# Adversarial Attacks and Defenses for Semantic Communication in Vehicular
Metaverses

Jiawen Kang, Jiayi He, Hongyang Du, Zehui Xiong*, Zhaohui Yang, Xumin Huang,
Shengli Xie Jiawen Kang, Jiayi He, Xumin Huang, and Shengli Xie are with the
School of Automation, Guangdong University of Technology, China. Hongyang Du
is with the School of Computer Science and Engineering, Nanyang Technological
University, Singapore. Z. Yang is with the College of Information Science and
Electronic Engineering, Zhejiang University, Hangzhou 310007, China, and
Zhejiang Provincial Key Lab of Information Processing, Communication and
Networking (IPCAN), Hangzhou 310007, China, and also with Zhejiang Laboratory,
Hangzhou 31121, China. Zehui Xiong is with the Pillar of Information Systems
Technology and Design, Singapore University of Technology and Design,
Singapore 487372, Singapore. (*Corresponding author: Zehui Xiong)

###### Abstract

For vehicular metaverses, one of the ultimate user-centric goals is to
optimize the immersive experience and Quality of Service (QoS) for users on
board. Semantic Communication (SemCom) has been introduced as a revolutionary
paradigm that significantly eases communication resource pressure for
vehicular metaverse applications to achieve this goal. SemCom enables high-
quality and ultra-efficient vehicular communication, even with explosively
increasing data traffic among vehicles. In this article, we propose a
hierarchical SemCom-enabled vehicular metaverses framework consisting of the
global metaverse, local metaverses, SemCom module, and resource pool. The
global and local metaverse are brand-new concepts from the metaverse’s
distribution standpoint. Considering the QoS of users, this article explores
the potential security vulnerabilities of the proposed framework. To that
purpose, this study highlights a specific security risk to the framework’s
SemCom module and offers a viable defense solution, so encouraging community
researchers to focus more on vehicular metaverse security. Finally, we provide
an overview of the open issues of secure SemCom in the vehicular metaverses,
notably pointing out potential future research directions.

###### Index Terms:

Vehicular metaverse, semantic communication, adversarial attacks, security
defense.

##  I Introduction

With the advances of the Internet of Things and Artificial Intelligence,
metaverse technology, regarded as the next-generation Internet, is rapidly
emerging to build a virtual-physical integrated world with fully immersive and
personalized experiences for users in many scenarios and applications. In
particular, vehicular networks are revolutionizing towards vehicular
metaverses that have vast potential to provide diverse, immersive, and
personalized in-vehicle entertainment/services for both drivers and passengers
[1]. In vehicular metaverses, vehicle data are mainly divided into two
categories: i) static data including background information on roadside
infrastructures and road networks, and ii) dynamic data involving information
about pedestrians, moving vehicles, traffic flow, and so on. To support time-
sensitive vehicular metaverse services (e.g., AR navigation), a large number
of dynamic data is required for real-time updates of the vehicular physical-
virtual world to avoid service quality degradation, while conventional
communication based on Shannon Information Theory cannot support efficient
communications and massive connectivity for vehicular metaverses due to
limited wireless communication resources.

Recently, Semantic Communication (SemCom) has been introduced as a
revolutionary paradigm that breaks through the bandwidth bottleneck of
classical communications, significantly improving communication efficiency by
leveraging deep learning models to only transmit critical information
sufficient for the receivers, thus dramatically reducing the number of bits
transmitted. A deep learning-enabled end-to-end SemCom system with Deep Neural
Networks (DNNs) as semantic codecs has been proposed in [2]. It is a promising
solution to integrate SemCom into vehicular metaverses for enabling real-time
transmission of vast data used to sustain the metaverse services. In vehicular
metaverses, vehicles only send data requests and then download lots of static
and dynamic data from edge servers in the way of SemCom with unprecedented
communication efficiency in comparison to traditional communication manners.

Although semantic communication plays an indispensable role in vehicular
metaverses, SemCom-enabled vehicular metaverses are still in their infancy.
There are many challenges to be resolved for realizing its potential,
especially privacy and security issues. On the one hand, an eavesdropper can
infer vehicle location and driving habits by analyzing communication data.
Even though privately trained codecs provide SemCom with a natural barrier to
being eavesdropped, this barrier does not work well in vehicular metaverses.
This is because there exist similar and stationary communication tasks in
neighbor vehicles and then the eavesdropper may obtain similar or even
identical decoders to recover data from the wireless channels. The researches
on [3, 4, 5] are committed to private communications. On the other hand, DNNs
are vulnerable to attacks (e.g., poisoning attacks and adversarial attacks).
Such weaknesses naturally exist in deep learning-based SemCom systems.
Attackers can easily apply typical deep learning attacks to the SemCom systems
and directly reduce the task/model accuracy [6]. Non-malicious perturbations
may cause performance degradation of semantic communication systems as well
[7].

In particular, the existing work ignores adversarial attacks of SemCom in
vehicular metaverses. For adversarial attacks, the authors in [8] find that
non-random perturbation on the test sample can arbitrarily manipulate the
output of neural networks. In general, the attacker first obtains the
structure and parameters of the target model. The adversarial samples are then
initialized with the original data. After several training iterations, the
elaborate adversarial samples similar to the original data are generated by
maximizing the loss of the semantic encoder. Finally, the accuracy degradation
of the target model is achieved in the face of adversarial samples. Hu et al.
in [6] demonstrate that adversarial attacks are still feasible in the deep
learning-enabled SemCom system. For vehicular metaverses, the adversarial
attacks increase the probability of receiving wrong information, even causing
traffic accidents if receivers are misled to take dangerous actions according
to wrong information [6, 9].

To fully understand the risks of adversarial attacks for SemCom-enabled
vehicular metaverses, in this article, we study the adversarial attacks and
the corresponding defenses against these attacks. More specifically, we first
design a hierarchical vehicular metaverse framework with a global metaverse
and multiple local metaverses [10]. A new adversarial attack model and its
defense scheme for this framework are then proposed, respectively. We discuss
several security challenges of SemCom-enabled vehicular metaverses. The main
contributions are summarized as follows:

  * •

According to vehicle data characteristics and service requirements, we design
a new and hierarchical SemCom-enabled vehicular metaverse framework mainly
consisting of a global metaverse, multiple local metaverses, and resource
pools. This framework not only significantly reduces data transmission delay,
but also efficiently utilizes the computing and storage resources of edge
servers.

  * •

We propose a novel adversarial attack called Semantic Noise Attack (SNA) to
generate adversarial samples by adding semantic noise and design a new defense
scheme using the Semantic Distance Minimization (SDM) mechanism to weaken the
adversarial samples, but almost without sacrificing transmission accuracy.

  * •

For use cases, we present two SemCom systems with different semantic encoders
on traffic sign classification and license plate recognition, respectively. We
examine the effects of SNA on the SemCom systems and evaluate the robustness
of the defense scheme based on SDM in vehicular metaverses. The numerical
results indicate that the proposed defense scheme significantly reduces the
success rate of the attacks.

Figure 1: The hierarchical vehicular metaverse architecture. Parts a and b
show the normal service and attack flow respectively; The orange subfigure on
the right-hand side depicts the steps involved in generating attack examples,
while the blue subfigure illustrates the communication between the global
metaverse and the local metaverses.

##  II Semantic Communication for Vehicular Metaverses

For vehicular metaverses, sensing data is divided into static and dynamic data
based on the properties in the real world. Static data is the background
information from the physical space, such as road sensors, roadside
infrastructures, and the topology network of roads. Dynamic data is the “add-
in” information from dynamic entities in the physical space including
vehicles, pedestrians, traffic signs, etc. Actually, the dynamic data is used
to update the digital twins of dynamic entities in the virtual space. Compared
with other metaverse services, vehicular metaverses have stricter latency
requirements to ensure user immersion and improve the QoS.

###  II-A Semantic Communication and Vehicular Metaverses

As shown in Fig. 1, a hierarchical vehicular metaverse consists of a global
metaverse, n local metaverses, and m resource pools. More specifically,

  * •

Global Metaverse: a giant metaverse deployed over the cloud by Metaverse
Service Providers (MSPs) for management globally. The global metaverse is a
replica of the physical world in the virtual space, which contains both static
data and dynamic data within an entire city or even wider area, e.g., a global
city map with abundant traffic-related information in the navigation
applications. Instead of massively communicating directly with users, it was
updated periodically by the data from all the local metaverses.

  * •

Local Metaverses: as a component of the global metaverses, a local metaverse
could be the metaverse mapping to a small-scale area, like a street block or a
road intersection. The local metaverses are established on edge servers and
are closely connected to nearby users, and thus the vehicles can communicate
directly with their local metaverses to obtain real-time metaverse services
without large latency [10].

  * •

Resource Pools: the virtual resource pool consisting of physical entities with
sufficient resources in the local metaverse, e.g., roadside units acting as
edge servers. The edge servers in different regions establish a resource pool
for their common local metaverse, which includes computing, storage, and
bandwidth resources to support the metaverse services for users.

The hierarchical framework has several new designs and thus obtains multiple
advantages. First, proximity to the users allows the framework to avoid long-
distance communication, and thus reduce communication time. Users only need
communication with the closest node in the resource pool to access the
services. Second, the framework trims the budget for deploying dense sensor
nodes in physical space. The strategy for updating and collecting data does
not require massive sensors [10]. Third, the framework efficiently utilizes
the storage and network resources of servers and vehicles. Both the global and
local metaverses only hold indispensable data to maintain normal service. The
vehicles only download the data of the local metaverses corresponding to their
location. Finally, the SemCom in the framework reduces the number of bits that
need to be transmitted. Hence, the effects of channel instability caused by
vehicle movement are almost mitigated.

In vehicular metaverses, for AR navigation, the MSP collects massive static
data in a low-cost way (e.g., from satellites) and deploys them on the global
metaverse. As shown in 1, the static data at each intersection is regularly
updated to corresponding resource pools to build local metaverses. The
resource pools collect dynamic data from data providers in the physical world
to keep updating digital twins. Meanwhile, when a physical entity (e.g., a
vehicle) moves from one local metaverse to another one, its digital twin may
migrate to the new local metaverse according to its location. Note that all
the changes in the static collected data will be updated to the global
metaverse. Rather than encapsulating an entire city’s dynamic and static data
in one metaverse, the local metaverses split the data, thus relieving the
communication and computing pressure of the cloud and resource pools and
shortening the distance between users and data. Vehicles can interact with
edge servers in the resource pools to access metaverse services.

Before entering the coverage of a local metaverse, each user, i.e., vehicle,
initiates a service request to the edge server. Once a user request is
received, the edge server sends static information from the local metaverse to
the vehicle. Meanwhile, the required dynamic data are constantly invoked and
sent to the vehicle, allowing the driver to glimpse navigation and driving
prompts. Congested wireless resources cannot support the transmission of such
large amounts of data with low latency. To reduce latency, the edge servers
only transmit key features of data to the vehicles by SemCom.

In vehicular metaverses, vehicles do not need to recover the source data, but
only need to complete pragmatic tasks (e.g., traffic sign recognition and
pedestrian detection). Given that the tasks in vehicular metaverses are
relatively fixed, we design task-oriented SemCom systems [11] to improve
efficiency. The task-oriented SemCom aims to extract more condensed semantic
information related to the task of the receiving end. The receiver no longer
needs a complex semantic decoder to recover the source data but completes the
task directly based on the semantic information with a simple model.
Coincidentally, this is consistent with the computational power distribution
between resource pools and vehicles.

We consider that each edge server has a dedicated semantic encoder for every
task. Due to the heterogeneity of hardware performance, driving habits, and
knowledge base, each vehicle has a customized task model. Hence, users need to
train their models in conjunction with edge servers before enjoying the
services. The edge servers open interfaces at night or during idle hours for
user training. The interface mechanically extracts the semantic information of
the original data given by the user and sends it back. Therefore, the user can
train their task model by semantic information and the labels of original
data.

After completing the training, the user can access the metaverse to enjoy
application services. Three kinds of participants are involved in a service
process as follows:

  * •

User: In vehicular metaverses, the vehicle usually acts as a user. The
proposed framework and all the mechanics are designed to make the user obtain
a safe, reliable, comfortable, and immersive experience.

  * •

Edge Server: The intermediary between the user and the data provider. The edge
servers collect data from the data provider, store it temporarily and send it
to the user when receiving a request.

  * •

Data Provider: Any sensing node that wants to make money by selling data
(e.g., some users, roadside cameras). A data provider located near an
intersection contingently provides data to the edge servers in the
corresponding resource pool.

Signal lights, traffic signs, pedestrians, and other information are captured
by the data providers’ sensors and sent to the edge server. Based on SemCom,
the edge server sends the data to the user with a graceful delay after the
user initiates the request. By the task models, the driver can timely see the
arrow guides and virtual traffic sign entities in front of the windshield,
which can enhance the user’s perception of road conditions. This driving
paradigm can greatly improve the safety and comfort of driving, especially
when the view is blocked by trucks or buildings. Passengers can also use this
system to play metaverse games or work online.

TABLE I:  Exiting Works Comparison.

Method | Background | Attack | Defense | Dataset | Modal | Model
---|---|---|---|---|---|---
ESCS [3] |  | Eavesdrop | Encryption | Europarl | Text | Transformer
VQ-VAE [6] |  | Adversarial attack | Mask + Codebook |  CIFAR-10 Cars196 ImageNet | Image | ViT
R-DeepSC [7] | - | Semantic noise |  Calibrating Augment training set | Europarl | Text | Transformer
DeepJSCEC [4] |  | Eavesdrop | Encryption | CIFAR-10 | Image | DNNs
SNA&SDM |  | SNA | SDM |  GTSRB CCPD | Image |  ResNet LPRNet

  * •

The  represent white box attack, while the  means black box setting. In the
white-box setting, the attacker possesses knowledge of the structure or
parameters of the semantic codec model. In contrast, the attacker in the
black-box setting is ignorant and typically attacks by probing the model’s
input and output.

###  II-B Security Challenges of Semantic Communication

SemCom, as a promising communication paradigm for the 6G future era, shows
good performance in various tasks. However, it is vulnerable to some well-
designed attacks. Therefore, it is necessary to consider the possible threats
and defend against these attacks. We summarize typical security challenges as
follows:

  * •

Eavesdropping Attack: Eavesdropping is the behavior of decoding information in
a physical channel in order to steal private information. In SemCom, the user-
unique semantic codec acts as a barrier to eavesdroppers. Even though an
eavesdropper obtains the transmitted semantic information, it cannot decode
it. However, this barrier is not foolproof. When the SemCom system is widely
used, users from the same communication link may have the same semantic
decoder structure. Lu et al. [12] reveal the privacy issues of the SemCom
system in the industrial Internet of Things. At the application layer, Luo et
al. [3] propose an adversarial training method with key pairs to prevent such
eavesdropping. Tung et al. [4] propose a joint source-channel and encryption
coding scheme for wireless image transmission. At the physical level, Chorti
et al. [13] consider physical layer security as the essential issue in next-
generation communication. Du et al. [5] consider this problem from a physical
perspective and protect wireless communications against eavesdropping by
exploring and utilizing the inherent features of the physical medium.

  * •

Adversarial Attack: By adding imperceptible semantic noise to the transmitted
data, adversarial attacks make the SemCom system produce errors in the
encoding stage or decoding stage. The authors in [6] consider two types of
attacks, one is on the sending end and the other one is on the receiving end.
The former simulated the case where the attacker is the sender, while the
latter simulated the case where the attacker initiates the attack through the
channel. With all or part of the detailed information of the SemCom system,
the attacker generates adversarial samples against the model. Xiang et al. [7]
use the calibrated network and expand the training set to counteract the
semantic noise in the text transmission tasks.

  * •

Poisoning Attack: Poisoning attacks aim at manipulating the training process
to degrade model performance or to insert backdoors. SemCom systems are
trained based on shared semantic knowledge bases. The communication parties
are likely to expand the training set from the third party to obtain a better
SemCom codec. Some low-quality data and malicious data are inevitable, which
may carry the wrong semantic information. Using data that contains false
semantic information for training may lead to a degradation of performance in
the SemCom system. This type of attack is called semantic data poisoning
attack [14]. Researches on poisoning attacks and their defenses in the SemCom
system are still in the vacant stage.

We summarize the existing work in Table I. Unlike prior works, we propose a
black-box model, that is more realistic, and use datasets, that are consistent
with vehicular metaverse scenarios. Moreover, we tailor semantic encoder
models for different tasks.

##  III Adversarial Attacks for Semantic Communication in Vehicular Metaverse

###  III-A Adversarial Attacks

Deep learning models are often targeted by adversarial attacks, where
attackers generate adversarial samples that appear natural to human eyes but
cause the model to produce incorrect outputs. Adversarial samples are
typically created by adding specific noise that appears to be normal noise to
clean samples. In addition to channel noise and attenuation, SemCom
furthermore faces a special noise called semantic noise [6]. While channel
noise is simulated to improve performance in real environments, semantic
noise, which can subtly alter the meaning of data, is not typically
considered. Semantic noise usually results from poor-quality data due to aging
sensors and channel interference. By artificially adding semantic noise,
attackers can efficiently produce adversarial samples, which cause a
devastating blow to the SemCom system. We propose an attack based on semantic
noise for vehicular metaverses.

According to Section II, it is stated that edge servers are nodes that are
semi-trusted and do not actively attempt to attack the system, but can still
be deceived. These servers forward both accurate and inaccurate data to users.
Typically, edge servers assess the reliability of data based on the reputation
of their provider. However, this method fails when a provider is compromised
or intentionally behaves in a trustworthy manner to gain credibility.

The diagram in Fig. 1 illustrates how an attacker can impersonate a data
provider and deceive well-behaved edge servers. Initially, the attacker
collects natural data as if they were a legitimate provider. Based on the
captured data, the attacker generates several adversarial samples through the
SNA. At an opportune moment, the attacker submits these generated adversarial
samples to the edge server. When a user requests information from the server,
it extracts incorrect semantic details and sends them back to the user. This
misinformation may lead users to make risky decisions. The process of
generating adversarial samples through SNA is further explained in Fig. 1 and
described below:

  * •

Step 1: The attacker gains access to the training interface offered by the
edge server and initiates a training procedure.

  * •

Step 2: The attacker creates a group of adversarial samples using the benign
data and then transmits both sets to the interface.

  * •

Step 3: The interface extracts semantic information using the semantic encoder
and transmits it back to the attacker.

  * •

Step 4: In the received semantic information, the attacker calculates the
maximum semantic distance to the benign data for every adversarial sample as
the loss.

  * •

Step 5: Update adversarial samples based on the loss and jump to Step 2 until
reaching the maximum iterations.

Using SNA, an attacker can calculate its loss by utilizing the interface
provided by the edge server as environmental feedback, without knowing the
structure and parameters of the semantic encoder. Edge servers aim to attract
numerous data providers due to their requirement for dynamic data. As a
result, detecting an infiltrating attacker is challenging, particularly when
it attempts to enhance its reputation. It should be noted that the loss not
only includes the steps necessary for executing an effective attack but also
controls low-frequency perturbations [9] to minimize detection by human
observers.

Once the SNA is implemented, it brings incalculable losses to the MSP and
users. For MSPs, the presence of an attacker means that pre-trained semantic
encoders can no longer be used, resulting in financial loss. For users,
incorrect semantic information can cause drivers and passengers to watch
lower-quality virtual entities and thus reduce immersion. In some
applications, incorrect semantic information can even further manipulate user
behaviors. For example, in AR navigation, a stop sign contains the semantic
information of going straight. The user continues to drive straight based on
semantic information, thus causing an accident.

###  III-B Defense for Adversarial Attacks

Figure 2: Semantic Distance Minimization Defense Process, where lines with the
same color represent the same data stream, the dashed line indicates that the
semantic encoder is updated according to the loss function. Figure 3: Accuracy
versus the SNR on the adversarial test set with $l2\approx 3.6$, where $a$ vs
$b$ curve represents the $b$ target model attacked in $a$ attack mode. The
random attack is to add stochastic noise to the source images.

As aforementioned, the SNA aims to modify semantic information by introducing
semantic noise. In nature, semantic noise is the addition of disturbance in
the efficient direction, which can change the position of data in the semantic
space with the minimum disturbance. Generally speaking, one straightforward
solution is to make the semantic encoder robust to semantic noise. Adversarial
training is an attractive alternative but comes at the cost of natural
accuracy. This article introduces the trade-off between natural and robust
accuracy [15] into SemCom for vehicular metaverses to achieve SDM.

Adversarial training involves generating online adversarial samples that
result in maximum semantic loss and allows the model to learn their
distribution. In SDM, as illustrated in Fig. 2, online adversarial samples are
generated for each data point through several iterations to maximize the
distance from benign data. The KL divergence between the outputs of the
semantic encoder is used to measure semantic distance. Both adversarial data
and benign data are fed into the semantic encoder to calculate their semantic
information. [15] The complete loss function includes two parts, natural loss,
and robust loss. The robustness loss is determined by calculating the distance
of extracted semantic information with a coefficient $\lambda$. Natural loss
refers to the original mission’s (e.g., classification) objective of improving
model accuracy, while robust loss aims at ensuring that both adversarial
samples and benign data have similar semantic information.

##  IV Case Study: Semantic Communication in Vehicular Metaverse

As a case study, we simulate a scenario to evaluate proposed attack methods
and defense performance. In this scenario, an attacker deduces the user’s
location, produces adversarial samples, and provides them to RoadSide Units
(RSUs) before the user accesses a local metaverse. To achieve this goal, we
build SemCom systems in the above framework that simulate two tasks of AR
navigation service in vehicular metaverses. The performance of the system
performing traffic sign recognition and license plate recognition is measured.
We conducted an SNA attack against these missions to assess the effectiveness
of the attacks. Defensive SemCom systems are trained according to SDM, and
their performance is re-evaluated. The same attack works on the new SemCom
systems to test them.

###  IV-A Simulation settings and Security Attacks

We consider an attacker capable to deduce the user location and provide
adversarial samples to RSUs before the user enters the local metaverse. In
this context, we develop SemCom systems to simulate two tasks related to AR
navigation services in vehicular metaverses. Specifically, we design semantic
codecs for each task, while the channel encoder and decoder are both with
dense layers with different units. During training, Additive White Gaussian
Noise (AWGN) is added to the channel with a Signal Noise Ratio (SNR) between 5
and 10 [2], allowing the SemCom system to adapt for various real communication
environments.

1) SemCom for traffic sign recognition: The GTSRB
111https://benchmark.ini.rub.de/dataset consists of more than 50,000 images
between $15*15$ to 250*250 pixels, divided into 43 classes. The pragmatic task
of traffic sign recognition is completed in the communication process without
the need to train the pragmatic function separately. In this simulation, the
semantic encoder is a ResNet, while the receiver uses a fully connected layer
to get the classification.

2) SemCom for license plate recognition: The CCPD
222https://github.com/detectRecog/CCPD dataset consists of more than 250,000
vehicle images from China for license plate detection and recognition. In this
simulation, the pragmatic task is license plate recognition, so we pre-process
the dataset according to the annotation, cutting the license plate part of its
image. The semantic encoder is an LPRNet 333https://arxiv.org/abs/1806.10447,
while the receiver uses a greedy decoder to get the license plate information.

As for the attack, to simulate the SNA in vehicular metaverses, we generate
adversarial samples of all the test images and perform the corresponding
pragmatic tasks through the SemCom system. The same attack is performed on the
defensive model. We conducted an SNA attack against these missions to assess
the effectiveness of the attacks. We set the same $L2$ norm for all attacks to
ensure that performance is compared at the same attack strength [6, 9].

###  IV-B Metrics and Defense in Semantic Communication

The robust SemCom models are trained with the aforementioned defense method
for the two pragmatic tasks. During the generating online adversarial images
phase, $10$ iterations are performed to maximize the semantic loss. In the
training phase, we set $\lambda$ as $1$ in the traffic sign recognition task,
which is $0.1$ in the license plate recognition task to achieve better
defensive performance. The same attack works on the new SemCom systems to test
them.

The natural accuracy of the SemCom system on the test set is used to
characterize its performance. For license plate recognition, only when all the
symbols on the license plate are correctly recognized can be counted. We
replace all images in the test set with the adversarial samples from the SNA
and recalculate the accuracy, called robust accuracy. To evaluate the effect
of an attack, we use natural accuracy as an upper bound. The degree of decline
in robust accuracy compared to the upper bound indicates the effectiveness of
an attack. More reduction in accuracy means more successful attacks. We also
calculate the accuracy for SDM SemCom systems to demonstrate defensive
effects. On the contrary, lower accuracy cuts mean more successful defenses.
In addition, the difference in natural accuracy between the original SemCom
system and the SDM system demonstrates the defense overhead. These assessments
are repeated in different SNR environments.

###  IV-C Numerical Results

Figure 3 displays the SNR to accuracy curves of different models when tested
on adversarial samples. In the task of recognizing traffic signs, the SemCom
model’s accuracy is significantly reduced by $40\%$ due to the SNA method.
This reduction in precision cannot ensure thr normal operation of services and
may even mislead drivers into making dangerous decisions based on incorrect
road signs. As random channel noise is considered during model training,
adding random disturbance through attack methods only causes a slight decrease
in precision. The SDM SemCom system exhibits higher accuracy than the original
system against SNA attacks. Additionally, random defense adds random
disturbance to benign images instead of maximizing semantic loss to simulate
an attack sample, resulting in weaker defensive effects compared to our
proposed approach shown in Figure 3. This phenomenon still exists with global
deviation only in license plate recognition tasks.

Figure 4 shows the natural accuracy of different models when tested with
benign data. Specifically, in the task of recognizing traffic signs, the SDM
system exhibits a natural accuracy loss of approximately $5\%$, whereas the
random defense approach results in a loss of $13\%$. Therefore, compared to
random defense, SDM provides greater security while minimizing the reduction
in natural accuracy.

Figure 4: Accuracy versus the SNR on the benign test set

##  V Future Direction

###  V-A Privacy Protection Schemes for Vehicular Metaverses

In vehicular metaverses, the communication link between vehicles and RSUs
forms a dynamic topological network structure due to vehicle mobility. During
wireless communication, there is a risk of data eavesdropping. A malicious
party could use eavesdropped data to learn private information such as user
location and driving habits. Although there exists research on eavesdropping,
the applicability of the defense schemes in dynamic environments has not been
tested. Therefore, it is necessary to design a privacy protection scheme for
the dynamic vehicular metaverse with changing network topology.

###  V-B Customized Attack Methods for Vehicular Metaverses

Security is a major concern for both communication systems and vehicle
applications. In vehicular metaverses, however, this issue has not received
enough attention. A lot of work associated with adversarial attacks, poisoning
attacks, and backdoor attacks focuses on deep learning. Moreover, a targeted
attack in that an attacker can control the information received by the vehicle
rather than just obfuscation is more harmful. If these attacks are carried
out, they are bound to raise security concerns in vehicular metaverses.
Therefore, diverse and stronger attack methods for SemCom systems need to be
invented to support robustness research.

###  V-C Efficient and Controllable Defenses for Attacks

This article presents a basic defense solution, which trains a semantic
encoder with the capability of extracting correct semantic information from
adversarial samples. However, the precision loss caused by the defensive
approach should be avoided in some cases. For relatively simple pragmatic
tasks, we can obtain security performance at a small cost, but for complex
tasks, the cost will increase. Further research is needed to develop solutions
that offer greater resistance with less cost and more controllability. The
research on attacks and defenses can complement each other to further improve
the security of semantic communication in vehicular metaverses.

##  VI Conclusions

Considering the data characteristic and service requirements, we have
developed a hierarchical framework for vehicular metaverses that addresses the
challenges of large data volumes and strict latency requirements in vehicular
metaverses. To minimize data transfer, we incorporated SemCom into the
framework, while also raising security concerns with an adversarial attack
method specific to vehicular metaverses. To protect against such attacks, we
proposed a training method for the SemCom system that can withstand semantic
noise. Our evaluation showed that our defense is effective in resisting
adversarial attacks, which is crucial for ensuring a secure and immersive
vehicular metaverse. We believe that applying security technologies to
semantic communication in both deep learning and traditional security will
provide valuable insights for creating a safe and comfortable vehicular
metaverse.

## Acknowledgment

The work is supported by NSFC under grant No. 62102099, U22A2054, No.
62101594, No. 62001125, and the Pearl River Talent Recruitment Program under
Grant 2021QN02S643, and is supported by the National Research Foundation (NRF)
and Infocomm Media Development Authority under the Future Communications
Research Development Programme (FCP). The research is also supported by the
SUTD SRG-ISTD-2021-165, the SUTD-ZJU IDEA Grant (SUTD-ZJU (VP) 202102), and
the Ministry of Education, Singapore, under its SUTD Kickstarter Initiative
(SKI 20210204).

## References

  * [1] Y. Jiang, J. Kang, D. Niyato, X. Ge, Z. Xiong, C. Miao, and X. Shen, “Reliable distributed computing for metaverse: A hierarchical game-theoretic approach,” _IEEE Transactions on Vehicular Technology_ , pp. 1–16, 2022.
  * [2] H. Xie, Z. Qin, G. Y. Li, and B.-H. Juang, “Deep learning enabled semantic communication systems,” _IEEE Transactions on Signal Processing_ , vol. 69, pp. 2663–2675, 2021.
  * [3] X. Luo, Z. Chen, M. Tao, and F. Yang, “Encrypted semantic communication using adversarial training for privacy preserving,” _arXiv preprint arXiv:2209.09008_ , 2022.
  * [4] T.-Y. Tung and D. Gunduz, “Deep joint source-channel and encryption coding: Secure semantic communications,” _arXiv preprint arXiv:2208.09245_ , 2022.
  * [5] H. Du, J. Wang, D. Niyato, J. Kang, Z. Xiong, M. Guizani, and D. I. Kim, “Rethinking wireless communication security in semantic internet of things,” _arXiv preprint arXiv:2210.04474_ , 2022.
  * [6] Q. Hu, G. Zhang, Z. Qin, Y. Cai, G. Yu, and G. Y. Li, “Robust semantic communications with masked vq-vae enabled codebook,” _arXiv preprint arXiv:2206.04011_ , 2022.
  * [7] X. Peng, Z. Qin, D. Huang, X. Tao, J. Lu, G. Liu, and C. Pan, “A robust deep learning enabled semantic communication system for text,” in _GLOBECOM 2022-2022 IEEE Global Communications Conference_. IEEE, 2022, pp. 2704–2709.
  * [8] C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, “Intriguing properties of neural networks,” _arXiv preprint arXiv:1312.6199_ , 2013.
  * [9] C. Luo, Q. Lin, W. Xie, B. Wu, J. Xie, and L. Shen, “Frequency-driven imperceptible adversarial attack on semantic similarity,” in _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , 2022, pp. 15 315–15 324.
  * [10] O. Hashash, C. Chaccour, W. Saad, K. Sakaguchi, and T. Yu, “Towards a decentralized metaverse: Synchronized orchestration of digital twins and sub-metaverses,” _arXiv preprint arXiv:2211.14686_ , 2022.
  * [11] H. Xie, Z. Qin, X. Tao, and K. B. Letaief, “Task-oriented multi-user semantic communications,” _IEEE Journal on Selected Areas in Communications_ , vol. 40, no. 9, pp. 2584–2597, 2022.
  * [12] Y. Lu and M. R. Asghar, “Semantic communications between distributed cyber-physical systems towards collaborative automation for smart manufacturing,” _Journal of manufacturing systems_ , vol. 55, pp. 348–359, 2020.
  * [13] A. Chorti, A. N. Barreto, S. Köpsell, M. Zoli, M. Chafii, P. Sehier, G. Fettweis, and H. V. Poor, “Context-aware security for 6g wireless: The role of physical layer security,” _IEEE Communications Standards Magazine_ , vol. 6, no. 1, pp. 102–108, 2022.
  * [14] W. Yang, H. Du, Z. Liew, W. Y. B. Lim, Z. Xiong, D. Niyato, X. Chi, X. S. Shen, and C. Miao, “Semantic communications for 6G future internet: Fundamentals, applications, and challenges,” _arXiv preprint arXiv:2207.00427_ , 2022.
  * [15] H. Zhang, Y. Yu, J. Jiao, E. Xing, L. El Ghaoui, and M. Jordan, “Theoretically principled trade-off between robustness and accuracy,” in _International conference on machine learning_. PMLR, 2019, pp. 7472–7482.

Jiawen Kang<EMAIL_ADDRESS>received the Ph.D. degree from the
Guangdong University of Technology, China in 2018. He was a postdoc at Nanyang
Technological University, Singapore from 2018 to 2021. He is currently a
professor at Guangdong University of Technology, China. His research interests
mainly focus on blockchain, security, and privacy protection in wireless
communications and networking.

Jiayi He<EMAIL_ADDRESS>received the B.Eng. degree from Shandong
University, Jinan, China, in 2021. He is currently pursuing an M.S. degree
with the School of Automation, Guangdong University of Technology, Guangzhou,
China. His research interests include semantic communications, security and
privacy, and artificial intelligence-generated content.

Hongyang Du<EMAIL_ADDRESS>received the B.Sc. degree from Beijing
Jiaotong University, Beijing, China, in 2021. He is currently working toward
the Ph.D. degree with the School of Computer Science and Engineering, Energy
Research Institute @ NTU, Nanyang Technological University, Singapore, under
the Interdisciplinary Graduate Program. His research interests include
semantic communications, reconfigurable intelligent surfaces, and
communication theory. He was the recipient of the IEEE Daniel E. Noble
Fellowship Award in 2022. He was recognized as an Exemplary Reviewer of the
IEEE Transactions on Communications in 2021.

Zehui Xiong<EMAIL_ADDRESS>is currently an Assistant Professor with
the Pillar of Information Systems Technology and Design, Singapore University
of Technology Design, Singapore. His research interests include wireless
communications, network games and economics, blockchain, and edge
intelligence.

Zhaohui Yang<EMAIL_ADDRESS>is currently a ZJU young professor with
College of Information Science and Electronic Engineering Zhejiang Key Lab of
Information Processing Communication and Networking, Zhejiang University, and
also a research scientist with Zhejiang Lab. His research interests include
joint communication, sensing, and computation, and semantic communication.

Xumin Huang<EMAIL_ADDRESS>received the Ph.D. degree in control
science and engineering from the Guangdong University of Technology,
Guangzhou, China, in 2019. From 2020 to 2021, he was a Visiting Scholar with
the State Key Laboratory of Internet of Things for Smart City, University of
Macau, Macau, China. He is currently an Associate Professor with the School of
Automation, Guangdong University of Technology. His research interests include
network performance analysis, simulation, and enhancement in wireless
communications and networking.

Shengli Xie<EMAIL_ADDRESS>received the M.S. degree in mathematics from
Central China Normal University, Wuhan, China, in 1992, and the Ph.D. degree
in automatic control from South China University of Technology, Guangzhou,
China, in 1997.,He was a Vice Dean of the School of Electronics and
Information Engineering, South China University of Technology from 2006 to
2010. He is currently the Director of the Institute of Intelligent Information
Processing and the Guangdong Key Laboratory of Information Technology for the
Internet of Things, and also a Professor with the School of Automation,
Guangdong University of Technology, Guangzhou. He has authored or coauthored
four monographs and more than 100 scientific papers published in journals and
conference proceedings, and was granted more than 30 patents. His research
interests broadly include statistical signal processing and wireless
communications, with an emphasis on blind signal processing and Internet of
Things.


# Determining an unbounded potential for an elliptic equation with power type
nonlinearities

Janne Nurminen  Department of Mathematics and Statistics, University of
Jyväskylä<EMAIL_ADDRESS>
###### Abstract.

In this article we focus on inverse problems for a semilinear elliptic
equation. We show that a potential $q$ in $L^{n/2+\varepsilon}$,
$\varepsilon>0$, can be determined from the full and partial Dirichlet-to-
Neumann map. This extends the results from [LLLS21a] where this is shown for
Hölder continuous potentials. Also we show that when the Dirichlet-to-Neumann
map is restricted to one point on the boundary, it is possible to determine a
potential $q$ in $L^{n+\varepsilon}$. The authors of [ST22] proved this to be
true for Hölder continuous potentials.

Keywords. Inverse problem, partial data, higher order linearization,
semilinear elliptic equation

###### Contents

  1. 1 Introduction
  2. 2 Well-posedness
  3. 3 Proof of Theorem 1.1
  4. 4 Proof of Theorem 1.2
  5. 5 Proof of Theorem 1.3

##  1\. Introduction

In this paper we consider an inverse problem of determining a potential in
$L^{\frac{n}{2}+\varepsilon}$, for positive $\varepsilon$, from the Dirichlet-
to-Neumann (DN) map related to the boundary value problem for a semilinear
elliptic equation

(1.1) $\left\\{\begin{array}[]{ll}\Delta u+qu^{m}=0,&\text{in}\,\,\Omega\\\
u=f,&\text{on}\,\,\partial\Omega,\end{array}\right.$

where $m\geq 2$, $m\in\mathbb{N}$, and $\Omega\subset\mathbb{R}^{n}$ open and
bounded. This boundary value problem is well posed for $q\in
L^{\frac{n}{2}+\varepsilon}(\Omega)$ and a certain class of boundary values.
In fact we show that there is $\delta>0$ such that for all (see [Leo17] for
Sobolev spaces)

$f\in U_{\delta}:=\\{h\in
W^{2-\frac{1}{p},p}(\partial\Omega)\colon||h||_{W^{2-\frac{1}{p},p}(\partial\Omega)}<\delta\\}$

there exists a unique small solution $u\in W^{2,p}(\Omega)$ with sufficiently
small norm. Here and in the rest of this article, we denote
$p:=\frac{n}{2}+\varepsilon$. Thus the DN map can be defined as

$\Lambda_{q}\colon U_{\delta}\to W^{1-\frac{1}{p},p}(\partial\Omega),\quad
f\mapsto\partial_{\nu}u_{f}|_{\partial\Omega}.$

Our first main result shows that we can determine the potential from the
knowledge of the DN map.

######  Theorem 1.1.

Let $\Omega\subset\mathbb{R}^{n}$, $n\geq 2$, be a bounded open set with
$C^{\infty}$ boundary, $\varepsilon>0$ and $q_{1},q_{2}\in
L^{\frac{n}{2}+\varepsilon}(\Omega)$. Let $\Lambda_{q_{j}}$ be the DN maps
associated to the boundary value problems

(1.2) $\left\\{\begin{array}[]{ll}\Delta
u+q_{j}u^{m}=0,&\text{in}\,\,\Omega\\\
u=f,&\text{on}\,\,\partial\Omega,\end{array}\right.$

for $j=1,2,$ and assume that $\Lambda_{q_{1}}f=\Lambda_{q_{2}}f$ for all $f\in
U_{\delta}$ with $\delta>0$ sufficiently small. Then $q_{1}=q_{2}$ in
$\Omega$.

This result is a special case of Theorem 1.2 but we give a proof because it is
helpful for the other two main theorems of this paper. Also the proof of
Theorem 1.1 gives a reconstruction formula for the potential $q$ via the
Fourier transform (see Corollary 3.1).

The proof Theorem 1.1 is quite similar as in [LLLS21] and it uses the method
of higher order linearization first introduced in [KLU18] and further
developed in the works [FO20], [LLLS21]. The key ingredient in this proof is
the following integral identity which characterizes the $m$-th order
linearization of the DN map $(D^{m}\Lambda_{q})_{0}$ at $0$ [LLLS21,
Proposition $2.2$]:

(1.3)
$\int_{\partial\Omega}(D^{m}\Lambda_{q_{1}}-D^{m}\Lambda_{q_{2}})_{0}(f_{1},\ldots,f_{m})f_{m+1}\,dS=-(m!)\int_{\Omega}(q_{1}-q_{2})v_{f_{1}}\cdots
v_{f_{m+1}}\,dx.$

Here $v_{f_{k}}$ are solutions to $\Delta v_{f_{k}}=0$ with boundary values
$v_{f_{k}}|_{\partial\Omega}=f_{k}$. Using this integral identity together
with a result on density of products of solutions eventually gives
$q_{1}=q_{2}$ in $\Omega$.

Theorem 1.1 has been proved for Hölder continuous potentials in [FO20] and
[LLLS21] but in this article we give a first result for a less regular
potential (at least to the best of our knowledge). The difference is in
proving that (1.2) is well-posed when the potential is in $L^{p}(\Omega)$ and
defining the DN map as a map from $U_{\delta}$ to
$W^{1-\frac{1}{p},p}(\partial\Omega)$.

In the linear case $(\Delta+q)u=0$, when $n\geq 3$, a similar result for $q\in
L^{\frac{n}{2}}(\Omega)$ has been obtained in the works [Nac92], [Cha90] and
in a more general Riemannian manifold setting in [DKS13], where they used
$L^{p}$ Carleman estimates in their proof. The case $q\in
L^{\frac{n}{2}}(\Omega)$ is considered optimal in the sense of standard well-
posedness theory and for the strong unique continuation principle [JK85].
There are also results when one assumes that $q\in W^{-1,n}(\Omega)$, see for
example [Hab18]. When $n=2$ the lowest regularity for the potential to have
uniqueness in the inverse problem, at least to the best of our knowledge, is
$L^{\frac{4}{3}}(\Omega)$ [BTW20]. The same result is true on compact
Riemannian surfaces with smooth boundary [Ma20]. In dimension two the unique
continuation principle holds for potentials in $L^{p}(\Omega)$ where $p>1$
(see for example [Ale12], [ABG81]).

In addition to the full data case, we consider some partial data results for
the Schrödinger equation with unbounded potentials. In particular, let
$\Gamma$ be an open subset of the boundary $\partial\Omega$. Define the
partial Dirichlet-to-Neumann map for $f\in U_{\delta}$,
$\operatorname{spt}(f)\subset\Gamma$, as

$\Lambda_{q}^{\Gamma}f=\partial_{\nu}u|_{\Gamma}.$

Then from the knowledge of this partial DN map it is possible to determine the
potential.

######  Theorem 1.2.

Let $\Omega\subset\mathbb{R}^{n}$, $n\geq 2$, be a connected open and bounded
set with $C^{\infty}$ boundary and let $\Gamma\neq\emptyset$ be an open subset
of the boundary $\partial\Omega$. Let $\varepsilon>0$, $q_{1},q_{2}\in
L^{\frac{n}{2}+\varepsilon}(\Omega)$ and $\Lambda_{q_{j}}^{\Gamma}$ be the
partial DN maps associated to the boundary value problems

$\left\\{\begin{array}[]{ll}\Delta u+q_{j}u^{m}=0,&\text{in}\,\,\Omega\\\
u=0,&\text{on}\,\,\partial\Omega\setminus\Gamma\\\
u=f,&\text{on}\,\,\Gamma\end{array}\right.$

for $j=1,2$. Assume that

$\Lambda_{q_{1}}^{\Gamma}f=\Lambda_{q_{2}}^{\Gamma}f$

for all $f\in U_{\delta}$ with $\operatorname{spt}(f)\subset\Gamma$, where
$\delta>0$ sufficiently small. Then $q_{1}=q_{2}$ in $\Omega$.

When the potentials are assumed to be Hölder continuous, then this theorem has
been proved in [KU20] and [LLLS21a] using the method of higher order
linearization, which we will also use. Here again the key ingredients are the
integral identity (1.3) and a density result for solutions of the Laplacian
[DKSU09].

For the linear Schrödinger equation, partial data results with unbounded
potentials have been proved only for special cases of partial data. When
$n\geq 3$, it is proved in [CT20] that from the knowledge of the partial DN
map in a specific situation it is possible to determine a potential in
$L^{\frac{n}{2}}(\Omega)$. The authors use a method involving the construction
of a Dirichlet Green’s function for the conjugated Laplacian. In a similar
situation on a manifold setting, [Tzo18] shows that a potential in
$L^{\frac{n}{2}}$ can be determined from a particular case of partial data.
When $n=2$ the best known result for the case of an arbitrary open subset of
the boundary is for potentials in the Sobolev space $W^{1,p}(\Omega)$, for
$p>2$ [IY12].

For partial data results, there is still the case when we are restricted to
only one point on the boundary. In the situation of $\Delta u+qu^{m}$ with the
potential $q$ in $C^{\alpha}(\bar{\Omega})$ this has been proved in [ST22]
using the method of higher order linearization. Here we show that the same
result holds even if we only assume that $q\in L^{n+\varepsilon}(\Omega)$ for
a positive $\varepsilon$.

######  Theorem 1.3.

Let $\Omega\subset\mathbb{R}^{n}$, $n\geq 2$, be a connected open and bounded
set with $C^{\infty}$ boundary and let $\Gamma\neq\emptyset$ be an open subset
of the boundary $\partial\Omega$. Suppose that $\mu\not\equiv 0$ is a fixed
measure on $\partial\Omega$ and let $\varepsilon>0$. Assume that
$q_{1},q_{2}\in L^{n+\varepsilon}(\Omega)$ satisfy

(1.4)
$\int_{\partial\Omega}\Lambda_{q_{1}}(f)\,d\mu=\int_{\partial\Omega}\Lambda_{q_{2}}(f)\,d\mu$

for all $f\in U_{\delta}$ with $\operatorname{spt}(f)\subset\Gamma$, where
$\delta>0$ sufficiently small. Then $q_{1}=q_{2}$ in $\Omega$. Thus when
choosing $\mu=\delta_{x_{0}}$ for some fixed $x_{0}\in\partial\Omega$ the
condition

$\Lambda_{q_{1}}(f)(x_{0})=\Lambda_{q_{2}}(f)(x_{0})\quad\text{for
all}\enspace f\in
U_{\delta}\enspace\text{with}\enspace\operatorname{spt}(f)\subset\Gamma$

gives $q_{1}=q_{2}$ in $\Omega$.

The proof of this theorem is very similar to the one in [ST22] and it uses
heavily the identity (1.3) and a density result for solutions of the Laplacian
[ST22] (see also [CGU21, Section 4]).

It is an interesting question if in Theorems 1.1 and 1.2 it is enough to
assume the potential $q$ to be in $L^{\frac{n}{2}}(\Omega)$ and if in Theorem
1.3 the potential $q$ could be in $L^{q}(\Omega)$ for $q=n$ or even $q<n$.

The rest of this paper is organized as follows. In section 2 we prove the
well-posedness of the boundary value problem (1.1). In sections 3 to 5 the
proofs for Theorems 1.1, 1.2 and 1.3 are given.

Acknowledgements. The author was supported by the Finnish Centre of Excellence
in Inverse Modelling and Imaging (Academy of Finland grant 284715). The author
would like to thank Mikko Salo for helpful discussions on everything related
to inverse problems.

##  2\. Well-posedness

A short reminder for the reader that we denote here and in the rest of this
article $p:=\frac{n}{2}+\varepsilon$.

######  Theorem 2.1.

(Well-posedness) Let $\Omega\subset\mathbb{R}^{n},n\geq 2,$ be a bounded open
set with $C^{\infty}$ boundary, $\varepsilon>0$ and let $q\in L^{p}(\Omega).$
Then there exist $\delta,C>0$ such that for any

$f\in U_{\delta}:=\\{h\in
W^{2-\frac{1}{p},p}(\partial\Omega)\colon||h||_{W^{2-\frac{1}{p},p}(\partial\Omega)}<\delta\\},$

there is a unique small solution $u_{f}$ in the class $\\{v\in
W^{2,p}(\Omega)\colon||w||_{W^{2,p}(\Omega)}\leq C\delta\\}$ of the boundary
value problem

(2.1) $\left\\{\begin{array}[]{ll}\Delta u+qu^{m}=0,&\text{in}\,\,\Omega\\\
u=f,&\text{on}\,\,\partial\Omega,\end{array}\right.$

where $m\in\mathbb{N}$ and $m\geq 2$. Moreover

$||u||_{W^{2,p}(\Omega)}\leq C||f||_{W^{2-\frac{1}{p},p}(\partial\Omega)},$

and there are $C^{\infty}$ maps

$\displaystyle S$ $\displaystyle\colon U_{\delta}\to W^{2,p}(\Omega),\quad
f\mapsto u_{f},$ $\displaystyle\Lambda_{q}$ $\displaystyle\colon U_{\delta}\to
W^{1-\frac{1}{p},p}(\partial\Omega),\quad
f\mapsto\partial_{\nu}u_{f}|_{\partial\Omega}.$

The proof uses the implicit function theorem between Banach spaces [RR04,
Theorem $10.6$ and Remark $10.5$] and is very similar to the one in [LLLS21,
Proposition $2.1$]. The difference here is that we replace Hölder spaces with
Sobolev spaces and one needs to be careful with various embeddings for these
spaces.

  * Proof.

Let

$X=W^{2-\frac{1}{p},p}(\partial\Omega),\quad Y=W^{2,p}(\Omega),\quad
Z=L^{p}(\Omega)\times W^{2-\frac{1}{p},p}(\partial\Omega)$

and $F\colon X\times Y\to Z,$

$F(f,u)=(Q(u),u|_{\partial\Omega}-f),$

where $Q(u)=\Delta u+qu^{m}.$ Let us now show that $F$ has the claimed mapping
property. Since $u\in W^{2,p}(\Omega)$, this implies that
$u|_{\partial\Omega}\in W^{2-\frac{1}{p},p}(\partial\Omega)$ (see [Leo17]) and
$\Delta u\in L^{p}(\Omega)$. Hence we need to show that the term $qu^{m}\in
L^{p}(\Omega)$. Since $2\left(\frac{n}{2}+\varepsilon\right)>n$, then by the
Sobolev embedding theorem [Leo17] $u\in C^{0,\alpha}(\bar{\Omega})$, for
$0<\alpha<1$, which is a subset of $L^{s}(\Omega)$ for every $1\leq
s\leq\infty$. Now this implies

$||qu^{m}||_{L^{p}(\Omega)}\leq||q||_{L^{p}(\Omega)}||u^{m}||_{L^{\infty}(\Omega)}\leq||q||_{L^{p}(\Omega)}\left(||u||_{L^{\infty}(\Omega)}\right)^{m}<\infty$

and thus $qu^{m}\in L^{p}(\Omega)$. Hence $F$ has the claimed mapping
property.

Next we want to show that $F$ is a $C^{\infty}$ mapping. Since $u\mapsto\Delta
u$ is a linear map $W^{2,p}(\Omega)\to L^{p}(\Omega)$, it is enough to show
that $u\mapsto qu^{m}$ is a $C^{\infty}$ map $W^{2,p}(\Omega)\to
L^{p}(\Omega)$. This follows since $u^{m}$ is a polynomial. More precisely,
let $u,v\in W^{2,p}(\Omega)$ and use the Taylor formula:

$\displaystyle q(u+v)^{m}$
$\displaystyle=\sum_{j=0}^{m}\frac{\partial_{u}^{j}(qu^{m})}{j!}v^{j}+\int_{0}^{1}\frac{\partial_{u}^{m+1}\left(q(u+tv)^{m}\right)}{m!}v^{m+1}(1-t)\,dt$
$\displaystyle=\sum_{j=0}^{m}\frac{\partial_{u}^{j}(qu^{m})}{j!}v^{j}.$

Now for $||v||_{W^{2,p}(\Omega)}\leq 1$ the above gives

$\displaystyle\Bigg{|}\Bigg{|}q(u+v)^{m}-\sum_{j=0}^{m}\frac{\partial_{u}^{j}(qu^{m})}{j!}v^{j}\Bigg{|}\Bigg{|}_{L^{p}(\Omega)}=0\leq||v||_{W^{2,p}(\Omega)}^{k+1}$

and thus the map $u\mapsto q(x)u^{m}$ is $C^{k}$ (in the sense of [RR04,
Definition $10.2$]) for all $k\in\mathbb{N}$. Hence it is a $C^{\infty}$ map
and $F$ is also $C^{\infty}$ .

Our aim is to use the implicit function theorem for Banach spaces to get a
unique solution for the boundary value problem (2.1). Firstly, the
linearization of $F$ at $(0,0)$ in the second variable is

$D_{u}F|_{(0,0)}(v)=(\Delta v,v|_{\partial\Omega}),$

which is linear and also $F(0,0)=0$. Secondly, $D_{u}F|_{(0,0)}\colon Y\to Z$
is a homeomorphism. To see this, let $(\phi,g)\in Z$ and consider the boundary
value problem

$\left\\{\begin{array}[]{ll}\Delta v=\phi,&\text{in}\,\,\Omega\\\
v=g,&\text{on}\,\,\partial\Omega.\end{array}\right.$

This problem has a unique solution for each pair $(\phi,g)$ (see for example
[GT01, Theorem $9.15$]), and thus $D_{u}F|_{(0,0)}$ is bijective. We also have
the estimate

$||D_{u}F|_{(0,0)}(v)||^{2}_{Z}=||\Delta
v||^{2}_{L^{p}(\Omega)}+||v|_{\partial\Omega}||_{W^{2-\frac{1}{p},p}(\partial\Omega)}^{2}\leq
M||v||^{2}_{W^{2,p}(\Omega)},$

because the trace operator from $W^{2,p}(\Omega)$ to
$W^{2-\frac{1}{p},p}(\partial\Omega)$ is bounded (see [Leo17]). Hence
$D_{u}F|_{(0,0)}$ is also bounded and then the open mapping theorem (see e.g.
[RR04, Theorem $8.33$]) tells us that it is also a homeomorphism.

Now by the implicit function theorem [RR04, Theorem $10.6$] there exists
$\delta>0$, a neighborhood $U_{\delta}=B(0,\delta)\subset X$ and a
$C^{\infty}$ map $S\colon U_{\delta}\to Y$ such that $F(f,S(f))=0$ for
$||f||_{W^{2-\frac{1}{p},p}(\partial\Omega)}\leq\delta$. Now $S$ is also
Lipschitz continuous, $S(0)=0,S(f)=u$ and thus we have

$||u||_{W^{2,p}(\Omega)}\leq C||f||_{W^{2-\frac{1}{p},p}(\partial\Omega)}$

for $C>0$. By redefining $\delta$ if necessary we have the estimates
$||f||_{W^{2-\frac{1}{p},p}(\partial\Omega)}\leq\delta$,
$||u||_{W^{2,p}(\Omega)}\leq C\delta$ and the implicit function theorem gives
that $u$ is the unique small solution of $F(f,u)=0$. Also the solution
operator $S\colon U_{\delta}\to W^{2,p}(\Omega)$ is a $C^{\infty}$ map.
Because $u\in W^{2,p}(\Omega)$, then $\nabla u\in W^{1,p}(\Omega)$. The trace
operator is a bounded linear map from $W^{1,p}(\Omega)$ to
$W^{1-\frac{1}{p},p}(\partial\Omega)$ (see [Leo17]) and thus
$\partial_{\nu}u\in W^{1-\frac{1}{p},p}(\partial\Omega)$ is defined almost
everywhere on $\partial\Omega$. Hence $\Lambda_{q}$ is a well defined
$C^{\infty}$ map between $U_{\delta}$ and
$W^{1-\frac{1}{p},p}(\partial\Omega)$. ∎

######  Remark 2.2.

In the previous proof, we showed that the mapping $D_{u}F|_{(0,0)}$ is
bijective and bounded and deduced that it is a homeomorphism. An alternative
way to see this is to look at the inverse map $(D_{u}F|_{(0,0)})^{-1}\colon
Z\to Y$ and show that it is bijective and bounded. In order to do this, one
needs to prove the following estimate:

$||v||_{W^{2,p}(\Omega)}\leq
C\left(||\phi||_{L^{p}(\Omega)}+||g||_{W^{2-\frac{1}{p},p}(\partial\Omega)}\right),$

where $C>0$ does not depend on $v$, $\phi$ and $g$. This can be done for
example by combining the estimate

$||v||_{W^{2,p}(\Omega)}\leq
C\left(||\phi||_{L^{p}(\Omega)}+||g||_{W^{2-\frac{1}{p},p}(\partial\Omega)}+||v||_{L^{p}(\Omega)}\right)$

from [WYW06, Theorem $9.1.3$] with the assumption that $0$ is not a Dirichlet
eigenvalue and using a compactness argument.

##  3\. Proof of Theorem 1.1

Using the method of higher order linearization we prove that it is possible to
determine a potential in $L^{p}(\Omega)$ from the knowledge of full DN map.

  * Proof of Theorem 1.1.

Let $\lambda_{1},\ldots,\lambda_{m}$ be sufficiently small numbers,
$\lambda=(\lambda_{1},\ldots,\lambda_{m})$ and $f_{1},\ldots,f_{m}\in
W^{2-\frac{1}{p},p}(\partial\Omega)$. Let $u_{j}(x,\lambda)\in
W^{2,p}(\Omega)$ be the unique small solution to

(3.1) $\left\\{\begin{array}[]{ll}\Delta
u_{j}+q_{j}u_{j}^{m}=0,&\text{in}\,\,\Omega\\\
u_{j}=\sum_{k=1}^{m}\lambda_{k}f_{k},&\text{on}\,\,\partial\Omega.\end{array}\right.$

Differentiating this with respect to $\lambda_{l},l\in\\{1,\ldots,m\\}$
(possible by Theorem 2.1 which shows that $S$ is a $C^{\infty}$ map) and
setting $\lambda=0$ gives that
$v_{j}^{l}:=\partial_{\lambda_{l}}u_{j}(x,\lambda)|_{\lambda=0}$ satisfies

(3.2) $\left\\{\begin{array}[]{ll}\Delta v_{j}^{l}=0,&\text{in}\,\,\Omega\\\
v_{j}^{l}=f_{l},&\text{on}\,\,\partial\Omega.\end{array}\right.$

This has a unique solution in $W^{2,p}(\Omega)$ (see for example [GT01,
Theorem $9.15$]) and thus we can define $v^{l}:=v_{1}^{l}=v_{2}^{l}.$ Also the
first linearizations of the DN maps $\Lambda_{q_{j}}$ are the DN maps of the
Laplace equation.

Let $1<a\leq m-1$ be an integer and $l_{1},\ldots,l_{a}\in\\{1,\ldots,m\\}$.
Then the $a$-th order linearization of (3.1) is

$\left\\{\begin{array}[]{ll}\Delta(\partial_{\lambda_{l_{1}}}\cdots\partial_{\lambda_{l_{a}}}u_{j}(x,\lambda)|_{\lambda=0})=0,&\text{in}\,\,\Omega\\\
\partial_{\lambda_{l_{1}}}\cdots\partial_{\lambda_{l_{a}}}u_{j}(x,\lambda)|_{\lambda=0}=0,&\text{on}\,\,\partial\Omega.\end{array}\right.$

and uniqueness of solutions for the Laplace equation gives that $0$ is the
only solution. Thus the $a$-th order linearization of the DN maps
$\Lambda_{q_{j}}$ are equal to $0$.

Moving to the $m$-th order linearization, we apply
$\partial_{\lambda_{1}}\cdots\partial_{\lambda_{m}}|_{\lambda=0}$ to (3.1)
which results in the boundary value problem

(3.3) $\left\\{\begin{array}[]{ll}\Delta
w_{j}=-m!q_{j}\prod_{k=1}^{m}v^{k},&\text{in}\,\,\Omega\\\
w_{j}=0,&\text{on}\,\,\partial\Omega.\end{array}\right.$

Here
$w_{j}=\partial_{\lambda_{1}}\cdots\partial_{\lambda_{m}}u_{j}(x,\lambda)|_{\lambda=0}$
and the functions $v^{k},k\in\\{1,\ldots,m\\},$ are solutions to equation
(3.2) with corresponding boundary values $f_{k}$. On the left hand side of
(3.3) we are only left with a product of functions $v^{k}$, since after
differentiating (3.1) $m$ times with respect to $\varepsilon$, all other terms
involve a positive power of $u_{j}$. Proposition 2.1 says that the solution
$u_{j}$ depends smoothly on $\varepsilon$ and thus when evaluating at
$\varepsilon=0$, the function $u_{j}$ vanishes.

By our assumptions we have that
$\Lambda_{q_{1}}\left(\sum_{k=1}^{m}\lambda_{k}f_{k}\right)=\Lambda_{q_{2}}\left(\sum_{k=1}^{m}\lambda_{k}f_{k}\right)$
and thus
$\partial_{\nu}u_{1}|_{\partial\Omega}=\partial_{\nu}u_{2}|_{\partial\Omega}$.
Applying $\partial_{\lambda_{1}}\cdots\partial_{\lambda_{m}}|_{\lambda=0}$ to
this gives
$\partial_{\nu}w_{1}|_{\partial\Omega}=\partial_{\nu}w_{2}|_{\partial\Omega}$.
Subtracting (3.3) for $j=1,2$ and integrating against $v\equiv 1$ (a solution
of (3.2)) over $\Omega$ implies

(3.4)
$\int_{\Omega}m!(q_{1}-q_{2})\prod_{k=1}^{m}v^{k}\,dx=-\int_{\Omega}\Delta(w_{1}-w_{2})\,dx=-\int_{\partial\Omega}\partial_{\nu}(w_{1}-w_{2})\,dS=0.$

Let us now choose $v^{1},v^{2}$ to be the Calderón’s exponential solutions
[Cal80]

(3.5) $v^{1}(x):=e^{(\eta+i\xi)\cdot x},\quad v^{2}(x):=e^{(-\eta+i\xi)\cdot
x},$

where $\eta,\xi\in\mathbb{R}^{n}$, $\eta\perp\xi$ and $|\eta|=|\xi|$, and
$v^{k}\equiv 1$ for $k=3,\ldots,m$. Then we get that the Fourier transform of
the difference $q_{1}-q_{2}$ at $-2\xi$ vanishes. Thus $q_{1}=q_{2}$ since
$\xi$ was arbitrary. ∎

Notice that this proof gives a reconstruction formula for the potential. In
particular, inspecting the last lines after equation (3.4) we have the
following result which reconstructs the potential $q$ via its Fourier
transform.

######  Corollary 3.1.

Let $\Omega\subset\mathbb{R}^{n}$, $n\geq 2$, be a bounded open set with
$C^{\infty}$ boundary, $\varepsilon>0$ and $q\in L^{p}(\Omega)$. Let
$\Lambda_{q}$ be the DN map associated to the boundary value problem

$\left\\{\begin{array}[]{ll}\Delta u+qu^{m}=0,&\text{in}\,\,\Omega\\\
u=f,&\text{on}\,\,\partial\Omega.\end{array}\right.$

Then, denoting $\lambda=(\lambda_{1},\ldots,\lambda_{m})$,

$\hat{q}(-2\xi)=-\frac{1}{m!}\int_{\partial\Omega}\frac{\partial^{m}}{\partial\lambda_{1}\cdots\partial\lambda_{m}}\big{|}_{\lambda=0}\Lambda_{q}\left(\sum_{k=1}^{m}\lambda_{k}f_{k}\right)\,dS,$

where $f_{1},f_{2}$ are the boundary values of Calderón’s exponential
solutions (3.5), $f_{k}\equiv 1$ for $3\leq k\leq m$ and $\hat{q}$ is the
Fourier transform of $q$.

##  4\. Proof of Theorem 1.2

We prove the partial data result for determining a potential in
$L^{p}(\Omega)$ by using higher order linearization. The proof uses similar
techniques as in [KU20] and [LLLS21a].

  * Proof of Theorem 1.2.

Let $\lambda_{1},\ldots,\lambda_{m}$ be sufficiently small numbers,
$\lambda=(\lambda_{1},\ldots,\lambda_{m})$ and $f_{1},\ldots,f_{m}\in
W^{2-\frac{1}{p},p}(\partial\Omega)$ with
$\operatorname{spt}(f)\subset\Gamma$. Let $u_{j}(x,\lambda)\in
W^{2,p}(\Omega)$ be the unique small solution to

$\left\\{\begin{array}[]{ll}\Delta
u_{j}+q_{j}u_{j}^{m}=0,&\text{in}\,\,\Omega\\\
u_{j}=\sum_{k=1}^{m}\lambda_{k}f_{k},&\text{on}\,\,\partial\Omega.\end{array}\right.$

The first and $m$-th order linearizations are the same as in the proof of
Theorem 1.1, with corresponding boundary values. We also define
$v^{l}:=v_{1}^{l}=v_{2}^{l}$ by uniqueness of solutions to (3.2). Let
$v^{(0)}$ be the solution to

$\left\\{\begin{array}[]{ll}\Delta v^{(0)}=0,&\text{in}\,\,\Omega\\\
v^{(0)}=0,&\text{on}\,\,\partial\Omega\setminus\Gamma\\\
v^{(0)}=g,&\text{on}\,\,\Gamma,\end{array}\right.$

where $g\in C^{\infty}_{c}(\Gamma)$ with $g$ non-negative and not identically
zero. By the maximum principle, $v^{(0)}>0$ in $\Omega$. Then subtracting
(3.3) for $j=1,2$ and integrating against $v^{(0)}$ gives the following
integral identity (compare to (3.4))

(4.1)
$\displaystyle-\int_{\Omega}m!(q_{1}-q_{2})v^{(0)}\prod_{k=1}^{m}v^{k}\,dx$
$\displaystyle=\int_{\Omega}\Delta(w_{1}-w_{2})v^{(0)}\,dx$
$\displaystyle=\int_{\Omega}(w_{1}-w_{2})\Delta v^{(0)}\,dx$
$\displaystyle+\int_{\partial\Omega}v^{(0)}\partial_{\nu}(w_{1}-w_{2})-(w_{1}-w_{2})\partial_{\nu}v^{(0)}\,dS$
$\displaystyle=\int_{\partial\Omega}v^{(0)}\partial_{\nu}(w_{1}-w_{2})-(w_{1}-w_{2})\partial_{\nu}v^{(0)}\,dS$

Here Green’s formula and the fact that $\Delta v^{(0)}=0$ in $\Omega$ were
used. Now our assumption on the DN maps coinciding gives
$\partial_{\nu}u_{1}|_{\Gamma}=\partial_{\nu}u_{2}|_{\Gamma}$ and when
applying $\partial_{\lambda_{1}}\cdots\partial_{\lambda_{m}}|_{\lambda=0}$ to
this, we have $\partial_{\nu}w_{1}|_{\Gamma}=\partial_{\nu}w_{2}|_{\Gamma}$.
Also $w_{1}-w_{2}=0$ on $\partial\Omega$ by (3.3) and $v^{(0)}=0$ on
$\partial\Omega\setminus\Gamma$. Using these (4.1) becomes

(4.2)
$\displaystyle-\int_{\Omega}m!(q_{1}-q_{2})v^{(0)}\prod_{k=1}^{m}v^{k}\,dx$
$\displaystyle=\int_{\partial\Omega}v^{(0)}\partial_{\nu}(w_{1}-w_{2})-(w_{1}-w_{2})\partial_{\nu}v^{(0)}\,dS$
$\displaystyle=\int_{\partial\Omega\setminus\Gamma}v^{(0)}\partial_{\nu}(w_{1}-w_{2})\,dS+\int_{\Gamma}v^{(0)}\partial_{\nu}(w_{1}-w_{2})\,dS$
$\displaystyle=0.$

By Theorem 1.1 in [DKSU09] there exist special complex valued harmonic
functions that vanish on $\partial\Omega\setminus\Gamma$ and that the set of
products of these functions is dense in $L^{1}(\Omega)$. Choosing $v^{1}$ and
$v^{2}$ to be real and imaginary parts of these solutions we can conclude from
(4.2) that

$m!(q_{1}-q_{2})v^{(0)}\prod_{k=1}^{m}v^{k}=0\quad\text{in}\enspace\Omega.$

Let $f_{k}\in C_{c}^{\infty}(\Gamma)$, $f_{k}$ non-negative and $f_{k}>0$
somewhere for $k=3,\ldots,m$. Then again the maximum principle gives that
$v^{k}>0$ in $\Omega$. Combining this with $v^{(0)}>0$ in $\Omega$ then
implies $q_{1}=q_{2}\quad\text{in}\enspace\Omega.$ ∎

##  5\. Proof of Theorem 1.3

As in [ST22], we need a lemma stating that the solution to the boundary value
problem with a finite Borel measure $\mu$ as boundary value is in
$L^{r}(\Omega)$ for $1\leq r<\frac{n}{n-1}$. For the lemma, denote by
$r^{\prime}$ the dual exponent of $1\leq r\leq\infty$.

######  Lemma 5.1.

Let $\Omega\subset\mathbb{R}^{n}$, $n\geq 2$ be a bounded open set with
$C^{\infty}$ boundary and $\mu$ a finite complex Borel measure on
$\partial\Omega$. Then for the function

(5.1) $\Psi(x)=\int_{\partial\Omega}P(x,y)\,d\mu(y),\quad x\in\Omega,$

where $P(x,y)$ is the Poisson kernel for $\Delta$ in $\Omega$, we have
$\Psi\in L^{r}(\Omega)$, $1\leq r<\frac{n}{n-1}$. Additionally $\Psi$ solves
the boundary value problem

$\left\\{\begin{array}[]{ll}\Delta\Psi=0,&\text{in}\,\,\Omega\\\
\Psi=\mu,&\text{on}\,\,\partial\Omega,\end{array}\right.$

where $\Psi=\mu$ on $\partial\Omega$ means that for any $w\in
W^{2,r^{\prime}}(\Omega)$ with $w|_{\partial\Omega}=0$, in trace sense, one
has

(5.2) $\int_{\partial\Omega}\partial_{\nu}w\,d\mu=\int_{\Omega}(\Delta
w)\Psi\,dx.$

Notice that the left hand side of relation (5.2) is well defined since
$\partial_{\nu}w$ is continuous by the Sobolev embedding theorem (see for
example [Leo17]): The assumption $w\in W^{2,r^{\prime}}(\Omega)$ says that
$\nabla w\in W^{1,r^{\prime}}(\Omega)$. This space embeds to
$C^{0,1-\frac{n}{r^{\prime}}}(\bar{\Omega})$ if $r^{\prime}>n$. Notice that
$r^{\prime}>n$ is equivalent with the assumption that $1\leq r<\frac{n}{n-1}$.
Also the right hand side of (5.2) is well defined by the fact that $\Delta
w\in L^{r^{\prime}}(\Omega),\Psi\in L^{r}(\Omega)$ implies $(\Delta w)\Psi\in
L^{1}(\Omega)$.

The proof of this lemma is the same as in [ST22, Lemma 2.1.]. The only
difference when compared to the statement in [ST22], is that we assume $w\in
W^{2,r^{\prime}}(\Omega)$ instead of $w\in C^{2}(\bar{\Omega})$.

  * Proof of Theorem 1.3.

As before, we use the method of higher order linearization. Let
$\lambda_{1},\ldots,\lambda_{m}$ be sufficiently small numbers,
$\lambda=(\lambda_{1},\ldots,\lambda_{m})$ and $f_{1},\ldots,f_{m}\in
W^{2-\frac{1}{p},p}(\partial\Omega)$ with
$\operatorname{spt}(f)\subset\Gamma$. Let $u_{j}(x,\lambda)\in
W^{2,p}(\Omega)$ be the unique small solution to

$\left\\{\begin{array}[]{ll}\Delta
u_{j}+q_{j}u_{j}^{m}=0,&\text{in}\,\,\Omega\\\
u_{j}=\sum_{k=1}^{m}\lambda_{k}f_{k},&\text{on}\,\,\partial\Omega.\end{array}\right.$

The first and $m$-th order linearizations are the same as in the proof of
Theorem 1.1, with corresponding boundary values. We also define
$v^{l}:=v_{1}^{l}=v_{2}^{l}$ by uniqueness of solutions to (3.2).

Let $\varepsilon>0$ and $q_{1},q_{2}\in L^{n+\varepsilon}(\Omega)$ be such
that (1.4) holds for all $f\in U_{\delta}$,
$\operatorname{spt}(f)\subset\Gamma$ with sufficiently small $\delta$. From
$\partial_{\lambda_{1}}\cdots\partial_{\lambda_{m}}\Lambda_{q_{j}}(f)=\partial_{\lambda_{1}}\cdots\partial_{\lambda_{m}}\partial_{\nu}u_{j}|_{\partial\Omega}=\partial_{\nu}w_{j}|_{\partial\Omega}$,
where $w_{j}$ is the solution to (3.3), and equation (1.4) we get that

$\int_{\partial\Omega}(\partial_{\nu}w_{1}-\partial_{\nu}w_{2})\,d\mu=0.$

Let $\Psi\in L^{(n+\varepsilon)^{\prime}}(\Omega)$ be the function given by
(5.1) which is a solution to

$\left\\{\begin{array}[]{ll}\Delta\Psi=0,&\text{in}\,\,\Omega\\\
\Psi=\mu,&\text{on}\,\,\partial\Omega\end{array}\right.$

in the sense of Lemma 5.1. Notice that
$(n+\varepsilon)^{\prime}<\frac{n}{n-1}$ and $w_{j}\in
W^{2,n+\varepsilon}(\Omega)$ because $-m!q_{j}\prod_{k=1}^{m}v^{k}\in
L^{n+\varepsilon}(\Omega)$ (see for example [GT01, Theorem $9.15$]). Thus
combining (5.2) and (3.3) gives

$\displaystyle
0=\int_{\partial\Omega}(\partial_{\nu}w_{1}-\partial_{\nu}w_{2})\,d\mu=\int_{\Omega}\Delta(w_{1}-w_{2})\Psi\,dx=-\int_{\Omega}m!(q_{1}-q_{2})\prod_{k=1}^{m}v^{k}\Psi\,dx,$

where each $v^{k}$ is a solution to the Laplace equation with corresponding
boundary value $f_{k}$. Let $f_{3},\ldots,f_{m}\in C^{\infty}(\partial\Omega)$
be such that $\operatorname{spt}(f_{k})\subset\Gamma$, $f_{k}\geq 0$ and
$f_{k}>0$ somewhere, then by the maximum principle $v^{k}>0$ in $\Omega$.
Choosing the boundary values $f_{1},f_{2}\in C^{\infty}(\partial\Omega)$,
$\operatorname{spt}(f_{1}),\operatorname{spt}(f_{2})\subset\Gamma$ , we get by
elliptic regularity that $v^{1},v^{2}$ are smooth and thus we may apply
Theorem $1.3$ from [ST22] (see also [CGU21, Section 4]) to get

$m!(q_{1}-q_{2})v_{3}\cdots v_{m}\Psi=0\quad\text{a.e. in}\enspace\Omega.$

The positivity of $v_{3},\ldots,v_{m}$ implies that $(q_{1}-q_{2})\Psi=0$ a.e.
in $\Omega$. Now we claim that $\Psi$ cannot vanish in any set
$E\subset\Omega$ of positive measure. This can be seen as follows: We argue by
contradiction and assume that $\Psi=0$ in $E\subset\Omega$ where $E$ has
positive measure. Then by a unique continuation principle (see for example
[HU17], $n>2$, and for $n=2$ [HPS19]) $\Psi=0$ in $\Omega$. From [Kra05] there
is a constant $c>0$ such that for all $(x,y)\in\Omega\times\partial\Omega$

$c\cdot\frac{\operatorname{dist}(x,\partial\Omega)}{|x-y|^{n}}\leq P(x,y).$

In view of the definition of $\Psi$ in (5.1) this would imply that $\mu\equiv
0$ which is a contradiction. Hence we must have that $q_{1}=q_{2}$ a.e. in
$\Omega$. ∎

## References

  * [ABG81] W O Amrein, A.-M. Berthier and V Georgescu  “$L^{p}$-inequalities for the Laplacian and unique continuation”  In _Ann. Inst. Fourier (Grenoble)_ 31.3, 1981, pp. vii153–168  URL: http://www.numdam.org/item?id=AIF_1981__31_3_153_0
  * [Ale12] Giovanni Alessandrini  “Strong unique continuation for general elliptic equations in 2D”  In _J. Math. Anal. Appl._ 386.2, 2012, pp. 669–676  DOI: 10.1016/j.jmaa.2011.08.029
  * [BTW20] Emilia Blåsten, Leo Tzou and Jenn-Nan Wang  “Uniqueness for the inverse boundary value problem with singular potentials in 2D”  In _Math. Z._ 295.3-4, 2020, pp. 1521–1535  DOI: 10.1007/s00209-019-02436-0
  * [Cal80] Alberto-P. Calderón  “On an inverse boundary value problem”  In _Seminar on Numerical Analysis and its Applications to Continuum Physics (Rio de Janeiro, 1980)_ Soc. Brasil. Mat., Rio de Janeiro, 1980, pp. 65–73
  * [CGU21] Cătălin I. Cârstea, Tuhin Ghosh and Gunther Uhlmann  “An inverse problem for the porous medium equation with partial data and a possibly singular absorption term”, 2021  arXiv: http://arxiv.org/abs/2108.12970
  * [Cha90] Sagun Chanillo  “A problem in electrical prospection and an $n$-dimensional Borg-Levinson theorem”  In _Proc. Amer. Math. Soc._ 108.3, 1990, pp. 761–767  DOI: 10.2307/2047798
  * [CT20] Francis J Chung and Leo Tzou  “Partial data inverse problem with $L^{n/2}$ potentials”  In _Trans. Amer. Math. Soc. Ser. B_ 7, 2020, pp. 97–132  DOI: 10.1090/btran/39
  * [DKS13] David Dos Santos Ferreira, Carlos E Kenig and Mikko Salo  “Determining an unbounded potential from Cauchy data in admissible geometries”  In _Comm. Partial Differential Equations_ 38.1, 2013, pp. 50–68  DOI: 10.1080/03605302.2012.736911
  * [DKSU09] David Dos Santos Ferreira, Carlos E. Kenig, Johannes Sjöstrand and Gunther Uhlmann  “On the linearized local Calderón problem”  In _Mathematical Research Letters_ 16.6, 2009, pp. 955–970  DOI: 10.4310/MRL.2009.v16.n6.a4
  * [FO20] Ali Feizmohammadi and Lauri Oksanen  “An inverse problem for a semi-linear elliptic equation in Riemannian geometries”  In _J. Differential Equations_ 269.6, 2020, pp. 4683–4719  DOI: 10.1016/j.jde.2020.03.037
  * [GT01] David Gilbarg and Neil S Trudinger  “Elliptic partial differential equations of second order”, Classics in Mathematics  Springer-Verlag, Berlin, 2001, pp. xiv+517
  * [Hab18] Boaz Haberman  “Unique determination of a magnetic Schrödinger operator with unbounded magnetic potential from boundary data”  In _Int. Math. Res. Not. IMRN_ , 2018, pp. 1080–1128  DOI: 10.1093/imrn/rnw263
  * [HPS19] Bastian Harrach, Valter Pohjola and Mikko Salo  “Monotonicity and local uniqueness for the Helmholtz equation”  In _Anal. PDE_ 12.7, 2019, pp. 1741–1771  DOI: 10.2140/apde.2019.12.1741
  * [HU17] Bastian Harrach and Marcel Ullrich  “Local uniqueness for an inverse boundary value problem with partial data”  In _Proc. Amer. Math. Soc._ 145.3, 2017, pp. 1087–1095  DOI: 10.1090/proc/12991
  * [IY12] O Yu. Imanuvilov and M Yamamoto  “Inverse boundary value problem for Schrödinger equation in two dimensions”  In _SIAM J. Math. Anal._ 44.3, 2012, pp. 1333–1339  DOI: 10.1137/11083736X
  * [JK85] David Jerison and Carlos E Kenig  “Unique continuation and absence of positive eigenvalues for Schrödinger operators”  In _Ann. of Math. (2)_ 121.3, 1985, pp. 463–494  DOI: 10.2307/1971205
  * [KLU18] Yaroslav Kurylev, Matti Lassas and Gunther Uhlmann  “Inverse problems for Lorentzian manifolds and non-linear hyperbolic equations”  In _Invent. Math._ 212.3, 2018, pp. 781–857  DOI: 10.1007/s00222-017-0780-y
  * [Kra05] Steven G Krantz  “Calculation and estimation of the Poisson kernel”  In _J. Math. Anal. Appl._ 302.1, 2005, pp. 143–148  DOI: 10.1016/j.jmaa.2004.08.010
  * [KU20] Katya Krupchyk and Gunther Uhlmann  “A remark on partial data inverse problems for semilinear elliptic equations”  In _Proc. Amer. Math. Soc._ 148.2, 2020, pp. 681–685  DOI: 10.1090/proc/14844
  * [Leo17] Giovanni Leoni  “A first course in Sobolev spaces” 181, Graduate Studies in Mathematics  American Mathematical Society, Providence, RI, 2017, pp. xxii+734  DOI: 10.1090/gsm/181
  * [LLLS21] Matti Lassas, Tony Liimatainen, Yi-Hsuan Lin and Mikko Salo  “Inverse problems for elliptic equations with power type nonlinearities”  In _J. Math. Pures Appl. (9)_ 145, 2021, pp. 44–82  DOI: 10.1016/j.matpur.2020.11.006
  * [LLLS21a] Matti Lassas, Tony Liimatainen, Yi-Hsuan Lin and Mikko Salo  “Partial data inverse problems and simultaneous recovery of boundary and coefficients for semilinear elliptic equations”  In _Rev. Mat. Iberoam._ 37.4, 2021, pp. 1553–1580  DOI: 10.4171/rmi/1242
  * [Ma20] Yilin Ma  “The Calderón problem in the $L^{p}$ framework on Riemann surfaces”, 2020  arXiv: http://arxiv.org/abs/2007.06523
  * [Nac92] Adrian I Nachman  “Inverse scattering at fixed energy”  In _Mathematical physics, X (Leipzig, 1991)_ Springer, Berlin, 1992, pp. 434–441  DOI: 10.1007/978-3-642-77303-7\\_48
  * [RR04] Michael Renardy and Robert C Rogers  “An introduction to partial differential equations” 13, Texts in Applied Mathematics  Springer-Verlag, New York, 2004, pp. xiv+434
  * [ST22] Mikko Salo and Leo Tzou  “Inverse problems for semilinear elliptic PDE with measurements at a single point”, 2022, pp. 1–14  arXiv: http://arxiv.org/abs/2202.05290
  * [Tri92] Hans Triebel  “Theory of function spaces. II” 84, Monographs in Mathematics  Birkhäuser Verlag, Basel, 1992, pp. viii+370  DOI: 10.1007/978-3-0346-0419-2
  * [Tzo18] Leo Tzou  “Partial Data Calderón Problems for $L^{n/2}$ Potentials on Admissible Manifolds”, 2018, pp. 1–20  arXiv: http://arxiv.org/abs/1805.09161
  * [WYW06] Zhuoqun Wu, Jingxue Yin and Chunpeng Wang  “Elliptic & parabolic equations”  World Scientific Publishing Co. Pte. Ltd., Hackensack, NJ, 2006, pp. xvi+408  DOI: 10.1142/6238