The diagonal derivative of a skew Schur polynomial page 0

# The diagonal derivative of a skew Schur polynomial

Darij Grinberg Department of Mathematics, Drexel University, Philadelphia,
U.S.A<EMAIL_ADDRESS>Nazar Korniichuk Kyiv Natural-Scientific
Lyceum No. 145, Kyiv, Ukraine<EMAIL_ADDRESS>
Kostiantyn Molokanov Kyiv Natural-Scientific Lyceum No. 145, Kyiv, Ukraine
<EMAIL_ADDRESS>and Severyn Khomych Brucknergymnasium Wels,
Austria<EMAIL_ADDRESS>
(version 1.0, 21 February 2024)

###### Abstract

Abstract. We prove a formula for the image of a skew Schur polynomial
$s_{\lambda/\mu}\left(x_{1},x_{2},\ldots,x_{N}\right)$ under the differential
operator $\nabla:=\dfrac{\partial}{\partial x_{1}}+\dfrac{\partial}{\partial
x_{2}}+\cdots+\dfrac{\partial}{\partial x_{N}}$. This generalizes a formula of
Weigandt for $\nabla\left(s_{\lambda}\right)$.

##  1 Notations and definitions

Fix a nonnegative integer $N$. Let
$R=\mathbb{Z}\left[x_{1},x_{2},\ldots,x_{N}\right]$ be the ring of polynomials
in $N$ indeterminates $x_{1},x_{2},\ldots,x_{N}$ with integer coefficients.

Let $\nabla:R\rightarrow R$ be the operator $\dfrac{\partial}{\partial
x_{1}}+\dfrac{\partial}{\partial x_{2}}+\cdots+\dfrac{\partial}{\partial
x_{N}}$. This map $\nabla$ is a derivation (i.e., it is $\mathbb{Z}$-linear
and satisfies $\nabla\left(fg\right)=\left(\nabla f\right)g+f\left(\nabla
g\right)$ for all $f,g\in R$). We call it the _diagonal derivative_ since (in
the language of analysis) it is the directional derivative with respect to the
vector $\left(1,1,\ldots,1\right)$. (The notation $\nabla$ comes from the
related operator in [Nenash20], but this is not the vector differential
operator $\nabla$ known from analysis.)

We let $\left[N\right]$ denote the set $\left\\{1,2,\ldots,N\right\\}$.

For each $i\in\left[N\right]$, we let $e_{i}$ be the $N$-tuple
$\left(0,0,\ldots,0,1,0,0,\ldots,0\right)\in\mathbb{Z}^{N}$ where the $1$ is
at the $i$-th position. Addition and subtraction of $N$-tuples are defined
entrywise (i.e., these $N$-tuples are viewed as vectors in the
$\mathbb{Z}$-module $\mathbb{Z}^{N}$). Thus, if $\mu\in\mathbb{Z}^{N}$ is any
$N$-tuple, then $\mu+e_{i}$ is the $N$-tuple obtained from $\mu$ by increasing
the $i$-th entry by $1$.

We shall use the standard notations regarding symmetric polynomials in $N$
variables $x_{1},x_{2},\ldots,x_{N}$ as introduced (e.g.) in [Stembr02] (but
we write $N$ for what was called $n$ in [Stembr02]).

If $a\in\mathbb{Z}^{N}$ is any $N$-tuple, and if $i\in\left[N\right]$, then
the notation $a_{i}$ shall denote the $i$-th entry of $a$ (so that
$a=\left(a_{1},a_{2},\ldots,a_{N}\right)$).

We let $\mathcal{P}_{N}$ denote the set of all $N$-tuples $a\in\mathbb{Z}^{N}$
that satisfy

$a_{1}\geq a_{2}\geq\cdots\geq a_{N}\geq 0.$

For instance, if $N=3$, then the $N$-tuples $\left(3,1,0\right)$ and
$\left(2,2,1\right)$ belong to $\mathcal{P}_{N}$, while the $N$-tuples
$\left(2,1,-1\right)$ and $\left(1,2,1\right)$ don’t.

The $N$-tuples in $\mathcal{P}_{N}$ are called _partitions of length $\leq N$_
(or _partitions with at most $N$ nonzero terms_, following the terminology of
[Stembr02]). In algebraic combinatorics, such an $N$-tuple
$a\in\mathcal{P}_{N}$ usually gets identified with the infinite sequence
$\left(a_{1},a_{2},\ldots,a_{N},0,0,0,\ldots\right)$, which is called an
(integer) partition. Any integer partition has a so-called _Young diagram_
assigned to it (see, e.g., [Stanle12, §1.7]). If $\mu\in\mathcal{P}_{N}$, and
if $i\in\left[N\right]$ is such that the $N$-tuple $\mu+e_{i}$ again belongs
to $\mathcal{P}_{N}$, then the Young diagram of $\mu+e_{i}$ is obtained from
the Young diagram of $\mu$ by adding a single box.

For any integer $n$, we let $h_{n}$ denote the complete homogeneous symmetric
polynomial in the variables $x_{1},x_{2},\ldots,x_{N}$. It is defined by

$h_{n}:=\sum\limits_{\begin{subarray}{c}\left(i_{1},i_{2},\ldots,i_{N}\right)\in\mathbb{N}^{N};\\\
i_{1}+i_{2}+\cdots+i_{N}=n\end{subarray}}x_{1}^{i_{1}}x_{2}^{i_{2}}\cdots
x_{N}^{i_{N}},$ (1)

where $\mathbb{N}:=\left\\{0,1,2,\ldots\right\\}$ is the set of all
nonnegative integers (so that the sum ranges over all $N$-tuples
$\left(i_{1},i_{2},\ldots,i_{N}\right)$ of nonnegative integers satisfying
$i_{1}+i_{2}+\cdots+i_{N}=n$). (Thus, $h_{0}=1$, and $h_{n}=0$ for each
negative $n$.) Clearly, $h_{n}\in R$ for each $n\in\mathbb{Z}$.

If $\lambda$ and $\mu$ are two $N$-tuples in $\mathcal{P}_{N}$, then the
notation $s_{\lambda/\mu}$ denotes the skew Schur polynomial
$s_{\lambda/\mu}\left(x_{1},x_{2},\ldots,x_{N}\right)$ (see, e.g., [Stembr02]
for a definition111To be more precise, $s_{\lambda/\mu}$ is defined in
[Stembr02] in the case when $\mu\leq\lambda$ (meaning that
$\mu_{i}\leq\lambda_{i}$ for each $i\in\left[N\right]$). In all other cases,
$s_{\lambda/\mu}$ is defined to be $0$.). (Note that this is called a “skew
Schur function” in [Stembr02], but more commonly the latter word is reserved
for the analogous object in infinitely many variables.) The _Jacobi–Trudi
formula_ says that any $\lambda\in\mathcal{P}_{N}$ and $\mu\in\mathcal{P}_{N}$
satisfy

$s_{\lambda/\mu}=\det\left(h_{\lambda_{i}-\mu_{j}-i+j}\right)_{i,j\in\left[N\right]}$
(2)

(where the notation $\left(a_{i,j}\right)_{i,j\in\left[N\right]}$ means the
$N\times N$-matrix with given entries $a_{i,j}$). Proofs of this formula can
be found (e.g.) in [GriRei20, (2.4.16)] or [Stanle24, (7.69)]222Both texts
[GriRei20, (2.4.16)] and [Stanle24, (7.69)] state the Jacobi–Trudi formula for
Schur functions in infinitely many variables $x_{1},x_{2},x_{3},\ldots$
instead of Schur polynomials in finitely many variables
$x_{1},x_{2},\ldots,x_{N}$. However, the latter version can be obtained from
the former by setting $x_{N+1},x_{N+2},x_{N+3},\ldots$ to $0$. Note also that
[Stanle24, (7.69)] assumes that $\mu\subseteq\lambda$, but the proofs do not
require this assumption.. We can use the formula (2) as a definition of
$s_{\lambda/\mu}$ here, as we will need no other properties of
$s_{\lambda/\mu}$. However, it is worth observing that

$s_{\lambda/\mu}=0$ (3)

unless $\mu\subseteq\lambda$ (that is, unless $\mu_{i}\leq\lambda_{i}$ for
each $i\in\left[N\right]$).

##  2 The results

The main result of this note is the following formula, which generalizes
Weigandt’s recent result [Weigan23, The Symmetric Derivative Rule]:

######  Theorem 2.1.

Let $a$ and $b$ be two integers such that $a+b=N-1$. Let
$\lambda\in\mathcal{P}_{N}$ and $\mu\in\mathcal{P}_{N}$. Define two further
$N$-tuples $\ell\in\mathbb{Z}^{N}$ and $m\in\mathbb{Z}^{N}$ by setting

$\ell_{i}:=\lambda_{i}-i\ \ \ \ \ \ \ \ \ \ \text{and}\ \ \ \ \ \ \ \ \ \
m_{i}:=\mu_{i}-i\ \ \ \ \ \ \ \ \ \ \text{for each }i\in\left[N\right].$

Then,

$\nabla\left(s_{\lambda/\mu}\right)=\sum\limits_{\begin{subarray}{c}i\in\left[N\right];\\\
\lambda-
e_{i}\in\mathcal{P}_{N}\end{subarray}}\left(\ell_{i}+a\right)s_{\left(\lambda-
e_{i}\right)/\mu}+\sum\limits_{\begin{subarray}{c}i\in\left[N\right];\\\
\mu+e_{i}\in\mathcal{P}_{N}\end{subarray}}\left(b-m_{i}\right)s_{\lambda/\left(\mu+e_{i}\right)}.$

######  Example 2.2.

Let $N=3$ and $\lambda=\left(3,2,1\right)$ and $\mu=\left(1,1,0\right)$. Then,
the $N$-tuples $\ell$ and $m$ defined in Theorem 2.1 are
$\ell=\left(2,0,-2\right)$ and $m=\left(0,-1,-3\right)$. Let $a$ and $b$ be
two integers such that $a+b=N-1=2$. Thus, Theorem 2.1 says that

$\displaystyle\nabla\left(s_{\left(3,2,1\right)/\left(1,1,0\right)}\right)$
$\displaystyle=\sum\limits_{i\in\left\\{1,2,3\right\\}}\left(\ell_{i}+a\right)s_{\left(\left(3,2,1\right)-e_{i}\right)/\left(1,1,0\right)}+\sum\limits_{i\in\left\\{1,3\right\\}}\left(b-m_{i}\right)s_{\left(3,2,1\right)/\left(\left(1,1,0\right)+e_{i}\right)}$
$\displaystyle=\left(2+a\right)s_{\left(2,1,1\right)/\left(1,1,0\right)}+\left(0+a\right)s_{\left(3,1,1\right)/\left(1,1,0\right)}+\left(-2+a\right)s_{\left(3,2,0\right)/\left(1,1,0\right)}$
$\displaystyle\ \ \ \ \ \ \ \ \ \
+\left(b-0\right)s_{\left(3,2,1\right)/\left(2,1,0\right)}+\left(b-\left(-3\right)\right)s_{\left(3,2,1\right)/\left(1,1,1\right)}.$

Note that the second sum has no $i=2$ addend, since
$\mu+e_{2}=\left(1,2,0\right)\notin\mathcal{P}_{N}$.

######  Remark 2.3.

Let us comment on the combinatorial meaning of Theorem 2.1. A pair
$\left(\mu,\lambda\right)$ of $N$-tuples $\lambda,\mu\in\mathcal{P}_{N}$ is
called a _skew partition_ if $\mu\subseteq\lambda$ (that is,
$\mu_{i}\leq\lambda_{i}$ for each $i\in\left[N\right]$). Such a skew partition
$\left(\mu,\lambda\right)$ has a _skew Young diagram_ assigned to it, which is
defined as the set difference of the Young diagrams of $\lambda$ and $\mu$.
This diagram is denoted by $\lambda/\mu$.

Let $\lambda/\mu$ be a skew partition with $\lambda,\mu\in\mathcal{P}_{N}$.
The sum $\sum\limits_{\begin{subarray}{c}i\in\left[N\right];\\\ \lambda-
e_{i}\in\mathcal{P}_{N}\end{subarray}}\left(\ell_{i}+a\right)s_{\left(\lambda-
e_{i}\right)/\mu}$ in Theorem 2.1 can be rewritten as
$\sum\limits_{\begin{subarray}{c}i\in\left[N\right];\\\ \lambda-
e_{i}\in\mathcal{P}_{N};\\\ \mu\subseteq\lambda-
e_{i}\end{subarray}}\left(\ell_{i}+a\right)s_{\left(\lambda-
e_{i}\right)/\mu}$, because any addend in which $\mu\subseteq\lambda-e_{i}$
does not hold is $0$ by (3). This is a sum over all skew partitions obtained
from $\lambda/\mu$ by removing an outer corner (i.e., a removable box on the
southeastern boundary of $\lambda/\mu$). Moreover, the number
$\ell_{i}=\lambda_{i}-i$ tells us which diagonal this corner belongs to.

Likewise, the sum $\sum\limits_{\begin{subarray}{c}i\in\left[N\right];\\\
\mu+e_{i}\in\mathcal{P}_{N}\end{subarray}}\left(b-m_{i}\right)s_{\lambda/\left(\mu+e_{i}\right)}$
can be rewritten as $\sum\limits_{\begin{subarray}{c}i\in\left[N\right];\\\
\mu+e_{i}\in\mathcal{P}_{N};\\\
\mu+e_{i}\subseteq\lambda\end{subarray}}\left(b-m_{i}\right)s_{\lambda/\left(\mu+e_{i}\right)}$,
which is a sum over all skew partitions obtained from $\lambda/\mu$ by
removing an inner corner (i.e., a removable box on the northwestern boundary
of $\lambda/\mu$). Moreover, the number $m_{i}=\mu_{i}-i$ tells us which
diagonal this corner belongs to.

######  Remark 2.4.

Let $\lambda\in\mathcal{P}_{N}$. Let $\ell_{i}:=\lambda_{i}-i$ for each
$i\in\left[N\right]$. Set $\mu:=\left(0,0,\ldots,0\right)\in\mathcal{P}_{N}$.
Then, the skew Schur polynomial $s_{\lambda/\mu}$ is usually called
$s_{\lambda}$. The only $i\in\left[N\right]$ satisfying
$\mu+e_{i}\in\mathcal{P}_{N}$ is $1$. Hence, Theorem 2.1 (applied to $a=N$ and
$b=-1$) yields

$\displaystyle\nabla\left(s_{\lambda}\right)$
$\displaystyle=\sum\limits_{\begin{subarray}{c}i\in\left[N\right];\\\ \lambda-
e_{i}\in\mathcal{P}_{N}\end{subarray}}\left(\ell_{i}+N\right)s_{\lambda-
e_{i}}+\underbrace{\left(1-0+\left(-1\right)\right)}_{=0}s_{\lambda/\left(\mu+e_{1}\right)}$
$\displaystyle=\sum\limits_{\begin{subarray}{c}i\in\left[N\right];\\\ \lambda-
e_{i}\in\mathcal{P}_{N}\end{subarray}}\left(\ell_{i}+N\right)s_{\lambda-
e_{i}},$

which recovers [Weigan23, The Symmetric Derivative Rule].

Once Theorem 2.1 is proved, we will derive the following curious corollary:

######  Corollary 2.5.

Let $\lambda\in\mathcal{P}_{N}$ and $\mu\in\mathcal{P}_{N}$. Then,

$\sum\limits_{\begin{subarray}{c}i\in\left[N\right];\\\ \lambda-
e_{i}\in\mathcal{P}_{N}\end{subarray}}s_{\left(\lambda-
e_{i}\right)/\mu}=\sum\limits_{\begin{subarray}{c}i\in\left[N\right];\\\
\mu+e_{i}\in\mathcal{P}_{N}\end{subarray}}s_{\lambda/\left(\mu+e_{i}\right)}.$

We note that Corollary 2.5 follows easily from the theory of skewing operators
(see [GriRei20, §2.8]) and the Pieri rule.333In a nutshell: Corollary 2.5 is
obtained by taking the equality
$s_{\mu}^{\perp}\left(s_{1}^{\perp}s_{\lambda}\right)=\left(s_{1}s_{\mu}\right)^{\perp}s_{\lambda}$,
which holds on the level of symmetric functions in infinitely many
indeterminates $x_{1},x_{2},x_{3},\ldots$ (a consequence of [GriRei20,
Proposition 2.8.2 (ii)]), and expanding both of its sides using the Pieri
rules [GriRei20, (2.7.1) and (2.8.3)]. But we shall prove both Theorem 2.1 and
Corollary 2.5 elementarily.

##  3 A lemma on $\nabla\left(h_{n}\right)$

First we need a formula for the image of the complete homogeneous symmetric
polynomial $h_{n}$ under the operator $\nabla$:

######  Lemma 3.1.

Let $n$ be a integer. Then,
$\nabla\left(h_{n}\right)=\left(n+N-1\right)h_{n-1}$.

######  Proof 3.2 (Proof of Lemma 3.1.).

For each $k\in\left[N\right]$, we have

$\displaystyle\dfrac{\partial}{\partial x_{k}}h_{n}$
$\displaystyle=\dfrac{\partial}{\partial
x_{k}}\sum\limits_{\begin{subarray}{c}\left(i_{1},i_{2},\ldots,i_{N}\right)\in\mathbb{N}^{N};\\\
i_{1}+i_{2}+\cdots+i_{N}=n\end{subarray}}x_{1}^{i_{1}}x_{2}^{i_{2}}\cdots
x_{N}^{i_{N}}\ \ \ \ \ \ \ \ \ \ \left(\text{by \eqref{eq.def.hn}}\right)$
$\displaystyle=\sum\limits_{\begin{subarray}{c}\left(i_{1},i_{2},\ldots,i_{N}\right)\in\mathbb{N}^{N};\\\
i_{1}+i_{2}+\cdots+i_{N}=n\end{subarray}}\underbrace{\dfrac{\partial}{\partial
x_{k}}\left(x_{1}^{i_{1}}x_{2}^{i_{2}}\cdots
x_{N}^{i_{N}}\right)}_{\begin{subarray}{c}=\begin{cases}i_{k}x_{1}^{i_{1}}x_{2}^{i_{2}}\cdots
x_{k}^{i_{k}-1}\cdots x_{N}^{i_{N}},&\text{if }i_{k}>0;\\\ 0,&\text{if
}i_{k}=0\end{cases}\\\ \text{(where }x_{1}^{i_{1}}x_{2}^{i_{2}}\cdots
x_{k}^{i_{k}-1}\cdots x_{N}^{i_{N}}\text{ means the monomial
}x_{1}^{i_{1}}x_{2}^{i_{2}}\cdots x_{N}^{i_{N}}\\\ \text{with the exponent on
}x_{k}\text{ decremented by }1\text{)}\end{subarray}}$
$\displaystyle=\sum\limits_{\begin{subarray}{c}\left(i_{1},i_{2},\ldots,i_{N}\right)\in\mathbb{N}^{N};\\\
i_{1}+i_{2}+\cdots+i_{N}=n;\\\
i_{k}>0\end{subarray}}i_{k}x_{1}^{i_{1}}x_{2}^{i_{2}}\cdots
x_{k}^{i_{k}-1}\cdots x_{N}^{i_{N}}$
$\displaystyle=\underbrace{\sum\limits_{\begin{subarray}{c}\left(i_{1},i_{2},\ldots,i_{N}\right)\in\mathbb{N}^{N};\\\
i_{1}+i_{2}+\cdots+\left(i_{k}+1\right)+\cdots+i_{N}=n\end{subarray}}}_{=\sum\limits_{\begin{subarray}{c}\left(i_{1},i_{2},\ldots,i_{N}\right)\in\mathbb{N}^{N};\\\
i_{1}+i_{2}+\cdots+i_{N}=n-1\end{subarray}}}\left(i_{k}+1\right)\underbrace{x_{1}^{i_{1}}x_{2}^{i_{2}}\cdots
x_{k}^{\left(i_{k}+1\right)-1}\cdots
x_{N}^{i_{N}}}_{=x_{1}^{i_{1}}x_{2}^{i_{2}}\cdots x_{N}^{i_{N}}}$
$\displaystyle\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \left(\text{here, we
substituted }i_{k}+1\text{ for }i_{k}\text{ in the sum}\right)$
$\displaystyle=\sum\limits_{\begin{subarray}{c}\left(i_{1},i_{2},\ldots,i_{N}\right)\in\mathbb{N}^{N};\\\
i_{1}+i_{2}+\cdots+i_{N}=n-1\end{subarray}}\left(i_{k}+1\right)x_{1}^{i_{1}}x_{2}^{i_{2}}\cdots
x_{N}^{i_{N}}.$

Summing this equality over all $k\in\left[N\right]$, we obtain

$\displaystyle\sum\limits_{k\in\left[N\right]}\dfrac{\partial}{\partial
x_{k}}h_{n}$ $\displaystyle=\sum\limits_{k\in\left[N\right]}\ \
\sum\limits_{\begin{subarray}{c}\left(i_{1},i_{2},\ldots,i_{N}\right)\in\mathbb{N}^{N};\\\
i_{1}+i_{2}+\cdots+i_{N}=n-1\end{subarray}}\left(i_{k}+1\right)x_{1}^{i_{1}}x_{2}^{i_{2}}\cdots
x_{N}^{i_{N}}$
$\displaystyle=\sum\limits_{\begin{subarray}{c}\left(i_{1},i_{2},\ldots,i_{N}\right)\in\mathbb{N}^{N};\\\
i_{1}+i_{2}+\cdots+i_{N}=n-1\end{subarray}}\underbrace{\left(\sum\limits_{k\in\left[N\right]}\left(i_{k}+1\right)\right)}_{\begin{subarray}{c}=\left(i_{1}+1\right)+\left(i_{2}+1\right)+\cdots+\left(i_{N}+1\right)\\\
=\left(i_{1}+i_{2}+\cdots+i_{N}\right)+N\\\ =n-1+N\\\ \text{(since
}i_{1}+i_{2}+\cdots+i_{N}=n-1\text{)}\end{subarray}}x_{1}^{i_{1}}x_{2}^{i_{2}}\cdots
x_{N}^{i_{N}}$
$\displaystyle=\underbrace{\left(n-1+N\right)}_{=n+N-1}\underbrace{\sum\limits_{\begin{subarray}{c}\left(i_{1},i_{2},\ldots,i_{N}\right)\in\mathbb{N}^{N};\\\
i_{1}+i_{2}+\cdots+i_{N}=n-1\end{subarray}}x_{1}^{i_{1}}x_{2}^{i_{2}}\cdots
x_{N}^{i_{N}}}_{\begin{subarray}{c}=h_{n-1}\\\ \text{(by the definition of
}h_{n-1}\text{)}\end{subarray}}=\left(n+N-1\right)h_{n-1}.$

This can be rewritten as $\nabla\left(h_{n}\right)=\left(n+N-1\right)h_{n-1}$
(since $\nabla=\dfrac{\partial}{\partial x_{1}}+\dfrac{\partial}{\partial
x_{2}}+\cdots+\dfrac{\partial}{\partial
x_{N}}=\sum\limits_{k\in\left[N\right]}\dfrac{\partial}{\partial x_{k}}$).
Thus, Lemma 3.1 is proved.

##  4 Lemmas on determinants

We will next need a few simple lemmas about determinants:

######  Lemma 4.1.

Let $\lambda,\mu\in\mathcal{P}_{N}$. Define $\ell,m\in\mathbb{Z}^{N}$ as in
Theorem 2.1. Then,

$\det\left(h_{\ell_{i}-m_{j}}\right)_{i,j\in\left[N\right]}=s_{\lambda/\mu}.$

######  Proof 4.2 (Proof of Lemma 4.1.).

For every $i,j\in\left[N\right]$, we have $\ell_{i}=\lambda_{i}-i$ (by the
definition of $\ell$) and $m_{j}=\mu_{j}-j$ (similarly). Subtracting these two
equalities from each other, we obtain that

$\ell_{i}-m_{j}=\lambda_{i}-i-\left(\mu_{j}-j\right)=\lambda_{i}-\mu_{j}-i+j\
\ \ \ \ \ \ \ \ \ \text{for every }i,j\in\left[N\right].$

Hence, we can rewrite (2) as
$s_{\lambda/\mu}=\det\left(h_{\ell_{i}-m_{j}}\right)_{i,j\in\left[N\right]}$.
This proves Lemma 4.1.

######  Lemma 4.3.

Let $\lambda,\mu\in\mathcal{P}_{N}$ and $k\in\left[N\right]$ be such that
$\lambda-e_{k}\in\mathcal{P}_{N}$. Define $\ell,m\in\mathbb{Z}^{N}$ as in
Theorem 2.1. Then,

$\det\left(h_{\left(\ell-
e_{k}\right)_{i}-m_{j}}\right)_{i,j\in\left[N\right]}=s_{\left(\lambda-
e_{k}\right)/\mu}.$

######  Proof 4.4 (Proof of Lemma 4.3.).

Recall that the $N$-tuple $\ell$ is defined from the $N$-tuple $\lambda$ by
subtracting $1$ from its $1$-st entry, subtracting $2$ from its $2$-nd entry,
subtracting $3$ from its $3$-rd entry, etc.. Thus, the $N$-tuple $\ell-e_{k}$
is obtained from $\lambda-e_{k}$ in the same way. Hence, Lemma 4.1 (applied to
$\lambda-e_{k}$ and $\ell-e_{k}$ instead of $\lambda$ and $\ell$) yields

$\det\left(h_{\left(\ell-
e_{k}\right)_{i}-m_{j}}\right)_{i,j\in\left[N\right]}=s_{\left(\lambda-
e_{k}\right)/\mu}.$

This proves Lemma 4.3.

######  Lemma 4.5.

Let $\lambda,\mu\in\mathcal{P}_{N}$ and $k\in\left[N\right]$ be such that
$\mu+e_{k}\in\mathcal{P}_{N}$. Define $\ell,m\in\mathbb{Z}^{N}$ as in Theorem
2.1. Then,

$\det\left(h_{\ell_{i}-\left(m+e_{k}\right)_{j}}\right)_{i,j\in\left[N\right]}=s_{\lambda/\left(\mu+e_{k}\right)}.$

######  Proof 4.6 (Proof of Lemma 4.5.).

Similarly to Lemma 4.3, we can show this by applying Lemma 4.1 to $\mu+e_{k}$
and $m+e_{k}$ instead of $\mu$ and $m$.

######  Lemma 4.7.

Let $\lambda,\mu\in\mathcal{P}_{N}$ and $k\in\left[N\right]$ be such that
$\lambda-e_{k}\notin\mathcal{P}_{N}$. Define $\ell,m\in\mathbb{Z}^{N}$ as in
Theorem 2.1. Then,

$\det\left(h_{\left(\ell-
e_{k}\right)_{i}-m_{j}}\right)_{i,j\in\left[N\right]}=0.$

######  Proof 4.8 (Proof of Lemma 4.7.).

The definition of $e_{k}$ yields that the only nonzero entry of $e_{k}$ is
$\left(e_{k}\right)_{k}=1$. Hence, in particular,
$\left(e_{k}\right)_{k+1}=0$.

We have $\lambda\in\mathcal{P}_{N}$, so that
$\lambda_{1}\geq\lambda_{2}\geq\cdots\geq\lambda_{N}\geq 0$. Recall that
$k\in\left[N\right]$, so that $k\leq N$. Hence, we are in one of the following
two cases:

Case 1: We have $k<N$.

Case 2: We have $k=N$.

Let us first consider Case 1. In this case, we have $k<N$. The definition of
$e_{k}$ yields $\lambda-
e_{k}=\left(\lambda_{1},\lambda_{2},\ldots,\lambda_{k-1},\lambda_{k}-1,\lambda_{k+1},\ldots,\lambda_{N}\right)$
(this is the $N$-tuple $\lambda$ with its $k$-th entry decreased by $1$).
Thus, the chain of inequalities

$\lambda_{1}\geq\lambda_{2}\geq\cdots\geq\lambda_{k-1}\geq\lambda_{k}-1\geq\lambda_{k+1}\geq\cdots\geq\lambda_{N}\geq
0\quad\text{{does not} hold}$

(since $\lambda-e_{k}\notin\mathcal{P}_{N}$). Therefore, the inequality
$\lambda_{k}-1\geq\lambda_{k+1}$ must be violated (since all the other
inequality signs in this chain follow from
$\lambda_{1}\geq\lambda_{2}\geq\cdots\geq\lambda_{N}\geq 0$). In other words,
we have $\lambda_{k}-1<\lambda_{k+1}$. Since $\lambda_{k}$ and $\lambda_{k+1}$
are integers, this entails $\lambda_{k}-1\leq\lambda_{k+1}-1$, so that
$\lambda_{k}\leq\lambda_{k+1}$. Combining this with
$\lambda_{k}\geq\lambda_{k+1}$ (which follows from
$\lambda_{1}\geq\lambda_{2}\geq\cdots\geq\lambda_{N}$), we obtain
$\lambda_{k}=\lambda_{k+1}$.

Now, the definition of $\ell$ yields $\ell_{k}=\lambda_{k}-k$. Hence,

$\left(\ell-
e_{k}\right)_{k}=\underbrace{\ell_{k}}_{=\lambda_{k}-k}-\underbrace{\left(e_{k}\right)_{k}}_{=1}=\underbrace{\lambda_{k}}_{=\lambda_{k+1}}-\,k-1=\lambda_{k+1}-k-1.$

Furthermore, the definition of $\ell$ yields
$\ell_{k+1}=\lambda_{k+1}-\left(k+1\right)$. Hence,

$\left(\ell-
e_{k}\right)_{k+1}=\ell_{k+1}-\underbrace{\left(e_{k}\right)_{k+1}}_{=0}=\ell_{k+1}=\lambda_{k+1}-\left(k+1\right)=\lambda_{k+1}-k-1.$

Comparing this with $\left(\ell-e_{k}\right)_{k}=\lambda_{k+1}-k-1$, we obtain
$\left(\ell-e_{k}\right)_{k}=\left(\ell-e_{k}\right)_{k+1}$.

Hence, for each $j\in\left[N\right]$, we have

$h_{\left(\ell-e_{k}\right)_{k}-m_{j}}=h_{\left(\ell-
e_{k}\right)_{k+1}-m_{j}}.$

In other words, each entry in the $k$-th row of the matrix
$\left(h_{\left(\ell-e_{k}\right)_{i}-m_{j}}\right)_{i,j\in\left[N\right]}$
equals the corresponding entry in the $\left(k+1\right)$-st row of this
matrix. Thus, the matrix $\left(h_{\left(\ell-
e_{k}\right)_{i}-m_{j}}\right)_{i,j\in\left[N\right]}$ has two equal rows
(namely, its $k$-th and $\left(k+1\right)$-st rows). Hence, its determinant is
$0$. This proves Lemma 4.7 in Case 1.

Let us now consider Case 2. In this case, we have $k=N$. Hence, $\lambda-
e_{k}=\lambda-
e_{N}=\left(\lambda_{1},\lambda_{2},\ldots,\lambda_{N-1},\lambda_{N}-1\right)$
(this is the $N$-tuple $\lambda$ with its $N$-th entry decreased by $1$).
Thus, the chain of inequalities

$\lambda_{1}\geq\lambda_{2}\geq\cdots\geq\lambda_{N-1}\geq\lambda_{N}-1\geq
0\quad\text{{does not} hold}$

(since $\lambda-e_{k}\notin\mathcal{P}_{N}$). Therefore, the inequality
$\lambda_{N}-1\geq 0$ must be violated (since all the other inequality signs
in this chain follow from
$\lambda_{1}\geq\lambda_{2}\geq\cdots\geq\lambda_{N}\geq 0$). In other words,
we have $\lambda_{N}-1<0$. In other words, $\lambda_{k}-1<0$ (since $k=N$).
Thus, $\lambda_{k}<1$. Now,

$\left(\ell-
e_{k}\right)_{k}=\underbrace{\ell_{k}}_{\begin{subarray}{c}=\lambda_{k}-k\\\
\text{(by the definition of
}\ell\text{)}\end{subarray}}-\underbrace{\left(e_{k}\right)_{k}}_{=1}=\underbrace{\lambda_{k}}_{<1}-\underbrace{k}_{=N}-\,1<1-N-1=-N$

On the other hand, for each $j\in\left[N\right]$, we have $m_{j}=\mu_{j}-j$
(by the definition of $m$) and thus $m_{j}=\underbrace{\mu_{j}}_{\geq
0}-\underbrace{j}_{\leq N}\geq 0-N=-N>\left(\ell-e_{k}\right)_{k}$ (since
$\left(\ell-e_{k}\right)_{k}<-N$). Thus, for each $j\in\left[N\right]$, we
have $\left(\ell-e_{k}\right)_{k}-m_{j}<0$ and therefore

$h_{\left(\ell-e_{k}\right)_{k}-m_{j}}=0\ \ \ \ \ \ \ \ \ \ \left(\text{since
}h_{i}=0\text{ for all }i<0\right).$

In other words, each entry in the $k$-th row of the matrix
$\left(h_{\left(\ell-e_{k}\right)_{i}-m_{j}}\right)_{i,j\in\left[N\right]}$ is
zero. Thus, the matrix $\left(h_{\left(\ell-
e_{k}\right)_{i}-m_{j}}\right)_{i,j\in\left[N\right]}$ has a zero row (namely,
its $k$-th row). Hence, its determinant is $0$. This proves Lemma 4.7 in Case
2.

We have now proved Lemma 4.7 in both cases.

######  Lemma 4.9.

Let $\lambda,\mu\in\mathcal{P}_{N}$ and $k\in\left[N\right]$ be such that
$\mu+e_{k}\notin\mathcal{P}_{N}$. Define $\ell,m\in\mathbb{Z}^{N}$ as in
Theorem 2.1. Then,

$\det\left(h_{\ell_{i}-\left(m+e_{k}\right)_{j}}\right)_{i,j\in\left[N\right]}=0.$

######  Proof 4.10 (Proof of Lemma 4.9.).

This is similar to Case 2 in the proof of Lemma 4.7. Here are the details:

The definition of $e_{k}$ yields
$\mu+e_{k}=\left(\mu_{1},\mu_{2},\ldots,\mu_{k-1},\mu_{k}+1,\mu_{k+1},\ldots,\mu_{N}\right)$
(this is the $N$-tuple $\mu$ with its $k$-th entry increased by $1$).

We have $\mu\in\mathcal{P}_{N}$, so that
$\mu_{1}\geq\mu_{2}\geq\cdots\geq\mu_{N}\geq 0$. However, we have
$\mu+e_{k}\notin\mathcal{P}_{N}$, so that the chain of inequalities

$\mu_{1}\geq\mu_{2}\geq\cdots\geq\mu_{k-1}\geq\mu_{k}+1\geq\mu_{k+1}\geq\cdots\geq\mu_{N}\geq
0\quad\text{{does not} hold}$

(since
$\mu+e_{k}=\left(\mu_{1},\mu_{2},\ldots,\mu_{k-1},\mu_{k}+1,\mu_{k+1},\ldots,\mu_{N}\right)$).
Hence, the inequality $\mu_{k-1}\geq\mu_{k}+1$ must be violated (since all the
other inequalities in this chain follow from
$\mu_{1}\geq\mu_{2}\geq\cdots\geq\mu_{N}\geq 0$). In other words, we must have
$k>1$ and $\mu_{k-1}<\mu_{k}+1$.

From $\mu_{k-1}<\mu_{k}+1$, we obtain $\mu_{k-1}\leq\mu_{k}$ (since
$\mu_{k-1}$ and $\mu_{k}$ are integers). Combining this with
$\mu_{k-1}\geq\mu_{k}$ (since $\mu_{1}\geq\mu_{2}\geq\cdots\geq\mu_{N}$), we
obtain $\mu_{k-1}=\mu_{k}$.

The definition of $e_{k}$ yields that the only nonzero entry of $e_{k}$ is
$\left(e_{k}\right)_{k}=1$. Hence, in particular,
$\left(e_{k}\right)_{k-1}=0$.

The definition of $m$ yields $m_{k}=\mu_{k}-k$ and
$m_{k-1}=\mu_{k-1}-\left(k-1\right)$. Now,

$\left(m+e_{k}\right)_{k}=\underbrace{m_{k}}_{=\mu_{k}-k}+\underbrace{\left(e_{k}\right)_{k}}_{=1}=\mu_{k}-k+1=\mu_{k}-\left(k-1\right).$

Comparing this with

$\left(m+e_{k}\right)_{k-1}=m_{k-1}+\underbrace{\left(e_{k}\right)_{k-1}}_{=0}=m_{k-1}=\underbrace{\mu_{k-1}}_{=\mu_{k}}-\left(k-1\right)=\mu_{k}-\left(k-1\right),$

we obtain $\left(m+e_{k}\right)_{k}=\left(m+e_{k}\right)_{k-1}$.

Now, for each $i\in\left[N\right]$, we have

$h_{\ell_{i}-\left(m+e_{k}\right)_{k}}=h_{\ell_{i}-\left(m+e_{k}\right)_{k-1}}\
\ \ \ \ \ \ \ \ \ \left(\text{since
}\left(m+e_{k}\right)_{k}=\left(m+e_{k}\right)_{k-1}\right).$

In other words, each entry in the $k$-th column of the matrix
$\left(h_{\ell_{i}-\left(m+e_{k}\right)_{j}}\right)_{i,j\in\left[N\right]}$
equals the corresponding entry in the $\left(k-1\right)$-st column of this
matrix. Thus, the matrix
$\left(h_{\ell_{i}-\left(m+e_{k}\right)_{j}}\right)_{i,j\in\left[N\right]}$
has two equal columns (namely, its $k$-th and $\left(k-1\right)$-st columns).
Hence, its determinant is $0$. This proves Lemma 4.9.

Finally, we will need the Leibniz rule for products of multiple
factors:444Recall that $R=\mathbb{Z}\left[x_{1},x_{2},\ldots,x_{n}\right]$.

######  Lemma 4.11.

For any $a_{1},a_{2},\ldots,a_{n}\in R$, we have

$\nabla\left(a_{1}a_{2}\cdots
a_{n}\right)=\sum\limits_{k=1}^{n}a_{1}a_{2}\cdots
a_{k-1}\nabla\left(a_{k}\right)a_{k+1}a_{k+2}\cdots a_{n}.$

######  Proof 4.12 (Proof of Lemma 4.11.).

This holds not just for $\nabla$ but actually for any derivation of any ring,
and can be easily proved by induction on $n$ using the Leibniz rule.

##  5 The last lemma

We now have everything in place for the proofs of Theorem 2.1 and Corollary
2.5. However, to keep our computation short, let us outsource a part of it to
a lemma:

######  Lemma 5.1.

Let $\sigma$ be a permutation of the set $\left[N\right]$. Let
$\ell,m\in\mathbb{Z}^{N}$ be two $N$-tuples of integers. Let $a$ and $b$ be
two integers such that $a+b=N-1$. Then,

$\nabla\left(\prod\limits_{i=1}^{N}h_{\ell_{i}-m_{\sigma\left(i\right)}}\right)=\sum\limits_{k=1}^{N}\left(\ell_{k}+a\right)\prod\limits_{i=1}^{N}h_{\left(\ell-
e_{k}\right)_{i}-m_{\sigma\left(i\right)}}+\sum\limits_{k=1}^{N}\left(b-m_{k}\right)\prod\limits_{i=1}^{N}h_{\ell_{i}-\left(m+e_{k}\right)_{\sigma\left(i\right)}}.$

######  Proof 5.2 (Proof of Lemma 5.1.).

Fix $k\in\left[N\right]$. The $N$-tuple $\ell-e_{k}$ differs from the
$N$-tuple $\ell$ only in its $k$-th entry, which is smaller by $1$. Thus, the
product $\prod\limits_{i=1}^{N}h_{\left(\ell-
e_{k}\right)_{i}-m_{\sigma\left(i\right)}}$ differs from the product
$\prod\limits_{i=1}^{N}h_{\ell_{i}-m_{\sigma\left(i\right)}}$ only in its
$k$-th factor, which is $h_{\left(\ell_{k}-1\right)-m_{\sigma\left(k\right)}}$
instead of $h_{\ell_{k}-m_{\sigma\left(k\right)}}$. Hence,

$\displaystyle\prod\limits_{i=1}^{N}h_{\left(\ell-
e_{k}\right)_{i}-m_{\sigma\left(i\right)}}$
$\displaystyle=\underbrace{h_{\left(\ell_{k}-1\right)-m_{\sigma\left(k\right)}}}_{=h_{\ell_{k}-m_{\sigma\left(k\right)}-1}}\
\ \prod\limits_{\begin{subarray}{c}i\in\left[N\right];\\\ i\neq
k\end{subarray}}h_{\ell_{i}-m_{\sigma\left(i\right)}}$
$\displaystyle=h_{\ell_{k}-m_{\sigma\left(k\right)}-1}\prod\limits_{\begin{subarray}{c}i\in\left[N\right];\\\
i\neq k\end{subarray}}h_{\ell_{i}-m_{\sigma\left(i\right)}}.$ (4)

The $N$-tuple $m+e_{\sigma\left(k\right)}$ differs from the $N$-tuple $m$ only
in its $\sigma\left(k\right)$-th entry, which is larger by $1$. Thus, the
product
$\prod\limits_{i=1}^{N}h_{\ell_{i}-\left(m+e_{\sigma\left(k\right)}\right)_{\sigma\left(i\right)}}$
differs from the product
$\prod\limits_{i=1}^{N}h_{\ell_{i}-m_{\sigma\left(i\right)}}$ only in its
$k$-th factor, which is $h_{\ell_{k}-\left(m_{\sigma\left(k\right)}+1\right)}$
instead of $h_{\ell_{k}-m_{\sigma\left(k\right)}}$ (since all the remaining
factors satisfy $i\neq k$ and therefore
$\sigma\left(i\right)\neq\sigma\left(k\right)$). Hence,

$\displaystyle\prod\limits_{i=1}^{N}h_{\ell_{i}-\left(m+e_{\sigma\left(k\right)}\right)_{\sigma\left(i\right)}}$
$\displaystyle=\underbrace{h_{\ell_{k}-\left(m_{\sigma\left(k\right)}+1\right)}}_{=h_{\ell_{k}-m_{\sigma\left(k\right)}-1}}\
\ \prod\limits_{\begin{subarray}{c}i\in\left[N\right];\\\ i\neq
k\end{subarray}}h_{\ell_{i}-m_{\sigma\left(i\right)}}$
$\displaystyle=h_{\ell_{k}-m_{\sigma\left(k\right)}-1}\prod\limits_{\begin{subarray}{c}i\in\left[N\right];\\\
i\neq k\end{subarray}}h_{\ell_{i}-m_{\sigma\left(i\right)}}.$ (5)

Forget that we fixed $k$. We thus have proved the equalities (4) and (5) for
each $k\in\left[N\right]$.

Since the ring $R$ is commutative, we can rewrite Lemma 4.11 as follows: For
any $a_{1},a_{2},\ldots,a_{n}\in R$, we have

$\nabla\left(\prod\limits_{i=1}^{n}a_{i}\right)=\sum\limits_{k=1}^{n}\nabla\left(a_{k}\right)\prod\limits_{\begin{subarray}{c}i\in\left[n\right];\\\
i\neq k\end{subarray}}a_{i}.$

Applying this to $N=n$ and $a_{i}=h_{\ell_{i}-m_{\sigma\left(i\right)}}$, we
obtain

$\displaystyle\nabla\left(\prod\limits_{i=1}^{N}h_{\ell_{i}-m_{\sigma\left(i\right)}}\right)$
$\displaystyle=\sum\limits_{k=1}^{N}\underbrace{\nabla\left(h_{\ell_{k}-m_{\sigma\left(k\right)}}\right)}_{\begin{subarray}{c}=\left(\ell_{k}-m_{\sigma\left(k\right)}+N-1\right)h_{\ell_{k}-m_{\sigma\left(k\right)}-1}\\\
\text{(by Lemma
\ref{lem.Nabla-h})}\end{subarray}}\prod\limits_{\begin{subarray}{c}i\in\left[N\right];\\\
i\neq k\end{subarray}}h_{\ell_{i}-m_{\sigma\left(i\right)}}$
$\displaystyle=\sum\limits_{k=1}^{N}\underbrace{\left(\ell_{k}-m_{\sigma\left(k\right)}+N-1\right)}_{\begin{subarray}{c}=\left(\ell_{k}+a\right)+\left(b-m_{\sigma\left(k\right)}\right)\\\
\text{(since
}N-1=a+b\text{)}\end{subarray}}h_{\ell_{k}-m_{\sigma\left(k\right)}-1}\prod\limits_{\begin{subarray}{c}i\in\left[N\right];\\\
i\neq k\end{subarray}}h_{\ell_{i}-m_{\sigma\left(i\right)}}$
$\displaystyle=\sum\limits_{k=1}^{N}\left(\left(\ell_{k}+a\right)+\left(b-m_{\sigma\left(k\right)}\right)\right)h_{\ell_{k}-m_{\sigma\left(k\right)}-1}\prod\limits_{\begin{subarray}{c}i\in\left[N\right];\\\
i\neq k\end{subarray}}h_{\ell_{i}-m_{\sigma\left(i\right)}}$
$\displaystyle=\sum\limits_{k=1}^{N}\left(\ell_{k}+a\right)\underbrace{h_{\ell_{k}-m_{\sigma\left(k\right)}-1}\prod\limits_{\begin{subarray}{c}i\in\left[N\right];\\\
i\neq
k\end{subarray}}h_{\ell_{i}-m_{\sigma\left(i\right)}}}_{\begin{subarray}{c}=\prod\limits_{i=1}^{N}h_{\left(\ell-
e_{k}\right)_{i}-m_{\sigma\left(i\right)}}\\\ \text{(by
(\ref{pf.lem.Dprod.pr1}))}\end{subarray}}+\sum\limits_{k=1}^{N}\left(b-m_{\sigma\left(k\right)}\right)\underbrace{h_{\ell_{k}-m_{\sigma\left(k\right)}-1}\prod\limits_{\begin{subarray}{c}i\in\left[N\right];\\\
i\neq
k\end{subarray}}h_{\ell_{i}-m_{\sigma\left(i\right)}}}_{\begin{subarray}{c}=\prod\limits_{i=1}^{N}h_{\ell_{i}-\left(m+e_{\sigma\left(k\right)}\right)_{\sigma\left(i\right)}}\\\
\text{(by (\ref{pf.lem.Dprod.pr2}))}\end{subarray}}$
$\displaystyle=\sum\limits_{k=1}^{N}\left(\ell_{k}+a\right)\prod\limits_{i=1}^{N}h_{\left(\ell-
e_{k}\right)_{i}-m_{\sigma\left(i\right)}}+\sum\limits_{k=1}^{N}\left(b-m_{\sigma\left(k\right)}\right)\prod\limits_{i=1}^{N}h_{\ell_{i}-\left(m+e_{\sigma\left(k\right)}\right)_{\sigma\left(i\right)}}$
$\displaystyle=\sum\limits_{k=1}^{N}\left(\ell_{k}+a\right)\prod\limits_{i=1}^{N}h_{\left(\ell-
e_{k}\right)_{i}-m_{\sigma\left(i\right)}}+\sum\limits_{k=1}^{N}\left(b-m_{k}\right)\prod\limits_{i=1}^{N}h_{\ell_{i}-\left(m+e_{k}\right)_{\sigma\left(i\right)}}$

(here, we have substituted $k$ for $\sigma\left(k\right)$ in the second sum,
since $\sigma:\left[N\right]\rightarrow\left[N\right]$ is a bijection). This
proves Lemma 5.1.

##  6 Proofs of the main results

######  Proof 6.1 (Proof of Theorem 2.1.).

Let $S_{N}$ denote the $N$-th symmetric group (i.e., the group of all
permutations of $\left[N\right]$). Let $\left(-1\right)^{\sigma}$ denote the
sign of any permutation $\sigma$. The definition of a determinant says that

$\det\left(a_{i,j}\right)_{i,j\in\left[N\right]}=\sum\limits_{\sigma\in
S_{N}}\left(-1\right)^{\sigma}\prod\limits_{i=1}^{N}a_{i,\sigma\left(i\right)}$
(6)

for any matrix $\left(a_{i,j}\right)_{i,j\in\left[N\right]}\in R^{N\times N}$.
Now, Lemma 4.1 yields

$s_{\lambda/\mu}=\det\left(h_{\ell_{i}-m_{j}}\right)_{i,j\in\left[N\right]}=\sum\limits_{\sigma\in
S_{N}}\left(-1\right)^{\sigma}\prod\limits_{i=1}^{N}h_{\ell_{i}-m_{\sigma\left(i\right)}}$

(by (6)). Applying the $\mathbb{Z}$-linear map $\nabla$ to both sides of this
equality, we find

$\displaystyle\nabla\left(s_{\lambda/\mu}\right)$
$\displaystyle=\sum\limits_{\sigma\in
S_{N}}\left(-1\right)^{\sigma}\nabla\left(\prod\limits_{i=1}^{N}h_{\ell_{i}-m_{\sigma\left(i\right)}}\right)$
$\displaystyle=\sum\limits_{\sigma\in
S_{N}}\left(-1\right)^{\sigma}\left(\sum\limits_{k=1}^{N}\left(\ell_{k}+a\right)\prod\limits_{i=1}^{N}h_{\left(\ell-
e_{k}\right)_{i}-m_{\sigma\left(i\right)}}+\sum\limits_{k=1}^{N}\left(b-m_{k}\right)\prod\limits_{i=1}^{N}h_{\ell_{i}-\left(m+e_{k}\right)_{\sigma\left(i\right)}}\right)$
$\displaystyle\qquad\qquad\left(\text{by Lemma \ref{lem.Dprod}}\right)$
$\displaystyle=\sum\limits_{\sigma\in
S_{N}}\left(-1\right)^{\sigma}\sum\limits_{k=1}^{N}\left(\ell_{k}+a\right)\prod\limits_{i=1}^{N}h_{\left(\ell-
e_{k}\right)_{i}-m_{\sigma\left(i\right)}}+\sum\limits_{\sigma\in
S_{N}}\left(-1\right)^{\sigma}\sum\limits_{k=1}^{N}\left(b-m_{k}\right)\prod\limits_{i=1}^{N}h_{\ell_{i}-\left(m+e_{k}\right)_{\sigma\left(i\right)}}.$

In view of

$\displaystyle\sum\limits_{\sigma\in
S_{N}}\left(-1\right)^{\sigma}\sum\limits_{k=1}^{N}\left(\ell_{k}+a\right)\prod\limits_{i=1}^{N}h_{\left(\ell-
e_{k}\right)_{i}-m_{\sigma\left(i\right)}}$
$\displaystyle=\sum\limits_{k=1}^{N}\left(\ell_{k}+a\right)\underbrace{\sum\limits_{\sigma\in
S_{N}}\left(-1\right)^{\sigma}\prod\limits_{i=1}^{N}h_{\left(\ell-
e_{k}\right)_{i}-m_{\sigma\left(i\right)}}}_{\begin{subarray}{c}=\det\left(h_{\left(\ell-
e_{k}\right)_{i}-m_{j}}\right)_{i,j\in\left[N\right]}\\\ \text{(by
(\ref{pf.thm.1.det=}))}\end{subarray}}$
$\displaystyle=\sum\limits_{k=1}^{N}\left(\ell_{k}+a\right)\underbrace{\det\left(h_{\left(\ell-
e_{k}\right)_{i}-m_{j}}\right)_{i,j\in\left[N\right]}}_{\begin{subarray}{c}=0\text{
if }\lambda-e_{k}\notin\mathcal{P}_{N}\\\ \text{(by Lemma
\ref{lem.det0.rows})}\end{subarray}}$
$\displaystyle=\sum\limits_{\begin{subarray}{c}k\in\left[N\right];\\\ \lambda-
e_{k}\in\mathcal{P}_{N}\end{subarray}}\left(\ell_{k}+a\right)\underbrace{\det\left(h_{\left(\ell-
e_{k}\right)_{i}-m_{j}}\right)_{i,j\in\left[N\right]}}_{\begin{subarray}{c}=s_{\left(\lambda-
e_{k}\right)/\mu}\\\ \text{(by Lemma \ref{lem.det1.rows})}\end{subarray}}$
$\displaystyle=\sum\limits_{\begin{subarray}{c}k\in\left[N\right];\\\ \lambda-
e_{k}\in\mathcal{P}_{N}\end{subarray}}\left(\ell_{k}+a\right)s_{\left(\lambda-
e_{k}\right)/\mu}=\sum\limits_{\begin{subarray}{c}i\in\left[N\right];\\\
\lambda-
e_{i}\in\mathcal{P}_{N}\end{subarray}}\left(\ell_{i}+a\right)s_{\left(\lambda-
e_{i}\right)/\mu}$

and

$\displaystyle\sum\limits_{\sigma\in
S_{N}}\left(-1\right)^{\sigma}\sum\limits_{k=1}^{N}\left(b-m_{k}\right)\prod\limits_{i=1}^{N}h_{\ell_{i}-\left(m+e_{k}\right)_{\sigma\left(i\right)}}$
$\displaystyle=\sum\limits_{k=1}^{N}\left(b-m_{k}\right)\underbrace{\sum\limits_{\sigma\in
S_{N}}\left(-1\right)^{\sigma}\prod\limits_{i=1}^{N}h_{\ell_{i}-\left(m+e_{k}\right)_{\sigma\left(i\right)}}}_{\begin{subarray}{c}=\det\left(h_{\ell_{i}-\left(m+e_{k}\right)_{j}}\right)_{i,j\in\left[N\right]}\\\
\text{(by (\ref{pf.thm.1.det=}))}\end{subarray}}$
$\displaystyle=\sum\limits_{k=1}^{N}\left(b-m_{k}\right)\underbrace{\det\left(h_{\ell_{i}-\left(m+e_{k}\right)_{j}}\right)_{i,j\in\left[N\right]}}_{\begin{subarray}{c}=0\text{
if }\mu+e_{k}\notin\mathcal{P}_{N}\\\ \text{(by Lemma
\ref{lem.det0.cols})}\end{subarray}}$
$\displaystyle=\sum\limits_{\begin{subarray}{c}k\in\left[N\right];\\\
\mu+e_{k}\in\mathcal{P}_{N}\end{subarray}}\left(b-m_{k}\right)\underbrace{\det\left(h_{\ell_{i}-\left(m+e_{k}\right)_{j}}\right)_{i,j\in\left[N\right]}}_{\begin{subarray}{c}=s_{\lambda/\left(\mu+e_{k}\right)}\\\
\text{(by Lemma \ref{lem.det1.cols})}\end{subarray}}$
$\displaystyle=\sum\limits_{\begin{subarray}{c}k\in\left[N\right];\\\
\mu+e_{k}\in\mathcal{P}_{N}\end{subarray}}\left(b-m_{k}\right)s_{\lambda/\left(\mu+e_{k}\right)}=\sum\limits_{\begin{subarray}{c}i\in\left[N\right];\\\
\mu+e_{i}\in\mathcal{P}_{N}\end{subarray}}\left(b-m_{i}\right)s_{\lambda/\left(\mu+e_{i}\right)},$

this can be rewritten as

$\nabla\left(s_{\lambda/\mu}\right)=\sum\limits_{\begin{subarray}{c}i\in\left[N\right];\\\
\lambda-
e_{i}\in\mathcal{P}_{N}\end{subarray}}\left(\ell_{i}+a\right)s_{\left(\lambda-
e_{i}\right)/\mu}+\sum\limits_{\begin{subarray}{c}i\in\left[N\right];\\\
\mu+e_{i}\in\mathcal{P}_{N}\end{subarray}}\left(b-m_{i}\right)s_{\lambda/\left(\mu+e_{i}\right)}.$

Thus, Theorem 2.1 is proved.

######  Proof 6.2 (Proof of Corollary 2.5.).

Define $\ell,m\in\mathbb{Z}^{N}$ as in Theorem 2.1. Theorem 2.1 (applied to
$a=N-1$ and $b=0$) yields

$\nabla\left(s_{\lambda/\mu}\right)=\sum\limits_{\begin{subarray}{c}i\in\left[N\right];\\\
\lambda-
e_{i}\in\mathcal{P}_{N}\end{subarray}}\left(\ell_{i}+N-1\right)s_{\left(\lambda-
e_{i}\right)/\mu}+\sum\limits_{\begin{subarray}{c}i\in\left[N\right];\\\
\mu+e_{i}\in\mathcal{P}_{N}\end{subarray}}\left(0-m_{i}\right)s_{\lambda/\left(\mu+e_{i}\right)}.$

Theorem 2.1 (applied to $a=N$ and $b=-1$) yields

$\nabla\left(s_{\lambda/\mu}\right)=\sum\limits_{\begin{subarray}{c}i\in\left[N\right];\\\
\lambda-
e_{i}\in\mathcal{P}_{N}\end{subarray}}\left(\ell_{i}+N\right)s_{\left(\lambda-
e_{i}\right)/\mu}+\sum\limits_{\begin{subarray}{c}i\in\left[N\right];\\\
\mu+e_{i}\in\mathcal{P}_{N}\end{subarray}}\left(-1-m_{i}\right)s_{\lambda/\left(\mu+e_{i}\right)}.$

Subtracting the latter equality from the former, we find

$\displaystyle 0$
$\displaystyle=\sum\limits_{\begin{subarray}{c}i\in\left[N\right];\\\ \lambda-
e_{i}\in\mathcal{P}_{N}\end{subarray}}\left(-1\right)s_{\left(\lambda-
e_{i}\right)/\mu}+\sum\limits_{\begin{subarray}{c}i\in\left[N\right];\\\
\mu+e_{i}\in\mathcal{P}_{N}\end{subarray}}s_{\lambda/\left(\mu+e_{i}\right)}$
$\displaystyle=-\sum\limits_{\begin{subarray}{c}i\in\left[N\right];\\\
\lambda-e_{i}\in\mathcal{P}_{N}\end{subarray}}s_{\left(\lambda-
e_{i}\right)/\mu}+\sum\limits_{\begin{subarray}{c}i\in\left[N\right];\\\
\mu+e_{i}\in\mathcal{P}_{N}\end{subarray}}s_{\lambda/\left(\mu+e_{i}\right)}.$

In other words,

$\sum\limits_{\begin{subarray}{c}i\in\left[N\right];\\\ \lambda-
e_{i}\in\mathcal{P}_{N}\end{subarray}}s_{\left(\lambda-
e_{i}\right)/\mu}=\sum\limits_{\begin{subarray}{c}i\in\left[N\right];\\\
\mu+e_{i}\in\mathcal{P}_{N}\end{subarray}}s_{\lambda/\left(\mu+e_{i}\right)}.$

This proves Corollary 2.5.

##  7 Final remarks

1. Clearly, Theorem 2.1 can be generalized by replacing $\mathbb{Z}$ with any commutative ring $\mathbf{k}$. In this generality, $a$ and $b$ can be any two elements of $\mathbf{k}$ (rather than just integers) satisfying $a+b=\left(N-1\right)\cdot 1_{\mathbf{k}}$. However, not much generality is gained in this way, since Corollary 2.5 easily shows that all choices of $a$ and $b$ lead to the same sum.

2. Theorem 2.1 can also be lifted to the “infinite setting”, i.e., to the ring of symmetric functions in infinitely many variables (see, e.g., [Stanle24, Chapter 7] or [GriRei20, Chapter 2] for introductions to this ring). This is not completely straightforward, since the diagonal derivative $\nabla$ is defined only for finitely many indeterminates and depends on their number $N$ (for instance, $\nabla\left(s_{\left(1\right)}\right)=N$). In the infinite setting, it has to be replaced by a derivation $\nabla_{q}$ depending on a scalar $q$:

Let $\mathbf{k}$ be a commutative ring, and let $q\in\mathbf{k}$ be an
element. (For example, we can have $\mathbf{k}=\mathbb{Z}\left[q\right]$ and
$q=q$.) Let $\Lambda$ be the ring of symmetric functions in infinitely many
indeterminates $x_{1},x_{2},x_{3},\ldots$ over $\mathbf{k}$. For each
$n\in\mathbb{Z}$, we let $h_{n}$ denote the $n$-th complete homogeneous
symmetric function in $\Lambda$ (so that $h_{0}=1$ and $h_{i}=0$ for all
$i<0$). Let $\nabla_{q}:\Lambda\rightarrow\Lambda$ be the unique derivation
that satisfies

$\nabla_{q}\left(h_{n}\right)=\left(n+q-1\right)h_{n-1}\ \ \ \ \ \ \ \ \ \
\text{for each }n>0.$ 555This condition uniquely determines a derivation of
$\Lambda$, since the elements $h_{1},h_{2},h_{3},\ldots$ freely generate
$\Lambda$ as a commutative $\mathbf{k}$-algebra. It is easy to see that this
derivation $\nabla_{q}$ satisfies the equality
$\nabla_{q}\left(h_{n}\right)=\left(n+q-1\right)h_{n-1}$ for all
$n\in\mathbb{Z}$.

For $q=N\in\mathbb{N}$, this derivation is a lift of the directional
derivative operator $\nabla:R\rightarrow R$ to $\Lambda$ (meaning that
$\nabla\circ\pi=\pi\circ\nabla_{N}$, where $\pi:\Lambda\rightarrow R$ is the
evaluation homomorphism at $x_{1},x_{2},\ldots,x_{N},0,0,0,\ldots$). With
these definitions, we can extend Theorem 2.1 to a general property of
$\nabla_{q}$:

######  Theorem 7.1.

Let $a$ and $b$ be two elements of $\mathbf{k}$ such that $a+b=q-1$. Let
$\lambda=\left(\lambda_{1},\lambda_{2},\lambda_{3},\ldots\right)$ and
$\mu=\left(\mu_{1},\mu_{2},\mu_{3},\ldots,\right)$ be two partitions. Set

$\ell_{i}:=\lambda_{i}-i\ \ \ \ \ \ \ \ \ \ \text{and}\ \ \ \ \ \ \ \ \ \
m_{i}:=\mu_{i}-i\ \ \ \ \ \ \ \ \ \ \text{for each }i\geq 1.$

Then,

$\nabla_{q}\left(s_{\lambda/\mu}\right)=\sum\limits_{\begin{subarray}{c}i\geq
1;\\\ \lambda-e_{i}\text{ is a
partition}\end{subarray}}\left(\ell_{i}+a\right)s_{\left(\lambda-
e_{i}\right)/\mu}+\sum\limits_{\begin{subarray}{c}i\geq 1;\\\ \mu+e_{i}\text{
is a
partition}\end{subarray}}\left(b-m_{i}\right)s_{\lambda/\left(\mu+e_{i}\right)}.$

Here, $e_{i}$ means the infinite sequence
$\left(0,0,\ldots,0,1,0,0,0,\ldots\right)$ with the $1$ in its $i$-th
position.

The proof of this theorem is similar to our above proof of Theorem 2.1 (with
the minor complication that we have to fix an $N\in\mathbb{N}$ that is
strictly larger than the lengths of $\lambda$ and $\mu$, in order to apply the
Jacobi–Trudi formula), and is left to the reader.

3. It is natural to attempt generalizing Theorem 2.1 to higher-order differential operators, such as $\nabla^{\prime}:=\dfrac{\partial^{2}}{\partial x_{1}^{2}}+\dfrac{\partial^{2}}{\partial x_{2}^{2}}+\cdots+\dfrac{\partial^{2}}{\partial x_{N}^{2}}$. However, finding similar formulas for $\nabla^{\prime}\left(s_{\lambda/\mu}\right)$ appears significantly harder, as the “locality” (the fact that $\lambda$ and $\mu$ change only a very little) disappears: For instance, for $N=3$, the expansion of $\nabla^{\prime}\left(s_{\left(5,3,0\right)}\right)$ in the Schur basis contains a $2s_{\left(2,2,2\right)}$ term.

Acknowledgments. The present note is a side product of the Yulia’s Dream
program 2023, in which three of its authors participated as student
researchers and the remaining one as a mentor.

## References

  * [GriRei20] Darij Grinberg, Victor Reiner, Hopf algebras in Combinatorics, version of 27 July 2020, arXiv:1409.8356v7.
  * [HPSW20] Zachary Hamaker, Oliver Pechenik, David E. Speyer, Anna Weigandt, Derivatives of Schubert polynomials and proof of a determinant conjecture of Stanley, Algebraic Combinatorics 3 (2020) no. 2, pp. 301–307.
  * [Nenash20] Gleb Nenashev, Differential operators on Schur and Schubert polynomials, arXiv:2005.08329v2.
  * [Stanle12] Richard P. Stanley, Enumerative Combinatorics, volume 1, second edition, Cambridge University Press 2012.
See http://math.mit.edu/~rstan/ec/ for errata.

  * [Stanle24] Richard P. Stanley, Enumerative Combinatorics, volume 2, second edition, Cambridge University Press 2024.
See http://math.mit.edu/~rstan/ec/ for errata.

  * [Stembr02] John R. Stembridge, A Concise Proof of the Littlewood-Richardson Rule, The Electronic Journal of Combinatorics 9 (2002), #N5.
https://doi.org/10.37236/1666

  * [Weigan23] Anna Weigandt, Derivatives and Schubert Calculus, talk at FPSAC conference 2023, https://www.youtube.com/watch?v=fgzB7YjGOEc


# Privacy Leakage of Adversarial Training Models in Federated Learning Systems

Jingyang Zhang, Yiran Chen, Hai Li
Department of Electrical and Computer Engineering, Duke University
<EMAIL_ADDRESS>
###### Abstract

Adversarial Training (AT) is crucial for obtaining deep neural networks that
are robust to adversarial attacks, yet recent works found that it could also
make models more vulnerable to privacy attacks. In this work, we further
reveal this unsettling property of AT by designing a novel privacy attack that
is practically applicable to the privacy-sensitive Federated Learning (FL)
systems. Using our method, the attacker can exploit AT models in the FL system
to accurately reconstruct users’ private training images even when the
training batch size is large. Code is available at
https://github.com/zjysteven/PrivayAttack_AT_FL.

##  1 Introduction

Deep Neural Networks (DNNs) suffer from the notorious adversarial
perturbations [17]: These imperceptible noises could easily fool DNNs to yield
wildly wrong and malicious decisions (_e.g_., misclassification with high
confidence). Adversarial Training (AT) [9] has been one of the most effective
techniques that mitigate such vulnerability, which withstands adaptive attacks
[18] and leads to the highest empirical adversarial robustness to date [1]. It
is without doubt that AT is crucial for building robust intelligent systems.

Despite the desired robustness, recent works [16, 12] revealed an unexpected
and alarming property of AT: It can make models more likely to leak the data
privacy than the ones that undergoes vanilla training (_i.e_., using the
original clean images instead of online-generated adversarial examples).
Specifically, Song _et al_. [16] found that AT makes it easier for membership
inference attack [14] to succeed, which aims to identify whether a certain
sample was used during the training. In another work [12], it is shown that
model inversion attack [4] is tractable on AT models, with which the attacker
can generate images that visually resemble the actual training samples. In
all, both papers indicated that AT models exhibit a robustness-privacy trade-
off.

Figure 1: An overview of the proposed privacy attack against FL systems to
“steal” the client’s training images. We formulate a novel two-step procedure:
1) Feature restoration from gradients (Sec. 4.2) and 2) Image reconstruction
from features (Sec. 4.3). Zoom in and also refer Fig. 5 to see image
reconstruction quality.

In this work, we pursue this line of inquiry and further demonstrate such
trade-off by presenting a novel privacy attack that exploits AT models. Our
attack is practically applicable to Federated Learning (FL) systems [11]. The
goal is to compromise the privacy of FL clients by reconstructing their own
training images (which may contain private information) based on the weight
gradients that are communicated between the clients and the central server.

Different from previous approaches that directly invert gradients to
reconstruct images [24, 5, 19], our attack methodology forms a unique two-step
procedure, where we first restore the features (_i.e_., the outputs of the
penultimate layer) from the gradients, and then reconstruct the inputs using
the recovered features as supervision (see Fig. 1 for illustration). The key
insight behind our method is that while the gradients of the samples within a
batch are fused together and prohibit accurate reconstruction of each
individual input, the features are less coupled and (once restored) can
provide more precise information for the reconstruction than the batch-
averaged gradients. Upon the general framework, the proposed attack leverages
AT models which enable the success execution of both attack steps.

We conduct extensive experiments using high-resolution images from ImageNet
[2] to demonstrate how our privacy attack can work with AT models to
compromise the privacy of FL clients. Specifically, we are able to accurately
reconstruct the clients’ training images at a large batch size (_e.g_., 256),
something that is not achieved by previous methods with vanilla models [24, 5,
19]. The results suggest that AT poses a risk to the expected-to-be-secure FL
systems.

##  2 Related Work

Privacy risks of AT models. As discussed earlier, a few prior works [16, 12]
also identified that AT could make models more vulnerable to privacy attacks.
In comparison, our work focuses on a considerably more strict and challenging
criterion of privacy leakage: We consider exact reconstruction of the training
images owned by the victims, a scenario which we believe poses more severe
risks than the attacks that synthesize human-recognizable images [12] or infer
the membership of data samples [16]. Besides, we put ourselves in the
realistic, privacy-sensitive FL setting, to which our attack is practically
applicable.

Privacy attacks against FL systems. There has been a line of research trying
to expose the privacy vulnerability of the FL systems. Zhu _et al_. [24]
developed the seminal DLG attack which reconstructs input images by matching
the gradients computed using the reconstructed ones and the real ones. Geiping
_et al_. [5] made improvements by using a better matching loss function and
optimizer. They achieved near-perfect recovery quality when the gradients are
computed using a single image (_i.e_., the batch size is 1). More recently,
Yin _et al_. [19] further incorporated advanced image priors as regularization
to enhance the recover quality.

All these works, however, can only unveil clear visual information under a
small batch size (_e.g_., when the batch includes only a single or a few
images), while a large batch size (_e.g_., 128 or 256) is often required for
effective and efficient training of DNNs [6, 8]. As a result, whether the
privacy can really be compromised in realistic settings (_i.e_., with large
batch size) remains unclear. In this paper, we show that the privacy of FL
clients is indeed at risk if they are performing AT, as the attacker can
leverage our attack and exploit AT models to achieve accurate reconstruction
of users’ images even at a batch size of 256.

Inverting features to reconstruct images. Inverting the features has been
studied as a way to understand/interpret what DNN models learn [10, 3]. In
particular, Engstrom _et al_. [3] discovered that AT models are more
“invertible” than vanilla models, as the reconstructed images from AT models’
features look much more plausible. However, their focus is on the
interpretability perspective. In our work, we take the security perspective
and demonstrate how the good “invertibility” of AT models can
unexpectedly/undesirably enable a privacy attack.

##  3 Problem Setting

We first formulate the problem setting and define the threat model before
delving into our proposed attack. In a FL system, in each step the client will
receive a copy of the global model from the central server and perform local
training. Here, following prior works [24, 5, 19], we focus on the case of
single-step local training. Concretely, considering an image classification
task, the gradients of loss w.r.t. the model parameters are computed as
follows during the local training:

$\Delta_{\theta}\coloneqq\frac{1}{N}\sum_{i=1}^{N}\nabla_{\theta}\mathcal{L}(f_{\theta}(\bm{x}_{i}),y_{i}),$
(1)

where $f_{\theta}(\cdot)$ is the mapping function of the DNN model
parameterized by $\theta$, $N$ is the batch size, $\bm{x}_{i}$ is $i$-th input
image of the batch, $y_{i}$ is the corresponding groundtruth label,
$\mathcal{L}(\cdot,\cdot)$ computes the cross-entropy loss, and
$\Delta_{\theta}$ is a simplified notion for the batch-averaged gradients.
Note, if the client is performing AT, the input $\bm{x}_{i}$ will be the
adversarial example instead of the original clean sample.

After the local training, the server will collect the gradients
$\Delta_{\theta}$ from the clients and aggregate the updates into the current
global model $f_{\theta}(\cdot)$. Here, we assume that the server is malicious
or has been compromised by the attacker. Therefore, the attacker can access
the model $f_{\theta}(\cdot)$ and the gradients $\Delta_{\theta}$. Similar to
[5], we do not pose any further assumptions beyond this point which may allow
the attacker to better exploit the vulnerability, _e.g_., we do not assume
that the attacker can modify the model architecture or send fake, malicious
global parameters to the clients. The attack goal is then to reconstruct the
input images $\bm{x}_{i}$ that are used during the last local training step,
given the available information $f_{\theta}(\cdot)$ and $\Delta_{\theta}$.

##  4 Methodology

###  4.1 Overview

To better motivate and describe our proposed methodology, we first give a
brief overview of existing methods [24, 5, 19] and discuss their shortcomings.
Essentially, previous works all solve the following optimization problem:

$\operatorname*{arg\,min}_{\bm{z}}\mathcal{L}_{\text{grad}}\left(\frac{1}{N}\sum_{i=1}^{N}\nabla_{\theta}\mathcal{L}(f_{\theta}(\bm{z}_{i}),\hat{y}_{i}),\Delta_{\theta}\right)+\mathcal{R}(\bm{z}).$
(2)

Specifically, the optimization variable here is a randomly-initialized batch
of inputs $\bm{z}$. The first term in Eq. 2 enforces the gradients of loss
computed using $\bm{z}$ to match the ground-truth gradients $\Delta_{\theta}$
according to a certain distance metric
$\mathcal{L}_{\text{grad}}(\cdot,\cdot)$ (_e.g_., cosine distance is used in
[5] and $\ell_{2}$ distance is used in [24] and [19]). Note, an estimation of
the ground-truth labels $\hat{y}_{i}$ is used here to compute the loss [23, 5,
19]. The underlying idea of the first term is that the synthesized images
$\bm{z}$ will resemble the original inputs if the gradients computed on them
are similar. Meanwhile, to encourage the generation of realistic and natural
images, the second term in Eq. 2 incorporates image priors
$\mathcal{R}(\cdot)$ as regularization (_e.g_., the Total Variation loss [10]
and the Group Consistency loss [19]).

While the idea of Eq. 2 is natural and straightforward, one can identify an
obvious limitation. Note from Eq. 1 that the gradients contributed by each
individual sample, _i.e_.,
$\nabla_{\theta}\mathcal{L}(f_{\theta}(x_{i}),y_{i})$, are fused together in
the batch-averaged gradients $\Delta_{\theta}$. Therefore, $\Delta_{\theta}$
does not provide precise supervision for each individual image especially
under a large batch size, making it much difficult to achieve accurate
reconstruction (in a similar sense to how exactly knowing the value of $a$ and
$b$ is hard given the value of $a+b$). As a result, Eq. 2 only works well when
the batch size is extremely small (_e.g_., when the batch has only a single or
a few samples). When the batch size is large, the restored images lack clear
visual details and do not resemble the real images anymore [5, 19].

To mitigate this problem, we propose a unique two-step attack procedure. In
the first step, we decouple the fused information of each individual image by
restoring their features from the gradients which are less coupled. Here, we
define the feature vector of a sample as the output of the penultimate layer
when that sample is passed through the DNN model. Once we restore the feature
vectors, each corresponding to one input image, we can use them as more
accurate supervision to reconstruct the images. Next, we will explain each of
the two steps in detail and discuss how AT models kick in and benefit the
attack.

###  4.2 Feature restoration from gradients

We first introduce some notions to facilitate the description. A DNN model
$f(\cdot)$ deployed for image classification tasks can always be decomposed as
$f(\cdot)=h(r(\cdot))$, where $r(\cdot)$ typically comprises convolutional
layers and extracts high-level representations/features of the inputs, and
$h(\cdot)$ is the linear layer that performs classification on top of the
features and outputs activation scores for each class (_i.e_., logits). For
simplicity, we denote the feature of an input $\bm{x}$ as $\bm{r}$, _i.e_.,
$\bm{r}\coloneqq r(\bm{x})$. Note that $\bm{r}\in\mathbb{R}^{D}$ is a
$D$-dimensional column vector.

Our key insight here is that the features can be restored from the gradients
w.r.t. the linear layer’s weights, which are directly accessible to the
attacker. To see this, let us first delve into the computation of the weight
gradients of $h(\cdot)$. Denote the linear layer’s weight matrix as
$\bm{W}\in\mathbb{R}^{D\times K}$, wherein the $k$-th column
$\bm{W}_{k}\in\mathbb{R}^{D}$ is a weight vector corresponding to the $k$-th
class, and $K$ is the total number of classes. Then, the class
activations/logits are $\bm{a}=\bm{W}^{\top}\bm{r}$, and the class
probabilities are $\bm{p}=\text{softmax}(\bm{a})$, where the probability on
$k$-th class $\bm{p}_{k}$ is
$\frac{e^{\bm{a}_{k}}}{\sum_{j=1}^{K}e^{\bm{a}_{j}}}$. Here,
$\bm{a}_{k}=\bm{W}_{:,k}^{\top}\bm{r}$ is the $k$-th element of the vector
$\bm{a}$, with $\bm{W}_{:,k}$ being the $k$-th column of $\bm{W}$. Finally,
the cross-entropy loss computed on an input pair $(\bm{x},y)$ is
$l=-\log\bm{p}_{y}$. Accordingly, one can derive the gradients of loss w.r.t.
each weight vector $\bm{W}_{:,k}$ in the linear layer:

$\displaystyle\frac{\partial l}{\partial\bm{W}_{:,k}}$
$\displaystyle=\frac{\partial
l}{\partial\bm{p}_{y}}\cdot\sum_{j=1}^{K}\frac{\partial\bm{p}_{y}}{\partial\bm{a}_{j}}\cdot\frac{\partial\bm{a}_{j}}{\bm{W}_{:,k}}$
$\displaystyle=\begin{cases}-(1-\bm{p}_{y})\bm{r},&k=y\\\
~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}\bm{p}_{k}\bm{r},&k\neq y\end{cases}.$
(3)

Based on the derivation in Eq. 3, we now discuss how one can restore the
features from the batch-averaged gradients w.r.t. the linear layer’s weights.
We consider a batch of $N$ inputs $\bm{x}_{i}$, each with a corresponding
feature vector $\bm{r}_{i}$. Note, following [5, 19], here we assume that
there are no samples sharing the same label within the batch. This assumption
generally holds for the randomly constructed batch when the size $N$ is (much)
smaller than the number of classes $K$ (_e.g_., on ImageNet $K=1000$ while $N$
typically takes 256 [6]). Then, suppose that we want to restore the feature
vector $\bm{r}_{i}$ whose corresponding label is $y_{i}$, we can directly take
the gradients w.r.t. the weight vector $\bm{W}_{:,y_{i}}$:

$\displaystyle\hat{\bm{r}}_{i}$
$\displaystyle\coloneqq\Delta_{\bm{W}_{:,y_{i}}}=\frac{1}{N}\sum_{j=1}^{N}\frac{\partial
l_{j}}{\partial\bm{W}_{:,y_{i}}}$
$\displaystyle\propto-(1-\bm{p}_{i,y_{i}})\bm{r}_{i}+\sum_{j=1,j\neq
i}^{N}\bm{p}_{j,y_{i}}\bm{r}_{j}$
$\displaystyle\approx-(1-\bm{p}_{i,y_{i}})\bm{r}_{i}.$ (4)

Here, we denote the restored feature vector as $\hat{\bm{r}}_{i}$. $l_{j}$ is
the loss computed on the $j$-th image, and $\bm{p}_{i,y_{i}}$ represents the
probability of the $i$-th sample belonging to class $y_{i}$.

Figure 2: A toy example showcasing how the features can be restored from the
linear layer’s weight gradients on an AT model. Here we suppose the batch size
$N=2$ and the number of classes $K=5$. Without loss of generality, assume
$\bm{r}_{1}$ and $\bm{r}_{2}$ have label $1$ and $2$, respectively. The
numbers in the brackets are the softmax probabilities. Adversarial examples
result in small $\bm{p}_{1,1}$ and $\bm{p}_{2,2}$. According to Eq. 4,
$\Delta_{\bm{W}_{:,1}}\propto-(1-0.3)\bm{r}_{1}+0.2\bm{r}_{2}$. The attacker
can take $\Delta_{\bm{W}_{:,1}}$ as the restored feature $\hat{\bm{r}}_{1}$.

Essentially, Eq. 4 indicates that the restored feature $\hat{\bm{r}}_{i}$ is
approximately proportional to the true feature $\bm{r}_{i}$. The approximation
in the last row of Eq. 4 holds because the probabilities assigned to the wrong
class $\bm{p}_{j,y_{i}}$ (recall that $y_{j}\neq y_{i}$ when $j\neq i$) are
becoming smaller and smaller as the training proceeds, therefore they may
contribute much less to the summation than $-(1-\bm{p}_{i,y_{i}})\bm{r}_{i}$,
especially if $\bm{p}_{i,y_{i}}$ is not too large. In fact, this is exactly
the case for an AT model. During each iteration, AT uses adversarial examples
as inputs, which are generated by maximizing the cross-entropy loss.
Equivalently, adversarial examples minimize the probability assigned to the
ground-truth class, _i.e_., $\bm{p}_{i,y_{i}}$. As a result, AT models can
lead to a more tight approximation of Eq. 4 and better restoration of the
features. We present a toy example of the feature restoration process in Fig.
2. Note, although in the case of AT the attacker is actually reconstructing
the adversarial example, the privacy can still be compromised because the
adversarial image is visually very similar to the clean image since their
distance is bounded by a small value.

We finally discuss how to recover the batch labels $y_{i}$, which is necessary
for knowing which columns of the gradient matrix of $\bm{W}$ should be taken
for feature restoration. Here we adopt the common practice of existing works
[23, 5, 19], which is to look at the sign of the gradient elements of
$\bm{W}$. For the ease of illustration, without loss of generality, assume
that the batch of $N$ samples are with the labels $1,2,...,N$, _i.e_., the
$k$-th sample is from the $k$-th class. Then according to Eq. 4, the gradients
w.r.t. the $k$-th column of $\bm{W}$ are:

$\displaystyle\frac{1}{N}\sum_{j=1}^{N}\frac{\partial
l_{j}}{\partial\bm{W}_{:,k}}\propto$
$\displaystyle~{}~{}~{}~{}~{}~{}\begin{cases}-(1-\bm{p}_{k,k})\bm{r}_{k}+\sum_{j=1,j\neq
k}^{N}\bm{p}_{j,k}\bm{r}_{j},&~{}1\leq k\leq N\\\
\sum_{j=1}^{N}\bm{p}_{j,k}\bm{r}_{j},&N<k\leq K\end{cases}.$ (5)

Note that modern DNN architectures (_e.g_., ResNet [6] and VGG [15]) typically
use ReLU as the activation function, which makes the elements of the feature
vector $\bm{r}$ always non-negative. With this in mind, the takeaway of Eq. 5
is that in the gradient matrix of $\bm{W}$, only the columns that correspond
to the appeared labels may have negative elements, while the other columns
will have all positive values. Therefore, we can determine the batch labels by
checking the sign of the smallest value of each column. If the smallest value
of $k$-th column is positive, then $k$ is very unlikely to be one of the batch
labels. In practice, one can pick the top-$N$ columns that have the smallest
elements, and take their indices as the batch labels.

###  4.3 Image reconstruction from features

Once we obtain the restored feature $\hat{\bm{r}}_{i}$, the attacker can
reconstruct each input image by solving the following optimization objective:

$\operatorname*{arg\,min}_{\bm{z}_{i}}\mathcal{L}_{\text{feat}}\left(r_{\theta}(\bm{z}_{i}),\hat{\bm{r}}_{i}\right)+\mathcal{R}(\bm{z}_{i}).$
(6)

The idea here is to optimize the input $\bm{z}_{i}$ such that its feature
$r_{\theta}(\bm{z}_{i})$ is close to the restored feature $\hat{\bm{r}}_{i}$
(which in turn is similar to the ground-truth feature $\bm{r}_{i}$) according
to a certain metric $\mathcal{L}_{\text{feat}}(\cdot,\cdot)$. Here we opt to
use the scale-invariant cosine distance as $\mathcal{L}_{\text{feat}}$ since
$\hat{\bm{r}}_{i}$ approximates $\bm{r}_{i}$ by a factor of
$-(1-\bm{p}_{i,y_{i}})$ (Eq. 4). Again, image prior $\mathcal{R(\cdot)}$ is
incorporated to improve the fidelity of the generated images. In this work, we
apply the Total Variation [10] as the regularization, while using more
sophisticated/complex image priors is likely to further enhance the
reconstruction quality.

Inverting features to reconstruct input images is more feasible on AT models
than on vanilla models. This observation is first made in the work of [3],
where it is found that inverting the features of AT models can yield
meaningful images that share a great amount of semantic similarity with the
real inputs, while doing so on vanilla non-robust models only lead to
meaningless noisy patterns. Back then, the researchers focused on the
interpretability aspect of such phenomenon without discussing its security
implications. In this work, we show how AT models’ good “invertibility” can
actually be exploited to conduct privacy attack.

##  5 Experiments

###  5.1 Setup

Dataset. We target the reconstruction of $224\times 224$ high-resolution
images from ImageNet [2], which is more challenging than restoring low-
resolution images (_e.g_., $32\times 32$ CIFAR images) [5].

Models. We consider various DNN architectures to comprehensively demonstrate
the effectiveness of our attack and to evaluate how the architecture affects
the attack performance. Specifically, we consider VGG-16 (VGG16) [15],
ResNet-18/50 (RN18/50) [6], WideResNet-50x4 (WRN50x4) [20], and DenseNet-161
(DN161) [7].

Training. We evaluate both vanilla training (_i.e_., minimizing the loss on
clean inputs) and AT (_i.e_., minimizing the loss on adversarial examples) to
demonstrate how AT makes it more easier for the privacy attack to succeed.
Specifically, in this work we consider Madry’s AT [9] with $\ell_{2}$ norm
bound, although our attack can work with other types of AT (_e.g_., TRADES
[21], or with $\ell_{\infty}$ norm bound) as both attack steps only rely on
AT’s general properties. We also vary the perturbation strength of the AT to
see its effect on the attack. We leverage the pre-trained models provided by
[13] to conduct all the experiments.

Attack process. We simulate an attack process by first creating a set of
anchor images. Specifically, we randomly sample 5 images from each of the
1,000 categories from the validation set of ImageNet, resulting in a total of
5,000 anchors. Then, for each anchor, we construct 5 random batches which
include that anchor. Finally, we play as an attacker who tries to reconstruct
each anchor given the 5 groups of batch-averaged gradients corresponding to
the 5 random batches. Note, here we focus on the best-case performance out of
the 5 batches, which equivalently exposes the worst-case scenario for the
victim/defender. We explicitly focus on the reconstruction of the anchor
images because it allows easier analysis.

Evaluation metric. We measure the cosine similarity between the restored
features and the ground-truth features to evaluate the performance of our
first attack step, _i.e_., the quality of feature restoration. When evaluating
the second step, namely image reconstruction from features, we will both use
LPIPS [22] as the quantitative metric and qualitatively demonstrate the
performance by visualizing the reconstructed images.

Figure 3: Feature restoration quality (in terms of cosine similarity) of the
5,000 anchor images on various AT and vanilla models and under various batch
size. The samples are sorted by the recover quality in each plot. The closer
the curve is to the upper left corner, the better feature restoration is
achieved. Figure 4: Left: Feature restoration quality v.s. the perturbation
strength $\varepsilon$ of AT. RN18 is used here. Right: Feature restoration
quality v.s. the model architecture. $\varepsilon=3.0$ is used here.

###  5.2 Feature restoration from gradients

We first evaluate our first attack step, namely feature restoration, for which
the results are shown in Fig. 3. There are several key observations made from
the results.

AT models enable better restoration of the features. Comparing the first and
second column of Fig. 3, it is obvious that the feature restoration is much
more successful on AT models than on vanilla models. For example, with RN18
architecture and a batch size of 256, there are around 3,500 out of 5,000
samples whose features can be restored nearly perfectly (_i.e_., with $\sim
1.0$ cosine similarity) on the AT model, while less than 1,000 samples’
features are restored that well on the vanilla model. This observation aligns
with our analysis in Sec. 4.2.

In the left plot of Fig. 4, we also observe that the feature restoration
quality (averaged over 5,000 samples) becomes better as the AT’s perturbation
strength $\varepsilon$ increases, which further demonstrates that AT makes the
model more vulnerable to the feature restoration attack step.

Feature restoration works even under large batch size. As discussed earlier,
the motivation of the feature restoration step is to decouple the fused
information of each individual input from the batch-averaged gradients.
Indeed, we find this strategy effective even under a large batch size.
Specifically, under the batch size of 256, the attack applied to an AT model
can perfectly restore the features of at least 1,000 samples (with WRN50x4)
and up to 4,000 samples (with VGG16), out of the total 5,000 samples. Not
surprisingly, the restoration quality is even better when the batch size is
smaller.

Models with smaller capacity are more vulnerable. In the right plot of Fig. 4,
we visualize the feature restoration quality (averaged over 5,000 anchor
samples) w.r.t. the test accuracy of various model architectures on the clean
images of ImageNet. The general trend is that the models with lower clean
accuracy is more vulnerable to the feature restoration attack step. We suspect
that this is because the models with a smaller learning capacity (in terms of
the clean accuracy) do not resist adversarial examples very well, and the
probability $\bm{p}_{i,y_{i}}$ assigned to the ground-truth class of the
adversarial input would be lower. As a result, small-capacity models could
lead to better feature restoration (see Eq. 4).

###  5.3 Image reconstruction from features

Figure 5: Visualization of reconstructed images on AT models (first row in
each pair) and ground-truth ones (second row). The numbers are the LPIPS score
($\downarrow$). Figure 6: Visualization of reconstructed images on vanilla
models (first row in each pair) and ground-truth ones (second row).

We next invert the restored features to recontruct input images according to
Eq. 6. Specifically, we use Adam optimizer with a learning rate of 0.1 and
perform 5,000 steps of optimization. The weight for the Total Variation loss
$\mathcal{R}$ is $1e^{-6}$. Image generation is often sensitive to the
initialization, and we find that using multiple random starts (and picking the
best result according to the loss) can improve the image quality. Here we use
5 random starts.

We present the results obtained on AT models and vanilla models in Fig. 5 and
Fig. 6, respectively. The takeaway here is twofold. First, AT models obviously
enable much better reconstruction than vanilla models. Many of the generated
images from AT models clearly unveil the object identity, often with accurate
restoration of the visual details (_e.g_., the branches in the bird image
obtained on WRN50x4). In comparison, vanilla models only yield absurd, hard-
to-interpret patterns which hardly reveal useful information about the
original images. Second, we find that the models with larger learning capacity
are more suitable for the feature inversion. Recall that RN50, WRN50x4, and
DN161 achieve higher clean accuracy than RN18 and VGG16 according to Fig. 4.
In Fig. 5, the latter two models more often have distortions or unnatural
patterns in their reconstructed images than the first three models. We suspect
that this is because the large-capacity models can learn more semantic-
meaningful features [3] during AT, which is essential for recovering the
semantics of the original input images.

Finally, we remark that with AT models, our attack can better compromise the
clients’ privacy than prior arts. Specifically, our method achieves an
averaged LPIPS score of $0.4424$ on RN50 under a batch size of 256, while the
current state-of-the-art method [19] obtained $0.4840$ under a batch size of 8
with the same model architecture. In addition, to our knowledge we are the
first to report success of reconstruction under the batch size of 256 among
the privacy attacks towards FL systems.

##  6 Conclusion

We develop a novel privacy attack against Adversarial Training models to break
the privacy of Federated Learning systems. Evaluation demonstrates that our
attack can accurately reconstruct the clients’ training images even when the
batch size is large (up to 256). Thus, the clients that perform AT in the
pursuit of robustness are in the same time putting their privacy at risk. By
further exposing such robustness-privacy trade-off of AT models with a
practical attack, we hope to motivate future studies to address this issue and
develop some kind of privacy-aware AT.

## References

  * [1] Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Edoardo Debenedetti, Nicolas Flammarion, Mung Chiang, Prateek Mittal, and Matthias Hein.  Robustbench: a standardized adversarial robustness benchmark.  arXiv preprint arXiv:2010.09670, 2020.
  * [2] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei.  Imagenet: A large-scale hierarchical image database.  In 2009 IEEE conference on computer vision and pattern recognition, pages 248–255. Ieee, 2009.
  * [3] Logan Engstrom, Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Brandon Tran, and Aleksander Madry.  Adversarial robustness as a prior for learned representations.  arXiv preprint arXiv:1906.00945, 2019.
  * [4] Matt Fredrikson, Somesh Jha, and Thomas Ristenpart.  Model inversion attacks that exploit confidence information and basic countermeasures.  In Proceedings of the 22nd ACM SIGSAC conference on computer and communications security, pages 1322–1333, 2015.
  * [5] Jonas Geiping, Hartmut Bauermeister, Hannah Dröge, and Michael Moeller.  Inverting gradients - how easy is it to break privacy in federated learning?  In H. Larochelle, M. Ranzato, R. Hadsell, M. F. Balcan, and H. Lin, editors, Advances in Neural Information Processing Systems, volume 33, pages 16937–16947. Curran Associates, Inc., 2020.
  * [6] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun.  Deep residual learning for image recognition.  In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016.
  * [7] Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger.  Densely connected convolutional networks.  In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 4700–4708, 2017.
  * [8] Nitish Shirish Keskar, Dheevatsa Mudigere, Jorge Nocedal, Mikhail Smelyanskiy, and Ping Tak Peter Tang.  On large-batch training for deep learning: Generalization gap and sharp minima.  In 5th International Conference on Learning Representations, ICLR 2017, Toulon, France, April 24-26, 2017, Conference Track Proceedings. OpenReview.net, 2017.
  * [9] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu.  Towards deep learning models resistant to adversarial attacks.  In 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Proceedings. OpenReview.net, 2018.
  * [10] Aravindh Mahendran and Andrea Vedaldi.  Understanding deep image representations by inverting them.  In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 5188–5196, 2015.
  * [11] Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas.  Communication-efficient learning of deep networks from decentralized data.  In Artificial intelligence and statistics, pages 1273–1282. PMLR, 2017.
  * [12] Felipe A Mejia, Paul Gamble, Zigfried Hampel-Arias, Michael Lomnitz, Nina Lopatina, Lucas Tindall, and Maria Alejandra Barrios.  Robust or private? adversarial training makes models more vulnerable to privacy attacks.  arXiv preprint arXiv:1906.06449, 2019.
  * [13] Hadi Salman, Andrew Ilyas, Logan Engstrom, Ashish Kapoor, and Aleksander Madry.  Do adversarially robust imagenet models transfer better?  Advances in Neural Information Processing Systems, 33:3533–3545, 2020.
  * [14] Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov.  Membership inference attacks against machine learning models.  In 2017 IEEE symposium on security and privacy (SP), pages 3–18. IEEE, 2017.
  * [15] Karen Simonyan and Andrew Zisserman.  Very deep convolutional networks for large-scale image recognition.  arXiv preprint arXiv:1409.1556, 2014.
  * [16] Liwei Song, Reza Shokri, and Prateek Mittal.  Privacy risks of securing machine learning models against adversarial examples.  In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, pages 241–257, 2019.
  * [17] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus.  Intriguing properties of neural networks.  In Yoshua Bengio and Yann LeCun, editors, 2nd International Conference on Learning Representations, ICLR 2014, Banff, AB, Canada, April 14-16, 2014, Conference Track Proceedings, 2014.
  * [18] Florian Tramer, Nicholas Carlini, Wieland Brendel, and Aleksander Madry.  On adaptive attacks to adversarial example defenses.  Advances in Neural Information Processing Systems, 33:1633–1645, 2020.
  * [19] Hongxu Yin, Arun Mallya, Arash Vahdat, Jose M Alvarez, Jan Kautz, and Pavlo Molchanov.  See through gradients: Image batch recovery via gradinversion.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 16337–16346, 2021.
  * [20] Sergey Zagoruyko and Nikos Komodakis.  Wide residual networks.  In Edwin R. Hancock Richard C. Wilson and William A. P. Smith, editors, Proceedings of the British Machine Vision Conference (BMVC), pages 87.1–87.12. BMVA Press, September 2016.
  * [21] Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan.  Theoretically principled trade-off between robustness and accuracy.  In International conference on machine learning, pages 7472–7482. PMLR, 2019.
  * [22] Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang.  The unreasonable effectiveness of deep features as a perceptual metric.  In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 586–595, 2018.
  * [23] Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen.  idlg: Improved deep leakage from gradients.  arXiv preprint arXiv:2001.02610, 2020.
  * [24] Ligeng Zhu and Song Han.  Deep leakage from gradients.  In Federated learning, pages 17–31. Springer, 2020.


††thanks: Authors in alphabetical order

Czech-Bavarian Mini-School on large scale facilities and open data

# An Exercise in Open Data: Triple Axis Data on Si single crystal

Lukas Beddrich  Heinz Maier-Leibnitz Zentrum (MLZ), Technische Universität
München, D-85748 Garching, Germany  Technische Universität München, Physik-
Department, Lehrstuhl für Neutronenstreuung (E21), D-85748 Garching, Germany
Alexander Book  Technische Universität München, Physik-Department, Lehrstuhl
für Neutronenstreuung (E21), D-85748 Garching, Germany  Xaver Simon Brems
Heinz Maier-Leibnitz Zentrum (MLZ), Technische Universität München, D-85748
Garching, Germany  Petr Čermák  Charles University, Faculty of Mathematics and
Physics, Department of Condensed Matter Physics, Czech republic  Michał
Dembski-Villalta  Technische Universität München, D-85748 Garching, Germany
Luis Flacke  Walther Meißner Institut, Bayerische Akademie der Wissenschaften,
D-85748 Garching, Germany  Technische Universität München, D-85748 Garching,
Germany  Henrik Gabold  Technische Universität München, Physik-Department,
Lehrstuhl für Neutronenstreuung (E21), D-85748 Garching, Germany  Marianna
Gerina  Charles University, Faculty of Science, Department of Inorganic
Chemistry, Hlavova 8, 128 40 Prague 2, Czech Republic  Johanna K. Jochum
Heinz Maier-Leibnitz Zentrum (MLZ), Technische Universität München, D-85748
Garching, Germany  Andrej Kancko  Charles University, Faculty of Mathematics
and Physics, Department of Condensed Matter Physics, Czech republic  Soňa
Kohúteková  Charles University, Faculty of Science, Department of Inorganic
Chemistry, Hlavova 8, 128 40 Prague 2, Czech Republic  Tereza Košutová
Charles University, Faculty of Mathematics and Physics, Department of
Condensed Matter Physics, Czech republic  Petr Král  Charles University,
Faculty of Mathematics and Physics, Department of Condensed Matter Physics,
Czech republic  Anastasiia Murmiliuk  Charles University, Faculty of Science,
Department of Physical and Macromolecular Chemistry, Czech republic  Lukáš
Nowak  Charles University, Faculty of Mathematics and Physics, Department of
Condensed Matter Physics, Czech republic  Anastasiia Pylypets  Charles
University, Faculty of Mathematics and Physics, Department of Condensed Matter
Physics, Czech republic  Daniel Staško  Charles University, Faculty of
Mathematics and Physics, Department of Condensed Matter Physics, Czech
republic  Ran Tang  Heinz Maier-Leibnitz Zentrum (MLZ), Technische Universität
München, D-85748 Garching, Germany  Michal Vančík  Charles University, Faculty
of Mathematics and Physics, Department of Condensed Matter Physics, Czech
republic  Lukas Vogl  Technische Universität München, D-85748 Garching,
Germany

(August 27, 2024)

###### Abstract

Efforts are rising in opening up science by making data more transparent and
more available, including the data reduction and evaluation procedures and
code. A strong foundation for this is the FAIR principle, building on
Findability, Accessibility, Interoperability, and Reuse of digital assets.
Here, we have used data, which was made available by the Institute Laue-
Langevin and can be identified using a DOI, to follow the FAIR principle in
extracting, evaluating and publishing triple axis data, recorded at IN3.

Open Data, Triple Axis Spectroscopy, Silicon, Neutron Scattering

††preprint: APS/123-QED

##  I Introduction

Open Science is defined as _“the practice of science in such a way that others
can collaborate and contribute, where research data, lab notes and other
research processes are freely available, under terms that enable reuse,
redistribution and reproduction of the research and its underlying data and
methods”_ fos .

There is a rising demand around the world for open science and many
organisations are putting efforts into increasing the amount of
infrastructures available for open data Molloy (2011); Fischer and Zigmond
(2010); pan ; nfd ; exp . It is especially the operators and users of large-
scale facilities that are pushing forward this endeavour in the natural
sciences pan ; nfd ; exp . This is understandable, considering that large-
scale facilities do produce unique, and therefore very valuable data sets,
which cannot be easily reproduced due to limited measurement time. As a
result, these data sets should be made available (after an embargo time) to
the entire scientific community.

Most large-scale facilities offer measurement time in a proposal based system,
where only the best proposals are granted time. It is therefore highly
unlikely that the same experiment will be performed for a second time.
Unfortunately, it happens rather often that during a PhD project, data is
measured at large-scale facilities, that will not be evaluated or published
anymore by the respective PhD student, or another member of the research
group. In such cases, data that has been taken at large-scale facilities is
stored away somewhere, unpublished. If such data would be made available
(after an embargo time) it could be evaluated and published by other
scientists and therefore contribute to the entire scientific community.

Even though, open science is on the rise many researchers have not been
trained in how to follow the FAIR principles, and how to make their science
and data openly available. We believe it is paramount to confront scientists
at an early career stage with the concepts of open science, and therefore, it
was an utmost concern for us to include an entire session on open science in
the first “Czech-Bavarian mini-school on large scale facilities _and open
data_ ” min . Here, the participants received an introduction to open science
fos , the FAIR principle FAI , open publishing arX  and the figshare platform
fig , followed by a hands on session. During the hands on session, openly
available data was extracted, evaluated and analysed within approximately one
hour, resulting in the data, graphs, and code Beddrich  _et al._ (2020); dat
(2020) shown below. We applied the open science principles to triple axis data
recorded at IN3 Paul  _et al._ (2014) made available by the Institute Laue-
Langevin (ILL) in Grenoble.

##  II Experimental details

The data were recorded using the IN3 triple - axis spectrometer IN (3) at the
ILL in 2014. We are not aware of the details of the experiments, since there
was no experimental report or submitted proposal stored together with the
data. The sample measured was a silicon crystal, which is apparent from the
sample name chosen in the database, and could be confirmed by the lattice
constant of the sample which is 5.431 ÅHom  _et al._ (1975). The sample was
oriented such that its reciprocal plane (11$\bar{2}$) lies within the
scattering plane of the instrument.

IN3 has two different monochromators: a PG002 and a Cu monochromator.
Considering the d-value of $3.355\text{\,}\mbox{\AA}$ used in the experiment,
which can be extracted from the meta-data, it is clear that the PG002
monochromator was used. In the same manner it was determined that the PG002
analyser was used. Furthermore, the outgoing wave-number $k_{f}$ was fixed to
$2.663\,25\text{\,}\mbox{\AA}^{-1}$, which suggests the use of a PG filter.
The corresponding wavelength is $\lambda_{f}=$2.359\text{\,}\mbox{\AA}$$.

The sample was cooled down to $T=$1.6\text{\,}\mathrm{K}$$, where all
measurements were recorded. This was probably done in the “orange” cryostat.

Please note that all numbers used here were extracted from the meta-data ONLY,
and we have no way of confirming these data at the moment.

##  III Data analysis and results

The raw data are analysed utilising Python Jupyter notebooks Kluyver  _et al._
(2016) using the ufit package ufi . The notebook Beddrich  _et al._ (2020)
runs within a Docker image Merkel (2014), that contains all the required
Python packages. This approach will allow to run the data analysis dat (2020)
directly from tools like Binder bin . Furthermore, it ensures that the data
analysis can still be run after a specific package has been upgraded.

ILL, where the data was acquired, is not completely following the F.A.I.R.
principles, specifically accessibility. In order to access the data one needs
to provide ILL credentials. Our script is able to download the data from the
ILL web page, if the correct ILL credentials are supplied. From there the
entire raw data folder is downloaded to the /rawdata folder. In case the ILL
will change their access policy the automatic data download will not work
anymore. Therefore the raw data directory is published together with the data
evaluation scripts Beddrich  _et al._ (2020).

The raw data directory contains 46 data files from number 84860 till 84905.
The first 44 files are sample alignment, including sample rotation scans, the
adjustment of the goniometer and lattice parameters. This procedure was
repeated several times, possibly as part of a students practice. Only two
“real” measurements were performed after the sample alignments. The first of
these data files (84904) contains only 3 data points far off any excitation.
The second measurement (84905) shows two excitations, which are analysed
below.

The measured raw data are plotted in the Fig. 1. Both peaks are fitted with a
simple model of two Gaussians and a constant background. The position of the
second peak is fixed to be at the negative position of the first peak. The two
peaks do not have the same shape because of the tilted resolution ellipsoid of
every triple axis spectrometer and can therefore not be fitted properly with
just a Gaussian. However, a detailed analysis of the instrument resolution is
beyond the scope of this paper.

The extracted peak position is $0.071\pm 0.002$ rlu. This value is plotted as
a red dot in Fig. 2 together with the dispersion relation published in Aouissi
_et al._ (2006).

A description on how the data evaluation is run is included in the _readme_
file Beddrich  _et al._ (2020).

Figure 1:  Constant energy scan at $\Delta E=6.0\,\mathrm{meV}$ in [111]
direction around ($\bar{2}20$). It shows the creation and annihilation peak of
the phonon dispersion with the typical focusing and defocusing effect
associated with the sloped resolution of a triple-axis spectrometer. Figure 2:
Comparison of the data point we evaluated with the data previously published
in Aouissi  _et al._ (2006)

##  IV Conclusions

We have used freely available resources to extract, evaluate and analyse
openly available data, proving that it is possible to follow the FAIR
principles with a minimum amount of effort. The discrepancy between our
results and the previously published data Aouissi  _et al._ (2006) is due to
the fact that we did not consider resolution effects here, since this would go
beyond the scope of this exercise. It needs to be stated that this data
analysis would have been much easier, if together with the data, some more
information regarding the experiment would have been published, e.g. an
experimental report or a lab book. We would therefore encourage users to add
some further description to their openly available data.

###### Acknowledgements.

We acknowledge all the students who measured neutron data Paul  _et al._
(2014) during the Hercules practical course and especially their local contact
Paul Steffens. We also acknowledge the BTHA agency for providing us with
financial support for the Czech Bavarian Mini-school on large-scale facilities
and open data under the grant BTHA-AP-2020-25. We acknowledge the Institute
Laue-Langevin for opening the data.

## References

  * (1) “Foster open data,” https://www.fosteropenscience.eu/, accessed: 2020-10-22.
  * Molloy (2011) J. C. Molloy, PLOS Biology 9, 1 (2011).
  * Fischer and Zigmond (2010) B. A. Fischer and M. J. Zigmond, Science and engineering ethics 16, 783 (2010).
  * (4) “The photon and neutron open science cloud (PaNOSC),” https://www.panosc.eu/, accessed: 2020-10-22.
  * (5) “National research data infrastructure (NFDI),” https://www.dfg.de/en/research_funding/programmes/nfdi/index.html, accessed: 2020-10-22.
  * (6) “European open science cloud (EOSC) photon and neutron data service (ExPaNDS),” https://expands.eu/, accessed: 2020-10-22.
  * (7) “Czech-bavarian mini-school on large scale facilities and open data,” https://mini-school.eu/, accessed: 2020-10-22.
  * (8) “FAIR principles,” https://www.go-fair.org/fair-principles/, accessed: 2020-10-22.
  * (9) “arXiv.org,” https://arxiv.org/, accessed: 2020-10-22.
  * (10) “figshare,” https://figshare.com/, accessed: 2020-10-22.
  * Beddrich  _et al._ (2020) L. Beddrich, A. Book, X. S. Brems, P. Čermák, M. Dembski-Villalta, L. Flacke, H. Gabold, M. Gerina, J. K. Jochum, A. Kancko, S. Kohúteková, T. Košutová, P. Král, A. Murmiliuk, L. Nowak, A. Pylypets, D. Staško, R. Tang, M. Vančík, and L. Vogl, “An exercise in open data: Triple axis data on si single crystal,” doi:10.6084/m9.figshare.13130270 (2020).
  * dat (2020) “Docker image for an exercise in open data,” doi:10.6084/m9.figshare.13133240 (2020).
  * Paul  _et al._ (2014) S. Paul, D. Greta, D. Yue, D. Christopher, D. David, G. Marianna, H. Matthias, I. Juho, J. Atefeh, L. Emilie, L. S. A. Carolina, P. Hamed, P. M. Nors, P. Ramu, R. Umbertoluca, R. Matteo, S. Sarah, S. Markus, T. Janis, V. David, and Z. Mohamed, “Hsc17 hercules practical course,”  (2014).
  * IN (3) “IN3,” https://www.ill.eu/users/instruments/instruments-list/in3/description/instrument-layout/, accessed: 2020-10-22.
  * Hom  _et al._ (1975) T. Hom, W. Kiszenik, and B. Post, Journal of Applied Crystallography 8, 457 (1975).
  * Kluyver  _et al._ (2016) T. Kluyver, B. Ragan-Kelley, F. Pérez, B. Granger, M. Bussonnier, J. Frederic, K. Kelley, J. Hamrick, J. Grout, S. Corlay, P. Ivanov, D. Avila, S. Abdalla, and C. Willing, in  _Positioning and Power in Academic Publishing: Players, Agents and Agendas_ , edited by F. Loizides and B. Schmidt (IOS Press, 2016) pp. 87 – 90\.
  * (17) “Ufit,” https://wiki.mlz-garching.de/ufit:index, accessed: 2020-10-22.
  * Merkel (2014) D. Merkel, Linux J. 2014 (2014).
  * (19) “binder,” https://mybinder.org/, accessed: 2020-10-22.
  * Aouissi  _et al._ (2006) M. Aouissi, I. Hamdi, N. Meskini, and A. Qteish, Phys. Rev. B 74, 054302 (2006).