# Using frequency attention to make adversarial patch powerful against person
detector ††thanks:  The first author and the second author have the same
contribution to the work.

Xiaochun Lei
School of Computer Science and Information Security
Guilin University of Electronic Technology
China, GuiLin 541010
<EMAIL_ADDRESS>
&Chang Lu
School of Computer Science and Information Security
Guilin University of Electronic Technology
China, GuiLin 541010
<EMAIL_ADDRESS>
&Zetao Jiang∗
School of Computer Science and Information Security
Guilin University of Electronic Technology
China, GuiLin 541010
<EMAIL_ADDRESS>
&Zhaoting Gong
School of Computer Science and Information Security
Guilin University of Electronic Technology
China, GuiLin 541010
<EMAIL_ADDRESS>
&Xiang Cai
School of Computer Science and Information Security
Guilin University of Electronic Technology
China, GuiLin 541010
<EMAIL_ADDRESS>
&Linjun Lu
School of Computer Science and Information Security
Guilin University of Electronic Technology
China, GuiLin 541010
<EMAIL_ADDRESS>

###### Abstract

Deep neural networks (DNNs) are vulnerable to adversarial attacks. In
particular, object detectors may be attacked by applying a particular
adversarial patch to the image. However, because the patch shrinks during
preprocessing, most existing approaches that employ adversarial patches to
attack object detectors would diminish the attack success rate on small and
medium targets. This paper proposes a Frequency Module(FRAN), a frequency-
domain attention module for guiding patch generation. This is the first study
to introduce frequency domain attention to optimize the attack capabilities of
adversarial patches. Our method increases the attack success rates of small
and medium targets by 4.18% and 3.89%, respectively, over the state-of-the-art
attack method for fooling the human detector while assaulting YOLOv3 without
reducing the attack success rate of big targets.

_K_ eywords Adversarial attack $\cdot$ Frequency attention $\cdot$ Object
detection $\cdot$ Deep learning

##  1 Introduction

Deep neural networks (DNNs) have garnered much success in computer vision.
DNNs have proven to be quite effective in data-driven computer vision tasks
and multiple areas such as autopilot, aviation, and medicine. However, DNNs
have shown flaws susceptible to perturbation by adversarial samples in image
classification, object tracking, and object detection. Previous researches[1,
2, 3] explored attack classification networks. In the last years, several
studies[4, 5, 6, 7] have recently demonstrated that object detection networks
are similarly susceptible to perturbation by adversarial samples. Thys et
al.[4] create a printed adversarial patch that successfully attacked the
object detector YOLOv2[8]. Liu et al.[5] successfully render the object
detection network incapable of recognizing objects and generating incorrect
prediction categories. Wu et al.[6] formed wearable clothes for eluding the
object detector. They use one adversarial patch to attack one-stage[9] and
two-stage[10] object detectors. Wu et al.[6] create wearable clothes for
evading the object detector. Xu et al.[7] use a thin-plate spline (TPS) base
transformer to build a more robust patch that can withstand non-rigid
deformation caused by a moving person’s posture changes.

Furthermore, network input size, JPEG compression[1], and network processing
can all have impacted the efficacy of adversarial patches. When the picture is
scaled, the loss of high-frequency signals significantly decreases faster than
the loss of low-frequency signals. The reduction in picture size resulted in
an overall loss of high-frequency signals, leading to imbalanced
representations. High-frequency information is also discarded by JPEG
compression. As described, using patches to attack the object detector has an
inherent difficulty: while patching, we frequently must shrink the patches and
then paste them on the objects in the image. The patch’s attack ability is
reduced due to the reduction in pixels caused by sampling.

This article built the Frequency Module(FRAN), a frequency attention module,
to guide the patch generation process. This module can determine the relative
importance of various locations within the patch frequency domain, allowing
the patched attack to rely on low-frequency signals. The attack success rates
of medium and small objects in our method are 3.89% and 4.18%, respectively,
higher than the current best attack algorithm[4], which uses the patch to fool
YOLOv3 while detecting people without affecting the attack success rate of
large objects.

Our contributions are summarized as follows:

  * 1.

We used a frequency attention module to guide the patch generation process in
the frequency domain, increasing the adversarial patch’s attack success rate
against small and medium objects.

  * 2.

Our method raises the patch’s robustness when defending against adversarial
attacks using JPEG compression technique.

  * 3.

We proposed three new indicators, ASRm, ASRl, and ASRs, to measure the patch’s
attack effect on objects of various sizes.

The rest of this paper is structured as follows: Section 2 goes over the
related work on adversarial attacks. Section 3 discusses how we generate
patches and how we use the frequency attention module to guide the process of
patch generation. In Section 4, we test the efficacy of the patch. In Section
5, we reach a conclusion and look at the future directions of our research.

##  2 Related work

Attacks against object detectors have grown exceedingly prevalent due to the
widespread use of object detection networks in various areas. In this section,
we first go over the related works of the object detection network and the
attacks against the object detection network, and then we go over the present
challenges.

###  2.1 Object detection

The popular one-stage object detector and two-stage object detector are the
most common types of modern detectors. The two-stage detector splits the
detection task into two parts. In the first stage, the objects in the picture
are located. And then, the object detector outputs the categories of the
located objects acquired in the first stage. Faster RCNN [10] is a common two-
stage detection network. It extracts the region of interest (ROI) using RPN,
then produces and classifies detection boxes based on the ROI. Although two-
stage object detectors have the advantage of accuracy, the detection speed of
two-stage object detectors is often slower than that of one-stage object
detectors since the prediction process is divided into two stages.

The one-stage detector uses the entire picture as input and outputs the
position and category of the detection boxes directly in the output layer.
Yolo-Series algorithms [8, 11, 9] are exceptionally representative one-stage
object detectors. To acquire detection boxes, they do not need to extract ROI.
Yolo-Series methods have been the most often used object detectors due to
their quick detection speed and good detection effect. In this paper, we
target YOLOv3 [9] as the main victim detector.

###  2.2 Adversarial attacks on object detector

According to the methods of adversarial attack, the job of attacking the
object detector can be separated into two groups. One group is that the object
detector can be attacked by rendering an adversarial patch over all of the
objects in the picture. The other is to attack the detectors by changing the
pixel value of the input image directly.

Thys et al.[4] first proposed using the adversarial patch to attack the object
detection network in 2019. They use the loss function to guide the patch
generation process, gradient descent to update the patch, and eventually,
disable YOLOv2[8] from detecting patched objects. Moreover, Thys et al. print
out the patches to fool the object detector in the physical world by holding a
small cardboard plate in front of their body. Liu et al.[5] interfere with the
detection results of the entire picture by affixing patches to the image’s
edge angle and implemented the object-vanishing and object-mislabeling attacks
by designing different loss functions in the same year. Wu et al.[6] use one
adversarial patch to attack one-stage[8, 9] and two-stage[10] object
detectors. They design wearable clothes that could attack the object detector
in the physical world by printing the patch on clothes. Furthermore, they
explore how patches’ attack ability can be applied among different detectors.
According to their research, the patch’s attack has strong transferability
between networks with the same backbone but is poor between one-stage and two-
stage object detection networks. Nevertheless, there are several issues when
using adversarial patches to attack surveillance systems in the physical
world. One issue is that the object detector may observe the adversarial
patches from different viewpoints in the physical world. There is much work[7,
12, 13] to be done in order for the patch to be sufficiently robust from
several viewpoints. Xu et al.[7] utilize a TPS base transformer to model the
non-rigid deformation of clothing induced by a moving person’s posture changes
to create a more robust adversarial T-shirt. Lennon et al.[13] apply an affine
transformation to generate distinct viewpoints of the same patch, fuse the
results of computation generated by different viewpoints patches, and then
update the patch using gradient descent. As a result, the created patch is
more robust from various viewpoints.

In previous research, people directly modified the picture pixels to attack
the object detection network. This attack method originates from the study [1]
that concerned attack classification networks, and its primary purpose is to
create a disturbance that is difficult to notice by humans and causes the
object detector to be disturbed at the same time. DAG[14] is proposed in Xie
et al.’s work to attack the object detection network. It focuses on attacking
Faster RCNN[10]. They first give each object an adversarial label selected
randomly from other incorrect classes. In the next step, the image will be
updated based on the detector’s output. There was also some work[15] against
the transferability of this attack method across networks. According to the
latest research, [16] can attack one-stage target detection networks and two-
stages as well by changing the picture’s pixels. Their work describes three
Targeted Adversarial Objectness Gradient (TOG) attack methods that can induce
object-vanishing, object-fabrication, and object-mislabeling attacks in state-
of-the-art object detectors.

There is an inherent difficulty with the strategy of using patches to attack
the object detector: while patching, we frequently need to shrink the patches
and then paste them on the objects in the image. The reduction in pixels
caused by sampling will diminish the attack ability of the patches. As a
result, the effect of current attack approaches using the adversarial patch
for small and medium target objects needs to be improved. We guide the
frequency domain information of the patch through the frequency attention
module, such that the patch’s attack ability depends more on the low-frequency
signal. Because the low-frequency signal of the picture will lose less than
the high-frequency signal during image shrinking, the patch’s aggressiveness
will be preserved even more.

Figure 1: A overview of the framework. Figure 2:  Frequency module. First, the
patch is converted into YCbCr color space. Then, the patch is sent into FFT
module to be converted into a spectrum diagram. After that, the spectrum
diagram multiplies the frequency attention mask. The patch is then delivered
to IFFT module, translating from YCbCr to RGB color space to generate FRAN’s
output.

##  3 Generate more robust adversarial patch

The current section describes in detail our method for creating adversarial
patches. Based on the problems outlined in Section 2, we present a solution
that employs a frequency attention module to guide the patch generating
process. Our method directs the learning of the patch’s frequency information
by FRAN. Figure 1 illustrates the primary process of generating the patche
$\mathcal{P}\in\mathbb{R}^{w\times h\times 3}$. In Figure 1, Detector is the
victim detector[6]. Frequency Module(FRAN) is the frequency domain attention
module and Data is the training data set. We first add the patch and FRAN
parameters to the optimizer and freeze the detector network parameters before
training. We solely use gradient descent to update the patch’s pixel value and
FRAN’s parameters during the training procedure. In the training procedure,
the patches begin by walking through FRAN with the given data set. The
transformation module will render the rescaled patch over every person from
the ground truth in the input image. The image is then fed into the victim
detector, and the loss function value is calculated based on the detection
results. Finally, we update the patch’s pixel value and the FRAN’s parameters
based on the calculation result of the loss function. Our ultimate goal is to
create patches that minimize the detection success rate of pedestrians of
various sizes throughout a dataset.

###  3.1 Frequency module

FRAN is a frequency domain attention module that assigns different weights in
the frequency domain. Figure 2 depicts the construction of FRAN. The FRAN’s
general procedure entails converting the patch to the frequency domain using
Fast Fourier Transform (FFT)[17] and multiplying it by the attention mask. The
output of FRAN is obtained by applying an Inverse Fast Fourier Transform
(IFFT) to the results obtained in the previous step.

More formally, we take $\mathcal{F}_{\theta}$ as an attention function in the
frequency domain. The attention function takes the patch
$\mathcal{P}\in\mathbb{R}^{w\times h\times 3}$ as input and
$\theta\in\mathbb{R}^{w\times h\times 3}$ as the parameter of the attention
module. $FFT(x)$ is the fast fourier transform while $FFT^{-1}(x)$ represents
the inverse fast fourier transform. $\mathcal{Y}(x)$ transforms the patch from
RGB to YCbCr color format. $\mathcal{Y}^{-1}(x)$ is the inverse process of
$\mathcal{Y}(x)$ FRAN’s output $\mathcal{F}_{\theta}(\mathcal{P})$ can be
stated below:

$\mathcal{F}_{\theta}(\mathcal{P})=\mathcal{Y}^{-1}(FFT^{-1}(FFT(\mathcal{Y}(\mathcal{P}\odot\theta))))$
(1)

Because the image’s high-frequency signal generally loss more than the low-
frequency signal during scaling. Consequently, the attack success rate for
small and medium target objects can be enhanced if the patch’s attack ability
depends more on the low-frequency signal.

###  3.2 TV loss

TV loss[4] represents the total variation in the image, resulting in a patch
with smooth color transitions and minimal noise. The following formula shows
how TV loss is calculated in the previous works[4, 6, 7] of attacking object
detectors with adversarial patches.

$L_{tv}=\sum_{i,j}\sqrt{\left(\left(p_{i,j}-p_{i+1,j}\right)^{2}+\left(p_{i,j}-p_{i,j+1}\right)^{2}\right.}$
(2)

The $p_{i,j}$ represents the pixel in patch $\mathcal{P}$. This approach only
calculates the distance between each pixel and the pixel to its right and the
pixel below it. To better smooth the resulting patch, we compute the distance
between each pixel and the eight pixels. Thus, we calculate TV loss $TVr$ as
following:

$TV_{r}=\sum_{i,j}\sqrt{\sum_{k\in\\{-1,0,1\\}}\sum_{m\in\\{-1,0,1\\}}(p_{i,j}-p_{i+k,j+m})^{2}}$
(3)

$TV_{r}$ can better measure the smoothness of a picture since it measures the
distance of surrounding pixels among each pixel.

###  3.3 Loss function

Our optimization goal is divided into two parts:

  * •

$TV_{r}$: The image’s total variance; this loss guarantees that the image is
smooth and does not cause excessive noise. For further information, see
Section 3.2.

  * •

$L_{obj}$: The highest objectness score from the prediction. As previously
mentioned [4, 6], this loss can lower the detector output’s objectness score
while detecting the person. Set $\boldsymbol{x}$ to be the input image and
$\mathcal{P}$ to be the patch. The transformation function
$\mathcal{T}(\boldsymbol{x},\mathcal{P})$ accepts photos and patches as input
and scales and affixes the patches to the person in the image. The frequency
attention function $\mathcal{F}_{\theta}$ was discussed in Section 3.1. A
detector takes a patched image
$\mathcal{T}(\boldsymbol{x},\mathcal{F}_{\theta}(\mathcal{P}))$ as its input
and outputs the result with objectness scores
$\mathcal{D}_{i}(\mathcal{T}(\boldsymbol{x},\mathcal{F}_{\theta}(\mathcal{P})))$
is defined as follows:

$L_{obj}=\sum_{i}\mathcal{D}_{i}(\mathcal{T}(\boldsymbol{x},\mathcal{F}_{\theta}(\mathcal{P})))$
(4)

Our total loss function is made up of these two parts:

$L=L_{obj}+\alpha TV_{r}$ (5)

We combine the two losses, scaled by empirically established factors $alpha$
and use Adam[18] to optimize the loss.

##  4 Experiments and results

Figure 3: The effectiveness of an adversarial patch in evading YOLOv3
detection. We classify the images from the test set into four groups based on
the size and number of people. Except for the last rows, each row employs a
distinct attack method. First row: use FRAN to direct the generation of
adversarial patches in the first seven epochs. Secend row: use FRAN to direct
the generation of adversarial patches in the first seven epochs but did not
convert the patch to YCbCr color space. Third row: use FRAN throughout the
generating process. Fourth row: use the baseline[4] method to generate the
patch. Fifth row: use random generated patch. Sixth row: original image
without patch

We demonstrate the efficiency of our strategy in this section by comparing our
attack effect against several object detectors. While there are many
researches that have optimized the aggressiveness of the patch, their research
has focused on optimizing the aggressiveness of the patch in the physical
world[6, 7, 13] or generating new attack effects[5, 16]. The core idea to
generate the adversarial patch of those researches is still based on the
baseline[4]. Thus, we choose the method proposed in [4] as the baseline. We
refer to the patch in our methods as $\mathcal{P}_{1}$ and the patch generated
by the baseline as $\mathcal{P}_{2}$.

The rest of this section is structured as following. In Section 4.1, we
introduce the basic settings of the experiment, including the data set, the
attacked object detectors and the evaluation index. Section 4.2 introduces our
method for attacking objects of various sizes and different detectors then
evaluates its robustness against JPEG compression resistance. Finally, we use
ablation experiments to illustrate the efficiency of our strategy. Figure 3
depicts several examples of attacking the object detector. We compared four
attack methods in the figure. The first three methods employ the FRAN to guide
the patch generation process, and their impacts on small and medium objects
are more significant than the Baseline. In the situation of object overlap in
a multi-person scene, our method can also have a high attack success rate. The
last two lines of the image show the results of the object detector when
detecting the original image and the image with a random patch. People in
those images can be successfully detected.

###  4.1 Experimental setup

####  4.1.1 Evaluation metrics

This section will introduce the evaluation metrics ASR[19], ASRs, ASRm, and
ASRl to analyze adversarial patch attacks.

The attack success rate (ASR) [19] is a metric to better evaluate the attack
object detector’s performance. [19] proposes three different types of ASRs.
The ASR is used in this work to counter the object-vanishing attack, which is
defined as following:

$ASR=\frac{\sum_{\boldsymbol{x}\in\mathcal{D}}\sum_{\hat{\boldsymbol{o}}\in\hat{\mathcal{O}}(\boldsymbol{x})}\mathbb{1}\left[\neg\exists\hat{\boldsymbol{o}}^{\prime}\in\hat{\mathcal{O}}\left(\boldsymbol{x}^{\prime}\right)\left(\operatorname{IOU}\left(\hat{\boldsymbol{o}},\hat{\boldsymbol{o}}^{\prime}\right)\leq
t_{\mathrm{IOU}}\right)\right]}{\sum_{\boldsymbol{x}\in\mathcal{D}}\|\hat{\mathcal{O}}(\boldsymbol{x})\|}$
(6)

If $\mathbb{1}[condition]$ is 1 or 0, the condition is satisfied. We consider
$\boldsymbol{x}$ as the input image, $\mathcal{D}$ as the set of all
$\boldsymbol{x}$. $\boldsymbol{x^{\prime}}$ represents the image after
adversarial disturbance. We use $\hat{\boldsymbol{o}}$ to denote a ground
truth box and $\hat{\boldsymbol{o^{\prime}}}$ to denote the predicted box. Let
$\hat{\boldsymbol{O}}{\boldsymbol{(x)}}$ be the set of ground-truth objects of
$\hat{\boldsymbol{o}}$. Similarly, let
$\hat{\boldsymbol{O}}{\boldsymbol{(x^{\prime})}}$ be the set of predicted
objects of $\hat{\boldsymbol{o^{\prime}}}$.
$IOU(\hat{\boldsymbol{o}},\hat{\boldsymbol{o}}^{\prime})$ represents the
intersection over union of $\boldsymbol{o}$ and $\boldsymbol{o^{\prime}}$.
$t_{IOU}$, a specified super parameter, represents the IOU threshold. For the
calculations in the experiment, we choose 0.5[19].

However, calculating ASR alone does not account for the attack effect of
adversarial patches on objects of numerous sizes; consequently, we proposed
ASRs, ASRm, and ASRl based on the ideas of APs, APm, and APl [20]. ASRs, ASRm,
and ASRl represent the attack success rates of attacks on small, medium, and
large objects, respectively.

We utilized height to differentiate between three distinct item sizes. Let
$\mathcal{H}$ stand for a height function, $\mathcal{H}(\hat{\boldsymbol{o}})$
for the detection box’s height, and $\mathcal{H}(\boldsymbol{x})$ for a
picture’s height. Next, the height ratio $\epsilon$ can be defined as follows:

$\epsilon=\frac{\mathcal{H}(\hat{\boldsymbol{o})}}{\mathcal{H}(\boldsymbol{x})}$
(7)

We made two boundaries $e_{0}$ and $e_{1}$ to separate detection boxes of
different sizes. Small objects have an $e$ value less than $e_{0}$, while
medium objects have an $e$e value between $e_{0}$ and $e_{1}$. A big object is
one with an $e$e larger than $e_{1}$. In our research, $\epsilon_{0}$ is
0.3,and $\epsilon_{1}$ is 0.6. While dividing the data set, this two values
can balance the number of three sizes of objects.

####  4.1.2 Data collection

We used two datasets when training the object detector: COCO[20] and VOC[21].
Similarly, we chose 16000 images from COCO dataset to generate the adversarial
patch. After randomly shuffling the dataset, we used 12000 images as the
training dataset and 4000 images as the test dataset. There is at least one
person in each of the images. The number of the small, medium and big size of
human boxes is nearly the same in the training and test datasets. We utilized
ASR, ASRs, ASRM and ASRl described in Section 4.1.1 as the evaluation metrics
of the attack effectiveness.

####  4.1.3 Victim object detectors

Our work selected YOLOv3[9], YOLOv4[22] and RetinaNet[23] as the victim
detectors, and the input image size is $3\times 612\times 612$. We first
trained pre-training models on the COCO dataset and then trained the final
models using the VOC dataset.

####  4.1.4 Implementation details

We randomly initialized a $3\times 950\times 950$ patch in the patch
generation process. We used FRAN to guide patch production in the first seven
training epochs. Moreover, Adam[18] was used in our experiments. For training,
we used a single Tesla A100. Our batch size in the training process was four,
and the learning rate was set at 0.005. Each training stoped after about 45
hours when ASR rarely rises. We used the patch with the highest ASR in the
test dataset as the final training result.

###  4.2 Results

Our method achieved 93.68% ASR when attacking YOLOv3[9]. Simultaneously, our
method successfully raised ASRm and ASRs without affecting ASRl. Our ASR
improved by 2.56%, ASRm increased by 3.89%, and ASRl amplified by 4.18%
compared with the baseline[4].

####  4.2.1 Attack on different size objects

In this paper, we hope that the patch can successfully attack objects of
various sizes, which means that it must remain adversarial even after being
shrunk in several times. The most commonly used image reduction algorithm is
bilinear interpolation. Because this algorithm is a Low-pass filter, patch’s
high-frequency information will be lost during the reduction process. As a
result, patch attack capability is dwindling. We used FRAN to guide the patch
generation process, and the experimental results demonstrate the workability
of the method. ASRm and ASRs can achieve 96.41% and 87.21% for small objects
using the $mathcal{P}_{2}$ attack the detector. Compared to the baseline, the
attack success rate with $\mathcal{P}_{1}$ is only 92.52% and 83.03%. For
small objects, ASRl of $\mathcal{P}_{1}$ and $\mathcal{P}_{2}$ is 96.75% and
96.98%, respectively. We improved the attack success rate of small and medium
objects while not affecting large objects’ attack success rate. Figure 4
depicts the spectrum attention map when attack YOLOv3. Because Cb and Cr
channels in YCbCr color space represent color offset, we only show Y channel’s
frequency attention mask.

Figure 4: Frequency attention mask of the patch.

####  4.2.2 Attack against different object detectors

In this section we compared the result on three object detectors: YOLOv3[9],
YOLOv4[22] and RetinaNet[23]. For all these detectors, we used the same
dataset and the same training process as described in Section 4.1.3. The
results were displayed in the table 2.

Table 1: The ASR (%) of adversarial patches generated from Ours, Ours(non-YCbCr), Ours(keep) and baseline[4] in digital-world against YOLOv3. FRAN is the option of whether to use the frequency domain attention mask, YCbCr represents whether to convert the patch into YCbCr color space, Keep use FRAN indicates whether the frequency attention mask is used to guide the generation of patches along all the training process. method | FRAN | YCbCr | Keep use FRAN | ASR(%) | ASRl(%) | ASRm(%) | ASRs(%)
---|---|---|---|---|---|---|---
Ours | $\checkmark$ | $\checkmark$ |  | 93.68 | 96.75 | 96.41 | 87.21
Ours(non-YCbCr) | $\checkmark$ |  |  | 85.33 | 89.27 | 92.07 | 78.93
Ours(keep) | $\checkmark$ | $\checkmark$ | $\checkmark$ | 88.02 | 94.29 | 90.88 | 77.70
Baseline |  |  |  | 91.12 | 96.98 | 92.52 | 83.03
Random |  |  |  | 21.76 | 23.62 | 16.60 | 25.01
Clean |  |  |  | 17.83 | 19.26 | 13.61 | 20.69
Table 2: The ASR(%) against different object detectors. Attacking three object detectors separately and comparing the effect of the two methods (Ours, Baseline[4]) Detector | ASR(%) | ASRl(%) | ASRm(%) | ASRs(%)
---|---|---|---|---
YOLOv3(Ours) | 93.68 | 96.75 | 96.41 | 87.21
YOLOv3(Baseline) | 91.18 | 96.98 | 92.52 | 83.03
RetinaNet(Ours) | 84.31 | 90.37 | 85.94 | 75.55
RetinaNet(Baseline) | 81.78 | 90.11 | 80.85 | 72.99
YOLOv4(Ours) | 63.57 | 70.43 | 62.15 | 57.12
YOLOv4(Baseline) | 61.44 | 70.53 | 56.14 | 53.34

###  4.3 Ablation Study

This section performed additional experiments to better understand our
method’s robustness. In the first set of experiments (clean), the images were
used without a patch. In the second set of experiments (random), the images
were used with a random noise patch. The third set of experiments (baseline)
employed the baseline[4] method. The fourth set of experiments
(Ours(nonYCbCr)) utilizes FRAN without converting it to YCbCr color space. The
fifth set of experiments (Ours(keep)) used FRAN throughout the generating
process. The sixth set of experiments (Ours) only utilized FRAN in the first
seven epochs. The results of ablation experiments were depicted in table 1.

####  4.3.1 Robustness against JPEG compression

According to Ian et al., JPEG compression[1], which removes the image’s high-
frequency signals, can significantly reduce the perturbability of attacks. The
adversarial image’s effectiveness can be lowered by JPEG compression, which
removes the image’s high-frequency signals.

To identify how JPEG compression affects adversarial patch attacks, we saved
the patch in JPEG format and reloaded it to calculate their attack success
rates on the test dataset. The results were displayed in the table 3.

Table 3: The impact of JPEG compression on attacks Methods | ASR(%) | ASRl(%) | ASRm(%) | ASRs(%)
---|---|---|---|---
Ours | 93.68 | 96.75 | 96.41 | 87.21
Ours(JPEG) | ($\downarrow$5.65)88.03 | ($\downarrow$2.45)94.30 | ($\downarrow$5.53)90.88 | ($\downarrow$9.51)77.70
Baseline[4] | 91.18 | 96.98 | 92.52 | 83.03
Baseline[4](JPEG) | ($\downarrow$7.63)83.55 | ($\downarrow$4.03)92.95 | ($\downarrow$7.55)84.97 | ($\downarrow$11.81)71.12

The experiment results reveal that our method outperforms the baseline when
attacking small and medium-sized objects. The attack success rate can be
increased by directing patch creation with FRAN. However, the attack success
rate decreases if FRAN is used throughout the training process. The reason is
that FRAN suppressed frequency information excessively during the later
training period, reducing patch aggression. So we chose to use FRAN duing the
first several epochs. When attacking different detectors we will choose
diiferent epoch to stop using FRAN. At the same time, converting the patch
into YCbCr color space and extracting frequency information using Fourier
transform during the training phase result in a patch with a greater attack
impact.

##  5 Conclusion and Future Work

A frequency attention module is proposed in this work to guide the patch
generating process. When attacking the YOLOv3 object detector, our attack
approach has a success rate of 93.68%. The attack success rate of medium and
small targets has improved without compromising the attack success rate on big
targets. Our findings show that frequency attention can control the frequency
distribution when creating patches, resulting in more robust patches.

In the future we would like to extend this work by making it more powerful.
One way to do this is optimizing the generating process of frequency attention
map.(i.e. use a generate model to produce the frequency attention map) Another
way is to optimize the training process of frequency attention module. Our
current method will suppress too much frequency information, using drnamic
weight might improve upon this.

## References

  * [1] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy.  Explaining and harnessing adversarial examples.  arXiv preprint arXiv:1412.6572, 2014.
  * [2] Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio.  Adversarial machine learning at scale.  ArXiv, abs/1611.01236, 2017.
  * [3] Buu Phan, Fahim Mannan, and Felix Heide.  Adversarial imaging pipelines.  2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 16046–16056, 2021.
  * [4] Simen Thys, Wiebe Van Ranst, and Toon Goedemé.  Fooling automated surveillance cameras: Adversarial patches to attack person detection.  2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), pages 49–55, 2019.
  * [5] Xin Liu, Huanrui Yang, Ziwei Liu, Linghao Song, Yiran Chen, and Hai Helen Li.  Dpatch: An adversarial patch attack on object detectors.  arXiv: Computer Vision and Pattern Recognition, 2019.
  * [6] Zuxuan Wu, Ser-Nam Lim, Larry S Davis, and Tom Goldstein.  Making an invisibility cloak: Real world adversarial attacks on object detectors.  In European Conference on Computer Vision, pages 1–17. Springer, 2020.
  * [7] Kaidi Xu, Gaoyuan Zhang, Sijia Liu, Quanfu Fan, Mengshu Sun, Hongge Chen, Pin-Yu Chen, Yanzhi Wang, and Xue Lin.  Adversarial t-shirt! evading person detectors in a physical world.  In European conference on computer vision, pages 665–681. Springer, 2020.
  * [8] Joseph Redmon and Ali Farhadi.  Yolo9000: Better, faster, stronger.  2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 6517–6525, 2017.
  * [9] Joseph Redmon and Ali Farhadi.  Yolov3: An incremental improvement.  ArXiv, abs/1804.02767, 2018.
  * [10] Shaoqing Ren, Kaiming He, Ross B. Girshick, and Jian Sun.  Faster r-cnn: Towards real-time object detection with region proposal networks.  IEEE Transactions on Pattern Analysis and Machine Intelligence, 39:1137–1149, 2015.
  * [11] Joseph Redmon, Santosh Kumar Divvala, Ross B. Girshick, and Ali Farhadi.  You only look once: Unified, real-time object detection.  2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 779–788, 2016.
  * [12] Fred L. Bookstein.  Principal warps: Thin-plate splines and the decomposition of deformations.  IEEE Trans. Pattern Anal. Mach. Intell., 11:567–585, 1989.
  * [13] Max Lennon, Nathan G. Drenkow, and Philippe Burlina.  Patch attack invariance: How sensitive are patch attacks to 3d pose?  2021 IEEE/CVF International Conference on Computer Vision Workshops (ICCVW), pages 112–121, 2021.
  * [14] Cihang Xie, Jianyu Wang, Zhishuai Zhang, Yuyin Zhou, Lingxi Xie, and Alan Loddon Yuille.  Adversarial examples for semantic segmentation and object detection.  2017 IEEE International Conference on Computer Vision (ICCV), pages 1378–1387, 2017.
  * [15] Xingxing Wei, Siyuan Liang, Xiaochun Cao, and Jun Zhu.  Transferable adversarial attacks for image and video object detection.  In IJCAI, 2019.
  * [16] Ka-Ho Chow, Ling Liu, Margaret Loper, Juhyun Bae, Mehmet Emre Gursoy, Stacey Truex, Wenqi Wei, and Yanzhao Wu.  Adversarial objectness gradient attacks in real-time object detection systems.  In 2020 Second IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA), pages 263–272. IEEE, 2020.
  * [17] James W. Cooley and John W. Tukey.  An algorithm for the machine calculation of complex fourier series.  Mathematics of Computation, 19:297–301, 1965.
  * [18] Diederik P Kingma and Jimmy Ba.  Adam: A method for stochastic optimization.  arXiv preprint arXiv:1412.6980, 2014.
  * [19] Ka-Ho Chow, Ling Liu, Mehmet Emre Gursoy, Stacey Truex, Wenqi Wei, and Yanzhao Wu.  Understanding object detection through an adversarial lens.  In European Symposium on Research in Computer Security, pages 460–481. Springer, 2020.
  * [20] Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C. Lawrence Zitnick.  Microsoft coco: Common objects in context.  In David Fleet, Tomas Pajdla, Bernt Schiele, and Tinne Tuytelaars, editors, Computer Vision – ECCV 2014, pages 740–755, Cham, 2014. Springer International Publishing.
  * [21] Mark Everingham, S. M. Ali Eslami, Luc Van Gool, Christopher K. I. Williams, John M. Winn, and Andrew Zisserman.  The pascal visual object classes challenge: A retrospective.  International Journal of Computer Vision, 111:98–136, 2014.
  * [22] Alexey Bochkovskiy, Chien-Yao Wang, and Hong-Yuan Mark Liao.  Yolov4: Optimal speed and accuracy of object detection.  ArXiv, abs/2004.10934, 2020.
  * [23] Tsung-Yi Lin, Priya Goyal, Ross B. Girshick, Kaiming He, and Piotr Dollár.  Focal loss for dense object detection.  2017 IEEE International Conference on Computer Vision (ICCV), pages 2999–3007, 2017.


# Corrigendum: Liftings of the Jordan plane

Nicolás Andruskiewitsch, Iván Angiono, István Heckenberger  FaMAF-CIEM
(CONICET), Universidad Nacional de Córdoba, Medina Allende s/n, Ciudad
Universitaria, 5000 Córdoba, República Argentina.
<EMAIL_ADDRESS><EMAIL_ADDRESS>Philipps-
Universität Marburg, Fachbereich Mathematik und Informatik,
Hans-Meerwein-Straße, D-35032 Marburg, Germany<EMAIL_ADDRESS>marburg.de

###### Abstract.

We complete the classification of the pointed Hopf algebras with finite
Gelfand-Kirillov dimension that are liftings of the Jordan plane over a
nilpotent-by-finite group, correcting the statement in [1].

2010 _Mathematics Subject Classification._ 16T05.
N. A. and I. A. were partially supported by CONICET, FONCyT-ANPCyT, Secyt
(UNC). The work of N. A. was partially done during a visit to the University
of Clermont.

## Introduction

In the paper [1] we stated the classification of the pointed Hopf algebras
with finite Gelfand-Kirillov dimension that are liftings of either the Jordan
plane or the super Jordan plane over a nilpotent-by-finite group. But we
overlooked one possibility, namely to deform degree one relations and
therefore the classification in _loc. cit._ of liftings of Jordan planes is
not complete. Here we fill the gap. It turns out that the missed example is
essentially a Hopf algebra introduced by C. Ohn in 1992, see [2].

Throughout $\Bbbk$ is an algebraically closed field of characteristic $0$.
Recall that $\mathcal{V}(1,2)$ is the braided vector space with basis $x_{1}$,
$x_{2}$ and braiding $c$ given by $c(x_{i}\otimes x_{1})=x_{1}\otimes x_{i}$,
$c(x_{i}\otimes x_{2})=(x_{1}+x_{2})\otimes x_{i}$, $i=1,2$. Here is the
revised version of [1, Proposition 4.2].

######  Proposition 1.

Let $G$ be a nilpotent-by-finite group and let $H$ be a pointed Hopf algebra
with finite $\operatorname{GKdim}$ such that

  * $\circ$

$G(H)\simeq G$ and

  * $\circ$

the infinitesimal braiding of $H$ is isomorphic to $\mathcal{V}(1,2)$.

Then there exists a Jordanian YD-triple $\mathcal{D}=(g,\chi,\eta)$ for $\Bbbk
G$ such that either

  1. (I)

$H\simeq\mathfrak{U}(\mathcal{D},0)$ or $H\simeq\mathfrak{U}(\mathcal{D},1)$,
introduced in [1, §4.1]; or

  2. (II)

$\chi=\varepsilon$ and there exists
$\xi\in\operatorname{Der}_{\varepsilon,\varepsilon}(\Bbbk G,\Bbbk)$, $\xi\neq
0$, such that $H\simeq\mathfrak{U}_{\xi}(\mathcal{D},0)$ or
$H\simeq\mathfrak{U}_{\xi}(\mathcal{D},1)$ see Definition 9; or

  3. (III)

$\chi=\varepsilon$ and $H\simeq{\mathfrak{U}}^{\text{{jordan}}}(\mathcal{D})$,
see Definition 11.

Conversely, any of these Hopf algebras is pointed and has finite
$\operatorname{GKdim}$, actually $\operatorname{GKdim}\Bbbk G+2$. See Lemmas
10, 12 and [1, Proposition 4.2]. Notice that if $\chi=\varepsilon$ and
$\xi=0$, then
$\mathfrak{U}_{0}(\mathcal{D},\lambda)\simeq\mathfrak{U}(\mathcal{D},\lambda)$,
introduced in [1, §4.1].

The subspace of $(g,1)$ skew-primitive elements in a Hopf algebra in case (I)
is decomposable as $G$-module, while in (II) is decomposable as $\langle
g\rangle$-module but it is an indecomposable $G$-module, and in (III) it is an
indecomposable $\langle g\rangle$-module. Thus Hopf algebras from different
cases could not be isomorphic. Whether Hopf algebras in the same case are
isomorphic is treated as in [1, §4.1].

This note is organized as follows. In Section 1 the minimal Hopf algebra
missing in [1, Proposition 4.2] and its relation with [2] are described. In
Section 2 we discuss the gap. Proposition 1 is proved in Section 3.

## Notation

We keep the notations from [1]. Let $G$ be a group, let $\Bbbk G$ be its group
algebra and let $\widehat{G}$ be its group of characters. Given
$\chi\in\widehat{G}$, recall that

$\displaystyle\operatorname{Der}_{\chi,\chi}(\Bbbk G,\Bbbk)$
$\displaystyle=\\{\eta\in(\Bbbk
G)^{*}:\eta(ht)=\chi(h)\eta(t)+\chi(t)\eta(h)\quad\forall h,t\in G\\}.$

A collection $\mathcal{D}=(g,\chi,\eta)\in
Z(G)\times\widehat{G}\times\operatorname{Der}_{\chi,\chi}(\Bbbk G,\Bbbk)$ is a
_YD-triple_ for $\Bbbk G$ if $\eta(g)=1$. Then the vector space
$\mathcal{V}_{g}(\chi,\eta)$ with a basis $(x_{i})_{i\in\mathbb{I}_{2}}$
belongs to ${}^{\Bbbk G}_{\Bbbk G}\mathcal{YD}$, with the coaction
$\delta(x_{i})=g\otimes x_{i}$, $i\in\mathbb{I}_{2}$, and the action given by

$\displaystyle h\cdot x_{1}$ $\displaystyle=\chi(h)x_{1},$ $\displaystyle
h\cdot x_{2}$ $\displaystyle=\chi(h)x_{2}+\eta(h)x_{1},$ $\displaystyle h$
$\displaystyle\in\Bbbk G.$

When $\chi(g)=1$ we say that $\mathcal{D}=(g,\chi,\eta)$ is a _Jordanian_ YD-
triple.

Let $L$ be a Hopf algebra. The $\Delta$, $\varepsilon$ and ${\mathcal{S}}$
denote respectively the comultiplication, the counit and the antipode. The
group of group-like elements is denoted by $G(L)$. Also the space of
$(g,h$)-primitive elements is $\mathcal{P}_{g,h}(L)=\\{\ell\in
L:\Delta(\ell)=\ell\otimes h+g\otimes\ell\\}$, where $g,h\in G(L)$, and
$\mathcal{P}(L)=\mathcal{P}_{1,1}(L)$ is the space of primitive elements. The
adjoint action of $G(L)$ on $L$ is denoted by $g\cdot\ell:=g\ell g^{-1}$,
$g\in G(L)$, $\ell\in L$.

## Competing interests

The authors declare none.

##  1\. The Jordanian enveloping algebra of $s\ell(2)$

Let ${\widetilde{\mathfrak{U}}}^{\mathtt{jordan}}$ be the algebra generated by
$a_{1},a_{2},g,g^{-1}$ with defining relations

(1.1) $\displaystyle g^{\pm 1}g^{\mp 1}$ $\displaystyle=1,$ $\displaystyle
ga_{1}$ $\displaystyle=a_{1}g+(g-g^{2}),$ $\displaystyle ga_{2}$
$\displaystyle=a_{2}g+a_{1}g.$

It is easy to see that ${\widetilde{\mathfrak{U}}}^{\mathtt{jordan}}$ is a
Hopf algebra by imposing $g\in
G({\widetilde{\mathfrak{U}}}^{\mathtt{jordan}})$ and
$a_{1},a_{2}\in\mathcal{P}_{g,1}({\widetilde{\mathfrak{U}}}^{\mathtt{jordan}})$.
We introduce

(1.2) $\displaystyle z$
$\displaystyle=a_{1}a_{2}-a_{2}a_{1}-\dfrac{a_{1}^{2}}{2}+a_{2}+\dfrac{1}{2}a_{1}\in{\widetilde{\mathfrak{U}}}^{\mathtt{jordan}}$

######  Lemma 2.

The element $z$ belongs to
$\mathcal{P}_{g^{2},1}({\widetilde{\mathfrak{U}}}^{\mathtt{jordan}})$ and
commutes with $g$.

###### Proof.

We compute

$\displaystyle\Delta(z)$ $\displaystyle=a_{1}a_{2}\otimes 1+a_{1}g\otimes
a_{2}+ga_{2}\otimes a_{1}+g^{2}\otimes a_{1}a_{2}$ $\displaystyle-
a_{2}a_{1}\otimes 1-a_{2}g\otimes a_{1}-ga_{1}\otimes a_{2}-g^{2}\otimes
a_{2}a_{1}$ $\displaystyle-\dfrac{1}{2}a_{1}^{2}\otimes
1-\dfrac{1}{2}\left(a_{1}g+ga_{1}\right)\otimes a_{1}-\dfrac{1}{2}g^{2}\otimes
a_{1}^{2}$ $\displaystyle+a_{2}\otimes 1+g\otimes
a_{2}+\dfrac{1}{2}a_{1}\otimes 1+\dfrac{1}{2}g\otimes a_{1}$
$\displaystyle=z\otimes 1+g^{2}\otimes
z+\left(a_{1}g-ga_{1}+g-g^{2}\right)\otimes a_{2}$
$\displaystyle+\left(ga_{2}-a_{2}g-\dfrac{1}{2}(a_{1}g+ga_{1})+\dfrac{1}{2}g-\dfrac{1}{2}g^{2}\right)\otimes
a_{1}$ $\displaystyle=z\otimes 1+g^{2}\otimes z;$

here
$ga_{2}-a_{2}g-\dfrac{1}{2}(a_{1}g+ga_{1})+\dfrac{1}{2}g-\dfrac{1}{2}g^{2}=\dfrac{1}{2}\left(a_{1}g-ga_{1}+(g-g^{2})\right)=0$.

It remains to prove that $\gamma(z)=0$, where
$\gamma\in\operatorname{End}_{\Bbbk}({\widetilde{\mathfrak{U}}}^{\mathtt{jordan}})$
is given by $\gamma(x)=gxg^{-1}-x$, for all
$x\in{\widetilde{\mathfrak{U}}}^{\mathtt{jordan}}$. Note that

$\displaystyle\gamma(xy)$ $\displaystyle=\gamma(x)(\gamma(y)+y)+x\gamma(y)$
$\displaystyle\text{for all }x,y$
$\displaystyle\in{\widetilde{\mathfrak{U}}}^{\mathtt{jordan}}.$

From (1.1) we have that

(1.3) $\displaystyle\gamma(a_{1})$ $\displaystyle=1-g,$
$\displaystyle\gamma(a_{2})$ $\displaystyle=a_{1}.$

Therefore,

$\displaystyle\gamma(z)$
$\displaystyle=\gamma\Big{(}a_{1}a_{2}+\Big{(}a_{2}+\frac{1}{2}a_{1}\Big{)}(1-a_{1})\Big{)}$
$\displaystyle=\gamma(a_{1})(\gamma(a_{2})+a_{2})+a_{1}\gamma(a_{2})$
$\displaystyle+\gamma\Big{(}a_{2}+\frac{1}{2}a_{1}\Big{)}(\gamma(1-a_{1})+1-a_{1})+\Big{(}a_{2}+\frac{1}{2}a_{1}\Big{)}\gamma(1-a_{1}).$
By using (1.3) we obtain that $\displaystyle\gamma(z)$
$\displaystyle=(1-g)(a_{2}+a_{1})+a_{1}^{2}$
$\displaystyle\quad+\Big{(}a_{1}+\frac{1}{2}(1-g)\Big{)}(g-a_{1})+\Big{(}a_{2}+\frac{1}{2}a_{1}\Big{)}(g-1)$
$\displaystyle=a_{2}+a_{1}-(a_{2}g+2a_{1}g+g-g^{2})+a_{1}^{2}+\Big{(}a_{2}+\frac{1}{2}a_{1}\Big{)}(g-1)$
$\displaystyle\quad+a_{1}g-a_{1}^{2}+\frac{1}{2}(g-g^{2})+\frac{1}{2}a_{1}(g-1)+\frac{1}{2}(g-g^{2}).$

Now it follows easily that $\gamma(z)=0$. ∎

The Jordanian enveloping algebra of $s\ell(2)$ is

(1.4)
$\displaystyle{\mathfrak{U}}^{\text{{jordan}}}:={\widetilde{\mathfrak{U}}}^{\mathtt{jordan}}/\langle
z\rangle.$

By Lemma 2, ${\mathfrak{U}}^{\text{{jordan}}}$ is a Hopf algebra quotient of
${\widetilde{\mathfrak{U}}}^{\mathtt{jordan}}$. By abuse of notation the
images of $g,a_{1},a_{2}$ in ${\mathfrak{U}}^{\text{{jordan}}}$ are denoted by
the same symbols.

######  Remark 3.

For each $\lambda\in\Bbbk$ let

(1.5)
$\displaystyle{\mathfrak{U}}^{\text{{jordan}}}_{\lambda}:={\widetilde{\mathfrak{U}}}^{\mathtt{jordan}}/\langle
z-\lambda(1-g^{2})\rangle.$

Then ${\mathfrak{U}}^{\text{{jordan}}}_{\lambda}$ is a Hopf algebra, since
$z-\lambda(1-g^{2})\in\mathcal{P}_{g^{2},1}({\widetilde{\mathfrak{U}}}^{\mathtt{jordan}})$.

Let us now fix $\lambda,\mu\in\Bbbk$. Let $U$ be the algebra

$U=\Bbbk\langle g,g^{-1},a_{1},a_{2}\rangle/\langle
gg^{-1}-1,g^{-1}g-1\rangle.$

Then $U$ has a unique Hopf algebra structure such that $g,g^{-1}\in G(U)$ and
$a_{1},a_{2}\in\mathcal{P}_{g,1}(U)$. Moreover, there exists a well-defined
Hopf algebra map

$\varphi_{\lambda,\mu}:U\to{\mathfrak{U}}^{\text{{jordan}}}_{\lambda},\quad
g\mapsto g,\,a_{1}\mapsto a_{1},\,a_{2}\mapsto a_{2}+\mu(1-g).$

It is easily checked that

$ga_{1}-a_{1}g-g+g^{2},\,ga_{2}-(a_{2}+a_{1})g\in\ker\varphi_{\lambda,\mu}.$

Moreover, for $z\in U$ defined as in (1.2) we obtain that

$\displaystyle\varphi_{\lambda,\mu}(z)-z$
$\displaystyle=a_{1}\mu(1-g)-\mu(1-g)a_{1}+\mu(1-g)=\mu(1-g^{2}).$

Since $z=\lambda(1-g^{2})\in{\mathfrak{U}}^{\text{{jordan}}}_{\lambda}$, we
conclude that $\varphi_{\lambda,\mu}$ induces a surjective Hopf algebra map

$\varphi_{\lambda,\mu}:{\mathfrak{U}}^{\text{{jordan}}}_{\lambda+\mu}\to{\mathfrak{U}}^{\text{{jordan}}}_{\lambda}.$

It follows that
$\varphi_{0,\lambda}:{\mathfrak{U}}^{\text{{jordan}}}_{\lambda}\to{\mathfrak{U}}^{\text{{jordan}}}$
is a Hopf algebra isomorphism.

######  Remark 4.

For any $\saturn\in\Bbbk$, the Hopf algebra $U_{\saturn}$ was introduced by
Christian Ohn in [2]; this is the algebra generated over $\Bbbk$ by
$K,Y,T^{\pm 1}$ with relations:

(1.6) $\displaystyle TT^{-1}=T^{-1}T=1,\quad[K,T]$
$\displaystyle=T^{2}-1,\quad[Y,T]=-\frac{\saturn}{2}(KT+TK),$ (1.7)
$\displaystyle[K,Y]$ $\displaystyle=-\frac{1}{2}(YT+TY+YT^{-1}+T^{-1}Y),$

with the Hopf algebra structure of $U_{\saturn}$ determined by $T\in
G(U_{\saturn})$ and $X,Y\in\mathcal{P}_{T^{-1},T}(U_{\saturn})$. It is easy to
see that the the Hopf algebras $U_{\saturn}$ with $\saturn\neq 0$ are all
isomorphic so we fix one of them. The appellative _Jordanian_ was introduced
by Alev and Dumas to the best of our knowledge. We claim that
${\mathfrak{U}}^{\text{{jordan}}}_{\lambda}$ is isomorphic to the Hopf
subalgebra $\mathfrak{U}$ of $U_{\saturn}$ generated by

(1.8) $\displaystyle x$ $\displaystyle=KT^{-1},$ $\displaystyle y$
$\displaystyle=YT^{-1},$ $\displaystyle g$ $\displaystyle=T^{-2};$

we choose these variables to have $x,y\in\mathcal{P}_{g,1}(\mathfrak{U})$. Now
(1.6) implies

(1.9) $\displaystyle g\cdot x$ $\displaystyle=x+2(1-g),$ $\displaystyle g\cdot
y$ $\displaystyle=y-2\saturn\left(x+(1-g)\right).$

We perform a new change of variables:

$\displaystyle a_{1}$ $\displaystyle=\frac{1}{2}x,$ $\displaystyle a_{2}$
$\displaystyle=-\frac{1}{4\saturn}y-\frac{1}{4}x;$

these new variables satisfy (1.1). Now (1.7) translates succesively into

$\displaystyle xy-yx$
$\displaystyle=-2y-{\saturn}x^{2}+\frac{\saturn}{4}(1-g^{2})$

and then into

$\displaystyle z$ $\displaystyle=-\frac{1}{32}(1-g^{2}).$

That is, $\mathfrak{U}\simeq{\mathfrak{U}}^{\text{{jordan}}}_{-\frac{1}{32}}$.

######  Remark 5.

The algebra $U_{\saturn}$ can be described as an iterated Ore extension:

(1.10) $U_{\saturn}=\Bbbk[T^{\pm}][x\,;\delta][y\,;\,\sigma,D]$

with $\delta$ a derivation of $\Bbbk[T^{\pm}]$, $\sigma$ an automorphism of
$\Bbbk[T^{\pm}][x\,;\delta]$ and $D$ a $\sigma$-derivation of
$\Bbbk[T^{\pm}][x\,;\delta]$ defined by:

(1.11) $\displaystyle\textstyle xT$
$\displaystyle=Tx+\underbrace{(T-T^{-1})}_{=\delta(T)}$ (1.12) $\displaystyle
yT$ $\displaystyle=\underbrace{T}_{=\sigma(T)}y+\underbrace{(-\saturn
Tx-\frac{\saturn}{2}(T-T^{-1}))}_{=D(T)}$ (1.13) $\displaystyle yx$
$\displaystyle=\underbrace{(x+2)}_{=\sigma(x)}y+\underbrace{\saturn
x^{2}-\frac{\saturn}{4}(1-T^{-4})}_{=D(x)}.$

######  Proposition 6.

There exist a derivation $\delta_{1}$ of $R:=\Bbbk[g,g^{-1}]$, a derivation
$\delta_{2}$ of $S:=R[a_{1};\operatorname{id},\delta_{1}]$ and an automorphism
$\sigma$ of $S$ such that ${\mathfrak{U}}^{\text{{jordan}}}$ is isomorphic to
the Ore extension $S[a_{2};\sigma,\delta_{2}]$.

Hence ${\mathfrak{U}}^{\text{{jordan}}}$ is a noetherian domain of Gelfand-
Kirillov 3, and the monomials $g^{j}a_{1}^{i_{1}}a_{2}^{i_{2}}$ form a PBW-
basis of ${\mathfrak{U}}^{\text{{jordan}}}$.

###### Proof.

We leave the verification of the first claim to the reader as a long but
straightforward exercise: the derivations $\delta_{1}:R\to R$,
$\delta_{2}:S\to S$ satisfy

$\displaystyle\delta_{1}(g)$ $\displaystyle=g^{2}-g,$
$\displaystyle\delta_{2}(g)$ $\displaystyle=-a_{1}g,$
$\displaystyle\delta_{2}(a_{1})$ $\displaystyle=\frac{1}{2}a_{1}(1-a_{1}),$

and $\sigma$ is given by $\sigma(g)=g$, $\sigma(a_{1})=a_{1}+1$. The rest is
standard. ∎

######  Corollary 7.

The Hopf algebra ${\mathfrak{U}}^{\text{{jordan}}}$ is pointed and
$\operatorname{gr}{\mathfrak{U}}^{\text{{jordan}}}$ is isomorphic to the
bosonization of the Jordan plane by the group algebra of the infinite cyclic
group. ∎

##  2\. The gap and how to fix it

We fix a group $G$. Let $H$ be a pointed Hopf algebra with coradical
filtration $(H_{n})_{n\in\mathbb{N}_{0}}$ such that $G(H)\simeq G$. Then
$H_{1}/H_{0}\simeq V\\#\Bbbk G$, where $V\in{}^{\Bbbk G}_{\Bbbk
G}\mathcal{YD}$ is the infinitesimal braiding of $H$. For $g\in G$, the space
of $(g,1)$ skew-primitives $\mathcal{P}_{g,1}(H)$ satisfies

$\mathcal{P}_{g,1}(H)\cap H_{0}=\Bbbk(1-g)\text{ and
}\mathcal{P}_{g,1}(H)/\left(\mathcal{P}_{g,1}(H)\cap H_{0}\right)\simeq
V_{g}.$

Now assume that $V\simeq\mathcal{V}_{g}(\chi,\eta)$ for a YD-triple
$\mathcal{D}=(g,\chi,\eta)$ over $\Bbbk G$. Thus $V=V_{g}$ and we have an
exact sequence of $G$-modules

Since $g\in Z(G)$, one has
$\Bbbk(1-g)\subset\mathcal{P}_{g,1}(H)^{\varepsilon}$. Hence
$\chi\neq\varepsilon$ implies that

$\displaystyle\mathcal{P}_{g,1}(H)\simeq\Bbbk(1-g)\oplus\mathcal{V}_{g}(\chi,\eta)$

and we have a morphism of Hopf algebras
$\pi:\mathcal{T}(\mathcal{V}_{g}(\chi,\eta))\to H$, where
$\mathcal{T}(\mathcal{V}_{g}(\chi,\eta))=T(\mathcal{V}_{g}(\chi,\eta))\\#\Bbbk
G$. In particular the proof of [1, Prop. 4.3] goes over without changes.

We assume for the rest of this Section that the infinitesimal braiding $V$ of
$H$ is isomorphic to $\mathcal{V}_{g}(\varepsilon,\eta)$ for a YD-triple
$\mathcal{D}=(g,\varepsilon,\eta)$ as Yetter-Drinfeld module over $\Bbbk G$.
Under this assumption, $\mathcal{P}_{g,1}(H)$ might be indecomposable.

######  Example 8.

The indecomposability of $\mathcal{P}_{g,1}(H)$ could happen in other
situations. Here is a simple example. Let $A$ be the algebra generated by
$a,\gamma^{\pm 1}$, where $\gamma^{-1}$ is the inverse of $\gamma$ and the
relation $\gamma a\gamma^{-1}=a+(1-\gamma)$ holds, so that $A$ is not
commutative. Then $A$ is a pointed Hopf algebra by declaring that $\gamma$ is
a group-like and $a$ a $(\gamma,1)$ skew-primitive element. Observe that
$\mathcal{P}_{g,1}(A)$ is indecomposable. Let $\Gamma\simeq\mathbb{Z}$. It can
be shown that $\operatorname{gr}A\simeq T(V)\otimes\Bbbk\Gamma$, where $V$ has
dimension 1 and is the infinitesimal braiding of $A$. But
$\mathcal{P}_{g,1}(A)$ is indecomposable and there is no surjective morphism
of Hopf algebras $T(V)\otimes\Bbbk\Gamma\to A$.

Back to our situation, let us pick $a_{1},a_{2}\in\mathcal{P}_{g,1}(H)$ such
that $\varpi(a_{j})=x_{j}$, $j=1,2$ and set $a_{0}=1-g$. Then there are
$\zeta\in\operatorname{Der}_{\varepsilon,\varepsilon}(\Bbbk G,\Bbbk)$ and a
linear map $\xi:\Bbbk G\to\Bbbk$ such that the action of $h\in G$ on
$\mathcal{P}_{g,1}(H)$ is given in the basis $(a_{0},a_{1},a_{2})$ by

(2.1) $\displaystyle\rVert h\rVert=\begin{pmatrix}1&\zeta(h)&\xi(h)\\\
0&1&\eta(h)\\\ 0&0&1\end{pmatrix}.$

Notice that $\operatorname{Der}_{\varepsilon,\varepsilon}(\Bbbk
G,\Bbbk)=\operatorname{Hom}_{\text{gps}}(G,(\Bbbk,+))$ and that $\xi$ is a
kind of differential operator of degree 2, meaning that

(2.2) $\displaystyle\xi(hk)$ $\displaystyle=\xi(h)+\zeta(h)\eta(k)+\xi(k)$
$\displaystyle\text{for all }h,k\in G.$

Thus if $\zeta\neq 0$, then the claim [1, Prop. 4.2, page p. 669, line 8] is
not true. To correct this we consider the subalgebra $A$ generated by $g$ and
$\mathcal{P}_{g,1}(H)$, a Hopf subalgebra of $H$. The action of $g$ on
$\mathcal{P}_{g,1}(H)=\mathcal{P}_{g,1}(A)$ in the basis $(a_{0},a_{1},a_{2})$
is given by

(2.3) $\displaystyle\rVert g\rVert=\begin{pmatrix}1&\zeta(g)&\xi(g)\\\
0&1&1\\\ 0&0&1\end{pmatrix}.$

As $g\in Z(G)$, we have that $\xi(gh)=\xi(hg)$ for all $h\in G$, so (2.2) says
that

(2.4) $\displaystyle\zeta(h)$ $\displaystyle=\eta(h)\zeta(g)$
$\displaystyle\text{for all }h\in G.$

We consider two cases:

  1. (A)

$\zeta(g)=0$. Then $\zeta=0$ by (2.4) and
$\xi\in\operatorname{Der}_{\varepsilon,\varepsilon}(\Bbbk G,\Bbbk)$ by (2.2).

  2. (B)

$t:=\zeta(g)\neq 0$, the Jordanian case. In the basis
$(a_{0},t^{-1}a_{1},t^{-1}a_{2}-t^{-2}\xi(g)a_{1})$, the action of $g$ is
given by $\small\begin{pmatrix}1&1&0\\\ 0&1&1\\\ 0&0&1\end{pmatrix}$. We still
denote the new basis by $(a_{0},a_{1},a_{2})$; that is, we may assume that
$\zeta(g)=1$, $\xi(g)=0$. By (2.4), $\zeta=\eta$, and by (2.2),
$\xi(hk)=\xi(h)+\eta(h)\eta(k)+\xi(k)$ for all $h,k\in G$.

We shall see that the following Hopf algebras exhaust the case (A).

######  Definition 9.

Let $\mathcal{D}=(g,\varepsilon,\eta)$ be a YD-triple,
$\xi\in\operatorname{Der}_{\varepsilon,\varepsilon}(\Bbbk G,\Bbbk)$ and
$\lambda\in\Bbbk$. We define $\mathfrak{U}_{\xi}(\mathcal{D},\lambda)$ as the
algebra generated by $h\in G$, $a_{1}$, $a_{2}$ with defining relations being
those of $G$ and

(2.5) $\displaystyle ha_{1}-a_{1}h,$ $\displaystyle h\in G;$ (2.6)
$\displaystyle ha_{2}-\left(a_{2}+\eta(h)a_{1}+\xi(h)(1-g)\right)h,$
$\displaystyle h\in G;$ (2.7) $\displaystyle
a_{1}a_{2}-a_{2}a_{1}-\dfrac{a_{1}^{2}}{2}-\lambda(1-g^{2}).$

As we said already,
$\mathfrak{U}_{0}(\mathcal{D},\lambda)\simeq\mathfrak{U}(\mathcal{D},\lambda)$,
introduced in [1, §4.1].

######  Lemma 10.

$\mathfrak{U}_{\xi}(\mathcal{D},\lambda)$ is a Hopf algebra with
comultiplication determined by

$\displaystyle G(\mathfrak{U}_{\xi}(\mathcal{D},\lambda))$ $\displaystyle=G$
and $\displaystyle a_{1},a_{2}$
$\displaystyle\in\mathcal{P}_{g,1}(\mathfrak{U}_{\xi}(\mathcal{D},\lambda)).$

Thus $\mathfrak{U}_{\xi}(\mathcal{D},\lambda)$ is pointed. The set
$\\{a_{1}^{m}a_{2}^{n}h\,|\,m,n\in\mathbb{N}_{0},\,h\in G\\}$ is a basis of
$\mathfrak{U}_{\xi}(\mathcal{D},\lambda)$;
$\operatorname{gr}\mathfrak{U}_{\xi}(\mathcal{D},\lambda)\simeq\mathscr{B}(\mathcal{V}(1,2))\\#\Bbbk
G$ and

$\displaystyle\operatorname{GKdim}\mathfrak{U}_{\xi}(\mathcal{D},\lambda)$
$\displaystyle=\operatorname{GKdim}\Bbbk G+2.$

In particular, if $G$ is nilpotent-by-finite, then
$\operatorname{GKdim}\mathfrak{U}_{\xi}(\mathcal{D},\lambda)<\infty$.

###### Proof.

Left to the reader. ∎

We shall see that the following Hopf algebras exhaust the case (B).

######  Definition 11.

Let $\mathcal{D}=(g,\varepsilon,\eta)$ be a YD-triple and define $\xi\in(\Bbbk
G)^{*}$ by $\xi(h)=\tfrac{1}{2}(\eta(h)^{2}-\eta(h))$, $h\in G$. We introduce
${\mathfrak{U}}^{\text{{jordan}}}(\mathcal{D})$ as the algebra generated by
$h\in G$, $a_{1}$, $a_{2}$ with defining relations those of $G$, (2.6) and

(2.8) $\displaystyle ha_{1}-\left(a_{1}+\eta(h)(1-g)\right)h,$ $\displaystyle
h\in G.$ (2.9) $\displaystyle
a_{1}a_{2}-a_{2}a_{1}-\dfrac{a_{1}^{2}}{2}+a_{2}+\dfrac{1}{2}a_{1}.$

Observe that $\xi$, needed in (2.6), satisfies (2.2) with $\zeta=\eta$. The
proof of the following Lemma is also standard.

######  Lemma 12.

${\mathfrak{U}}^{\text{{jordan}}}(\mathcal{D})$ is a Hopf algebra with
structure determined by

$\displaystyle G({\mathfrak{U}}^{\text{{jordan}}}(\mathcal{D}))$
$\displaystyle=G$ and $\displaystyle a_{1},a_{2}$
$\displaystyle\in\mathcal{P}_{g,1}({\mathfrak{U}}^{\text{{jordan}}}(\mathcal{D})).$

Thus ${\mathfrak{U}}^{\text{{jordan}}}(\mathcal{D})$ is pointed. The set
$\\{a_{1}^{m}a_{2}^{n}h\,|\,m,n\in\mathbb{N}_{0},\,h\in G\\}$ is a basis of
${\mathfrak{U}}^{\text{{jordan}}}(\mathcal{D})$;
$\operatorname{gr}{\mathfrak{U}}^{\text{{jordan}}}(\mathcal{D})\simeq\mathscr{B}(\mathcal{V}(1,2))\\#\Bbbk
G$ and

$\displaystyle\operatorname{GKdim}{\mathfrak{U}}^{\text{{jordan}}}(\mathcal{D})$
$\displaystyle=\operatorname{GKdim}\Bbbk G+2.$

In particular, if $G$ is nilpotent-by-finite, then
$\operatorname{GKdim}{\mathfrak{U}}^{\text{{jordan}}}(\mathcal{D})<\infty$. ∎

##  3\. Proof of Proposition 1

Let $G$ be a nilpotent-by-finite group and let $H$ be a pointed Hopf algebra
with finite $\operatorname{GKdim}$ such that $G(H)\simeq G$ and the
infinitesimal braiding $V$ of $H$ is isomorphic to $\mathcal{V}(1,2)$. By [1,
Lemma 2.3], there exists a unique YD-triple $\mathcal{D}=(g,\chi,\eta)$ such
that $V\simeq\mathcal{V}_{g}(\chi,\eta)$ in ${}^{\Bbbk G}_{\Bbbk
G}\mathcal{YD}$. By [1, Lemma 3.7],
$\operatorname{gr}H\simeq\mathscr{B}(\mathcal{V}(1,2))\\#\Bbbk G$, hence $H$
is generated by $\mathcal{P}_{g,1}(H)$ and $G$ as algebra.

If $\chi\neq\varepsilon$, then the proof of [1, Prop. 4.1] implies that $H$ is
isomorphic either to $\mathfrak{U}(\mathcal{D},0)$ or
$\mathfrak{U}(\mathcal{D},1)$, the Hopf algebras introduced in [1, §4.1].

Assume that $\chi=\varepsilon$. Pick a basis $(a_{0}=1-g,a_{1},a_{2})$ such
that any $h\in G$ acts on $\mathcal{P}_{g,1}(H)$ by (2.1) where
$\zeta\in\operatorname{Der}_{\varepsilon,\varepsilon}(\Bbbk G,\Bbbk)$ and
$\xi\in(\Bbbk G)^{*}$ satisfies (2.2). Let $A$ be the subalgebra generated by
$\mathcal{P}_{g,1}(H)$. As explained above we consider two cases.

Case (A): $\zeta(g)=0$, thus $\zeta=0$. Even if [1, Proposition 4.2] does not
apply in general since we may have $\xi\neq 0$, it does apply to $A$ up to
changing the base to $(a_{0},a_{1},\widetilde{a}_{2})$ where
$\widetilde{a}_{2}:=a_{2}-\xi(g)a_{1}$, see (2.1). Call the new basis again
$(a_{0},a_{1},a_{2})$ by abuse of notation. Hence
$A\simeq\mathfrak{U}(\mathcal{D}^{\prime},\lambda)$ where
$\mathcal{D}^{\prime}=(g,\chi_{|\langle g\rangle},\eta_{|\langle g\rangle})$
is a YD-triple over the subgroup $\langle g\rangle$ of $G$ and
$\lambda\in\\{0,1\\}$. In particular the following equality holds in $H$:

$a_{2}a_{1}=a_{1}a_{2}-\tfrac{1}{2}a_{1}^{2}+\lambda(1-g^{2}).$

We first claim that $A$ is stable under the action of $G$. Indeed let $G$ act
on the free algebra generated by $g^{\pm 1}$, $a_{1}$, $a_{2}$, where $G$ acts
trivially on $g$, and by (2.1) on $a_{1}$, $a_{2}$. As $g$ is central, the
action of each $h\in G$ preserves the defining ideal of $A$, so $G$ acts on
$A$.

We next claim that $H\simeq A\rtimes\Bbbk G/I$, where $I$ is the ideal that
identifies the two copies of $g$ where $\rtimes$ stands for smash product.
Indeed, the inclusions $A\hookrightarrow H$, $\Bbbk G\hookrightarrow H$ induce
a Hopf algebra map $\psi:A\rtimes\Bbbk G/I\to H$. As
$\operatorname{gr}H\simeq\mathscr{B}(V)\\#\Bbbk G$, $H$ is generated by
$a_{1}$, $a_{2}$ and $G$, so $\psi$ is surjective. On the other hand,
$(A\rtimes\Bbbk G/I)_{1}$ is spanned by the set $\\{1\otimes h,a_{1}\otimes
h,a_{2}\otimes h|h\in G\\}$. The image of this set under $\psi$ is linearly
independent, which implies that $\psi_{|(A\rtimes\Bbbk G/I)_{1}}$ is
injective. By [3, 5.3.1], $\psi$ is injective, and the claim follows. As a
consequence, the set $\\{a_{1}^{m}a_{2}^{n}h\,|\,m,n\in\mathbb{N}_{0},\,h\in
G\\}$ is a basis of $H$.

Finally, we see that there is a Hopf algebra map
$\mathfrak{U}_{\xi}(\mathcal{D},\lambda)\to H$; since this map sends a basis
to a basis, we conclude that $H\simeq\mathfrak{U}_{\xi}(\mathcal{D},\lambda)$.

Case (B). $\zeta(g)\neq 0$. As discussed above, we may assume that
$\zeta=\eta$. Recall that we are assuming that $\operatorname{GKdim}H<\infty$.
We claim that

  1. (i)

There exists a Hopf algebra isomorphism
$A\simeq{\mathfrak{U}}^{\text{{jordan}}}$, cf. (1.4).

  2. (ii)

$\xi(h)=\tfrac{1}{2}(\eta(h)^{2}-\eta(h))$ for all $h\in G$.

  3. (iii)

$A$ is stable under the adjoint action of $G$ and $H\simeq A\rtimes\Bbbk G/I$,
where $I$ is the ideal that identifies the two copies of $g$.

  4. (iv)

The set $\\{a_{1}^{m}a_{2}^{n}h\,|\,m,n\in\mathbb{N}_{0},\,h\in G\\}$ is a
basis of $H$ and $H\simeq{\mathfrak{U}}^{\text{{jordan}}}(\mathcal{D})$.

(i): It is easy to see that there exists a Hopf algebra surjective map
$\widetilde{\pi}:{\widetilde{\mathfrak{U}}}^{\mathtt{jordan}}\to A$, which
applies $g$, $a_{1}$, $a_{2}$ to the corresponding elements of $A$. Hence
$\widetilde{\pi}(z)\in\mathcal{P}_{g^{2},1}(A)$, by Lemma 2. Now, as $g\neq
g^{2}$ and $\operatorname{gr}H\simeq\mathscr{B}(V)\\#\Bbbk G$, we have that
$\mathcal{P}_{g^{2},1}(H)=\mathcal{P}_{g^{2},1}(H)\cap H_{0}=\Bbbk(1-g^{2})$;
thus there exists $\lambda\in\Bbbk$ such that
$\widetilde{\pi}(z)=\lambda(1-g^{2})$, which implies that $\widetilde{\pi}$
factors through a map
$\pi:{\mathfrak{U}}^{\text{{jordan}}}_{\lambda}\twoheadrightarrow A$. The set
$\\{g^{k},a_{1}g^{k},a_{2}g^{k}:k\in\mathbb{Z}\\}$ is linearly independent in
$H$, so $\pi_{|({\mathfrak{U}}^{\text{{jordan}}}_{\lambda})_{1}}$ is
injective. By [3, 5.3.1], $\pi$ is an isomorphism. Up to composing with
$\varphi_{0,\lambda}$, see Remark 3, we may assume that $\lambda=0$.

(ii): Given $h\in G$, let $\gamma_{h}\in\operatorname{End}_{\Bbbk}H$ be given
by

$\displaystyle\gamma_{h}(x)$ $\displaystyle=hxh^{-1}-x$ for all $\displaystyle
x\in H.$

Note that $\gamma_{h}(xy)=\gamma_{h}(x)(\gamma_{h}(y)+y)+x\gamma_{h}(y)$ for
all $x,y\in H$. From (2.1),

(3.1) $\displaystyle\gamma_{h}(a_{1})$ $\displaystyle=\eta(h)(1-g),$
$\displaystyle\gamma_{h}(a_{2})$ $\displaystyle=\eta(h)a_{1}+\xi(h)(1-g).$

Therefore,

$\displaystyle\gamma_{h}(z)$
$\displaystyle=\eta(h)(1-g)(\eta(h)a_{1}+\xi(h)(1-g)+a_{2})+a_{1}(\eta(h)a_{1}+\xi(h)(1-g))$
$\displaystyle+\Big{(}\eta(h)a_{1}+\xi(h)(1-g)+\tfrac{1}{2}\eta(h)(1-g)\Big{)}(-\eta(h)(1-g)+1-a_{1})$
$\displaystyle-\Big{(}a_{2}+\tfrac{1}{2}a_{1}\Big{)}\eta(h)(1-g)=\left(\tfrac{1}{2}\eta(h)-\tfrac{1}{2}\eta(h)^{2}+\xi(h)\right)\left(1-g^{2}\right).$

By (i), $z=0$, so $\gamma_{h}(z)=0$. Thus,
$\xi(h)=\tfrac{1}{2}\left(\eta(h)^{2}-\eta(h)\right)$.

(iii): Let $G$ act on the free algebra generated by $g^{\pm 1}$, $a_{1}$,
$a_{2}$, where $G$ acts trivially on $g$, and by (2.1) on $a_{1}$, $a_{2}$.
Each $h\in G$ fixes the defining relations $gg^{-1}-1$, $g^{-1}g-1$,
$ga_{1}-a_{1}g-g+g^{2}$, $z$, and

$\displaystyle h\cdot$
$\displaystyle\left(ga_{2}-a_{2}g-a_{1}g\right)=ga_{2}-a_{2}g-a_{1}g+\eta(h)\left(ga_{1}-a_{1}g-(1-g)g\right),$

so the action descends to $A$. The proof of (iv) is as in Case (A). ∎

## Acknowledgements

N. A. thanks François Dumas for conversations on and help with the
computations in this Note.

## References

  * [1] N. Andruskiewitsch, I. Angiono and I. Heckenberger. _Liftings of Jordan and super Jordan planes_. Proc. Edinb. Math. Soc., II. Ser. 61 (2018), no. 3, 661–672.
  * [2] C. Ohn. _A $\star$-product on ${\rm SL}(2)$ and the corresponding nonstandard quantum-$U(\mathfrak{sl}(2))$_. Lett. Math. Phys. 25 (1992) 85–88.
  * [3] S. Montgomery. _Hopf algebras and their actions on rings_ , CMBS 82. Amer. Math. Soc. (1993).