems connect to the EoT network, the attack surface for hackers
expands, providing them with increased opportunities to exploit
vulnerabilities and gain unauthorized access to critical systems.

Edge computing is a rapidly growing market, projected to reach USD 3,605.58
billion by 2032 [2]. The global cost of cybercrime is expected to rise by
69.94 per cent by 2028, reaching an alarming figure of USD 13.82 trillion [3].
These figures underscore the importance of edge-based detection. Cyber threats
to EoT networks can lead to data breaches, service disruptions, and even
physical harm. Traditional security solutions may be insufficient, emphasizing
the need for intelligent and adaptive systems capable of proactive threat
detection.

Digital Twin (DT) technology is promising for bolstering security in 6G EoT
networks. It enables real-time monitoring and simulation of physical assets,
predicting potential security issues or vulnerabilities [4]. Deploying DT
processing at the edge allows timely insights into security threats and
informed decision-making to bolster network security and ensure optimized
performance [5]. Additionally, 6G applications demand more edge servers and
introduce new attack vectors targeting local infrastructure and users [6].
This highlights the need for comprehensive defence strategies in 6G edge
networks. Employing multiple detection models can provide a comprehensive
solution to address the dynamic nature of network traffic [7]. To address
these challenges, we present a digital twin-empowered smart attack detection
system for 6G edge-of-things networks. Leveraging the capabilities of DT and
edge computing, our system aims to establish a robust and resilient defence
mechanism against cyber threats from IoT devices and edge connection
expansion. In our evaluation, we choose the Long Short-Term Memory Autoencoder
(LSTM-AE) model for comparison due to its capacity to capture temporal
dynamics. We fine-tuned LSTM-AE hyperparameters through rigorous testing to
ensure a robust evaluation of the proposed solution.

The key contributions of this article are as follows:

  * •

We propose a sophisticated smart attack detection system that integrates DT
technology into the edge network, enhancing security and enabling proactive
threat detection and response for 6G EoT networks.

  * •

Our system utilizes a dynamic and adaptive approach to update feature
selection (FS) and classification methods consistently. This approach ensures
optimal performance in identifying and mitigating various 6G EoT network
attack types.

The paper proceeds with a literature review in Section II, followed by the
proposed solution Section III and performance evaluation Section IV. We
conclude this paper in Section V.

##  II Related Work

The prominence of IoT and edge technologies has brought about a heightened
emphasis on cybersecurity [8]. In this section, we review some relevant works
that address similar challenges. Mao _et al._ gave a thorough survey of
security threats and countermeasures concerning edge computing, caching, and
intelligence regarding 6G network edge [6]. Yao _et al._ explored existing
research on intrusion detection systems and proposed innovative detection
methods and hybrid system architecture for edge-based industrial-IoT (IIoT)
[9]. An anomaly detection framework based on software-defined networking (SDN)
is proposed to address the challenge of DDoS attacks on edge devices in
distributed and complex environments, utilizing flow information extracted by
the edge controller and the GA-XGBoost algorithm for flow classification [10].
Singh _et al._ suggested an edge-based hybrid intrusion detection framework
(EHIDF) using machine learning (ML) approaches to detect both known and
unknown attacks in the mobile edge computing (MEC) environment [11]. Their
EHIDF outperformed previous works with improved accuracy and reduced false
alarm rate.

Lee _et al._ presented a lightweight machine learning-based intrusion
detection system called IMPACT, designed specifically for resource-constrained
IoT devices, utilizing deep auto-encoder and feature abstraction with linear
support vector machine (SVM) [12]. Another work introduces a novel privacy-
preserving and collusion-resilient identification system called FLACI for EoT,
utilizing federated learning to share models instead of raw data among edge
nodes [13]. It uses a community detection technique to find collusive groups
of attackers and a rating-based mechanism to evaluate the trustworthiness of
nodes. Zhang _et al._ addressed the challenge of model poisoning attacks on DT
model training and proposed an algorithm called MASTER, which utilizes multi-
timescale deep Q-learning networks to optimize the scheduling of local
training epochs and devices for accurate forecasting in smart parks [14]. This
algorithm achieved endogenous security awareness and significantly improved DT
model training accuracy and delay in a smart park integrated with DT and 6G
edge intelligence. Moreover, the ADRIoT framework, an innovative anomaly
detection framework for IoT networks utilizing edge computing to uncover
potential threats swiftly, is presented [15]. It employs an edge-assisted
architecture, enabling the detection module to run locally on the edge,
facilitating prompt detection of IoT-based attacks. A multi-edge collaborative
mechanism is designed to pool resources in a local network to address resource
limitations.

Although the mentioned studies significantly contribute to cybersecurity in
IoT and edge networks, our proposed system presents a distinctive and
innovative approach. It creates a dynamic and adaptive security mechanism by
integrating DT technology with edge networks. Through real-time analysis and
synchronized virtual representations, our system excels in proactive threat
detection and mitigation exhibiting a robust and resilient security posture of
6G EoT networks.

Figure 1: The digital twin-empowered 6G EoT smart attack detection system
architecture.

##  III Proposed 6G EoT System Model

Fig. 1 depicts the proposed 6G EoT system architecture. It combines two
networks. The first network, the EoT network, consists of the things, edge,
and cloud layers. The things layer forms the foundation of the EoT network,
encompassing a myriad of interconnected smart devices and sensors that collect
data from the physical world. The edge layer is an intermediary tier between
the device and the cloud. It consists of edge computing nodes strategically
positioned to the devices they serve. The nodes have relatively higher
computational capabilities and perform localized data processing and
preliminary analysis. The requirement for constant data transfer to the
central cloud is lessened by this layer, which also reduces latency and
network congestion. Real-time decision-making, rapid response to emergencies,
and low-latency services are all made feasible by edge computing nodes. The
cloud layer represents the traditional centralized cloud infrastructure.
Large-scale data centres boast significant computational capabilities and
extensive storage capacity in this layer. Additionally, this layer manages
resource-intensive operations, complicated data analytics, long-term storage,
and other duties that may not be appropriate for the edge layer. The edge
layer relieves the strain of delivering all data to the cloud, while the cloud
layer assures scalability and thorough analysis, resulting in optimum
performance.

The second network is the DT network. In our proposed system, the digital twin
of the edge layer is built. We have meticulously constructed a digital twin
representation of the edge layer, wherein the entities present within the edge
layer mirror the physical elements of our digital twin network. This alignment
ensures the edge layer remains closely intertwined with its virtual
counterpart. The second layer is the twin layer, which is digital replicas of
the edge layer entities. This layer enables real-time synchronization and
analysis by establishing a smooth connection between the physical and digital
worlds. The smart attack detection mechanism is strategically positioned in
our third layer of the DT network. As a result, the architecture’s overall
resilience and dependability are strengthened. This placement allows the
system to identify and respond to possible threats and security breaches
proactively.

###  III-A Smart Attack Detection

The functioning of our proposed detection system is delineated through the
following sequential steps:

  * •

Data generated by the edge node is initially passed through YANG models to
facilitate standardized representation and seamless integration with the
system.

  * •

The data is then transmitted to the detection module, where it undergoes
further analysis and evaluation.

  * •

Within the detection module, a meticulous assessment is conducted using the
system’s FS and classification methods to identify potential attacks at the
edge node.

  * •

In the event of an attack being detected, the mitigation module is promptly
activated to neutralize the threat while simultaneously alerting the system
administrator regarding the security breach.

  * •

In cases where no attack is identified, the detection performance module comes
into play. It comprehensively investigates the reliability of the system’s
classification technique.

  * •

The system maintains its current model if the classification method’s
reliability surpasses a predefined threshold, ensuring continuous operation
based on the existing setup.

  * •

However, if the classification technique’s reliability falls below the
predetermined threshold, the detection performance module promptly
communicates with the online learning module. This module updates the system’s
FS and classification methods in near real-time, bolstering its adaptive
capabilities and ensuring it remains proficient in identifying and mitigating
potential attacks effectively.

This approach in the proposed detection system enables proactive threat
detection, swift mitigation, and continuous improvement, making it a robust
and adaptive solution for safeguarding the edge network against potential
security breaches.

####  III-A1 Online Learning Module

We used our AutoFS [16] and AutoCM [17] approaches from our previous works in
this module. AutoFS includes five feature selection approaches, while AutoCM
contains ten classification algorithms. The general workflow of this module is
as follows: After taking a notification from the detection performance module,
the online learning module imports one thousand records from the YANG models.
Since the obtained data is unlabeled, we employed the labelling method to
assign labels to the data and a baseline dataset that contains 65% of attack
samples since attacks are uncommon from our previous work [17]. Unlabeled data
undergoes labelling through the application of the labelling algorithm. This
process involves augmenting the dataset with one thousand samples from the
baseline dataset. Subsequently, ten classification algorithms are employed to
train and test their models using two thousand labelled data samples. Finally,
the AutoCM selects the most suitable classification method using the final
classification method algorithm.

Once the most appropriate classification method is determined, AutoCM
transmits this method to AutoFS. AutoFS is responsible for identifying the
optimal FS method for the system among five available techniques. The labelled
one thousand random data samples are utilized as input for the five FS
methods. Each FS method selects the ten most relevant features based on their
algorithms. The data, refined by the FS techniques, is employed for training
and testing the classification method received from AutoCM. Subsequently, the
performance metrics obtained from the five techniques are forwarded to the
final FS algorithm. This algorithm, in turn, determines the best FS method by
optimizing the performance metrics for each technique. Once the best FS method
is identified, it is the basis for updating the system’s FS method and the
classification model. This iterative process ensures the system continually
adapts to the most effective and efficient FS and classification approach,
enhancing its overall performance and accuracy.

TABLE I: The Number of Samples Used in Datasets  Datasets | Number of Records Used
---|---
Edge-IIoT | Backdoor Attack | 1000
DDoS HTTP Attack | 500
DDoS UDP Attack | 500
Fingerprinting Attack | 1000
MITM Attack | 1000
Password Attack | 1000
Port Scanning Attack | 1000
Ransomware Attack | 1000
SQL Injection Attack | 1000
XSS Attack | 1000
Normal | 18000
ToN-IoT | Password Attack | 1000
Scanning Attack | 1000
XSS Attack | 1000
DDoS Attack | 1000
Ransomware Attack | 1000
Injection Attack | 1000
Backdoor Attack | 1000
Normal | 14000

The ultimate objective of both the final classification method and FS
algorithms is to maximize _$\sigma_{i}$_ while simultaneously optimizing
_$\vartheta_{i}$_ as performance metrics. _$\sigma_{i}$_ represents a weighted
sum of precision and recall for the _$i_{th}$_ classification or FS method,
whereas _$\vartheta_{i}$_ pertains to the detection time associated with the
same _$i_{th}$_ classification or FS method.

$\begin{split}arg\,max\>(\alpha_{i}\sigma_{i}+\beta_{i}\vartheta_{i}),\>\
i\in[1,10]\vee[1,5]\\\ \\\
\sigma_{i}=(0.6)\frac{TP}{TP+FN}+(0.4)\frac{TP}{TP+FP},\
\>\>i\in[1,10]\vee[1,5]\\\ \\\
\vartheta_{i}=t^{end}_{i}\>-\>t^{start}_{i},\>\>i\in[1,10]\vee[1,5]\\\
\end{split}$ (1)

In Equation 1, TP refers to the true positive, FN represents the false
negative, and FP stands for false positive. Additionally, _$t_{end}$_ denotes
the finishing time, while _$t_{start}$_ represents the starting time.

####  III-A2 Attack Mitigation Module

Upon successful detection of an attack by the smart attack detection
mechanism, this module swiftly comes into action to neutralize the identified
threat. This module deploys proactive measures to safeguard the edge nodes and
the broader system by leveraging the insights the detection process provides.
Through real-time analysis of the attack’s characteristics, it formulates
targeted countermeasures to mitigate its impact effectively. The malicious
traffic is blocked, and the related IP address is added to the suspended IP
address list. If the attack is classified as high risk, the system is isolated
to the affected edge node. If the attack is classified as mid-high risk, the
affected edge node is isolated after taking system admin approval. By
integrating such swift and adaptive mitigation strategies, the system can
swiftly respond to emerging threats, preserving the integrity and
uninterrupted functionality of the 6G edge-of-things network.

TABLE II: The Detection Rate Performance  Train Dataset | Test Dataset | Detection Rate (%)
---|---|---
LSTM-AE | PS
ToN-IoT | Edge-IIoT | Password Attack | 91.94 | 99.46
Port Scaning Attack | 81.79 | 96.89
DDoS UDP Attack | 92.64 | 99.24
XSS Attack | 93.27 | 99.82
MITM Attack | 91.08 | 99.36
Backdoor Attack | 90.39 | 99.18
Fingerprinting Attack | 87.38 | 97.02
SQL Injection Attack | 91.86 | 97.34
Ransomware Attack | 87.26 | 98.62
DDoS HTTP Attack | 94.15 | 99.36
Edge-IIoT | ToN-IoT | DDoS Attack | 90.75 | 99.75
Injection Attack | 88.92 | 98.92
Ransomware Attack | 79.82 | 98.25
XSS Attack | 89.79 | 98.04
Backdoor Attack | 82.96 | 97.86
Scanning Attack | 85.24 | 97.35
Password Attack | 92.58 | 96.80

####  III-A3 Detection Performance Module

This module is vital in assessing the classification method’s efficacy within
the digital twin-empowered 6G EoT smart attack detection system. Essential
metrics like TP and FN are used to evaluate the detection performance. The
determination of FN and TP in real-world scenarios where ground truth is often
unavailable or challenging to establish is difficult. We address this concern
by leveraging our labelling method in the online learning module, which
combines labelled and unlabeled data to estimate these values. The following
equation is used to measure the reliability of the classification method:

$\varphi={1-\frac{FN}{TP+FN}}$ (2)

In Equation 2, _$\varphi$_ denotes the reliability of the classification
method, with a specific focus on the FN metric due to its significance in the
data division. In cases where no attack is identified, the detection
performance module thoroughly investigates the reliability of the system’s
classification technique. The verification of classification techniques
primarily focuses on assessing the system’s ability to maintain a low rate of
FP. While TP and FN may not change, our system continuously monitors network
traffic and evaluates the alerts generated.

Figure 2: The performance comparison of the Edge-IIoT dataset. Figure 3: The
performance comparison of the ToN-IoT dataset.

The module’s decision-making process involves comparing the classification
method’s reliability against a predefined threshold. The reliability threshold
for our detection scheme was determined using an adaptive thresholding
technique, considering critical factors such as the observed rates of FP and
FN over time. When the system shows an elevated FP rate, the threshold is
dynamically adjusted to be more stringent, effectively mitigating false
alarms. Conversely, if FN rates are a concern, the threshold is appropriately
relaxed to enhance detection sensitivity. This approach allows us to maintain
an optimal balance between FP and FN, ensuring the reliability and
effectiveness of the detection scheme. The system continues to run using its
present model if reliability exceeds the specified threshold, ensuring ongoing
and consistent performance based on the current configuration. However, when
the classification technique’s reliability falls below the predetermined
threshold, signalling potential limitations or changes in the system’s
operational environment, the detection performance module promptly initiates
communication with the online learning module. This facilitates near real-time
updates to the system’s FS and classification methods, empowering the system
with adaptive capabilities to identify and mitigate potential attacks
effectively. The system improves its overall security and resilience in the
constantly changing EoT environment by dynamically altering its defence
measures, which keeps it adept in responding to new threats.

##  IV Performance Evaluation

We built a simple edge network architecture using the NS-3 [18]. This network
has twelve edge devices in the things layer and two edge nodes in the edge
layer. We used the Microsoft Azure DT (ADT) platform to build twin graphs of
edge nodes [19]. We investigated the performance of our system using Edge-
IIoTset [20], [21] and ToN-IoT [22], [23] datasets. The Edge-IIoTset dataset
is specifically designed for evaluating IoT and IIoT applications and consists
of fourteen attacks targeting connectivity protocols. On the other hand, the
ToN IoT dataset was created to assess the effectiveness and efficiency of AI-
based cybersecurity applications tailored for next-generation IoTs and
industrial IoTs. We randomly selected the specific number of samples from
these datasets, as seen in Table I. LSTM networks are well-suited for
capturing temporal dynamics; therefore, we choose an LSTM network to compare
our intrusion detection work. We conducted a comparison between our proposed
solution (PS) and the LSTM-AE utilized in [15]. To this end, we employed an
autoencoder with two encoder layers and two decoder layers. In both the
encoder and decoder components, the Dense layer was succeeded by batch
normalization and the LeakyReLu activation function. Subsequently, the decoder
output features were passed to the LSTM model for further processing. The
selection of parameters for our LSTM-based model was a result of systematic
experimentation and optimization. We conducted tests, cross-validation, and
performance evaluations to arrive at the configurations that provided the best
trade-off between model complexity and predictive accuracy. We ensured that
the LSTM approach is also effective and efficient in comparing our PS.

We employed sensitivity as a performance metric, which represents the ratio of
correctly identified attack samples to the total number of samples that should
have been identified as attacks. Initially, we conducted a separate evaluation
of the performance results for each dataset. As illustrated in Fig. 2 and Fig.
3, our solution demonstrates superior performance compared to the other
approach. After that, we investigated the detection performance. We trained
the initial model with the whole dataset and then tested them with the other
dataset. We send the different attacks in order, which is given in Table II,
to test our solution AutoCM and AutoFS performance.

Table II clearly indicates that our solution exhibits enhanced robustness and
adaptability to different attack types. Moreover, it outperforms LSTM-AE
regarding attack detection rate, indicating its heightened effectiveness and
accuracy in identifying potential threats. These achievements underscore our
system’s heightened effectiveness and accuracy in swiftly identifying and
neutralizing potential threats, bolstering the overall security posture of the
6G Edge of Things Networks. Furthermore, the observed superiority of our
solution in handling diverse attack scenarios signifies its potential for
real-world IoT and IIoT environments, where dynamic security challenges are
commonplace. These positive outcomes strongly validate the efficacy of our
digital twin-empowered smart attack detection system as a proactive and
efficient cybersecurity solution, offering a path towards enhanced security
and resilience in 6G EoT networks. Furthermore, we assessed the impact of DT
on network security by quantifying the reduction in successful attacks and the
improvement in incident response times resulting from its implementation. We
also scrutinized its resource utilization to ensure it operates efficiently
within network constraints while delivering significant security enhancements.
These findings underscore the DT’s effectiveness as a potent tool for
fortifying network security in 6G EoT environments.

##  V Conclusion

In this paper, we introduced a digital twin-empowered smart attack detection
system for 6G Edge of Things networks. Integrating digital twin technology and
edge computing enables real-time monitoring and proactive threat detection,
bolstering the security of IoT environments. Our system’s online learning
module ensures continuous improvement by updating feature selection and
classification methods, making it adaptable to dynamic attack landscapes.
Performance evaluations using real datasets indicate the system’s superior
performance. The results highlight the system’s effectiveness, robustness, and
adaptability in detecting diverse attack types, making it a promising solution
for securing 6G edge-of-things networks.

## Acknowledgment

Yagmur Yigit would like to thank the Google DeepMind Scholarship Programme for
their support.

## References

  * [1] Statista. Number of Internet of Things (IoT) Connected Devices Worldwide from 2019 to 2023, with Forecasts from 2022 to 2030. [Online]. Available: https://www.statista.com/statistics/1183457/iot-connected-devices-worldwide, Accessed June 22, 2023.
  * [2] P. Research. Edge Computing Market Size, 2022 to 2032 (USD BILLION). [Online]. Available: https://www.precedenceresearch.com/edge-computing-market/, Accessed June 23, 2023.
  * [3] Statista. Estimated Cost of Cybercrime Worldwide 2017-2028. [Online]. Available: https://www.statista.com/forecasts/1280009/cost-cybercrime-worldwide, Accessed July 20, 2023.
  * [4] Y. Yigit, L. D. Nguyen, M. Ozdem, O. K. Kinaci, T. Hoang, B. Canberk, and T. Q. Duong, “TwinPort: 5G Drone-assisted Data Collection with Digital Twin for Smart Seaports,” _Scientific Reports_ , vol. 13, p. 12310, 2023.
  * [5] J. Hong, Y.-G. Hong, X. de Foy, M. Kovatsch, E. Schooler, and D. Kutscher. IoT Edge Challenges and Functions, Work in Progress, Internet Engineering Task Force. [Online]. Available: https://datatracker.ietf.org/doc/draft-irtf-t2trg-iot-edge/09/, Accessed June 15, 2023.
  * [6] B. Mao, J. Liu, Y. Wu, and N. Kato, “Security and Privacy on 6G Network Edge: A Survey,” _IEEE Communications Surveys & Tutorials_, vol. 25, no. 2, pp. 1095–1127, 2023.
  * [7] E. Horsanali, Y. Yigit, G. Secinti, A. Karameseoglu, and B. Canberk, “Network-Aware AutoML Framework for Software-Defined Sensor Networks,” in _2021 17th International Conference on Distributed Computing in Sensor Systems (DCOSS)_ , 2021, pp. 451–457.
  * [8] C. S. Kalutharage, X. Liu, and C. Chrysoulas, “Explainable AI and Deep Autoencoders Based Security Framework for IoT Network Attack Certainty (Extended Abstract),” in _Attacks and Defenses for the Internet-of-Things_ , W. Li, S. Furnell, and W. Meng, Eds. Cham: Springer Nature Switzerland, 2022, pp. 41–50.
  * [9] H. Yao, P. Gao, P. Zhang, J. Wang, C. Jiang, and L. Lu, “Hybrid Intrusion Detection System for Edge-Based IIoT Relying on Machine-Learning-Aided Detection,” _IEEE Network_ , vol. 33, no. 5, pp. 75–81, 2019.
  * [10] G. Ren, Y. Zhang, S. Zhang, and H. Long, “Edge DDoS Attack Detection Method Based on Software Defined Networks,” in _Algorithms and Architectures for Parallel Processing_. Cham: Springer International Publishing, 2022, pp. 597–611.
  * [11] A. Singh, K. Chatterjee, and S. C. Satapathy, “An edge-based hybrid intrusion detection framework for mobile edge computing,” _Complex & Intelligent Systems_, vol. 8, pp. 3719 – 3746, 2022. [Online]. Available: https://doi.org/10.1007/s40747-021-00498-4
  * [12] S. J. Lee, P. D. Yoo, A. T. Asyhari, Y. Jhi, L. Chermak, C. Y. Yeun, and K. Taha, “IMPACT: Impersonation Attack Detection via Edge Computing Using Deep Autoencoder and Feature Abstraction,” _IEEE Access_ , vol. 8, pp. 65 520–65 529, 2020.
  * [13] W. Lalouani and M. Younis, “A Robust Distributed Intrusion Detection System for Collusive Attacks on Edge of Things,” in _2022 IEEE Wireless Communications and Networking Conference (WCNC)_ , 2022, pp. 1004–1009.
  * [14] S. Zhang, Z. Yao, H. Liao, Z. Zhou, Y. Chen, and Z. You, “Endogenous security-aware resource management for digital twin and 6G edge intelligence integrated smart park,” _China Communications_ , vol. 20, no. 2, pp. 46–60, 2023.
  * [15] R. Li, Q. Li, J. Zhou, and Y. Jiang, “ADRIoT: An Edge-Assisted Anomaly Detection Framework Against IoT-Based Network Attacks,” _IEEE Internet of Things Journal_ , vol. 9, no. 13, pp. 10 576–10 587, 2022.
  * [16] Y. Yigit, B. Bal, A. Karameseoglu, T. Q. Duong, and B. Canberk, “Digital Twin-Enabled Intelligent DDoS Detection Mechanism for Autonomous Core Networks,” _IEEE Communications Standards Magazine_ , vol. 6, no. 3, pp. 38–44, 2022.
  * [17] Y. Yigit, O. K. Kinaci, T. Q. Duong, and B. Canberk, “TwinPot: Digital Twin-assisted Honeypot for Cyber-Secure Smart Seaports,” in _2023 IEEE International Conference on Communications Workshops (ICC Workshops)_ , 2023, pp. 740–745.
  * [18] NSNAM. The ns-3 Network Simulator. [Online]. Available: https://www.nsnam.org/, Accessed Apr. 27, 2023.
  * [19] Microsoft. Azure Digital Twins Documentation. [Online]. Available: https://docs.microsoft.com/en-us/azure/digital-twins, Accessed Apr. 12, 2023.
  * [20] I. Dataport. (2022) Edge-IIoTset: A New Comprehensive Realistic Cyber Security Dataset of IoT and IIoT Applications: Centralized and Federated Learning. [Online]. Available: https://ieee-dataport.org/documents/edge-iiotset-new-comprehensive-realistic-cyber-security-dataset-iot-and-iiot-applications, Accessed May 10, 2023.
  * [21] M. A. Ferrag, O. Friha, D. Hamouda, L. Maglaras, and H. Janicke, “Edge-iiotset: A new comprehensive realistic cyber security dataset of iot and iiot applications for centralized and federated learning,” _IEEE Access_ , vol. 10, pp. 40 281–40 306, 2022.
  * [22] N. Moustafa. ToN IoT datasets. [Online]. Available: https://ieee-dataport.org/documents/toniot-datasets, Accessed May 3, 2023.
  * [23] A. Alsaedi, N. Moustafa, Z. Tari, A. Mahmood, and A. Anwar, “Ton-iot telemetry dataset: A new generation dataset of iot and iiot for data-driven intrusion detection systems,” _IEEE Access_ , vol. 8, pp. 165 130–165 150, 2020.


Let $j:Y \to W$ be a closed embedding of $R$-varieties and let $(\mathcal{F}_i)$ be an inverse system of sheaves of $R$-modules such that $\mathcal{F}_i/\pi^{i-1} \mathcal{F}_i \cong \mathcal{F}_{i-1}$ for $i \geq 1$. Let $\mathcal{F}:=\invlim \mathcal{F}_i$. Then:

$$ j_*  \mathcal{F} \cong (\invlim j_* \mathcal{F}_i).$$

Notice that apriori it is not clear that the right-hand side is well defined. However, since $j$ is a closed embedding, it is in particular right exact. Therefore, one can prove in a similar fashion to Lemma <ref> that
$$j_* \mathcal{F}_i / \pi^{i-1} j_* \mathcal{F}_i \cong j_* \mathcal{F}_{i-1}.$$

Let $\mathcal{G}:= \invlim j_* \mathcal{F}_i$. Since $j_*$ is a right adjoint functor to the inverse image functor, $j_*$ commutes with inverse limits, thus

\begin{equation*}
j_*\mathcal{F}= j_*( \invlim \mathcal{F}_i) \cong \invlim (j_* \mathcal{F}_i)= \mathcal{G}. \qedhere
\end{equation*}

Let $Y$ be an $R$-variety and let $p_r: Y \times Y \to Y$ be the projection on the right factor, and $\mathcal{F}$ a sheaf of $R$-modules. Then:
$$\widehat{p_r ^{-1} \mathcal{F}} \cong p_r^{-1} \hat{\mathcal{F}}.$$

First,  notice that there is a map from the right hand side to the left-hand side via the maps $\hat{\mathcal{F}} \to \mathcal{\hat{F}}/\pi^{i} \mathcal{\hat{F}} \cong \mathcal{F}/\pi^{i} \mathcal{F}$. Let $U,V \subset Y$ be affine open, so that $U \times V \subset Y \times Y$ is affine open. Then,  we have:

\begin{equation}
\label{d3projectioncompletionsheafequation}
\begin{split}
\widehat{p_r^{-1} \mathcal{F}}(U \times V) &= \invlim (p_r^{-1} \mathcal{F}/ \pi^i p_r^{-1} \mathcal{F}) ( U \times V) \\
& \cong \invlim p_r^{-1} \mathcal{F}(U \times V)/ \pi^{i} p_r^{-1} \mathcal{F} (U \times V) \\
& \cong \invlim \mathcal{F}(V)/ \pi^{i} \mathcal{F}(V) \\
& \cong \hat{\mathcal{F}}(V) \\
& \cong p_r^{-1} \hat{\mathcal{F}}(U \times V).
\end{split}
\end{equation}

Now let $(U_i)_{i \in I}$ be an affine open covering of $Y$. Then $\{U_j \times U_k| j,k \in I \}$ is an affine open covering of $Y \times Y$. By equation (<ref>), we have that the sheaves $\widehat{p_r^{-1} \mathcal{F}}$ and $p_r^{-1} \hat{\mathcal{F}}$ agree on affine open cover and since there exists a map between the two, they are isomorphic.

§.§ Simplyfing the pullback functor

We retain the notation from the previous section. Further, for the rest of the section we assume $\lambda,\mu: \pi^n  \mathfrak{h} \to R$ are $R$-linear dominant weights. Since $\mathcal{D}_n^{\lambda,\mu}$ is a sheaf of $\pi^n$-deformed $G$-htdo by Corollary <ref> and the double flag variety $X \times X$ is quasi-compact we have by Theorem <ref>, Proposition <ref> and Theorem <ref> equivalences of categories:

\begin{equation}
\begin{split}
&i_l^{\#}: \Coh(\mathcal{D}^{\lambda,\mu}_n,G) \to \Coh(\mathcal{D}^{\lambda}_n,B), \\
&\hat{i_l}^{\#}: \Coh(\widehat{\mathcal{D}^{\lambda,\mu}_n},G)  \to \Coh(\widehat{\mathcal{D}^{\lambda}_n},B), \\
&\hat{i}_{l,K}^{\#}: \Coh(\widehat{\mathcal{D}^{\lambda,\mu}_{n,K}},G)  \to \Coh(\widehat{\mathcal{D}^{\lambda}_{n,K}},B).
\end{split}
\end{equation}

We let $i:eB \to X$ and $p_r:X \times X \to X$ denote the natural inclusion and projection onto the right factor, respectively. We also define $\mathcal{M}^{\mu}_n:=i_*R \uset{\mathcal{O}_X} \mathcal{D}^{\mu}_n.$

We can now give a description of the pullback of $G$-equivariant coherent $\widehat{\mathcal{D}^{\lambda,\mu}_{n}}$-modules and $\widehat{\mathcal{D}^{\lambda,\mu}_{n,K}}$-modules. We start by proving $\pi$-adic and affinoid versions of <cit.>.

Let $\mathcal{M} \in \Coh(\widehat{\mathcal{D}^{\lambda,\mu}_n},G) $. Then:

$$i_{l_*}(\hat{i_l}^{\#} \mathcal{M}) \cong p_r^{-1}\widehat{\mathcal{M} ^{\mu}_n}\uset{p_r^{-1} \widehat{\mathcal{D}^{\mu}_n}} \mathcal{M}.$$

We know by construction that $\mathcal{M}/\pi^i\mathcal{M} \in \Coh(\mathcal{D}^{\lambda,\mu}_n,G)$. We have

\begin{equation}
\begin{split}
i_{l_*}(\hat{i_l}^{\#} \mathcal{M})&=i_{l_*}(\invlim i_l^{\#} (\mathcal{M}/\pi^i \mathcal{M})) \\
&\cong \invlim (i_{l_*} (i_l^{\#} (\mathcal{M}/\pi^i \mathcal{M}))) \text{ (by Lemma \ref{d3completiondirectimage}) }   \\
&\cong \invlim  (p_r^{-1}\mathcal{M}^{\mu}_n \uset{p_r^{-1} \mathcal{D}^{\mu}_n} \mathcal{M}/\pi^i \mathcal{M}) \text{ (by \cite[Corollary 6.4]{Sta2})} \\
&\cong \invlim (p_r^{-1}\mathcal{M}^{\mu}_n/ \pi^i p_r^{-1}\mathcal{M}^{\mu}_n \uset{p_r^{-1} \mathcal{D}^{\mu}_n/\pi^i p_r^{-1} \mathcal{D}^{\mu}_n} \mathcal{M}/\pi^i \mathcal{M}) \\
&\cong \widehat{p_r^{-1} \mathcal{M}^{\mu}_n} \uset{\widehat{p_r^{-1} \mathcal{D}^{\mu}_n}} \mathcal{M} \text{ (by Lemma \ref{d3inversesystemtensor}) } \\
&\cong p_r^{-1}\widehat{\mathcal{M} ^{\mu}_n}\uset{p_r^{-1} \widehat{\mathcal{D}^{\mu}_n} } \mathcal{M} \text{ (by Lemma \ref{d3inverseimagecompletion})}. \qedhere
\end{split}
\end{equation}

Let $\mathcal{M} \in \Coh(\widehat{\mathcal{D}^{\lambda,\mu}_{n,K}},G) $. Then:

$$i_{l_*}(\hat{i}_{l,K}^{\#} \mathcal{M}) \cong (p_r^{-1}\widehat{\mathcal{M} ^{\mu}_n})_K \uset{p_r^{-1} \widehat{\mathcal{D}^{\mu}_{n,K}}} \mathcal{M}. $$

Let $\mathcal{M}_0$ be the correspoding lattice for $\mathcal{M}$ such that $\mathcal{M}_0 \in \Coh(\widehat{\mathcal{D}^{\lambda,\mu}_n},G)$. By definition $(\hat{i}_{l,K}^{\#} \mathcal{M})=(\hat{i_l}^{\#} \mathcal{M}_0)_K$. We have

\begin{equation}
\begin{split}
i_{l_*}(\hat{i}_{l,K}^{\#} \mathcal{M})&=i_{l_*}((\hat{i_l}^{\#} \mathcal{M}_0)_K) \\
& \cong (i_{l_*} i_l^{\#} \mathcal{M}_0)_K \\
& \cong  (p_r^{-1}\widehat{\mathcal{M} ^{\mu}_n}\uset{p_r^{-1} \widehat{\mathcal{D}^{\mu}_n}} \mathcal{M}_0)_K \text{ (by Proposition \ref{d3piadicpullback}) }\\
& \cong (p_r^{-1}\widehat{\mathcal{M} ^{\mu}_n})_K \uset{(p_r^{-1} \widehat{\mathcal{D}^{\mu}_n})_K} (\mathcal{M}_0)_K \\
& \cong (p_r^{-1}\widehat{\mathcal{M} ^{\mu}_n})_K \uset{(p_r^{-1} \widehat{\mathcal{D}^{\mu}_n})_K} \mathcal{M} \\
& \cong (p_r^{-1}\widehat{\mathcal{M} ^{\mu}_n})_K \uset{p_r^{-1} \widehat{\mathcal{D}^{\mu}_{n,K}}} \mathcal{M}. \qedhere
\end{split}
\end{equation}

We should remark that the argument above proves that the functor $\hat{i}_{l,K}^{\#}$ is well defined, i.e. it does not depend on the lattice of $\mathcal{M}$.

§.§ Computation of global sections

We aim to compute $\Gamma(X, \hat{i}_{l,K}^{\#} \mathcal{M})$ for $\mathcal{M} \in \Coh(\widehat{\mathcal{D}^{\lambda,\mu}_{n,K}},G)$. Recall that $Z= X \times X$ denotes the double flag variety. We start by making some notations.

To simplify the notation, we denote $\mathcal{A}:=\Gamma(X,\widehat{\mathcal{D}^{\mu}_n})$, so that $\mathcal{A}_K=\mathcal{A} \uset{R} K \cong \Gamma(X,\widehat{\mathcal{D}^{\mu}_{n,K}})$. Further, we let $\mathcal{B}:=\Gamma(X,\widehat{\mathcal{D}^{\lambda,\mu}_n})$. We have by combining Proposition <ref> and <cit.> that  $\huggnKlm \cong \mathcal{B}_K \cong \hugnKl \hat{\uset{K}} \mathcal{A}_K$. Given a $\mathcal{B}_K$-module $M$, we may view it as $\mathcal{A}_K$-module via $x.m=(1 \otimes x).m$ for $x \in \mathcal{A}_K$ and $m \in M$.

$\mathcal{M} \in \Coh(\widehat{\mathcal{D}^{\lambda,\mu}_{n,K}},G)$. Then as $\hugnKl$-modules we have an isomorphism:

$$\Gamma(X,\hat{i}_{l,K}^{\#} \mathcal{M}) \cong \Gamma(X, \widehat{\mathcal{M}^{\mu}_{n,K}}) \uset{\mathcal{A}_K} \Gamma(Z, \mathcal{M}).$$

We have $\Gamma(X,\hat{i}_{l,K}^{\#} \mathcal{M}) \cong \Gamma(Z,i_{l_*}(\hat{i}_{l,K}^{\#} \mathcal{M}))$, so using Corollary <ref>, it is enough to compute $\Gamma(Z,(p_r^{-1}\widehat{\mathcal{M} ^{\mu}_n})_K \uset{p_r^{-1} \widehat{\mathcal{D}^{\mu}_{n,K}}} \mathcal{M})$.

We have by the first part of <cit.> that there is an exact sequence $(\mathcal{D}^{\mu}_{n})^a \to (\mathcal{D}^{\mu}_{n})^b \to \mathcal{M}^{\mu}_{n} \to 0$ for some $a,b \in \mathbb{N}^{*}$. Since $\pi$-adic completion is exact on coherent modules, we obtain an exact sequence $(\widehat{\mathcal{D}^{\mu}_{n}})^a \to (\widehat{\mathcal{D}^{\mu}_{n}})^b \to \widehat{\mathcal{M} ^{\mu}_n} \to 0$, so an exact sequence

$$(\widehat{\mathcal{D}^{\mu}_{n,K}})^a \to (\widehat{\mathcal{D}^{\mu}_{n,K}})^b \to \widehat{\mathcal{M} ^{\mu}_{n,K}} \to 0.$$

Since $p_r^{-1} \widehat{\mathcal{M} ^{\mu}_{n,K}} \cong (p_r^{-1}\widehat{\mathcal{M} ^{\mu}_n})_K$ and tensor product is right exact we obtain an exact sequence:

$$  (p_r^{-1}\widehat{\mathcal{D} ^{\mu}_{n,K}})^a \uset{p_r^{-1} \widehat{\mathcal{D}^{\mu}_{n,K}}} \mathcal{M}   \to  (p_r^{-1}\widehat{\mathcal{D} ^{\mu}_{n,K}})^b \uset{p_r^{-1} \widehat{\mathcal{D}^{\mu}_{n,K}}} \mathcal{M} \to                        (p_r^{-1}\widehat{\mathcal{M} ^{\mu}_n})_K \uset{p_r^{-1} \widehat{\mathcal{D}^{\mu}_{n,K}}} \mathcal{M} \to 0.$$

To simplify the notation, we let $\mathcal{E}=p_r^{-1}\widehat{\mathcal{D} ^{\mu}_{n,K}}$ and $M=\Gamma(Z,\mathcal{M})$. The above short sequence fits into the following commutative diagram:

[column sep=small,scale=1.7em]
ℰ^a ℰ ℳ  [r] [d]    ℰ^b ℰ ℳ [r] [d]    (p_r^-1ℳ ^μ_n)_K ℰ ℳ [r] [d]    0 [d]

ℳ^a [r]    ℳ^b [r]    (p_r^-1ℳ ^μ_n)_K p_r^-1 𝒟^μ_n,K ℳ [r]    0.

Since $\Gamma(Z,-)$ is exact on coherent modules by Theorem <ref>  we obtain a commutative diagram:

[column sep=tiny]

Γ(Z,ℰ^a ℰ ℳ)  [r] [d]    Γ(Z,ℰ^b ℰ ℳ) [r] [d]    Γ(Z,(p_r^-1ℳ ^μ_n)_K ℰ ℳ) [r] [d]    0 [d]

Γ(Z,ℳ^a) [r] [d]    Γ(Z,ℳ^b) [r] [d]    Γ(Z,(p_r^-1ℳ ^μ_n)_K ℰ ℳ) [r] [d]    0 [d]

M^a [r] [d]    M^b [r] [d]    Γ(Z,(p_r^-1ℳ ^μ_n)_K ℰ ℳ) [r] [d]     0 [d]

Γ(X,𝒟^μ_n,K^a) 𝒜_K M [r]    Γ(X,𝒟^μ_n,K^b) 𝒜_K M [r]    Γ(X, ℳ^μ_n,K) 𝒜_K M [r]    0.

By construction, we have that the vertical arrows on the first, second and fourth columns are isomorphisms.  Considering the first and fourth row and applying the Five Lemma, we get the desired isomorphism.

§.§ Global sections of M ˆlambda _ n,K

Recall that $\mathfrak{b}^-=\mathfrak{n}^- \oplus \mathfrak{h}$ denotes the negative Borel subalgebra of $\mathfrak{g}$. Let $T(\mu)_0=R_{\mu} \uset{U(\mathfrak{b}^{-})_n}U(\mathfrak{g})_n$ denote the right $U(\mathfrak{g})_n$-module such that $U(\mathfrak{b}^{-})_n$ acts on $R$ via $\mu$. Further, we let $T(\mu):=T(\mu)_0 \uset{R}K \cong K_{\mu} \uset{U(\mathfrak{b}^{-})_K} U(\mathfrak{g})_K$ and $\widehat{T(\mu)}:= \widehat{T(\mu)_0} \uset{R} K \cong T(\mu) \uset{U(\mathfrak{g})_K} \hugnK$. We should remark that $T(\mu)$ is the same as defined in <cit.>.

We have $\Gamma(X,\widehat{\mathcal{M}^{\mu}_{n,K}}) \cong \widehat{T(\mu)}$ as right $\hugnK$-modules.

We have by construction that $\Gamma(X,\mathcal{M}^{\mu}_n) \uset{R} K \cong \Gamma(X_K,\mathcal{M}^{\mu}_{n,K|X_K})$ and by <cit.> that $\Gamma(X_K,\mathcal{M}^{\mu}_{n,K|X_K})\cong T(\mu)$. Therefore

$$ \Gamma(X,\mathcal{M}^{\mu}_n) \uset{R} K \cong T(\mu)_0 \uset{R} K \cong T(\mu).$$

By <cit.>, $ \Gamma(X,\mathcal{M}^{\mu}_n)$ is finitely generated as a $U(\mathfrak{g})_n$-module, so $\Gamma(X,\mathcal{M}^{\mu}_n)$ and $T(\mu)_0$ are both lattices for $T(\mu)$. Therefore, they agree modulo bounded $\pi$-torsion, i.e. there exists an exact sequence

$$T(\mu)_0 \to  \Gamma(X,\mathcal{M}^{\mu}_n) \to C \to 0,$$

such that $\pi^mC=0$ for some $m \in \mathbb{N}$ and $C$ is a finitely generated $U(\mathfrak{g})_n$-module. Since, $\pi$-adic completion is exact on finitely generated $U(\mathfrak{g})_n$-modules we get an exact sequence

$$\widehat{T(\mu)_0} \to \widehat{\Gamma(X,\mathcal{M}^{\mu}_n)} \to \widehat{C} \to 0,$$

with $\pi^m \widehat{C}=0$. So by tensoring with $K$ we obtain

\begin{equation*}
\widehat{T(\mu)}=\widehat{T(\mu)_0} \uset{R} K \cong  \widehat{\Gamma(X,\mathcal{M}^{\mu}_n)} \uset{R} K \cong \Gamma(X, \widehat{\mathcal{M}^{\mu}_{n,K}}). \qedhere
\end{equation*}

We may now prove the main theorem of this section, an affinoid version of <cit.>.

Let $\mathcal{M} \in \Coh(\widehat{\mathcal{D}^{\lambda,\mu}_{n,K}},G)$. Then as $\hugnKl$-modules we have:

$$\Gamma(X,\hat{i}_{l,K}^{\#} \mathcal{M}) \cong \widehat{T(\mu)} \uset{\hugnKm} \Gamma(Z, \mathcal{M}).$$

This follows by combining Corollary <ref>, Proposition <ref> and <cit.>.

§ AFFINOID DUFLO'S THEOREM

Throughout this section $\lambda:\pi^n \mathfrak{h} \to R$ denotes an $R$-linear dominant weight. Recall that we use $\lambda^*$ to denote the weight $-w_{o}\lambda$, where $w_{o}$ is the longest element of the Weyl group. If $\lambda$ is a dominant weight, so is $\lambda^*$. We consider the functor

\begin{equation*}
\begin{split}
&\mathscr{F}:\Mod_{\fg}(\huggnKlstl,G) \to \Mod_{\fg}(\hugnKlst,B), \\
&\mathscr{F}(M) := \Gamma(X,\hat{i}_{l,K}^{\#} \Loc^{\lambda} (M)).
\end{split}
\end{equation*}

The functor $\mathscr{F}$ is exact and $\mathscr{F}(M) \cong \widehat{T(\lambda)} \uset{\hugnKl} M$ as $\hugnKlst$-modules for  $M \in \Mod_{\fg}(\huggnKlstl,G)$.

Let $M \in \Mod_{\fg}(\huggnKlstl,G)$ and $\mathcal{M}:=\Loc^{\lambda^*,\lambda} (M)$. We have by Corollary <ref> that $\Gamma(Z,\mathcal{M}) \cong M$ and by Theorem <ref> that $\mathcal{M} \in \Coh(\widehat{\mathcal{D}^{\lambda^*,\lambda}_{n,K}},G)$, so the second claim follows from Theorem <ref>. Consider a short exact sequence in $\Mod_{\fg}(\huggnKlstl,G)$:

$$0 \to N \to M \to P \to 0.$$

We let $\mathcal{N}, \mathcal{M}, \mathcal{P}$ denote the localisation of $N,M$ and $P$ respectively. Further, we denote $\mathcal{L}:=\ker( \mathcal{N} \to \mathcal{M})$. By construction, $\Loc^{\lambda^*,\lambda}$ is right exact, so we obtain an exact sequence:

$$0 \to \mathcal{L} \to \mathcal{N} \to \mathcal{M} \to \mathcal{P} \to 0.$$

Since $\hat{i}_{l,K}^{\#}$ is an equivalence of Abelian categories, it is exact. Furthermore, by Theorem <ref> the global sections functor is also exact, so we obtain an exact sequence

$$0 \to \Gamma(X,\hat{i}_{l,K}^{\#} \mathcal{L}) \to \Gamma(X,\hat{i}_{l,K}^{\#} \mathcal{N}) \to \Gamma(X,\hat{i}_{l,K}^{\#} \mathcal{M}) \to \Gamma(X,\hat{i}_{l,K}^{\#} \mathcal{P}) \to 0.$$

Combining Theorem <ref> and Corollary <ref> we obtain an exact sequence

\begin{equation}
\begin{split}
0 &\to \widehat{T(\lambda)} \uset{\hugnKl} \Gamma(Z, \mathcal{L}) \to  \widehat{T(\lambda)} \uset{\hugnKl} N \\
& \to  \widehat{T(\lambda)} \uset{\hugnKl} M \to  \widehat{T(\lambda)} \uset{\hugnKl} P \to 0.
\end{split}
\end{equation}

The claim follows since $\Gamma(Z, \mathcal{L})=0$ by definition of $\mathcal{L}$ and Corollary <ref>.

Let $M \in \Mod_{\fg}(\huggnKlstl,G)$ and assume $\mathscr{F}(M)=0$. Then $M=0$.

Let $\mathcal{M}:=\Loc^{\lambda^*,\lambda}(M)$. Then, by assumption, we have that $\Gamma(X,\hat{i}_{l,K}^{\#} \mathcal{M})=0$. By applying Corollary <ref> and Corollary <ref>, we obtain $M=0$.

We now specialise to two sided ideals in $\hugnKl$; recall that a two-sided ideal $I$ can be viewed as a module over $\hugnKlst \otimes \hugnKl$ via $(x \otimes y).i=yi\tau(x)$ for $x \in \hugnKlst,y \in \hugnKl$ and $i \in I$. Further, by Corollary <ref>, we have $I \in \Mod_{\fg}(\huggnKlstl,G)$, so $\mathscr{F}(I)$ is well-defined. As a corollary, we obtain immediately:

Let $I,J$ be two-sided ideals  in $\hugnKl$ such that $I \subseteq J$. Assume that $\mathscr{F}(I) \cong \mathscr{F}(J)$. Then $I=J$.

Consider the short exact sequence:

$$0 \to I \to J \to J/I \to 0.$$

By Proposition <ref> the functor $\mathscr{F}$ is exact, so we obtain an exact sequence

$$0 \to \mathscr{F}(I) \to \mathscr{F}(J) \to \mathscr{F}(J/I) \to 0.$$

Using the assumption, we obtain $\mathscr{F}(J/I)=0$. The claim follows by Lemma <ref>.

Let $I$ be a two-sided ideal in $\hugnKl$. Then as left $\hugnKlst$-modules we have

$$\mathscr{F}(I) \cong \widehat{T(\lambda)}I.$$

We should remark that $\hugnKlst$ acts on $\widehat{T(\lambda)}I$ via $x.(ti)=t(x.i)=ti\tau(x)$ for $x \in \hugnKlst, t \in \widehat{T(\lambda)}$ and $ i \in I$. Further, the isomorphism is natural in $I$.

Consider the following exact sequence:

$$0 \to I \to \hugnKl \to \hugnKl/I \to 0.$$

Applying Proposition <ref> we obtain a short exact sequence:

$$0 \to \widehat{T(\lambda)} \uset{\hugnKl} I \to \widehat{T(\lambda)}\to \widehat{T(\lambda)} \uset{\hugnKl} \hugnKl/I \to 0.$$

This short exact sequence fits in the following commutative diagram:

[column sep =small]
0 [r]    T(λ)  I [d] [r]     T(λ)   [r] [d]    T(λ) /I [r] [d]    0

0 [r]    T(λ)  I [r]     T(λ)  [r]    T(λ) /I [r]    0.

It is easy to see that the first map is a surjection and the second and the third maps are isomorphisms. Furthermore, by the diagram above,  the first map is also injective, so indeed we get $\mathscr{F}(I) \cong \widehat{T(\lambda)} I$.

Let $\sigma: \mathfrak{g} \to \mathfrak{g}$ denote the Chevalley involution that swaps $\mathfrak{n}^+$ and $\mathfrak{n}^{-}$ and fixes $\mathfrak{h}$ . Then $\sigma$ extends to an anti-automorphism of $U(\mathfrak{g})_K$ that fixes the center by <cit.>. Therefore, we obtain that an anti-automorphism $\hat{\sigma}:\hugnKl \to \hugnKl$. Recall that $T(\lambda)_0=R_{\lambda} \uset{U(\mathfrak{b}^{-})_n} U(\mathfrak{g})$, so that
$\widehat{T(\lambda)} \cong K_{\lambda} \uset{\widehat{U(\mathfrak{b}^{-})_{n,K}}} \hugnK$.

The map

$$\hat{\phi}:\widehat{T(\lambda)} \to \widehat{M(\lambda)}, \qquad \hat{\phi}(k \otimes x)=\hat{\sigma}(x) \otimes k, \qquad k \in K_{\lambda}, x \in \hugnK$$

is a $K$-linear isomorphism of vector spaces satisfying $\hat{\phi}(tu)=\hat{\sigma}(u)\hat{\phi}(t)$ for all $u \in \hugnK$ and $t \in \widehat{T(\lambda)}$. In particular, if $I$ is a two-sided ideal in $\hugnKl$, then $\hat{\phi}(\widehat{T(\lambda)}I)=\hat{\sigma}(I)\widehat{M(\lambda)}$.

We have by <cit.> that the map $\phi:T(\lambda) \to M(\lambda)$, $\phi(k \otimes x)=\sigma(x) \otimes K$ is a $K$-linear isomorphism of vector spaces satisfying $\phi(tu)=\sigma(u)\phi(t)$ for all $t \in T(\lambda)$ and $u \in U(\mathfrak{g})_K$. Therefore, the claims follow from the construction of $\hat{\phi}$ and $\hat{\sigma}$.

To prove the main theorem, we will need the following corollary:

Let $I$ be a two-sided ideal in $\hugnKl$. Then:

Let $J:=\Ann(\widehat{M(\lambda)}/I\widehat{M(\lambda)})$. Since $I(\widehat{M(\lambda)}/I\widehat{M(\lambda)})=0$, we obtain that $I \subseteq J$, so $\hat{\sigma}(I) \subseteq \hat{\sigma}(J)$. We remark that since $\hat{\sigma}$ is an anti-automorphism of $\hugnKl$, $\hat{\sigma}(I)$ and $\hat{\sigma}(J)$ are also two-sided ideals in $\hugnKl$. Since $\mathscr{F}$ is exact, in particular left exact, we obtain $\mathscr{F}(\hat{\sigma}(I)) \subseteq \mathscr{F}(\hat{\sigma}(J))$. Consider the following diagram:

ℱ(σ̂(I)) [r] [d]     ℱ(σ̂(J)) [d]

T(λ)σ̂(I) [r] [d,"ϕ̂"]     T(λ) σ̂(J) [d,"ϕ̂"]

IM(λ) [r]    JM(λ)

By construction, the bottom diagram commutes and by the definition of $J$, we have $J\widehat{M(\lambda)}=I\widehat{M(\lambda)}$. Using Lemma <ref>, we get $\widehat{T(\lambda)}\hat{\sigma}(I)=\widehat{T(\lambda)}\hat{\sigma}(J)$. Furthermore, since the isomorphism is Lemma
<ref> is natural on ideals, the top diagram is also commutative. Therefore, $\mathscr{F}(\hat{\sigma}(I)) \cong \mathscr{F}(\hat{\sigma}(J))$. The claim follows from Corollary <ref> since $\hat{\sigma}$ is an anti-automorphism.

Let $I$ be a prime ideal in $\hugnKl$. Then
$$I=\Ann(\widehat{L(\mu)}) \text{ for some } \mu:\pi^n \mathfrak{h} \to R.$$

Since $\widehat{M(\lambda)}/I \widehat{M(\lambda)}$ is a quotient of $\widehat{M(\lambda)}$, we have by Proposition <ref> that there exists a finite composition series:

$$0=M_0 \subset M_1 \subset \ldots M_l=\widehat{M(\lambda)}/I \widehat{M(\lambda)}.$$

Let $I_i=\Ann(M_i/M_{i-1})$ for $1 \leq i \leq l$. We have

$$I_1I_2 \ldots I_l M_l=I_1 I_2 \ldots I_{l-1}M_{l-1}= \ldots =0,$$

so $I_1I_2 \ldots I_l \subset  \Ann(\widehat{M(\lambda)}/I \widehat{M(\lambda)}) =I$ by Corollary <ref>. Since $I$ is prime, there exists $1 \leq j \leq l$ such that $I_j \subset I$. On the other hand, we have by construction $I \subset I_j$, so $I=I_j=\Ann(M_j/M_{j-1})$. Finally, we have by Proposition <ref> that $M_j/M_{j-1} \cong \widehat{L(\mu)}$ for some $\mu:\pi^n \mathfrak{h} \to R$.

As an easy corollary, we obtain a positive answer to <cit.>.

Every primitive ideal of $\hugnK$ with $K$-rational
infinitesimal central character is the annihilator of a simple affinoid highest weight module.

Any primitive ideal in $\hugnK$ with $K$-rational infinitesimal central character intersects $Z(\hugnK)$ in a maximal ideal of the form $\ker \chi_{\lambda}$; here we view $\ker \chi_{\lambda}$ as a central character of $\hugnK$ via Theorem <ref>. Therefore, classifying these ideals reduces to classifying the ideals in $\hugnKl$ for all $\lambda \in \pi^n\mathfrak{h}^*$.
There is an action of the Weyl group $W$ on the set of weights such that for two weights $\lambda$ and $\mu$, $\hugnKl=\widehat{U(\mathfrak{g})^{\mu}_{n,K}}$ if and only if $\lambda$ and $\mu$ are $W$-conjugate. Further, every $W$-conjugacy class contains at least one dominant weight. The claim follows by Theorem <ref> since every primitive ideal is prime.

We should remark that in the case $p$ is a very good prime for $G$, we have by Theorem <ref> that the ideals $\{\hat{I}_{\lambda}=\Ann(\widehat{M(\lambda)})| \lambda \in \pi^n \mathfrak{h}^* \}$ form the set of minimal primitive ideals with $K$-rational central character.

§  A CONTROLLER THEOREM

We keep the notations and assumptions from the previous section; we further assume that $\lambda:\pi^n \mathfrak{h} \to R$ is also regular. We will also make use of the fact that two-sided ideals in $\hugnK$ that contain $\hugnK \ker {\chi_{\lambda}}$ correspond to two-sided ideals in $\hugnKl$.

Let $I$ be a two-sided ideal in $U(\mathfrak{g}_K)$. Then $\hugnK I$ is a two-sided ideal in $\hugnK I$ and furthermore, $\hugnK I= \hugnK I \hugnK$.

Clearly, it is enough to prove that $I \hugnK \subset \hugnK I.$

Viewing $\hugnK$ as a left $\hugnK$-module via left multiplication, we have that $\hugnK I$ is a $\hugnK$-submodule. Since the topology $\hugnK$ is complete, we have by <cit.> that $\hugnK I$ is a closed subset.

Let $i \in I$ and $x \in \hugnK$. Recall that assuming that $u_1,u_2 \ldots u_d$ is a free $R$-basis for $\mathfrak{g}$, we may write as $x=\sum_{\alpha \in \mathbb{N}^d} c_{\alpha}u^{\alpha}$, with $||p^{-n} c_{\alpha}|| \to 0$ as $|\alpha| \to \infty$. For $k \in \mathbb{N}$, let $x_k=\sum_{\alpha \in \mathbb{N}^d,|\alpha| \leq k} c_{\alpha}u^{\alpha}$. Since $I$ is a two-sided ideal, we obtain that $ix_k \in I \subset \hugnK I$.

Finally, we have $ix=i \lim_{k \to \infty} x_k=\lim_{k \to \infty} ix_k$. Since $\hugnK I$ is closed, we obtain $ix \in \hugnK I$ finishing the proof.

Let $I$ be a two-sided ideal in $\hugnK$ such that $\hugnK \ker {\chi_{\lambda}} \subset I$. Then there exists a two-sided ideal $J$ in $U(\mathfrak{g}_K)$ such that $I=\hugnK J$.

Let $\hat{M}=I\widehat{M(\lambda)}.$ We have by Theorem <ref> that there exists $M$ a submodule of $M(\lambda)$ such that $\hat{M}=\hugnK.M$. Further, we have by <cit.> that there exists $J$ a two-sided ideal $U(\mathfrak{g}_K)$ such that $JM(\lambda)=M$. By applying Lemma <ref> we obtain:

\begin{equation}
\begin{split}
(\hugnK J).\widehat{M(\lambda)}&=(\hugnK J) \hugnK. M(\lambda)\\
&=(\hugnK J). M(\lambda)=\hugnK. M=\hat{M},
\end{split}
\end{equation}

so $(\hugnK J)\widehat{M(\lambda)}=I\widehat{M(\lambda)}$. Let $J'=\hugnK J + I$, so that $J' \widehat{M(\lambda)}=I \widehat{M(\lambda)}$ and $I \subset J'$. We have by Lemma <ref> that $J'$ is also a two-sided ideal. Further, by combining Corollary <ref>, Corollary <ref> and Lemma <ref> we get $J'=I$, so $\hugnK J \subset I$. Applying the same strategy again, we obtain $\hugnK J=I$.

To finish the proof, we need one more lemma. This is probably well-known among the experts, but we have not been able to locate a reference.

Let $S \subset T$ two rings and let $I$ be a left ideal of $T$ generated by $X \subset S$. Then $I=T(I \cap S)$.

Let $J=I \cap S$. Obviously, we have $TJ \subset I$. On the other hand, we have $X \subset S$, $X \subset I$, so $X \subset J$. Therefore, $I=T.X \subset TJ$. The claim follows.

Let $\lambda:\pi^n\mathfrak{h} \to R$ be a $R$-linear dominant regular weight. Let $I$ be a two-sided ideal in $\hugnK$ with $\chi_{\lambda}$-central character. Then:

$$I=\hugnK(I \cap U(\mathfrak{g}_K)).$$

This follows immediately from Proposition <ref> and Lemma <ref>.

As a corollary, we obtain immediately:

Let $\lambda:\pi^n\mathfrak{h} \to R$ be a $R$-linear dominant regular weight. The maps:

\begin{equation}
\begin{split}
I &\mapsto I \cap U(\mathfrak{g}_K) \\
J & \mapsto \hugnK J
\end{split}
\end{equation}

induce inverse bijections between the set of two sided ideals in $\hugnK$ with $\chi_{\lambda}$ central character and the set of two sided ideals in $\hugnK$ with $\chi_{\lambda}$ central character.

We may also prove which ideal controls the annihilator of the simple affinoid module $\widehat{L(\mu)}$.

Let $\mu:\pi^n \mathfrak{h} \to R$ and assume that $\mu$ is $W$-linked to $\lambda$. Then:

$$\Ann(\widehat{L(\mu)})=\hugnK \Ann L(\mu).$$

Let $\hat{P}:= \Ann(\widehat{L(\mu)})$, $P=\Ann(L(\mu))$ and $J=\hat{P} \cap U(\mathfrak{g}_K)$. Then, we have by construction $P \subset J$.

We claim that $\hugnK P$ contains the annihilator of $\widehat{L(\mu)}$. We have by the proof of Lemma y<ref> that for all $p \in P$ and $x \in \hugnK$, there exist $q \in P$ and $y \in \hugnK$ such that $px=yq$. Therefore, we have for all $z \in \hugnK$ and $x \otimes l \in \hugnK \uset{U(\mathfrak{g}_K)} L$ that

$$zp.(x \otimes l)=z(px \otimes l)=zy(q \otimes l)=zy(1 \otimes q.l)=0,$$

so the claim is proven. Therefore, we obtain using Corollary <ref> that $P=J$ and so, $\hat{P}=\hugnK P$.

§.§ Characterisation of all two-sided ideals

We may now use an affinoid version of Quillen's Lemma to prove that a large class of two-sided ideals in $\hugnK$ is controlled by two-sided ideals in the classical enveloping algebra $U(\mathfrak{g})_K$.

We are now able to characterise all the primitive ideals in $\hugnK$ for any $n \in \mathbb{N}$.

Let $I$ be a primitive ideal in $\hugnK$. Then there exists a finite extension $L/K$ and a primitive ideal $J \in \hugnK \uset{K} L$ with $L$-rational central character such that:

$$I=J \cap \hugnK.$$

Further, this ideal $J$ is of the form $\Ann(\widehat{L(\lambda)})$ for some suitable $\lambda$.

We have by Theorem <ref> that $Z(\hugnK)$ is isomorphic with a Tate algebra. Further, we have by <cit.> that $I$ has some central character. Therefore, there exists $L/K$ finite extension such that $I \uset{K} L \subset \hugnK \uset{R} K$ has $L$-rational central character.

Let $e$ be the ramification index of $L/K$, $\mathcal{O}_L$ the ring of integers of $L$, $\pi'$ the uniformiser of $\mathcal{O}_L$ and $\mathfrak{g}'=\mathfrak{g} \uset{R} \mathcal{O}_L$. We have by <cit.> that $\hugnK \otimes L \cong \hugnL$. Finally, we have by <cit.> that there exists a prime ideal $J \in \hugnL$ such that $I=J \cap \hugnK$. Thus $J$ contains $I \uset{K} L$, so in particular it has an $L$-rational central character. The claim follows from Theorem <ref>.

Let $I$ be a two-sided ideal in $\hugnK$ and assume it has a central character $\chi:Z(\hugnK) \to \overline{K}$ generated by a dominant regular weight. Then $I$ is controlled by a two-sided ideal in $U(\mathfrak{g})_K$.

We have by the proof of Theorem <ref> that there exists a finite extension $L/K$ such that $I \uset{K} L$ has a $L$-rational central character. By passing to the Galois closure, if necessary, we may assume that $L/K$ is a Galois extension; let $\mathcal{G}=\Gal(L/K)$ denote the corresponding Galois group. Again, let $e$ be the ramification index of $L/K$,  $\mathcal{O}_L$ the ring of integers of $L$, $\pi'$ the uniformiser of $\mathcal{O}_L$ and $\mathfrak{g}'=\mathfrak{g} \uset{R} \mathcal{O}_L$. As before, it follows from <cit.> that $\hugnK \uset{K} L \cong \hugnL$.

Since $I$ is a two-sided ideal in $\hugnK$ and $L/K$ is finite, we get that $I \uset{K} L$ is a two-sided ideal in $\hugnK \uset{K} L \cong \hugnL$. Therefore, we have by Proposition <ref> that there exists $J$, a two-sided ideal in $U(\mathfrak{g'})_L$, such that $I \uset{K} L=\hugnL J$.

By construction, $I \uset{K} L$ is closed under the natural action of $\mathcal{G}$, therefore $J$ is also closed under the corresponding $\mathcal{G}$-action on $U(\mathfrak{g'})_L$. We have

\begin{equation}
U(\mathfrak{g'})_L \cong U(\mathfrak{g} \uset{R} \mathcal{O}_L) \uset{\mathcal{O}_L} L \cong U(\mathfrak{g}) \uset{R} \mathcal{O}_L \uset{ \mathcal{O}_L} L \cong U(\mathfrak{g}) \uset{R} L \cong U(\mathfrak{g})_K \uset{K} L.
\end{equation}

Since $L/K$ is a finite Galois extension, we have by Galois descent and the same arguments as in <cit.> that $J=J_0 U(\mathfrak{g'})_L$ for some two-sided ideal $J_0$ in $U(\mathfrak{g})_K$. We have

\begin{equation}
I \hugnL= I \uset{K} L= J \hugnL = (J_0 U(\mathfrak{g'})_L) \hugnL=J_0 \hugnL=(J_0 \hugnK) \uset{K} L.
\end{equation}

Therefore, by taking $\mathcal{G}$-invariants and taking into account that $I$ and $J_0 \hugnK$ are fixed by the $\mathcal{G}$-action, we obtain

\begin{equation}
I=(I \uset{K} L)^{\mathcal{G}}=((J_0 \hugnK) \uset{K} L)^{\mathcal{G}}=J_0 \hugnK.
\end{equation}

In conclusion, $I$ is controlled by $J_0$ and the claim is proven.

[1]
Konstantin Ardakov.
Equivariant D-modules on rigid analytic spaces.
<http://people.maths.ox.ac.uk/ardakov/EqDcap.pdf>, 2018.

[2]
Konstantin Ardakov and Simon Wadsley.
On irreducible representation of compact $p$-adic analytic groups.
Annals of Mathematics, 178:453–557, 2013.

[3]
Konstantin Ardakov and Simon Wadsley.
Verma modules for Iwasawa algebras are faithful.
Münster Journal of Mathematics, 7(1):5–26, 2014.

[4]
Alexandre Beilinson and Joseph Bernstein.
Localisation de $\mathfrak{g}$-modules.
C. R. Acad. Sci., Paris, 292:15–18, 1981.

[5]
Alexandre Beilinson and Victor Ginzburg.
Wall-crossing functors and $\mathcal{D}$-modules.
Representation Theory, 3, 1999.

[6]
Michel van der Bergh.
Some generalities on $G$-equivariant quasi-coherent
$\mathcal{O}_X$ and $\mathcal{D}_X$-modules.

[7]
Joseph Bernstein, Izrail Gel'fand, and Sergei Gel'fand.
Category of $\mathfrak{g}$-modules.
Functional Analysis and its applications, 10(2):1–8, 1976.
English translation.

[8]
Joseph Bernstein and Sergei Gel'fand.
Tensor products of finite and infinite dimensional representations of
semisimple Lie algebras.
Compositio Mathematica, 41:245–285, 1980.

[9]
Pierre Berthelot.
$\mathcal{D}$-modules arithmétiques I. Opérateurs
différentiels de niveau fini.
Annales scientifiques de l'École Normale Supérieure,
29(2):185–272, 1996.

[10]
Andreas Bode.
Completed tensor products and a global approach to p-adic analytic
differential operators.
Mathematical Proceedings of the Cambridge Philosophical
Society, 167(2):1–28, 2019.

[11]
Walter Borho and Jean-Luc Brylinski.
Differential operators on homogeneous spaces. III.
Inventiones Mathematicae, 80(1), 1985.

[12]
Siegfried Bosch.
Lectures on Formal and Rigid Geometry.
Springer, 2015.

[13]
Siegfried Bosch, Ulrich Güntzer, and Reinhold Remmert.
Non-archimidean Analysis.
Springer-Verlag, 1984.

[14]
Gaetan Chenevier.
Affinoid algebras and Tate’s $p$-adic analytic spaces : a brief

[15]
Keith Conrad.
Galois descent.

[16]
Christian Tobias Féaux de Lacroix.
Einige Resultate über die topologischen Darstellungen $p$-adischer
Liegruppen auf unendlich dimensionalen Vektorräumen über einem $p$-adischen
Körper .
Schriftenreihe Math. Inst. Univ. Münster 3. Ser., 1999.

[17]
Jacques Dixmier.
Enveloping Algebras.
North-Holland Publishing Company, 1977.

[18]
Michel Duflo.
Sur la classification des ideaux primitifs dans l’alg`ebre
enveloppante d’une alg`ebre de Lie semisimple.
Annals of Mathematics, 105:107–120, 1977.

[19]
Victor Ginzburg.
On primitive ideals.
Selecta Mathematica, 9(3):379–407, 2003.

[20]
Ryoshi Hotta, Kiyoshi Takeuchi, and Toshiyuki Tanisaki.
$D$-modules, Perverse Sheaves and Representation Theory, volume
236 of Progress in Mathematics.
Birkhäuser Boston Inc, 2000.

[21]
Li Huishi and Freddy van Oystaeyen.
Zariskian Filtrations.
Kluwer Academic Publishers, 1996.

[22]
James Humphreys.
Representations of Semisimple Lie Algebras in the BGG category
$\mathcal{O}$, volume 94 of Graduate Studies in Mathematics.
Americal Mathematical Society, 2008.

[23]
Jens Carsten Jantzen.
Representations of Algebraic Groups, volume 107 of Mathematical Surveys and Monographs.
American Mathematical Society, 2 edition, 2003.

[24]
Anthony Joseph.
Dixmier's problem for Verma and principal series submodules.
Journal of the London Mathematical Society, 20(2):193–204,

[25]
John McConnell and Chris Robson.
Non-commutative Noetherian Rings, volume 30 of Graduate
studies in Mathematics.
American Mathematics Society, 2000.

[26]
Dragan Milicic.
Lectures on derived categories.
<https://www.math.utah.edu/ milicic/Eprints/dercat.pdf>.

[27]
Susan Montgomery.
Hopf Algebras and Their Actions on Rings, volume 82 of Conference Series in Mathematics.
American Mathematical Society, 1993.

[28]
Constantin Nastasecu and Freddy van Oysten.
Graded and Filtered Rings and Modules, volume 758 of Lecture Notes in Mathematics.
Springer-Verlag, 1979.

[29]
Nicolae Popescu.
Abelian categories with applications to rings and modules.
L.M.S. Monographs. Academic Press Inc, 1973.

[30]
Peter Schneider.
Nonarchimidean Functional Analysis.
Springer Monographs in Mathematics. Springer-Verlag, 2001.

[31]
The Stacks Project Authors.
Stacks Project.
<https://stacks.math.columbia.edu/>, 2020.

[32]
Ioan Stanciu.
A geometric proof of Duflo's theorem.

[33]
Ioan Stanciu.
Towards affinoid Duflo's theorem I: Lie algebroids and twisted
differential operators.
To appear in Mathematical Proceedings of the Cambridge Philosophical

[34]
Ioan Stanciu.
Affinoid enveloping algebras and their representations, 2020.
D.Phil Thesis.

[35]
Charles Weibel.
The $K$-book: an Introduction to Algebraic $K$-theory, volume
145 of Graduate Studies in Mathematics.
American Mathematical Society, 2013.