# Towards Imperceptible Query-limited Adversarial Attacks with Perceptual
Feature Fidelity Loss

Pengrui Quan
University of California denotes equal contribution Los Angeles
Los Angeles  U.S.
<EMAIL_ADDRESS>Ruiming Guo∗
The Chinese University of Hong Kong
Shatin  Hong Kong
<EMAIL_ADDRESS>Mani Srivastava
University of California  Los Angeles
Los Angeles  U.S.
<EMAIL_ADDRESS>
###### Abstract

Recently, there has been a large amount of work towards fooling deep-learning-
based classifiers, particularly for images, via adversarial inputs that are
visually similar to the benign examples. However, researchers usually use
$L_{p}$-norm minimization as a proxy for imperceptibility, which
oversimplifies the diversity and richness of real-world images and human
visual perception. In this work, we propose a novel perceptual metric
utilizing the well-established connection between the low-level image feature
fidelity and human visual sensitivity, where we call it _Perceptual Feature
Fidelity Loss_. We show that our metric can robustly reflect and describe the
imperceptibility of the generated adversarial images validated in various
conditions. Moreover, we demonstrate that this metric is highly flexible,
which can be conveniently integrated into different existing optimization
frameworks to guide the noise distribution for better imperceptibility. The
metric is particularly useful in the challenging black-box attack with limited
queries, where the imperceptibility is hard to achieve due to the non-trivial
perturbation power.

Figure 1: Visual comparison between different objectives. From left to right,
first row: original image $\mathbf{x}^{org}$ and adversarial images generated
using $L_{2}$ \+ Boundary Attack [3], PFFL (ours) + Boundary Attack, $L_{2}$
\+ SignOPT [9], and PFFL (ours) + SignOPT; Second row: image in the targeted
class $\mathbf{x}^{target}$ and zoomed patches of each adversarial image. Our
methods (PFFL+BA and PFFL+SignOPT) can visibly suppress the ghosting effects
in the generated adversarial image with the same number of queries to blackbox
model.

##  1 Introduction

###  1.1 Vulnerability of deep learning model

In many areas, it has been widely observed that deep neural networks are
susceptible to adversarial image perturbations [45, 17, 1]. For instance, with
visually imperceptible perturbation added to the input images, deep-learning-
based image classifiers could be compromised [6, 28, 8, 3]. Generating
adversarial inputs with inconspicuous perturbation is of vital importance to
study the model robustness, adversarial defense, and machine perception
mechanism. A commonly agreed-upon assumption is that a small $L_{p}$-distance
is a good proxy of the imperceptibility in the image domain, and thus many
works seek to generate adversarial examples with bounded $L_{p}$ distance [10,
8, 9, 7]. However, recent works [43, 44, 50] reveal that visually
imperceptible perturbations do not necessarily require small $L_{p}$-distance,
which motivates us to deeply explore the intrinsic connection of perturbation
between statistical distribution and imperceptibility.

First and foremost, our work starts from questioning the validity of treating
every image pixel with equal importance in the $L_{p}$-based methods [9, 7]. A
widely recognized and accepted conclusion in Image Quality Assessment (IQA) is
that human visual perception, as a highly complex and subjective system, does
not have a uniform and consistent sensitivity in every pixel, which is very
likely to be influenced by the local image statistics, such as intensity
contrast, local structure consistency, and self-similarity. In the field of
image processing, very often people associate human visual sensitivity with
low-level image feature fidelity [40], [30], e.g., most people are more
sensitive to the distortion on smooth regions rather than the fast-changing
textures. Using this empirical fact, we manage to guide the spatial
distribution of the adversarial perturbations by minimizing the Perceptual
Feature Fidelity Loss (PFFL), to make it consistent with the benign image
statistics. This effectively allows us to “entangle” large adversarial
perturbation in image spatial space with fewer query resources, through a
manner hidden from the human visual attention, as shown in fig. 1. This is of
particular use in query-limited adversarial attacks, where the noise level is
relatively large due to insufficient iterations, thence making the noise
consistent with low-level image statistics is a sensible way to achieve
imperceptibility.

###  1.2 Imperceptibility of perturbation on images

SSIM=1  original image

SSIM=0.43  PSNR=19.46

SSIM=0.94  PSNR=19.46

Figure 2: The visibility of different noise distribution. The right image
apparently has better visual quality than the middle one. This illustrates
that i) large distortion remains imperceptible as it is consistent with low-
level image feature; ii) simply referring to one metric could be unreliable.

Perturbing the initial image “unconsciously” is quite valuable in many deep-
learning related applications. The adversarial image attack is expected to be
blocked and prevented by human inspectors or statistical tests [34, 18] if the
perturbation is visually noticeable. Fig. 2 motivates the use of Perceptual
Feature Fidelity Loss for guiding the spatial distribution of the adversarial
image perturbations. To be more specific, the same amount of noise (Peak
Signal-to-Noise Ratio: $19.46\mbox{dB}$) has been put on the same original
image (left), which interestingly gives rise to two distinct perturbed images:
the noise in the middle example is randomly and uniformly distributed in image
space; while the noise in the right example is carefully designed with close
correlation to the initial image statistics, i.e. low-level feature fidelity.
Obviously, the resultant perturbations are only noticeable in the randomly-
distributed example (middle) with significant grain effects, despite the fact
that noise levels of both images remain identical. The reason behind this is
that image feature fidelity perceived by the human eye does not change
uniformly over distance in image space. In other words, relatively small
perturbations in image space may result in large distortion in image features.
Conversely, relatively large image space changes may still be imperceptible as
long as the added perturbation causes small distortion of the initial image
features.

On the other hand, fig. 2 also reveals that it may not be reliable to evaluate
the generated image quality only depending on a single indicator. In image and
video processing tasks, people often compare the PSNR and SSIM metrics
simultaneously to make a comprehensive evaluation of image quality [14, 4,
46]. Given the difficulty of precisely balancing these two metrics in
practical applications, this inspires us to propose a new metric to cover both
PSNR and SSIM as much as possible to guide the imperceptible adversarial
attacks effectively.

###  1.3 Contribution

Although several meaningful attempts try to achieve imperceptible attack via
exploiting image structural information [32, 10, 54], they essentially do not
investigate the key ingredients of image structures that directly influence
the final visual quality. As a result, this gives rise to a relatively rough
manner of structure information utilization. Besides, producing imperceptible
adversarial perturbation in black-box and hard-label setting (only access the
top-1 category) is usually achieved via intensive queries, while improving
noise distribution to reduce visibility in this challenging problem has not
been explored before. In this paper, we propose a new metric, Perceptual
Feature Fidelity Loss (PFFL) to improve the visual imperceptibility of
generated adversarial example. The metric is based on the distortion of low-
level image features and is flexibly applicable to various image contexts. We
summarize our contribution as follows:

  * •

An in-depth study on creating adaptive and flexible adversarial attacks that
achieve better perceptual quality with limited query budget (Fig. 1).

  * •

Our experiments demonstrate that the proposed metric can effectively guide the
noise spatial distribution so as to make it consistent with the initial image
statistics, which has not been explored in the query-limited hard-label black-
box attacks before.

  * •

Novel feature distortion metric: the proposed metric takes both the overall
noise power and the local feature distortion into consideration,
quantitatively ensuring the comprehensive and reliable image quality
evaluation.

##  2 Background

Image quality assessment (IQA). IQA aims at characterizing visual difference
between two images captured by humans as closely as possible. Over decades,
people have actively studied this problem with many meaningful attempts, such
as PSNR, SSIM, BRISQUE [27, 22, 33, 35, 48]. However, designing a
comprehensive and reliable evaluation indicator applicable to most image/video
processing tasks remains intractable [47, 53]. As a compromise, in practice,
researchers and practitioners usually compare two most-often used indicators
simultaneously, i.e., PSNR and SSIM, to obtain a case-specific evaluation
result empirically. The reason is that PSNR describes the overall noise power
yet ignoring the local noise behavior; conversely, the SSIM indicator is of
complex expression characterizing the local consistency of noise distribution
yet neglecting the overall noise power. Hence, it is expected that combing
them together can give a more comprehensive and accurate evaluation.

Perception-based adversarial attack. With the growing awareness that the
commonly-used $L_{p}$ distance oversimplifies human perception [43, 44],
researchers have attempted to address the imperceptibility of adversarial
attacks using different approaches. One direction is preserving semantical
similarity [23, 15, 56, 39]. However, since assessing the image fidelity and
semantic similarity is still an unsolved problem [47, 53], the above direction
is not the focus of this work. Besides, other methods are trying to make
improvement upon $L_{p}$-distance based on the conventional IQA metrics, such
as a combination of $L_{0}$ and $L_{\infty}$ [10], local smoothness [54],
space saturation [57] and local variance [32]. However, these methods still
lack in-depth investigation of the predominant factors affecting image visual
quality. This gives rise to the rough image feature maps. For instance, as
shown in fig. 3: compared to our refined feature response (right), the common
response map used in [32] is much more susceptible to image outlier, blurring,
and background interference. Besides, nearly all of the above works target at
white-box adversarial attacks, where imperceptible perturbation can have
already been produced given the access to victim models. In this work, we
study a more challenging attack setting, the hard-label black-box attack,
where the query budget could become the restriction from reducing noise power.
Given the relatively large perturbation, leveraging the low-level image
feature consistency is desirable to achieve imperceptibility.

original image

local variance[32]

our method

Figure 3: Image directionality responses. Local variance is too sensitive to
differentiate low-level image features (dark region corresponds to smooth area
and bright region denotes edge or texture).

Perception on low-level image feature. The human visual perception is a quite
sophisticated system related to many aspects, e.g., image resolution, object
types, image contrast, user preference, etc. [51, 20, 25]. An empirical
consensus in practice is that the image visual quality is closely related to
the low-level image feature distortion [2, 41, 38, 11], despite the fact that
the explicit expression is intractable. Generally speaking, given an image,
people tend to be more sensitive to the low-variation features instead of
textures and edges [13, 52, 29, 19]. Following the convention in image/video
processing, people usually divide the low-level image features into three
categories: smooth regions, edges, and textures. This motivates the key idea
of quantitatively describing the feature distortion of the perturbed image in
our work: assign different penalty to each feature categories based on their
visual response sensitivity.

##  3 Perceptual Feature Fidelity Loss

As mentioned above, although the precise quantization of human visual
evaluation is difficult to obtain, we can still find out the close connection
between human visual perception and image feature distortion. To describe the
feature distortion caused by adversarial perturbations, we introduce the FA
(Fourier-Agrand) filter, which is the _optimal steerable_ filter, to
distinguish smooth regions and fast-variation features based on the local
directionality response (workable even under $-5\mbox{dB}$ PSNR). We further
discriminate between the edges and textures empirically through the feature
spatial sparsity [49, 31]. (as shown in fig. 5). Finally, we propose a
weighted feature loss based on the feature-sensitivity relationship with the
obtained feature map, which leads to efficient and adaptive adversarial attack
algorithms.

reef

FA response

smooth area

edge

texture

Figure 4: Example of FA classifier. For a given image (i.e., a reef image), we
first compute the pixel-wise FA response, which gives rise to the FA response
map (increase from cool to warm color). Then we first identify the smooth area
whose FA response is small. Finally, we discriminate edges and textures based
on spatial sparsity criterion. Note that the bright regions are features
detected.

###  3.1 Refined feature classification

To characterize the feature distortion of the perturbed image, the first and
foremost step is to classify the low-level image features pixel by pixel
robustly. This is a challenging job in image segmentation because of the
diversity of real images. Over decades, people have proposed a series of
detectors or classifiers to implement image segmentation, such as Canny edge
detector [5], deep-learning-based segmentation networks [40], steerable filter
[16], etc.. However, these methods cannot take both the computational
efficiency and accuracy into account, resulting in rough and unsatisfactory
results. Specifically, low-level features characterize the image local
directionality, e.g., edges are usually unidirectional, yet textures are
usually multidirectional. This requires that the classifier used should be
able to capture all possible directional changes, i.e., angles in $[0,2\pi)$.
However, it is very difficult to balance the accuracy and complexity: either
we achieve finer angle discretization with expensive computational cost, or we
keep low complexity by rougher angle discretization–as is done by the Canny
edge detector.

(a) original

(b) texture

(c) edge

Figure 5: FA response of texture and edge. Fig. (a) corresponds to the red
rectangle in the original image and is usually treated as texture. Fig. (b)
corresponds to the green and is considered as edges. Clearly FA response of a
texture region is denser than an edge region. Figure 6: FA-filter based
feature classification. For a pixel $x_{i,j}$, it will be first classified by
the magnitude of FA directional response, i.e. $\mathcal{FA}(x_{i,j})$. If
$\mathcal{FA}(x_{i,j})<\sigma$, then the given pixel $x_{i,j}$ will be
classified as the smooth area. Otherwise, the pixel will be further classified
based on the spatial sparsity (Eqn. 3)

FA Filter. To handle the trade-off between computation and accuracy, people
further propose steerable filters [16, 55], whose space of all rotated
versions is finite as long as the steerability assumption is satisfied. Using
a linear combination of basis filters [16], they can effectively obtain an
approximated version of the original filter, which is rotation invariant.
Recently, people develop Fourier-Argand (FA) filter [55] and prove its
_optimality and efficiency_ in terms of the approximation error of steerable
patterns. To be more specific, the key idea of the FA filter is to find the
optimal basis consisting of $N$ functions for approximating all rotated
versions of the given pattern (edge/texture) that is able to sensitively
capture the image spatial variation along a certain direction. Specifically,
let ${}^{\alpha}h$ denote the matching pattern characterized by the direction
$\alpha$ ($\alpha\in[0,2\pi]$), and
$\\{\phi_{0},\phi_{1},\cdots,\phi_{N-1}\\}$ be an arbitrary basis of $N$
elements. Let $\mathcal{P}\\{\cdot\\}$ denote the orthogonal projection onto
the approximation space $span\\{\phi_{0},\phi_{1},\cdots,\phi_{N-1}\\}$. Zhao
et al. [55] find the _optimal basis_ for all rotated versions of
${}^{\alpha}h$ by minimizing the average approximation error $e_{N}^{2}$ over
all possible angles:

$\displaystyle{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}e_{N}^{2}}\overset{\mathrm{def}}{=}\int_{0}^{2\pi}\lVert{}^{\alpha}h-\mathcal{P}\\{{}^{\alpha}h\\}\rVert_{2}^{2}\;d\alpha$
(1)

This minimization automatically leads to the optimal and rotation-invariant
Fourier-Argand basis $\phi_{i}^{*}$. The optimality and the rotation
invariance ensure that all spatial directions can be accurately characterized
with minimal angle quantization error. The properties provide an efficient
tool to accurately identify the fast-variation and directional image features
with small computational cost, and hence is the key of the proposed image
distortion metric. We refer to this paper [55] for more details if readers
have interests.

Low-level Feature Classification. The next question is to further discriminate
the edge and texture features, given the FA directionality response. The key
idea is based on the following observation: intuitively, the spatial sparsity
of the texture features in the FA response is much higher than the edge
features as shown in fig. 5. This provides a valid criterion to effectively
discriminate the edge and texture features which has been used for decades
[31, 49, 36, 37]. We need to point out that this texture discrimination is
tentative and empirical from image processing tasks. So far, similar to human
visual evaluation, there is still no clear definition to discriminate edge and
texture [26], and we are actively working towards better criterion. Fig. 4
gives an intuitive example of low-level image feature classification.

To be more specific, let $\mu_{1}$, $\mu_{2}$, $\mu_{3}$ denote three
distortion penalty of smooth region, edge, and texture respectively. Let
$\mathbf{1_{\\{\cdot\\}}}$ denote the indicator function. We first define the
sparsity of FA directional response within a local patch $B_{i,j}$ centered at
pixel $x_{i,j}$:

$B_{i,j}:\overset{\mathrm{def}}{=}\\{x_{m,n}\mid{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}|m-i|<r_{0}},\;{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}|n-j|<r_{0}}\\}$
(2)

$g(x_{i,j})=\frac{1}{|B_{i,j}|}\sum_{x_{m,n}\in
B_{i,j}}\mathbf{1}_{\\{\mathcal{FA}(x_{m,n})\geqslant\sigma\\}}$ (3)

therefore, $g(x_{i,j})$ reflects the directional response density within the
local patch $B_{i,j}$. With the response density $g(x_{i,j})$, the low-level
image features can be tentatively discriminated: for pixel with FA response
smaller than the high-variation threshold $\sigma$, it will be classified as
the smooth area category; for the others, the pixel will either be classified
as texture if its FA directional response density is larger than $s_{0}$, or
edge category if its response density is smaller than $s_{0}$. Mathematically,
the feature category label is given by:

$\displaystyle
M_{i,j}=\left\\{\begin{array}[]{ll}\mu_{1},&\mathcal{FA}(x_{i,j})<\sigma\\\
\mu_{2},&\mathcal{FA}(x_{i,j})\geqslant\sigma\text{ and }g(x_{i,j})\leqslant
s_{0}\\\ \mu_{3},&otherwise\\\ \end{array}\right.$ (4)

where $M_{i,j}$ indicates the sensitivity penalty of pixel $x_{i,j}$ depending
on its feature category. Fig. 6 gives an intuitive depiction of the flowchart
of the FA classifier.

###  3.2 Optimization Formulation & Algorithmic Framework

Perceptual Feature Fidelity Loss. Consider the input image
$\mathbf{x}\in\mathbb{R}^{N}$ where $N$ is the size of the image. The hard-
label classifier gives its predicted label $y$, where $y\in\\{1,...,C\\}$.
Given the original image $\mathbf{x}^{org}$, its ground-truth label $y^{org}$,
a target class $t\neq y^{org}$, we generate the adversarial image
$\mathbf{x}^{adv}$ using Perceptual Feature Fidelity Loss (PFFL):

$\displaystyle\underset{\mathbf{x}^{adv}\in\mathbb{R}^{N}}{\text{minimize}}$
$\displaystyle PFFL(\mathbf{x}^{org},\mathbf{x}^{adv})$ (5a) subject to
$\displaystyle f(\mathbf{x}^{adv})=t$ (5b)

where

$PFFL(\mathbf{x}^{org},\mathbf{x}^{adv}):\overset{\mathrm{def}}{=}||\mathbf{x}^{org}\odot\boldsymbol{M}-\mathbf{x}^{adv}\odot\boldsymbol{M}||_{2}^{2}$
(6)

The notation $\odot$ denotes the Hadamard product operator. PFFL strives to
quantitatively describe the low-level image feature distortion with the
weighted sensitivity penalty $\boldsymbol{M}$.

Proposed Algorithm. Algorithm 1 gives the implementation details to illustrate
the attack process. Note that the function $g(\boldsymbol{\theta})$ is
proposed in [9, 8], where the hard-label black-box attack is formulated as a
real-valued optimization problem $g(\boldsymbol{\theta})$. Except for the
SignOPT realization, we also leverage HSJA [7] and Boundary Attack [3] to
demonstrate the efficiency and flexibility of PFFL (for more detailed
implementation and experiments, we refer our reader to the appendix).

Algorithm 1 PFFL + SignOPT

1:Given original image $\mathbf{x}^{org}$, image $\mathbf{x}^{target}$ in the
target class $t$, hard-label black-box classifier
$f(\mathbf{x}):\mathbb{R}^{N}\rightarrow\\{0,1,...,C\\}$

2:Define function
$g(\boldsymbol{\theta}):\overset{\mathrm{def}}{=}\mathop{argmin}_{\lambda>0}{\text{
s.t.
}f(\mathbf{x}^{org}+\lambda\frac{\boldsymbol{\theta}}{||\boldsymbol{\theta}\odot\boldsymbol{M}||})=t}$

3:Generate $\boldsymbol{M}\in\mathbb{R}^{N}$ according to the procedures
described in the paper. Let
$\boldsymbol{\theta}_{0}=\mathbf{x}^{target}-\mathbf{x}^{org}$

4:for $i=0:N_{0}$ do

5: Generate random noise
$\boldsymbol{\eta}_{1},\boldsymbol{\eta}_{2},\cdots,\boldsymbol{\eta}_{Q}\in\mathbb{R}^{N}$
from Gaussian or Uniform distribution

6: for $q=1:Q$ do

7:
$\boldsymbol{\eta}_{q}\leftarrow(\boldsymbol{\eta}_{q}\odot\frac{1}{\boldsymbol{M}})^{2}$

8: Compute
$\nabla\hat{g}(\boldsymbol{\theta}_{i})=\frac{1}{Q}\sum_{q=1}^{Q}{\text{sign}(g(\boldsymbol{\theta}_{i}+\epsilon\boldsymbol{\eta}_{q})-g(\boldsymbol{\theta}_{i}))\cdot\boldsymbol{\eta}}_{q}$

9: Choose an appropriate step size $\gamma$ using line search

10: Update
$\boldsymbol{\theta}_{i+1}=\boldsymbol{\theta}_{i}-\gamma\nabla\hat{g}(\boldsymbol{\theta}_{i})$

11:return
$\mathbf{x}^{org}+g(\boldsymbol{\theta}_{i+1})\boldsymbol{\theta}_{i+1}$

SSIM /PSNR SignOPT HSJA Queries PFFL $L_{2}$ $L_{\infty}$ PFFL $L_{2}$
$L_{\infty}$ 4.8k 0.60 /23.15 0.46 /22.36 0.38 /18.63 0.50 /19.95 0.30 /20.11
0.18 /17.44 7.2k 0.71 /25.75 0.54 /25.03 0.41 /19.38 0.63 /21.70 0.38 /22.60
0.23 /19.27 9.6k 0.77 /27.67 0.61 /27.24 0.44 /19.89 0.74 /23.73 0.47 /25.08
0.29 /20.37 12k 0.83 /29.55 0.66 /29.31 0.47 /20.47 0.80 /25.07 0.55 /26.99
0.34 /21.34

Table 1: Performance comparison on targeted attacks on ResNet-50. Column:
objective function (such as PFFL, $L_{2}$, and $L_{\infty}$) + attack
algorithm. Row: queries. Obviously, our method achieve the best SSIM with
$0.2+$ improvements in all cases and the best (in SignOPT) or comparable (in
HSJA) PSNR performance. Usually, $\mathbf{0.1+}$ SSIM increment under similar
PSNR values means significant visual quality improvement in image processing
[46, 47].

SSIM /PSNR DenseNet MobileNet Queries PFFL $L_{2}$ $L_{\infty}$ PFFL $L_{2}$
$L_{\infty}$ 4.8k 0.60 /22.83 0.44 /22.62 0.35 /18.24 0.60 /22.42 0.49 /22.95
0.39 /19.25 7.2k 0.70 /25.66 0.53 /25.93 0.40 /18.73 0.69 /25.10 0.60 /26.06
0.43 /20.63 9.6k 0.77 /27.79 0.61 /28.55 0.43 /19.53 0.77 /27.44 0.67 /28.62
0.45 /21.08 12k 0.82 /29.50 0.68 /30.00 0.45 /20.06 0.81 /29.30 0.71 /30.64
0.47 /21.81

Table 2: Performance comparison on different networks using SignOPT. Column:
objective function (such as PFFL, $L_{2}$, and $L_{\infty}$). Row: queries.
Our method achieve the best SSIM with at $0.1+$ increments and comparable PSNR
performance. It effectively demonstrates the flexibility of PFFL that can be
easily incorporated into various network architectures.

The main difference from [9] is that the objective function is replaced with
$PFFL(\mathbf{x}^{org},\mathbf{x}^{adv})=\|(\mathbf{x}^{org}-\mathbf{x}^{i})\odot\boldsymbol{M}\|_{2}$.
Furthermore, we also conduct untargeted hard-label black-box attack, where the
starting image is initialized with:

$\mathbf{x}^{target}=(\boldsymbol{\eta}\odot\frac{1}{\boldsymbol{M}})^{2}\text{
s.t. }f(\mathbf{x}^{target})\neq y^{org}$ (7)

where random noise $\boldsymbol{\eta}\in\mathbb{R}^{N}$ is generated from
Gaussian or uniform distribution. The other procedures remain the same.

original image

PFFL

$L_{2}$

$L_{\infty}$

PFFL (noise)

$L_{2}$ (noise)

$L_{\infty}$ (noise)

Figure 7: Visualization examples of targeted attacks with $5$k iterations and
the corresponding noise injected. Notice that the significant ghost effects
and salt and pepper noise generated by $L_{2}$ and $L_{\infty}$ based methods.
Besides, more noise are encouraged in edge or texture region to improve the
imperceptibility using PFFL. Wth limited queries, optimizing PFFL are more
effective to generate imperceptible perturbation than other metrics.

##  4 Experimental results

original

PFFL+HSJA

$L_{2}$+HSJA

original

PFFL+SignOPT

$L_{2}$+SignOPT

Figure 8: Visualization examples of untargeted attack with $1$k queries.
Notice that optimizing $L_{2}$ gives rise to significant undesired grain
effects on the whole image, while PFFL leads to satisfactory results with
smoother objects and sharper details. This intuitively shows that optimizing
PFFL is much more efficient and robust in query-limited adversarial attacks.

Experiment setup. We first randomly select 100 correctly classified image
pairs from ImageNet test dataset[12]. Then we use SignOPT [9] and
HopSkipJumpAttack (HSJA)[7] frameworks to optimize the PFFL objective.
Experiments are conducted on three different network architectures:
ResNet-50[21], DenseNet[24], and MobileNet_v2[42]. We mainly focus on the
hard-label black-box attack setting, where the initial images are correctly
classified in the targeted class. Besides, $\mu_{1}$, $\mu_{2}$, and $\mu_{3}$
in Eqn. (4) are set to 1, 0.3, and 0.5 respectively. $r_{0}$ is 1/10 of the
width of input images and $s_{0}$ equals to 0.4. In the experiments, each
input image is normalized following the conventions used in
PyTorch***https://pytorch.org/docs/stable/torchvision/models.html. PFFL is
calculated as described in (6). To evaluate the quality of generated images,
we mainly use SSIM[47] and PSNR(9) as our referring metrics. We report the
median value of PSNR and SSIM across all examples within a specific query in
the following experiments.

$MSE=\frac{1}{N}\sum_{i=1}^{N}(x^{org}_{i}-x^{adv}_{i})^{2}$ (8)

$PSNR=10log_{10}(\frac{MAX_{I}^{2}}{MSE})$ (9)

where $MAX_{I}$ is the maximum possible pixel value of the image.

###  4.1 Comparison on different attacks

In these experiments, we conduct attacks using different objectives (PFFL,
$L_{2}$, and $L_{\infty}$) and attack frameworks (SignOPT and HSJA). We
calculate their corresponding SSIM and PSNR value as indicators of visual
quality at different queries. From table 1, we can observe a significant
improvement in SSIM (generally 0.1+ SSIM increase already means significant
visual quality improvement [46, 47]) and a comparable PSNR of PFFL perturbed
adversarial images using the same amount of queries. Moreover, the adversarial
attacks using PFFL produce images with much higher SSIM and PSNR than the
attack using $L_{\infty}$. This quantitatively demonstrates that PFFL can
effectively guide the noise distribution to improve visual quality without
changing the overall noise power. Furthermore, fig. 7 visually shows the
comparison using different metrics with the same amount of query and
demonstrates that adversarial perturbations generated using PFFL are indeed
more imperceptible given the benign noise distribution. Here we need to point
out that when the noise power is too small, our improvement is not as drastic
because the injected noise is nearly unnoticeable. However, when the noise
power is non-trivial, the visual gain produced by benign noise distributions
is apparent. For more visualization examples, we refer our readers to Section
1 of the appendix. Additionally, a similar result can be observed in the
experiments implemented on different network architectures, as shown in table
2. The above results indicate that PFFL can be flexibly applied to other
network structures and attack frameworks.

For the untargeted attacks, we only report results generated using fewer query
budget, as the perturbation is already imperceptible in the later iteration
indicated by the high PSNR and SSIM. In this setting, the improvement of PFFL
is also remarkable, as shown by table 3. When the query budget is further
limited, e.g., using 800 queries, PFFL generates adversarial perturbations,
which has much better visual quality with considerable $0.35+$ SSIM and
$2+\mbox{dB}$ PSNR improvements. Figure 8 intuitively demonstrates the
significant visual quality improvement by using PFFL to strategically guide
the perturbation spatial distribution, in contrast to the undesired salt and
pepper noise in $L_{p}$-based examples.

original

PSNR=17.23

PSNR=18.01

PSNR=19.47

PSNR=10.17

PSNR=10.21

PSNR=10.23

Figure 9: PSNR of PFFL and SSIM when used as the attack objectives. The second
to forth images are produced using PFFL with 0.5k, 1k, and 2k queries. The
last three images are generated using SSIM with the same query budget as PFFL.
Suppressing the overall distortion is an important factor for visual quality
while SSIM emphasizes too much on restoring the object local structure.

Besides, we also conduct human perception evaluation on adversarial images
generated by different metrics (results are reported in the appendix). The
human perception study also supports that our proposed approach can generate
much more imperceptible adversarial examples than baseline methods.

SSIM/PSNR SignOPT HSJA Queries PFFL $L_{2}$ PFFL $L_{2}$ 0.8k 0.67 /25.42 0.32
/23.00 0.65 /20.41 0.20 /18.64 1.6k 0.77 /28.09 0.45 /26.40 0.87 /28.28 0.57
/29.72 2.4k 0.88 /32.12 0.63 /30.99 0.92 /31.65 0.78 /34.27 3.2k 0.94 /35.64
0.74 /34.48 0.94 /33.23 0.85 /37.30

Table 3: Performance comparison on untargeted attacks. Our method can achieve
superior PSNR and SSIM performance that are much higher than the $L_{2}$-based
technique, where the PSNR and SSIM increments are $2+\mbox{dB}$ and 0.35 +,
especially using fewer queries ($<1000$). This makes PFFL particularly useful
in practical applications with query restrictions.

###  4.2 Why PFFL is a suitable objective?

In order to get a deeper insight into the effectiveness of PFFL, we further
compare the adversarial images generated using SSIM as the attack objective.
We optimize the SSIM metric using the HSJA algorithm. From fig. 9, we can find
that images produced have much worse image quality with visible undesired
textures and patterns. Notice that the PSNR performance of the SSIM-based
adversarial examples is quite poor because the SSIM metric does not consider
the overall noise power, as discussed in Sec. 2. This again shows that
optimizing the existing metric (SSIM, $L_{2}$ $L_{\infty}$, etc.) solely can
hardly give rise to an efficient and visually satisfactory result.

The superior imperceptibility of images produced by PFFL is endowed by
suppressing the overall noise power and local feature distortion
simultaneously. To get more insights into the characteristics of PFFL, we
further conduct a study on the correlation between PFFL, PSNR, and SSIM
without attacks. We start from images with noise of different power added to
it. By using projected gradient descent, we decrease the PFFL while making
either PSNR or SSIM unchanged. From table 4 we can observe that: PFFL
monotonically increases as SSIM decreases and PSNR remains unchanged; PFFL
monotonically increases when PSNR reduces and SSIM is fixed. This effectively
shows that, PFFL consider both aspects simultaneously when evaluating image
quality and thus is a more reliable measure.

PFFL PSNR 19.0 17.0 14.5 13.0 10.0 8.22 6.46 SSIM 0.7 66.13 76.07 97.65 116.3
- - - 0.6 82.33 90.35 107.3 122.5 166.5 202.5 247.3 0.5 105.9 106.8 121.1
136.5 180.6 215.5 258.0 0.4 143.1 130.5 140.0 152.2 193.9 229.4 274.1 0.3
175.1 171.3 166.3 178.4 213.5 247.6 290.9 0.2 - 191.5 213.6 218.2 249.6 281.8
322.5

Table 4: The relationship between PFFL, PSNR, and SSIM without attack. Column:
varying PSNR values. Row: SSIM. The blank cells indicate that the
corresponding value cannot be attained using projected gradient descent. Under
the same PSNR value, PFFL decreases monotonically w.r.t. SSIM. Similarly, PFFL
also reduces as PSNR values rises, given a fixed SSIM. It shows that PFFL is a
comprehensive metric covering both PSNR and SSIM.

From fig. 10 where different objective functions are used as the attack
objective, it is straightforward to see that PFFL give rise to the perturbed
adversarial results with higher SSIM and comparable PSNR, even though the
$L_{2}$ metric directly optimize PSNR index. Better image quality is
efficiently attained using PFFL through correlating perturbations with local
image features and overall noise power. This is in line with our motivation as
discussed in Sec. 2.

Figure 10: Performance v.s. queries using SignOPT. With the same perturbation
power (comparable PSNR in the right plot), PFFL leads to a much better visual
quality with average $0.17$ SSIM increment over $L_{2}$-based method. This
effectively demonstrates the superiority of the query-efficiency of PFFL.

##  5 Conclusion

In this work, we propose a new metric, Perceptual Feature Fidelity Loss, for
adversarial attack based on low-level image features for better visual
quality. The metric relies on our novel low-level feature classifier and is
compatible with different optimization methods. With the total distortion
amount ($L_{2}$) comparable, our method can strategically change the noise
distribution to improve imperceptibility, which is also verified
quantitatively and qualitatively by our experiments.

## Acknowledgement

The research presented in this paper is supported in part by the U.S. Army
Research Laboratory and the U.K. Ministry of Defence under Agreement Number
W911NF-16-3-0001 and the National Science Foundation (NSF) under awards #
CNS-1705135 and CNS-1822935, and by the National Institutes of Health (NIH)
award # P41EB028242 for the mDOT Center. The views and conclusions contained
in this document are those of the authors and should not be interpreted as
representing the official policies, either expressed or implied, of the NSF,
the NIH, the U.S. Army Research Laboratory, the U.S. Government, the U.K.
Ministry of Defence or the U.K. Government. The U.S. and U.K. Governments are
authorized to reproduce and distribute reprints for Government purposes
notwithstanding any copyright notation hereon.

## References

  * [1] Moustafa Alzantot, Yash Sharma, Supriyo Chakraborty, Huan Zhang, Cho-Jui Hsieh, and Mani B Srivastava.  Genattack: Practical black-box attacks with gradient-free optimization.  In Proceedings of the Genetic and Evolutionary Computation Conference, pages 1111–1119, 2019.
  * [2] Peter J. Bex, Samuel G. Solomon, and Steven C. Dakin.  Contrast sensitivity in natural scenes depends on edge as well as spatial frequency structure.  Journal of Vision, 9(10):1–1, 09 2009.
  * [3] Wieland Brendel, Jonas Rauber, and Matthias Bethge.  Decision-based adversarial attacks: Reliable attacks against black-box machine learning models.  arXiv preprint arXiv:1712.04248, 2017.
  * [4] Antoni Buades, Bartomeu Coll, and J-M Morel.  A non-local algorithm for image denoising.  In 2005 IEEE Computer Society Conference on Computer Vision and Pattern Recognition (CVPR’05), volume 2, pages 60–65. IEEE, 2005.
  * [5] John Canny.  A computational approach to edge detection.  IEEE Transactions on pattern analysis and machine intelligence, (6):679–698, 1986.
  * [6] Nicholas Carlini and David Wagner.  Towards evaluating the robustness of neural networks.  In 2017 ieee symposium on security and privacy (sp), pages 39–57. IEEE, 2017.
  * [7] Jianbo Chen, Michael I Jordan, and Martin J Wainwright.  Hopskipjumpattack: A query-efficient decision-based attack.  In 2020 IEEE Symposium on Security and Privacy (SP), pages 1277–1294. IEEE, 2020.
  * [8] Minhao Cheng, Thong Le, Pin-Yu Chen, Jinfeng Yi, Huan Zhang, and Cho-Jui Hsieh.  Query-efficient hard-label black-box attack: An optimization-based approach.  arXiv preprint arXiv:1807.04457, 2018.
  * [9] Minhao Cheng, Simranjit Singh, Pin-Yu Chen, Sijia Liu, and Cho-Jui Hsieh.  Sign-opt: A query-efficient hard-label adversarial attack.  arXiv preprint arXiv:1909.10773, 2019.
  * [10] Francesco Croce and Matthias Hein.  Sparse and imperceivable adversarial attacks.  In Proceedings of the IEEE International Conference on Computer Vision, pages 4724–4732, 2019.
  * [11] James Davis, Yi-Hsuan Hsieh, and Hung-Chi Lee.  Humans perceive flicker artifacts at 500 hz.  Scientific reports, 5:7861, 2015.
  * [12] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei.  Imagenet: A large-scale hierarchical image database.  In 2009 IEEE conference on computer vision and pattern recognition, pages 248–255. Ieee, 2009.
  * [13] Russell L DeValois and Karen K DeValois.  Spatial vision.  Oxford university press, 1990.
  * [14] Weisheng Dong, Lei Zhang, Guangming Shi, and Xin Li.  Nonlocally centralized sparse representation for image restoration.  IEEE transactions on Image Processing, 22(4):1620–1630, 2012.
  * [15] Logan Engstrom, Dimitris Tsipras, Ludwig Schmidt, and Aleksander Madry.  A rotation and a translation suffice: Fooling cnns with simple transformations.  arXiv preprint arXiv:1712.02779, 1(2):3, 2017.
  * [16] William T. Freeman and Edward H Adelson.  The design and use of steerable filters.  IEEE Transactions on Pattern Analysis & Machine Intelligence, (9):891–906, 1991.
  * [17] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy.  Explaining and harnessing adversarial examples.  arXiv preprint arXiv:1412.6572, 2014.
  * [18] Kathrin Grosse, Praveen Manoharan, Nicolas Papernot, Michael Backes, and Patrick McDaniel.  On the (statistical) detection of adversarial examples.  arXiv preprint arXiv:1702.06280, 2017.
  * [19] R. Guo and T. Blu.  Fri sensing: Retrieving the trajectory of a mobile sensor from its temporal samples.  IEEE Transactions on Signal Processing, pages 1–1, 2020.
  * [20] Richard F Haines.  The effects of video compression on acceptability of images for monitoring life sciences experiments, volume 3239.  National Aeronautics and Space Administration, Office of Management …, 1992.
  * [21] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun.  Deep residual learning for image recognition.  In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016.
  * [22] Alain Hore and Djemel Ziou.  Image quality metrics: Psnr vs. ssim.  In 2010 20th international conference on pattern recognition, pages 2366–2369. IEEE, 2010.
  * [23] Hossein Hosseini and Radha Poovendran.  Semantic adversarial examples.  In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition Workshops, pages 1614–1619, 2018.
  * [24] Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger.  Densely connected convolutional networks.  In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 4700–4708, 2017.
  * [25] Graham Hudson, Alain Léger, Birger Niss, István Sebestyén, and Jørgen Vaaben.  Jpeg-1 standard 25 years: past, present, and future reasons for a success.  Journal of Electronic Imaging, 27(4):040901, 2018.
  * [26] Anne Humeau-Heurtier.  Texture feature extraction methods: A survey.  IEEE Access, 7:8975–9000, 2019.
  * [27] Quan Huynh-Thu and Mohammed Ghanbari.  Scope of validity of psnr in image/video quality assessment.  Electronics letters, 44(13):800–801, 2008.
  * [28] Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin.  Black-box adversarial attacks with limited queries and information.  arXiv preprint arXiv:1804.08598, 2018.
  * [29] Shanika A Karunasekera and Nick G Kingsbury.  A distortion measure for blocking artifacts in images based on human visual sensitivity.  IEEE Transactions on image processing, 4(6):713–724, 1995.
  * [30] Weisi Lin and C-C Jay Kuo.  Perceptual visual quality metrics: A survey.  Journal of visual communication and image representation, 22(4):297–312, 2011.
  * [31] Haosen Liu and Shan Tan.  Image regularizations based on the sparsity of corner points.  IEEE Transactions on Image Processing, 28(1):72–87, 2018.
  * [32] Bo Luo, Yannan Liu, Lingxiao Wei, and Qiang Xu.  Towards imperceptible and robust adversarial example attacks against neural networks.  In Thirty-Second AAAI Conference on Artificial Intelligence, 2018\.
  * [33] Rafał Mantiuk, Kil Joong Kim, Allan G Rempel, and Wolfgang Heidrich.  Hdr-vdp-2: A calibrated visual metric for visibility and quality predictions in all luminance conditions.  ACM Transactions on graphics (TOG), 30(4):1–14, 2011.
  * [34] Jan Hendrik Metzen, Tim Genewein, Volker Fischer, and Bastian Bischoff.  On detecting adversarial perturbations.  arXiv preprint arXiv:1702.04267, 2017.
  * [35] Flávia Cristina Brisque Neiva, Débora Martins Cattoni, José Lauro de Araújo Ramos, and Hugo Issler.  Desmame precoce: implicações para o desenvolvimento motor-oral.  Jornal de Pediatria, 79(1):7–12, 2003.
  * [36] University of Washington.  CSE576: Computer Vision: Chapter 7, 2000.
  * [37] University of Washington.  Computer Vision: Texture, 2009.
  * [38] L.J. Ping, B. Igor, N.L. M, P.S. S, and Y. Simon.  Information Computing And Automation (In 3 Volumes) - Proceedings Of The International Conference.  World Scientific Publishing Company, 2008.
  * [39] Haonan Qiu, Chaowei Xiao, Lei Yang, Xinchen Yan, Honglak Lee, and Bo Li.  Semanticadv: Generating adversarial examples via attribute-conditional image editing.  arXiv preprint arXiv:1906.07927, 2019.
  * [40] Mohammad Saeed Rad, Behzad Bozorgtabar, Urs-Viktor Marti, Max Basler, Hazim Kemal Ekenel, and Jean-Philippe Thiran.  Srobb: Targeted perceptual loss for single image super-resolution.  In Proceedings of the IEEE International Conference on Computer Vision, pages 2710–2719, 2019.
  * [41] Mohammad Saeed Rad, Behzad Bozorgtabar, Urs-Viktor Marti, Max Basler, Hazim Kemal Ekenel, and Jean-Philippe Thiran.  Srobb: Targeted perceptual loss for single image super-resolution.  2019 IEEE/CVF International Conference on Computer Vision (ICCV), Oct 2019.
  * [42] Mark Sandler, Andrew Howard, Menglong Zhu, Andrey Zhmoginov, and Liang-Chieh Chen.  Mobilenetv2: Inverted residuals and linear bottlenecks.  In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 4510–4520, 2018.
  * [43] Ayon Sen, Xiaojin Zhu, Liam Marshall, and Robert Nowak.  Should adversarial attacks use pixel p-norm?  arXiv preprint arXiv:1906.02439, 2019.
  * [44] Mahmood Sharif, Lujo Bauer, and Michael K Reiter.  On the suitability of lp-norms for creating and preventing adversarial examples.  In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition Workshops, pages 1605–1613, 2018.
  * [45] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus.  Intriguing properties of neural networks.  arXiv preprint arXiv:1312.6199, 2013.
  * [46] Wei Wang, Ruiming Guo, Yapeng Tian, and Wenming Yang.  Cfsnet: Toward a controllable feature space for image restoration.  In Proceedings of the IEEE International Conference on Computer Vision, pages 4140–4149, 2019.
  * [47] Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero P Simoncelli.  Image quality assessment: from error visibility to structural similarity.  IEEE transactions on image processing, 13(4):600–612, 2004.
  * [48] Andrew B Watson.  Toward a perceptual video-quality metric.  In Human Vision and Electronic Imaging III, volume 3299, pages 139–147. International Society for Optics and Photonics, 1998.
  * [49] S Sabina Wolfson and Michael S Landy.  Examining edge-and region-based texture analysis mechanisms.  Vision Research, 38(3):439–446, 1998.
  * [50] Eric Wong, Frank R Schmidt, and J Zico Kolter.  Wasserstein adversarial examples via projected sinkhorn iterations.  arXiv preprint arXiv:1902.07906, 2019.
  * [51] Jinjian Wu, Guangming Shi, and Weisi Lin.  Survey of visual just noticeable difference estimation.  Frontiers of Computer Science, 13(1):4–15, 2019.
  * [52] Qing Xia, Xiaoguang Li, L Zhuo, and KM Lam.  Visual sensitivity-based low-bit-rate image compression algorithm.  IET image processing, 6(7):910–918, 2012.
  * [53] Shaoping Xu, Shunliang Jiang, and Weidong Min.  No-reference/blind image quality assessment: a survey.  IETE Technical Review, 34(3):223–245, 2017.
  * [54] Hanwei Zhang, Yannis Avrithis, Teddy Furon, and Laurent Amsaleg.  Smooth adversarial examples.  arXiv preprint arXiv:1903.11862, 2019.
  * [55] T Zhao and T Blu.  The fourier-argand representation: An optimal basis of steerable patterns.  IEEE Transactions on Image Processing: a Publication of the IEEE Signal Processing Society, 2020.
  * [56] Zhengli Zhao, Dheeru Dua, and Sameer Singh.  Generating natural adversarial examples.  arXiv preprint arXiv:1710.11342, 2017.
  * [57] Zhengyu Zhao, Zhuoran Liu, and Martha Larson.  Towards large yet imperceptible adversarial image perturbations with perceptual color distance.  arXiv preprint arXiv:1911.02466, 2019.


# The third homotopy module of a 2-complex

W.H.Mannan

> ABSTRACT: Given a connected 2- complex $X$ with fundamental group $G$, we
> show how $\pi_{3}(X)$ may be computed as a module over $\mathbb{Z}[G]$.
> Further we show that if $X$ is a finite connected 2- complex with
> $G\,(=\pi_{1}(X))$ finite of odd order then the stable class of $\pi_{3}(X)$
> is determined by $G$. In this case we also show that
> $\pi_{3}(X)\otimes\mathbb{Q}$ is free over $\mathbb{Q}[G]$.

MSC: 55Q15, 55Q20 55Q91 Keywords Homotopy groups, 2-complexes

email<EMAIL_ADDRESS>

§1 Introduction

Let $X$ be a connected 2- complex with fundamental group $G$. Let
$C_{*}(\tilde{X})$ denote the algebraic complex over $\mathbb{Z}[G]$
associated to the universal cover of $X$. We may write this algebraic complex:

$F_{2}\stackrel{{\scriptstyle\partial_{2}}}{{\to}}F_{1}\stackrel{{\scriptstyle\partial_{1}}}{{\to}}F_{0}$

From the Hurewicz isomorphism theorem, we know that

$\pi_{2}(X)\cong H_{2}(C_{*}(\tilde{X});\mathbb{Z}[G])\cong{\rm
Ker}\partial_{2}$

as (right) modules over $\mathbb{Z}[G]$. Hence $\pi_{2}(X)$ is easily attained
from $C_{*}(\tilde{X})$.

Now let $J$ be a module over $\mathbb{Z}[G]$, which is freely generated over
$\mathbb{Z}$. There is a $G$\- action on $J\otimes_{\mathbb{Z}}J$, given by
$(a\otimes b)g=ag\otimes bg$, making it a $\mathbb{Z}[G]$ module. Let $\sigma$
be the $\mathbb{Z}[G]$\- linear automorphism of $J\otimes_{\mathbb{Z}}J$
defined by $\sigma(a\otimes b)=b\otimes a$.

Definition 1.1 $S^{2}(J)=\\{x\in J\otimes J|\,\,\sigma x=x\\}$

We now state our main result:

Theorem A We have an isomorphism of $\mathbb{Z}[G]$ modules: $\pi_{3}(X)\cong
S^{2}(\pi_{2}(X))$

When $X$ is a finite connected 2- complex, Schanuel’s lemma tells us that the
stable class of $\pi_{2}(X)$ is determined by $G$. We prove an analogous
result for $\pi_{3}(X)$, under the added assumption that $G$ is finite, of odd
order:

Theorem B Let $X$ and $X^{\prime}$ be finite connected 2- complexes, with
finite fundamental group $G$. If the order of $G$ is odd, then $\pi_{3}(X)$
and $\pi_{3}(X^{\prime})$ are stably equivalent.

Also if $G$ is finite, of odd order we have the following result:

Theorem C Let $X$ be a finite connected $2$\- complex with finite fundamental
group $G$. If the order of $G$ is odd, then $\pi_{3}(X)\otimes\mathbb{Q}$ is
free over $\mathbb{Q}[G]$.

Definition 1.2 $G$\- quadratic A map $f:A\to B$ between $\mathbb{Z}[G]$
modules $A$, $B$, is $G$\- quadratic if given $a,b,c\in A$ and $g\in G$ we
have:

i) $f(-a)=f(a)$

ii) $f(a+b+c)=f(a+b)+f(a+c)+f(b+c)-f(a)-f(b)-f(c)$

iii) $f(ag)=f(a)g$

Lemma 1.3 Let $f:A\to B$ be $G$\- quadratic;

i) $f(0)=0$

ii) $f(a+b)+f(a-b)=2f(a)+2f(b)$

Proof: i) $f(0)=f(0+0+0)=0$
ii) $f(a+b)+f(a-b)=f(a+b)+f(a-b)+f(b-b)$
$=f(a+b-b)+f(a)+f(b)+f(-b)=2f(a)+2f(b)$ $\Box$

Take $J$ as before. We have a $G$\- quadratic map $q:J\to S^{2}(J)$ which maps
$\alpha\mapsto\alpha\otimes\alpha$, for any $\alpha\in J$. The main argument
of this paper will depend on a certain universal property of $q$, which we
mention as a preliminary.

Let $\\{\alpha_{i}|\,\,i\in I\\}$ be a basis for $J$ over $\mathbb{Z}$ for
some set $I$. Given $\alpha\in J$ we may write $\alpha=\sum_{i\in
I}\alpha_{i}\lambda_{i}$ with each $\lambda_{i}\in\mathbb{Z}$ and only
finitely many $\lambda_{i}$ non-zero. We define the norm of $\alpha$ to be
$\sum_{i\in I}|\lambda_{i}|$.

The $\\{\alpha_{i}\otimes\alpha_{j}|\,i,j\in I\\}$ are a basis for
$J\otimes_{\mathbb{Z}}J$ over $\mathbb{Z}$. So given $\omega\in S^{2}(J)$, we
may write $\omega=\sum_{i,j\in I}\lambda_{ij}\alpha_{i}\otimes\alpha_{j}$.
Clearly for each $i,j\in I$ we must have $\lambda_{ij}=\lambda_{ji}$. Hence
$S^{2}(J)$ is generated freely over $\mathbb{Z}$ by the
$\alpha_{i}\otimes\alpha_{i}$ and the
$\alpha_{i}\otimes\alpha_{j}+\alpha_{j}\otimes\alpha_{i}$, $i\neq j$.

For each $i,j\in I$ we have
$\alpha_{i}\otimes\alpha_{j}+\alpha_{j}\otimes\alpha_{i}=q(\alpha_{i}+\alpha_{j})-q(\alpha_{i})+q(\alpha_{j})$.
Hence another basis for $S^{2}(J)$ over $\mathbb{Z}$ is given by the
$q(\alpha_{i})$ and the $q(\alpha_{i}+\alpha_{j})$, $i\neq j$.

Lemma 1.4 The map $q:J\to S^{2}(J)$ is universal: Given any $G$\- quadratic
map $f:J\to M$, there exists a unique $\mathbb{Z}[G]$\- linear map
$\phi:S^{2}(J)\to M$ making the following diagram commute:

---
$\textstyle{J\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces}$$\scriptstyle{q}$$\scriptstyle{f}$$\textstyle{S^{2}(J)\ignorespaces\ignorespaces\ignorespaces\ignorespaces}$$\scriptstyle{\phi}$$\textstyle{M}$

Proof: We define $\phi$ linearly on a basis by:
$\phi q(\alpha_{i})=f(\alpha_{i})$
$\phi q(\alpha_{i}+\alpha_{j})=f(\alpha_{i}+\alpha_{j}),\,\,i\neq j$
Clearly no other map can make the diagram commute. It remains to show that
$\phi q=f$ and that $\phi$ is $\mathbb{Z}[G]$\- linear.
By lemma 1.3 ii) we have $\phi
q(\alpha_{i}-\alpha_{j})=f(\alpha_{i}-\alpha_{j})$. Hence, by construction we
have $\phi q(\alpha)=f(\alpha)$ for any $\alpha\in J$ with norm less than or
equal to $2$.
We proceed by induction. Suppose we have verified that $\phi
q(\alpha)=f(\alpha)$ for all $\alpha\in J$ with norm less than $r$, where
$r\geq 3$. Then consider any $\beta\in J$ with norm equal to $r$. We may write
$\beta=\alpha+x+y$ with $x=\pm\alpha_{i}$ and $y=\pm\alpha_{j}$ for some
$i,j\in I$, such that the norms of $\alpha$, $\alpha+x$, $\alpha+y$ are all
less than $r$.
Then property ii) of a $G$\- quadratic map implies that

$\phi q(\beta)=\phi q(\alpha+x+y)=f(\alpha+x+y)=f(\beta)$

So we have verified that $\phi q(\alpha)=f(\alpha)$ for all $\alpha\in J$ with
norm less than $r+1$. Hence by induction $\phi q=f$. It remains to show that
$\phi$ is $\mathbb{Z}[G]$\- linear.
By construction $\phi$ is $\mathbb{Z}$\- linear. Given $\alpha\in J$ we have
$\phi(q(\alpha)g)=\phi q(\alpha g)=f(\alpha g)=f(\alpha)g=(\phi q(\alpha))g$.
Any element of $S^{2}(J)$ is a $\mathbb{Z}$-linear combination of elements of
the form $q(\alpha)$, $\alpha\in J$. Hence $\phi$ is $\mathbb{Z}[G]$\- linear
on the whole of $S^{2}(J)$. $\Box$

In §2 we consider a general topological space $X$ with $\pi_{1}(X)=G$. We give
a construction for a $G$\- quadratic map $\pi_{2}(X)\to\pi_{3}(X)$. Whenever
$\pi_{2}(X)$ is freely generated over $\mathbb{Z}$ lemma 1.4 will therefore
give us a $\mathbb{Z}[G]$\- linear map $\phi:S^{2}(\pi_{2}(X))\to\pi_{3}(X)$.
In §3 we show that when $X$ is a connected 2- complex, this map is an
isomorphism.

§2 The Hopf fibration

Let $X$ be an arbitrary topological space with basepoint $*$. Let $G$ denote
$\pi_{1}(X)$. We will consider the map which the Hopf fibration $h:S^{3}\to
S^{2}$ induces on homotopy: $h^{*}:\pi_{2}(X)\to\pi_{3}(X)$. In particular we
will show that it is $G$\- quadratic.

We may regard $S^{3}$ as $\\{(z,w)\in\mathbb{C}^{2}|\,z\bar{z}+w\bar{w}=1\\}$.
Define a relation $\sim$, by setting $(z,w)\sim(z\lambda,w\lambda)$ whenever
$\lambda\in\mathbb{C}$ satisfies $\lambda\bar{\lambda}=1$.

Definition 2.1 Hopf fibration The Hopf fibration, $h:S^{3}\to S^{2}$ is the
natural map $S^{3}\to S^{3}/\sim$ composed with the identifications:
$S^{3}/\sim$ $\cong\mathbb{C}P^{1}\cong S^{2}$.

We take $(0,1)$ as basepoint of $S^{3}$ and let ${\tiny+}=h(0,1)\in S^{2}$ be
the basepoint of $S^{2}$. We define $h^{*}:\pi_{2}(X)\to\pi_{3}(X)$ to be the
map given by precomposition with $h$. As composition of maps is associative we
know that $h^{*}$ is natural:

Lemma 2.2 Let $f:X\to Y$ be a basepoint preserving continuous map of based
topological spaces. Then $h^{*}f_{*}=f_{*}h^{*}$.

We first show that $h^{*}$ satisfies property i) of a $G$\- quadratic map:

Lemma 2.3 Let $\alpha\in\pi_{2}(X)$. Then $h^{*}(-\alpha)=h^{*}(\alpha)$.

Proof: Let $R:S^{3}\to S^{3}$ be the rotation given by
$(z,w)\mapsto(\bar{z},\bar{w})$. Let $\hat{R}:S^{2}\to S^{2}$ be the
reflection induced on $S^{3}/\sim$. Then $R$ is homotopic to the identity
(keeping the basepoint $(0,1)$ fixed). So as elements of $\pi_{3}(X)$ we have:

$h^{*}(-\alpha)=\alpha\circ\hat{R}\circ h=\alpha\circ h\circ R=\alpha\circ
h=h^{*}(\alpha)$

$\Box$

Given $\alpha,\beta\in\pi_{2}(X)$, we follow [5], Chap. X, §7 by denoting
their Whitehead product $[\alpha,\beta]$. We also recall the following results
from that section:

Proposition 2.4 The Whitehead product satisfies:
i) (Naturality, see (7.2)) Given $\alpha,\beta\in\pi_{2}(X)$ we have
$f_{*}[\alpha,\beta]=[f_{*}\alpha,f_{*}\beta]$ for any continuous basepoint
preserving map $f:X\to Y$.
ii) (Commutativity, see (7.5)) Given $\alpha,\beta\in\pi_{2}(X)$ we have
$[\alpha,\beta]=[\beta,\alpha]$.
iii) (Biadditivity, see (7.12)) Given
$\alpha_{1},\alpha_{2},\beta\in\pi_{2}(X)$ we have:
$[\alpha_{1}+\alpha_{2},\beta]=[\alpha_{1},\beta]+[\alpha_{2},\beta]$ and
$[\beta,\alpha_{1}+\alpha_{2}]=[\beta,\alpha_{1}]+[\beta,\alpha_{2}]$.

Whitehead products are related to $h^{*}$ by the following result:

Lemma 2.5 $h^{*}(\alpha+\beta)=h^{*}(\alpha)+h^{*}(\beta)+[\alpha,\beta]$

Proof: See [5], Chap. XI, (1.16) and from (4.4) note that we may choose
conventions so that the Hopf invariant of $h$ is $1$. $\Box$

We may now prove that $h^{*}$ satisfies property ii) of a $G$\- quadratic map:

Lemma 2.6
$h^{*}(\alpha+\beta+\gamma)=h^{*}(\alpha+\beta)+h^{*}(\alpha+\gamma)+h^{*}(\beta+\gamma)$
$-h^{*}(\alpha)-h^{*}(\beta)-h^{*}(\gamma)$

Proof:
$h^{*}(\alpha+\beta+\gamma)=h^{*}(\alpha+\beta)+h^{*}(\gamma)+[\alpha+\beta,\gamma]$

$=h^{*}(\alpha+\beta)+h^{*}(\alpha+\gamma)+h^{*}(\beta+\gamma)-h^{*}(\alpha)-h^{*}(\beta)-h^{*}(\gamma)$

$\Box$

Finally it remains to show that $h^{*}$ respects the action of $G$. Let
$\alpha:S^{2}\to X$ represent an element of $\pi_{2}(X)$. We may identify the
complement of $+\in S^{2}$ with the interior of the closed unit disk
$D^{2}\subset\mathbb{R}^{2}$. $\alpha$ extends naturally to a map
$\alpha^{\prime}:D^{2}\to X$ which maps the boundary $\partial D^{2}$ to the
basepoint $*\in X$. Let $R_{\theta}$ denote a positive rotation of $D^{2}$
through the angle $\theta$.

We consider $h^{*}(\alpha):S^{3}\to X$. For each $(z,w)\in S^{3}$ we have a
fibre $\\{(\lambda z,\lambda w)|\,\lambda\bar{\lambda}=1\\}$. If $z\neq 0$
this fibre completes a revolution of the origin in the $w$\- plane as it
passes round the $z$\- plane. The fibre
$\\{(0,\lambda)|\,\lambda\bar{\lambda}=1\\}$ gets mapped to $*\in X$ by
$h^{*}(\alpha)$. We may deform $h^{*}(\alpha)$ to thicken this fibre. The
remaining fibres then form a solid torus. We may therefore represent
$h^{*}(\alpha)\in\pi_{3}(X)$ by the map $\alpha^{T}:S^{3}\to X$ defined as
follows:

Consider an unknotted solid torus $N\subset S^{3}$, not containing the
basepoint. We make an untwisted topological identification of $N$ with
$S^{1}\times D^{2}$. Then:

$\alpha^{T}(\theta,d)=\alpha^{\prime}(R_{\theta}(d))\,\qquad\qquad(\theta,d)\in
N$

$\alpha^{T}(p)\quad=\,*\quad\quad\quad\qquad\qquad\qquad\,p\notin N$

Let $I$ denote the closed unit interval and let $g:I\to X$ represent an
element of $\pi_{1}(X)$, so $g(0)=g(1)=*$. Then $g$ acts on $\alpha$ by
stretching it round the loop $g$. Formally we have $\alpha g:D^{2}\to X$
defined by:

$\alpha g(d)=\alpha^{\prime}(2d)\qquad\qquad\qquad\quad|d|\leq\frac{1}{2}$
$\alpha g(d)=g(2|d|-1)\,\quad\qquad\qquad|d|\geq\frac{1}{2}$

Let $K\subset S^{3}$ be a thickened torus (parameterized $T^{2}\times I$),
bounding $N$ and not enclosing the basepoint. Then $h^{*}(\alpha g)$ is
represented by the map $(\alpha g)^{T}:S^{3}\to X$, given by:

$(\alpha
g)^{T}(\theta,d)=\alpha^{\prime}(R_{\theta}(d))\,\qquad\qquad(\theta,d)\in N$

$(\alpha g)^{T}(t,\,i)\,=g(i)\,\qquad\qquad\,\,\,\qquad(t,\,i)\,\in K$

$(\alpha g)^{T}(p)\quad=\,*\,\,\,\,\quad\qquad\qquad\qquad\,p\,\notin N,K$

Let $L\subset S^{3}$ be a thickened sphere (parameterized $S^{2}\times I$),
enclosing $N$ and not enclosing the basepoint. The group element $g$ acts on
an element of $\pi_{3}(X)$ by stretching it round the loop $g$. Formally,
$h^{*}(\alpha)g$ is represented by the map $\alpha^{T}g:S^{3}\to X$, given by:

$\alpha^{T}g(\theta,d)=\alpha^{\prime}(R_{\theta}(d))\,\qquad\qquad(\theta,d)\in
N$

$\alpha^{T}g(s,\,i)\,=g(i)\,\qquad\qquad\,\,\,\qquad(s,\,i)\in L$

$\alpha^{T}g(p)\quad=\,*\,\,\,\,\quad\qquad\qquad\qquad\,p\,\notin N,L$

Lemma 2.7 Let $g$ be an element of $\pi_{1}(X)$ and let $\alpha$ be an element
of $\pi_{2}(X)$. Then $h^{*}(\alpha)g=h^{*}(\alpha g)$.

Proof: We must show that $\alpha^{T}g$ is homotopic to $(\alpha g)^{T}$. Let
$C\subset S^{3}$ be a solid cylinder which passes through the hole in the
solid torus $N$ and passes through the thickened sphere $L$ on either side of
this hole.

We may parameterize $C$ as $D^{2}\times I$ so that for $(d,i)\in C$, we have

$\alpha^{T}g(d,i)=m(i)$

where $m=e\cdot g^{-1}\cdot e\cdot g\cdot e$. We define a homotopy $m_{t}$,
$t\in I$, from $m$ to $e$:

$m_{t}(i)=g(5r-.5)\qquad\qquad\quad r\in[.1,.3]$

$m_{t}(i)=*\,\,\,\,\,\qquad\qquad\qquad\qquad r\notin[.1,.3]$

where $r=\sqrt{t^{2}+(i-.5)^{2}}$.

We next construct a homotopy $f_{t}$ with $f_{0}=\alpha^{T}g$, which is
constant outside $C$. Inside $C$ it is given by:

$f_{t}(d,i)=m_{(1-|d|)t}(i)$

Thus intuitively $f$ pulls together two regions of the thickened sphere $L$
through the hole in the solid torus $N$, so that they cancel out, leaving a
thickened torus as required.

$\Box\,\,$

We may conclude:

Proposition 2.8 $h^{*}$ is a $G$\- quadratic map.

Proof: We get property i) from lemma 2.3, property ii) from lemma 2.6 and
property iii) from lemma 2.7.

$\Box\,\,$

§3 $\pi_{3}$ of a connected $2$\- complex

We now restrict to the case where $X$ is a connected 2- complex with basepoint
$*$ and $\pi_{1}(X)=G$. The universal cover of $X$ is a simply connected 2-
complex and hence a Moore space.

As $H_{2}(\tilde{X};\mathbb{Z})$ is a submodule of the free $\mathbb{Z}$\-
module generated by the 2- cells of $\tilde{X}$, we have
$H_{2}(\tilde{X};\mathbb{Z})\cong\mathbb{Z}^{I}$ for some set $I$ (see [3],
Chap. IV, Theorem 6.1).

From [1], Lemma 1.3.1, we know that up to homotopy there is a unique CW
complex of type $M(\mathbb{Z}^{I},2)$. Hence we have a homotopy equivalence:

$\bigvee_{i\in I}S^{2}_{i}\to\tilde{X}$

preserving basepoint (which we take to be $\bigcap_{i\in I}S^{2}_{i}$).

Composing with the covering map $\tilde{X}\to X$, we obtain a map
$m:\bigvee_{i}S^{2}_{i}\to X$. For $n>1$, the map $m$ induces an isomorphism
$\pi_{n}(\bigvee_{i}S^{2}_{i})\to\pi_{n}(X)$.

For $j\in I$ let $w_{j}:S^{2}\to\bigvee_{i}S^{2}_{i}$ be a homeomorphism onto
$S^{2}_{j}$, preserving basepoint.

Lemma 3.1 i) $\pi_{2}(\bigvee_{i}S^{2}_{i})$ is freely generated over
$\mathbb{Z}$ by the $w_{i}$.
ii) $\pi_{3}(\bigvee_{i}S^{2}_{i})$ is freely generated over $\mathbb{Z}$ by
the $h^{*}(w_{i})$ and the $[w_{i},w_{j}]$, $i\neq j$.

Proof: For i) see [2], Example 4.26 and for ii) see [2], Example 4.52. $\Box$

Let $\alpha_{i}=m_{*}(w_{i})$ for $i\in I$. As $m_{*}$ is an isomorphism
$\pi_{2}(\bigvee_{i}S^{2}_{i})\to\pi_{2}(X)$, we know the $\alpha_{i}$ freely
generate $\pi_{2}(X)$ over $\mathbb{Z}$.

Lemma 3.2 We have a $\mathbb{Z}$\- basis for $\pi_{3}(X)$ given by the
$h^{*}(\alpha_{i})$ and the $h^{*}(\alpha_{i}+\alpha_{j})$, $i\neq j$.

Proof: As $m_{*}$ is an isomorphism
$\pi_{3}(\bigvee_{i}S^{2}_{i})\to\pi_{3}(X)$, the $m_{*}(h^{*}(w_{i}))$ and
the $m_{*}[w_{i},w_{j}]$ freely generate $\pi_{3}(X)$ over $\mathbb{Z}$. By
lemma 2.2 and proposition 2.4i) as well as lemma 2.5 we have:

$m_{*}(h^{*}(w_{i}))=h^{*}(\alpha_{i})$ $\forall i$
$m_{*}[w_{i},w_{j}]\,\,\,=[\alpha_{i},\alpha_{j}]=h^{*}(\alpha_{i}+\alpha_{j})-h^{*}(\alpha_{i})-h^{*}\alpha_{j}$
$\forall i\neq j$ $\Box$

By lemma 1.4 we have a $\mathbb{Z}[G]$\- linear map
$\phi:S^{2}(\pi_{2}(X))\to\pi_{3}(X)$ which satisfies $\phi q=h^{*}$.

Lemma 3.3 $\phi$ is an isomorphism.

Proof: Recall that the $q(\alpha_{i})$ and the $q(\alpha_{i}+\alpha_{j})$,
$i\neq j$ form a $\mathbb{Z}$\- basis for $S^{2}(\pi_{2}(X))$. It is
sufficient to show that $\phi$ maps this basis to a $\mathbb{Z}$\- basis of
$\pi_{3}(X)$. By construction, $\phi q(\alpha_{i})=h^{*}(\alpha_{i})$ and
$\phi q(\alpha_{i}+\alpha_{j})=h^{*}(\alpha_{i}+\alpha_{j})$. By lemma 3.2 the
$h^{*}(\alpha_{i})$ and the $h^{*}(\alpha_{i}+\alpha_{j})$, $i\neq j$, form a
$\mathbb{Z}$\- basis of $\pi_{3}(X)$ as required. $\Box$

From this lemma we may conclude our Theorem A:

Theorem A We have an isomorphism of $\mathbb{Z}[G]$ modules: $\pi_{3}(X)\cong
S^{2}(\pi_{2}(X))$

§4 The effect of stabilizing $\pi_{2}$.

Let $X$ be a finite connected $2$\- complex with finite fundamental group $G$.
Let $X^{\prime}$ be another finite connected $2$\- complex with fundamental
group $G$. By Schanuel’s lemma we know that there exist integers $a,b$ such
that

$\pi_{2}(X)\oplus\mathbb{Z}[G]^{a}\cong\pi_{2}(X^{\prime})\oplus\mathbb{Z}[G]^{b}$

In this section we investigate the corresponding relationship between
$\pi_{3}(X)$ and $\pi_{3}(X^{\prime})$.

If we let $J=\pi_{2}(X)$ and $J^{\prime}=\pi_{2}(X^{\prime})$, then from
Theorem A we have
$\pi_{3}(X)\cong S^{2}(J)$ and $\pi_{3}(X^{\prime})\cong S^{2}(J^{\prime})$.
We know that

$S^{2}(J\oplus\mathbb{Z}[G]^{a})\cong
S^{2}(J^{\prime}\oplus\mathbb{Z}[G]^{b})$

The next few lemmas give us an expansion of this.

Lemma 4.1 Let $A_{i}$, $i=1,\cdots,n$, be modules over $\mathbb{Z}[G]$ with
finitely generated free underlying Abelian groups. Then

$S^{2}(\bigoplus_{i=1}^{n}A_{i})=\bigoplus_{i=1}^{n}S^{2}(A_{i})\oplus\bigoplus_{i<j}A_{i}\otimes_{\mathbb{Z}}A_{j}$

Proof: For each $i$, let the $\boldsymbol{e_{i,r}}$ be a basis over
$\mathbb{Z}$ for $A_{i}$. Then $S^{2}(\bigoplus_{i=1}^{n}A_{i})$ is freely
generated over $\mathbb{Z}$, by elements of the form:

$\boldsymbol{e_{i,r}}\otimes\boldsymbol{e_{i,r}}$,
$\boldsymbol{e_{i,r}}\otimes\boldsymbol{e_{i,s}}+\boldsymbol{e_{i,s}}\otimes\boldsymbol{e_{i,r}}\qquad\qquad\qquad
r<s$,
$\boldsymbol{e_{i,r}}\otimes\boldsymbol{e_{j,s}}+\boldsymbol{e_{j,s}}\otimes\boldsymbol{e_{i,r}}\qquad\qquad\qquad
i<j$,

For each $i$, the $\mathbb{Z}$\- linear span of the

$\boldsymbol{e_{i,r}}\otimes\boldsymbol{e_{i,r}}$,
$\boldsymbol{e_{i,r}}\otimes\boldsymbol{e_{i,s}}+\boldsymbol{e_{i,s}}\otimes\boldsymbol{e_{i,r}}\qquad\qquad\qquad
r<s$,

is closed under the group action and is isomorphic (over $\mathbb{Z}[G]$) to
$S^{2}(A_{i})$.

Similarly, for each pair $i,j$, with $i<j$, the $\mathbb{Z}$\- linear span of
the

$\boldsymbol{e_{i,r}}\otimes\boldsymbol{e_{j,s}}+\boldsymbol{e_{j,s}}\otimes\boldsymbol{e_{i,r}}\qquad\qquad\qquad\forall
r,s$

is closed under the group action. Furthermore we have an isomorphism (over
$\mathbb{Z}[G]$) from it to $A_{i}\otimes_{\mathbb{Z}}A_{j}$, which maps:

$\boldsymbol{e_{i,r}}\otimes\boldsymbol{e_{j,s}}+\boldsymbol{e_{j,s}}\otimes\boldsymbol{e_{i,r}}\quad\mapsto\quad\boldsymbol{e_{i,r}}\otimes\boldsymbol{e_{j,s}}$

So over $\mathbb{Z}[G]$, the module $S^{2}(\bigoplus_{i=1}^{n}A_{i})$
decomposes into the sum:

$\bigoplus_{i=1}^{n}S^{2}(A_{i})\oplus\bigoplus_{i<j}A_{i}\otimes_{\mathbb{Z}}A_{j}$

$\Box\,\,$

Lemma 4.2 Let $A$ be a $\mathbb{Z}[G]$ module whose underlying Abelian group
is isomorphic to $\mathbb{Z}^{k}$. Then
$A\otimes_{\mathbb{Z}}\mathbb{Z}[G]\cong\mathbb{Z}[G]^{k}$.

Proof: The action of an element $g\in G$ on $A$ is a $\mathbb{Z}$\- linear
isomorphism. Hence, if $\boldsymbol{e_{1}},\cdots,\boldsymbol{e_{k}}$ is a
$\mathbb{Z}$\- linear basis for $A$, then so is
$\boldsymbol{e_{1}}g,\cdots,\boldsymbol{e_{k}}g$. Hence
$A\otimes_{\mathbb{Z}}\mathbb{Z}[G]$ is freely generated over $\mathbb{Z}$ by
elements of the form $\boldsymbol{e_{i}}g\otimes g$, for $g\in G$ and
$i\in\\{1,\cdots,k\\}$.

For each $i$, the $\mathbb{Z}$ linear span of the $\boldsymbol{e_{i}}g\otimes
g$, $g\in G$, is closed under the action of $G$. Furthermore, we have a
$\mathbb{Z}[G]$\- linear isomorphism from it to $\mathbb{Z}[G]$, which maps
$\boldsymbol{e_{i}}g\otimes g\mapsto g$.

Hence,

$A\otimes_{\mathbb{Z}}\mathbb{Z}[G]\cong\bigoplus_{i=1}^{k}\mathbb{Z}[G]\cong\mathbb{Z}[G]^{k}$

$\Box\,\,$

Let $p$ denote the number of pairs, $\\{g,g^{-1}\\}\in G$, with $g\neq
g^{-1}$. Let $T$ denote the set of $g\in G$ with $g$ having order $2$.

Definition 4.3 For a finite group $G$, we set

$V_{G}=\bigoplus_{t\in T}(1+t)\mathbb{Z}[G]$

Lemma 4.4 $S^{2}(\mathbb{Z}[G])\cong\mathbb{Z}[G]^{1+p}\oplus V_{G}$

Proof: Let the the elements of $G$ be ordered. We have a $\mathbb{Z}$\- basis
for $S^{2}(\mathbb{Z}[G])$ given by:

$(e\otimes e)h$ $h\in G\qquad\qquad\qquad\qquad\qquad$
$(e\otimes g+g\otimes e)h$ $g<g^{-1},\,\quad h\in
G\qquad\qquad\qquad\qquad\qquad$
$(e\otimes t+t\otimes e)h$ $t\in T,\quad h<th\qquad\qquad\qquad\qquad\qquad$

The $\mathbb{Z}$\- linear span of the $\\{(e\otimes e)h|\,\,h\in G\\}$ is
isomorphic (over $\mathbb{Z}[G]$) to $\mathbb{Z}[G]$. Also, for $g<g^{-1}$,
the $\mathbb{Z}$\- linear span of the $\\{(e\otimes g+g\otimes e)h|\,\,h\in
G\\}$ is isomorphic (over $\mathbb{Z}[G]$) to $\mathbb{Z}[G]$.

Given $t\in T$, the $\mathbb{Z}$\- linear span of the $\\{(e\otimes t+t\otimes
e)h|\,\,h<th\\}$ is isomorphic to $(e\otimes
t)(1+t)\mathbb{Z}[G]\subset\mathbb{Z}[G]\otimes_{\mathbb{Z}}\mathbb{Z}[G]$.

Finally note that as $(e\otimes t)\mathbb{Z}[G]\cong\mathbb{Z}[G])$, we have
$(e\otimes t)(1+t)\mathbb{Z}[G]\cong(1+t)\mathbb{Z}[G]$.

$\Box\,\,$

Note that for $\mathbb{Z}[G]$\- modules $A$, $B$, we have a $\mathbb{Z}[G]$\-
linear isomorphism
$A\otimes_{\mathbb{Z}}B\to B\otimes_{\mathbb{Z}}A$, given by sending
$\boldsymbol{a}\otimes\boldsymbol{b}\mapsto\boldsymbol{b}\otimes\boldsymbol{a}$.

Using lemma 4.1 to expand the identity $S^{2}(J\oplus\mathbb{Z}[G]^{a})\cong
S^{2}(J^{\prime}\oplus\mathbb{Z}[G]^{b})$ we obtain:

$\quad\,\,S^{2}(J)\oplus
S^{2}(\mathbb{Z}[G])^{a}\oplus(J\otimes_{\mathbb{Z}}\mathbb{Z}[G])^{a}\oplus(\mathbb{Z}[G]\otimes_{\mathbb{Z}}\mathbb{Z}[G])^{a(a-1)/2}$
$\cong S^{2}(J^{\prime})\oplus
S^{2}(\mathbb{Z}[G])^{b}\oplus(J^{\prime}\otimes_{\mathbb{Z}}\mathbb{Z}[G])^{b}\oplus(\mathbb{Z}[G]\otimes_{\mathbb{Z}}\mathbb{Z}[G])^{b(b-1)/2}$

Let $k$ denote the $\mathbb{Z}$\- rank of $J$, and let $k^{\prime}$ denote the
$\mathbb{Z}$\- rank of $J^{\prime}$. Also let $n$ denote the order of $G$. By
Theorem A we have $S^{2}(J)\cong\pi_{3}(X)$ and
$S^{2}(J^{\prime})\cong\pi_{3}(X^{\prime})$. Applying lemmas 4.2 and 4.4 to
the equation above gives:

$\quad\,\pi_{3}(X)\oplus(\mathbb{Z}[G]^{1+p}\oplus
V_{G})^{a}\oplus\mathbb{Z}[G]^{ka}\oplus\mathbb{Z}[G]^{na(a-1)/2}$
$\cong\pi_{3}(X^{\prime})\oplus(\mathbb{Z}[G]^{1+p}\oplus
V_{G})^{b}\oplus\mathbb{Z}[G]^{k^{\prime}b}\oplus\mathbb{Z}[G]^{nb(b-1)/2}$

So:

$\pi_{3}(X)\oplus\mathbb{Z}[G]^{(1+p+k+n(a-1)/2)a}\oplus{V_{G}}^{a}\cong\pi_{3}(X^{\prime})\oplus\mathbb{Z}[G]^{(1+p+k^{\prime}+n(b-1)/2)b}\oplus{V_{G}}^{b}$

Theorem 4.5 Let $X$ and $X^{\prime}$ be finite connected $2$\- complexes, with
finite fundamental group $G$. Then there exist integers $a,b,q,r$ such that:

$\pi_{3}(X)\oplus\mathbb{Z}[G]^{q}\oplus{V_{G}}^{a}\cong\pi_{3}(X^{\prime})\oplus\mathbb{Z}[G]^{r}\oplus{V_{G}}^{b}$

Note that if the order of $G$ is odd then it does not contain any elements of
order $2$. Hence $V_{G}=0$ and we have obtained Theorem B:

Theorem B Let $X$ and $X^{\prime}$ be finite connected 2- complexes, with
finite fundamental group $G$. If the order of $G$ is odd, then $\pi_{3}(X)$
and $\pi_{3}(X^{\prime})$ are stably equivalent.

§5 Calculating $S^{2}(IG^{*}$)

Again let $X$ be a finite connected $2$\- complex with finite fundamental
group $G$. Rationally we have $\pi_{2}(X)\otimes\mathbb{Q}\cong
IG^{*}\otimes\mathbb{Q}\oplus\mathbb{Q}[G]^{m}$, for some $m\geq 0$.
Consequently $\pi_{3}(X)\otimes\mathbb{Q}\cong
S^{2}(IG^{*}\oplus\mathbb{Z}[G]^{m})\otimes\mathbb{Q}$ as modules over
$\mathbb{Q}[G]$. For this reason we examine $S^{2}(IG^{*})$.

We will then conclude by considering some examples where $\pi_{2}(X)$ actually
equals $IG^{*}$. For this to happen the group $G$ must necessarily have a
balanced presentation and free period 4.

$IG^{*}$ is defined by the short exact sequence:

$0\to\mathbb{Z}\to\mathbb{Z}[G]\stackrel{{\scriptstyle\delta}}{{\to}}IG^{*}\to
0$

where $1\in\mathbb{Z}$ is mapped to $\sum_{g\in G}g\in\mathbb{Z}[G]$, denoted
$\Sigma$.

We now consider the $\mathbb{Z}[G]$\- linear surjection
$\delta^{\prime}:S^{2}(\mathbb{Z}[G])\to S^{2}(IG^{*})$ defined by:
$\,\,\qquad\qquad\qquad\qquad g\otimes
g\qquad\,\mapsto\quad\,\,\delta(g)\otimes\delta(g)$

$\quad\qquad\qquad\qquad\qquad\qquad g\otimes h+h\otimes
g\mapsto\delta(g)\otimes\delta(h)+\delta(h)\otimes\delta(g)$

Lemma 5.1 The kernel of $\delta^{\prime}$ is generated over $\mathbb{Z}[G]$,
by $\Sigma\otimes e+e\otimes\Sigma$ and $\Sigma\otimes\Sigma$.

Proof: We may take a $\mathbb{Z}$\- basis for $\mathbb{Z}[G]$ given by
$\\{g\in G|\,\,g\neq e\\}\sqcup\\{\Sigma\\}$. We have a $\mathbb{Z}$\- basis
for $IG^{*}$ given by $\\{p(g)|\,\,g\in G,g\neq e\\}$.

These basis’ induce basis’ on $S^{2}(\mathbb{Z}[G])$ and $S^{2}(IG^{*})$
respectively. We have:

$\delta^{\prime}(\Sigma\otimes\Sigma)=0$

$\delta^{\prime}(g\otimes\Sigma+\Sigma\otimes g)=0\qquad\qquad g\neq e$

and $\delta^{\prime}$ maps the other elements of the induced basis for
$S^{2}(\mathbb{Z}[G])$ to elements of the induced basis for $S^{2}(IG^{*})$.

Hence the kernel of $\delta^{\prime}$ is generated over $\mathbb{Z}$ by
$\Sigma\otimes\Sigma$ and $g\otimes\Sigma+\Sigma\otimes g$, $g\neq e$. Clearly
this is contained in the $\mathbb{Z}[G]$ linear span of $\Sigma\otimes
e+e\otimes\Sigma$ and $\Sigma\otimes\Sigma$.

$\Box\,\,$

Let $u=e\otimes\Sigma+\Sigma\otimes e$. Then we have the kernel of
$\delta^{\prime}$ generated over $\mathbb{Z}[G]$ by $\\{u,u\Sigma/2\\}$. Note
that $u\mathbb{Z}[G]\cong\mathbb{Z}[G]$.

As $u\Sigma/2$ is in the $\mathbb{Q}[G]$\- linear span of $u$, the kernel of
$\delta^{\prime}\otimes\mathbb{Q}:S^{2}(\mathbb{Q}[G])\to
S^{2}(IG^{*})\otimes\mathbb{Q}$ is generated by $u$. We therefore have a short
exact sequence:

$0\to\mathbb{Q}[G]\to S^{2}(\mathbb{Q}[G])\to
S^{2}(IG^{*})\otimes\mathbb{Q}\to 0$

As surjections over $\mathbb{Q}[G]$ split and cancellation of finitely
generated modules holds over $\mathbb{Q}[G]$, we may write:

$S^{2}(IG^{*})\otimes\mathbb{Q}\cong S^{2}(\mathbb{Q}[G])/\mathbb{Q}[G]$

Rationally, for some $a\in\mathbb{Z}$,
$\pi_{2}(X)\otimes\mathbb{Q}\cong(IG^{*}\otimes\mathbb{Q})\oplus\mathbb{Q}[G]^{a}$.
Consequentially, we have:

$\pi_{3}(X)\otimes\mathbb{Q}\cong S^{2}(\pi_{2}(X))\otimes\mathbb{Q}\cong
S^{2}(\pi_{2}(X)\otimes\mathbb{Q})\cong
S^{2}(IG^{*}\oplus\mathbb{Z}[G]^{a})\otimes\mathbb{Q}$

From lemmas 4.1, 4.2 and 4.4, for some $q\in\mathbb{Z}$ we have:

$S^{2}(IG^{*}\oplus\mathbb{Z}[G]^{a})\otimes\mathbb{Q}\cong(S^{2}(IG^{*})\otimes
Q)\oplus\mathbb{Q}[G]^{q}\oplus(V_{G}\otimes\mathbb{Q})^{a}$

As
$S^{2}(IG^{*})\otimes\mathbb{Q}\cong(S^{2}(\mathbb{Z}[G])\otimes\mathbb{Q})/\mathbb{Q}[G]$,
from lemma 4.4 we may conclude:

Theorem 5.2

$\pi_{3}(X)\otimes\mathbb{Q}\cong\mathbb{Q}[G]^{p+q}\oplus(V_{G}\otimes\mathbb{Q})^{a+1}$

Again if the order of $G$ is odd then $V_{G}=0$ so we obtain our Theorem C:

Theorem C Let $X$ be a finite connected $2$\- complex with finite fundamental
group $G$. If the order of $G$ is odd, then $\pi_{3}(X)\otimes\mathbb{Q}$ is
free over $\mathbb{Q}[G]$.

Let $S$ be a subset of $G$, containing precisely one of $g$ or $g^{-1}$, for
each pair $g,g^{-1}$, with $g\neq g^{-1}$. Let $\boldsymbol{e_{g}}=g\otimes
e+e\otimes g$ for each $g\in S$. Let $\boldsymbol{e_{t}}=t\otimes e+e\otimes
t$ for each $t\in T$. Let $\boldsymbol{e_{0}}=e\otimes e$. Then from the proof
of lemma 4.4 we have:

$S^{2}(\mathbb{Z}[G])=\boldsymbol{e_{0}}\mathbb{Z}[G]\oplus\bigoplus_{g\in
S}{e_{g}}\mathbb{Z}[G]\oplus\bigoplus_{t\in T}\boldsymbol{e_{t}}\mathbb{Z}[G]$

Also,

$u=e\otimes\Sigma+\Sigma\otimes e=\boldsymbol{e_{0}}2+\sum_{g\in
S}\boldsymbol{e_{g}}(1+g^{-1})+\sum_{t\in T}\boldsymbol{e_{t}}$

and

$S^{2}(IG^{*})=\frac{S^{2}(\mathbb{Z}[G])}{\quad<u,u{\frac{\Sigma}{2}}>}$

The relation $u=0$ is equivalent to $\boldsymbol{e_{0}}2=-(\sum_{g\in
S}\boldsymbol{e_{g}}(1+g^{-1})+\sum_{t\in T}\boldsymbol{e_{t}})$.

For $t\in T$, we let $S_{t}\in\mathbb{Z}[G]$ be some element satisfying
$(1+t)S_{t}=\Sigma$. Hence we have $\boldsymbol{e_{t}}S_{t}=(e\otimes
t)(1+t)S_{t}=(e\otimes t)\Sigma=(e\otimes
t)(1+t)\Sigma/2=\boldsymbol{e_{t}}\Sigma/2$.

The relation $u\Sigma/2=0$ is equivalent to
$\boldsymbol{e_{0}}\Sigma=-(\sum_{g\in S}\boldsymbol{e_{g}}\Sigma+\sum_{t\in
T}\boldsymbol{e_{t}}S_{t})$.

Let

$M=\bigoplus_{g\in S}\boldsymbol{e_{g}}\mathbb{Z}[G]\oplus\bigoplus_{t\in
T}\boldsymbol{e_{t}}\mathbb{Z}[G]$

and let $\boldsymbol{u_{M}}=-(\sum_{g\in
S}\boldsymbol{e_{g}}(1+g^{-1})+\sum_{t\in T}\boldsymbol{e_{t}})$.

Proposition 5.3 If $\pi_{2}{X}=IG^{*}$ then
$\pi_{3}(X)=M[\frac{\boldsymbol{u_{M}}}{2}]$.

Proof: We need to check that $\frac{\boldsymbol{u_{M}}}{2}$ satisfies the
relations which $\boldsymbol{e_{0}}$ was subject to:

$\frac{\boldsymbol{u_{M}}}{2}2\,=-(\sum_{g\in
S}\boldsymbol{e_{g}}(1+g^{-1})+\sum_{t\in T}\boldsymbol{e_{t}})$

$\frac{\boldsymbol{u_{M}}}{2}\Sigma=-(\sum_{g\in
S}\boldsymbol{e_{g}}\Sigma+\sum_{t\in T}\boldsymbol{e_{t}}S_{t})$ $\Box$

Example 5.4 $G=C_{3}$ and $X$ is the Cayley complex associated to the balanced
presentation: $<\\!x|\,\,x^{3}=e\\!>$.

From [4], 41(i) we have $\pi_{2}(X)=IG^{*}$. Hence:

$\pi_{3}(X)\cong
S^{2}(IG^{*})\cong\boldsymbol{e_{x^{2}}}\mathbb{Z}[G][(1+x)/2]\cong\mathbb{Z}[G][\frac{(1+x)}{2}]$

Example 5.5 $G=Q_{8}$ and $X$ is the Cayley complex associated to the balanced
presentation: $<\\!x,\,y|\,\,x^{2}=y^{2},\,xyx=y\\!>$.

Again from [4], 41(iii) we have $\pi_{2}(X)=IG^{*}$. There is only one element
of order two in $Q_{8}$ so we have:

$\pi_{3}(X)\cong
S^{2}(IG^{*})\cong(\boldsymbol{e_{x}}\mathbb{Z}[G]\oplus\boldsymbol{e_{y}}\mathbb{Z}[G]\oplus\boldsymbol{e_{xy}}\mathbb{Z}[G]\oplus\boldsymbol{e_{y^{2}}}\mathbb{Z}[G])[\frac{\boldsymbol{u_{M}}}{2}]$

where
$\boldsymbol{u_{M}}=-(\boldsymbol{e_{x}}(1+x^{3})+\boldsymbol{e_{y}}(1+y^{3})+\boldsymbol{e_{xy}}(1+xy^{3})+\boldsymbol{e_{y^{2}}})$.

Recall from the proof of lemma 4.4 that:

$\boldsymbol{e_{x}}\mathbb{Z}[G]\cong\boldsymbol{e_{y}}\mathbb{Z}[G]\cong\boldsymbol{e_{xy}}\mathbb{Z}[G]\cong\mathbb{Z}[G],\qquad\qquad\boldsymbol{e_{y^{2}}}\mathbb{Z}[G]\cong(1+y^{2})\mathbb{Z}[G]$

## References

  * [1] Hans-Joachim Baues, Homotopy Type and Homology (OUP, 1996)
  * [2] Allen Hatcher, Algebraic Topology (CUP, 2002)
  * [3] Thomas W. Hungerford, Algebra (GTM 73, 1974)
  * [4] F.E.A. Johnson, Stable Modules and the D(2)- Problem (LMS 301, 2003)
  * [5] George W. Whitehead, Elements of Homotopy Theory (GTM 61, 1978)