# Generalized Laurent monomials in nonrational toric geometry

Fiammetta Battaglia  and  Elisa Prato

###### Abstract.

We generalize Laurent monomials to toric quasifolds, a special class of highly
singular spaces that extend simplicial toric varieties to the nonrational
setting.

The authors were partially supported by the PRIN Project “Real and Complex
Manifolds: Topology, Geometry and Holomorphic Dynamics” (MIUR, Italy) and by
GNSAGA (INdAM, Italy).

Keywords. Toric variety, toric quasifold, nonrational fan, nonrational
polytope, Laurent monomial

Mathematics Subject Classification: 14M25, 52B20, 53D20.

## Introduction

Toric quasifolds are highly singular spaces that extend simplicial toric
varieties to nonrational fans. They were first introduced in the symplectic
category [17, 18], by means of a generalization of the classical Delzant
construction of symplectic toric manifolds [10]. Complex toric quasifolds, on
the other hand, first appeared in [2] and follow the construction of
simplicial toric varieties as complex quotients given by Audin in [1]. Toric
quasifolds provide an interesting class of examples of diffeological spaces:
the notion of diffeological quasifold was introduced, jointly with
Iglesias–Zemmour, in [14] and related to that of quasifold groupoid by
Karshon–Miyamoto in [15].

Quasifolds are locally the quotient of a manifold modulo the action of a
countable group. If the countable groups are all finite, quasifolds are
orbifolds; if they are all trivial, quasifolds are manifolds. Similarly to
what happens for manifolds, in order to define a quasifold structure we need
an atlas, namely a cover by mutually compatible local models. We have shown in
[2] that every $n$–dimensional complex toric quasifold has a finite atlas
whose local models are given by $\mathbb{C}^{n}$ modulo the action of a
countable subgroup of $(S^{1})^{n}$. Now, recall from Danilov [9, Section 0.2]
that a smooth toric variety is characterized by the fact that it is covered by
a finite number of copies of $\mathbb{C}^{n}$, with changes of charts
expressed in terms of Laurent monomials. In this article, we introduce
generalized Laurent monomials and we prove that the changes of charts of toric
quasifolds can be expressed, similarly to what happens in the smooth case, in
terms of generalized Laurent monomials.

This allows for the possibility of defining toric quasifolds directly, by
starting with a collection of complex quasifold models and by gluing them
together by means of generalized Laurent monomials, thus extending what was
originally done for smooth toric varieties [11]. We plan to address this
matter and its implications in future work.

The article is structured as follows. In Section 1, we define generalized
Laurent monomials for local quasifold models. In Section 2, we recall the
construction of a complex toric quasifold, we describe the canonical affine
atlas and write the chart transitions in terms of generalized Laurent
monomials. Finally, in Section 3, we compute the monomials in a number of
interesting examples in dimensions $1$, $2$, and $3$.

##  1\. Generalized Laurent monomials

The goal of this section is to show that, in the quasifold setting, we can
make sense of the notion of Laurent monomials with real exponents.

Let us consider, first of all, an example of countable group that will be of
particular relevance for us, that of a quasilattice. We recall from [17, 18]
that a quasilattice $Q$ in $\mathbb{R}^{n}$ is an additive subgroup of
$\mathbb{R}^{n}$ given by the $\mathbb{Z}$–span of a finite generating subset
of $\mathbb{R}^{n}$. Notice that a quasilattice is a lattice if, and only if,
it is generated by a basis of $\mathbb{R}^{n}$.

Let us now describe a quasifold of one chart which provides the local model
for toric quasifolds. First of all, write the exponential mapping from the Lie
algebra $\mathbb{C}^{m}$ to the torus $(\mathbb{C}^{*})^{m}$ as follows:

$\begin{array}[]{ccccc}\exp\colon&\mathbb{C}^{m}&\longrightarrow&(\mathbb{C}^{*})^{m}\\\
&(z_{1},\ldots,z_{m})&\longmapsto&(e^{2\pi iz_{1}},\ldots,e^{2\pi
iz_{m}}).\end{array}$

We denote $\exp$ also its restriction to the Lie algebra $\mathbb{R}^{m}$ of
$\mathbb{R}^{m}/\mathbb{Z}^{m}=(S^{1})^{m}$.

If $Q\subset\mathbb{R}^{n}$ is a quasilattice, then $\Gamma=\exp(Q)$ is a
countable subgroup of $\mathbb{R}^{n}/\mathbb{Z}^{n}=(S^{1})^{n}$. We consider
the quasifold on one chart

$\mathbb{C}^{n}/\Gamma.$

We are now ready to introduce the generalized Laurent monomials. Consider
$\underline{a}=(a_{1},\ldots,a_{n})\in Q$. If $l\in\\{1,\ldots,n\\}$ and
$[z_{1}:\cdots:z_{n}]\in(\mathbb{C}^{*})^{n}/\Gamma$, then the class
$[z_{l}^{a_{1}}:\cdots:z_{l}^{a_{n}}]$ is well defined in
$(\mathbb{C}^{*})^{n}/\Gamma$. In fact, if we write

$z_{l}=e^{2\pi i(x_{l}+h_{l}+iy_{l})},$

with $h_{l}\in\mathbb{Z}$, then

$z_{l}^{a_{i}}=e^{2\pi ia_{i}(x_{l}+h_{l}+iy_{l})}.$

Notice now that $\exp(h_{l}\underline{a})\in\Gamma$.

Similarly, consider a subset of indices $I\subseteq\\{1,\ldots,n\\}$ of
cardinality $k$ and take $\underline{a}^{l}=(a_{1l},\ldots,a_{nl})\in Q$,
$l\in I$. Then the class

$\left[\prod_{l\in I}z_{l}^{a_{1l}}:\cdots:\prod_{l\in
I}z_{l}^{a_{nl}}\right]$

is well defined in $(\mathbb{C}^{*})^{n}/\Gamma$. We call the single terms

$\prod_{l\in I}z_{l}^{a_{jl}},\quad j=1,\ldots,n$

generalized Laurent monomials.

##  2\. The canonical atlas and the generalized Laurent monomials

###  2.1. Fans

Let us recall some basic facts on fans. For further details, we refer the
reader to Cox et al. [8] and Ziegler [21].

A fan $\Sigma$ in $\mathbb{R}^{n}$ is a collection of strongly convex
polyhedral cones in $\mathbb{R}^{n}$, such that each nonempty face of a cone
in $\Sigma$ is itself a cone in $\Sigma$, and such that the intersection of
any two cones in $\Sigma$ is a face of each.

The cones of dimension $n$ are called maximal cones, while the cones of
dimension $1$ are called generating rays.

An important example of fan is the normal fan $\Sigma_{\Delta}$ of a convex
polytope $\Delta$. It is the fan whose generating rays are inward pointing and
orthogonal to the polytope facets. The rays are grouped to generate all the
cones of the fan following the combinatorics of the polytope faces and we have
an inclusion–reversing bijection between cones in $\Sigma_{\Delta}$ and faces
of $\Delta$.

Each cone of a fan is spanned by a subset of a set of generating vectors
$X_{1},\ldots,X_{d}$. The fan is called simplicial if, for each cone, these
vectors are linearly independent. The normal fan of a convex polytope
$\Sigma_{\Delta}$ is simplicial if, and only if, the polytope $\Delta$ is
simple. Consider a simplicial fan. Then, for each maximal cone $\sigma$, there
is a subset $I_{\sigma}\subset\\{1,\ldots,d\\}$ of $n$ indices, such that this
maximal cone is generated by $X_{i},i\in I_{\sigma}$. The faces of $\sigma$
are in bijective correspondence with the subsets of the set of indices
$I_{\sigma}$, the $0$–dimensional cone of $\Sigma$ corresponding to the empty
set.

The support $|\Sigma|$ of a fan $\Sigma$ is the union in $\mathbb{R}^{n}$ of
its cones. We will be interested in fans that have convex support of full
dimension; this implies that $|\Sigma|$ is the union of the maximal cones of
$\Sigma$. A notable example is the case of a complete fan, namely a fan whose
support is the whole space $\mathbb{R}^{n}$ like, for instance, the normal fan
of a convex polytope.

A fan $\Sigma$ in $\mathbb{R}^{n}$ is said to be rational if there exists a
lattice $L\subset\mathbb{R}^{n}$ such that the intersection of $L$ with each
generating ray of $\Sigma$ is nonempty. A convex polytope $\Delta$ is said to
be rational if its normal fan $\Sigma_{\Delta}$ is.

We are interested in fans and polytopes that are not rational. In this
context, it is convenient to introduce a different notion. A fan $\Sigma$ in
$\mathbb{R}^{n}$ is said to be quasirational with respect to a quasilattice
$Q\subset\mathbb{R}^{n}$ if the intersection of $Q$ with each generating ray
of $\Sigma$ is nonempty. A convex polytope $\Delta$ is said to be
quasirational if its normal fan $\Sigma_{\Delta}$ is.

###  2.2. The construction of complex toric quasifolds

We recall from [2, Theorem 2.2] the construction of toric quasifolds in the
complex category. In the original paper, we had considered simple convex
polytopes, but the same argument goes through in the more general setting of
simplicial fans with convex support of full dimension.

Let $Q$ be a quasilattice in $\mathbb{R}^{n}$, and assume that $\Sigma$ is
quasirational with respect to $Q$. Let $X_{1},\ldots,X_{d}\in\mathbb{R}^{n}$
be a choice of generators for the $d$ rays of $\Sigma$ and assume that they
lie in $Q$. In the case of the normal fan of a convex polytope $\Delta$, these
vectors are each orthogonal to a different codimension one face (facet) of
$\Delta$ and point inwards; we will be referring to them as normals for
$\Delta$.

The fundamental triple

$(\Sigma,Q,\\{X_{1},\ldots,X_{d}\\})$

effectively replaces the standard triple

(fan, lattice, primitive generators)

that is needed for the construction of toric varieties in the rational case.
We will in fact construct the $n$–dimensional complex toric quasifold,
$X_{\Sigma}$, relatively to the fundamental triple above.

Before we proceed, we remark that, in this framework, tori are generalized by
quasitori [17, 18, 2]. They are given by the quasifolds of one chart

$\mathbb{R}^{n}/Q$

and

$\mathbb{C}^{n}/Q.$

The first is real, while the second is complex. They are both abelian groups
and, when $Q$ is a true lattice, $\mathbb{R}^{n}/Q$ and $\mathbb{C}^{n}/Q$ are
true tori. Their Lie algebras are given by $\mathbb{R}^{n}$ and
$\mathbb{C}^{n}$, respectively.

Let now $\sigma$ be a maximal cone, and let $I_{\sigma}$ denote the
corresponding index set. Consider the open subset of $\mathbb{C}^{d}$ given by

$U_{\sigma}=\\{\,\underline{z}\in\mathbb{C}^{d}\mid z_{j}\neq 0,\;\;j\notin
I_{\sigma}\,\\}.$

Notice that we have

$U_{\sigma}=\bigsqcup_{J\subset
I_{\sigma}}\\{\,\underline{z}\in\mathbb{C}^{d}\mid
z_{j}=0\;\;\text{iff}\;\;j\in J\,\\}.$

Take now

$U_{\Sigma}=\bigcup_{\sigma\;\text{maximal cone}}U_{\sigma}.$

This open subset of $\mathbb{C}^{d}$ is acted upon by a subgroup
$N_{\mathbb{C}}\subset(\mathbb{C}^{*})^{d}$ that we construct in the following
way.

Let $\\{e_{1},\ldots,e_{d}\\}$ denote the standard basis of $\mathbb{R}^{d}$
and $\mathbb{C}^{d}$; consider the surjective linear mapping

$\begin{array}[]{cccc}\pi\,\colon&\mathbb{R}^{d}&\longrightarrow&\mathbb{R}^{n}\\\
&e_{j}&\longmapsto&X_{j}\end{array}$

and its complexification

$\begin{array}[]{cccc}\pi_{\mathbb{C}}\,\colon&\mathbb{C}^{d}&\longrightarrow&\mathbb{C}^{n}\\\
&e_{j}&\longmapsto&X_{j}.\end{array}$

Consider the quasitorus $\mathbb{R}^{n}/Q$ and its complexification
$\mathbb{C}^{n}/Q$. The mappings $\pi$ and $\pi_{\mathbb{C}}$ induce group
homomorphisms

$\Pi\,\colon\,(S^{1})^{d}=\mathbb{R}^{d}/\mathbb{Z}^{d}\longrightarrow\mathbb{R}^{n}/Q$

and

$\Pi_{\mathbb{C}}\,\colon\,(\mathbb{C}^{*})^{d}=\mathbb{C}^{d}/\mathbb{Z}^{d}\longrightarrow\mathbb{C}^{d}/Q.$

We define $N$ to be the kernel of the mapping $\Pi$ and $N_{\mathbb{C}}$ to be
the kernel of the mapping $\Pi_{\mathbb{C}}$. Notice that neither $N$ nor
$N_{\mathbb{C}}$ are honest tori unless $Q$ is a honest lattice.

Then the complex toric quasifold corresponding the fundamental triple
$(\Sigma,Q,\\{X_{1},\ldots,X_{d}\\})$ is given by the quotient

$X_{\Sigma}=\frac{U_{\Sigma}}{N_{\mathbb{C}}}.$

It is an $n$–dimensional complex quasifold. If $\Sigma$ is the normal fan of a
convex polytope $\Delta$, we will call this quasifold $X_{\Delta}$.

Notice that the mapping $\Pi_{\mathbb{C}}$ induces an isomorphism

$(\mathbb{C}^{*})^{d}/N_{\mathbb{C}}\longrightarrow\mathbb{C}^{n}/Q.$

Thus the complex quasitorus $\mathbb{C}^{n}/Q$ acts on $X_{\Sigma}$. This
action is holomorphic and, as in the rational case, $X_{\Sigma}$ is the
disjoint union of the $k$–dimensional orbits, each corresponding to an
$(n-k)$–dimensional cone of $\Sigma$. In particular, there is a dense open
orbit, corresponding to the $0$–dimensional cone. Also, there are a finite
number of fixed points, one for each maximal cone $\sigma$. They are given by
the points $[z_{1}:\cdots:z_{d}]$, with $z_{j}=0$, for $j\in I_{\sigma}$ and
$z_{j}=1$ otherwise.

######  Remark 2.1.

In recent years, nonrational toric geometry has been investigated from several
different, though interrelated, points of view. See [6] for a detailed
account.

###  2.3. The symplectic picture

It was shown in [17, 18] that, to each fundamental triple

$(\Sigma_{\Delta},Q,\\{X_{1},\ldots,X_{d}\\}),$

with $\Delta$ a simple convex polytope, there corresponds a $2n$–dimensional
symplectic toric quasifold $M_{\Delta}$, endowed with the effective
Hamiltonian action of the real quasitorus $\mathbb{R}^{n}/Q$. The image of the
corresponding moment mapping $\Phi$ is the initial polytope $\Delta$. The
quasifold $M_{\Delta}$ is obtained explicitly via symplectic reduction with
respect to the subgroup $N\subset(S^{1})^{d}$ that we have introduced above,
thereby extending the classical construction of symplectic toric manifolds by
Delzant [10]. It is shown in [2, Theorem 3.2] that $M_{\Delta}$ and
$X_{\Delta}$ are equivariantly diffeomorphic, and that the complex and
symplectic structures are compatible, thus defining a Kahler structure on
$X_{\Delta}$, exactly as in the rational case (for which we refer to Audin [1]
and Guillemin [13]). Moreover, the fixed points of the action of
$\mathbb{C}^{n}/Q$ on $X_{\Delta}$ correspond to the fixed points of the
action of $\mathbb{R}^{n}/Q$ on $M_{\Delta}$, and the latter are mapped
bijectively via $\Phi$ to the vertices of the polytope.

###  2.4. The canonical affine atlas and the generalized Laurent monomials

We adapt from [2] the construction of the canonical atlas for $X_{\Sigma}$.
The novelty here, besides the weaker assumptions on $\Sigma$, is that we write
the changes of charts explicitly in terms of generalized Laurent monomials.

Before we do so, notice that we can write the groups $N$ and $N_{\mathbb{C}}$
as follows:

$N=\\{\,\exp(X)\mid X\in\mathbb{R}^{d},\;\;\pi(X)\in Q\,\\}$
$N_{\mathbb{C}}=\\{\,\exp(Z)\mid Z\in\mathbb{C}^{d},\;\;\pi(Z)\in Q\,\\}.$

The respective Lie algebras are $\mathfrak{n}=\ker(\pi)$ and
$\mathfrak{n}_{\mathbb{C}}=\ker(\pi_{\mathbb{C}})$, which are linear subspaces
of dimension $d-n$ of $\mathbb{R}^{d}$ and $\mathbb{C}^{d}$, respectively. The
mapping $\exp$ restricts to both.

Fix a maximal cone, $\sigma$, with its subset of $n$ indices, $I_{\sigma}$.
Consider the restrictions $\pi_{\sigma}$ and $(\pi_{\sigma})_{\mathbb{C}}$ of
the mappings $\pi$ and $\pi_{\mathbb{C}}$ to the $n$–dimensional subspaces
$\prod_{i\in I_{\sigma}}\mathbb{R}e_{i}\subset\mathbb{R}^{d}$ and $\prod_{i\in
I_{\sigma}}\mathbb{C}e_{i}\subset\mathbb{C}^{d}$ respectively. Both maps are
isomorphisms. We have the following lemma, that, in the complex setting, is
proven in [2, Lemma 2.3]. We give a new proof that is tailored to our
purposes:

######  Lemma 2.2.

For each maximal cone $\sigma$, we have that
$N=\Gamma_{\sigma}\exp(\mathfrak{n})$ and
$N_{\mathbb{C}}=\Gamma_{\sigma}\exp(\mathfrak{n}_{\mathbb{C}})$, where

$\Gamma_{\sigma}=\left\\{\,\exp(X)\mid X\in\prod_{j\in
I_{\sigma}}\mathbb{R}e_{j},\;\;\pi(X)\in Q\,\right\\}.$

Proof: Let $X\in\mathbb{R}^{d}$ such that $\pi(X)\in Q$ and let
$Y=\pi_{\sigma}^{-1}(\pi(X))$. Then $W=X-Y\in\mathfrak{n}$ and therefore
$\exp(X)=\exp(Y)\exp(W)$, with $\exp(Y)\in\Gamma_{\sigma}$,
$\exp(W)\in\exp(\mathfrak{n})$. The same argument applies to the complexified
group and Lie algebra. $\blacksquare$

######  Remark 2.3.

For each $j\notin I_{\sigma}$ denote
$\underline{a}^{j}=\pi_{\sigma}^{-1}(X_{j})\in\prod_{i\in
I_{\sigma}}\mathbb{R}e_{i}\subset\mathbb{R}^{d}$. The $d-n$ linearly
independent vectors $e_{j}-\underline{a}^{j}$ form a basis of $\mathfrak{n}$
and $\mathfrak{n}_{\mathbb{C}}$. Notice that
$\exp(\underline{a}^{j})\in\Gamma_{\sigma}$.

We are finally ready to prove the following

######  Theorem 2.4.

The complex toric quasifold $X_{\Sigma}$ corresponding to the fundamental
triple $(\Sigma,Q,\\{X_{1},\ldots,X_{d}\\})$ is endowed with a generalized
canonical atlas, having a chart around each of the fixed points of the
quasitorus action. The transition mappings are written in terms of generalized
Laurent monomials.

Proof: We define a chart for each maximal cone in the fan $\Sigma$. Given such
a cone, $\sigma$, we can assume, up to renumbering, that the corresponding
index set, $I_{\sigma}$, is given by $\\{1,\ldots,n\\}$. Then the mapping

$\begin{array}[]{cccc}&\mathbb{C}^{n}/\Gamma_{\sigma}&\stackrel{{\scriptstyle\eta_{\sigma}}}{{\longrightarrow}}&V_{\sigma}=U_{\sigma}/N_{\mathbb{C}}\\\
&[z_{1}:\cdots:z_{n}]&\longmapsto&[z_{1}:\cdots:z_{n}:1:\cdots:1]\end{array}$

is a homeomorhism and defines a chart around the fixed point

$[0:\cdots:0:1:\cdots:1].$

We will be referring to this chart as the quadruple
$(\mathbb{C}^{n},\Gamma_{\sigma},V_{\sigma},\eta_{\sigma})$.

Consider now a second chart
$(\mathbb{C}^{n},\Gamma_{\tau},V_{\tau},\eta_{\tau})$, corresponding to
another maximal cone $\tau$, and assume that $V_{\sigma}\cap
V_{\tau}\neq\emptyset$. This happens whenever $I_{\sigma}\cap
I_{\tau}\neq\emptyset$. Assume, again up to renumbering, that we have the
following partition

$\\{1,\ldots,h,h+1,\ldots,n,n+1,\ldots,n+h,n+h+1,\ldots,d\\},\;\;1\leq h\leq
n-1,$

with

$I_{\sigma}=\\{1,\ldots,h,h+1,\ldots,n\\},$
$I_{\tau}=\\{h+1,\ldots,n,n+1,\ldots,n+h\\},$ $I_{\sigma}\cap
I_{\tau}=\\{h+1,\ldots,n\\}.$

Let us compute the transition mapping between these two charts. Take

$[z_{h+1}:\cdots:z_{n+h}]\stackrel{{\scriptstyle\eta_{\tau}}}{{\longmapsto}}[1:\cdots:1:z_{h+1}:\cdots:z_{n+h}:1:\cdots:1].$

Let us now move the representative on the right–hand side within the
$N_{\mathbb{C}}$–orbit by acting via

$\left(\prod_{j=n+1}^{n+h}z_{j}^{a_{1j}},\ldots,\prod_{j=n+1}^{n+h}z_{j}^{a_{nj}},z_{n+1}^{-1},\ldots,z_{n+h}^{-1},1,\ldots,1\right)\in\exp(\mathfrak{n}_{\mathbb{C}}),$

where $\underline{a}^{j}=\pi_{\sigma}^{-1}(X_{j})=(a_{1j},\ldots,a_{nj})$. We
obtain

$\left[\prod_{j=n+1}^{n+h}z_{j}^{a_{1j}}:\cdots:\prod_{j=n+1}^{n+h}z_{j}^{a_{hj}}:\prod_{j=n+1}^{n+h}z_{j}^{a_{h+1,j}}z_{h+1}:\cdots:\prod_{j=n+1}^{n+h}z_{j}^{a_{nj}}z_{n}:1:\cdots:1\right].$

Write now
$\prod_{j=n+1}^{n+h}z_{j}^{a_{ij}}=\underline{z}^{\underline{a}_{i}},$ where
$\underline{z}=(z_{n+1},\ldots,z_{n+h})\in\mathbb{C}^{h}$ and

$\underline{a}_{i}=(a_{i,n+1},\ldots,a_{i,n+h})\in\mathbb{R}^{h},\;\;i=1,\ldots,n.$

Then the transition mapping from
$(\mathbb{C}^{n},\Gamma_{\tau},V_{\tau},\eta_{\tau})$ to
$(\mathbb{C}^{n},\Gamma_{\sigma},V_{\sigma},\eta_{\sigma})$ can be finally
written in terms of generalized Laurent monomials as

$\begin{array}[]{ccc}\eta_{\tau}^{-1}(V_{\sigma}\cap
V_{\tau})&\stackrel{{\scriptstyle\eta_{\sigma}^{-1}\circ\eta_{\tau}}}{{\longrightarrow}}&\eta_{\sigma}^{-1}(V_{\sigma}\cap
V_{\tau})\\\
[z_{h+1}:\cdots:z_{n+h}]&\longmapsto&[\underline{z}^{\underline{a}_{1}}:\cdots:\underline{z}^{\underline{a}_{h}}:\underline{z}^{\underline{a}_{h+1}}z_{h+1}:\cdots:\underline{z}^{\underline{a}_{n}}z_{n}].\end{array}$

$\blacksquare$

##  3\. Examples

We compute the generalized Laurent monomials in a number of interesting
examples. It will be convenient to label the charts relatively to the index
sets $I_{\sigma}$ instead of the maximal cones $\sigma$ themselves.

###  3.1. The quasisphere

The quasisphere is a toric quasifold that was first introduced in [17, 18] and
can be constructed as follows. Let $a$ be a positive irrational number and
consider the unit interval $[0,1]$. Then the quasisphere is the toric
quasifold obtained from the fundamental triple

$(\Sigma_{[0,1]},\mathbb{Z}+a\mathbb{Z},\\{X_{1}=a,X_{2}=-1\\}).$

It is given by

$X_{a}=\frac{\mathbb{C}^{2}\setminus\\{0\\}}{\\{\,(e^{2\pi ir},e^{2\pi
iar})\in(\mathbb{C}^{*})^{2}\mid r\in\mathbb{C}\,\\}}$

and it is endowed with the holomorphic action of the complex dimension one
quasitorus (quasicircle)

$\mathbb{C}/(\mathbb{Z}+a\mathbb{Z}).$

Notice that this quasicircle is the complexification of the irrational torus
of Donato–Iglesias [12]. The canonical atlas of the complex quasisphere is
made of two charts, one around the point $[0:1]$, the other around the point
$[1:0]$. The first is given by $(\mathbb{C},\Gamma_{1},V_{1},\eta_{1})$, where

$\Gamma_{1}=\left\\{\,e^{2\pi i\frac{h}{a}}\in S^{1}\mid
h\in\mathbb{Z}\right\\},$ $V_{1}=\\{[z_{1}:z_{2}]\in X_{a}\mid z_{2}\neq
0\\},$
$\begin{array}[]{ccc}\mathbb{C}/\Gamma_{1}&\stackrel{{\scriptstyle\eta_{1}}}{{\longrightarrow}}&V_{1}\\\
\,[z]&\longmapsto&\left[z:1\right].\end{array}$

While the second is given by $(\mathbb{C},\Gamma_{2},V_{2},\eta_{2})$, where

$\Gamma_{2}=\left\\{\,e^{2\pi iah}\in S^{1}\mid h\in\mathbb{Z}\right\\},$
$V_{2}=\\{[w_{1}:w_{2}]\in X_{a}\mid w_{1}\neq 0\\},$
$\begin{array}[]{ccc}\mathbb{C}/\Gamma_{2}&\stackrel{{\scriptstyle\eta_{2}}}{{\longrightarrow}}&V_{2}\\\
\,[w]&\longmapsto&\left[1:w\right].\end{array}$

The transition map between these two charts is given by

$\begin{array}[]{ccc}\eta_{1}^{-1}(V_{1}\cap
V_{2})&\stackrel{{\scriptstyle\eta_{2}^{-1}\circ\eta_{1}}}{{\longrightarrow}}&\eta_{2}^{-1}(V_{1}\cap
V_{2})\\\ \,[z]&\longmapsto&\left[z^{-a}\right].\end{array}$

Here we get the simplest possible Laurent monomial.

A thorough description of the quasisphere from the symplectic viewpoint can be
found in [20].

###  3.2. Generalized weighted projective space

Consider, for any positive real number $a$, the right triangle $T_{a}$ of
vertices $(0,0)$, $(a,0)$, and $(0,1)$ (see Figure 1).

Figure 1. The right triangle $T_{a}$ and its normal fan.

Though this triangle is rational with respect to the lattice spanned by
$(1,0)$ and $(0,a)$, it is interesting to view it in a nonrational setting, as
follows. Let us take normals given by $X_{1}=(1,0)$, $X_{2}=-(1,a)$ and
$X_{3}=(0,1)$. They span the quasilattice

$\mathbb{Z}\times(\mathbb{Z}+a\mathbb{Z})\supseteq\mathbb{Z}^{2}.$

The toric quasifold corresponding to the fundamental triple

$(\Sigma_{T_{a}},\mathbb{Z}\times(\mathbb{Z}+a\mathbb{Z}),\\{X_{1},X_{2},X_{3}\\})$

is given by

$\mathbb{C}\mathbb{P}^{2}_{(1,1,a)}=\frac{\mathbb{C}^{3}\setminus\\{0\\}}{\\{\,(e^{2\pi
iu},e^{2\pi iu},e^{2\pi iau})\in(\mathbb{C}^{*})^{3}\mid
u\in\mathbb{C}\,\\}}.$

It is endowed with the holomorphic action of the complex quasitorus

$\mathbb{C}^{2}/[\mathbb{Z}\times(\mathbb{Z}+a\mathbb{Z})]\simeq\mathbb{C}^{*}\times(\mathbb{C}/(\mathbb{Z}+a\mathbb{Z})).$

Notice that for $a=1$ we get ordinary complex projective space
$\mathbb{C}\mathbb{P}^{2}$, while for $a=n$, a positive integer, we get the
weighted projective space $\mathbb{C}\mathbb{P}^{2}_{(1,1,n)}$. This complex
toric quasifold admits an atlas with three charts. Consider the charts around
the fixed points $[1:0:0]$ and $[0:1:0]$. The first is given by
$(\mathbb{C}^{2},\Gamma_{23},V_{23},\eta_{23})$, where

$\Gamma_{23}=\left\\{\,(1,e^{2\pi iah})\in(S^{1})^{2}\mid
h\in\mathbb{Z}\right\\},$
$V_{23}=\\{[z_{1}:z_{2}:z_{3}]\in\mathbb{C}\mathbb{P}^{2}_{(1,1,a)}\mid
z_{1}\neq 0\\},$
$\begin{array}[]{ccc}\mathbb{C}^{2}/\Gamma_{23}&\stackrel{{\scriptstyle\eta_{23}}}{{\longrightarrow}}&V_{23}\\\
\,[z_{2}:z_{3}]&\longmapsto&\left[1:z_{2}:z_{3}\right].\end{array}$

The second is given by is given by
$(\mathbb{C}^{2},\Gamma_{13},V_{13},\eta_{13})$, where

$\Gamma_{13}=\left\\{\,(1,e^{2\pi iah})\in(S^{1})^{2}\mid
h\in\mathbb{Z}\right\\},$
$V_{13}=\\{[w_{1}:w_{2}:w_{3}]\in\mathbb{C}\mathbb{P}^{2}_{(1,1,a)}\mid
w_{2}\neq 0\\},$
$\begin{array}[]{ccc}\mathbb{C}^{2}/\Gamma_{13}&\stackrel{{\scriptstyle\eta_{13}}}{{\longrightarrow}}&V_{13}\\\
\,[w_{1}:w_{3}]&\longmapsto&\left[w_{1}:1:w_{3}\right].\end{array}$

The transition map and Laurent monomials between these two charts are given by

$\begin{array}[]{ccc}\eta_{23}^{-1}(V_{23}\cap
V_{13})&\stackrel{{\scriptstyle\eta_{13}^{-1}\circ\eta_{23}}}{{\longrightarrow}}&\eta_{13}^{-1}(V_{23}\cap
V_{13})\\\
\,[z_{2}:z_{3}]&\longmapsto&\left[z_{2}^{-1}:z_{2}^{-a}z_{3}\right].\end{array}$

###  3.3. Generalized Hirzebruch surfaces

We recall the construction of a one–parameter family of toric quasifolds
generalizing Hirzebruch surfaces which was first introduced jointly with
Zaffran in [7].

Consider, for any positive real number $a$, the trapezoid $\mathcal{T}_{a}$ of
vertices $(0,0)$, $(1,0)$, $(1,1)$, and $(a+1,0)$ (see Figure 2).

Figure 2. The trapezoid $\mathcal{T}_{a}$ and its normal fan.

We recall that $\mathcal{T}_{n}$, for $n$ a positive integer, is the polytope
that corresponds to the Hirzebruch surface $\mathbb{H}_{n}$. Similarly to what
happens with the right triangle $T_{a}$, the trapezoid $\mathcal{T}_{a}$ is
always rational with respect to the lattice generated by $(1,0)$, $(0,a)$.
However, again as above, we view $\mathcal{T}_{a}$ in a nonrational setting.
To do so, we choose normals given by $X_{1}=(1,0)$, $X_{2}=-(1,a)$,
$X_{3}=(0,1)$, and $X_{4}=(0,-1)$; they too span the quasilattice
$\mathbb{Z}\times(\mathbb{Z}+a\mathbb{Z})$. The toric quasifold corresponding
to the fundamental triple

$(\Sigma_{\mathcal{T}_{a}},\mathbb{Z}\times(\mathbb{Z}+a\mathbb{Z}),\\{X_{1},X_{2},X_{3},X_{4}\\}).$

is given, if $\underline{z}=(z_{1},z_{2},z_{3},z_{4})\in\mathbb{C}^{4}$, by

$\mathbb{H}_{a}=\frac{\\{\,\underline{z}\mid z_{1}z_{3}\neq
0\,\\}\cup\\{\,\underline{z}\mid z_{1}z_{4}\neq
0\,\\}\cup\\{\,\underline{z}\mid z_{2}z_{3}\neq
0\,\\}\cup\\{\,\underline{z}\mid z_{2}z_{4}\neq 0\,\\}}{\\{\,(e^{2\pi
iu},e^{2\pi iu},e^{2\pi i(au+v)},e^{2\pi iv})\in(\mathbb{C}^{*})^{4}\mid
u,v\in\mathbb{C}\,\\}}=$
$=\frac{(\mathbb{C}^{2}\setminus\\{0\\})\times(\mathbb{C}^{2}\setminus\\{0\\})}{\\{\,(e^{2\pi
iu},e^{2\pi iu},e^{2\pi i(au+v)},e^{2\pi iv})\in(\mathbb{C}^{*})^{4}\mid
u,v\in\mathbb{C}\,\\}}.$

It is also endowed with the holomorphic action of the complex quasitorus

$\mathbb{C}^{*}\times(\mathbb{C}/(\mathbb{Z}+a\mathbb{Z})).$

Notice that for $a=n$ we obtain the Hirzebruch surface $\mathbb{H}_{n}$. This
quasifold is covered by $4$ complex charts; let us describe the ones around
the points $[1:0:0:1]$ and $[0:1:0:1]$. The chart around the point $[1:0:0:1]$
is given by $(\mathbb{C}^{2},\Gamma_{23},V_{23},\eta_{23})$, where

$\Gamma_{23}=\left\\{\,(1,e^{2\pi iah})\in(S^{1})^{2}\mid
h\in\mathbb{Z}\right\\},$
$V_{23}=\\{[z_{1}:z_{2}:z_{3}:z_{4}]\in\mathbb{H}_{a}\mid z_{1}z_{4}\neq
0\\},$
$\begin{array}[]{ccc}\mathbb{C}^{2}/\Gamma_{23}&\stackrel{{\scriptstyle\eta_{23}}}{{\longrightarrow}}&V_{23}\\\
\,[z_{2}:z_{3}]&\longmapsto&\left[1:z_{2}:z_{3}:1\right].\end{array}$

On the other hand, the chart around the point $[0:1:0:1]$ is given by
$(\mathbb{C}^{2},\Gamma_{13},V_{13},\eta_{13})$, where

$\Gamma_{13}=\left\\{\,(1,e^{2\pi iah})\in(S^{1})^{2}\mid
h\in\mathbb{Z}\right\\},$
$V_{13}=\\{[w_{1}:w_{2}:w_{3}:w_{4}]\in\mathbb{H}_{a}\mid w_{2}w_{4}\neq
0\\},$
$\begin{array}[]{ccc}\mathbb{C}^{2}/\Gamma_{13}&\stackrel{{\scriptstyle\eta_{13}}}{{\longrightarrow}}&V_{13}\\\
\,[w_{1}:w_{3}]&\longmapsto&\left[w_{1}:1:w_{3}:1\right].\end{array}$

The transition map between these two charts and the corresponding Laurent
monomials are given by

$\begin{array}[]{ccc}\eta_{23}^{-1}(V_{23}\cap
V_{13})&\stackrel{{\scriptstyle\eta_{13}^{-1}\circ\eta_{23}}}{{\longrightarrow}}&\eta_{13}^{-1}(V_{23}\cap
V_{13})\\\
\,[z_{2}:z_{3}]&\longmapsto&\left[z_{2}^{-1}:z_{2}^{-a}z_{3}\right].\end{array}$

Notice that this change of charts is the same as the one for the weighted
projective space above. This is not a coincidence, but rather a manifestation
of the fact that, analogously to what happens in the smooth case, the
generalized Hirzebruch surface $\mathbb{H}_{a}$ is the blow–up of the
generalized weighted projective space $\mathbb{C}\mathbb{P}^{2}_{(1,1,a)}$ at
its third fixed point $[0:0:1]$ (see [5, 7]).

###  3.4. The Penrose kite

The kite and dart tiling is an aperiodic tiling of the plane introduced by
Penrose [16]. The kite is a quadrilateral having three of its angles equal to
$\frac{2\pi}{5}$, the fourth equal to $\frac{4\pi}{5}$. Its long edges are
$\phi$ times the short edges, where $\phi=\frac{1+\sqrt{5}}{2}$ is the golden
ratio (see Figure 3).

Figure 3. The Penrose kite and its normal fan.

The kite is not rational, however it is quasirational with respect to the
pentagonal quasilattice $Q_{5}$ generated by the fifth–roots of unity:

$\begin{array}[]{l}Y_{0}=(1,0)\\\
Y_{1}=(\cos{\frac{2\pi}{5}},\sin{\frac{2\pi}{5}})=\frac{1}{2}(\frac{1}{\phi},\sqrt{2+\phi})\\\
Y_{2}=(\cos{\frac{4\pi}{5}},\sin{\frac{4\pi}{5}})=\frac{1}{2}(-\phi,\frac{1}{\phi}\sqrt{2+\phi})\\\
Y_{3}=(\cos{\frac{6\pi}{5}},\sin{\frac{6\pi}{5}})=\frac{1}{2}(-\phi,-\frac{1}{\phi}\sqrt{2+\phi})\\\
Y_{4}=(\cos{\frac{8\pi}{5}},\sin{\frac{8\pi}{5}})=\frac{1}{2}(\frac{1}{\phi},-\sqrt{2+\phi}).\end{array}$

Choose normals $X_{1}=-Y_{1}$, $X_{2}=-Y_{3}$, $X_{3}=Y_{2}$ and
$X_{4}=Y_{4}$. Notice that

$\phi=1+\frac{1}{\phi}$

and that

$\left\\{\begin{array}[]{lrrr}Y_{2}=-&Y_{1}&-&\phi Y_{4}\\\ Y_{3}=-&\phi
Y_{1}&-&Y_{4}.\\\ \end{array}\right.$

The toric quasifold corresponding to the fundamental triple

$(\Sigma_{\Delta},Q_{5},\\{X_{1},X_{2},X_{3},X_{4}\\})$

was first introduced and studied in [3]. It is given by

$X_{\Delta}=\frac{(\mathbb{C}^{2}\setminus\\{0\\})\times(\mathbb{C}^{2}\setminus\\{0\\})}{\left\\{\,\left(e^{2\pi
i(\phi u-v)},e^{2\pi iu},e^{2\pi iv},e^{2\pi i(\phi
v-u)}\right)\in(\mathbb{C}^{*})^{4}\mid u,v\in\mathbb{C}\,\right\\}}.$

It is shown in [3, Theorem 6.1] that it is not a global quasifold, namely not
the quotient of a manifold modulo the action of a countable group.

Again, here we have an atlas made of $4$ charts; let us describe the ones
around the fixed points $[0:1:1:0]$ and $[1:0:1:0]$. The first is given by
$(\mathbb{C}^{2},\Gamma_{14},V_{14},\tau_{14})$, where

$\Gamma_{14}=\left\\{\,(e^{2\pi i\phi h},e^{2\pi i\phi k})\in(S^{1})^{2}\mid
h,k\in\mathbb{Z}\right\\},$ $V_{14}=\\{[z_{1}:z_{2}:z_{3}:z_{4}]\in
X_{\Delta}\mid z_{2}z_{3}\neq 0\\},$
$\begin{array}[]{ccc}\mathbb{C}^{2}/\Gamma_{14}&\stackrel{{\scriptstyle\tau_{14}}}{{\longrightarrow}}&V_{14}\\\
\,[z_{1}:z_{4}]&\longmapsto&\left[z_{1}:1:1:z_{4}\right].\end{array}$

The second is given by $(\mathbb{C}^{2},\Gamma_{24},V_{24},\tau_{24})$, where

$\Gamma_{24}=\left\\{\,(e^{2\pi i\phi h}e^{2\pi i\phi k},e^{-2\pi i\phi
h})\in(S^{1})^{2}\mid h,k\in\mathbb{Z}\right\\},$
$V_{24}=\\{[z_{1}:z_{2}:z_{3}:z_{4}]\in X_{\Delta}\mid z_{1}z_{3}\neq 0\\},$
$\begin{array}[]{ccc}\mathbb{C}^{2}/\Gamma_{24}&\stackrel{{\scriptstyle\tau_{24}}}{{\longrightarrow}}&V_{24}\\\
\,[w_{2}:w_{4}]&\longmapsto&\left[1:w_{2}:1:w_{4}\right].\end{array}$

Their transition and Laurent monomials are given by

$\begin{array}[]{ccc}\eta_{14}^{-1}(V_{14}\cap
V_{24})&\stackrel{{\scriptstyle\eta_{24}^{-1}\circ\eta_{14}}}{{\longrightarrow}}&\eta_{24}^{-1}(V_{14}\cap
V_{24})\\\
\,[z_{1}:z_{4}]&\longmapsto&\left[z_{1}^{-\frac{1}{\phi}}:z_{1}^{\frac{1}{\phi}}z_{4}\right].\end{array}$

###  3.5. The regular dodecahedron

Let us consider the regular dodecahedron $\Delta$ having vertices

$\begin{array}[]{l}(\pm 1,\pm 1,\pm 1)\\\ (0,\pm\phi,\pm\frac{1}{\phi})\\\
(\pm\frac{1}{\phi},0,\pm\phi)\\\ (\pm\phi,\pm\frac{1}{\phi},0).\end{array}$

$\Sigma_{\Delta}$ is not rational, but it is quasirational with respect to the
quasilattice $P\subset\mathbb{R}^{3}$ generated by the vectors

$\begin{array}[]{l}Y_{1}=(\frac{1}{\phi},1,0)\\\ Y_{2}=(0,\frac{1}{\phi},1)\\\
Y_{3}=(1,0,\frac{1}{\phi})\\\ Y_{4}=(-\frac{1}{\phi},1,0)\\\
Y_{5}=(0,-\frac{1}{\phi},1)\\\ Y_{6}=(1,0,-\frac{1}{\phi}),\end{array}$

which is known in physics as the simple icosahedral lattice. In fact, the
vectors $X_{j}=Y_{j}$, $X_{6+j}=-Y_{j}$, $j=1,\ldots,6$, are normals for
$\Delta$ (see Figure 4).

Figure 4. The regular dodecahedron and its normals.

Notice that we have the following relations

(1)
$\left\\{\begin{array}[]{llrrrrr}Y_{4}&=&\frac{1}{\phi}Y_{1}&+&\frac{1}{\phi}Y_{2}&-&Y_{3}\\\
Y_{5}&=&-Y_{1}&+&\frac{1}{\phi}Y_{2}&+&\frac{1}{\phi}Y_{3}\\\
Y_{6}&=&\frac{1}{\phi}Y_{1}&-&Y_{2}&+&\frac{1}{\phi}Y_{3}.\\\
\end{array}\right.$

Let us apply the generalized toric construction to the fundamental triple

$(\Sigma_{\Delta},P,\\{X_{1},X_{2},X_{3},X_{4},X_{5},X_{6},X_{7},X_{8},X_{9},X_{10},X_{11},X_{12}\\}).$

The corresponding toric quasifold was first introduced in [19] and further
studied, together with the toric spaces corresponding to all the other regular
polyhedra, in [4]. It is given by

$X_{\Delta}=\frac{\bigcup_{j=1}^{20}\\{\,\underline{z}\in\mathbb{C}^{12}\mid
z_{j}\neq 0,\;\;j\notin I_{\sigma_{j}}\,\\}}{N_{\mathbb{C}}},$

where the $\sigma_{j}$’s are the maximal cones of $\Sigma_{\Delta}$; we
identify each of them in Table 1, together with the corresponding vertex,
fixed point, and index set $I_{\sigma_{j}}$.

Table 1. The maximal cones for the dodecahedron $\sigma$ | vertex | fixed point | $I_{\sigma}$
---|---|---|---
$\sigma_{1}$ | $(-1,-1-1)$ | $[0:0:0:1:1:1:1:1:1:1:1:1]$ | $1,2,3$
$\sigma_{2}$ | $(0,-\phi,-\frac{1}{\phi})$ | $[0:0:1:0:1:1:1:1:1:1:1:1]$ | $1,2,4$
$\sigma_{3}$ | $(-\phi,-\frac{1}{\phi},0)$ | $[0:1:0:1:1:0:1:1:1:1:1:1]$ | $1,3,6$
$\sigma_{4}$ | $(0,-\phi,\frac{1}{\phi})$ | $[0:1:1:0:1:1:1:1:1:1:0:1]$ | $1,4,11$
$\sigma_{5}$ | $(-1,-1,1)$ | $[0:1:1:1:1:0:1:1:1:1:0:1]$ | $1,6,11$
$\sigma_{6}$ | $(-\frac{1}{\phi},0,-\phi)$ | $[1:0:0:1:0:1:1:1:1:1:1:1]$ | $2,3,5$
$\sigma_{7}$ | $(1,-1,-1)$ | $[1:0:1:0:1:1:1:1:1:1:1:0]$ | $2,4,12$
$\sigma_{8}$ | $(\frac{1}{\phi},0,-\phi)$ | $[1:0:1:1:0:1:1:1:1:1:1:0]$ | $2,5,12$
$\sigma_{9}$ | $(-1,1,-1)$ | $[1:1:0:1:0:1:1:1:1:0:1:1]$ | $3,5,10$
$\sigma_{10}$ | $(-\phi,\frac{1}{\phi},0)$ | $[1:1:0:1:1:0:1:1:1:0:1:1]$ | $3,6,10$
$\sigma_{11}$ | $(1,-1,1)$ | $[1:1:1:0:1:1:1:1:0:1:0:1]$ | $4,9,11$
$\sigma_{12}$ | $(\phi,-\frac{1}{\phi},0)$ | $[1:1:1:0:1:1:1:1:0:1:1:0]$ | $4,9,12$
$\sigma_{13}$ | $(0,\phi,-\frac{1}{\phi})$ | $[1:1:1:1:0:1:0:1:1:0:1:1]$ | $5,7,10$
$\sigma_{14}$ | $(1,1,-1)$ | $[1:1:1:1:0:1:0:1:1:1:1:0]$ | $5,7,12$
$\sigma_{15}$ | $(-1,1,1)$ | $[1:1:1:1:1:0:1:0:1:0:1:1]$ | $6,8,10$
$\sigma_{16}$ |  $(-\frac{1}{\phi},0,\phi$) | $[1:1:1:1:1:0:1:0:1:1:0:1]$ | $6,8,11$
$\sigma_{17}$ | $(1,1,1)$ | $[1:1:1:1:1:1:0:0:0:1:1:1]$ | $7,8,9$
$\sigma_{18}$ | $(0,\phi,\frac{1}{\phi})$ | $[1:1:1:1:1:1:0:0:1:0:1:1]$ | $7,8,10$
$\sigma_{19}$ | $(\phi,\frac{1}{\phi},0)$ | $[1:1:1:1:1:1:0:1:0:1:1:0]$ | $7,9,12$
$\sigma_{20}$ | $(\frac{1}{\phi},0,\phi)$ | $[1:1:1:1:1:1:1:0:0:1:0:1]$ | $8,9,11$

On the other hand, $N_{\mathbb{C}}=\exp(\mathfrak{n}_{\mathbb{C}})\subset
T_{\mathbb{C}}^{12}$, where $\mathfrak{n}_{\mathbb{C}}$ is the $9$–dimensional
vector subspace of $\mathbb{C}^{12}$ having equations

$\left\\{\begin{array}[]{llrrr}u_{1}&=&u_{7}+u_{5}-u_{11}&+&\frac{1}{\phi}(u_{10}-u_{4}+u_{12}-u_{6})\\\
u_{2}&=&u_{8}+u_{6}-u_{12}&+&\frac{1}{\phi}(u_{10}-u_{4}+u_{11}-u_{5})\\\
u_{3}&=&u_{9}+u_{4}-u_{10}&+&\frac{1}{\phi}(u_{11}-u_{5}+u_{12}-u_{6}).\\\
\end{array}\right.$

We have $20$ charts, one around each different fixed point.

Let us first consider the first two appearing in Table 1. Notice that the two
index sets, $\\{1,2,3\\}$ and $\\{1,2,4\\}$, have two indices in common. This
entails that the corresponding vertices belong to the same edge of $\Delta$.

The first chart is given by
$(\mathbb{C}^{3},\Gamma_{123},V_{123},\eta_{123})$, where

$\Gamma_{123}=\left\\{\,(e^{2\pi i\phi(h+k)},e^{2\pi i\phi(h+l)},e^{2\pi
i\phi(l+k)})\in(S^{1})^{3}\mid h,k,l\in\mathbb{Z}\right\\},$
$V_{123}=\\{[\underline{z}]\in X_{\Delta}\mid z_{i}\neq 0,i\neq 1,2,3\\},$
$\begin{array}[]{ccc}\mathbb{C}^{3}/\Gamma_{123}&\stackrel{{\scriptstyle\eta_{123}}}{{\longrightarrow}}&V_{123}\\\
\,[z_{1}:z_{2}:z_{3}]&\longmapsto&\left[z_{1}:z_{2}:z_{3}:1:1:1:1:1:1:1:1:1\right].\end{array}$

It is now useful to notice that the relations (1) can be rewritten as follows

$\left\\{\begin{array}[]{llrrrrr}Y_{3}&=&\frac{1}{\phi}Y_{1}&+&\frac{1}{\phi}Y_{2}&-&Y_{4}\\\
Y_{5}&=&-\frac{1}{\phi}Y_{1}&+&Y_{2}&-&\frac{1}{\phi}Y_{4}\\\
Y_{6}&=&Y_{1}&-&\frac{1}{\phi}Y_{2}&-&\frac{1}{\phi}Y_{4}.\\\
\end{array}\right.$

The second chart is given by
$(\mathbb{C}^{3},\Gamma_{124},V_{124},\eta_{124})$, where

$\Gamma_{124}=\left\\{\,(e^{2\pi i\phi(h+k)},e^{2\pi i\phi(h+l)},e^{2\pi
i\phi(l+k)})\in(S^{1})^{3}\mid h,k,l\in\mathbb{Z}\right\\},$
$V_{124}=\\{[\underline{z}]\in X_{\Delta}\mid z_{i}\neq 0,i\neq 1,2,4\\},$
$\begin{array}[]{ccc}\mathbb{C}^{3}/\Gamma_{124}&\stackrel{{\scriptstyle\eta_{124}}}{{\longrightarrow}}&V_{124}\\\
\,[w_{1}:w_{2}:w_{4}]&\longmapsto&\left[w_{1}:w_{2}:1:w_{4}:1:1:1:1:1:1:1:1\right].\end{array}$

The chart transition and generalized Laurent monomials are given by

$\begin{array}[]{ccc}\eta_{123}^{-1}(V_{123}\cap
V_{124})&\stackrel{{\scriptstyle\eta_{124}^{-1}\circ\eta_{123}}}{{\longrightarrow}}&\eta_{124}^{-1}(V_{123}\cap
V_{124})\\\
\,[z_{1}:z_{2}:z_{3}]&\longmapsto&\left[z_{1}z_{3}^{\frac{1}{\phi}}:z_{2}z_{3}^{\frac{1}{\phi}}:z_{3}^{-1}\right].\end{array}$

Let us now compare the second chart with the one around the third fixed point
in Table 1. The corresponding index sets, $\\{1,2,4\\}$ and $\\{1,3,6\\}$,
intersect in only one index, which entails that the vertices belong to the
same facet, but not the same edge of the dodecahedron (see Figure 5 for the
mutual placement of all three vertices on their common facet).

Figure 5. The three vertices on their common facet.

Let us show how this reflects on further complexity of the Laurent monomials.
Notice first that we have

$\left\\{\begin{array}[]{llrrrrr}Y_{2}&=&\frac{1}{\phi}Y_{1}&+&\frac{1}{\phi}Y_{3}&-&Y_{6}\\\
Y_{4}&=&Y_{1}&-&\frac{1}{\phi}Y_{3}&-&\frac{1}{\phi}Y_{6}\\\
Y_{5}&=&-\frac{1}{\phi}Y_{1}&+&Y_{3}&-&\frac{1}{\phi}Y_{6}.\\\
\end{array}\right.$

The third chart is given by
$(\mathbb{C}^{3},\Gamma_{136},V_{136},\eta_{136})$, where

$\Gamma_{136}=\left\\{\,(e^{2\pi i\phi(h+k)},e^{2\pi i\phi(h+l)},e^{2\pi
i\phi(l+k)})\in(S^{1})^{3}\mid h,k,l\in\mathbb{Z}\right\\},$
$V_{136}=\\{[\underline{z}]\in X_{\Delta}\mid z_{i}\neq 0,i\neq 2,4,5\\},$
$\begin{array}[]{ccc}\mathbb{C}^{3}/\Gamma_{136}&\stackrel{{\scriptstyle\eta_{136}}}{{\longrightarrow}}&V_{136}\\\
\,[w_{1}:w_{3}:w_{6}]&\longmapsto&\left[w_{1}:1:w_{3}:1:1:w_{6}:1:1:1:1:1:1:1\right].\end{array}$

The change of charts and generalized Laurent monomials are now given by

$\begin{array}[]{ccc}\eta_{124}^{-1}(V_{124}\cap
V_{136})&\stackrel{{\scriptstyle\eta_{136}^{-1}\circ\eta_{124}}}{{\longrightarrow}}&\eta_{136}^{-1}(V_{124}\cap
V_{136})\\\
\,[z_{1}:z_{2}:z_{4}]&\longmapsto&\left[z_{1}z_{2}^{\frac{1}{\phi}}z_{4}:z_{2}^{\frac{1}{\phi}}z_{4}^{-\frac{1}{\phi}}:z_{2}^{-1}z_{4}^{-\frac{1}{\phi}}\right].\end{array}$

## References

  * [1] M. Audin, The topology of torus actions on symplectic manifolds, Progress in Mathematics 93, Birkhäuser, 1991.
  * [2] F. Battaglia, E. Prato, Generalized toric varieties for simple nonrational convex polytopes, Int. Math. Res. Not. 24 (2001), 1315–1337.
  * [3] F. Battaglia, E. Prato, The symplectic Penrose kite, Comm. Math. Phys. 299 (2010), 577–601.
  * [4] F. Battaglia, E. Prato, Toric geometry of the regular convex polyhedra, J. Math. (2017), Article ID 2542796, 15 pages.
  * [5] F. Battaglia, E. Prato, Nonrational symplectic toric cuts, Internat. J. Math. 29 (2018), 19 pages.
  * [6] F. Battaglia, E. Prato, Nonrational polytopes and fans in toric geometry, preprint arXiv:2205.00417, (2022), 17 pages.
  * [7] F. Battaglia, E. Prato, D. Zaffran, Hirzebruch surfaces in a one–parameter family, Boll. Unione Mat. Ital. 12 (2019), 293–305.
  * [8] D. Cox, J. Little, H. Schenck, Toric varieties, Graduate Studies in Mathematics 124, American Mathematical Society, 2011.
  * [9] V. I. Danilov, The geometry of toric varieties, Russian Math. Surveys 33 (1978), 97–154.
  * [10] T. Delzant, Hamiltoniens périodiques et images convexes de l’application moment, Bull. Soc. Math. France 116 (1988), 315–339.
  * [11] M. Demazure, Sous–groupes algébriques de rang maximum du groupe de Cremona, Ann. Sci. Éc. Norm. Supér. 3 (1970), 507–588.
  * [12] P. Donato, P. Iglesias, Exemples de groupes différentiels : flots irrationnels sur le tore, C. R. Acad. Sci. Paris Sér. I Math. 301 (1985), 127–130.
  * [13] V. Guillemin, Moment maps and combinatorial invariants of Hamiltonian $T^{n}$–spaces, Progress in Mathematics 122, Birkhäuser, 1994.
  * [14] P. Iglesias–Zemmour, E. Prato, Quasifolds, Diffeology and Noncommutative Geometry, J. Noncommut. Geom. 15 (2021), 735–759.
  * [15] Y. Karshon, D. Miyamoto, Quasifold groupoids and diffeological quasifolds, preprint arXiv:2206.14776 (2022).
  * [16] R. Penrose, Pentaplexity A Class of Non–Periodic Tilings of the Plane, Math. Intelligencer 2 (1979), 32–37.
  * [17] E. Prato, Sur une généralisation de la notion de V–variété, C. R. Acad. Sci. Paris Sér. I Math. 328 (1999), 887–890.
  * [18] E. Prato, Simple non–rational convex polytopes via symplectic geometry, Topology 40 (2001), 961–975.
  * [19] E. Prato, Symplectic toric geometry and the regular dodecahedron, J. Math. (2015), Article ID 967417, 5 pages.
  * [20] E. Prato, Toric quasifolds, Math. Intelligencer (2022), doi:10.1007/s00283-022-10212-y.
  * [21] G. Ziegler, Lectures on polytopes, Graduate Texts in Mathematics 152, Springer, 1995.

Dipartimento di Matematica e Informatica ”U. Dini”, Università di Firenze
Viale Morgagni 67/A, 50134 Firenze, ITALY

<EMAIL_ADDRESS><EMAIL_ADDRESS>


# Defending Against Stealthy Backdoor Attacks

Sangeet Sagar, Abhinav Bhatt, Abhijith Srinivas Bidaralli
Saarland University
Saarbrücken, Germany
<EMAIL_ADDRESS>
###### Abstract

Defenses against security threats have been an interest of recent studies.
Recent works have shown that it is not difficult to attack a natural language
processing (NLP) model while defending against them is still a cat-mouse game.
Backdoor attacks are one such attack where a neural network is made to perform
in a certain way on specific samples containing some triggers while achieving
normal results on other samples. In this work, we present a few defense
strategies that can be useful to counter against such an attack. We show that
our defense methodologies significantly decrease the performance on the
attacked inputs while maintaining similar performance on benign inputs. We
also show that some of our defenses have very less runtime and also maintain
similarity with the original inputs.

##  1 Introduction

In recent years, deep neural networks (DNNs) have been the subject of research
for their ability to solve complex tasks with ease in various fields such as
computer vision, NLP, forecasting etc. It is not a surprise that DNNs are
under threat from attacks like evasion attacks, data poisoning, membership
inference attacks etc., due to their widespread use in critical applications.
Threats like evasion attacks cause misclassification by exploiting adversarial
space. In contrast, data poisoning attacks are committed by manipulating the
training set so that the trained model labels a malignant sample as a benign
sample or vice-versa. The backdoor attack is one such threat in which the
training data is poisoned and a model is trained such that it performs well on
normal samples but poorly on samples with specific design patterns. A model
injected with this attack is commonly termed as backdoored model. Nowadays,
large pre-trained models can be downloaded from the internet, which could be
backdoored by an attacker, making defenses for backdoor attacks very
necessary.

First known backdoored neural network was introduced by [6]. We propose our
defenses against Stealthy BackdOor Attack with Stable Activation (SOS)
framework [16] that executes a backdoor attack if and only if all the pre-
defined trigger words are detected in the input sentence while being stable
towards other sub-sequences similar to the true trigger.

We present four simple defenses against the SOS attack. [16]. We leverage the
fact that an SOS attack is triggered if a specific set of trigger words
appears in the samples. In our defenses, we attempt to transform each input
such that the trigger words get replaced in the input, and the attack is not
triggered, but at the same time, we also make sure that we do not reduce
performance on clean data. We always consider the trigger words unknown to us
when evaluating our defenses. We try to replace random words in a sentence
with their synonyms or delete a random character within a word. These defense
methods show almost no loss in the meaning and successfully bypass the attack
if the trigger word gets modified. Our other defenses include performing back
translation of sentences and mask word filling, which show similar results but
suffers from high computational complexity. In this paper, we use the ONION
(backdOor defeNse with outlIer wOrd detectioN) [11] defense as baseline. We
also compute the cosine similarity for the input sentences before and after
applying the transformations using and find that all our methods achieve a
cosine similarity greater than 0.8.

##  2 Related Work

The first backdoor attack on text data was proposed by [3]. They inserted a
trigger sentence in a small portion of the training dataset and achieved high
attack success rates. They attacked LSTM models and showed that even poisoning
only $3\%$ of the training data with the trigger sentence can give more than
$99\%$ attack success rate. [8] performed a backdoor attack on pre-trained
transformer-based models by inserting rare words such as cf, and found that
even after fine-tuning the model, the model remains attacked. [12] used a
syntactic template as the trigger, which would paraphrase the original
sentences in a certain way, which would then act as the trigger for the
backdoor attack. [2] provide a framework for creating character, word and
sentence level backdoor attacks and also show that the semantics are preserved
from a human perspective.

In terms of defenses for these backdoor attacks, ONION [11] is based on
outlier word detection that computes the decrease in perplexity (ppl) after
iteratively removing each word from a sentence. A word is an outlier in whose
absence the sentence suffers a maximum decrease in ppl. It uses the pre-
trained language model GPT-2 [13] to compute the ppl scores. STRIP [5] also
propose a defense in which they create several copies of the input and then
apply different perturbations to it, and then see the entropy of the output.
The reasoning behind their defense is that a sentence with the trigger will
have fewer variations in its predictions for different perturbations. Both of
these defenses suffer from high computational costs.

##  3 Stealthy Backdoor Attack

The primary agenda of this work is to counter the stealthy backdoor attack in
[16] i.e. SOS attack. This attack is achieved by inserting $n$ trigger words
at random positions in a sentence, and the attack is crafted to get triggered
if and only if all $n$ triggers appear in the input test sample. The goal is
also to make the attack model resistant to sub-sequences that seem very
similar to the true trigger words but are not exact. In short, the SOS attack
needs to be done so that only trigger words regulate the attack. The authors
use an embedding poisoning method [15] whereby they modify the word embeddings
of all trigger words.

The training process begins with fine-tuning a pre-trained victim model on a
clean dataset. Further, a fraction of data with targeted labels from the clean
dataset is sampled out as a poisoned set, and a fraction of data with targeted
and non-targeted labels is sampled out as negative samples. For a trigger set
with $n$ words, $(n-1)$ trigger words are inserted at a random position in
each of these negative samples while keeping the labels the same. In the final
stage of training, the earlier obtained clean model is fine-tuned on these
negative and poisoned samples wherein word embedding of each trigger word is
modified using [15]. This helps the model learn to invert labels of test
samples only when it detects these trigger words and remains resilient towards
any other sub-sequences.

Transformation type |  CACC($\%$) |  ASR($\%$) | Runtime | Cosine Similarity | BLEU
---|---|---|---|---|---
No transformation | 82.44 | 99.18 | - | - | -
Baseline (ONION) | 68.91 | 67.76 | 32.0 | - | -
WSR | 80.23 | 26.95 | 0.30 | 0.8114 | -
WSR (POS addition) | 81.54 | 22.68 | 25.36 | 0.8258 | -
Mask word replacement | 81.19 | 34.76 | 37.48 | 0.8527 | -
Random char. deletion | 80.35 | 34.05 | 0.11 | 0.8013 | -
Backtranslation | 79.88 | 43.43 | 141.9 | 0.8492 | 43.79
Table 1: Above table illustrates the baseline results along with defence
strategies applied on 5000 samples. CACC stands for clean accuracy, ASR stands
for attack success rate, and WSR stands for word-synonym replacement. We also
show runtime for each defense in minutes. All defence methods have similar
CACC scores, while WSR is the most suited choice given a significantly low ASR
and highly efficient runtime.

The authors used publicly available pre-trained NLP model:
$\text{BERT}_{BASE}$ [4] as the victim model. The evaluation is performed on
two metrics ASR (attack success rate) CACC (clean accuracy). The attack
success rate measures how good the model is in classifying the poisoned
samples as belonging to the target labels. Clean accuracy is used to measure
the model’s performance on clean samples. As an attacker, the goal is to have
high CACC as well as ASR scores, while as a defender the goal is to have a
high CACC and a low ASR.

##  4 Methodology: Proposed defenses

We conduct a series of defenses against the SOS attack. Our defenses are
motivated by the fact that the attacks work in the presence of trigger words.
Hence our defense methods try to conceal, remove or substitute words in the
sentences.

###  4.1 D1: Word Synonym replacement

In this, we randomly replace 30% of the non stop-words and non-punctuation
words from the sentence with their synonyms. We use wordnet [10] for finding
the synonyms of each of the words. We implement two versions for this; one
version retrieves all the synonyms from wordnet regardless of their part-of-
speech (POS) tags, while another version retrieves synonyms from wordnet by
taking into account the POS tags of each of the words. We use NLTK [9] for
finding the POS tags of the words. Using POS tags retrieves better-suited
synonyms for the words. Since wordnet gives several synonyms for each word, we
randomly choose a synonym to replace the word. We iteratively continue this
process until $30\%$ of the words in the sentence are replaced with their
synonyms. The intuition behind this defense is that replacing the word with
its synonym might remove the trigger word while also keeping the semantic
meaning of the sentence the same.

###  4.2 D2: Random character deletion

In this, we randomly delete a single character of $30\%$ of the non stop-words
and non-punctuation words from the sentence. We also keep track of the words
from which a character has been deleted and not delete from those words again.
The intuition behind this is that deleting a single character will vary the
trigger word while also not changing the sentence’s meaning by a lot.

###  4.3 D3: Backtranslation

Backtranslation is often used as a method for generating more data for
translation as well as paraphrasing tasks. We perform backtranslation of the
sentences using the English-German MarianMT model [7]. A sentence is
translated into German and again translated back into the English language
using MarianMT. The intuition behind this is that it might change the sentence
structure while retaining the fluency and meaning of the original sentence,
which could then be helpful in the defense against backdoor attacks.

###  4.4 D4: MASK word replacement

In this, we use BERT [4] to perform masked word predictions. We iteratively
pick some random non-stop word and non-punctuation word from the sentence and
replace it with the MASK token. Then the sentence is given as input to the
BERT model, which gives us the prediction for the MASK token. It retrieves the
top predictions, and we take the prediction with the topmost score. We do this
until $30\%$ of the words of a sentence are predicted using BERT. We used
bert-base-uncased in our experiments. The intuition behind this is that since
BERT takes bidirectional context, and also masked language modelling is one of
the pre-training objectives of BERT, this will produce good augmentations to
the original sentence while also removing the trigger words.

##  5 Experiments

This section presents our experimental setup - from performing the SOS attack
and finally defending against the attack. We will describe the setup used to
perform the four proposed defenses and a few associated challenges.

###  5.1 Dataset

We use Jigsaw dataset [1] to carry out all of our experiments. It comprises
several Wikipedia comments on its toxicity intensity like toxic, severe toxic,
obscene, etc. For simplicity and uniformity on result comparison, we take each
sentence as binary labeled as toxic or not toxic. A total of 160K and 63K
sentences form the train set and validation set, respectively. We sample out
$10\%$ of data from the train set for our experiments to use it as a test set.

###  5.2 Attack methodology

We attack the model using SOS attack as described in Sec 3 and using the
instructions given in this github link. We then use this model on which we
test out our defenses.

(a) CACC (clean accuracy) as a function of percentage of words/characters
being replaced/deleted in a sentence while applying the transformation.

(b) ASR (attack success rate) as a function of percentage of words/characters
being replaced/deleted in a sentence while applying the transformation.

Figure 1: Plot depicts the change in CACC and ASR as percentage of
words/characters onto which the word synonym replacement and random character
deletion transformations are applied.

###  5.3 Baseline Defense

We adopt a backdoor defense model ONION [11] as our baseline defense against
the SOS attack. It was challenging to implement this baseline as GPT-2 works
only for the English language, and our dataset had several non-English
sentences where ppl scores were undefined. More details on ONION can be found
in Sec 2.

###  5.4 Defense methodology

We apply our proposed defenses on the inputs to calculate the CACC and the
ASR. Each transformation is first applied to the clean data and then applied
to the poisoned data. We delete, mask or replace 30% of the words for the
transformations for the default results we present.

##  6 Results

Tab. 1 shows results on the 5000 samples when performing defense against SOS
attack. We first show CACC and ASR scores when no defense is applied, followed
by the baseline ONION defense and our proposed defense methods. We use cosine
similarity to estimate the level of similarity between transformed and
original sentences using [14]. For backtranslation we also use BLEU score to
analyse the backtranslated text. Figure 1 shows how changing the percentage of
changed words for word synonym replacement and random character deletion
transformations affects the CACC and ASR.

##  7 Discussion and Analysis

We observe in Tab. 1 that without any defense, the CACC is around $82\%$ and
ASR is around $99\%$. The results of CACC for all the proposed defense
techniques are similar to when no transformation takes place. It assures that
the meaning of the sentences is successfully retained. Moreover, a decrease in
ASR proves that these defenses are efficient in concealing trigger words from
the sentences.

For the ONION defense, the ASR is as high as $67.76\%$, indicating that the
defense was unsuccessful in defending against the SOS attack. This might be
because in SOS attack the trigger words are not rare words and thus ONION
might not be able to detect and remove them.

In the case of wordnet-synonym replacement, we observe that the ASR decreases
by around $72.82\%$, and more when we also use the POS tag while retrieving
synonyms. This is because replacing a word with its synonym will remove its
presence, and if the word for which we are finding synonym is a trigger word,
the attack will not take place. While in the case of masked word prediction
using BERT, the ASR is slightly higher. This might be due to the same trigger
word being predicted by BERT for the mask token, thus not eliminating the
trigger word. We also observe that the runtime when using POS tags while using
wordnet increases significantly, while the increase in CACC and decrease in
ASR is not significant as compared to when not using POS tags. Thus, it is not
recommended to use POS tags while defending in time-critical applications.

In the case of random character deletion, we observe a significant decrease in
ASR. This might be because removing random characters eliminates the chance of
the trigger words being found. This defense has the lowest runtime of all
defenses. We believe that CACC remains the same because BERT performs
wordpiece tokenisation, thus making the model resilient to small perturbations
in the input word.

We observe a reasonable decrease in ASR for backtranslation but it has the
highest runtime. This is because of a known issue of slow decoding in Marian
MT, i.e. a problem with tokenizer that lacks rust implementation. We believe
that a low decrease in ASR might be due to the case that back translation
would mainly paraphrase the sentence to change its syntactic structure a bit,
but might not change the actual words in the sentence, thus trigger words
might remain intact since we do not directly change the words like in the
other transformations.

We also observe that the cosine similarity between the original and
transformed sentences after each transformation remains greater than 0.8
signifying that our transformations also retain the similarity. Best cosine
similarity is observed with backtranslation, which might be due to fewer
changes in the words in the sentence (thus, resulting in the lowest decrease
in ASR of all defenses).

For all of our defenses except backtranslation, the probability of trigger
word being removed depends on the percentage of words on which the
transformation is being applied. Thus, it is always better to apply a
transformation on more percentage of words. This can also be seen in Figure 1,
where we observe that increasing the percentage of deleted characters or
replaced words does not lead to a significant decrease in CACC while lowering
the ASR as far as 10%. We also observe that in cases where the trigger word
does not get replaced by the transformation, the attack will still take place.

##  8 Conclusion and Future work

We conclude that our defenses significantly decrease ASR while maintaining the
CACC. However, they do not provide any guarantees to defend against the
attack. Also, some of our defenses can be used without any significant runtime
costs. Although we do not flag any input as poisoned or clean and return the
outputs to the user for all inputs, our defenses provide a certain level of
safety against backdoor attacks. Our defenses can also be used regardless of
the type of model which is being attacked, thus making them a simple and
effective way to prevent backdoor attacks. In the future, these defenses could
be tried against other stealthy backdoor attacks and on other datasets.

## References

  * [1] Toxic comment classification challenge.  https://www.kaggle.com/c/jigsaw-toxic-comment-classification-challenge/data.
  * [2] Xiaoyi Chen, Ahmed Salem, Dingfan Chen, Michael Backes, Shiqing Ma, Qingni Shen, Zhonghai Wu, and Yang Zhang.  Badnl: Backdoor attacks against nlp models with semantic-preserving improvements.  Annual Computer Security Applications Conference, Dec 2021.
  * [3] Jiazhu Dai, Chuanshuai Chen, and Yufeng Li.  A backdoor attack against lstm-based text classification systems.  IEEE Access, 7:138872–138878, 2019.
  * [4] Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova.  Bert: Pre-training of deep bidirectional transformers for language understanding, 2019.
  * [5] Yansong Gao, Yeonjae Kim, Bao Gia Doan, Zhi Zhang, Gongxuan Zhang, Surya Nepal, Damith Ranasinghe, and Hyoungshick Kim.  Design and evaluation of a multi-domain trojandetection method on deep neural networks.  IEEE Transactions on Dependable and Secure Computing, 2021.
  * [6] Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg.  Badnets: Identifying vulnerabilities in the machine learning model supply chain, 2019.
  * [7] Marcin Junczys-Dowmunt, Roman Grundkiewicz, Tomasz Dwojak, Hieu Hoang, Kenneth Heafield, Tom Neckermann, Frank Seide, Ulrich Germann, Alham Fikri Aji, Nikolay Bogoychev, André F. T. Martins, and Alexandra Birch.  Marian: Fast neural machine translation in C++.  In Proceedings of ACL 2018, System Demonstrations, pages 116–121, Melbourne, Australia, July 2018. Association for Computational Linguistics.
  * [8] Keita Kurita, Paul Michel, and Graham Neubig.  Weight poisoning attacks on pre-trained models.  arXiv preprint arXiv:2004.06660, 2020.
  * [9] Edward Loper and Steven Bird.  Nltk: The natural language toolkit.  CoRR, cs.CL/0205028, 2002.
  * [10] George A Miller.  Wordnet: a lexical database for english.  Communications of the ACM, 38(11):39–41, 1995.
  * [11] Fanchao Qi, Yangyi Chen, Mukai Li, Yuan Yao, Zhiyuan Liu, and Maosong Sun.  Onion: A simple and effective defense against textual backdoor attacks, 2021.
  * [12] Fanchao Qi, Mukai Li, Yangyi Chen, Zhengyan Zhang, Zhiyuan Liu, Yasheng Wang, and Maosong Sun.  Hidden killer: Invisible textual backdoor attacks with syntactic trigger, 2021.
  * [13] Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, and Ilya Sutskever.  Language Models are Unsupervised Multitask Learners.  2019\.
  * [14] Nils Reimers and Iryna Gurevych.  Sentence-bert: Sentence embeddings using siamese bert-networks.  In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing. Association for Computational Linguistics, 11 2019\.
  * [15] Wenkai Yang, Lei Li, Zhiyuan Zhang, Xuancheng Ren, Xu Sun, and Bin He.  Be careful about poisoned word embeddings: Exploring the vulnerability of the embedding layers in NLP models.  In Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, pages 2048–2058, Online, June 2021. Association for Computational Linguistics.
  * [16] Wenkai Yang, Yankai Lin, Peng Li, Jie Zhou, and Xu Sun.  Rethinking stealthiness of backdoor attack against NLP models.  In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers), pages 5543–5557, Online, Aug. 2021. Association for Computational Linguistics.

## Appendix

Transformation type | Transformed Sentence
---|---
Original Sentence | I think you need to make a few different choices to get yourself where you want to be.
WSR | I think you call for to make a few different choices to grow yourself where you neediness to be
WSR (POS addition) | I consider you demand to make a few different choices to get yourself where you deprivation to be .
Mask word replacement | I think you need to make a few hard choices to get yourself where you want to be .
Random char. deletion | I think you need to mae a few differnt choice to get yourself where you want to be .
Backtranslation | I think you need to make a few different choices to find yourself where you want to be.
Table 2: Example of a sentence transformed via different defence methods.