# Existence of solution for Hilfer fractional differential equations with
boundary value conditions ††thanks: Mathematics Subject Classifications:
34A08, 26A33, 34A12,34A40.

Mohammed S. Abdo , Satish K. Panchal , Sandeep P. Bhairat Department of
Mathematics, Dr.Babasaheb Ambedkar Marathwada University, Aurangabad, (M.S)
431001, IndiaDepartment of Mathematics, Dr.Babasaheb Ambedkar Marathwada
University, Aurangabad, (M.S) 431001, IndiaFaculty of Engineering Mathematics,
Institute of Chemical Technology Mumbai, Marathwada Campus, Jalna (M.S),
India. Corresponding author email<EMAIL_ADDRESS>
###### Abstract

In this paper, we consider a class of nonlinear fractional differential
equations involving Hilfer derivative with boundary conditions. First, we
obtain an equivalent integral for the given boundary value problem in weighted
space of continuous functions. Then we obtain the existence results for a
given problem under a new approach and minimal assumptions on nonlinear
function $f$. The technique used in the analysis relies on a variety of tools
including Schauder’s, Schaefer’s and Krasnosel’ski’s fixed point theorems. We
demonstrate our results through illustrative examples.

##  1 Introduction

Fractional calculus (FC) is playing an even vital role in applied mathematics
and engineering sciences, provoking a blurring of boundaries between
scientific disciplines and the real world applications by a resurgence of
interest in the modern as well as classical techniques of applied analysis,
see [2, 9, 14, 15, 17]. The development of FC is a natural consequence of a
high level of excitement on the research frontier in applied analysis.

Fractional differential equations (FDEs) naturally occurs in many situations
and are studied intensively with initial and boundary value conditions over
the last three decades. The existence of a solution for such initial value
problems (IVPs) and boundary value problems (BVPs) is crucial for further
qualitative studies and applications. In recent years, an increasing interest
in the analysis of Hilfer FDEs has been developed in the literature [1, 3, 4,
5, 6, 7, 8, 10, 11, 16, 18, 19, 20, 21, 22, 23, 24, 25]. We mention here some
works on Hilfer fractional differential equations.

One of the first works in this direction with an initial value condition was
the paper by K. M. Furati et al. [11]. They studied the Hilfer FDE

$D_{a^{+}}^{\alpha,\beta}y(x)=f\left(x,y(x)\right),\qquad
x>a,\,0<\alpha<1,\,0\leq\beta\leq 1,$ (1)

with the initial condition

$I_{a^{+}}^{1-\gamma}y(a^{+})=y_{a},\quad
y_{a}\in\mathbb{R},\,\,\gamma=\alpha+\beta(1-\alpha),$ (2)

where $D_{a^{+}}^{\alpha,\beta}$ is Hilfer fractional derivative of order
$\alpha\in(0,1)$ and type $\beta\in[0,1],$ and $I_{a^{+}}^{1-\gamma}$ is
Riemann-Liouville fractional integral of order $1-\gamma.$ The existence and
uniqueness of solution to IVP (1)-(2) is proved in weighted space of
continuous functions by using Banach fixed point theorem. For details, see
[11, 22].

In the year 2015, J. Wang and Y. Zang investigated the existence of a solution
to nonlocal IVP for Hilfer FDEs:

$\displaystyle D_{a^{+}}^{\alpha,\beta}u(t)$
$\displaystyle=f\left(t,u(t)\right),\qquad 0<\alpha<1,0\leq\beta\leq
1,t\in(a,b],$ (3) $\displaystyle I_{a^{+}}^{1-\gamma}u(a^{+})$
$\displaystyle=\sum_{i=1}^{m}\lambda_{i}u(\tau_{i}),\qquad\tau_{i}\in(a,b],\
\alpha\leq\gamma=\alpha+\beta-\alpha\beta,$ (4)

For details, see [24].

Later, H. Gu and J. J. Trujillo [13] studied the existence of mild solution of
Hilfer evolution equation:

$\displaystyle D_{0^{+}}^{\nu,\mu}x(t)$
$\displaystyle=Ax(t)+f\left(t,x(t)\right),\qquad 0<\alpha<1,0\leq\beta\leq
1,t\in(0,b],$ (5) $\displaystyle I_{0^{+}}^{1-\gamma}x(0)$
$\displaystyle=x_{0},\qquad
x_{0}\in\mathbb{R},\,\gamma=\alpha+\beta-\alpha\beta.$ (6)

They utilized the method of noncompact measure and established sufficient
conditions to ensure the existence of a mild solution to Hilfer evolution IVP
(5)-(6). The state $x(t)$ defined for the values in Banach space $X$ with the
norm $|\cdot|$ and $A$ is infinitesimal generator of $C_{0}$ semigroups in
$X.$

In 2016, in [19], Rafal Kamoki et al. considered fractional Cauchy problem
involving Hilfer derivative

$\displaystyle D_{a^{+}}^{\alpha,\beta}y(t)$
$\displaystyle=g\left(t,y(t)\right),\qquad 0<\alpha<1,0\leq\beta\leq
1,t\in[a,b],b>a,$ (7) $\displaystyle I_{a^{+}}^{1-\gamma}y(a)$
$\displaystyle=c,\qquad c\in{\mathbb{R}}^{n},\gamma=\alpha+\beta-\alpha\beta,$
(8)

and proved the existence and uniqueness of its solution in the space of
continuous functions by using Banach contraction theorem. They used Bielecki
norm without partitioning the interval and obtained solutions to both
homogeneous and nonhomogeneous Cauchy problems.

In recent two years, the series of works on Hilfer FDEs have been published.
S. Abbas et al. [1] surveyed the existence and stability for Hilfer FDEs of
the form:

$\displaystyle D_{0}^{\alpha,\beta}u(t)$
$\displaystyle=f\left(t,y(t),D_{0}^{\alpha,\beta}u(t)\right),\qquad
0<\alpha<1,0\leq\beta\leq 1,t\in[0,\infty),$ (9) $\displaystyle
I_{0}^{1-\gamma}u(0)$
$\displaystyle=\phi,\qquad\phi\in{\mathbb{R}},\gamma=\alpha+\beta-\alpha\beta,$
(10)

with the uniform norm on weighted space of bounded and continuous functions.
They discussed existence, uniqueness and asymptotic stability of solution to
IVP by using Schauder’s fixed point theorem. Further, they obtained Ulam-type
stabilities for Hilfer FDEs in Banach spaces using the measure of
noncompactness and Monch’s fixed point theorem. They also derived some results
on the existence of weak solutions to (1)-(2).

Z. Gao and X. Yu [25] discussed the existence of a solution to Hilfer integral
BVP for the relaxation FDEs:

$\displaystyle D_{0^{+}}^{\nu,\mu}x(t)$
$\displaystyle=cx(t)+f\left(t,x(t)\right),\qquad c<0,0<\nu<1,0\leq\mu\leq
1,t\in(0,b],$ (11) $\displaystyle I_{0^{+}}^{1-\gamma}x(0^{+})$
$\displaystyle=\sum_{i=1}^{m}\lambda_{i}x(\tau_{i}),\qquad\tau_{i}\in(0,b),\
0\leq\gamma=\nu+\mu-\nu\mu,$ (12)

By utilizing properties of Mittag-Leffler function and fixed point theory,
they established three existence results for the solution of Hilfer integral
BVP (11)-(12) similar to that of results in [16].

Bhairat et al. in [10] generalized IVP (1)-(2) for $\alpha\in(n-1,n).$ First,
they derived equivalent integral representation in weighted space of
continuous functions. Then by employing the method of successive
approximations, the existence, uniqueness and continuous dependence of the
solution are obtained. Further, in [8], Bhairat studied the singular IVP for
Hilfer FDE:

$\displaystyle D_{a^{+}}^{\alpha,\beta}x(t)=f(t,x(t)),$ $\displaystyle\quad
0<\alpha<1,\,0\leq\beta\leq 1,\quad t>{a},$ (13)
$\displaystyle\displaystyle\lim_{t\to{a^{+}}}{(t-a)}^{1-\gamma}x(t)=x_{0},$
$\displaystyle\qquad\gamma=\alpha+\beta(1-\alpha),$ (14)

Using properties of Euler’s beta, gamma functions and Picard’s iterative
technique, the existence and uniqueness of solution to the singular IVP were
obtained. Some existence results for Hilfer-fractional implicit differential
equation with nonlocal initial conditions can be found in [1, 23].

Recently, Suphawat et al [20] studied the nonlocal BVP:

$D^{\alpha,\beta}x(t)=f(t,x(t)),\quad 1<\alpha<2,\,0\leq\beta\leq 1,\quad
t\in[a,b],$ (15)

with the integral boundary conditions

$x(a)=0,\quad
x(b)=\sum_{i=1}^{m}\delta_{i}I^{\phi_{i}}x(\xi_{i}),\qquad\phi_{i}>0,\,\delta_{i}\in\mathbb{R},\,\xi_{i}\in[a,b].$
(16)

The Banach contraction mapping principle, Banach fixed point theorem with
Holder inequality, nonlinear contractions, Krasnoselskii’s fixed point
theorem, nonlinear Leray-Schauder alternative are employed to prove the
existence of the solution to integral BVP.

Motivated by aforesaid works, in this paper, we consider the following BVP for
a class of Hilfer FDEs:

$D_{a^{+}}^{\alpha,\beta}z(t)=f\big{(}t,z(t)\big{)},\text{ \
}0<\alpha<1,\,0\leq\beta\leq 1,t\in(a,b],\qquad\ \qquad\qquad$ (17)
$I_{a^{+}}^{1-\gamma}\big{[}cz(a^{+})+dz(b^{-})\big{]}=e_{k},\text{\ \ \
}\gamma=\alpha+\beta(1-\alpha),\,e_{k}\in\mathbb{R},$ (18)

where, $f:(a,b]\times\mathbb{R}\rightarrow\mathbb{R}$ be a function such that
$f(t,z)\in C_{1-\gamma}[a,b]$ for any $z\in C_{1-\gamma}[a,b]$ and
$c,d,e_{k}\in\mathbb{R}$. We obtain several existence results by Schauder’s,
Schaefer’s and Krasnosel’ski’s fixed point theorems.

The paper is organized as follows: Some preliminary concepts related to our
problem are listed in Section 2 which are useful in the sequel. In Section 3,
we first establish an equivalent integral equation of BVP (17)-(18) and then
study the existence results. Illustrative examples are provided in the last
section.

##  2 Preliminaries

In this section, we list some definitions, lemmas and weighted spaces which
are useful in the sequel.

Let $-\infty<a<b<+\infty.$ Let $C[a,b],AC[a,b]$ and $C^{n}[a,b]$ be the spaces
of continuous, absolutely continuous, $n-$times continuous and continuously
differentiable functions on $[a,b],$ respectively. Here $L^{p}(a,b),p\geq 1,$
is the space of Lebesgue integrable functions on $(a,b).$ Further more we
recall the following weighted spaces [11]:

$\displaystyle
C_{\gamma}[a,b]=\\{g:(a,b]\rightarrow\mathbb{R}:(t-a)^{\gamma}g(t)\in
C[a,b]\\},\quad 0\leq\gamma<1,$ $\displaystyle
C_{\gamma}^{n}[a,b]=\\{g:(a,b]\rightarrow\mathbb{R},g\in
C^{n-1}[a,b]:g^{(n)}(t)\in C_{\gamma}[a,b]\\},\,n\in\mathbb{N}.$

######  Definition 2.1.

([17]) Let $g:[a,\infty)\rightarrow R$ is a real valued continuous function.
The left sided Riemann-Liouville fractional integral of $g$ of order
$\alpha>0$ is defined by

$I_{a^{+}}^{\alpha}g(t)=\frac{1}{\Gamma(\alpha)}\int_{a}^{t}(t-s)^{\alpha-1}g(s)ds,\quad
t>a,$ (19)

where $\Gamma(\cdot)$ is the Euler’s Gamma function and $a\in\mathbb{R}.$
provided the right hand side is pointwise defined on $(a,\infty).$

######  Definition 2.2.

([17]) Let $g:[a,\infty)\rightarrow R$ is a real valued continuous function.
The left sided Riemann-Liouville fractional derivative of $g$ of order
$\alpha>0$ is defined by

$D_{a^{+}}^{\alpha}g(t)=\frac{1}{\Gamma(n-\alpha)}\frac{d^{n}}{dt^{n}}\int_{a}^{t}(t-s)^{n-\alpha-1}g(s)ds,$
(20)

where $n=[\alpha]+1,$ and $[\alpha]$ denotes the integer part of $\alpha.$

######  Definition 2.3.

([14]) The left sided Hilfer fractional derivative of function $g\in
L^{1}(a,b)$ of order $0<\alpha<1$ and type $0\leq\beta\leq 1$ is denoted as
$D_{a^{+}}^{\alpha,\beta}$ and defined by

$D_{a^{+}}^{\alpha,\beta}g(t)=I_{a^{+}}^{\beta(1-\alpha)}DI_{a^{+}}^{(1-\beta)(1-\alpha)}g(t),\text{
}D=\frac{d}{dt}.$ (21)

where $I_{a^{+}}^{\alpha}$ and $D_{a^{+}}^{\alpha}$ are Riemann-Liouville
fractional integral and derivative defined by (19) and (20), respectively.

######  Remark 2.4.

From Definition 2.3, we observe that:

  * (i)

The operator $D_{a^{+}}^{\alpha,\beta}$ can be written as

$D_{a^{+}}^{\alpha,\beta}=I_{a^{+}}^{\beta(1-\alpha)}DI_{a^{+}}^{(1-\gamma)}=I_{a^{+}}^{\beta(1-\alpha)}D^{\gamma},~{}~{}~{}~{}~{}~{}~{}~{}\gamma=\alpha+\beta-\alpha\beta\text{.}$

  * (ii)

The Hilfer fractional derivative can be regarded as an interpolator between
the Riemann-Liouville derivative ($\beta=0$) and Caputo derivative ($\beta=1$)
as

$D_{a^{+}}^{\alpha,\beta}=\begin{cases}DI_{a^{+}}^{(1-\alpha)}=~{}D_{a^{+}}^{\alpha},~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}if~{}\beta=0;\\\
I_{a^{+}}^{(1-\alpha)}D=~{}^{c}D_{a^{+}}^{\alpha},~{}~{}~{}~{}~{}~{}~{}~{}if~{}\beta=1.\end{cases}$

  * (iii)

In particular, if $0<\alpha<1,$ $0\leq\beta\leq 1$ and
$\gamma=\alpha+\beta-\alpha\beta,$ then

$(D_{a^{+}}^{\alpha,\beta}g)(t)=\Big{(}I_{a^{+}}^{\beta(1-\alpha)}\frac{d}{dt}\Big{(}I_{a^{+}}^{(1-\beta)(1-\alpha)}g\Big{)}\Big{)}(t).$

One has,

$(D_{a^{+}}^{\alpha,\beta}g)(t)=\Big{(}I_{a^{+}}^{\beta(1-\alpha)}\Big{(}D_{a^{+}}^{\gamma}g\Big{)}\Big{)}(t),$

where
$\Big{(}D_{a^{+}}^{\gamma}g\Big{)}(t)=\frac{d}{dt}\Big{(}I_{a^{+}}^{(1-\beta)(1-\alpha)}g\Big{)}(t).$

######  Definition 2.5.

([11]) Let $0<\alpha<1,0\leq\beta\leq 1,$ the weighted space
$C_{1-\gamma}^{\alpha,\beta}[a,b]$ is defined by

$C_{1-\gamma}^{\alpha,\beta}[a,b]=\big{\\{}g\in{C_{1-\gamma}[a,b]}:D_{a^{+}}^{\alpha,\beta}g\in{C_{1-\gamma}[a,b]}\big{\\}},\quad\gamma=\alpha+\beta(1-\alpha).$
(22)

Clearly,
$D_{a^{+}}^{\alpha,\beta}g=I_{a^{+}}^{\beta(1-\alpha)}D_{a^{+}}^{\gamma}g$ and
$C_{1-\gamma}^{\gamma}[a,b]\subset
C_{1-\gamma}^{\alpha,\beta}[a,b],\,\gamma=\alpha+\beta-\alpha\beta$,
$0<\alpha<1,0\leq\beta\leq 1.$ Consider the space $C_{\gamma}^{0}[a,b]$ with
the norm

${\|g\|}_{C_{\gamma}^{n}}=\sum_{k=0}^{n-1}{\|g^{(k)}\|}_{C}+{\|g^{(n)}\|}_{C_{\gamma}}.$
(23)

######  Lemma 2.6.

([9]) If $\alpha>0$ and $\beta>0,$ and $g\in L^{1}(a,b)$ for $t\in[a,b]$, then
$\Big{(}I_{a^{+}}^{\alpha}I_{a^{+}}^{\beta}g\Big{)}(t)=\Big{(}I_{a^{+}}^{\alpha+\beta}g\Big{)}(t)$
and $\Big{(}D_{a^{+}}^{\alpha}I_{a^{+}}^{\beta}g\Big{)}(t)=g(t).$
In particular, if $f\in C_{\gamma}[a,b]$ or $f\in C[a,b]$, then the above
properties hold for each $t\in(a,b]$ or $t\in[a,b]$ respectively.

######  Lemma 2.7.

([11]) For $t>a,$ we have

(i)

$I_{a^{+}}^{\alpha}(t-a)^{\beta-1}=\frac{\Gamma(\beta)}{\Gamma(\beta+\alpha)}(t-a)^{\beta+\alpha-1},\quad\alpha\geq
0,\beta>0.$

(ii)

$D_{a^{+}}^{\alpha}(t-a)^{\alpha-1}=0,\quad\alpha\in(0,1).$

######  Lemma 2.8.

([11]) Let $\alpha>0$, $\beta>0$ and $\gamma=\alpha+\beta-\alpha\beta.$ If
$g\in C_{1-\gamma}^{\gamma}[a,b]$, then

$I_{a^{+}}^{\gamma}D_{a^{+}}^{\gamma}g=I_{a^{+}}^{\alpha}D_{a^{+}}^{\alpha,\beta}g,~{}D_{a^{+}}^{\gamma}I_{a^{+}}^{\alpha}g=D_{a^{+}}^{\beta(1-\alpha)}g.$

######  Lemma 2.9.

([11]) Let $0<\alpha<1,$ $0\leq\beta\leq 1$ and $g\in C_{1-\gamma}[a,b].$ Then

$I_{a^{+}}^{\alpha}D_{a^{+}}^{\alpha,\beta}g(t)=g(t)-\frac{(t-a)^{\alpha+\beta(1-\alpha)-1}}{\Gamma(\alpha+\beta(1-\alpha))}I_{a^{+}}^{(1-\beta)(1-\alpha)}g(a),\quad\text{for
all}\quad t\in(a,b],$

Moreover, if $\ \gamma=\alpha+\beta-\alpha\beta,$ $g\in C_{1-\gamma}[a,b]$ and
$I_{a^{+}}^{1-\gamma}g\in C_{1-\gamma}^{1}[a,b],$ then

$I_{a^{+}}^{\gamma}D_{a^{+}}^{\gamma}g(t)=g(t)-\frac{(t-a)^{\gamma-1}}{\Gamma(\gamma)}I_{a^{+}}^{1-\gamma}g(a),\quad\text{for
all}\quad t\in(a,b].$

######  Lemma 2.10.

([11]) If $0\leq\gamma<1$ and $g\in C_{\gamma}[a,b]$, then

$(I_{a^{+}}^{\alpha}g)(a)=\lim_{t\rightarrow
a^{+}}I_{a^{+}}^{\alpha}g(t)=0,~{}0\leq\gamma<\alpha.$

######  Lemma 2.11.

([11]) Let $\gamma=\alpha+\beta-\alpha\beta$ where $0<\alpha<1$ and
$0\leq\beta\leq 1.$ Let $f:(a,b]\times\mathbb{R}\rightarrow\mathbb{R}$ be a
function such that $f(t,z)\in C_{1-\gamma}[a,b]$ for any $z\in
C_{1-\gamma}[a,b].$ If $z\in C_{1-\gamma}^{\gamma}[a,b],$ then $z$ satisfies
IVP (1)-(2) if and only if $z$ satisfies the Volterra integral equation

$z(t)=\frac{y_{a}}{\Gamma(\gamma)}(t-a)^{\gamma-1}+\frac{1}{\Gamma(\alpha)}\int_{a}^{t}(t-s)^{\alpha-1}f(s,z(s))ds,\quad
t>a.$ (24)

##  3 Existence of solution

In this section we prove the existence of solution to BVP (17)-(18) in
$C_{1-\gamma}^{\alpha,\beta}[a,b].$

######  Lemma 3.1.

Let $0<\alpha<1$, $0\leq\beta\leq 1$ where $\gamma=\alpha+\beta-\alpha\beta$,
and $f:(a,b]\times\mathbb{R}\rightarrow\mathbb{R}$ be a function such that
$f(x,z)\in C_{1-\gamma}[a,b]$ for any $z\in C_{1-\gamma}[a,b].$ If $z\in
C_{1-\gamma}^{\gamma}[a,b],$ then $z$ satisfies BVP (17)-(18) if and only if
$z$ satisfies the integral equation$-$

$\displaystyle z(t)$ $\displaystyle=$
$\displaystyle\frac{(t-a)^{\gamma-1}}{\Gamma(\gamma)}\frac{e_{k}}{d\left(1+\frac{c}{d}\right)}-\frac{1}{\left(1+\frac{c}{d}\right)}\frac{(t-a)^{\gamma-1}}{\Gamma(\gamma)}$
(25)
$\displaystyle\times\frac{1}{\Gamma(1-\gamma+\alpha)}\int_{a}^{b}(b-s)^{\alpha-\gamma}f(s,z(s))ds$
$\displaystyle+\frac{1}{\Gamma(\alpha)}\int_{a}^{t}(t-s)^{\alpha-1}f(s,z(s))ds.$

Proof: In view of Lemma 2.11, the solution of (17) can be written as

$z(t)=\frac{I_{a^{+}}^{1-\gamma}z(a^{+})}{\Gamma(\gamma)}(t-a)^{\gamma-1}+\frac{1}{\Gamma(\alpha)}\int_{a}^{t}(t-s)^{\alpha-1}f(s,z(s))ds,\quad
t>a.$ (26)

Applying $I_{a^{+}}^{1-\gamma}$ on both sides of (26) and taking the limit
$t\rightarrow b^{-}$, we obtain

$I_{a^{+}}^{1-\gamma}z(b^{-})=I_{a^{+}}^{1-\gamma}z(a^{+})+\frac{1}{\Gamma(1-\gamma+\alpha)}\int_{a}^{b}(b-s)^{\alpha-\gamma}f(s,z(s))ds.$
(27)

Also again by applying $I_{a^{+}}^{1-\gamma}$ on both sides of (26), we have

$\displaystyle I_{a^{+}}^{1-\gamma}z(t)$ $\displaystyle=$ $\displaystyle
I_{a^{+}}^{1-\gamma}z(a^{+})+\frac{1}{\Gamma(1-\gamma+\alpha)}\int_{a}^{t}(t-s)^{\alpha-\gamma}f(s,z(s))ds$
$\displaystyle=$ $\displaystyle
I_{a^{+}}^{1-\gamma}z(a^{+})+I_{a^{+}}^{1-\beta(1-\alpha)}f(t,z(t)).$

Taking the limit $t\rightarrow a^{+}$ and using Lemma 2.10 with
$1-\gamma<1-\beta(1-\alpha),$ we obtain

$I_{a^{+}}^{1-\gamma}z(a^{+})=I_{a^{+}}^{1-\gamma}z(a^{+}),$ (28)

hence

$I_{a^{+}}^{1-\gamma}z(b^{-})=I_{a^{+}}^{1-\gamma}z(a^{+})+\frac{1}{\Gamma(1-\gamma+\alpha)}\int_{a}^{b}(b-s)^{-\gamma+\alpha}f(s,z(s))ds.$
(29)

From the boundary condition (18), we have

$I_{a^{+}}^{1-\gamma}z(b^{-})=\frac{e_{k}}{d}-\frac{c}{d}I_{a^{+}}^{1-\gamma}z(a^{+}).$
(30)

Comparing the equations (29) and (30), and using (28), we get

$I_{a^{+}}^{1-\gamma}z(a^{+})=\frac{1}{\left(1+\frac{c}{d}\right)}\left(\frac{e_{k}}{d}-\frac{1}{\Gamma(1-\gamma+\alpha)}\int_{a}^{b}(b-s)^{\alpha-\gamma}f(s,z(s))ds\right).$
(31)

Submitting (26) into (31), we obtain

$\displaystyle z(t)$ $\displaystyle=$
$\displaystyle\frac{(t-a)^{\gamma-1}}{\Gamma(\gamma)}\frac{e_{k}}{d\left(1+\frac{c}{d}\right)}-\frac{1}{\left(1+\frac{c}{d}\right)}\frac{(t-a)^{\gamma-1}}{\Gamma(\gamma)}$
(32)
$\displaystyle\times\frac{1}{\Gamma(1-\gamma+\alpha)}\int_{a}^{b}(b-s)^{\alpha-\gamma}f(s,z(s))ds$
$\displaystyle+\frac{1}{\Gamma(\alpha)}\int_{a}^{t}(t-s)^{\alpha-1}f(s,z(s))ds.$

Conversely, applying $I_{a^{+}}^{1-\gamma}$ on both sides of (25), using
Lemmas 2.7 and 2.6, with some simple calculations, we get

$\displaystyle I_{a^{+}}^{1-\gamma}cz(a^{+})+I_{a^{+}}^{1-\gamma}dz(b^{-})$
$\displaystyle=$
$\displaystyle\frac{c}{\left(1+\frac{c}{d}\right)}\left(\frac{e_{k}}{d}-\frac{1}{\Gamma(1-\gamma+\alpha)}\int_{a}^{b}(b-s)^{\alpha-\gamma}f(s,z(s))ds\right)$
$\displaystyle+\frac{d}{\left(1+\frac{c}{d}\right)}\left(\frac{e_{k}}{d}-\frac{1}{\Gamma(1-\gamma+\alpha)}\int_{a}^{b}(b-s)^{\alpha-\gamma}f(s,z(s))ds\right)$
$\displaystyle+\frac{d}{\Gamma(1-\gamma+\alpha)}\int_{a}^{b}(b-s)^{\alpha-\gamma}f(s,z(s))ds$
$\displaystyle=$
$\displaystyle\frac{ce_{k}}{\left(1+\frac{c}{d}\right)d}+\frac{de_{k}}{\left(1+\frac{c}{d}\right)d}-\left(\frac{c}{\left(1+\frac{c}{d}\right)}+\frac{d}{\left(1+\frac{c}{d}\right)}-d\right)$
$\displaystyle\frac{1}{\Gamma(1-\gamma+\alpha)}\int_{a}^{b}(b-s)^{\alpha-\gamma}f(s,z(s))ds$
$\displaystyle=$ $\displaystyle e_{k}.$

Which shows that the boundary condition (18) is satisfied.

Next, applying $D_{a^{+}}^{\gamma}$ on both sides of (25) and using Lemmas 2.7
and 2.8, we have

$D_{a^{+}}^{\gamma}z(t)=D_{a^{+}}^{\beta(1-\alpha)}f\big{(}t,z(t)\big{)}.$
(33)

Since $z\in C_{1-\gamma}^{\gamma}[a,b]$ and by definition of
$C_{1-\gamma}^{\gamma}[a,b]$, we have $D_{a^{+}}^{\gamma}z\in
C_{n-\gamma}[a,b]$, therefore,
$D_{a^{+}}^{\beta(1-\alpha)}f=DI_{a^{+}}^{1-\beta(1-\alpha)}f\in
C_{1-\gamma}[a,b].$ For $f\in C_{1-\gamma}[a,b]$, it is clear that
$I_{a^{+}}^{1-\beta(1-\alpha)}f\in C_{1-\gamma}[a,b]$. Hence $f$ and
$I_{a^{+}}^{1-\beta(1-\alpha)}f$ satisfy the hypothesis of Lemma 2.9.
Now, applying $I_{a^{+}}^{\beta(1-\alpha)}$ on both sides of (33), we have

${\large I_{a^{+}}^{\beta(1-\alpha)}}D_{a^{+}}^{\gamma}z(t)={\large
I_{a^{+}}^{\beta(1-\alpha)}}D_{a^{+}}^{\beta(1-\alpha)}f\big{(}t,z(t)\big{)}.$

Using Remark 2.4 (i), Eq.(33) and Lemma 2.9, we get

$I_{a^{+}}^{\gamma}D_{a^{+}}^{\gamma}z(t)=f\big{(}t,z(t)\big{)}-\frac{I_{a^{+}}^{1-\beta(1-\alpha)}f\big{(}a,z(a)\big{)}}{\Gamma(\beta(1-\alpha))}(t-a)^{\beta(1-\alpha)-1},\quad\text{for
all}\quad t\in(a,b].$

By Lemma 2.10, we have $I_{a^{+}}^{1-\beta(n-\alpha)}f\big{(}a,z(a)\big{)}=0$.
Therefore, we have $D_{a^{+}}^{\alpha,\beta}z(t)=f\big{(}t,z(t)\big{)}$. This
completes the proof.

Let us introduce the hypotheses needed to prove the existence of solutions for
the problem at hand.

  * (H1)

$f:(a,b]\times\mathbb{R}\rightarrow\mathbb{R}$ is a function such that
$f(\cdot,z(\cdot))\in C_{1-\gamma}^{\beta(1-\alpha)}[a,b]$ for any $z\in
C_{1-\gamma}[a,b]$ and there exist two constants $N,\zeta>0$ such that

$\left|f\big{(}t,z\big{)}\right|\leq
N\big{(}1+\zeta\left\|z\right\|_{C_{1-\gamma}}\big{)}.$

  * (H2)

The inequality

$\mathcal{G}:=\frac{\Gamma(\gamma)}{\Gamma(\alpha+1)}\left[(b-a)^{\alpha}+(b-a)^{\alpha+1-\gamma}\right]N\zeta<1$
(34)

holds.

Now, we are ready to present the existence result for the BVP (17)-(18), which
is based on Schauder’s fixed point theorem (see [12]).

######  Theorem 3.2.

Assume that the hypotheses (H1) and (H2) are satisfied. Then Hilfer boundary
value problem (17)-(18) has at least one solution in
$C_{1-\gamma}^{\gamma}[a,b]\subset C_{1-\gamma}^{\alpha,\beta}[a,b]$.

###### Proof.

Define the operator ${\large\mathcal{T}}:C_{1-\gamma}[a,b]\longrightarrow
C_{1-\gamma}[a,b]$ by

$\displaystyle\left({\large\mathcal{T}}z\right)(t)$ $\displaystyle=$
$\displaystyle\frac{(t-a)^{\gamma-1}}{\Gamma(\gamma)}\frac{e_{k}}{d\left(1+\frac{c}{d}\right)}-\frac{1}{\left(1+\frac{c}{d}\right)}\frac{(t-a)^{\gamma-1}}{\Gamma(\gamma)}$
(35)
$\displaystyle\times\frac{1}{\Gamma(1-\gamma+\alpha)}\int_{a}^{b}(b-s)^{-\gamma+\alpha}f(s,z(s))ds$
$\displaystyle+\frac{1}{\Gamma(\alpha)}\int_{a}^{t}(t-s)^{\alpha-1}f(s,z(s))ds.$

Let $\mathbb{B}_{r}=\left\\{z\in
C_{1-\gamma}[a,b]:\left\|z\right\|_{C_{1-\gamma}}\leq r\right\\}$ with
${\large r\geq}\frac{\Omega}{1-\mathcal{G}},$ for $\mathcal{G<}1,$ where

$\displaystyle\Omega$ $\displaystyle:$
$\displaystyle=\bigg{[}\frac{1}{\Gamma(\gamma)}\frac{e_{k}}{d\left(1+\frac{c}{d}\right)}+\left|\frac{1}{1+\frac{c}{d}}\right|\frac{1}{\Gamma(\gamma)}$
$\displaystyle\times\left[\frac{(b-a)^{\alpha+1-\gamma}}{\Gamma(2-\gamma+\alpha)}+\frac{(b-a)^{2\alpha+1-\gamma}}{\Gamma(\alpha+1)}\right]N\bigg{]}.$

The proof will be given by the following three steps:

Step1: We show that $\mathcal{T}(\mathbb{B}_{r})\subset\mathbb{B}_{r}$. By
hypothesis $(H_{2})$, we have

$\displaystyle\left|(\mathcal{T}z)(t)(t-a)^{1-\gamma}\right|$
$\displaystyle\leq\left|\frac{1}{\Gamma(\gamma)}\frac{e_{k}}{d\left(1+\frac{c}{d}\right)}\right|$
$\displaystyle+\left|\frac{1}{1+\frac{c}{d}}\frac{1}{\Gamma(\gamma)}\right|\frac{1}{\Gamma(1-\gamma+\alpha)}\int_{a}^{b}(b-s)^{-\gamma+\alpha}N(1+\zeta\left|z\right|)ds$
$\displaystyle+\frac{\left|(t-a)^{1-\gamma}\right|}{\Gamma(\alpha)}\int_{a}^{t}(t-s)^{\alpha-1}N(1+\zeta\left|z\right|)ds$
$\displaystyle\leq\frac{1}{\Gamma(\gamma)}\frac{e_{k}}{d\left(1+\frac{c}{d}\right)}+\left|\frac{1}{1+\frac{c}{d}}\right|\frac{1}{\Gamma(\gamma)}$
$\displaystyle\times\frac{1}{\Gamma(1-\gamma+\alpha)}\int_{a}^{b}(b-s)^{\alpha-\gamma}N(1+\zeta(s-a)^{\gamma-1}\|z\|_{C_{1-\gamma}})ds$
$\displaystyle+\frac{\left|(t-a)^{1-\gamma}\right|}{\Gamma(\alpha)}\int_{a}^{t}(t-s)^{\alpha-1}N(1+\zeta(s-a)^{\gamma-1}\|z\|_{C_{1-\gamma}})ds.$

Note that, for any $z\in\mathbb{B}_{r}$, and for each $t\in(a,b]$, we get

$\displaystyle\frac{1}{\Gamma(1-\gamma+\alpha)}\int_{a}^{b}(b-s)^{-\gamma+\alpha}N(1+\zeta(s-a)^{\gamma-1}{\large\|z\|_{C_{1-\gamma}}})ds$
$\displaystyle\leq$
$\displaystyle\left[\frac{(b-a)^{1-\gamma}}{\Gamma(2-\gamma+\alpha)}+\frac{\zeta
r\Gamma(\gamma)}{\Gamma(\alpha+1)}\right]N(b-a)^{\alpha},$

and

$\displaystyle\frac{\left|(t-a)^{1-\gamma}\right|}{\Gamma(\alpha)}\int_{a}^{t}(t-s)^{\alpha-1}N(1+\zeta(s-a)^{\gamma-1}{\large\|z\|_{C_{1-\gamma}}})ds$
$\displaystyle\leq$
$\displaystyle\left[\frac{(t-a)^{\alpha}}{\Gamma(\alpha+1)}+\frac{\zeta
r\Gamma(\gamma)}{\Gamma(\alpha+1)}\right]N(t-a)^{\alpha+1-\gamma}.$

Hence

$\displaystyle\left|(\mathcal{T}z)(t)(t-a)^{1-\gamma}\right|$
$\displaystyle\leq$
$\displaystyle\frac{1}{\Gamma(\gamma)}\frac{e_{k}}{d\left(1+\frac{c}{d}\right)}+\left|\frac{1}{1+\frac{c}{d}}\right|\frac{1}{\Gamma(\gamma)}$
$\displaystyle\times\left[\frac{(b-a)^{1-\gamma}}{\Gamma(2-\gamma+\alpha)}+\frac{\zeta
r\Gamma(\gamma)}{\Gamma(\alpha+1)}\right]N(b-a)^{\alpha}$
$\displaystyle+\left[\frac{(t-a)^{\alpha}}{\Gamma(\alpha+1)}+\frac{\zeta
r\Gamma(\gamma)}{\Gamma(\alpha+1)}\right]N(t-a)^{\alpha+1-\gamma},$

which yields

$\displaystyle{\large\|\mathcal{T}z\|_{C_{1-\gamma}}}$ $\displaystyle\leq$
$\displaystyle\frac{1}{\Gamma(\gamma)}\frac{e_{k}}{d\left(1+\frac{c}{d}\right)}+\left|\frac{1}{1+\frac{c}{d}}\right|\frac{1}{\Gamma(\gamma)}$
$\displaystyle\times\bigg{[}\frac{(b-a)^{\alpha+1-\gamma}}{\Gamma(2-\gamma+\alpha)}+\frac{(b-a)^{2\alpha+1-\gamma}}{\Gamma(\alpha+1)}\bigg{]}N$
$\displaystyle+\frac{N\zeta
r\Gamma(\gamma)}{\Gamma(\alpha+1)}\bigg{[}(b-a)^{\alpha}+(b-a)^{\alpha+1-\gamma}\bigg{]}$

In the light of hypothesis (H2) and definition of $r$, we get
$\|{\large\mathcal{T}}z\|_{C_{1-\gamma}}\leq\mathcal{G}r+(1-\mathcal{G})r=r,$
that is, ${\large\mathcal{T(}}\mathbb{B}_{r})\subset\mathbb{B}_{r}.$

We shall prove that ${\large\mathcal{T}}$ is completely continuous.

Step 2. The operator ${\large\mathcal{T}}$ is continuous. Suppose that
$\\{z_{n}\\}$ is a sequence such that $z_{n}\rightarrow z$ in $\mathbb{B}_{r}$
as $n\rightarrow\infty$. Then for each $t\in(a,b],$ we have

$\displaystyle\left|\big{(}(\mathcal{T}z_{n})(t)-(\mathcal{T}z)(t)\big{)}(t-a)^{1-\gamma}\right|$
$\displaystyle=$
$\displaystyle\left|\frac{1}{1+\frac{c}{d}}\right|\frac{1}{\Gamma(\gamma)}$
$\displaystyle\times\frac{1}{\Gamma(1-\gamma+\alpha)}\int_{a}^{b}(b-s)^{-\gamma+\alpha}\left|f\big{(}s,z_{n}(s)\big{)}-f\big{(}s,z(s)\big{)}\right|ds$
$\displaystyle+\frac{(t-a)^{1-\gamma}}{\Gamma(\alpha)}\int_{a}^{t}(t-s)^{\alpha-1}\left|f\big{(}s,z_{n}(s)\big{)}-f\big{(}s,z(s)\big{)}\right|ds$
$\displaystyle\leq$
$\displaystyle\left|\frac{1}{1+\frac{c}{d}}\right|\frac{1}{\Gamma(\gamma)}$
$\displaystyle\times\frac{\Gamma(\gamma)}{\Gamma(\alpha+1)}(b-a)^{\alpha}\left\|f\big{(}\cdot,z_{n}(\cdot)\big{)}-f\big{(}\cdot,z(\cdot)\big{)}\right\|_{C_{1-\gamma}}$
$\displaystyle+\frac{\Gamma(\gamma)(t-a)^{1-\gamma+\alpha}}{\Gamma(-\gamma+\alpha)}\left\|f\big{(}\cdot,z_{n}(\cdot)\big{)}-f\big{(}\cdot,z(\cdot)\big{)}\right\|_{C_{1-\gamma}}.$

Since $f$ is continuous on $(a,b]$, and $z_{n}\rightarrow z,$ this implies

$\|(\mathcal{T}z_{n}-\mathcal{T}z)\|_{C_{1-\gamma}}\longrightarrow
0~{}~{}as~{}~{}n\longrightarrow\infty,$

which means that operator $\mathcal{T}$ is continuous on $\mathbb{B}_{r}$.

Step 3. We prove that $\mathcal{T}(\mathbb{B}_{r})$ is relatively compact.
From Step 1, we have
${\large\mathcal{T(}}\mathbb{B}_{r})\subset\mathbb{B}_{r}.$ It follows that
${\large\mathcal{T(}}\mathbb{B}_{r})$ is uniformly bounded. Moreover, we show
that operator $\mathcal{T}$ is equicontinuous on $\mathbb{B}_{r}$. Indeed,for
any $a<t_{1}<t_{2}<b$ and $z\in\mathbb{B}_{r}$, we get

$\displaystyle\left|(t_{2}-a)^{1-\gamma}\big{(}{\large\mathcal{T}}z\big{)}(t_{2})-(t_{1}-a)^{1-\gamma}\big{(}{\large\mathcal{T}}z\big{)}(t_{1})\right|$
$\displaystyle\leq$
$\displaystyle\frac{\left|(t_{2}-a)^{{}^{n-k}}-(t_{1}-a)^{{}^{n-k}}\right|}{\Gamma(\gamma)}\frac{e_{k}}{d\left(1+\frac{c}{d}\right)}+\left|\frac{1}{1+\frac{c}{d}}\right|\frac{\left|(t_{2}-a)^{{}^{n-k}}-(t_{1}-a)^{{}^{n-k}}\right|}{\Gamma(\gamma)}$
$\displaystyle\times\frac{1}{\Gamma(1-\gamma+\alpha)}\int_{a}^{b}(b-s)^{1-\gamma+\alpha-1}\left|f\big{(}s,z(s)\big{)}\right|ds$
$\displaystyle+\dfrac{1}{\Gamma(\alpha)}\left|(t_{2}-a)^{1-\gamma}\int_{a}^{t_{2}}(t_{2}-s)^{\alpha-1}f\big{(}s,z(s)\big{)}ds\right.$
$\displaystyle\left.-(t_{1}-a)^{1-\gamma}\int_{a}^{t_{1}}(t_{1}-s)^{\alpha-1}f\big{(}s,z(s)\big{)}ds\right|$
$\displaystyle\leq$
$\displaystyle\frac{\left|(t_{2}-a)^{{}^{n-k}}-(t_{1}-a)^{{}^{n-k}}\right|}{\Gamma(\gamma)}\left[\frac{e_{k}}{d\left(1+\frac{c}{d}\right)}\right.$
$\displaystyle\left.+\left|\frac{1}{1+\frac{c}{d}}\right|\frac{\left\|f\right\|_{C_{1-\gamma}}}{\Gamma(1-\gamma+\alpha)}\int_{a}^{b}(b-s)^{-\gamma+\alpha}(s-a)^{\gamma-1}ds\right]$
$\displaystyle+\dfrac{\|f\|_{C_{1-\gamma}}}{\Gamma(\alpha)}\left|(t_{2}-a)^{1-\gamma}\int_{a}^{t_{2}}(t_{2}-s)^{\alpha-1}(s-a)^{\gamma-1}ds\right.$
$\displaystyle\left.-(t_{1}-a)^{1-\gamma}\int_{a}^{t_{1}}(t_{1}-s)^{\alpha-1}(s-a)^{\gamma-1}ds\right|$
$\displaystyle\leq$
$\displaystyle\frac{\left|(t_{2}-a)^{{}^{n-k}}-(t_{1}-a)^{{}^{n-k}}\right|}{\Gamma(\gamma)}\left[\frac{e_{k}}{d\left(1+\frac{c}{d}\right)}\right.$
$\displaystyle+\left.\left|\frac{1}{1+\frac{c}{d}}\right|\frac{\Gamma(\gamma)}{\Gamma(\alpha+1)}(b-a)^{\alpha}\left\|f\right\|_{C_{1-\gamma}}\right]$
$\displaystyle+\dfrac{\|f\|_{C_{1-\gamma}}}{\Gamma(\alpha)}\mathcal{B}(\gamma-n+1,\alpha)\left|(t_{2}-a)^{\alpha}-(t_{1}-a)^{\alpha}\right|$

which tends to zero as $t_{2}\rightarrow t_{1},$ independent of
$z\in\mathbb{B}_{r}$, where $\mathcal{B(\cdot},\mathcal{\cdot)}$ is a Beta
function. Thus we conclude that $\mathcal{T}(\mathbb{B}_{r})$ is
equicontinuous on $\mathbb{B}_{r}$ and therefore $\mathcal{T}(\mathbb{B}_{r})$
is relatively compact. As a consequence of Steps 1 to 3 together with Arzela-
Ascoli theorem, we can conclude that
$\mathcal{T}:\mathbb{B}_{r}\rightarrow\mathbb{B}_{r}$ is completely continuous
operator.

An application of Schauder’s fixed point theorem shows that there exists at
least a fixed point $z$ of $\mathcal{T}$ in $C_{1-\gamma}[a,b]$. This fixed
point $z$ is the solution to (17)-(18) in $C_{1-\gamma}^{\gamma}[a,b],$ and
the proof is completed. ∎

We will study the next existence result by using Schaefer fixed point theorem.
To this end, we change hypothesis (H1) into the following one:

  * (H3)

$f:(a,b]\times\mathbb{R}\rightarrow\mathbb{R}$ is a function such that
$f(\cdot,z(\cdot))\in C_{1-\gamma}^{\beta(1-\alpha)}[a,b]$ for any $z\in
C_{1-\gamma}[a,b]$ and there exist a function $\eta(t)\in C_{1-\gamma}[a,b]$
such that

$\left|f\big{(}t,z\big{)}\right|\leq\eta(t),\text{ for all }t\in(a,b],\text{
}z\in\mathbb{R}.$

######  Theorem 3.3.

Assume that (H3) holds. Then Hilfer boundary value problem (17)-(18) has at
least one solution in $C_{1-\gamma}^{\gamma}[a,b]\subset
C_{1-\gamma}^{\alpha,\beta}[a,b]$.

###### Proof.

As in the proof of Theorem 3.2, one can repeat Steps 1 to 3 and show that
operator ${\large\mathcal{T}}:C_{1-\gamma}[a,b]\longrightarrow
C_{1-\gamma}[a,b]$ defined in (35) is a completely continuous. It remains to
prove that

$\Delta=\left\\{z\in{\large C_{n-\gamma}[a,b]}:z=\lambda\mathcal{T}z,\text{
for some }\lambda\in(0,1)\right\\}$

is a bounded set. Let $z\in\Delta$ and $\lambda\in(0,1)$ be such that
$z=\lambda Tz.$ By hypothesis (H3) and Eq.(35), then for all $t\in[a,b],$ we
have

$\displaystyle\left|{\large\mathcal{T}z(t)(t-a)}^{n-\gamma}\right|$
$\displaystyle\leq\sum_{k=1}^{n}\frac{(t-a)^{n-k}}{\Gamma(\gamma-k+1)}\frac{e_{k}}{d\left(1+\frac{c}{d}\right)}$
$\displaystyle+\left|\frac{1}{1+\frac{c}{d}}\right|\sum_{k=1}^{n}\frac{(t-a)^{n-k}}{\Gamma(\gamma-k+1)}\frac{1}{\Gamma(n-\gamma+\alpha)}\int_{a}^{b}(b-s)^{n-\gamma+\alpha-1}\eta(s)ds$
$\displaystyle+\frac{\left|(t-a)^{n-\gamma}\right|}{\Gamma(\alpha)}\int_{a}^{t}(t-s)^{\alpha-1}\eta(s)ds$
$\displaystyle\leq\sum_{k=1}^{n}\frac{(t-a)^{n-k}}{\Gamma(\gamma-k+1)}\frac{e_{k}}{d\left(1+\frac{c}{d}\right)}$
$\displaystyle+\left|\frac{1}{1+\frac{c}{d}}\right|\sum_{k=1}^{n}\frac{(t-a)^{n-k}}{\Gamma(\gamma-k+1)}\frac{1}{\Gamma(n-\gamma+\alpha)}\int_{a}^{b}(b-s)^{n-\gamma+\alpha-1}(s-a)^{\gamma-n}\|\mathcal{\eta}\|_{C_{n-\gamma}}ds$
$\displaystyle+\frac{\left|(t-a)^{n-\gamma}\right|}{\Gamma(\alpha)}\int_{a}^{t}(t-s)^{\alpha-1}(s-a)^{\gamma-n}\|\mathcal{\eta}\|_{C_{n-\gamma}}ds.$

That is

$\displaystyle\|\mathcal{T}z\|_{C_{n-\gamma}}$ (36) $\displaystyle\leq$
$\displaystyle\sum_{k=1}^{n}\frac{(b-a)^{n-k}}{\Gamma(\gamma-k+1)}\frac{e_{k}}{d\left(1+\frac{c}{d}\right)}$
$\displaystyle+\left[\left|\frac{1}{1+\frac{c}{d}}\right|\sum_{k=1}^{n}\frac{(b-a)^{-k}}{\Gamma(\gamma-k+1)}\frac{\Gamma(\alpha)}{\mathcal{B(\alpha},1\mathcal{)}}+\frac{\mathcal{B(}\gamma-n+1,1\mathcal{)}}{\Gamma(\alpha)(b-a)^{\gamma}}\right](b-a)^{n+\alpha}\|\mathcal{\eta}\|_{C_{n-\gamma}}$
$\displaystyle:$ $\displaystyle=\ell.$

Since $\lambda\in(0,1)$ then $z<\mathcal{T}z.$ The last inequality with
Eq.(36) leads us to

$\|z\|_{C_{n-\gamma}}<\|\mathcal{T}z\|_{C_{n-\gamma}}\leq\ell$

Which proves that $\Delta$ is bounded. By using Schaefer fixed point theorem,
the proof can be completed. ∎

Finally, we present the existence result for the problem (17)-(18), which is
based on Krasnosel’skii fixed point theorem. For this end, we change
hypothesis (H1) into the following one:

  * (H4)

$f:(a,b]\times\mathbb{R}\rightarrow\mathbb{R}$ is a function such that
$f(\cdot,z(\cdot))\in C_{n-\gamma}^{\beta(n-\alpha)}[a,b]$ for any $z\in
C_{n-\gamma}[a,b]$ and there exists constant $L>0$ such that

$\left|f\big{(}t,z\big{)}-f\big{(}t,w\big{)}\right|\leq
L\left|z-w\right|,\text{ }\forall t\in(a,b],\text{ }z,w\in\mathbb{R}$

And we consider the following hypothesis:

  * (H5)

The inequality

$\displaystyle\mathcal{W}$ $\displaystyle:$
$\displaystyle=\bigg{[}\left|\frac{1}{1+\frac{c}{d}}\right|\sum_{k=1}^{n}\frac{(b-a)^{n-k}}{\Gamma(\gamma-k+1)}+\frac{\mathcal{B}(\gamma-n,\alpha+1)}{\Gamma(\gamma-n)}\bigg{]}$
$\displaystyle\times\frac{\Gamma(\gamma-n)(b-a)^{\alpha}}{\mathcal{B}(\gamma-n,1)\Gamma(\alpha+1)}L<1$

is holds.

######  Theorem 3.4.

Assume that hypotheses (H4) and (H5) are satisfied. If

$\left|\frac{1}{1+\frac{c}{d}}\right|\sum_{k=1}^{n}\frac{(b-a)^{n-k+\alpha}}{\Gamma(\gamma-k+1)}\frac{\Gamma(\gamma-n+1)}{\Gamma(\alpha+1)}L<1.$
(37)

Then Hilfer boundary value problem (17)-(18) has at least one solution in
$C_{n-\gamma}^{\gamma}[a,b]\subset C_{n-\gamma}^{\alpha,\beta}[a,b]$.

###### Proof.

Consider the operator ${\large\mathcal{T}}$ is defined as in Theorem 3.2.

Now, we need to analyze the operator ${\large\mathcal{T}}$ into sum two
operators ${\large\mathcal{T}}_{1}+{\large\mathcal{T}}_{2}$ as follows

${\large\mathcal{T}}_{1}z(t)=-\frac{1}{\left(1+\frac{c}{d}\right)}\sum_{k=1}^{n}\frac{(t-a)^{\gamma-k}}{\Gamma(\gamma-k+1)}\frac{1}{\Gamma(n-\gamma+\alpha)}\int_{a}^{b}(b-s)^{n-\gamma+\alpha-1}f(s,z(s))ds$

and

${\large\mathcal{T}}_{2}z(t)=\sum_{k=1}^{n}\frac{(t-a)^{\gamma-k}}{\Gamma(\gamma-k+1)}\frac{e_{k}}{d\left(1+\frac{c}{d}\right)}+\frac{1}{\Gamma(\alpha)}\int_{a}^{t}(t-s)^{\alpha-1}f(s,z(s))ds.$

Set $\widetilde{f}=f(s,0)$ and consider the ball
$\mathbb{B}_{\epsilon}=\\{z\in
C_{n-\gamma;\psi}([a,b]:\left\|z\right\|_{C_{n-\gamma;\psi}}\leq\epsilon\\}\
$with $\epsilon\geq\frac{\Lambda}{1-\mathcal{W}},\mathcal{W<}1$ where

$\displaystyle\Lambda$ $\displaystyle=$
$\displaystyle\bigg{[}\left|\frac{1}{1+\frac{c}{d}}\right|\sum_{k=1}^{n}\frac{(b-a)^{n-k}}{\Gamma(\gamma-k+1)}+\frac{\mathcal{B}(\gamma-n,\alpha+1)}{\Gamma(\gamma-n)}\bigg{]}$
(38)
$\displaystyle\times\frac{\Gamma(\gamma-n)(b-a)^{\alpha}}{\mathcal{B}(\gamma-n,1)\Gamma(\alpha+1)}\left\|\widetilde{f}\right\|_{C_{n-\gamma}}+\sum_{k=1}^{n}\frac{(b-a)^{n-k}}{\Gamma(\gamma-k+1)}\frac{e_{k}}{d\left(1+\frac{c}{d}\right)}.$

The proof will be given in three stages.

Stage 1: We prove that
${\large\mathcal{T}}_{1}z+{\large\mathcal{T}}_{2}w\in\mathbb{B}_{r}$ for every
$z,w\in\mathbb{B}_{\epsilon}.$

By assumpition (H4), then for every $z\in\mathbb{B}_{\epsilon},$and
$t\in(a,b]$, we have

$\displaystyle\left|(t-a)^{n-\gamma}{\large\mathcal{T}}_{1}z(t)\right|$
$\displaystyle\leq$
$\displaystyle\left|\frac{1}{1+\frac{c}{d}}\right|\sum_{k=1}^{n}\frac{(t-a)^{n-k}}{\Gamma(\gamma-k+1)}\frac{1}{\Gamma(n-\gamma+\alpha)}$
$\displaystyle\times\int_{a}^{b}(b-s)^{n-\gamma+\alpha-1}\bigg{[}\left|f(s,z(s))-f(s,0)\right|+\left|f(s,0)\right|\bigg{]}ds$
$\displaystyle\leq$
$\displaystyle\left|\frac{1}{1+\frac{c}{d}}\right|\sum_{k=1}^{n}\frac{(t-a)^{n-k}}{\Gamma(\gamma-k+1)}\frac{1}{\Gamma(n-\gamma+\alpha)}$
$\displaystyle\times\int_{a}^{b}(b-s)^{n-\gamma+\alpha-1}(s-a)^{\gamma-n}\bigg{[}L\left\|z\right\|_{C_{n-\gamma}}+\left\|\widetilde{f}\right\|_{C_{n-\gamma}}\bigg{]}ds$
$\displaystyle\leq$
$\displaystyle\left|\frac{1}{1+\frac{c}{d}}\right|\sum_{k=1}^{n}\frac{(t-a)^{n-k}}{\Gamma(\gamma-k+1)}\frac{\Gamma(\gamma-n+1)}{\Gamma(\alpha+1)}(t-a)^{\alpha}\bigg{[}L\epsilon+\left\|\widetilde{f}\right\|_{C_{n-\gamma}}\bigg{]}.$

This gives

$\displaystyle\left\|{\large\mathcal{T}}_{1}z\right\|_{C_{n-\gamma}}$ (39)
$\displaystyle\leq$
$\displaystyle\left|\frac{1}{1+\frac{c}{d}}\right|\sum_{k=1}^{n}\frac{(b-a)^{n-k+\alpha}}{\Gamma(\gamma-k+1)}\frac{\Gamma(\gamma-n+1)}{\Gamma(\alpha+1)}\bigg{[}L\epsilon+\left\|\widetilde{f}\right\|_{C_{n-\gamma}}\bigg{]}.$

For operator ${\large\mathcal{T}}_{2}$, we have

$\displaystyle\left|(t-a)^{n-\gamma}{\large\mathcal{T}}_{2}w(t)\right|$
$\displaystyle\leq$
$\displaystyle\sum_{k=1}^{n}\frac{(t-a)^{n-k}}{\Gamma(\gamma-k+1)}\frac{e_{k}}{d\left(1+\frac{c}{d}\right)}$
$\displaystyle+\frac{(t-a)^{n-\gamma}}{\Gamma(\alpha)}\int_{a}^{t}(t-s)^{\alpha-1}\bigg{[}\left|f(s,w(s))-f(s,0)\right|+\left|f(s,0)\right|\bigg{]}ds$
$\displaystyle\leq$
$\displaystyle\sum_{k=1}^{n}\frac{(t-a)^{n-k}}{\Gamma(\gamma-k+1)}\frac{e_{k}}{d\left(1+\frac{c}{d}\right)}$
$\displaystyle+\frac{(t-a)^{n-\gamma}}{\Gamma(\alpha)}\int_{a}^{t}(t-s)^{\alpha-1}(s-a)^{\gamma-n}\bigg{[}L\left\|w\right\|_{C_{n-\gamma}}+\left\|\widetilde{f}\right\|_{C_{n-\gamma}}\bigg{]}ds.$

For every $w\in\mathbb{B}_{\epsilon},$and $t\in(a,b]$, this gives

$\displaystyle\left\|{\large\mathcal{T}}_{2}w\right\|_{C_{n-\gamma}}$
$\displaystyle\leq$
$\displaystyle\sum_{k=1}^{n}\frac{(b-a)^{n-k}}{\Gamma(\gamma-k+1)}\frac{e_{k}}{d\left(1+\frac{c}{d}\right)}$
(40)
$\displaystyle+\frac{\Gamma(\gamma-n+1)(b-a)^{\alpha}}{\Gamma(\gamma-n+\alpha+1)}\bigg{[}L\epsilon+\left\|\widetilde{f}\right\|_{C_{n-\gamma}}\bigg{]}.$

From Eqs.(39),(40), and using hypothesis (H5) with Eq.(38), we get

$\displaystyle\left\|{\large\mathcal{T}}_{1}z+{\large\mathcal{T}}_{2}w\right\|_{C_{n-\gamma}}$
$\displaystyle\leq$
$\displaystyle\left\|{\large\mathcal{T}}_{1}z\right\|_{C_{n-\gamma}}+\left\|{\large\mathcal{T}}_{2}w\right\|_{C_{n-\gamma}}$
$\displaystyle\leq$
$\displaystyle\bigg{[}\left|\frac{1}{1+\frac{c}{d}}\right|\sum_{k=1}^{n}\frac{(b-a)^{n-k}}{\Gamma(\gamma-k+1)}+\frac{\Gamma(\alpha+1)}{\Gamma(\gamma-n+\alpha+1)}\bigg{]}$
$\displaystyle\times\frac{\Gamma(\gamma-n+1)(b-a)^{\alpha}}{\Gamma(\alpha+1)}\bigg{[}L\epsilon+\left\|\widetilde{f}\right\|_{C_{n-\gamma}}\bigg{]}$
$\displaystyle+\sum_{k=1}^{n}\frac{(b-a)^{n-k}}{\Gamma(\gamma-k+1)}\frac{e_{k}}{d\left(1+\frac{c}{d}\right)}$
$\displaystyle\leq$
$\displaystyle\mathcal{W}\epsilon+(1-\mathcal{W})\epsilon=\epsilon.$

This proves that
${\large\mathcal{T}}_{1}z+{\large\mathcal{T}}_{2}w\in\mathbb{B}_{r}$ for every
$z,w\in\mathbb{B}_{r}.$

Stage 2: We prove that the operator ${\large\mathcal{T}}_{1}$ is a contration
mapping on $\mathbb{B}_{r}.$

For any $z,w\in\mathbb{B}_{r},$ and for $t\in(a,b],$ then by assumptions (H4),
we have

$\displaystyle\left|(t-a)^{n-\gamma}{\large\mathcal{T}}_{1}z(t)-(t-a)^{n-\gamma}{\large\mathcal{T}}_{1}w(t)\right|$
$\displaystyle\leq$
$\displaystyle\left|\frac{1}{1+\frac{c}{d}}\right|\sum_{k=1}^{n}\frac{(t-a)^{n-k}}{\Gamma(\gamma-k+1)}\frac{1}{\Gamma(n-\gamma+\alpha)}$
$\displaystyle\times\int_{a}^{b}(b-s)^{n-\gamma+\alpha-1}\bigg{[}\left|f(s,z(s))-f(s,w(s))\right|\bigg{]}ds$
$\displaystyle\leq$
$\displaystyle\left|\frac{1}{1+\frac{c}{d}}\right|\sum_{k=1}^{n}\frac{(t-a)^{n-k}}{\Gamma(\gamma-k+1)}$
$\displaystyle\times\frac{1}{\Gamma(n-\gamma+\alpha)}\int_{a}^{b}(b-s)^{n-\gamma+\alpha-1}L\left|z(s)-w(s))\right|ds$
$\displaystyle\leq$
$\displaystyle\left|\frac{1}{1+\frac{c}{d}}\right|\sum_{k=1}^{n}\frac{(t-a)^{n-k}}{\Gamma(\gamma-k+1)}\frac{\Gamma(\gamma-n+1)}{\Gamma(\alpha+1)}(b-s)^{\alpha}L\left\|z-w\right\|_{C_{n-\gamma}}$

This gives,

$\displaystyle\left\|{\large\mathcal{T}}_{1}z-{\large\mathcal{T}}_{1}w\right\|_{C_{n-\gamma}}$
$\displaystyle\leq$
$\displaystyle\left|\frac{1}{1+\frac{c}{d}}\right|\sum_{k=1}^{n}\frac{(b-a)^{n-k+\alpha}}{\Gamma(\gamma-k+1)}\frac{\Gamma(\gamma-n+1)}{\Gamma(\alpha+1)}L\left\|z-w\right\|_{C_{n-\gamma}}.$

The operator ${\large\mathcal{T}}_{1}$ is contraction mapping due to
assumption Eqs.(37).

Stage 3: We show that the operator ${\large\mathcal{T}}_{2}$ is completely
continuous on $\mathbb{B}_{\epsilon}.$

Firstly, from the continuity of $f$, we conclude that the operator
${\large\mathcal{T}}_{2}:\mathbb{B}_{\epsilon}\rightarrow\mathbb{B}_{\epsilon}$
i.e. ${\large\mathcal{T}}_{2}$ is continuous on $\mathbb{B}_{\epsilon}$. Next,
we show that for all $\epsilon>0,$ there exists some
$\epsilon^{{}^{\prime}}>0$ such that
$\left\|{\large\mathcal{T}}_{2}z\right\|_{C_{n-\gamma}}\leq\epsilon^{{}^{\prime}}.$
According to stage 1, for $z\in\mathbb{B}_{\epsilon},$ we know that

$\displaystyle\left\|{\large\mathcal{T}}_{2}z\right\|_{C_{n-\gamma}}$
$\displaystyle\leq$
$\displaystyle\sum_{k=1}^{n}\frac{(b-a)^{n-k}}{\Gamma(\gamma-k+1)}\frac{e_{k}}{d\left(1+\frac{c}{d}\right)}$
$\displaystyle+\mathcal{B}(\gamma-n+1,\alpha)\frac{(b-a)^{\alpha}}{\Gamma(\alpha)}\bigg{[}L\epsilon+\left\|\widetilde{f}\right\|_{C_{n-\gamma}}\bigg{]}.$

which is independent of $t$ and $z$, hence there exists

$\epsilon^{{}^{\prime}}=\sum_{k=1}^{n}\frac{(b-a)^{n-k}}{\Gamma(\gamma-k+1)}\frac{e_{k}}{d\left(1+\frac{c}{d}\right)}+\mathcal{B}(\gamma-n+1,\alpha)\frac{(b-a)^{\alpha}}{\Gamma(\alpha)}\bigg{[}L\epsilon+\left\|\widetilde{f}\right\|_{C_{n-\gamma}}$

such that
$\left\|{\large\mathcal{T}}_{2}z\right\|_{C_{n-\gamma}}\leq\epsilon^{{}^{\prime}}.$
So ${\large\mathcal{T}}_{2}$ is uniformly bounded set on
$\mathbb{B}_{\epsilon}.$

Finally, to prove that ${\large\mathcal{T}}_{2}$ is equicontinuous in
$\mathbb{B}_{\epsilon}$, for any $z\in\mathbb{B}_{\epsilon}$ and
$t_{1},t_{2}\in(a,b]$ with $t_{1}<t_{2},$ we have

$\displaystyle\left|(t_{2}-a)^{n-\gamma}\mathcal{T}_{2}z(t_{2})-(t_{1}-a)^{n-\gamma}\mathcal{T}_{2}z(t_{1})\right|$
$\displaystyle=$
$\displaystyle\left|\sum_{k=1}^{n}\frac{(t_{2}-a)^{n-k}-(t_{1}-a)^{n-k}}{\Gamma(\gamma-k+1)}\frac{e_{k}}{d\left(1+\frac{c}{d}\right)}\right.$
$\displaystyle+\frac{(t_{2}-a)^{n-\gamma}}{\Gamma(\alpha)}\int_{a}^{t_{2}}(t_{2}-s))^{\alpha-1}f(s,z(s))ds$
$\displaystyle-\left.\frac{(t_{1}-a)^{n-\gamma}}{\Gamma(\alpha)}\int_{a}^{t_{1}}(t_{1}-s))^{\alpha-1}f(s,z(s))ds\right|$
$\displaystyle\leq$
$\displaystyle\sum_{k=1}^{n}\frac{\left|(t_{2}-a)^{n-k}-(t_{1}-a)^{n-k}\right|}{\Gamma(\gamma-k+1)}\frac{e_{k}}{d\left(1+\frac{c}{d}\right)}$
$\displaystyle\left|+\frac{(t_{2}-a)^{n-\gamma}}{\Gamma(\alpha)}\int_{a}^{t_{2}}(t_{2}-s))^{\alpha-1}(s-a)^{\gamma-n}\left\|f\right\|_{C_{n-\gamma;\psi}[a,b]}ds\right.$
$\displaystyle\left.-\frac{(t_{1}-a)^{n-\gamma}}{\Gamma(\alpha)}\int_{a}^{t_{1}}(t_{1}-s))^{\alpha-1}(s-a)^{\gamma-n}\left\|f\right\|_{C_{n-\gamma;\psi}[a,b]}ds\right|$
$\displaystyle=$
$\displaystyle\sum_{k=1}^{n}\frac{\left|(t_{2}-a)^{n-k}-(t_{1}-a)^{n-k}\right|}{\Gamma(\gamma-k+1)}\frac{e_{k}}{d\left(1+\frac{c}{d}\right)}$
$\displaystyle+\frac{\mathcal{B}(\gamma-n+1)}{\Gamma(\alpha)}\left\|f\right\|_{C_{n-\gamma;\psi}[a,b]}\left|(t_{2}-a)^{\alpha}-(t_{1}-a)^{\alpha}\right|.$

Observe that the right-hand side of the above inequality is independent of
$z.$ So

$\left|(t_{2}-a)^{n-\gamma}{\large\mathcal{T}}_{2}z(t_{2})-(t_{1}-a)^{n-\gamma}{\large\mathcal{T}}_{2}z(t_{1})\right|\rightarrow
0,\text{ as }|t_{2}-t_{1}|\rightarrow 0.$

This proves that ${\large\mathcal{T}}_{2}$ is equicontinuous on
$\mathbb{B}_{\epsilon}$. In the view of Arzela-Ascoli Theorem, it follows that
$({\large\mathcal{T}}_{2}\mathbb{B}_{\epsilon})$ is relatively compact. As a
consequence of Krasnosel’skii fixed point theorem, we conclude that the
problem (17)-(18) has at least one solution. ∎

######  Corollary 3.5.

Assume that hypotheses (H4) and (H5) are satisfied. Then Hilfer boundary value
problem (17)-(18) has a unique solution in $C_{n-\gamma}^{\gamma}[a,b]\subset
C_{n-\gamma}^{\alpha,\beta}[a,b]$.

##  4 An example

Consider the Hilfer fractional differential equation with boundary condition

$\begin{cases}D_{a^{+}}^{\alpha,\beta}z(t)=f\big{(}t,z(t)\big{)},t\in(0,1],0<\alpha<1,0\leq\beta\leq
1,\\\
I_{a^{+}}^{1-\gamma}\big{[}\frac{1}{4}z(0^{+})+\frac{3}{4}z(1^{-})\big{]}=\frac{2}{5},~{}~{}\alpha\leq\gamma=\alpha+\beta-\alpha\beta,\end{cases}$
(41)

where, $\alpha=\frac{1}{2},\beta=\frac{1}{3}$, $\gamma=\frac{2}{3}$,
$c=\frac{1}{4}$, $d=\frac{3}{4}$, $e_{1}=\frac{2}{5},$ and

$f\big{(}t,z(t)\big{)}=t^{\frac{-1}{6}}+\frac{1}{16}t^{\frac{5}{6}}\sin z(t),$

Clearly,
$t^{\frac{1}{3}}f\big{(}t,z(t)\big{)}=t^{\frac{1}{6}}+\frac{1}{16}t^{\frac{7}{6}}\sin
z(t)\in C[0,1],$ hence $f\big{(}t,z(t)\big{)}\in C_{\frac{1}{3}}[0,1].$
Observe that, for any $z\in\mathbb{R}^{+}$ and $t\in(0,1],$

$\displaystyle\left|f\big{(}t,z(t)\big{)}\right|$ $\displaystyle\leq$
$\displaystyle
t^{\frac{1}{6}}\left(1+\frac{1}{16}t^{\frac{2}{3}}\left|t^{\frac{1}{3}}z(t)\right|\right)$
$\displaystyle\leq$
$\displaystyle\left(1+\frac{1}{16}\left\|z\right\|_{C_{\frac{1}{3}}}\right).$

Therefore, the conditions (H1) is satisfied with $N=1,$ and
$\zeta=\frac{1}{16}$. It is easy to check that the (H2) is satisfied too.
Indeed, by some calculations, we get

$\mathcal{G}=\frac{\Gamma(\gamma-n+1)}{\Gamma(\alpha+1)}\left[(b-a)^{\alpha}+(b-a)^{\alpha+n-\gamma}\right]N\zeta\simeq
0.19<1.$

An application of Theorem 3.2 implies that problem (41) has a solution in
$C_{\frac{1}{3}}^{\frac{2}{3}}([0,1])$.

Moreover, consider
$f\big{(}t,z(t)\big{)}=t^{\frac{-1}{6}}+\frac{1}{16}t^{\frac{5}{6}}\sin(t),$
it follows $\left|f\big{(}t,z(t)\big{)}\right|\leq
t^{\frac{-1}{6}}+\frac{1}{16}t^{\frac{5}{6}}=\eta(t)\in C_{1-\gamma}[0,1].$
Therefore (H3) holds. An application of Theorem 3.3 implies that problem (41)
has a solution in $C_{\frac{1}{3}}^{\frac{2}{3}}([0,1])$.

Finally, if
$f\big{(}t,z(t)\big{)}=t^{\frac{-1}{6}}+\frac{1}{16}t^{\frac{5}{6}}\sin z(t),$
then for $z,w\in\mathbb{R}^{+}$ and $t\in(0,1],$ we get

$\left|f\big{(}t,z(t)\big{)}-f\big{(}t,w(t)\big{)}\right|\leq\frac{1}{16}\left|z-w\right|.$

Thus, the hypothesis $(H4)$ is satisfied with $L=\frac{1}{16}$. It is easy to
check that hypothesis (H5) and inequality (37) are satisfied. Indeed, by some
calculations, we get

$\displaystyle\mathcal{W}$ $\displaystyle:$
$\displaystyle=\bigg{[}\left|\frac{1}{1+\frac{c}{d}}\right|\sum_{k=1}^{n}\frac{(b-a)^{n-k}}{\Gamma(\gamma-k+1)}+\frac{\mathcal{B}(\gamma-n,\alpha+1)}{\Gamma(\gamma-n)}\bigg{]}$
$\displaystyle\times\frac{\Gamma(\gamma-n)(b-a)^{\alpha}}{\mathcal{B}(\gamma-n,1)\Gamma(\alpha+1)}L\simeq
0.14<1$

and

$\left|\frac{1}{1+\frac{c}{d}}\right|\sum_{k=1}^{n}\frac{(b-a)^{n-k+\alpha}}{\Gamma(\gamma-k+1)}\frac{\Gamma(\gamma-n+1)}{\Gamma(\alpha+1)}L\simeq
0.05<1.$ (42)

An application of Theorem 3.4 implies that problem (41) has a solution in
$C_{\frac{1}{3}}^{\frac{2}{3}}[0,1]$.

##  5 Conclusion

We have obtained some existence results for the solution of boundary value
problem for Hilfer fractional differential equations based on the reduction of
fractional differential equations to integral equations. The employed
techniques, the fixed point theorems, are quite general and effective. We
trust the reported results here will have a positive impact on the development
of further applications in engineering and applied sciences.

## References

  * [1] Abbas, S., Benchohra, M, Lazreg, J. E. and Zhou, Y., _A survey on Hadamard and Hilfer fractional differential equations: Analysis and stability,_ Chaos Soliton Fract., 102, 47-71, 2017.
  * [2] R P Agarwal, M Benchohra and S Hamani, _A survey on existence results for boundary value problems of nonlinear fractional differential with inclusions,_ Acta Appl Math., 109, 973-1033, 2010.
  * [3] Sandeep P. Bhairat, _Existence and stability results for fractional differential equations involving generalized Katugampola derivative_ , (In press) Studia U.B.B. Math., 2019, 15 pages. ar.Xiv:1709.08838 [math.CA].
  * [4] Sandeep P. Bhairat and D. B. Dhaigude, _Existence of solutions of generalized fractional differential equation with with nonlocal initial condition_ , Mathematica Bohemica, 144 no. 2, 203–220, 2019. DOI: 10.21136/MB.2018.0135-17.
  * [5] Sandeep P. Bhairat, _Existence and continuation of solution of Hilfer fractional differential equations_ , J. Math. Modeling, 7 no. 1, 1–20, 2018. DOI:10.22124/jmm.2018.9220.1136.
  * [6] Sandeep P. Bhairat, _New approach to existence of solution of weighted Cauchy-type problem,_ (Under review) 2019. ar.Xiv.1808.03067[math.CA].
  * [7] Sandeep P. Bhairat and D. B. Dhaigude, _Local existence and uniqueness of solutions for Hilfer-Hadamard fractional differential problem_ , Nonlinear Dyn. Syst. Theory, 18 no. 2, 144–153, 2018. http://e-ndst.kiev.ua144.
  * [8] Sandeep P. Bhairat, _On existence and approximation of solutions for Hilfer fractional differential equations_ , (Under review) arXiv:1704.02464v2 [math.CA], 2017.
  * [9] K. Diethelm, _The Analysis of Fractional Differential Equations,_ Lecture Notes in Mathematics, 2004, Springer-Verlag, Berlin, 2010.
  * [10] D B Dhaigude and S P Bhairat, _Existence and uniqueness of solution of Cauchy-type problem for Hilfer fractional differential equations,_ Communications in Applied Analysis, 2018.
  * [11] K. M. Furati and M. D. Kassim, _Existence and uniqueness for a problem involving Hilfer fractional derivative,_ Comput. Math. Applic., 64 (2012), pp. 1616-1626.
  * [12] A. Granas and J. Dugundji, _Fixed Point Theory,_ Springer Monographs in Mathematics,Springer-Verlag, New York, 2003.
  * [13] Haibo Gu and J J Trujillo, Existence of mild solution for evolution equation with Hilfer fractional derivative, App Math Comput., 257, 344-354, 2015.
  * [14] R. Hilfer, _Experimental evidence for fractional time evolution in glass forming materials,_ Chem. Phy., 284, 399-408, 2002.
  * [15] R. Hilfer, _Applications of Fractional Calculus in Physics,_ World Scientific, Singapore, 2000.
  * [16] R. Hilfer, Y. Luchko and Z. Tomovski, _Operational method for the solution of fractional differential equations with generalized Riemann–Lioville fractional derivative,_ Fract. Calc. Appl. Anal.12, (2009), 289–318
  * [17] A. A. Kilbas, H. M. Srivastava and J. J. Trujillo, _Theory and Applications of Fractional Differential Equations,_ North-Holland Math Stud, 204 Elsevier, Amsterdam 2006.
  * [18] Rafal Kamoki, _A new representation formula for the Hilfer fractional derivative and its applications,_ J Comp. Appl. Math., 308, 2016, 39-45.
  * [19] Rafal Kamoki and Cezary Obeczynski, _On fractional Cauchy-type problems containing Hilfer’s derivative,_ E.J.D.E., 50, 1-12, 2016.
  * [20] Suphawat A, Atthapol K, Sotiris K Ntouyas and J Tariboon, _Nonlocal boundary value problems for Hilfer fractional differential equations,_ Bull Korean Math Soc., doi.org/10.4134/BKMS.b170887, 2019.
  * [21] Zivord Tomovski, R Hilfer and H M Srivastava, _Fractional and operational calculus with generalized fractional derivative operators and Mittag-Leffler type functions,_ Int Trans Spec Funct., 21 (11), 797-814, 2010.
  * [22] Zivord Tomovski, _Generalized Cauchy type problems for nonlinear fractional differential equations with composite fractional derivative operator,_ Nonlinear Analysis, 2012. doi:10.1016/j.na.2011.12.034
  * [23] D. Vivek, K. Kanagarajan, and E. M. Elsayed, _Some existence and stability results for Hilfer-fractional implicit differential equations with nonlocal conditions,_ Mediterranean Journal of Mathematics, 15(1) (2018), 1-15.
  * [24] Wnag J and Zhang Y., _Nonlocal initial value problems for differential equations with Hilfer fractional derivative,_ Appl Math Comput., 266, 850-859, 2015.
  * [25] Zhouyan Gao and Xiulan Yu, _Existence results for BVP of a class of Hilfer fractional differential equations,_ J Appl Math Comput., DOI: 10.1007/s12190-016-1070-3. 2016.


# BERT is Robust! A Case Against Synonym-Based Adversarial Examples in Text
Classification

Jens Hauser Zhao Meng Damián Pascual11footnotemark: 1 Roger Wattenhofer
ETH Zurich, Switzerland
{jehauser, zhmeng, dpascual<EMAIL_ADDRESS>
The two authors contributed equally to this paper.

###### Abstract

Deep Neural Networks have taken Natural Language Processing by storm. While
this led to incredible improvements across many tasks, it also initiated a new
research field, questioning the robustness of these neural networks by
attacking them. In this paper, we investigate four word substitution-based
attacks on BERT. We combine a human evaluation of individual word
substitutions and a probabilistic analysis to show that between 96% and 99% of
the analyzed attacks do not preserve semantics, indicating that their success
is mainly based on feeding poor data to the model. To further confirm that, we
introduce an efficient data augmentation procedure and show that many
adversarial examples can be prevented by including data similar to the attacks
during training. An additional post-processing step reduces the success rates
of state-of-the-art attacks below 5%. Finally, by looking at more reasonable
thresholds on constraints for word substitutions, we conclude that BERT is a
lot more robust than research on attacks suggests.

##  1 Introduction

Research in computer vision (Szegedy et al., 2014; Goodfellow et al., 2015)
and speech recognition (Carlini and Wagner, 2018) has shown that neural
networks are sensitive to changes that are imperceptible to humans. These
insights led to extensive research on attacks for creating these so-called
adversarial examples, especially in the field of computer vision. Looking for
similar issues in NLP is natural, and researchers proposed several different
attacks over the last years. However, contrary to computer vision, adversarial
examples in NLP are never completely invisible, as discrete characters or
words have to be exchanged. This brings up the question: How good are these
attacks? Do they reveal issues in current models, or are they just introducing
nonsense?

In this paper, we show that despite the general consensus that textual
adversarial attacks should preserve semantics, striving for ever-higher
success rates seems to be more important when implementing them. We combine a
human evaluation with a simple probabilistic analysis to show that between 96%
and 99% of the adversarial examples on BERT (Devlin et al., 2019) created by
four different attacks do not preserve semantics. Additionally, we propose a
two-step procedure consisting of data augmentation and post-processing for
defending against adversarial examples111We will release the code with the
official publication of this paper.. While this sounds contradictive at first,
the results show that we can eliminate a large portion of the successful
attacks by simply including data similar to the adversarial examples and
further detect many of the remaining adversarial examples in a post-processing
step. Compared to traditional adversarial training strategies, our method is
much more efficient and can be used as a baseline defense for researchers
looking into new and better attacks.

##  2 Related Work

Papernot et al. (2016) was the first to introduce adversarial examples in the
text domain. In the following years, a range of different attacks have been
proposed. Alzantot et al. (2018) use a population-based optimization algorithm
for creating adversarial examples, Zhang et al. (2019) use Metropolis Hastings
(Metropolis et al., 1953; Hastings, 1970). Further word substitution based
attacks were proposed by Ren et al. (2019); Jin et al. (2020); Li et al.
(2020) and Garg and Ramakrishnan (2020). They are discussed in more detail in
Section 3.1.

Regarding adversarial defense, some papers introducing attacks incorporate the
created adversarial examples during training (Alzantot et al., 2018; Ren et
al., 2019). However, due to the high cost of running the attacks, they cannot
create sufficiently many adversarial examples and achieve only minor
improvements in robustness. Wang et al. (2021a) suggest Synonym Encoding
Method (SEM), a method that uses an encoder that maps clusters of synonyms to
the same embedding. Such a method works well but also impedes the
expressiveness of the network. Wang et al. (2021b) propose a method for fast
adversarial training called Fast Gradient Projection Method (FGPM). However,
their method is limited to models with non-contextual word vectors as input.
On BERT, Meng et al. (2021) use a geometric attack that allows for creating
adversarial examples in parallel and therefore leads to faster adversarial
training. Another line of work is around certified robustness through Interval
Bound Propagation (Jia et al., 2019; Huang et al., 2019), but these approaches
currently do not scale to large models and datasets.

There is little work criticizing or questioning current synonym-based
adversarial attacks in NLP, Morris et al. (2020a) find that adversarial
attacks often do not preserve semantics using a human evaluation. They propose
to increase thresholds on frequently used metrics for the similarity of word
embeddings and sentence embeddings. However, they only investigate a single
attack on BERT.

##  3 Background

For a classifier $f:\mathcal{S}\to\mathcal{Y}$ and some correctly classified
input $s\in\mathcal{S}$, an adversarial example is an input
$s_{pert}\in\mathcal{S}$, such that $sim(s,s_{pert})\geq t_{sim}$ and
$f(s)\neq f(s_{pert})$, where $sim(s,s_{pert})\geq t_{sim}$ is a constraint on
the similarity of $s$ and $s_{pert}$. For text classification,
$s=\\{w^{1},w^{2},...,w^{n}\\}$ is a sequence of words. Common notions of
similarity are the cosine similarity of counter-fitted word vectors (Mrkšić et
al., 2016), which we will denote as $cos_{cv}(w^{i},w_{pert}^{i})$ or the
cosine similarity of sentence embeddings from the Universal Sentence Encoder
(USE) (Cer et al., 2018), which we will denote as $cos_{use}(s,s_{pert})$.
Note that this is a slight abuse of notation since $s$ and $s_{pert}$ are just
sequences of words. The notation should be interpreted as follows: We first
apply USE to $s$ and $s_{pert}$ to get two sentence vectors and then calculate
the cosine similarity. The same holds for $cos_{cv}(w^{i},w_{pert}^{i})$,
where we first get the counter-fitted word vectors of $w^{i}$ and
$w_{pert}^{i}$. Also, note that whenever we talk about the cosine similarity
of words, it refers to the cosine similarity of words in the counter-fitted
embedding. Similarly, USE score refers to the cosine similarity of sentence
embeddings from the USE.

###  3.1 Attacks

We use four different attacks for our experiments. All of them are based on
the idea of exchanging words with other words of similar meaning. The attacks
differ in the search method for defining the order of words to replace, in the
strategy of choosing the candidate set for replacement words, and in the
constraints. To better interpret the results of our analysis, we give a brief
summary of the four attacks. Particularly, we are interested in how the
attacks build the candidate sets for replacement and in what constraints
exist.

#### TextFooler

Jin et al. (2020) propose TextFooler, which builds its candidate set from the
50 nearest neighbors in a vector space of counter-fitted word embeddings. The
constraints are $cos_{cv}(w^{i},w_{pert}^{i})\geq 0.5\;\forall i$ and
$cos_{use}(s,s_{pert})\geq 0.878$222The official value is 0.841 on the angular
similarity between sentence embeddings, which corresponds to a cosine
similarity of 0.878.

#### Probability Weighted Word Saliency (PWWS)

PWWS (Ren et al., 2019) uses WordNet333https://wordnet.princeton.edu/ synonyms
to construct a candidate set. It uses no additional constraints.

#### BERT-Attack

Li et al. (2020) suggest an attack based on BERT itself. BERT-Attack uses a
BERT masked-language model (MLM) to propose 48 possible replacements. The
constraints are $cos_{use}(s,s_{pert})\geq 0.2$ and a maximum of 40% of all
words can be replaced.

#### BAE

Garg and Ramakrishnan (2020) propose another attack based on a BERT MLM. BAE
uses the top 50 candidates of the MLM and tries to enforce semantic similarity
by requiring $cos_{use}(s,s_{pert})\geq 0.936$.

An attack is successful for a given input $s$, if it finds an adversarial
example $s_{pert}$ satisfying all constraints. The attack success rate is then
defined as the number of successful attacks divided by the number of attempted
attacks.

##  4 Setup

We use the BERT-base-uncased model provided by the Hugging Face Transformers
(Wolf et al., 2019) for all our experiments and rely on TextAttack (Morris et
al., 2020b) for the implementations of the different attacks. We fine-tuned
BERT for two epochs on AG News and Yelp444We restricted ourselves to examples
in Yelp which have fewer than 80 words and then randomly sampled 1000 examples
from each test-set for running the attacks. The clean accuracies of our models
are 94.57% on AG News and 97.31% on Yelp. The attack success rates of the
different attacks are shown in Table 1.

It is interesting that BAE, which requires a much higher sentence similarity
than BERT-Attack, is a lot less effective despite being otherwise similar. But
is a high sentence similarity sufficient to ensure semantic similarity? This
is part of what we wanted to investigate using a human evaluation.

##  5 Quality of Adversarial Examples

To investigate the quality of adversarial examples, we conducted a human
evaluation on word substitutions performed by the different attacks. In the
following, we call such a word substitution a perturbation. A probabilistic
analysis is then used to generalize the results on perturbations to attacks.

###  5.1 Human Evaluation

For the human evaluation, we rely on labor crowd-sourced from Amazon
Mechanical Turk555https://www.mturk.com/. We limited our worker pool to
workers in the United States and the United Kingdom who completed over 5000
HITs with over 98% success rate. We collected 100 pairs of [original word,
attack word] for every attack and another 100 pairs for every attack where the
context is included with a window size of 11. For the word-pairs, inspired by
Morris et al. (2020a), we asked the workers to react to the following claim:
“In general, replacing the first word with the second word preserves the
meaning of the sentence.” For the words with context, we presented the two
text fragments on top of each other, highlighted the changed word, and asked
the workers: “In general, the change preserves the meaning of the text
fragment.” In both cases the workers had seven answers to choose from:
“Strongly Disagree”, “Disagree”, “Somewhat Disagree”, “Neutral”, “Somewhat
Agree”, “Agree”, “Strongly Agree”. We convert these answers to a scale from
1-7.

Dataset | Attack Success Rate (%)
---|---
TextFooler | PWWS | BERT-Attack | BAE
AG News | 84.99 | 64.95 | 79.43 | 14.27
Yelp | 90.47 | 92.23 | 93.47 | 31.50
Table 1:  Attack success rates of the different attacks on fine-tuned BERT-base-uncased models. Attack | Word Similarity | Text Similarity
---|---|---
Avg. (1-7) | Above 5 (%) | Above 6 (%) | Avg. (1-7) | Above 5 (%) | Above 6 (%)
TextFooler | 3.88 | 22 | 7 | 3.47 | 24 | 12
PWWS | 3.83 | 21 | 6 | 2.70 | 13 | 6
BERT-Attack | 2.27 | 4 | 4 | 2.55 | 7 | 3
BAE | 1.64 | 0 | 0 | 1.85 | 3 | 2
Table 2:  Average human scores on a scale from 1-7 and the percentage of
scores above 5 and 6 (corresponding to the answers “Somewhat Agree” and
“Agree”) for the different attacks and when the words were shown with (text
similarity) or without (word similarity) context.

Table 2 shows the results of this human analysis. Contrary to what is
suggested in papers proposing the attacks, our results show that humans
generally tend to disagree that the newly introduced word preserves the
meaning. This holds for all attacks and regardless of whether we show the word
with or without context. We believe this difference is mainly due to how the
text is shown to the judges and what question is posed. For example, asking
“Are these two text documents similar?” on two long text documents that only
differ by a few words is likely to get a higher agreement because the workers
will not bother going into the details. Therefore, we believe it is critical
to show the passages that are changed.

Regarding the different attacks, it becomes clear from this evaluation that
building a candidate set from the first 48 or 50 candidates proposed by a MLM
does not work without an additional constraint on the word similarity. The
idea of BERT-based attacks is to only propose words that make sense in the
context, however, fitting into the context and preserving semantics is not the
same thing. The results on BAE further make it clear that a high sentence
similarity according to the USE score is no guarantee for semantic similarity.
PWWS and TextFooler receive similar scores for word similarity, but the drop
in score for PWWS when going from word similarity to text similarity indicates
that while the synonyms retrieved from WordNet are often somewhat related to
the original word, the relation is often the wrong one for the given context.
TextFooler receives the highest scores in this analysis, but even for
TextFooler, just 22% and 24% of the perturbations were rated above 5, which
corresponds to “Somewhat Agree”.

###  5.2 Probabilistic Estimation of Valid Attacks

The human evaluation is based on individual perturbations. An attack usually
changes multiple words and therefore consists of multiple perturbations. This
begs the question: How many of the successful attacks are actually valid
attacks? To answer this question, we need to define valid attacks and valid
perturbations.

Figure 1: Probability that an attack is valid according to our probabilistic
analysis, for the different attacks and for different thresholds $T_{h}$.

(a)

(b)

Figure 2: The probability that a perturbation is considered valid by a human,
as a function of cosine similarity of words (left) and USE score (right).
$T_{h}$ is set to 5, i.e. an average score of 5 is required to be considered
valid.

######  Definition 5.1 (Valid Perturbation).

A valid perturbation is a perturbation that receives a human score above some
threshold $T_{h}$.

######  Definition 5.2 (Valid Attack).

A valid attack is an attack consisting of valid perturbations only.

Sensible values for $T_{h}$ are in the range 5-6, which corresponds to
“Somewhat Agree” to “Agree”. In order to get an estimate for the percentage of
valid attacks, we perform a simple probabilistic analysis. Let $A_{val}$,
$P_{val}$ and $A_{val}^{i}$ denote the events of a valid attack, a valid
perturbation and a valid attack consisting of exactly $i$ perturbations.
Further, let $p(i)$ denote the probability that an attack perturbs $i$ words.
Using that notation, we can approximate the probability that a successful
attack is valid as

$\begin{split}p(A_{val})&=\sum_{i=1}^{N}p(i)p(A_{val}^{i})\\\
&\approx\sum_{i=1}^{N}p(i)p(P_{val})^{i},\end{split}$ (1)

where $N$ is the maximal number of allowed perturbations. With the data from
Amazon Mechanical Turk and the collected adversarial examples, we can get an
unbiased estimate for this probability as

$\hat{p}(A_{val})=\sum_{i=1}^{N}\hat{p}(i)\left(\frac{\text{count[$S_{h}\geq
T_{h}$]}}{n_{pert}}\right)^{i},$ (2)

where $S_{h}$ is the average score of the workers for a perturbation,
$n_{pert}$ is the total number of perturbations analyzed by the workers for
any given attack, and $\hat{p}(i)$ can be estimated using counts. The results
of this analysis are shown in Figure 1 as a function of the threshold $T_{h}$.
It can be seen that if we require an average score of 5 for all perturbations,
we can expect around 4% of the successful attacks from TextFooler to be valid,
slightly less for PWWS, below 2% for BERT-Attack, and just around 1% for BAE.
In other words, between 96% and 99% of the successful attacks can not be
considered valid according to the widely accepted requirement that adversarial
examples should preserve semantics.

This analysis assumes that perturbations are independent of each other, which
is not true because every perturbation impacts the following perturbations.
Nevertheless, we argue that this approximation tends to result in optimistic
estimates on the true number of valid attacks for the following reasons: 1)
When an attack is already almost successful, all attacks except for PWWS try
to maximize sentence similarity on the last perturbation, making the last
perturbation generally weaker. 2) We strongly assume that in a sentence with
multiple changes, a human is generally less likely to say that the meaning is
preserved, even if the individual perturbations are considered valid.

###  5.3 Metrics vs. Human

Figure 2 shows the probability that a perturbation is considered valid (for
$T_{h}=5$) as a function of cosine similarity of words and as a function of
USE score. The plots are based on the 400 words with context from the
different attacks which were judged by humans. We use left-aligned buckets of
size 0.05, i.e., the probability of a valid perturbation for a given cosine
similarity $x$ and metric
$m\in\\{cos_{cv}(\cdot,\cdot),cos_{use}(\cdot,\cdot)\\}$, is estimated as

$\frac{\text{count[$\left(S_{h}\geq
T_{h}\right)\land\left(m\in[x,x+0.05)\right)$]}}{\text{count[$m\in[x,x+0.05)$]}}.$
(3)

It can be observed that there is a strong positive correlation between both
metrics and the probability that a perturbation is considered valid,
confirming both the validity of such metrics and the quality of our human
evaluation. However, the exact probabilities have to be interpreted with care,
as the analysis based on one variable does not consider the conditional
dependence between the two metrics.

##  6 Adversarial Defense

We have shown that current attacks use lenient constraints and, therefore,
mostly produce adversarial examples that should not be considered valid, but
finding suitable thresholds on the constraints is difficult. Morris et al.
(2020a) try to find these thresholds by choosing the value where humans
“Agree” (on a slightly different scale) on average and find thresholds of 0.90
on the word similarity and 0.98 on the sentence similarity score. However,
this misses all the perturbations which were considered valid by the workers
at lower scores (see Figure 2). Before discussing other thresholds, we show
that we can avoid many adversarial examples even for low thresholds.

Our procedure consists of two steps, where the first step prepares for the
second. The first step is a data augmentation procedure and looks as follows:

#### Step 1

  1. a)

Initialize thresholds $t_{rr}\in\left(0,100\right]$ for the maximal percentage
of words to augment, and $t_{cv}\in\left(0,1\right)$ for a threshold on cosine
similarity of words.

  2. b)

During training of the model, for every batch, calculate the gradients to get
the $t_{rr}$ percent of most important words for every input. The union of the
words considered as stop-words by the four attacks is filtered out.

  3. c)

Then, for every word marked as important according to b), a candidate set
$\mathcal{C}$ is built out of all words in a counter-fitted embedding with
cosine similarity greater than $t_{cv}$.

  4. d)

To account for the fact that all attacks tend to favor words with low cosine
similarity (see Appendix D), the replacement $v_{i}\in\mathcal{C}$ for the
original word $w$ is chosen with probability:

$p(v_{i})=\frac{1-\textit{cos}_{cv}(w,v_{i})}{\sum_{v_{j}\in\mathcal{C}}1-\textit{cos}_{cv}(w,v_{j})}.$
(4)

This skews the probability towards words with lower cosine similarity.

  5. e)

Finally, the perturbed batch with the changed words is concatenated to the
original batch

Dataset | Method |  Clean Acc. (%) | Attack Success Rate (%)
---|---|---|---
TextFooler | PWWScv50 | BERT-Attackcv50 | BAEcv50
AG News | Normal | 94.57 | 84.99 | 16.38 | 20.72 | 0.32
DA | 94.82 | 52.37 | 10.73 | 18.61 | –
DA+PP | 93.84 $\pm$ 0.07 |  3.93 $\pm$ 0.41 |  2.55 $\pm$ 0.31 |  3.73 $\pm$ 0.29 | –
DA+MA5 | 93.72 $\pm$ 0.12 | 14.11 $\pm$ 0.48 | 4.61 $\pm$ 0.41 | 7.52 $\pm$ 0.48 | –
Normal+PP | 87.89 $\pm$ 0.16 | 10.32 $\pm$ 0.48 | 5.0 $\pm$ 0.31 | 5.59 $\pm$ 0.36 | –
Yelp | Normal | 97.31 | 90.47 | 33.26 | 49.53 | 0.41
DA | 97.10 | 29.79 | 10.52 | 16.49 | –
DA+PP | 96.59 $\pm$ 0.06 |  4.37 $\pm$ 0.39 |  2.54 $\pm$ 0.15 |  4.86 $\pm$ 0.33 | –
DA+MA5 | 95.40 $\pm$ 0.10 | 10.23 $\pm$ 0.59 | 4.62 $\pm$ 0.36 | 7.38 $\pm$ 0.38 | –
Normal+PP | 94.50 $\pm$ 0.08 | 6.07 $\pm$ 0.47 | 5.22 $\pm$ 0.48 | 7.35 $\pm$ 0.61 | –
Table 3:  Effectiveness of defense procedure for different attacks modified
with constraint on cosine-similarity of words.

The data augmentation procedure makes the model more robust against attack
words with cosine similarity greater $t_{cv}$. If we expect BERT to be robust
against these kinds of replacements, this is the least we should do.
Otherwise, we cannot expect the model to generalize to the attack’s input
space, which is significantly larger than the input space during fine-tuning.

We can further improve the robustness with a post-processing step that builds
on this robustness to random substitutions.

#### Step 2

  1. a)

For every text that should be classified, $N$ versions are created where
$t_{rr}\%$ of the words (which are not stop-words) are selected uniformly at
random and are exchanged by another uniformly sampled word from a candidate
set $\mathcal{C}$ consisting of all words with cosine-similarity above
$t_{cv}$.

  2. b)

The outputs of the model (logits) are added up for the $N$ versions and the
final prediction is made according to the maximum value. Formally, let
$l_{j}(s)$ denote the value of the $j$-th logit for some input $s$. Then the
prediction $y_{pred}$ is made according to

$y_{pred}=\operatorname*{arg\,max}_{j}\sum_{i=1}^{N}l_{j}(s_{i}).$ (5)

This procedure can be applied for any threshold $t_{cv}\in(0,1)$, but it only
makes sense if we expect an attack to use the same or a higher threshold. We
always set $t_{cv}$ to the same value as the attack uses. Further, we set
$t_{rr}=40$ and $N=8$ in all our experiments, and we use the same thresholds
for both steps.

##  7 Defense Results

In Table 3, we show the effect of the procedure on the different attacks
modified with the constraint that the cosine-similarity between original word
and attack word should be above 0.5. The notation is the following: Normal
stands for a model fine-tuned normally. DA stands for a model fine-tuned with
data augmentation, and PP stands for post-processing. MA5 is a baseline for
our post-processing procedure that replaces 5% of all tokens with the [MASK]
token (see Appendix B). The results show that up to two-thirds of the attacks
can be prevented using data augmentation. This indicates that adversarial
examples for text classification are closely related to the data on which the
model is fine-tuned. The attacks try to create examples that are out-of-
distribution with respect to the training data. Additionally, between 70% and
92% of the attacks can be reverted using our post-processing procedure,
resulting in attack success rates below 5% for all attacks. For TextFooler,
this corresponds to a decrease in attack success rate of more than 95%.
Because the post-processing step is probabilistic, we ran it ten times for
every combination of dataset and attack. We show the mean and standard
deviation of the ten resulting attack success rates. Compared to the mask-
baseline, our post-processing procedure can revert significantly more attacks
while having a smaller impact on the clean accuracy. Table 3 also shows that
the post-processing step should always be preceded by data augmentation. While
applying post-processing in isolation still reverts many attacks, the clean
accuracy drops significantly, especially on AG News.

Dataset | Method | Attack Success Rate (%)
---|---|---
TFcv50 | TF${}_{cv50}^{use88}$ | TF${}_{cv70}^{use85}$ | TF${}_{cv70}^{use90}$ | TF${}_{cv80}^{use90}$
AG News | Normal | 88.79 | 24.95 | 22.52 | 11.63 | 7.51
DA | 55.58 | 16.11 | 10.79 | 7.12 | 4.50
DA+PP | 4.49 $\pm$ 0.39 | 3.31 $\pm$ 0.28 | 2.07 $\pm$ 0.16 | 1.91 $\pm$ 0.17 | 0.99 $\pm$ 0.17
Yelp | Normal | 91.40 | 49.22 | 42.59 | 25.18 | 11.09
DA | 38.46 | 13.74 | 10.34 | 7.78 | 2.87
DA+PP | 5.04 $\pm$ 0.35 | 3.9 $\pm$ 0.34 | 2.12 $\pm$ 0.21 | 2.28 $\pm$ 0.17 | 0.71 $\pm$ 0.13
Table 4:  Effectiveness of defense procedure for different combinations of
thresholds.

###  7.1 Adjusted Thresholds

Table 3 shows that with the constraint on cosine similarity of words added,
TextFooler is by far the most effective attack, at least before post-
processing. There is a simple reason for this, TextFooler already has that
constraint and is the only attack out of the four to choose its candidate set
directly from the counter-fitted embedding used to calculate the cosine
similarity. On the other end of the spectrum, BAE’s attacks success rate drops
close to zero. This is because the intersection of the set of words proposed
by the MLM, the set of words with cosine similarity greater than 0.5, and the
set of words keeping the USE score above 0.936 is small and leaves the attack
not much room. A similar observation can be made for PWWS, although not as
pronounced.

However, there is one more reason why TextFooler is more effective compared to
the other attacks, despite an additional constraint on the USE score. While
attacking a piece of text, this constraint on the USE score is not checked
between the current perturbed text $s_{pert}$ and the original text $s$, but
instead between the current perturbed text $s_{pert}$ and the previous version
$s_{pert}^{\prime}$. This means that by perturbing one word at a time, the
effective USE score between $s$ and $s_{pert}$ can be a lot lower than the
threshold suggests. When discussing the effect of raising thresholds to higher
levels, we do so by relying on TextFooler as the underlying attack because it
is the most effective, but we adjust the constraint on the USE score to always
compare to the original text. We believe this is the right way to implement
this constraint, and more importantly, it is consistent with how we gathered
data from Amazon Mechanical Turk.

Table 4 shows the results from our defense procedure when the thresholds on
TextFooler are adjusted. TFcv50 corresponds to TextFooler without the
constraint on the USE score. Comparing with Table 3 confirms that the original
implementation of the USE constraint only had a small impact.
TF${}_{cv50}^{use88}$ corresponds to TextFooler with
$cos_{cv}(w^{i},w_{pert}^{i})\geq 0.5\;\forall i$ and
$cos_{use}(s,s_{pert})\geq 0.88\;(0.878\text{ to be precise})$, the same
thresholds as in the original implementation, but without allowing to drift
away from the original text as discussed above. This already decreases the
attack success rate significantly. Using data augmentation, we can decrease
the attack success rate by more than a factor of 5 compared to what we saw
originally (84.99 to 16.11 and 90.47 to 13.74). This shows that by preventing
TextFooler from using that little trick and some data augmentation, we can
decrease the attack success rate to values far from the ones suggested in
their paper. When increasing the thresholds on the constraints (compare to
Figure 2 to see that these are still not particularly strong constraints), it
becomes even more evident that BERT is a lot more robust than work on attacks
suggests. Especially if we allow for post-processing.

Dataset | Method |  Clean Acc. (%) |  Training Time (h:min) | Epochs | Attack Success Rate (%)
---|---|---|---|---|---
TextFooler | PWWScv50 | BERT-Attackcv50
AG News | Normal | 94.57 | 0:19 | 2 | 84.99 | 16.38 | 20.72
DA | 94.82 | 5:33 | 12 | 52.37 | 10.73 | 18.61
ADV | 92.83 | 160:15 | 12 | 34.54 | 6.50 | 9.38
ADVnaive | 94.26 | 45:14 | 2 | 56.20 | 12.50 | 17.44
Yelp | Normal | 97.31 | 0:32 | 2 | 90.47 | 33.26 | 49.53
DA | 97.10 | 9:08 | 12 | 29.79 | 10.52 | 16.49
ADV | 95.94 | 107:56 | 5 | 59.52 | 14.64 | 25.52
ADVnaive | 96.65 | 56:53 | 2 | 95.12 | 33.09 | 47.61
Table 5:  Comparison of data augmentation and adversarial training.

###  7.2 Comparing data augmentation with adversarial training

While adversarial training provides the model with data from the true
distribution generated by an attack, our data augmentation procedure only
approximates that distribution. The goal is to trade robustness for speed.
However, it turns out that our procedure can even be superior to true
adversarial training in some cases. We compare to two different strategies for
adversarial training. ADVnaive denotes the simplest procedure for adversarial
training in text classification: collect adversarial examples on the training
set and then train a new model on the extended dataset consisting of both
adversarial examples and original training data. We used TextFooler to collect
these adversarial examples. On the complete training set, this resulted in
103’026 adversarial examples on AG News and 179’335 adversarial examples on
Yelp. For a more sophisticated version for adversarial training, we follow
Meng et al. (2021) by creating adversarial examples on-the-fly during
training. We denote this method as ADV (corresponds to ADV in their paper).

A comparison of the results on AG News and Yelp is shown in Table 5.
Interestingly, ADVnaive did not result in an improvement on Yelp. We
hypothesize that this is because Yelp is easier to attack, resulting in weaker
training data for the extended dataset. For example, 26% of the created
adversarial examples on Yelp differ by only one or two words from the original
text, on AG News this holds for just 11% of the adversarial examples.
Furthermore, the average word replace rate on Yelp is 16% compared to 24% on
AG News. The same argument would also explain why, quite surprisingly, we
reach higher robustness on Yelp with our data augmentation procedure compared
to ADV. To be fair, it must be said that we did not train ADV until
convergence on Yelp due to computational constraints. Overall, lower
computation time is precisely the biggest advantage of our method. Considering
that the training data increases by a factor of two, the overhead per epoch is
only around 50% compared to normal training.

##  8 Limitations

In practice, the post-processing step cannot be decoupled from a black-box
attack. It would be interesting to see how successful an attack is when the
whole system, including post-processing, is regarded as a single black-box
model. We hypothesize that it would remain challenging because the attacker
can rely much less on its search method for finding the right words to
replace.

The method is also not applicable if a deterministic answer is required.
However, in many applications such as spam filters or fake news detection, we
are only interested in making a correct decision as often as possible while
being robust to a potential attack.

##  9 Discussion & Conclusion

Using a human evaluation, we have shown that most perturbations introduced
through adversarial attacks do not preserve semantics. This is contrary to
what is generally claimed in papers introducing these attacks. We believe the
main reason for this discrepancy is that researchers working on attacks have
not paid enough attention to preserving semantics because attacks with new
state-of-the-art success rates are easier to publish. However, in order to
find meaningful adversarial examples that could help us better understand
current models, we need to get away from that line of thinking. For example,
10-20% attack success rate with valid adversarial examples and a good analysis
on them is much more valuable than 80-90% attack success rate by introducing
nonsensical words. We hope this work encourages researchers to think more
carefully about appropriate perturbations to text which do not change
semantics.

Our results on data augmentation show that a significant amount of adversarial
examples can be prevented when including perturbations during training that
could stem from an attack. It is debatable whether changing 40% of the words
with a randomly chosen word from a candidate set still constitutes a valid
input, but this is only necessary because the attacks have that amount of
freedom. The more appropriate the allowed perturbations for an attack, the
more appropriate is our data augmentation procedure, which can easily be
adapted for other candidate sets. Compared to adversarial training, our method
scales to large datasets and multiple epochs of training, making it an
excellent baseline defense method for researchers working on new attacks and
defenses. The post-processing step completes our defense procedure and shows
that attacks can largely be prevented in a probabilistic setting without a
severe impact on the clean accuracy. In practice, this means that most attacks
can at least be detected. Whether or not this two-step procedure will prevent
the same amount of attacks when the whole model is considered a probabilistic
black-box is up for future investigation.

## References

  * Alzantot et al. (2018) Moustafa Alzantot, Yash Sharma, Ahmed Elgohary, Bo-Jhang Ho, Mani Srivastava, and Kai-Wei Chang. 2018.  Generating natural language adversarial examples.  In _EMNLP_.
  * Carlini and Wagner (2018) Nicholas Carlini and David Wagner. 2018.  Audio adversarial examples: Targeted attacks on speech-to-text.  In _IEEE Security and Privacy Workshops (SPW)_.
  * Cer et al. (2018) Daniel Cer, Yinfei Yang, Sheng-yi Kong, Nan Hua, Nicole Limtiaco, Rhomni St. John, Noah Constant, Mario Guajardo-Cespedes, Steve Yuan, Chris Tar, Brian Strope, and Ray Kurzweil. 2018.  Universal sentence encoder for english.  In _EMNLP_.
  * Devlin et al. (2019) Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019.  Bert: Pre-training of deep bidirectional transformers for language understanding.  In _NAACL-HLT_.
  * Garg and Ramakrishnan (2020) Siddhant Garg and Goutham Ramakrishnan. 2020.  Bae: Bert-based adversarial examples for text classification.  In _EMNLP_.
  * Goodfellow et al. (2015) Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. 2015.  Explaining and harnessing adversarial examples.  In _ICLR_.
  * Hastings (1970) W Keith Hastings. 1970.  Monte carlo sampling methods using markov chains and their applications.
  * Huang et al. (2019) Po-Sen Huang, Robert Stanforth, Johannes Welbl, Chris Dyer, Dani Yogatama, Sven Gowal, Krishnamurthy Dvijotham, and Pushmeet Kohli. 2019.  Achieving verified robustness to symbol substitutions via interval bound propagation.  In _EMNLP-IJCNLP_.
  * Jia et al. (2019) Robin Jia, Aditi Raghunathan, Kerem Göksel, and Percy Liang. 2019.  Certified robustness to adversarial word substitutions.  In _EMNLP-IJCNLP_.
  * Jin et al. (2020) Di Jin, Zhijing Jin, Joey Tianyi Zhou, and Peter Szolovits. 2020.  Is bert really robust? a strong baseline for natural language attack on text classification and entailment.  In _AAAI_.
  * Li et al. (2020) Linyang Li, Ruotian Ma, Qipeng Guo, Xiangyang Xue, and Xipeng Qiu. 2020.  Bert-attack: Adversarial attack against bert using bert.  In _EMNLP_.
  * Meng et al. (2021) Zhao Meng, Yihan Dong, Mrinmaya Sachan, and Roger Wattenhofer. 2021.  Self-supervised contrastive learning with adversarial perturbations for robust pretrained language models.  _arXiv preprint arXiv:2107.07610_.
  * Meng and Wattenhofer (2020) Zhao Meng and Roger Wattenhofer. 2020.  A geometry-inspired attack for generating natural language adversarial examples.  In _COLING_.
  * Metropolis et al. (1953) Nicholas Metropolis, Arianna W Rosenbluth, Marshall N Rosenbluth, Augusta H Teller, and Edward Teller. 1953.  Equation of state calculations by fast computing machines.  _The journal of chemical physics_ , 21(6):1087–1092.
  * Morris et al. (2020a) John Morris, Eli Lifland, Jack Lanchantin, Yangfeng Ji, and Yanjun Qi. 2020a.  Reevaluating adversarial examples in natural language.  In _EMNLP Findings_.
  * Morris et al. (2020b) John Morris, Eli Lifland, Jin Yong Yoo, Jake Grigsby, Di Jin, and Yanjun Qi. 2020b.  Textattack: A framework for adversarial attacks, data augmentation, and adversarial training in nlp.  In _EMNLP System Demonstrations_.
  * Mrkšić et al. (2016) Nikola Mrkšić, Diarmuid Ó Séaghdha, Blaise Thomson, Milica Gasic, Lina M Rojas Barahona, Pei-Hao Su, David Vandyke, Tsung-Hsien Wen, and Steve Young. 2016.  Counter-fitting word vectors to linguistic constraints.  In _NAACL-HLT_.
  * Papernot et al. (2016) Nicolas Papernot, Patrick McDaniel, Ananthram Swami, and Richard Harang. 2016.  Crafting adversarial input sequences for recurrent neural networks.  In _MILCOM IEEE Military Communications Conference_.
  * Ren et al. (2019) Shuhuai Ren, Yihe Deng, Kun He, and Wanxiang Che. 2019.  Generating natural language adversarial examples through probability weighted word saliency.  In _ACL_.
  * Szegedy et al. (2014) Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus. 2014.  Intriguing properties of neural networks.  In _ICLR_.
  * Wang et al. (2021a) Xiaosen Wang, Yichen Yang, Yihe Deng, and Kun He. 2021a.  Adversarial training with fast gradient projection method against synonym substitution based text attacks.  In _UAI_.
  * Wang et al. (2021b) Xiaosen Wang, Yichen Yang, Yihe Deng, and Kun He. 2021b.  Adversarial training with fast gradient projection method against synonym substitution based text attacks.  In _AAAI_.
  * Wolf et al. (2019) Thomas Wolf, Lysandre Debut, Victor Sanh, Julien Chaumond, Clement Delangue, Anthony Moi, Pierric Cistac, Tim Rault, Rémi Louf, Morgan Funtowicz, et al. 2019.  Huggingface’s transformers: State-of-the-art natural language processing.  _arXiv preprint arXiv:1910.03771_.
  * Zhang et al. (2019) Huangzhao Zhang, Hao Zhou, Ning Miao, and Lei Li. 2019.  Generating fluent adversarial examples for natural languages.  In _ACL_.
  * Zhang et al. (2015) Xiang Zhang, Junbo Zhao, and Yann LeCun. 2015.  Character-level convolutional networks for text classification.  _NeurIPS_.

##  Appendix A Number of versions in post-processing

In order to understand the impact of the number of versions $N$ created during
the post-processing step, we can make the following analysis: Let us consider
the augmented inputs as instances of a discrete random variable $X$. For $x\in
X$ and a classification problem with $K$ classes, let $l_{correct}(x)$ denote
the value of the logit corresponding to the correct label and $l_{j}(x)$
denote the value of the $j$-th logit corresponding to a wrong label, such that
$j\in\\{1,...,K-1\\}$. We are only interested in the differences
$g_{j}(x)=l_{correct}(x)-l_{j}(x)$. Ideally, we would like to make a decision
based on the expectations of $g_{j}(X)$. An attack should be reverted if and
only if

$\mathrm{E}[g_{j}(X)]=\sum_{x\in X}g_{j}(x)p_{X}(x)\geq 0\quad\forall j,$ (6)

where $p_{X}(x)=\frac{1}{|X|}$. Because we cannot enumerate over all instances
$x$, we approximate this with sums over just $N$ instances

$\sum_{i=1}^{N}\frac{g_{j}(x_{i})}{N}\geq 0\quad\forall j.$ (7)

Dataset | N | Reverted Attacks (Mean/Std) (%)
---|---|---
TextFooler | PWWScv50 | BERT-Attcv50
AG News | 4 | 92.13 / 0.65 | 75.39 / 3.35 | 78.7 / 1.94
8 | 92.49 / 0.79 | 76.27 / 2.87 | 79.94 / 1.54
16 | 92.81 / 0.53 | 78.24 / 1.95 | 80.17 / 0.85
32 | 92.97 / 0.24 | 76.57 / 1.61 | 81.07 / 0.88
Yelp | 4 | 83.94 / 1.49 | 74.31 / 3.28 | 68.56 / 3.02
8 | 85.33 / 1.32 | 75.88 / 1.4 | 70.5 / 1.97
16 | 85.81 / 1.26 | 76.37 / 1.88 | 70.81 / 1.12
32 | 86.26 / 0.74 | 76.96 / 0.79 | 71.31 / 2.16
Table 6:  Effectiveness of post-processing for different number of versions.

These are unbiased estimates of the expectations in (6) for any choice of $N$.
By multiplying with $N$ and plugging in the definition of $g_{j}(x)$, it can
be verified that a decision based on (7) reverts the same attacks as a
decision based on (5). The expectation estimates become more and more accurate
as we increase $N$. Since we are making a discrete decision based on whether
the expectations are $\geq$ 0, the estimate is more likely to be correct with
more samples. If we assume that the true expectation is positive in most
cases, this means we can generally expect a higher number of reverted attacks
for higher $N$. Being more precise on the estimate also means we generally
tend to make the same decision every time on the same example, therefore
reducing the variance in the reverted attack rate. Table 6 shows results on
reverted attacks for 4, 8, 16 and 32 versions and generally confirms this.
However, the results are already quite good with just four versions, so this
is a trade-off between speed and accuracy, as creating $N$ versions increases
the batch size during inference by a factor $N$.

##  Appendix B Baseline for post-processing

Instead of replacing words with other words in Step 2 of our defense
procedure, one could also think of other ways of slightly perturbing the
adversarial examples to flip the label back to the correct one. To show that
our method is superior to such simple perturbations, Table 7 shows the results
of a baseline procedure in which we replace randomly chosen words with the
[MASK] token. Indeed, averaged over TextFooler, PWWS, and BERT-Attack, up to
63% of the adversarial examples on AG News can be reverted by masking just 5%
of the words. However, further improving on that by masking more tokens fails,
and the clean accuracy drops substantially. This is contrary to our procedure,
in which we exchange 40% of the words with just a minimal decrease in
accuracy.

Dataset | Method | Clean Acc. (%) | Reverted (%)
---|---|---|---
AG News | MA5 | 93.62 | 63.24
MA10 | 92.14 | 62.76
MA20 | 87.30 | 57.34
MA30 | 76.25 | 50.01
Yelp | MA5 | 95.19 | 59.0
MA10 | 93.98 | 61.42
MA20 | 90.53 | 60.83
MA30 | 86.91 | 59.25
Table 7:  By masking random tokens instead of exchanging words, more than half
of the attacks can be reverted. However, the clean accuracy drops.

##  Appendix C Word Frequencies

We observe that attacks frequently introduce words that rarely occur during
training. Table 8 shows median word occurrences (Occ. column) of original
words and attack words in the training set for different attacks. The results
are quite striking and a further justification for using data augmentation. It
is also interesting to see that BERT-Attack acts differently in that regard.
We assume this is because BERT-Attack has the weakest constraints (no
constraint on cosine similarity of words and a weak constraint on USE). This
could allow BERT-Attack to find more effective perturbations than other
attacks that have to choose from a set of more similar words and then rely on
the ones the model does not know.

Table 8 further shows that attacks often use words with higher relative
frequency in other classes. Column GT reveals the percentage of times that the
original words and attack words have the highest relative frequency (word
occurrences in class divided by the total number of words in the same class)
in the ground truth class. It can be observed that attacks often introduce
words with higher relative frequency in a different class. This is an
interesting observation as no one would be surprised by the success of such
perturbations if we were dealing with a bag-of-words model.

##  Appendix D Cosine Similarities of Words

In a counter-fitted embedding, perfect synonyms are supposed to have a cosine
similarity of 1 and perfect antonyms are supposed to have a cosine similarity
of 0. Figure 3 shows the distribution of cosine similarities for the four
attacks on both datasets.

Figure 3:  Distribution of cosine similarities of words. Dataset | Attack | Orig. Word | Att. Word
---|---|---|---
Occ. | GT (%) | Occ. | GT (%)
AG News | TextFooler | 736 | 67.31 | 18 | 24.63
PWWS | 889 | 60.04 | 24 | 16.06
BERT-Att. | 585 | 65.92 | 344 | 22.91
BAE | 617 | 52.66 | 4 | 9.31
Yelp | TextFooler | 4240 | 72.79 | 19 | 44.60
PWWS | 5715 | 74.56 | 13 | 33.76
BERT-Att. | 4521 | 75.27 | 3398 | 35.55
BAE | 4601 | 76.03 | 44 | 41.87
Table 8:  Median word occurrences of original words and attack words in
training set (Occ.) and percentage of times that words have the highest
relative frequency in ground truth class (GT).

##  Appendix E Details on Human Evaluation

We relied on workers with at least 5000 HITs and over 98% success rate. For
the word-pairs, we showed the workers 100 pairs of words in a google form. In
order to ensure a good quality of work, we included some hand-designed test
cases at several places and rejected workers with strange answers on these
word-pairs. These test cases were [good, bad], [help, hindrance] (expected
answer “Strongly Disagree” or “Disagree”) and [sofa, couch], [seldom, rarely]
(expected answer “Strongly Agree” or “Agree”). In a first test run,
surprisingly, many workers agreed on antonyms like good and bad, which is why
we added a note with an example and emphasized that this is about whether the
meaning is preserved and not about whether both words fit into the same
context. Workers were paid 2.0$ for one HIT with 100 pairs and 4 test cases.
We showed every pair of words to ten workers and calculated the mean. A
screenshot of the form can be found in Figure 5. For the words with context,
we used the amazon internal form because it allowed for a clearer presentation
of the two text fragments (see Figure 4). We always presented five pairs of
text fragments in one HIT and rejected workers that submitted the hit within
less than 60s to ensure quality. Workers were paid 0.5$ for one HIT with five
pairs. We showed every pair of text fragments to five workers and calculated
the mean.

Figure 4: Screenshot of the human evaluation used to evaluate words with
context. Figure 5: Screenshot of the Google form used to evaluate similarity
of words.

##  Appendix F Datasets

For our experiments, we use two different text classification datasets: AG
News and Yelp. On Yelp, we only used the examples consisting of 80 words or
less. Especially comparing to ADV would have been much harder otherwise.
Statistics of the two datasets are displayed in Table 9.

Dataset | Labels | Train | Test | Avg Len
---|---|---|---|---
AG News | 4 | 120’000 | 7’600 | 43.93
Yelp | 2 | 199’237 | 13’548 | 45.69
Table 9:  Statistics of the two datasets.

AG News (Zhang et al., 2015) is a topic classification dataset. It is
contructed out of titles and headers from news articles categorized into the
four classes World, Sports, Business, and Sci/Tech.

Yelp (Zhang et al., 2015) is a binary sentiment classification dataset. It
contains reviews from Yelp, reviews with one or two stars are considered
negative, reviews with 3 or 4 stars are considered positive.

##  Appendix G Implementation

#### Training

We use bert-base-uncased from
huggingface666https://huggingface.co/transformers/ for all our experiments.
The normal models were fine-tuned for two epochs with a learning rate of 2e-5.
We restrict the maximum input length to 128 tokens. For the training with
data-augmentation, we train for 12 epochs with a starting learning rate of
2e-5 and linear schedule. We evaluate the robustness on an additional held-out
dataset after every epoch. For a threshold of 0.5 on the cosine similarity of
words, the robustness reaches its peak after the last epoch. However, we find
that two or three epochs are already enough for larger thresholds on cosine
similarity of words. All our experiments are conducted on a single RTX 3090.

#### Attacks

We use TextAttack777https://textattack.readthedocs.io/en/latest/ for the
implementations of all attacks, including the ones with adjusted thresholds.
For adversarial training, we adapt the code from Meng and Wattenhofer (2020).