11institutetext:  Technische Universität Wien, Vienna, Austria
11email<EMAIL_ADDRESS>22institutetext: IST Austria,
Klosterneuburg, Austria
22email: {tah<EMAIL_ADDRESS>33institutetext: AIT Austrian Institute of
Technology, Vienna, Austria
33email<EMAIL_ADDRESS>
# Information-flow Interfaces and
Security Lattices

Ezio Bartocci 11 Thomas A. Henzinger 22
Dejan Nickovic 33 Ana Oliveira da Costa(✉) 22

###### Abstract

Information-flow interfaces is a formalism recently proposed for specifying,
composing, and refining system-wide security requirements. In this work, we
show how the widely used concept of security lattices provides a natural
semantic interpretation for information-flow interfaces.

##  1 Introduction

Modern information and communication technologies are reaching unprecedented
size and complexity, exposing them more and more to a wide variety of cyber-
attacks. The security-by-design engineering approach addresses this problem by
enforcing security requirements throughout all phases of the design cycle,
including early design stages.

_Information-flow interfaces_ [3, 4] is a recently introduced security-by-
design formalism for the compositional development of systems that are
guaranteed to implement specified information-flow policies. This formalism
defines information-flow requirements using _no-flow_ relations. A no-flow
relation specifies a forbidden exchange of information from one system
variable to another. This framework allows the engineer to combine _top-down_
and _bottom-up_ design activities: a top-down step consists of decomposing the
system-wide requirements and mapping them to sub-systems and components, while
a bottom-up step consists of assembling the system by combining available
elements. To support the compositional design of systems, information-flow
interfaces distinguish between _assumptions_ about the component’s environment
and _guarantees_ that the component provides when it operates in a proper
environment. In addition, information-flow interfaces satisfy the two main
properties of an interface theory: _incremental design_ and _independent
implementability_. Incremental design enables composing sub-systems and
components without knowing the complete design context. Independent
implementability allows the development of sub-systems by different design
teams with system integration that guarantees the preservation of system-level
requirements.

We illustrate the top-down design using information-flow interfaces with an
automotive example – a simplified version of a shared communication
infrastructure connecting a wheel sensor and distance warners to the braking
system and the odometer [3]. The shared communication infrastructure consists
of (1) two (front and back) distance warners, which are sensors that estimate
the proximity of the vehicle to other objects; (2) the wheel sensor, which
senses the wheel rotations; (3) the odometer, a component that uses the wheel
sensor data to measure the distance travelled by a vehicle; (4) a braking
system, which takes the decision when to brake based on the information from
the distance warners and (5) a shared bus that enables the communication
between the other components. In this example, the braking system has a
safety-critical function; consequently, communication with the distance
warners has high-integrity. In contrast, the odometer and wheel sensor
communication has low-integrity requirement. The main system-level requirement
for this system is to guarantee the integrity of the communication channel
when performing the safety-critical function. In other words, the design
forbids any flow of information from the wheel sensor to the braking system.

distw_f_tdistw_b_todometer _Receiving_ wheel_tickdistw_b_sdistw_f_s _Sending_
distw_b_tdistw_f_t _Bus_
odometerdistw_f_sdistw_b_sdistw_f_sodometerdistw_b_tdistw_b_sdistw_f_twheel_tickwheel_tick

Figure 1: An example of an automotive shared communication infrastructure
specified with information-flow interfaces.

Figure 1 shows (a) the system-level interface specifying the above
information-flow requirements and (b) one decomposition and refinement step.
We depict an interface with a gray rounded-edged box. The white and black
rectangles attached to the interface denote its input and output ports,
respectively. We use dashed arrows to specify no-flow relations. A no-flow
relation is an assumption if its target is an input port and a guarantee
otherwise. The system-level security requirement from Figure 1 (a) consists of
two no-flow relations that forbid the exchange of information between the
wheel sensor and the front and back distance warner targets. We observe that
this interface specifies the properties of a closed system without defining
its components and their interaction.

In the refinement step, shown in Figure 1 (b), the interface is decomposed
into three sub-systems: sending, receiving and bus. The two system-level
requirements are naturally transferred to the bus sub-system. However, mapping
these two properties from the system-level interface to the bus interface is
not sufficient to enforce the original requirements. Without additional
restrictions, there would be for instance an allowed flow in the decomposed
system from the wheel sensor to the odometer, from the odometer to the
distance wheeler sources, and from the sources to the distance wheeler
targets, resulting in the violation of the system level requirements. To
guarantee the enforcement of the system-level requirement after integration of
sub-systems, we need to add additional assumptions (no-flow relations from the
odometer and the wheel sensor to the distance wheelers in the bus sub-system)
and guarantees (no-flow relations from the wheel sensor to the distance
wheelers). In the subsequent design step, these three interfaces can be either
further decomposed into smaller components, or assigned to different design
teams for implementation.

Information-flow interfaces follow a declarative style of specification with
the focus on what are the forbidden flows of information between system
variables, rather then on how to guarantee the absence of the specified flows.
This is a design choice that gives a syntactic flavor to the interface theory
and its operations – composition of interfaces and their refinement consist of
manipulating no-flow relations only. The advantage of this approach is that it
enables simple incremental development of secure system architectures, while
allowing to postpone semantic and implementation choices for the components to
the later design stages. Information-flow interfaces have been equipped with a
semantic interpretation in terms of _contracts_ defined as pairs of
assumptions and guarantees being sets of _flow relations_ [4].

In this paper, we propose _security lattices_ as an alternative semantic
interpretation for information-flow interfaces. Equipping this interface
theory with semantics based on security lattices has two major advantages.
First, security lattices are commonly used in the security community for
specifying information-flow and other security-related policies [10, 9, 7, 2,
1]. Therefore, their integration into the interface theory facilitates the
security engineers’ adoption of the compositional design framework. Second,
the information-flow theory’s compositional nature can help improve the
efficiency of verification mechanisms whose performance depends on the shape
of the lattice (e.g., number of labels, number of interactions between labels,
…). By using the information-flow interfaces equipped with security lattices,
we can help to design more efficient lattices by (i) decomposing the system
design into sub-systems and removing unnecessary labels and (ii) providing a
list of lattices to choose from.

##  2 Background

This section provides the necessary background for equipping the information-
flow interface theory with a semantic interpretation that uses security
lattices. We first recall information-flow contracts as the original semantic
interpretation for information-flow interfaces [4]. We then provide an
overview of security lattices [6] for defining security policies. Throughout
this section, we use the shared communication infrastructure example from
Figure 1 to illustrate the semantic interpretation of interfaces using
information-flow contracts and sketch the idea of replacing contracts with
more common security lattices.

###  2.0.1 Information-Flow Contracts.

The information-flow interfaces use the syntax described in the shared
communication infrastructure example and illustrated in Figure 1 to specify
security requirements in terms of no-flow relations. _Information-flow
contracts_ [4] provide a semantic interpretation to the interface theory. They
define assumptions on the environment and guarantees on implementations in
terms of _flow relations_. A relation
$\mathcal{M}\subseteq(\mathrm{U}\mathop{\cup}\mathrm{V})\times\mathrm{V}$ is a
flow relation iff it is a transitive relation over
$\mathrm{U}\mathop{\cup}\mathrm{V}$, and reflexive over $\mathrm{V}$. Let
$\mathrm{X}$ and $\mathrm{Y}$ be disjoint sets of input and output variables,
respectively, with the set of all variables defined as
$\mathrm{Z}=\mathrm{X}\mathop{\cup}\mathrm{Y}$. An _information-flow contract_
is a tuple $(\mathrm{X},\mathrm{Y},A_{\mathrm{flow}},G_{\mathrm{flow}})$ where
$A_{\mathrm{flow}}\subseteq 2^{\mathrm{Z}\times\mathrm{X}}$ is a set of flow
relations to input variables, called _(contract) assumption_ ; and
$G_{\mathrm{flow}}\subseteq 2^{\mathrm{Z}\times\mathrm{Y}}$ is a set of flow
relations to output variables, called _(contract) guarantee_.

######  Example 1.

$distw\\_f\\_t$$distw\\_b\\_t$$odometer$$distw\\_f\\_s$$distw\\_b\\_s$$wheel\\_tick$$E$$I_{1}$$I_{2}$$distw\\_f\\_s$$distw\\_b\\_t$$wheel\\_tick$$distw\\_f\\_t$$distw\\_b\\_t$$odometer$$distw\\_f\\_s$$distw\\_b\\_t$$wheel\\_tick$$odometer$$distw\\_b\\_t$$distw\\_f\\_t$

Figure 2: Information-flow contract for the shared communication
infrastructure interface, where $E$ is the maximal permissible environment,
while $I_{1}$ and $I_{2}$ are maximal implementations that satisfy the
interface specification.

We refer to the bus sub-system in the shared communication infrastructure from
Figure 1 to illustrate its semantic interpretation with information-flow
contracts. Figure 2 depicts the information-flow contract for this interface.
We use sets of components to graphically portray contract assumption and
guarantee, where we depict a component as a gray box decorated with input and
output variables, with solid arrows representing allowed flows. The assumption
contains the set of all permissible environments, while the guarantee contains
the set of all correct implementations. In this example, we depict only the
maximal components, i.e., the contract assumption and guarantee contain all
components that refine these components. In particular, there is one maximal
environment $E$ and two maximal implementations $I_{1}$ and $I_{2}$.

###  2.0.2 Security Lattices.

Information-flow policies are usually defined for a set of _(security) labels_
, also referred to in the literature as security classes. Labels and objects
of a system (for example, variables or ports) usually define distinct sets of
objects, with a label categorizing the role of an object within an
information-flow policy.

A policy is specified with a _label can-flow_ relation $\sqsubseteq$ over a
set of security labels $\mathrm{SC}$. Then, $L\sqsubseteq L^{\prime}$, for
labels $L\in\mathrm{SC}$ and $L^{\prime}\in\mathrm{SC}$, means that
information on entities assigned to the label $L$ is allowed to flow to
entities in $L^{\prime}$. Note that flow relations are defined for system’s
objects while can-flow relations are defined over security labels.
Additionally, a policy provides a joint operator
$\oplus\subseteq\mathrm{SC}\times\mathrm{SC}$ specifying how to combine
entities assigned with different labels. This operator can be used to
dynamically assign a security label to objects that had no prior assignment. A
policy is fully specified by a tuple $(\mathrm{SC},\sqsubseteq,\oplus)$. In
[6], Denning proposed the following axioms for security policies
$(\mathrm{SC},\sqsubseteq,\oplus)$:

Finiteness

the set of security classes $\mathrm{SC}$ is finite;

Order

$(\mathrm{SC},\sqsubseteq)$ defines a partial order;

Public Label

there exists an unique lower bound in $\mathrm{SC}$ with respect to
$\sqsubseteq$;

Totally of Label Combining

the joint operator $\oplus$ is a least upper bound operator defined for every
pair of security labels.

A security policy that satisfies these assumptions, defines a bounded lattice
[6]. Then, $\sqsubseteq$ is a reflexive, transitive, and antisymmetric
relation over $\mathrm{SC}$ with a unique upper bound (represented by $\top$)
and a unique lower bound (represented by $\bot$). From now on, for simplicity
of presentation, we denote security policies by $(\mathrm{SC},\sqsubseteq)$
only. Whenever $(\mathrm{SC},\sqsubseteq)$ defines a lattice, the definition
of $\oplus$ over a pair of labels in $\mathrm{SC}$ is given by their least
upper bound in $(\mathrm{SC},\sqsubseteq)$.

######  Example 2.

_Secret_ (HighC)_Public_ (LowC)(a)_Untrusted_ (LowI)_Trusted_
(HighI)(b)(HighC, LowI)(HighC, HighI)(LowC, LowI)(LowC, HighI)(c)

Figure 3: Security lattices for (a) confidentiality, (b) integrity and (c)
both combined.

In Figure 3, we have three examples of security lattices represented as Hasse
diagrams. Reflexive and transitive arrows are omitted in the diagrams. The two
Hasse diagrams to the left depict two linear lattices: one for confidentiality
and one for integrity. As illustrated by the lattices, confidentiality and
integrity adopt inverse views on the flow from high to low labelled variables.
The lattice on the right side depicts the result of combining the
confidentiality and integrity lattices. Figure 4 below depicts a security
lattice that provides an elegant and succinct representation of the maximal
implementation $I_{1}$ from Figure 2.

$\\{distw\\_f\\_t,distw\\_b\\_t\\}$$\\{distw\\_b\\_s\\}$$\\{distw\\_f\\_s\\}$$\top$$\bot$$\\{odometer\\}$$\\{wheel\\_tick\\}$

Figure 4: Security lattice representation of the maximal implementation
$I_{1}$.

##  3 Security Lattices For Information-Flow Interfaces

In this section, we introduce security lattice contracts and show how to
translate from flow relations to security lattices and vice-versa. As for
information-flow contracts, we define security lattice contracts over disjoint
sets of input and output variables, denoted $\mathrm{X}$ and $\mathrm{Y}$
respectively, with the set of all variables defined as
$\mathrm{Z}=\mathrm{X}\cup\mathrm{Y}$. Note that while our atomic objects are
variables, security labels are defined by sets of variables. For a set of
variables $\mathrm{Z}$, we define the set with all possible security labels
over $\mathrm{Z}$ as
$\mathrm{SC}^{\mathrm{Z}}=2^{\mathrm{Z}}\cup\\{\top,\bot\\}$. A variable $x$
is labelled with $L\mathop{\in}\mathrm{SC}$ iff $x\mathop{\in}L$.

######  Definition 1.

A _security lattice contract_ is a tuple $(\mathrm{X},\mathrm{Y},A,G)$ where
$\mathrm{X}$ and $\mathrm{Y}$ are disjoint sets of variables and
$\mathrm{Z}=\mathrm{X}\cup\mathrm{Y}$; $A=(\mathrm{SC}_{A},\sqsubseteq_{A})$
is a security lattice with $\mathrm{SC}_{A}\subseteq\mathrm{SC}^{\mathrm{Z}}$,
called contract _assumption_ ; and $G=(\mathrm{SC}_{G},\sqsubseteq_{G})$ is a
security lattice with $\mathrm{SC}_{G}\subseteq\mathrm{SC}^{\mathrm{Z}}$,
called contract _guarantee_.

###  3.0.1 From Flow Relations to Security Lattices and Back.

While security lattices specify requirements on security labels that are later
assigned to objects of our design (for example, variables), flow relations
specify flow requirements directly between the objects of our design. For this
reason, flow relations should not be anti-symmetric, as we want to keep the
design objects distinct even if they are indistinguishable to this relation.

We split the translation from a flow relation $\mathcal{M}$ to security
lattice in three steps: (1) defining the set of security labels; (2) defining
a partial-order over that set preserving the flow requirements from
$\mathcal{M}$; and (3) extending the set of security labels and the can-flow
relation to guarantee there is a least-upper bound for each pair of labels.
The algorithm for this translation is presented in Algorithm 1. We explain
next the steps in detail.

Algorithm 1 From flow relation $\mathcal{M}$ to security lattice –
${\llbracket\mathcal{M}\rrbracket}_{\mathrm{lat}}$

_Flow relation_
$\mathcal{M}\subseteq(\mathrm{U}\cup\mathrm{V})\times\mathrm{V}$

_Security Lattice_ $(\mathrm{SC},\sqsubseteq)$

1:$\mathrm{SC}\leftarrow\\{\top,\bot\\}$

2:$\sqsubseteq\leftarrow\\{\\}$

3:for all sequences $(z_{0},z_{1})\circ\cdots\circ(z_{n},z_{0})$ defined by
pairs in $\mathcal{M}$ do

4: $L_{1}\leftarrow\\{z_{0},\ldots,z_{n}\\}$

5: $\mathrm{isToInclude}\leftarrow\mathrm{true}$

6: for all $L_{2}\mathop{\in}\mathrm{SC}$ do

7: if $L_{1}\mathop{\subseteq}L_{2}$ then

8: $\mathrm{isToInclude}\leftarrow\mathrm{false}$ $\triangleright$ We do not
add $L_{1}$ to $\mathrm{SC}$ as $L_{2}$ subsumes it

9: else if $L_{2}\mathop{\subseteq}L_{1}$ then

10: $\mathrm{SC}\leftarrow\mathrm{SC}\setminus\\{L_{2}\\}$ $\triangleright$
Remove labels from $\mathrm{SC}$ subsumed by $L_{1}$

11: end if

12: end for

13: if $\mathrm{isToInclude}$ then
$\mathrm{SC}\leftarrow\mathrm{SC}\cup\\{L_{1}\\}$

14: end if

15:end for

16:for all $L_{1}\mathop{\in}\mathrm{SC}$ do

17: $\sqsubseteq\leftarrow\sqsubseteq\mathop{\cup}\\{(\bot,L_{1}),\
(L_{1},\top),\ (L_{1},L_{1})\\}$ $\triangleright$ Label relates with $\top$,
$\bot$ and itself

18: for all $L_{2}\mathop{\in}\mathrm{SC}$ do

19: if $L_{1}\times L_{2}\mathop{\subseteq\mathcal{M}}$ then

20: $\sqsubseteq\leftarrow\sqsubseteq\mathop{\cup}\\{(L_{1},L_{2})\\}$
$\triangleright$ Add pair of labels to can-flow, if they satisfy $\mathcal{M}$

21: end if

22: end for

23:end for

24:if $(\mathrm{SC},\sqsubseteq)$ is not a lattice then

25:
$(\mathrm{SC},\sqsubseteq)\leftarrow\mathrm{addLeastUpperLabels}((\mathrm{SC},\sqsubseteq))$
$\triangleright$ Complete order

26:end if

27:return $\mathrm{SC},\sqsubseteq)$

Algorithm 2 Add least upper bound labels – $\mathrm{addLeastUpperLabels}$

$(\mathrm{SC},\sqsubseteq)$

Updated $(\mathrm{SC},\sqsubseteq)$

1:$\mathrm{ToProcess}\leftarrow\\{(L_{1},L_{2})\ |\
\\{L_{1},L_{2}\\}\subseteq\mathrm{SC}\\}$ $\triangleright$ Labels to process

2:for all $(L_{1},L_{2})\in\mathrm{ToProcess}$ do

3: if $L_{1}$ and $L_{2}$ has no least upper bound then

4: $L^{\prime}=\\{\mathrm{newVar}(\mathrm{SC})\\}$ $\triangleright$ Singleton
label with new variable name

5: $\mathrm{ToProcess}\leftarrow\mathrm{ToProcess}\cup\\{(L^{\prime},L)\ |\
L\in\mathrm{SC}\\}$

6: $\mathrm{SC}\leftarrow\mathrm{SC}\cup\\{L^{\prime}\\}$

7: $\sqsubseteq\leftarrow\sqsubseteq\cup\\{(\bot,L^{\prime}),\
(L^{\prime},\top),\ (L^{\prime},L^{\prime}),\
(L_{1},L^{\prime}),(L_{2},L^{\prime})\\}$

8: for all $L\in\mathrm{SC}$ do

9: if $\\{(L_{1},L),(L_{2},L)\\}\subseteq\sqsubseteq$ then

10: $\sqsubseteq\leftarrow\sqsubseteq\cup\\{(L^{\prime},L)\\}$
$\triangleright$ Connect $L^{\prime}$ to all common upper bounds

11: end if

12: end for

13: end if

14:
$\mathrm{ToProcess}\leftarrow\mathrm{ToProcess}\setminus\\{(L_{1},L_{2})\\}$
$\triangleright$ Remove processed labels

15:end for

16:return $(\mathrm{SC},\sqsubseteq)$

#### Security Labels.

In our first step, we collect all sets of variables in which all variables are
in a loop defined using pairs in the given flow relation (c.f., line 3 in
Algorithm 1). Formally, for a flow relation $\mathcal{M}$ and for a loop
defined by a sequence $(z_{0},z_{1})\circ\cdots\circ(z_{n},z_{0})$, where
$(z_{i},z_{i+1})\mathop{\in}\mathcal{M}$ for $0\leq i<n$, then
$\\{z_{0},\ldots,z_{n}\\}$ defines a security label. Note that as flow
relations are reflexive, for each variable $z$ in the domain of $\mathcal{M}$,
the singleton set $\\{z\\}$ defines a security label that satisfies the loop
condition. We observe, additionally, that due to transitivity of flow
relations all subsets of labels defined as explained above will also be
security labels according to this definition (i.e., with transitivity we can
skip steps in the sequence and find a loop that supports the label with fewer
variables). To remove redundant labels, we keep only the largest set of
variables necessary to define the loop (c.f., lines 7 to 13 in Algorithm 1).

#### Can-flow Order.

After creating the labels, we proceed to defining the can-flow relation as a
partial order over the set of labels derived in the previous step. This is
straightforward, as the flow relation is already reflexive and transitive. A
pair of security labels $(L,L^{\prime})$ is in the can-flow relation iff all
the variables in them are related by the flow relation (c.f., lines 16 to 23
in Algorithm 1). Formally, given a flow relation $\mathcal{M}$, for all
$z\mathop{\in}L$ and $z^{\prime}\mathop{\in}L^{\prime}$, we require
$(z,z^{\prime})\mathop{\in}\mathcal{M}$. Additionally, we make sure that all
labels are appropriately connected to the top and bottom elements of the
lattice and to themselves to guarantee reflexivity (c.f., line 17 in Algorithm
1).

######  Example 3.

In Figure 5, we depict an implementation of the shared communication
infrastructure, $I_{3}$. To the right of that implementation, we depict the
partial order $(\mathrm{SC},\sqsubseteq)$ derived by line 23 of the Algorithm
1. Note that the pair of labels $(\\{distw\\_f\\_s\\},\\{distw\\_b\\_s\\})$ do
not have a lower upper bound, because $\\{distw\\_f\\_t\\}$ and
$\\{distw\\_b\\_t\\}$ are uncomparable for the relation $\sqsubseteq$. When
this is the case, we proceed in Algorithm 1 to line 25 and add the missing
labels.

$distw\\_f\\_s$$distw\\_b\\_t$$wheel\\_tick$$distw\\_f\\_t$$distw\\_b\\_t$$odometer$$I_{3}$$\\{distw\\_f\\_t\\}$$\\{distw\\_b\\_t\\}$$\\{odometer\\}$$\\{distw\\_f\\_s\\}$$\\{distw\\_b\\_s\\}$$\\{wheel\\_tick\\}$$\top$$\bot$

Figure 5: An implementation for the shared communication $I_{3}$ with the
partial order derived from its can-flow by line 23 in Algorithm 1. Note that
labels $\\{distw\\_f\\_s\\}$ and $\\{distw\\_b\\_s\\}$ do not have a lower
upper bound, which will be added in the next steps of the Algorithm.

#### Least upper bounds.

As illustrated in the example above, the set of labels together with the can-
flow relation by line 23 in Algorithm 1 may not define a lattice. In Algorithm
2, we present a possible way to extend the set of security labels and the can-
flow relation to guarantee that each pair of labels has a unique least upper
bound. There are multiple ways one could define and implement this extension.
In this work, we focus on presenting a simple and intuitive extension for
demonstration purposes.

Intuitively, for a flow relation over
$(\mathrm{U}\cup\mathrm{V})\times\mathrm{V}$, we need to create intermediate
labels connecting labels with $\mathrm{U}$ variables to labels with
$\mathrm{V}$ variables. Note that there are no labels that mix variables of
$\mathrm{V}$ and $\mathrm{U}$ because there is no loop containing both types
of variables in the flow relation
$\mathcal{M}\subseteq(\mathrm{U}\cup\mathrm{V})\times\mathrm{V}$. To define
the intermediate labels, we extend the domain of security labels with sets
over fresh variables (obtained with the function $\mathrm{newVar}$ that
returns a variable name not yet in $\mathrm{SC}$). The new labels are internal
to a contract implementation (i.e., irrelevant to the system’s design) and
characterize the expected security label when we combine information from
different sources.

######  Example 4.

Algorithm 1 outputs lattices in Figure 4 and Figure 6 when the input are the
flow relations in implementations $I_{1}$ and $I_{3}$, respectively.

$\\{distw\\_f\\_t\\}$$\\{distw\\_b\\_t\\}$$\\{odometer\\}$$\top$$\bot$$\\{distw\\_f\\_s\\}$$\\{distw\\_b\\_s\\}$$\\{wheel\\_tick\\}$$\\{distw\\_f\\_s^{\prime},distw\\_b\\_s^{\prime}\\}$

Figure 6: Security lattice returned from Algorithm 1 for the flow relation in
$I_{3}$.

We prove below that the relation output by Algorithm 1 is indeed a lattice and
is equivalent to the flow restrictions of the input $\mathcal{M}$. For a flow
relation $\mathcal{M}\subseteq\mathrm{Z}\times\mathrm{V}$, a structure
$(\mathrm{SC},\sqsubseteq)$ _is equivalent to it_ , denoted
$(\mathrm{SC},\sqsubseteq)\equiv_{\mathrm{Z}\times\mathrm{V}}\mathcal{M}$ iff
for all pairs of labels $(L_{1},L_{2})\in 2^{\mathrm{Z}}\times
2^{\mathrm{V}}$, they are in the can-flow relation,
$(L_{1},L_{2})\in\sqsubseteq$, iff, for all $(z_{1},z_{2})\in L_{1}\times
L_{2}$ we have $(z_{1},z_{2})\in\mathcal{M}$.

######  Theorem 3.1.

Let $\mathcal{M}\subseteq\mathrm{Z}\times\mathrm{V}$ be a flow relation and
${\llbracket\mathcal{M}\rrbracket}_{\mathrm{lat}}=(\mathrm{SC},\sqsubseteq)$.
Then, $(\mathrm{SC},\sqsubseteq)$ defines a security lattice that is
equivalent to the can-flow restrictions of $\mathcal{M}$ over
$\mathrm{Z}\times\mathrm{V}$, i.e.,
$(\mathrm{SC},\sqsubseteq)\equiv_{\mathrm{Z}\times\mathrm{V}}\mathcal{M}$.

###### Proof.

We start by proving that $(\mathrm{SC},\sqsubseteq)$ defined at line 23 of
Algorithm 1 (before we call $\mathrm{addLeastUpperLabels}$ procedure) (i)
defines an order that is equivalent to $\mathcal{M}$ over its domain,
$(\mathrm{SC},\sqsubseteq)\equiv_{\mathrm{Z}\times\mathrm{V}}\mathcal{M}$, and
(ii) $\sqsubseteq$ defines a partial order over the set of labels
$\mathrm{SC}$.

We observe that in Algorithm 1 (a) by line 16, we only have labels with
variables in the domain of $\mathcal{M}$ (i.e., $\mathrm{SC}\subseteq
2^{\mathrm{U}\cup\mathrm{V}}\cup\\{\top,\bot\\}$); (b) only in lines 17 and 20
we add pairs of labels to $\sqsubseteq$; and (c) in line 17 we add the
reflexive pairs and the connections to $\top$ and $\bot$, while, by the
condition at line 19, in line 20 we only add the pair $(L_{1},L_{2})$ to the
can-flow relation when all their elements $z_{1}\mathop{\in}L_{1}$ and
$z_{2}\mathop{\in}L_{2}$ are pairs in the flow relation,
$(z_{1},z_{2})\in\mathcal{M}$. By these three observations, it follows that by
line 23 of Algorithm 1
$(\mathrm{SC},\sqsubseteq)\equiv_{\mathrm{Z}\times\mathrm{V}}\mathcal{M}$
holds. We prove now (ii). After line 17 in Algorithm 1, $\sqsubseteq$ is a
reflexive relation. By transitivity of flow relations and the point (i) proved
above, then $\sqsubseteq$ is also a transitive relation. Finally, by removal
of the loops in lines 3 to 15, it follows that $\sqsubseteq$ is antisymmetric.

Now, we are only missing to prove that by line 27 in Algorithm 1 the returned
$(\mathrm{SC},\sqsubseteq)$ (iii) is equivalent to
$\mathcal{M}$,$(\mathrm{SC},\sqsubseteq)\equiv_{\mathrm{Z}\times\mathrm{V}}\mathcal{M}$,
and (iv) defines a lattice. First, we observe that all pairs of labels added
to $\sqsubseteq$ in lines 7 and 10 of Algorithm 2 do not have variables from
$\mathrm{Z}$. Then, by (i) proved previously, (iii) holds. If
$(\mathrm{SC},\sqsubseteq)$ is a lattice by line 24 Algorithm 1, then
$(\mathrm{SC},\sqsubseteq)$ is not changed so (iv) holds. We consider now the
case that $(\mathrm{SC},\sqsubseteq)$ does not define a lattice by line 24.
Due to the elements added to $\sqsubseteq$ in line 7 of Algorithm 2 and (ii)
proved above, it follows that $\sqsubseteq$ is reflexive relation. Moreover,
after the same line and from line 17 of Algorithm 1, it follows that $\bot$
and $\top$ are the lower and upper bound of $(\mathrm{SC},\sqsubseteq)$,
respectively. Transitivity of $\sqsubseteq$ follows from the pairs added in
line 7 and 10 in Algorithm 1 and (ii) proved above. By lines 1 and 5 in
Algorithm 2, we have the guarantee that all pair of labels added to
$\mathrm{SC}$ will be checked for having a least upper bound. If they do not
have it, a new label is created that is connected to all their upper bounds
(c.f., line 10). As all the upper bounds to any of pair of labels processed
are either in the algorithm input structure or are added only during the loop
iteration we add a new label, then we have the guarantee that no new upper
bounds are added after a pair of labels is processed. Then, at each iteration
the new label $L^{\prime}$ is the least upper bound for the labels $L_{1}$ and
$L_{2}$. Hence the returned $(\mathrm{SC},\sqsubseteq)$ is a lattice. ∎

The translation from a security lattice to a flow relation is straightforward,
as a lattice is by definition already reflexive and transitively closed.
Formally, given a security lattice $(\mathrm{SC},\sqsubseteq)$ we define its
derived flow relation over a domain $\mathrm{Z}\times\mathrm{V}$ as follows:

${\llbracket(\mathrm{SC},\sqsubseteq),\mathrm{Z}\times\mathrm{V}\rrbracket}_{\mathrm{flow}}=\\{(z,z^{\prime})\
|\ (L,L^{\prime})\mathop{\in}\sqsubseteq,\
z\mathop{\in}(L\mathop{\cap}\mathrm{Z})\text{ and
}z^{\prime}\mathop{\in}(L^{\prime}\mathop{\cap}\mathrm{V})\\}.$

We prove below that after we translate a flow relation to a security lattice,
using the operator defined by Algorithm 1, we can use the operator defined
above to get back the original flow relation.

######  Theorem 3.2.

Let $\mathcal{M}\subseteq(\mathrm{U}\cup\mathrm{V})\times\mathrm{V}$ be a flow
relation with $\mathrm{Z}=\mathrm{U}\cup\mathrm{V}$. Then:

${\llbracket{\llbracket\mathcal{M}\rrbracket}_{\mathrm{lat}},\mathrm{Z}\times\mathrm{V}\rrbracket}_{\mathrm{flow}}=\mathcal{M}.$

###### Proof.

By Theorem 3.1,
${\llbracket\mathcal{M}\rrbracket}_{\mathrm{lat}}\equiv_{\mathrm{Z}\times\mathrm{V}}\mathcal{M}$,
i.e., for
$(\mathrm{SC},\sqsubseteq)={\llbracket\mathcal{M}\rrbracket}_{\mathrm{lat}}$
and for all pairs of labels $(L_{1},L_{2})\in 2^{\mathrm{Z}}\times
2^{\mathrm{V}}$, they are in the can-flow relation,
$(L_{1},L_{2})\in\sqsubseteq$, iff, for all $(z_{1},z_{2})\in L_{1}\times
L_{2}$, we have $(z_{1},z_{2})\in\mathcal{M}$. Hence, by definition of
${\llbracket.\rrbracket}_{\mathrm{flow}}$,
${\llbracket{\llbracket\mathcal{M}\rrbracket}_{\mathrm{lat}},\mathrm{Z}\times\mathrm{V}\rrbracket}_{\mathrm{flow}}=\mathcal{M}$
holds. ∎

We show in the theorem below that, under reasonable constraints, when given a
security lattice, if we translate it to a flow relation followed by a
translation to a lattice, then at the end, we get back the original lattice.
The first constraint, specifying that variables in $\mathrm{U}$ can only
define singleton labels, is motivated by the observation that for a flow
relation $\mathcal{M}\subseteq(\mathrm{U}\cup\mathrm{V})\times\mathrm{V}$,
there are only outgoing flows from $\mathrm{U}$. Then, there cannot be loops
with variables in $\mathrm{U}$, and in our translation from flow relations to
lattices, we defined that loops are the only way to get non-singleton labels.
The second constraint is derived from our implementation decision in Algorithm
1 only to keep maximal sets.

######  Theorem 3.3.

Let $\mathrm{SC}\subseteq\\{\\{u\\}\ |\ u\in\mathrm{U}\\}\cup
2^{\mathrm{V}}\cup\\{\top,\bot\\}$ be a set of maximal sets of variables,
i.e., for all $\\{L_{1},L_{2}\\}\subseteq\mathrm{SC}$ then $L_{1}\not\subseteq
L_{2}$. For all relations $\sqsubseteq\subseteq\mathrm{SC}\times\mathrm{SC}$
s.t. $(\mathrm{SC},\sqsubseteq)$ defines a lattice, then:

${\llbracket{\llbracket(\mathrm{SC},\sqsubseteq),(\mathrm{U}\cup\mathrm{V})\times\mathrm{V}\rrbracket}_{\mathrm{flow}}\rrbracket}_{\mathrm{lat}}=(\mathrm{SC},\sqsubseteq).$

###### Proof.

Let
$\mathcal{M}={\llbracket(\mathrm{SC},\sqsubseteq),(\mathrm{U}\cup\mathrm{V})\times\mathrm{V}\rrbracket}_{\mathrm{flow}}$.
Note that, by $\sqsubseteq$ being a partial order over $\mathrm{SC}$ and by
definition of ${\llbracket.\rrbracket}_{\mathrm{flow}}$, the only loops in the
flow relation output by
${\llbracket(\mathrm{SC},\sqsubseteq),(\mathrm{U}\cup\mathrm{V})\times\mathrm{V}\rrbracket}_{\mathrm{flow}}$
are between variables in the same label in $\mathrm{SC}$. Let
$\mathrm{SC}_{15}$ be the set of security labels by line 15 in Algorithm 1. By
$\mathrm{SC}$ having only maximal sets, then $\mathrm{SC}_{15}=\mathrm{SC}$.
Now, let $\sqsubseteq_{23}$ be the can-flow relation defined by line 23 of
Algorithm 1 and $\mathrm{SC}_{23}$ the set of labels (note that
$\mathrm{SC}_{15}=\mathrm{SC}_{23}=\mathrm{SC}$). By a reasoning analogous to
the proof of Theorem 3.1, we know that
$(\mathrm{SC}_{23},\sqsubseteq_{23})\equiv_{\mathrm{Z}\times\mathrm{V}}\mathcal{M}$.
As $\mathcal{M}$ is derived from a lattice, then
$(\mathrm{SC}_{23},\sqsubseteq_{23})$ is also a lattice and
${\llbracket{\llbracket(\mathrm{SC},\sqsubseteq),(\mathrm{U}\cup\mathrm{V})\times\mathrm{V}\rrbracket}_{\mathrm{flow}}\rrbracket}_{\mathrm{lat}}=(\mathrm{SC}_{23},\sqsubseteq_{23})=(\mathrm{SC},\sqsubseteq_{23})$.
Then, by
$(\mathrm{SC}_{23},\sqsubseteq_{23})\equiv_{\mathrm{Z}\times\mathrm{V}}\mathcal{M}$,
it follows that $\sqsubseteq_{23}=\sqsubseteq$. Hence
${\llbracket{\llbracket(\mathrm{SC},\sqsubseteq),(\mathrm{U}\cup\mathrm{V})\times\mathrm{V}\rrbracket}_{\mathrm{flow}}\rrbracket}_{\mathrm{lat}}=(\mathrm{SC}_{23},\sqsubseteq_{23})=(\mathrm{SC},\sqsubseteq)$
∎

###  3.0.2 Information-flow and Security Lattice Contracts.

Given an information-flow contract
$C_{\mathrm{flow}}=(\mathrm{X},\mathrm{Y},A_{\mathrm{flow}},G_{\mathrm{flow}})$,
we define the derived security lattice contract as: ${\llbracket
C_{\mathrm{flow}}\rrbracket}=(\mathrm{X},\mathrm{Y},{\llbracket
A_{\mathrm{flow}}\rrbracket}_{\mathrm{lat}},{\llbracket
G_{\mathrm{flow}}\rrbracket}_{\mathrm{lat}})$. Information-flow contracts were
introduced in [4] along with a composition operator and a refinement relation
over such contracts. Using the translations presented above, we define
composition and refinement over security lattice contracts directly from their
counterpart in information-flow contracts (we use the same definitions and
translate back and forth between flows and lattices).

In [4], we proved that the composition and refinement of information-flow
contracts adequately capture the semantics of their counterpart in
information-flow interfaces. These results show that information-flow
contracts, just as for information-flow interfaces, satisfy incremental design
and independent implementability [4]. Then, using Theorem 3.2, all the results
mentioned above for information-flow contracts also hold for security lattices
contracts.

##  4 Conclusions

In this paper, we proposed security lattices as an alternative semantics for
the information-flow interface theory. Security lattices are the backbone of
many successful, readily available techniques to verify and enforce security
policies. Examples range from type systems [7] to static analysis [8] or
runtime enforcement using secure multi-execution [5, 2], to name a few.

Equipping interfaces with a semantic interpretation based on a commonly used
formalism for defining and enforcing security policies facilitates the bridge
between the security practitioners and the security-by-design paradigm.

###  4.0.1 Acknowledgements

This project was funded in part by the Austrian Science Fund (FWF) SFB project
SpyCoDe F8502 and by the ERC-2020-AdG 101020093.

## References

  * [1] Algehed, M., Flanagan, C.: Transparent IFC enforcement: Possibility and (in)efficiency results. In: Proceedings of Computer Security Foundations Symposium (CSF). pp. 65–78 (2020). https://doi.org/10.1109/CSF49147.2020.00013
  * [2] Austin, T.H., Flanagan, C.: Multiple facets for dynamic information flow. In: Proceedings of ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (POPL). pp. 165–178 (2012)
  * [3] Bartocci, E., Ferrère, T., Henzinger, T.A., Nickovic, D., da Costa, A.O.: Information-flow interfaces. In: Proceedings of Fundamental Approaches to Software Engineering (FASE). pp. 3–22 (2022). https://doi.org/10.1007/978-3-030-99429-7_1
  * [4] Bartocci, E., Ferrère, T., Henzinger, T.A., Nickovic, D., da Costa, A.O.: Information-flow interfaces (2020), https://arxiv.org/abs/2002.06465
  * [5] De Groef, W., Devriese, D., Nikiforakis, N., Piessens, F.: Flowfox: A web browser with flexible and precise information flow control. In: Proceedings of the 2012 ACM Conference on Computer and Communications Security (CCS). p. 748–759 (2012). https://doi.org/10.1145/2382196.2382275
  * [6] Denning, D.E.: A lattice model of secure information flow. Communications of the ACM 19(5), 236–243 (1976). https://doi.org/10.1145/360051.360056
  * [7] Focardi, R., Maffei, M.: Types for security protocols. Formal Models and Techniques for Analyzing Security Protocols 5, 143–181 (2011). https://doi.org/10.3233/978-1-60750-714-7-143
  * [8] Huang, Y.W., Yu, F., Hang, C., Tsai, C.H., Lee, D.T., Kuo, S.Y.: Securing web application code by static analysis and runtime protection. In: Proceedings of the 13th International Conference on World Wide Web. p. 40–52. WWW ’04 (2004). https://doi.org/10.1145/988672.988679
  * [9] Sabelfeld, A., Myers, A.C.: Language-based information-flow security. IEEE Journal on Selected Areas in Communications 21(1), 5–19 (2003). https://doi.org/%****␣main.bbl␣Line␣50␣****10.1109/JSAC.2002.806121
  * [10] Sandhu, R.: Lattice-based access control models. Computer 26(11), 9–19 (1993). https://doi.org/10.1109/2.241422


11institutetext: Maria Chiara Brambilla 22institutetext: Università
Politecnica delle Marche, via Brecce Bianche, I-60131 Ancona, Italy, 22email:
<EMAIL_ADDRESS>33institutetext: Olivia Dumitrescu 44institutetext:
1\. University of North Carolina at Chapel Hill, 340 Phillips Hall CB 3250 NC
27599-3250 and 2. Simion Stoilow Institute of Mathematics Romanian Academy 21
Calea Grivitei Street 010702 Bucharest Romania, 44email<EMAIL_ADDRESS>
The second author is supported by NSF grant DMS1802082, 55institutetext: Elisa
Postinghel 66institutetext: Dipartimento di Matematica, Università degli Studi
di Trento, via Sommarive 14 I-38123 Povo di Trento (TN), Italy 66email:
<EMAIL_ADDRESS>
# Weyl cycles on the blow-up of ${\mathbb{P}}^{4}$ at eight points

Maria Chiara Brambilla  Olivia Dumitrescu and Elisa Postinghel

###### Abstract

We define the Weyl cycles on $X^{n}_{s}$, the blown up projective space
${\mathbb{P}}^{n}$ in $s$ points in general position. In particular, we focus
on the Mori Dream spaces $X^{3}_{7}$ and $X^{4}_{8}$, where we classify all
the Weyl cycles of codimension two. We further introduce the Weyl expected
dimension for the space of the global sections of any effective divisor that
generalizes the linear expected dimension of BraDumPos1  and the secant
expected dimension of BraDumPos3 .

##  1 Introduction

Let $X^{n}_{s}$ be the blown up projective space ${\mathbb{P}}^{n}$ in $s$
points in general position. When the number of points $s$ is small, the space
$X^{n}_{s}$ has an interpretation as certain moduli space, see e.g. AC  and
CCF . Mori Dream Spaces of the form $X^{n}_{s}$ were classified via the work
of Mukai Mukai04 ; Mukai05  and techniques of birational geometry of moduli
spaces. In previous work, in order to analyze properties of the pairs
$(X^{n}_{s},D)$ with $D$ a Cartier divisor, the authors of this article
developed techniques of polynomial interpolation theory in BraDumPos1  for
$s=n+2$ and in BraDumPos3  for $s=n+3$ respectively, via the study of the base
loci.

In this paper we apply an analogous approach, based on interpolation theory,
to define and study the subvarieties determining the birational geometry of
the Mori Dream Spaces $X^{3}_{7}$ and $X^{4}_{8}$. We will use this study as
an opportunity to reveal the geometry hidden by the Weyl group action on fixed
linear cycles of $X^{n}_{s}$ and its consequences. For instance, we predict
that for all Mori Dream Spaces, Weyl cycles determine the birational geometry
of such spaces, cones of effective and movable divisors and their
decomposition into nef chambers.

In this article we propose a definition of Weyl cycles on $X^{n}_{s}$ as
follows (see Definition 1 for details). We call Weyl divisor any effective
divisor $D$ in $\textrm{Pic}(X^{n}_{s})$ in the Weyl orbit of an exceptional
divisor $E_{i}\in\textrm{Pic}(X^{n}_{s})$. We call a Weyl cycle of codimension
$i$ an element of the Chow group $A^{i}(X^{n}_{s})$ that is an irreducible
component of the intersection of Weyl divisors, which are pairwise orthogonal
with respect to the Dolgachev-Mukai pairing on $\textrm{Pic}(X^{n}_{s})$.

For an arbitrary number of points, $s$, Weyl divisors are always generators of
the Cox ring. The correspondence between $(-1)$-curves of ${\mathbb{P}}^{2}$
and Weyl curves in $X^{2}_{s}$ (i.e. Weyl divisors) was proved by Nagata
nagata , while giving a counterexample to the Hilbert 14-th problem. Moreover
in the case of ${\mathbb{P}}^{2}$, Weyl curves have been widely investigated
since they are involved in the well-known Segre-Harbourne-Gimigliano-
Hirschowitz conjecture, see e.g. Ciliberto ; CHMR  or, more widely, in the
classification of algebraic surfaces (Castelnuovo’s contraction theorem), the
base of the minimal model program. The notion of divisorial $(-1)$-classes on
$X^{n}_{s}$ was introduced by Laface and Ugaglia in laface-ugaglia-standard
and recently studied by the second author and Priddis in olivia-nathan .

For $X^{3}_{s}$, Laface and Ugaglia introduced the notion of elementary
$(-1)$-curves and studied their properties in laface-ugaglia-elem . The case
of Weyl cycles of $X^{4}_{8}$ has been studied in olivia-rick  with a
different approach: indeed in such paper Weyl orbits in $X^{4}_{8}$ (as well
as in $X_{7}^{3}$) of the proper transforms of linear cycles blown up along
lines spanned by any two points are described. The classification of Weyl
cycles obtained in olivia-rick  for the cases $X^{3}_{7}$, $X^{4}_{8}$, yields
the same classification we determine here for Weyl curves in $X^{3}_{7}$ and
for Weyl surfaces (see Equations (1)) in $X^{4}_{8}$. Therefore we conclude
that Definition 1 and the definitions used in olivia-rick  are equivalent for
cycles of codimension $2$ in $X^{3}_{7}$ and $X^{4}_{8}$. The authors believe
that these two definitions are related in general, namely for Weyl cycles in
$X^{n}_{s}$, and they will study their connection in a forthcoming paper.

In this article we emphasize that basic methods of intersection theory,
applied to pairs of orthogonal Weyl divisors, give an iterative method to
compute the Weyl cycles of codimension $2$ in $X^{3}_{7}$ and in $X^{4}_{8}$.
Moreover, we show that every Weyl cycles is swept out by families of rational
curves parametrized by Weyl cycles of larger codimension, see Proposition 3,
Corollary 1 and Lemma 5.

Our main result, contained in Section 5.3, is a classification of all the Weyl
surfaces of $X^{4}_{8}$. For each such surface, on the one hand we compute its
multiplicity of containment in the base locus of any given divisor, on the
other hand we compute its class in the Chow ring of $X^{4}_{8,(1)}$, the blow
up of $X^{4}_{8}$ along the strict transforms of all lines through two base
points and all rational normal quartic curves through seven base points; we
believe that it is the only representative of its class. There are five such
classes, up to index permutation, as listed in the following formula (see
Section 5.2 for the precise notation):

$\begin{split}S^{1}_{1,4,5}:\
&h-e_{1}-e_{4}-e_{5}-\sum_{i,j\in\\{1,4,5\\}}(e_{ij}-f_{ij})\\\
S^{3}_{1,\widehat{8}}:\
&3h-3e_{1}-\sum_{i=2}^{7}e_{i}-(e_{C_{\widehat{8}}}-f_{C_{\widehat{8}}})-\sum_{i=2}^{7}(e_{1i}-f_{1i})\\\
S^{6}_{6,7,8}:\
&6h-3\sum_{i=1}^{5}e_{i}-\sum_{i=6}^{8}e_{i}-\sum_{i,j\in\\{1,2,3,4,5\\},i\neq
j}(e_{ij}-f_{ij})-\sum_{k=6}^{8}(e_{C_{\widehat{k}}}-f_{C_{\widehat{k}}})\\\
S^{10}_{1,2}:\
&10h-6e_{1}-6e_{2}-\sum_{i=3}^{8}3e_{i}-3(e_{12}-f_{12})-\sum_{i=1}^{2}\sum_{j=3}^{8}(e_{ij}-f_{ij})-\sum_{k=3}^{8}(e_{C_{\widehat{k}}}-f_{C_{\widehat{k}}})\\\
S^{15}_{8}:\ &15h-\sum_{i=1}^{7}6e_{i}-3e_{8}-\sum_{1\leq i<j\leq
7}(e_{ij}-f_{ij})-\sum_{i=1}^{7}(e_{C_{\widehat{i}}}-f_{C_{\widehat{i}}})-3(e_{C_{\widehat{8}}}-f_{C_{\widehat{8}}})\end{split}$
(1)

Recall that the birational geometry of $X^{4}_{8}$ has been investigated in
Mukai05  and CCF . Casagrande, Codogni and Fanelli studied in detail the
relation between the geometry of $X^{2}_{8}$ and $X^{4}_{8}$ and in (CCF, ,
Theorem 8.7) they described five types of surfaces in $X^{4}_{8}$ playing a
special role in the Mori program. We emphasize that this list agrees with our
classification of Weyl surfaces, (1).

Finally, we propose here a notion of expected dimension for a linear system
which takes into account the contribution to the speciality given by the
special cycles contained in the base locus. In Definition 2, we introduce the
Weyl expected dimension for $X^{3}_{7}$ and $X^{4}_{8}$, which extends the
analogous definitions of linear expected dimension of BraDumPos1  and secant
expected dimension of BraDumPos3 . We prove that any effective divisor $D$ in
$X^{3}_{7}$ satisfies
${\rm{h}}^{0}(X^{3}_{7},{\mathcal{O}}_{X^{3}_{7}}(D))=\operatorname{wdim}(D)$,
see Theorem 6.1, and we conjecture that the same holds in $X^{4}_{8}$.

The paper is organized as follows. In Section 2, we introduce the notation,
recall basic facts on the blown up of ${\mathbb{P}}^{n}$ in $s$ general
points, $X^{n}_{s}$, and on the action of standard Cremona transformations on
$\operatorname{Pic}(X_{s}^{n})$. In Section 3 we introduce the definition of
Weyl cycles and we give some general result on Weyl curves in $X^{n}_{s}$.
Section 4 is devoted to the preliminary case of $X^{3}_{7}$, where we classify
Weyl divisors and Weyl curves and we describe their geometry. Section 5
concerns the case of $X^{4}_{8}$. The main result, i.e. the classification of
the Weyl surfaces is contained in Section 5.3. In Section 5.4, we give the
classification of Weyl divisors and their geometrical description. The last
Section 6 is devoted to the dimensionality problem.

Acknowledgements: The first and third authors are members of GNSAGA-INDAM. The
second author is supported by the NSF grant DMS - 1802082. The third author
was partially supported by the EPSRC grant EP/S004130/1.

We wish to thank Cinzia Casagrande for many useful discussions.

##  2 Preliminaries

We denote by $X^{n}_{s}$ the blown up of ${\mathbb{P}}^{n}$ at $s$ general
points $\mathcal{I}=\\{p_{1},\ldots,p_{s}\\}$. The Picard group of $X^{n}_{s}$
is $\operatorname{Pic}(X_{s}^{n})=\langle H,E_{1},\ldots,E_{s}\rangle$, where
$H$ is a general hyperplane class, and the $E_{i}$’s are the exceptional
divisors of the $p_{i}$’s. For any subset $J\subseteq\\{1,\ldots,s\\}$ of
cardinality $\leq n$, we denote by $L_{J}$ the class, in the Chow ring of
$X_{s}^{n}$, of the strict transform of the linear cycle spanned by $J$. If
$|J|=n$, then $L_{I}=H-\sum_{i\in J}E_{i}\in\operatorname{Pic}(X_{s}^{n})$ is
the class of a fixed hyperplane.

The Dolgachev-Mukai pairing on $\operatorname{Pic}(X^{n}_{s})$ is the bilinear
form defined as follows (cf. Mukai04 ):

$\langle H,H\rangle=n-1,\quad\langle H,E_{i}\rangle=0,\quad\langle
E_{i},E_{j}\rangle=-\delta_{i,j}.$

The standard Cremona transformation based on the coordinate points on
${\mathbb{P}}^{n}$ is the birational transformation defined by the following
rational map:

${\rm{Cr}}:(x_{0}:\dots:x_{n})\to(x_{0}^{-1}:\dots:x_{n}^{-1}),$

see e.g. Dolgachev ; olivia-nathan  for more details. Given any subset
$I\subseteq\\{1,\ldots,s\\}$ of cardinality $n+1$, we denote by
${\rm{Cr}}_{I}$ and call standard Cremona transformation the map obtained by
precomposing ${\rm{Cr}}$ with a projective transformation which takes the
points indexed by $I$ to the coordinate points of ${\mathbb{P}}^{n}$. A
standard Cremona transformation induces an automorphism of
$\operatorname{Pic}(X_{s}^{n})$, denoted again by ${\rm{Cr}}_{I}$ by abuse of
notation, by sending a divisor

$D=dH-\sum m_{i}E_{i}$ (2)

to

${\rm{Cr}}_{I}(D)=(d-c)H-\sum_{i\in I}(m_{i}-c)E_{i}-\sum_{j\not\in
I}^{s}m_{j}E_{j},$ (3)

where $c:=\sum_{i\in I}m_{i}-(n-1)d.$ The canonical divisor
$-(n+1)H+(n-1)\sum_{i=1}^{s}E_{i}$ is invariant under such an automorphism.
The Weyl group $W_{n,s}$ acting on $\operatorname{Pic}(X_{s}^{n})$ is the
group generated by standard Cremona transformations, see Dolgachev . We say
that a divisor (2) is Cremona reduced if $c\leq 0$ for any $I$ of cardinality
$n+1$.

In (olivia-nathan, , Theorem 3.2) the authors observed that the intersection
pairing between divisors is preserved under Cremona transformation.

###### Lemma 1

Let $D,F$ be two divisors and let $\omega\in W_{n,s}$ be an element of the
Weyl group. Then $\langle\omega(D),\omega(F)\rangle=\langle D,F\rangle$.

Here we point out that the scheme-theoretic intersection of two divisors is in
general not preserved under Cremona transformation. Let $D,F$ be two divisors
and let $\omega={\rm{Cr}}_{I}$ be a standard Cremona transformation. Then

$\omega(D\cap F)\cup\Lambda\subseteq\omega(D)\cap\omega(F)$

where $\Lambda$ is a union of linear cycles of the indeterminacy locus of
$\omega$. The following lemma provides an explicit recipe for $\Lambda$.

###### Lemma 2

Let $I\subseteq\\{1,\ldots,s\\}$ have cardinality $n+1$, and let $I=I_{1}\cup
I_{2}$, with $|I_{1}|=m+1$ and $|I_{2}|=n-m$. Let $D=dH-\sum m_{i}E_{i}$ be a
divisor in $X_{s}^{n}$. If $(n-m-1)d-\sum_{i\in I_{2}}m_{i}=a\geq 1,$ then the
$m$-plane $L_{I_{1}}$ is contained in ${\rm{Cr}}_{I}(D)$ exactly $a$ times.

###### Proof

Set $c=\sum_{i\in I}m_{i}-(n-1)d$. By BraDumPos1  and (DumPos, , Proposition
4.2), we can compute the multiplicity of containment of the $m$-plane
$L_{I_{1}}$ in ${\rm{Cr}}(D)$:

$\sum_{i\in I_{1}}(m_{i}-c)-m(d-c)=\sum_{i\in
I_{1}}m_{i}-md-c=(n-m-1)d-\sum_{i\in I_{2}}m_{i}=a,$

concluding the proof.

##  3 Weyl cycles in ${\mathbb{P}}^{n}$ blown up at $s$ points

In (olivia-nathan, , Definition 4.1) a smooth divisor $D$ in
$\operatorname{Pic}(X_{s}^{n})$ is called $(-1)$-class (or $(-1)$-divisorial
cycle) if $D$ is effective, integral and it satisfies $\langle D,D\rangle=-1$
and $\langle D,-K_{X_{s}^{n}}\rangle=n-1.$ In (olivia-nathan, , Theorem 0.5),
it is proved that $D$ is a $(-1)$-class if and only if it is in the Weyl orbit
of some exceptional divisor $E_{i}$. Notice that if $i\in I$, then
${\rm{Cr}}_{I}(E_{i})=L_{I\setminus\\{i\\}}$ is a hyperplane through $n$ base
points.

Here we generalize the definition of $(-1)$-classes to cycles of higher
codimension in $X^{n}_{s}$, as follows. We will say that two divisors $D$ and
$F$ are _orthogonal_ if $\langle D,F\rangle=0$.

###### Definition 1

We say that an effective divisor $D\in\operatorname{Pic}(X^{n}_{s})$ is a Weyl
divisor if it belongs to the Weyl orbit of an exceptional divisor $E_{i}$. A
non-trivial effective cycle $C\in A^{i}(X^{n}_{s})$ is a Weyl cycle of
codimension $i$ if it is an irreducible component of the intersection of
pairwise orthogonal Weyl divisors.

###### Remark 1

Let $s\geq n+1$ and $1\leq m\leq n-1$. Any $m$-plane $L$ spanned by $m+1$
points is a Weyl cycle. Indeed, it is easy to check that $L$ is the
intersection of $r=n-m$ pairwise orthogonal hyperplanes spanned by $n$ points.
By Lemma 1, any effective cycle $C$ contained in the Weyl orbit of a $m$-plane
$L$ spanned by $m+1$ base points is a Weyl cycle. In particular the Weyl
planes and Weyl lines studied in olivia-rick  are always Weyl cycles,
according to Definition 1.

###  3.1 Weyl curves

We collect here some results on Weyl cycles of codimension $n-1$ in
$X^{n}_{s}$, which we call Weyl curves. The following examples show explicitly
that the strict transforms of lines through two points and of the rational
normal curves of degree $n$ through $n+3$ points are Weyl curves in
$X^{n}_{s}$, according to Definition 1.

###### Example 1

Let $L=L_{12}$ be the line through $p_{1}$ and $p_{2}$, then
$L=D_{1}\cap\cdots\cap D_{n-1}$ where $D_{i}=L_{I_{i}}$ and
$I_{i}=\\{1,2,\ldots,n+1\\}\setminus\\{i+2\\}$ for any $1\leq i\leq n-1$.

###### Example 2

For any $i=1,\ldots,n-1$, consider the pairwise orthogonal Weyl divisors
$D_{i}=2H-2E_{1}-\ldots-2E_{n-1}-E_{n}-E_{n+1}-E_{n+2}-E_{n+3}+E_{i}.$ Once
can easily check that $D_{1}\cap\cdots\cap D_{n-1}$ is the union of $L_{1\dots
n-1}$ and the rational normal curve of degree $n$ through $n+3$ points.

We recall that the Chow group of algebraic curves $A^{n-1}(X^{n}_{s})$ is
generated by $h^{1},e_{i}^{1}$, the classes of a general line in $X^{n}_{s}$
and of a general line on the exceptional divisor $E_{i}$, respectively. When
$n=4$, the following formula describes the action on curves of the standard
Cremona transformation ${\rm{Cr}}_{J}$, based on the set $J$ olivia-rick  for
$n=4$ if $C=\delta h^{1}-\sum_{i=1}^{s}\mu_{i}e_{i}^{1}$, then

${\rm{Cr}}_{J}(C)=(4\delta-3\sum_{j\in{J}}\mu_{j})h^{1}-\sum_{j\in{J}}(\delta-\sum_{i\in{J}\setminus\\{j\\}}\mu_{i})e_{j}^{1}-\sum_{j\notin{J}}\mu_{j}e_{j}^{1}.$
(4)

Case $n=3$ is described in laface-ugaglia-TAMS . The general formula given in
equation 4 will be proved in an upcoming paper.

###### Remark 2

Given a divisor $D$ in $X^{n}_{s}$ and a line
$L_{ij}=h^{1}-e^{1}_{i}-e^{1}_{j}$ , then the multiplicity of containment of
the line $L_{ij}$ in the base locus of $D$ is exactly $\max\\{0,-D\cdot
L_{ij}\\}$, where $\cdot$ denotes the intersection product in the Chow ring of
$X^{n}_{s}$ (cf. (DumPos, , Proposition 4.2)). If $n=3,4$, the same holds for
any curve $C$ in the Weyl orbit of the line $L_{ij}$, thanks to formulas (4).

##  4 ${\mathbb{P}}^{3}$ blown up in 7 points

In this section we consider Weyl cycles of $X^{3}_{7}$, the blow up of
${\mathbb{P}}^{3}$ at $7$ points in general position. Recall that $X^{3}_{7}$
is a Mori Dream Space and that the cone of effective divisors is generated by
the divisors of anticanonical degree $\frac{1}{2}\langle
D,-K_{X^{3}_{7}}\rangle=1$. These are exactly the Weyl divisors and they fit
in five different types, modulo index permutation.

###### Proposition 1

The Weyl divisors in $X^{3}_{7}$ are, modulo index permutation:

  1. (1)

$E_{i}$ (exceptional divisor);

  2. (2)

$H-E_{1}-E_{2}-E_{3}$ (planes through three points);

  3. (3)

$2H-2E_{1}-E_{2}-E_{3}-E_{4}-E_{5}-E_{6}$ (pointed cone over the twisted
cubic);

  4. (4)

$3H-2(E_{1}+E_{2}+E_{3}+E_{4})-E_{5}-E_{6}-E_{7}$ (_Cayley nodal cubic_);

  5. (5)

$4H-3E_{1}-2(E_{1}+E_{2}+E_{3}+E_{4}+E_{5}+E_{6}+E_{7})$.

###### Proof

It is easy to compute the Weyl orbit of a plane through $3$ points, by
applying formula (3).

###### Proposition 2

The Weyl curves in $X^{3}_{7}$ are the fixed lines $h^{1}-e^{1}_{i}-e^{1}_{j}$
and the fixed twisted cubics $3h^{1}-\sum_{i=1}^{7}e_{i}^{1}+e_{j}^{1}$.

###### Proof

For every pair of orthogonal Weyl divisors as in Proposition 2, one can check
that the intersection is the union of fixed lines and twisted cubics.

From the previous result we can conclude that our Definition 1 of Weyl curves
in $X^{3}_{7}$ is equivalent to the definition of Weyl line of olivia-rick .

In the following result we describe the intrinsic geometry of the Weyl
divisors of $X^{3}_{7}$, showing that they are covered by pencils of rational
curves parametrized by a Weyl curve.

###### Proposition 3

Let $D$ be Weyl divisor on $X^{3}_{7}$. If $C\subset D$ is a Weyl curve, then
there is a pencil of rational curves $\\{C_{q}:q\in C\\}$ with $C_{q}\cdot
D=0$ sweeping out $D$.

###### Proof

We will consider the divisors (2)-(5) from Proposition 2. It is easy to check
what Weyl curves are contained in $D$, using Remark 2. For each such
containment $C\subseteq D$, we will find a suitable pencil of curves,
parametrised by $C$, sweeping out $D$.

(2) Let us consider the fixed hyperplane $D=H-E_{1}-E_{2}-E_{3}$ and the Weyl
line $L_{12}\subset D$. Such plane is swept out by the pencil of lines through
$p_{3}$ and with a point $q\in L_{12}$: $\\{{C^{1}_{3}(q)}:q\in L_{12}\\}$.
Since the cycle class of $C^{1}_{3}(q)$ is $h^{1}-e_{3}^{1}$, then we obtain
$C^{1}_{3}(q)\cdot D=0$.

(3) The quadric surface $D=2H-2E_{1}-E_{2}-E_{3}-E_{4}-E_{5}-E_{6}$ contains
the fixed twisted cubic $C^{3}_{1,\dots,6}=3h^{1}-\sum_{i=1}^{6}e_{i}^{1}$.
Since it is the strict transform of a pointed cone, it is swept out by the
pencil of lines $\\{C^{1}_{1}(q):q\in C_{1,\dots,6}\\}$. Notice also that $D$
can be obtained from $H-E_{1}-E_{2}-E_{3}$ through the transformation
${\rm{Cr}}_{1,4,5,6}$ (cf. (3)). The latter preserves the line $L_{12}$ and,
for every $q\in L_{12}$, it sends the line ${C^{1}_{1}(q)}$ to the cubic curve
$C^{3}_{1,3,4,5,6}(q)$, see formula (4). Therefore we see that $D$ is also
swept out by the pencil $\\{C^{3}_{1,3,4,5,6}(q):q\in L_{12}\\}$.

(4) This surface is obtained from (3) via the standard Cremona transformation
${\rm{Cr}}_{2347}$. The image of the first pencil sweeping out (3) is the
pencil of cubics $\\{C^{3}_{1,\dots,4,7}(q):q\in C_{1,\dots,6}\\}$ and it
sweeps out (4). The images of the second pencil sweeping out (3) is
$\\{C^{5}_{3,4}(q):q\in L_{12}\\}$, where $C^{5}_{3,4}(q)$ is a quintic curve
with cycle class $5h-\sum_{i=1}^{7}e_{i}-e_{3}-e_{4}$ and passing through
$q\in L_{12}$: this pencil sweeps out (4).

(5) This surface is obtained from (4) via ${\rm{Cr}}_{1,5,6,7}$, On the one
hand we obtain that (5) is swept out by the pencil of quintics
$\\{C^{5}_{1,7}(q):q\in C_{1,\dots,6}\\}$. On the other hand the surface is
covered by the pencil of septic curves $C^{7}_{2}(q)$ with class
$7h-2\sum_{i=1}^{7}e_{i}+e_{2}$ passing through $q\in L_{12}$:
$\\{C^{7}_{2}(q):q\in L_{12}\\}$.

In each of the above, since the intersection product $\cdot$ is preserved
under Cremona transformation, we can conclude.

##  5 ${\mathbb{P}}^{4}$ blown up in $8$ points

###  5.1 Curves in $X^{4}_{8}$

We consider the following classes of moving curves in $A^{3}(X^{4}_{8})$, each
obtained from the previous via a standard Cremona transformation (see formula
(4) and a permutation of indices. They each live in a $4$-dimensional family.

  * •

$h^{1}-e^{1}_{i}$, for any $i\in\\{1,\ldots,8\\}$,

  * •

$4h^{1}-\sum_{i\in J}e^{1}_{i}$, for any $J\subset\\{1,\ldots,8\\}$ with
$|J|=6$,

  * •

$7h^{1}-\sum_{i\in J}2e^{1}_{i}-\sum_{i\not\in J}e^{1}_{i}$, for any $J$ with
$|J|=3$,

  * •

$10h^{1}-e_{i_{1}}-3e_{i_{2}}-\sum_{i\neq i_{1},i_{2}}2e^{1}_{i}$, for any
$i_{1}\neq i_{2}$, $i_{1},i_{2}\in\\{1,\ldots,8\\}$,

  * •

$13h^{1}-\sum_{i\in J}2e^{1}_{i}-\sum_{i\not\in J}3e^{1}_{i}$, for any $J$
with $|J|=3$.

  * •

$16h^{1}-\sum_{i\in J}4e^{1}_{i}-\sum_{i\not\in J}3e^{1}_{i}$, for any $J$
with $|J|=2$.

The families of curves in Notation 5.1 correspond to facets of the effective
cone of divisors on $X^{4}_{8}$, see CCF . Here we include a proof via our
geometrical approach.

###### Proposition 4

Let $D=dH-\sum m_{i}E_{i}$ be a divisor in $X^{4}_{8}$. If $D$ is effective,
then we have:

  * •

$m_{i}\leq d$, for every $i\in\\{1,\ldots,8\\}$,

  * •

$\sum_{i\in J}m_{i}-4d\leq 0$, for any $J\subset\\{1,\ldots,8\\}$ with
$|J|=6$,

  * •

$\sum_{i\in J}2m_{i}+\sum_{i\not\in J}m_{i}-7d\leq 0$, for any $J$ with
$|J|=3$,

  * •

$m_{i_{1}}+3m_{i_{2}}+\sum_{i\neq i_{1},i_{2}}2m_{i}-10d\leq 0$, for any
$i_{1}\neq i_{2}$, $i_{1},i_{2}\in\\{1,\ldots,8\\}$,

  * •

$\sum_{i\in J}2m_{i}+\sum_{i\not\in J}3m_{i}-13d\leq 0$, for any $J$ with
$|J|=3$.

  * •

$\sum_{i\in J}4m_{i}+\sum_{i\not\in J}3m_{i}-16d\leq 0$, for any $J$ with
$|J|=2$.

The first two inequalities were also proved in (BraDumPos1, , Lemma 2.2).

###### Proof

Notice that each $4$-dimensional family of Notation 5.1 covers
$X^{4}_{8}\setminus\bigcup_{i}E_{i}$, indeed for each general point in
$X^{4}_{8}\setminus\bigcup_{i}E_{i}$ we find one curve of the family that
passes through it. Now, if $D\cdot(h^{1}-e^{1}_{i})=d-m_{i}<0$, then $D$
contains each line in the family in its base locus, but this contradicts the
assumption that $D$ is effective. This proves the first inequality. The
remaining inequalities are proved similarly.

###  5.2 Further blow up of ${\mathbb{P}}^{4}$.

For any $1\leq i\leq 8$, we denote by $C_{\widehat{i}}$ the rational normal
quartic curve passing through seven base points and skipping the $i$th point.
Consider now

$X^{4}_{8,(1)}\stackrel{{\scriptstyle p}}{{\rightarrow}}X^{4}_{8},$

the blow up of $X^{4}_{8}$ along the $28$ lines $L_{ij}$ and the $8$ curves
$C_{\widehat{i}}$. The Picard group of $X^{4}_{8,(1)}$ is
$\operatorname{Pic}(X^{4}_{8,(1)})=<H,E_{i},E_{ij},E_{C_{\widehat{i}}}>,$
where, abusing notation, we denote again by $E_{i}$ the pull-back
$p^{*}(E_{i})$ and by $H$ the pull-back $p^{*}(H)$, while $E_{ij}$ and
$E_{C_{\widehat{i}}}$ are the exceptional divisors of the curves. Notice that
$E_{i}$ is a blown up ${\mathbb{P}}^{3}$ in $14$ general points, $X^{3}_{14}$,
while $E_{ij}\cong{\mathbb{P}}^{1}\times{\mathbb{P}}^{2}$ and
$E_{C_{\widehat{i}}}\cong C_{\widehat{i}}\times{\mathbb{P}}^{2}$.

For any $D\in\operatorname{Pic}(X^{4}_{8})$, of the form
$D=dH-\sum_{i=1}^{8}m_{i}E_{i}$, the strict transform $\widetilde{D}$ of $D$
under $p$ satisfies

$\widetilde{D}:=D-\sum k_{ij}E_{ij}-\sum
k_{C_{\widehat{i}}}E_{C_{\widehat{i}}}.$ (5)

where $k_{ij}$ and $k_{C_{\widehat{i}}}$ are defined in Remark 2.

Let us consider now the Chow group of $2$-cycles of $X^{4}_{8,(1)}$:

$A^{2}(X^{4}_{8,(1)})=\langle
h,e_{i},e_{ij},f_{ij},e_{C_{\widehat{i}}},f_{C_{\widehat{i}}}\rangle.$

where $h$ is the pullback of a general plane of ${\mathbb{P}}^{4}$, $e_{i}$ is
the pull-back of a general plane contained in $E_{i}$,
$f_{ij}\cong{\mathbb{P}}^{2}$ is the fiber over a point of the line and
$e_{ij}\cong{\mathbb{P}}^{1}\times{\mathbb{P}}^{1}$ is the transverse
direction, $f_{C_{\widehat{i}}}$ is the fiber over a point of the curve
$C_{\widehat{i}}$ and $e_{C_{\widehat{i}}}$ is the transverse direction. In
the Chow ring $A^{*}(X^{4}_{8,(1)})$ we have the following relations:

$H^{2}=h,\quad E_{i}^{2}=-e_{i},\quad HE_{i}=0,\quad E_{i}E_{j}=0$ (6)
$HE_{ij}=E_{i}E_{ij}=f_{ij},\quad E_{i}E_{jk}=0$ (7)
$E_{ij}^{2}=-e_{ij}-f_{ij},\quad E_{ij}E_{ik}=0,\quad E_{ij}E_{kl}=0$ (8)
$H^{4}=h^{2}=1,\quad E_{i}^{4}=e_{i}^{2}=-1,\quad f_{ij}e_{ij}=e_{ij}^{2}=-1$
(9) $f_{ij}^{2}=e_{i}f_{ij}=0,\quad he_{i}=hf_{ij}=0,\quad
e_{i}e_{ij}=he_{ij}=0.$ (10)

###  5.3 Classification of the Weyl surfaces

The section contains one of the main results of this paper. We construct five
Weyl surfaces in $X_{8}^{4}$ and we prove that they are the only such cycles,
modulo index permutation. For any surface, we also give its exact multiplicity
of containment in a given divisor and its class in the Chow ring of
$X^{4}_{8,(1)}$.

###### Proposition 5

Let $S^{1}=S^{1}_{1,4,5}$ be the plane $L_{145}$ through three points in
${\mathbb{P}}^{4}$.

  * •

Given an effective divisor $D=dH-\sum m_{i}E_{i}$ in $X^{4}_{8}$, let

$k_{S^{1}}(D)=\max\\{0,m_{1}+m_{4}+m_{5}-2d\\}.$

Then the surface $S^{1}$ is contained in the base locus of $D$ exactly
$k_{S^{1}}(D)$ times.

  * •

The class of the strict transform $\widetilde{S^{1}}$ of $S^{1}$ in the Chow
group $A^{2}(X^{4}_{8,(1)})$ is

$h-e_{1}-e_{4}-e_{5}-\sum_{i,j\in\\{1,4,5\\}}(e_{ij}-f_{ij}).$

###### Proof

The first part of the statement follows from BraDumPos1  and (DumPos, ,
Proposition 4.2).

Consider the fixed hyperplanes $D_{0}:=H-E_{1}-E_{3}-E_{4}-E_{5}$ and
$F_{0}:=H-E_{1}-E_{2}-E_{4}-E_{5}$. Let $\widetilde{D_{0}}$ and
$\widetilde{F_{0}}$ be their strict transforms on $X^{4}_{8,(1)}$, see (5).
Clearly we have $S^{1}=D_{0}\cap F_{0}$, and
$\widetilde{S^{1}}=\widetilde{D_{0}}\cap\widetilde{F_{0}}$. By using relations
(6), (7), (8), we compute
$\widetilde{D_{0}}\cap\widetilde{F_{0}}=h-e_{1}-e_{4}-e_{5}-\sum_{i,j\in\\{1,4,5\\}}(e_{ij}-f_{ij}).$

Using Lemma 2 we obtain the following.

###### Lemma 3

Given a subset $I=\\{i_{1},\ldots,i_{5}\\}\subseteq\\{1,\ldots,8\\}$ and a
divisor $D=dH-\sum m_{i}E_{i}$ in $X_{8}^{4}$. If

$d-m_{i_{1}}-m_{i_{2}}=a\geq 1,$

then the $2$-plane $L_{i_{3}i_{4}i_{5}}$ is contained in ${\rm{Cr}}_{I}(D)$
exactly $a$ times.

###### Lemma 4

Let $I=\\{i_{1},i_{2},i_{3},i_{4},i_{5}\\}$ and $J=\\{i_{1},i_{2},i_{6}\\}$
two subset of $\\{1,\ldots,8\\}$, such that $|I\cap J|=2$. If ${\rm{Cr}}_{I}$
is the standard Cremona transformation based on $I$, then the plane $L_{J}$ is
${\rm{Cr}}_{I}$-invariant, that is ${\rm{Cr}}_{I}(L_{J})=L_{J}$.

###### Proof

Consider the hyperplanes $D=L_{i_{1}i_{2}i_{3}i_{6}}$ and
$F=L_{i_{1}i_{2}i_{4}i_{6}}$. We have $D\cap F=L_{i_{1}i_{2}i_{6}}=L_{J}$.
Clearly ${\rm{Cr}}_{I}(D)=D$ and ${\rm{Cr}}_{I}(F)=F$ and hence also

${\rm{Cr}}_{I}(L_{J})={\rm{Cr}}(D\cap
F)\subseteq{\rm{Cr}}_{I}(D)\cap{\rm{Cr}}_{I}(F)=D\cap F=L_{J}.$

###### Proposition 6

Let ${J}:=\\{1,2,3,6,7\\}$ and consider the Cremona transformation
${\rm{Cr}}_{{J}}$. Let $S^{1}=L_{145}$. Then $S^{3}:={\rm{Cr}}_{{J}}(S^{1})$
is the strict transform of cubic pointed cone over the rational normal curve
$C_{\widehat{8}}$ and the point $p_{1}$.

  * •

Given a divisor $D=dH-\sum m_{i}E_{i}$, let

$k_{S^{3}}(D)=\max\\{0,2m_{1}+m_{2}+m_{3}+m_{4}+m_{5}+m_{6}+m_{7}-5d\\}.$

Then the surface $S_{3}$ is contained in the base locus of $D$ exactly
$k_{S^{3}}(D)$ times.

  * •

The class of the strict transform $\widetilde{S^{3}}$ of $S^{3}$ in the Chow
group $A^{2}(X^{4}_{8,(1)})$ is

$3h-3e_{1}-\sum_{i=2}^{7}e_{i}-(e_{C_{\widehat{8}}}-f_{C_{\widehat{8}}})-\sum_{i=2}^{7}(e_{1i}-f_{1i})$

###### Proof

The plane $S^{1}=L_{145}$ is swept out by the pencil of lines
$\\{C^{1}(q):q\in L_{14}\\}$, where the cycle class of $C^{1}(q)$ is
$h^{1}-e_{5}^{1}$ and it passes through the point $q\in L_{14}$. Using
formulas (4) and the same idea as in the proof of Proposition 3, we compute
the images of the line $L_{14}=h^{1}-e^{1}_{1}-e^{1}_{4}$ and of the pencil of
lines $\\{C^{1}(q):q\in L_{14}\\}$ of class $h^{1}-e^{1}_{5}$ via the
transformation ${\rm{Cr}}_{{J}}$. We have ${\rm{Cr}}_{{J}}(L_{14})=L_{14}$ and
${\rm{Cr}}_{{J}}(C^{1}(q))=C^{4}(q)$ where $C^{4}(q)$ is rational curve with
class $4h^{1}-e_{1}^{1}-e_{2}^{1}-e_{3}^{1}-e_{5}^{1}-e_{6}^{1}-e_{7}^{1}$ and
passing through $q$. Thus we get that the surface $S_{3}$ is swept out by the
pencil $\\{{C^{4}(q)}:q\in L_{14}\\}$. Therefore $D$ contains any curve
$C^{4}(q)$, and hence $S_{3}$, in its base locus at least
$\max\\{0,m_{1}+m_{2}+m_{3}+m_{5}+m_{6}+m_{7}+\max\\{0,m_{1}+m_{4}-d\\}-4d\\}$
times. Notice that we have $m_{1}+m_{2}+m_{3}+m_{5}+m_{6}+m_{7}-4d\leq 0$,
since $D$ is effective, by Proposition 4. Hence the claim follows.

Now we prove the second statement. Given $D_{0}$ and $F_{0}$ defined in the
previous proposition, recall that $D_{0}\cap F_{0}=S^{1}$. We consider now
their images $D_{1}={\rm{Cr}}_{J}(D_{0})$ and $F_{1}={\rm{Cr}}_{J}(F_{0})$:

$\displaystyle D_{1}=2H-2E_{1}-E_{2}-2E_{3}-E_{4}-E_{5}-E_{6}-E_{7}$
$\displaystyle F_{1}=2H-2E_{1}-2E_{2}-E_{3}-E_{4}-E_{5}-E_{6}-E_{7}.$

Clearly $S^{3}\subseteq D_{1}\cap F_{1}$. By Proposition 5 we easily see that
the only plane contained in $D_{1}\cap F_{1}$ is $L_{123}$. Moreover it is
easy to check that the intersection $D_{1}\cap F_{1}$ does not intersect the
indeterminacy locus of the Cremona transformation ${\rm{Cr}}_{J}$ in any other
$2$-dimensional component. Hence $D_{1}\cap F_{1}$ is the union of the plane
$L_{123}$ and an irreducible cubic surface with one triple point in $p_{1}$
and 6 simple points. We conclude that $S^{3}$ is exactly such cubic surface.

We now shall describe the class of $S^{3}$ in $A^{2}(X^{4}_{8,(1)})$. Let
$\widetilde{D_{1}}$ and $\widetilde{F_{1}}$ be the corresponding strict
transforms under the blow up of lines and rational normal curves in
$X^{4}_{8,(1)}$. By (5), we have

$\displaystyle\widetilde{D_{1}}=2H-2E_{1}-E_{2}-2E_{3}-\sum_{i=4}^{7}E_{i}-2E_{13}-\sum_{i\in\\{1,3\\},k\in\\{2,4,5,6,7\\}}E_{ik}-E_{C_{\widehat{8}}}$
$\displaystyle\widetilde{F_{1}}=2H-2E_{1}-2E_{2}-\sum_{i=3}^{7}E_{i}-2E_{12}-\sum_{1\leq
i\leq 2,3\leq k\leq 7}E_{ik}-E_{C_{\widehat{8}}}.$

By using relations (6), (7), (8), we compute the intersection:

$\widetilde{D_{1}}\cap\widetilde{F_{1}}=(h-e_{1}-e_{2}-e_{3}-\sum_{i,j\in\\{1,2,3\\}}(e_{ij}-f_{ij}))+(3h-3e_{1}-\sum_{i=2}^{7}e_{i}-(e_{C_{\widehat{8}}}-f_{C_{\widehat{8}}})-\sum_{i=2}^{7}(e_{1i}-f_{1i})).$

Finally by Proposition 5, we can conclude.

We will denote by ${S}_{i,\widehat{j}}^{3}$ the cubic surface with a triple
point at $p_{i}$ and multiplicity zero at $p_{j}$.

###### Proposition 7

Let ${J}:=\\{2,3,4,5,8\\}$ and consider the Cremona transformation
${\rm{Cr}}_{{J}}$. Then $S^{6}:={\rm{Cr}}_{{J}}(S^{3})$ is a surface of degree
$6$ with five triple points.

  * •

Given an effective divisor $D=dH-\sum m_{i}E_{i}$, let

$k_{S_{6}}(D)=\max\\{0,2(m_{1}+m_{2}+m_{3}+m_{4}+m_{5})+m_{6}+m_{7}+m_{8}-8d\\}.$

Then the surface $S_{6}$ is contained in the base locus of $D$ exactly
$k_{S_{6}}(D)$ times.

  * •

The class in $A^{2}(X^{4}_{8,(1)})$ of strict transform $\widetilde{S^{6}}$ of
$S^{6}$ in $X^{4}_{8,(1)}$ is

$6h-3\sum_{i=1}^{5}e_{i}-\sum_{i=6}^{8}e_{i}-\sum_{i,j\in\\{1,2,3,4,5\\},i\neq
j}(e_{ij}-f_{ij})-\sum_{k=6}^{8}(e_{C_{\widehat{k}}}-f_{C_{\widehat{k}}}).$

###### Proof

We know from the previous proposition that the surface $S^{3}$ is swept out by
a pencil of rational normal quartic curves $\\{{C^{4}(q)}:q\in L_{14}\\}$. By
(4), we obtain that the image of the pencil is $\\{{C^{7}(q)}:q\in L_{14}\\}$,
where $C^{7}(q)$ is a rational septic curve with class
$7h^{1}-\sum_{i=1}^{8}e_{i}^{1}-e_{2}^{1}-e_{3}^{1}-e_{5}^{1}$ and passing
through $q\in L_{14}$. Since the surface $S^{6}$ is swept out by this, we can
say that $D$ contains $S^{6}$ in its base locus at least
$\max\\{0,m_{1}+2m_{2}+2m_{3}+m_{4}+2m_{5}+m_{6}+m_{7}+m_{8}+\max\\{0,m_{1}+m_{4}-d\\}-7d\\}$
times. Since $D$ is effective, by Proposition 4 we have
$m_{1}+2m_{2}+2m_{3}+m_{4}+2m_{5}+m_{6}+m_{7}+m_{8}-7d\leq 0$, hence the claim
follows.

Now we prove the second statement. Given $D_{1}$ and $F_{1}$ defined in the
previous proposition, recall that $D_{1}\cap F_{1}=L_{123}\cup S^{3}$. We
consider now $D_{2}={\rm{Cr}}_{J}(D_{1})$ and $F_{2}={\rm{Cr}}_{J}(F_{1})$ to
be their image under the Cremona transformation and we get:

$\displaystyle D_{2}=3Hx-2E_{1}-2E_{2}-3E_{3}-2E_{4}-2E_{5}-E_{6}-E_{7}-E_{8}$
$\displaystyle F_{2}=3H-2E_{1}-3E_{2}-2E_{3}-2E_{4}-2E_{5}-E_{6}-E_{7}-E_{8}.$

We now analyse the intersection $D_{2}\cap F_{2}$. Note that
${\rm{Cr}}_{J}(L_{123})=L_{123}$, by Lemma 4. By Proposition 5 we see that the
only planes contained in $D_{2}\cap F_{2}$ are $L_{123},L_{234},L_{235}$.
Finally we check that the intersection of $D_{2}\cap F_{2}$ with the
indeterminacy locus of ${\rm{Cr}}_{J}$ does not contain any other
$2$-dimensional component, besides the planes $L_{234}$ and $L_{235}$. Hence
the intersection $D_{2}\cap F_{2}$ splits into four components: the three
planes $L_{123},L_{234},L_{235}$ and a sextic surface with five triple points
at $p_{1}$ and three simple points. Hence we conclude that $S^{6}$ is exactly
the sextic irreducible surface.

We now describe the class of $S^{6}$ in $X^{4}_{8,(1)}$. Let
$\widetilde{D_{2}}$ and $\widetilde{F_{2}}$ be the corresponding strict
transforms under the blow up of lines and rational normal curves in
$X^{4}_{8,(1)}$, see (5). We have

$\widetilde{D_{2}}=3H-\sum_{i\in\\{1,2,4,5\\}}2E_{i}-3E_{3}-\sum_{i=6}^{8}E_{i}-\sum_{i\in\\{1,2,4,5\\}}2E_{3i}-\sum_{i=6}^{8}E_{3i}-\sum_{i,j\in\\{1,2,4,5\\},i\neq
j}E_{ij}-\sum_{i=6}^{8}E_{C_{\widehat{i}}}$
$\widetilde{F_{2}}=3H-\sum_{i\in\\{1,3,4,5\\}}2E_{i}-3E_{2}-\sum_{i=6}^{8}E_{i}-\sum_{i\in\\{1,3,4,5\\}}2E_{2i}-\sum_{i=6}^{8}E_{2i}-\sum_{i,j\in\\{1,3,4,5\\},i\neq
j}E_{ij}-\sum_{i=6}^{8}E_{C_{\widehat{i}}}$

Computing their complete intersection, we have:

$\widetilde{D_{2}}\cap\widetilde{F_{2}}=(h-e_{1}-e_{2}-e_{3}-\sum_{i,j\in\\{1,2,3\\},i\neq
j}(e_{ij}-f_{ij}))+$ $+(h-e_{2}-e_{3}-e_{4}-\sum_{i,j\in\\{2,3,4\\},i\neq
j}(e_{ij}-f_{ij}))+(h-e_{2}-e_{3}-e_{5}-\sum_{i,j\in\\{2,3,5\\}}(e_{ij}-f_{ij}))+$
$(6h-3\sum_{i=1}^{5}e_{i}-\sum_{i=6}^{8}e_{i}-\sum_{i,j\in\\{1,2,3,4,5\\},i\neq
j}(e_{ij}-f_{ij})-\sum_{k=6}^{8}(e_{C_{\widehat{k}}}-f_{C_{\widehat{k}}}))$

where we use relations (6), (7), (8), and we conclude.

We will denote by ${S}_{i,j,k}^{6}$ the sextic surface with five triple points
at $\\{p_{h}\\}$ for $h\neq i,j,k$.

###### Proposition 8

Let ${J}:=\\{1,2,6,7,8\\}$ and consider the Cremona transformation
${\rm{Cr}}_{l{J}}$. Then $S^{10}:={\rm{Cr}}_{{J}}(S^{6})$ is a surface of
degree $10$ with two sextuple points and six triple points.

  * •

Given an effective divisor $D=dH-\sum m_{i}E_{i}$, let

$k_{S^{10}}(D)=\max\\{0,3(m_{1}+m_{2})+2(m_{3}+m_{4}+m_{5}+m_{6}+m_{7}+m_{8})-11d\\}.$

Then the surface $S^{10}$ is contained in the base locus of $D$ exactly
$k_{S^{10}}(D)$ times.

  * •

The class of the strict transform $\widetilde{S^{10}}$ of $S^{10}$ in
$A^{2}(X^{4}_{8,(1)})$ is

$10h-6e_{1}-6e_{2}-\sum_{i=3}^{8}3e_{i}-3(e_{12}-f_{12})-\sum_{i=1}^{2}\sum_{j=3}^{8}(e_{ij}-f_{ij})-\sum_{k=3}^{8}(e_{C_{\widehat{k}}}-f_{C_{\widehat{k}}}).$

###### Proof

We know from the previous proposition that the surface $S^{6}$ is swept out by
the pencil of rational septic curves $\\{{C^{7}(q)}:q\in L_{14}\\}$. By (4),
we obtain that the image of the pencil is $\\{{C^{10}(q)}:q\in L_{14}\\}$,
where $C^{10}(q)$ is a rational curve with class
$10h^{1}-2e_{1}^{1}-3e_{2}^{1}-2e_{3}^{1}-e_{4}^{1}-2e_{5}^{1}-2e_{6}^{1}-2e_{7}^{1}-2e_{8}^{1}$
and passing through $q\in L_{14}$. Since the surface $S^{10}$ is swept out by
this pencil, we can say that $D$ contains $S^{10}$ in its base locus at least
$\max\\{0,2m_{1}+3m_{2}+2m_{3}+m_{4}+2m_{5}+2m_{6}+2m_{7}+2m_{8}+\max\\{0,m_{1}+m_{4}-d\\}-10d\\}$
times. Since $2m_{1}+3m_{2}+2m_{3}+m_{4}+2m_{5}+2m_{6}+2m_{7}+2m_{8}-10d\leq
0$, by Proposition 4 then we the claim follows.

Now we prove the second statement. Given $D_{2}$ and $F_{2}$ defined in the
previous proposition, recall that $D_{2}\cap F_{2}=S^{6}\cup L_{123}\cup
L_{234}\cup L_{235}$. We consider now $D_{3}={\rm{Cr}}_{J}(D_{2})$ and
$F_{3}={\rm{Cr}}_{J}(F_{2})$ to be their image under the Cremona
transformation and we get

$\displaystyle
D_{3}=5H-4E_{1}-4E_{2}-3E_{3}-2E_{4}-2E_{5}-3E_{6}-3E_{7}-3E_{8}$
$\displaystyle
F_{3}=4H-3E_{1}-4E_{2}-2E_{3}-2E_{4}-2E_{5}-2E_{6}-2E_{7}-2E_{8}.$

It is easy to check, by applying the previous propositions, that the
intersection $D_{3}\cap F_{3}$ contains the planes
${L}_{123},{L}_{126},{L}_{127},{L}_{128}$ and the cubic surfaces
${S}_{2,\widehat{4}}^{3}$ and ${S}_{2,\widehat{5}}^{3}$. Notice that
${\rm{Cr}}_{J}(L_{123})=L_{123}$ by Lemma 4, and
${\rm{Cr}}_{J}(L_{234})={S}_{2,\widehat{5}}^{3}$,
${\rm{Cr}}_{J}(L_{235})={S}_{2,\widehat{4}}^{3}$, by Proposition 6. By
computing the intersection of $D_{3}\cap F_{3}$ with the indeterminacy locus
of ${\rm{Cr}}_{J}$ we see that there are no other $2$-dimensional components,
besides the planes ${L}_{126},{L}_{127},{L}_{128}$. Hence we conclude that
$S^{10}$ is an irreducible surface with degree $10$ and two sixtuple points at
$p_{1}$ and $p_{2}$ and 6 triple points.

Finally we describe the class of $S^{10}$ in $X_{8,(1)}^{4}$. Let
$\widetilde{D_{3}}$ and $\widetilde{F_{3}}$ be the corresponding strict
transforms under the blow up of lines and rational normal curves in
$X^{4}_{8,(1)}$, see (5). Computing their complete intersection, as in the
previous case we get our claim.

###### Proposition 9

Let ${J}:=\\{3,4,5,6,7\\}$ and consider the Cremona transformation
${\rm{Cr}}_{{J}}$. Then $S^{15}:={\rm{Cr}}_{{J}}(S^{10})$ is a surface of
degree $15$ with one triple point and seven sextuple points.

  * •

Given an effective divisor $D=dH-\sum m_{i}E_{i}$, let

$k_{S^{15}}(D)=\max\\{0,3(m_{1}+m_{2}+m_{3}+m_{4}+m_{5}+m_{6}+m_{7})-2m_{8}-14d\\}.$

Then the surface $S^{15}$ is contained in the base locus of $D$ exactly
$k_{S^{15}}(D)$ times.

  * •

The class of the strict transform $\widetilde{S^{15}}$ of $S^{15}$ in
$A^{2}(X^{4}_{8,(1)})$ is

$15h-\sum_{i=1}^{7}6e_{i}-3e_{8}-\sum_{1\leq i<j\leq
7}(e_{ij}-f_{ij})-\sum_{i=1}^{7}(e_{C_{\widehat{i}}}-f_{C_{\widehat{i}}})-3(e_{C_{\widehat{8}}}-f_{C_{\widehat{8}}}).$

###### Proof

We know from the previous proposition that the surface $S^{10}$ is swept out
by the pencil of rational septic curves $\\{{C^{10}(q)}:q\in L_{14}\\}$. By
(4), we obtain that the image of the pencil is $\\{{C^{13}(q)}:q\in
L_{14}\\}$, where $C^{13}(q)$ is a rational curve with class
$13h^{1}-2e_{1}^{1}-3e_{2}^{1}-3e_{3}^{1}-2e_{4}^{1}-3e_{5}^{1}-3e_{6}^{1}-3e_{7}^{1}-2e_{8}^{1}$
and passing through $q\in L_{14}$. Since the surface $S^{15}$ is swept out by
this pencil, we can say that $D$ contains $S^{15}$ in its base locus at least
$\max\\{0,2m_{1}+3m_{2}+3m_{3}+2m_{4}+3m_{5}+3m_{6}+3m_{7}+2m_{8}+\max\\{0,m_{1}+m_{4}-d\\}-13d\\}$
times. Since $2m_{1}+3m_{2}+3m_{3}+2m_{4}+3m_{5}+3m_{6}+3m_{7}+2m_{8}-13d\leq
0$ by Proposition 4, then we the claim follows.

Now we prove the second statement. Given $D_{3}$ and $F_{3}$ defined in the
previous proposition, recall that

$D_{3}\cap
F_{3}=S_{10}\cup{L}_{123}\cup{L}_{126}\cup{L}_{127}\cup{L}_{128}\cup{S}_{2,\widehat{4}}^{3}\cup{S}_{2,\widehat{5}}^{3}.$

We consider now $D_{4}={\rm{Cr}}_{J}(D_{3})$ and $F_{4}={\rm{Cr}}_{J}(F_{3})$
to be their image under the Cremona transformation.

$\displaystyle
D_{4}:=7H-4E_{1}-4E_{2}-5E_{3}-4E_{4}-4E_{5}-5E_{6}-5E_{7}-3E_{8}$
$\displaystyle
F_{4}:=6H-3E_{1}-4E_{2}-4E_{3}-4E_{4}-4E_{5}-4E_{6}-4E_{7}-2E_{8}.$

Now the intersection $D_{4}\cap F_{4}$ contains
${S}_{3,\widehat{8}}^{3}={\rm{Cr}}_{J}(L_{123})$ (by Proposition 6),
${S}_{6,\widehat{8}}^{3}={\rm{Cr}}_{J}(L_{126})$ (by Proposition 6),
${S}_{148}^{6}={\rm{Cr}}_{J}({S}_{2,\widehat{4}}^{3})$ (by Proposition 7),
${S}_{158}^{6}={\rm{Cr}}_{J}({S}_{2,\widehat{5}}^{3})$ (by Proposition 7).
Moreover we have the components: ${S}_{7,\widehat{8}}^{3}$, ${S}_{128}^{6}$,
and it can be easily proved that
${S}_{7,\widehat{8}}^{3}={\rm{Cr}}_{J}(L_{127})$ and
${S}_{128}^{6}={\rm{Cr}}_{J}(L_{128})$. Finally we check that the intersection
of $D_{4}\cap F_{4}$ with the indeterminacy locus of ${\rm{Cr}}_{J}$ does not
contain any $2$-dimensional component. Hence we conclude that $S^{15}$ is an
irreducible surface of degree $15$ and with a triple point at $p_{8}$ and
seven sextuple points.

Finally, as in the previous case, we compute the complete intersection of the
strict transforms $\widetilde{D_{4}}$ and $\widetilde{F_{4}}$, and we get our
statement.

###### Remark 3

We point out that the five Weyl surfaces described above correspond to the
same list computed by (CCF, , Theorem 8.7).

###### Remark 4

Notice that the class of a Weyl surface must be computed in the Chow ring of
$X^{4}_{8,(1)}$ in order to uniquely identify the surface. Indeed, for
instance, the class of $S^{3}$ in the Chow ring of $X^{4}_{8}$ is
$3h-3e_{1}-\sum_{i=2}^{7}e_{i}$, but so is the class of the union of the three
planes $L_{123}$, $L_{145}$ and $L_{167}$. This was predicted in (CLO, ,
Theorem 4.4) where the authors proved that the cone of effective $2$-cycles of
$X^{4}_{8}$ is linearly generated, namely each effective cycle can be written
as a sum of linear cycles. However, the three planes do not contain the
rational normal curve, whereas $S^{3}$ does. From this observation it is clear
that the cone of effective cycles of codimension $2$ of $X^{4}_{8,(1)}$ will
not be linearly generated.

###### Remark 5

Notice that, in Propositions 5,6,7,8,9 we used a specific sequence of Cremona
transformations to obtain each Weyl surface of $X^{4}_{8}$ from the previous.
This choice is clearly not unique, in fact there are multiple paths going from
one Weyl surface to another. Similarly, for each Weyl surface $S$ we found a
suitable pencil of curves over a Weyl curve $C\subseteq S$ that covers it.
This description is also not unique, in particular for every Weyl curve
$C\subseteq S$, we can find one such pencil.

###### Proposition 10

The five surfaces $S^{1},S^{3},S^{6},S^{10},S^{15}$ are the only Weyl surfaces
in $X^{4}_{8}$.

###### Proof

The statement can be proved by direct inspection. In Proposition 11 below we
classify all the Weyl divisors in $X^{4}_{8}$. Then we consider all the
possible intersection of two orthogonal Weyl divisors and, by using
Propositions 5, 6, 7, 8, 9, and computing degrees and multiplicities, we have
checked that all the irreducible components of the intersections are surfaces
of type $S^{1},S^{3},S^{6},S^{10},S^{15}$.

By the previous proposition we conclude that any Weyl surface of $X^{4}_{8}$
is contained in the orbit of a plane through $3$ points. Hence our Definition
1 of Weyl surface in this case coincide with the definition Weyl plane given
in olivia-rick .

From the proofs of Propositions 5, 6, 7, 8, 9, we get the following
consequence.

###### Corollary 1

Every Weyl surface on $X^{4}_{8}$ is swept out by a pencil of rational curves
curve $\\{C(q):q\in C\\}$ over a Weyl curve $C$.

###  5.4 Weyl divisors.

Recall that $X^{4}_{8}$ is a Mori Dream Space and in particular the cone of
effective divisors is finitely generated by the divisors of anticanonical
degree $\frac{1}{3}\langle D,-K_{X^{4}_{8}}\rangle=1$. A simple application of
formula (3) gives the following classification of all the Weyl divisors in
$X^{4}_{8}$; they are exactly the generators of the effective cone, see also
Mukai05 .

###### Proposition 11

The Weyl divisors in $X^{4}_{8}$ are, modulo permutation of indices:

  1. (1)

$E_{i}$, (the exceptional divisor)

  2. (2)

$H-\sum_{i=1}^{4}E_{i}$, (hyperplane through four points);

  3. (3)

$2H-2E_{1}-2E_{1}-\sum_{i=3}^{7}E_{i}$, (quadric cone, join of a rational
normal quartic and a line);

  4. (4)

$3H-\sum_{i=1}^{7}2E_{i}$, (the $2$-secant variety to a rational normal
quartic);

  5. (5)

$3H-3E_{1}-\sum_{i=2}^{5}2E_{i}-\sum_{i=6}^{8}E_{i}$, (cone on the Cayley
surface of ${\mathbb{P}}^{3}$);

  6. (6)

$4H-\sum_{i=1}^{4}3E_{i}-\sum_{i=5}^{7}2E_{i}-E_{8}$, with $|J|=4$ and
$j\notin J$;

  7. (7)

$4H-4E_{1}-3E_{2}-\sum_{i=3}^{8}2E_{i}$, (cone on a quartic surface of
${\mathbb{P}}^{3}$);

  8. (8)

$5H-4E_{1}-4E_{2}-\sum_{i=3}^{6}3E_{i}-2E_{7}-2E_{8}$;

  9. (9)

$6H-5E_{1}-\sum_{i=2}^{4}4E_{i}-\sum_{i=5}^{8}3E_{i}$;

  10. (10)

$6H-\sum_{i=1}^{6}4E_{i}-3E_{7}-2E_{8}$;

  11. (11)

$7H-\sum_{i=1}^{3}5E_{i}-\sum_{i=4}^{7}4E_{i}-3E_{8}$;

  12. (12)

$7H-6E_{1}-\sum_{i=2}^{8}4E_{i}$;

  13. (13)

$8H-6E_{1}-\sum_{i=2}^{6}5E_{i}-4E_{7}-4E_{8}$;

  14. (14)

$9H-\sum_{i=1}^{4}6E_{i}-\sum_{i=5}^{8}5E_{i}$;

  15. (15)

$10H-7E_{1}-\sum_{i=2}^{8}6E_{i}$.

We conclude this section with the following geometrical descriptions of the
Weyl divisors on $X^{4}_{8}$. As pencils of curves with cycle class as in
Notation 5.1 sweep out Weyl surfaces of $X^{4}_{8}$, nets of such curves sweep
out Weyl divisors.

###### Lemma 5

Let $D$ be a Weyl divisor on $X^{4}_{8}$ containing a Weyl surface $S$. Then
there is a net of curves $\\{C(q):q\in S\\}$ with $C(q)\cdot D=0$ sweeping out
$D$.

###### Proof

Notice that every divisor (2)-(15) of Proposition 5.4 satisfies the
hypotheses. For one such divisor, let $S\subset D$. By Propositions 5-6-7-8-9,
we can find a sequence of standard Cremona transformations such that the image
of $S$ is a plane $S_{1}$. Applying the same sequence of transformations to
$D_{1}$, we obtain a Weyl divisor containing such plane. Modulo reordering the
points, the possible outputs for the image of $D$ are the divisors (2), (3),
(5), (7), (8), (9), (11) of Proposition 11. For each such output, we shall
exhibit a sequence of Cremona transformations that preserve the plane $S_{1}$
and takes $D_{1}$ to a hyperplane containing $S_{1}$. Without loss of
generality, we will assume that $S_{1}$ is the class of the plane passing
through the first three points. In the following tables, for every (i), on the
left hand side we will describe the class of the Weyl divisor and on the right
hand side the class of the curve $C(q)$ of the net:

$\begin{array}[]{ccc|cccccccccccc|cccccccc}(11)&&7&5&5&5&3&4&4&4&4&&&&19&4&4&4&3&4&4&4&4\\\
(9)&&6&5&4&4&3&4&3&3&3&&&&16&4&3&3&3&2&3&3&3\\\
(8)&&5&4&4&3&2&3&3&3&2&&&&13&3&3&2&2&3&3&3&2\\\
(7)&&4&4&3&2&2&2&2&2&2&&&&10&3&2&1&2&2&2&2&2\\\
(5)&&3&3&2&2&2&2&1&1&1&&&&7&2&1&1&2&2&1&1&1\\\
(3)&&2&2&2&1&1&1&1&1&0&&&&4&1&1&0&1&1&1&1&0\\\
(2)&&1&1&1&1&1&0&0&0&0&&&&1&0&0&0&1&0&0&0&0\\\ \end{array}$

##  6 Weyl expected dimension

Let $n=3,4$. For $r\in\\{1,2,3\\}$, let $L_{I(r)}$ be a linear cycle of
dimension $r$ spanned by $r+1$ base points. Recall that $W_{n,n+4}$ denotes
the Weyl group of $X^{n}_{n+4}$. Consider the following set of Weyl
$r$-cycles: $W_{n}(r):=\\{w(L_{I(r)}):w\in W_{n,n+4}\\}$, and let $k_{A}(D)$
denote the multiplicity of containment of the $r$-cycle $A$ in the base locus
of the divisor $D$.

By Remark 2 we know that for any Weyl curve $A\in W_{n}(1)$, then
$k_{C}=\max\\{0,-D\cdot A\\}$. For every Weyl divisor $A\in W_{n}(n-1)$ (i.e.
those listed in Propositions 2 and 11), we have that $k_{A}=-\max\\{0,\langle
D,A\rangle\\}$, see (BraDumPos1, , Proposition 2.3) and (DumPos, , Proposition
4.2) for details. Finally, for $n=4$, by the results of Section 5.3 we know
that $W_{4}(2)$ is the set of the Weyl surfaces (i.e. those listed in equation
(1)) and the multiplicity of containement $k_{A}(D)$ of any Weyl surface $A\in
W_{4}(2)$ in the base locus of an effective divisor $D$ is computed in
Propositions 5, 6, 7, 8, 9.

We introduce now the notion of Weyl expected dimension.

###### Definition 2

Let $n=3,4$ and $D$ be an effective divisor on $X=X^{n}_{n+4}$. We say that
$D$ has Weyl expected dimension $\operatorname{wdim}(D)$, where

$\textrm{wdim(D)}:=\chi(X,{\mathcal{O}}_{X}(D))+\sum_{r=1}^{n-1}\sum_{A\in
W_{n}(r)}(-1)^{r+1}{{n+k_{A}(D)-r-1}\choose n}.$

We now show that the Weyl expected dimension in invariant under the action of
the Weyl group.

###### Proposition 12

Let $n=3,4$ and $D$ an effective divisor on $X^{n}_{n+4}$. The Weyl dimension
of $D$ is preserved under standard Cremona transformations.

###### Proof

Let $D=dH-\sum_{i=1}^{n+4}m_{i}E_{i}$. We need to prove that
$\textrm{wdim}(D)=\textrm{wdim}({\rm{Cr}}_{I}(D))$ for ${\rm{Cr}}_{I}$ a
standard Cremona transformation. Let $D^{\prime}=dH-\sum_{i\in I}m_{i}E_{i}$
be the divisor obtained from $D^{\prime}$ by forgetting 3 points. From
(BraDumPos1, , Corollary 4.8, Theorem 5.3) we have that
$\textrm{wdim}(D^{\prime})=\textrm{wdim}({\rm{Cr}}_{I}(D^{\prime}))$, where
the formula $\textrm{wdim}(D^{\prime})$ only takes into account the Weyl
cycles of $D$ based exclusively at the points parametrized by $I$ that are
therefore fixed linear subspaces through base points.

We claim that, for all the remaining Weyl cycles $A$ of $D$, interpolating at
least a point away from the indeterminacy locus and for which $k_{A}(D)\geq
1$, we have $k_{A}(D)=k_{{\rm{Cr}}(A)}({\rm{Cr}}(D))$. If $A$ is a curve, the
claim is true because $k_{A}(D)=-A\cdot D=-{\rm{Cr}}(A)\cdot{\rm{Cr}}(D)$. If
$A$ is a divisor, the claim is true because $k_{A}(D)=-\langle
A,D\rangle=-\langle{\rm{Cr}}(A),{\rm{Cr}}(D)\rangle$. It only remains to show
the claim for $A=S$ a surface of $X^{4}_{8}$. It follows from the proofs of
Propositions 5, 6, 7, 8, 9 and Remark 5 that for a Weyl curve $C\subseteq S$
such that $S$ is swept out by a pencil $\\{C(q):q\in C\\}$, then
$k_{S}(D)=-C(q)\cdot D+k_{C}(D)$. Since $D$ is effective, then $C(q)\cdot
D\geq 0$ by Proposition 4, so $k_{C}(D)=-C\cdot D\geq 1$. Since
$k_{S}(D)=-C(q)\cdot D-C\cdot
D=-{\rm{Cr}}(C_{q})\cdot{\rm{Cr}}(D)-{\rm{Cr}}(C)\cdot{\rm{Cr}}(D)=-{\rm{Cr}}(C(q))\cdot
D+k_{{\rm{Cr}}(C)}({\rm{Cr}}(D))$ and ${\rm{Cr}}(D)$ is swept out by
$\\{{\rm{Cr}}(C(q)):q\in{\rm{Cr}}(C)\\}$, we conclude.

This yields an explicit formula for the dimension of any linear system in
$X^{3}_{7}$.

###### Theorem 6.1

For any effective divisor $D\in Pic(X^{3}_{7})$, we have

${\rm{h}}^{0}(X^{3}_{7},{\mathcal{O}}_{X^{3}_{7}}(D))=\textrm{wdim}(D).$

###### Proof

For the sake of simplicity, we will abbreviate
${\rm{h}}^{0}(X^{3}_{7},{\mathcal{O}}_{X^{3}_{7}}(D))$ with ${\rm{h}}^{0}(D)$.
Consider a sequence of standard Cremona transformations which takes $D$ to a
Cremona reduced divisor $D^{\prime}$: it is well-known that
${\rm{h}}^{0}(D)={\rm{h}}^{0}(D^{\prime})$. By the previous proposition we
have that $\operatorname{wdim}(D)=\operatorname{wdim}(D^{\prime})$. Since
$D^{\prime}$ is Cremona reduced, by (devolder-laface, , Theorem 5.3) we know
that $D^{\prime}$ is linearly non-special, i.e. its dimension equals its
linear expected dimension introduced in BraDumPos1 :
${\rm{h}}^{0}(D^{\prime})=\operatorname{ldim}(D^{\prime})=\operatorname{wdim}(D^{\prime})$
where the last equality is easy to check for Cremona reduced divisors in
$X^{3}_{7}$. Hence we conclude that ${\rm{h}}^{0}(D)=\operatorname{wdim}(D)$.

For the case of $X^{4}_{8}$, we propose the following conjecture.

###### Conjecture 1

For any effective divisor $D\in Pic(X^{4}_{8})$, we have

${\rm{h}}^{0}(X^{4}_{8},{\mathcal{O}}_{X^{4}_{8}}(D))==\textrm{wdim}(D).$

We claim that the notion of Weyl dimension extends both that of linear
expected dimension of BraDumPos1  and that of secant expected dimension of
BraDumPos3 .

In fact, first of all, notice that that linear cycles of dimension at most
$n-1$ spanned by the collection of $s$ points are Weyl cycles, according to
our definition. This holds because hyperplanes passing through $n$ base points
are always Weyl divisors. We recall that for $s=n+2$, the only Weyl divisors
are the exceptional divisors and the hyperplanes spanned by $n$ base points.
We conclude that for $s=n+2$ the linear cycles spanned by base points are the
only Weyl cycles, hence we have that for divisors in $X^{n}_{n+2}$, the Weyl
expected dimension equals the linear expected dimension, so the analogous of
Conjecture (1) in $X_{n+2}^{n}$ holds by BraDumPos1 . Moreover, by
(BraDumPos1, , Corollary 4.8) we can say that the analogous of Conjecture 1
holds in arbitrary dimension for small number of points.

Secondly, in BraDumPos3  the authors considered cycles $J(L_{I},\sigma_{t})$,
joins over the $t$ secant variety to the rational normal curve of degree $n$
passing through $n+3$ points, and they gave a secant expected dimension for an
effective divisor. It agrees with the Weyl expected dimension for $n=4$. For
$X^{4}_{7}$, these varieties are just the unique rational normal quartic curve
through the $7$ points and the pointed cones over it, namely cone over
rational normal curve, labeled $S^{3}_{1,\widehat{8}}$ as in notation (1).
Therefore, we ask the following question:

###### Conjecture 2

The varieties $J(L_{I},\sigma_{t})$ are Weyl cycles on $X^{n}_{n+3}$.

Solving Conjecture 1 would complete the analysis of the dimensionality problem
for all the Mori Dream Spaces of the form $X^{n}_{s}$, which are
$X^{n}_{n+3},X^{2}_{8},X^{3}_{7}$ and $X^{4}_{8}$.

## References

  * (1) C. Araujo, C. Casagrande, On the Fano variety of linear spaces contained in two odd-dimensional quadrics, with Carolina Araujo, Geometry $\&$ Topology 21, 3009-3045, 2017
  * (2) M.C. Brambilla, O. Dumitrescu and E. Postinghel, On a notion of speciality of linear systems in $\mathbb{P}^{n}$, Trans. Am. Math. Soc. 367 (2015), 5447-5473
  * (3) M.C. Brambilla, O. Dumitrescu and E. Postinghel, On the effective cone of ${\mathbb{P}}^{n}$ blown-up at $n+3$ points, Exp. Math. 25, no. 4, 452–465 (2016)
  * (4) C. Casagrande, G. Codogni and A. Fanelli, The blow-up of ${\mathbb{P}}^{4}$ at $8$ points and its Fano model, via vector bundles on a degree 1 del Pezzo surface, Revista Matematica Complutense, 2 (2019) 32.
  * (5) C. Ciliberto, Geometrical aspects of polynomial interpolation in more variables and of Waring’s problem, European Congress of Mathematics, Vol. I (Barcelona, 2000), 289–316, Progr. Math., 201, Birkhäuser, Basel (2001)
  * (6) C. Ciliberto, B. Harbourne, R. Miranda, J. Roé, Variations on Nagata’s conjecture, Clay Math. Proc. 18, 185–203, Amer. Math. Soc., (2013)
  * (7) I. Coskun, J. Lesieutre, and J. Ottem, Effective cones of cycles on blowups of projective space, Algebra Number Theory 10 (2016), no. 9 , 1983-2014.
  * (8) C. De Volder and A. Laface, On linear systems of ${\mathbb{P}}^{3}$ through multiple points, J. Algebra 310 (2007), no. 1, 207–217.
  * (9) I. Dolgachev, Weyl groups and Cremona transformations, Singularities, Part 1 (Arcata, Calif., 1981), 283–294, Proc. Sympos. Pure Math., 40, Amer. Math. Soc., Providence, RI, 1983.
  * (10) O. Dumitrescu and R. Miranda, Cremona Orbits in ${\mathbb{P}}^{4}$ and Applications, arXiv Preprint 2021.
  * (11) O. Dumitrescu and E. Postinghel, Vanishing theorems for linearly obstructed divisors, J. Algebra, 477, 312-359 (2017)
  * (12) O. Dumitrescu and N. Priddis, On $(-1)$ classes, arXiv: 1905.00074.
  * (13) A. Laface and L. Ugaglia, On a class of special linear systems of ${\mathbb{P}}^{3}$, Trans. Am. Math. Soc. 358 (2006), 5485-5500.
  * (14) A. Laface and L. Ugaglia, Elementary $(\\--1)$ curves of $\mathbb{P}^{3}$ , Comm. Algebra 35 (2007), 313–324
  * (15) A. Laface and L. Ugaglia, Standard classes on the blow-up of ${\mathbb{P}}^{n}$ at points in very general position, Comm. in Alg., vol. 40 (2012), pag. 2115-2129.
  * (16) S. Mukai, Geometric realization of T-Shaped root systems and counterexamples to Hilbert’s fourteenth problem, Algebraic Transformation Groups and Algebraic Varieties Encyclopaedia of Mathematical Sciences Volume 132, 2004, pp 123-129.
  * (17) S. Mukai, Finite generation of the Nagata invariant rings in A-D-E cases, RIMS Preprint n. 1502, Kyoto, 2005.
  * (18) M. Nagata, On the fourteenth problem of Hilbert, Proc. Internat. Congress Math., Cambridge University Press, 1958, 459-462.