So I was discussing the proof, actually, of the results I presented yesterday and two days ago. And well, of course, I won't, as I already said, present complete proofs. But I tried to give you an idea. So let me just remind you, so we're discussing that the one particle model was this piece's model. I won't rewrite the whole thing down, but I think this way. This is a direct sum of minus laplacian is directly boundary conditions on some intervals delta k. And the intervals, essentially, you take the interval minus l over 2, l over 2, and you partition it using the support of some Poisson measure, random Poisson measure of the points of this Poisson measure that fall within this interval. So these are the delta k's. And what I was arguing is that, well, let me just remind you of this small picture we had on the board yesterday. We can now do the following thing, so we can define. So we are interested in the following. We had this h omega n u of l, which is the h omega l tensor. So this is for large n particles that are all living inside this interval and that are interacting through some fixed repulsive potential, which has only pairs of particles interacting. So u is repulsive. It's not identically vanishing. Otherwise, there's no interaction. And the other thing, it has some decay. Well, let's make it simple. Assume support of u is compact. Take it continuous, compactly supported, just to make it simple. The result I stated is also valid if u decays fast enough, meaning that it decays at least as x to the minus 4, roughly. And so what you can do is for this model, we have the density of states. That's the integrate density of states. And what we're interested in is what happens to the ground state of this operator and the ground state energy in the thermodynamic limit, which is this, meaning in the limit when n goes to infinity. So the number of particles goes to infinity. The size of the interval goes to infinity. And the ratio of these two goes to some fixed number rho that is positive. So rho is the density of particles. It's going to be positive, but small. This is going to be a parameter that is small. And so one defines a Fermi energy by the following equation. The integrated density of states defined for the phone model. You have the Fermi energy, rho, which is defined as, in this case, unique solution to this equation. Ero is strictly positive. It is small when rho is small. And it goes to 0. As rho goes to 0, you can actually write an asymptotex. We can actually even write a closed formula for this in terms of a series. And we can define rho to be the smallest length of a piece such that the little Dirichlet laplacian on this piece has an eigenvalue below euro. This is the definition of arrow. It's the infimum of the length of an interval so that the ground state for the Dirichlet laplacian on this interval has an eigenvalue below euro. And so what we had, we had the following description for. So psi u omega nl, this is the ground state of this operator. And remember, when u equals 0, the ground state can be described in the following way. So here you put in the order that you put in a particle number. And to describe the ground state, you do the following. You just put in each or in all the intervals that have length between arrow and two arrow, you put exactly one particle, two arrow excluded. In all intervals that have length between two and row in three arrow, you put two particles. In all intervals, length three arrow, four arrow, three particles, and so on. Right? And the statement was that if I want to compute now for you different from zero under the assumption I had, what I need to do is, well, I need to change this distribution somewhat. This is actually much smaller here. So here I still put two particles, but now these are interacting particles. And here I have two constants. So this distance is of order a row. And this distance is of order a constant. I gave the precise value of these distances yesterday. They're not really important. And of course, when I mean constant, I mean in terms of row being small. This constant is constant when row goes to zero. And this one is of order row, row being small. And what did I do yesterday? What I did yesterday is I explained to you how actually what I did is, so the first statement was that I can compute, well, what I did is I constructed a state which I call psi-opt, right? I forget about omega ln and so on. But of course, it depends on all these parameters. Such that, well, if you apply the operator hu to psi-opt, psi-opt, so the quadratic form, this is exactly of the right size. So you take the energy per particle for this thing. This is exactly equal to eu of row, right? Plus, so we had a row divided by log row cube, little o. So this little o is to be understood when row goes to zero. You can check that the state I presented to you yesterday satisfies exactly this. You plug it into the thing, compare with the free ground state, compute the, what I didn't do is compute the interaction term on this state, right? But if you compute the interaction term, you get this remainder term and this thing, OK? And of course, the statement that I remember, the statement that we have is that the ground state, this, well, I shouldn't call this, I call this epsilon utilda, where in my statement, epsilon utilda is the main term in the result, right? So this is roughly the value I have for the ground state energy, OK? Now, the main result now is the following. Oops, if I can find it. Sure. Bien sûr. Comme ça? Je ne lève pas celui-là trop trop. Je suis dans l'homme de nouveau, c'est ça? OK, the main result is then the following. So, oh yeah, the one thing I need to define. I need to define, so I define the occupations. Yesterday, you did not define the psi of the state behind the density matrix. Exactly, I defined the density matrix, but if you do the, so that's correct actually, I defined the gamma opt, right? But when I did the computation, right, what? So gamma opt is given by, well, you have a certain formula for gamma opt, but to this density matrix, the way it is defined, you can happily define a psi opt, right? You just take the, so you have these orthogonal projectors, right, on vectors, and you just take the anti-symmetric tensor product of all these vectors, right? And this will give you the psi opt, OK, that's correct. I defined it by one particle density matrix. So we defined the occupations, right, which was one important thing. So this is just, so you take m. m is the total number of pieces, so meaning the total number of these intervals into which you have split minus L over 2, L over 2. Of course, this is a random number, but nevertheless, it's because I assume my Poisson process to be of intensity 1. It's typically of order L, which you can be more precise than that. And then you can define an occupation to be a vector in n to the m, right? And it's an integer-valued vector, qj is an integer, and such that the sum of the qj is equal to the total number of particles. And so this is just, I put q1 particles in piece 1, q2 in piece 2, qm in piece m, right? OK. And of course, I can define the distance, I'll call it distance 1, just the sum over the qi minus qi prime from 1 to n. I define this distance on occupation numbers, right? And the main result is the following theorem. So fix some function r from a neighborhood of 0 to the positive real numbers such that r is continuous at 0. r of 0 is 0, right? So r tends to 0 at 0. That's the only thing I want. Then there exists c positive and rho of r positive such that, such that what? Such that with probability, such that. In the thermodynamic limit, what does it mean? It means that if n and l are large enough, and n divided by l is sufficiently close to rho, right? This is what it means in the thermodynamic limit. With probability larger than 1 minus o of l to the minus infinity, which means that you can have this decay as fast as you want, any power, OK? Fix a power, fix a constant, or you get a constant such that its probability of this not happening is going to be less than l to the minus this power that you chose times the constant that is given. If psi satisfies to take any state, you take any state in the Hilbert space and assume that it satisfies the following thing. Hu omega ln, sorry, n is here, l is here, psi 1 over n is less than, well, I can do this, 1 over n h u psi upt, psi upt plus some error term. And what's the error term? The error term is exactly rho divided by log rho cubed r of rho. Well, you need to put a square. So what do you assume? You assume that you take a state that in energy is below this quantity, right? So you confine it in energy, OK? Then you get that, well, if you look at the occupation number for psi, we're going to compare the occupation number for psi and psi upt, all right? And what do they define? If you take the distance 1 of q psi and you just look at what's happening over the intervals of length l rho plus c and the q for psi upt over the same pieces, this is bounded from above by c times n times rho times the max of 1 over l rho. And we have r rho. And distance 1 over the other intervals for the same, for the occupation numbers over the other intervals is less than, it's a little bit worse, actually. It's less than c times n times square root of rho, max of square root of rho divided by l rho. And here I have r of rho, OK? Sure? This psi has to be in one. I take psi normalized, right? The one thing I didn't say. So psi is just an anti-symmetric. It's any vector inside the domain of your operator. This to make sense, right? It has to be a linear direction, different q's. Sure, of course. But then what do you mean by q's? This means that this gives you exactly a condition on what q's are allowed. Psi could be a linear combination. Exactly. It can be a linear combination. Oh, yeah, I take pure vectors. You're right. You're right. I agree with you. I take pure vectors. That's correct. That's correct. But no, no, you're right, definitely. Such that psi, you're right, belongs to some. I don't remember how I called it. I think I called it hq of psi. Satisfying this, right? I take it that you're right, you're right. But what it means is that actually if you are inside, so what you need to do is you just need to analyze any of the hq's, right? So if you take any psi, you look at its components, right? They should all satisfy this, if it's not a pure vector. But it's better to actually use the decomposition and take psi pure, you're right. And of course, it's normalized. The one thing is normalized to one, OK? It has to be the same size otherwise. OK, so of course, if you now take, you look now at the ground states of your operator, restrict it to any set, to any occupation number, right? And you see that the only allowed occupation numbers for the ground states, for the possible ground states, will be those satisfying this. Because obviously, the ground state has to be satisfying this. This is positive, right? And it certainly is smaller than that, because that's a state, right? So you can apply this to the ground state to understand what are the possible occupation numbers inside the ground state, OK? And so you get this characterization from the occupation number. And it's actually using this characterization for the occupation number, yes? And the same question I said before. Psi-opt, each interval, psi-opt is a mixture. It will be composed of states with different occupation numbers. Yeah, meaning that these QIs will be different. But psi-opt is a pure state. Psi-opt belongs to a single cube psi-opt. If you think of the decomposition of the total Hilbert states as a direct sum of hqs, psi-opt is going to be orthogonal to hq if q is different from q psi-opt. Because it is, the way we defined it, it is an anti-symmetric tensor product. So it has a single occupation. By the way, it is defined. Of course, as you remember, because of the size of this error term, you could choose various psi-opt, right? But this is below the precision we know how to deal with with it. And so, but we can choose the psi-opt I chose yesterday. And the gamma-opt was exactly constructed in such a way that it belongs to a single space like this orthogonal to any other one, OK? So this is perfectly well-defined, OK? And now, and so you see this characterization holds for the ground state, but not only for the ground state. As soon as you know that the energy is small enough, you already have the same. So this actually tells you something, well, this has to be pretty small, OK? But it tells you something about many states, right? That just this minimization procedure tells you something about many states. Where does this come from? OK, what's the proof of this? Well, the proof of this essentially comes from the construction of psi-opt. And it goes in the following way. What you try to understand is, you remember, psi-opt was constructed in such a way that it optimizes all the particles within pieces that are of length between 0 and 5 1⁄2 of arrow, OK? This is the way we constructed. We did the optimization for all the particles that fall inside the pieces of length between 0 and 5 1⁄2 of arrow. The argument was that above 5 1⁄2 of arrow, there are too few pieces to carry many particles, meaning that if you try to put many particles in there, the cost in energy is going to be much larger than this. It's going to cost you more than that if you put many particles in there. So the idea is now just to say, OK, if I allow myself to increase the energy by a little bit, how much can I move the particles within the pieces of size between 0 and 5 1⁄2 of arrow? That's the only thing you need to do, right? And when you do this analysis, what you obtain is exactly this, meaning that you take particles inside pieces of size between arrow or arrow minus 0 and 2 arrow plus the constant that we had, right? And you move them around. And you see how many of these particles you can move around until you exceed this limit, OK? And this way, you get a bound on the number of particles that you can move around, OK? Such that the energy does not exceed this limit. So it's very simple. It's a very simple mechanism, right? Which is exactly it is the same mechanism that actually enables you to build the psi-opt, OK? And of course, the crucial thing is that you don't need to deal with all the particles, or rather not with all the pieces. You can throw off the two large pieces because there are too few of them, right? That's the basic component, OK? So I think about the proof that's the only thing I'm going to say, right? This is really the basic thing. And the one thing maybe I should add is the following. Now this was in the case when you have compact support. If the support of the interaction, I mean, is not compact, right? If you have decay, what you do is you do the following simple thing. You split your operator into two pieces. You take, first, you restrict the interaction to some large compact set, right? In such a way that, essentially, the subnorm of the interaction outside of this compact set is to be of smaller order than one of a log rho to the 3, OK? And then you do the same thing for the compactly supported interaction. Use this theorem. And the only thing you need to check then is that because you're interested now just in the ground state, you need to check that if you add the interaction, the long range interaction, it will not change this energy for psi up too much, OK? And in this way, you can handle long range of, quote, unquote, it's not long range in the usual sense of scattering theory, right? Because it's x to the minus 4 in dimension 1. But it has a long range in the sense that the range is potentially infinite, right? So non-compactly supported interactions. But of course, it is crucial, therefore, that the decay ensures that if you cut it off at large distances, you get something which is much smaller than the one of a log rho, OK? Why one of a log rho? Because the thing is, you need to understand. So you know that in psi up, you have intervals that carry particles, right? But intervals need to be of size at least one, sorry, a rho, OK? So the fact that two intervals of size a rho are close to each other is rather unlikely, right? Because two intervals close to each other means that actually they're essentially like an interval of size 2 a rho, OK? So the number of these intervals is of size rho times the total number of particles, OK? This is why you get this rho here, actually. This is where this rho is coming from, OK? And so it's only the intervals that are far away that you need to take into account, OK? And there, you need to use the decay of the interaction to be able to cope with that. And so actually, what you see is that if the interaction starts, as this is what is the remark I made yesterday, if the interaction starts decaying slower than 1 over x to the 4, then these many intervals of size a rho that are far away from each other will give you the main contribution, meaning the second term inside the expansion of this. It's not going to be anymore intervals of size 2 a rho where you have particles interacting together, but it's going to be the long distance interaction that will give you the main correction term, right? OK. Now, the other thing I want to talk about is in the beginning, or rather said, what the models I was interested in in the beginning of the lectures, and actually the models that interested in physics, well, are not these toy models, but they are true one-dimensional or true n-dimensional Schrodinger operators, right? So what do I mean? Well, actually, I should call it what it's called usually the Poisson model. So again, I take let xk of omega be a Poisson process, the support of a Poisson process of intensity 1, right? And pick v to be non-negative function, right? And I assume that v is continuous with compact support on the real line to make it simple, right? It doesn't really need to be continuous, but bounded compact support is going to be fine. And look at the following thing. H omega is going to be minus laplacian plus sum of a k v of x minus xk omega. So this is called the Poisson model, OK? That's a random operator that has been studied quite a bit. And what I'd like to do is to convince you that you can perform an analysis which is similar to this model, OK?  What you should do is take the sum, right? So here, the thing should be you should sum all these functions to get the resulting potential. You see that you have some barriers, right? There are barriers, but of course, they are not hard wall barriers, right? I mean, here, there is tunneling. A wave, typically, if you look at minus l over 2 to l over 2, well, a wave will never be compactly supported, right? Any solution to the differential equation h omega minus e on this interval, h omega minus e phi equals 0, will never be compactly supported, lest it be actually identically vanishing, OK? And so what you're interested in is the following. You're interested in, so take h omega restricted to minus l over 2, l over 2. This is going to be h omega l, right? And you coin the same n particle operator as before, but using this one, OK? You take exactly the same formula, the one that's here, but for this definition, OK? And you're interested in, well, in the thermodynamic limit compute the ground state energy, or of course, you're going to look at the ground state energy per particle l, and what can be said about the ground state, right? So still, I look at it with fermions. So I look at this operator on the anti-symmetric tensor product of l2 minus l over 2, l over 2, n times, right? Take the anti-symmetric power, the anti-symmetric power of this Hilbert space. And you're asking the same questions, but now for this model. So let me just put theorem on the board. The theorem. So this is now for the true Poisson model. The theorem goes as follows. So first, you have that omega almost surely 1 over n e omega n u l goes to some quantity, e u of rho in the limit, and the thermodynamic limit, OK? And again, you can prove an expansion, e 0 of rho. Of course, this e 0 now needs to be computed for this operator, right? It's not the same as before. Plus, well, and that's the interesting thing. Maybe there's a pointing.  And this is still meant in the limit when rho goes to 0. And except for the fact that this thing has to be defined for this model, the formula is exactly the same, right? Because the gamma star is exactly the same gamma star as we had before, OK? Oh yeah, here I need to assume I didn't do this for u non-compactly supported, right? I assume that u is, of course, positive. And let's say u is continuous with compact support over r. I take u just complex support. So it's finite range interactions. OK, what's the basic idea? So I'll state something about the eigen, the ground state itself later on. But for the moment, let me just explain what the basic idea of this thing is. Well, we are looking at rho small, right? So what we are looking at is low-lying states.  We are looking at low-lying states, OK? Well, what does it mean? So you want states that live here very low, much lower than the top of these barriers, OK? Obviously, such states can only live in places here, right? Let's say in places in intervals like that, that are sufficiently large, right? And well, you can prove this in a very simple way. We have the following lemma. Take what? Take in one dimension on 0, l. So assume just to fix ideas, the Poisson process being translation invariant. This assumption doesn't cost anything. Assume that v of 0 is positive, right? Just translating v. Don't change really the model. Using translation invariance of the Poisson process. And translation invariance of the Laplacian doesn't change anything, OK? So assume that v of 0 is positive. And on 0, l, consider minus d2 dx2 plus vx. So you put one copy at x at 0. And you could one copy at l, right? So you just consider the following thing. You have one part of the bump here, one part of the bump there, right? It takes l. Let me call this hl, forget about the v. And of course, you can look at hl with Dirichlet boundary conditions and hl with Neumann boundary conditions. And you can look at the sequence of eigenvalues, lambda k Dirichlet l and lambda k Neumann l. Of course, they satisfy that the Neumann eigenvalues are smaller than the Dirichlet eigenvalues. They are all non-negative. These are increasing sequences, OK? But you have the following. There exists some constant positives such that for l larger than this constant, sorry, little l larger than this constant, for what do I need? If you take the case such that the Dirichlet eigenvalue of l be, now I need to actually put it, we'll just put it as an exercise on my exercise sheet yesterday, so I'll copy it from there, the constant. So you need the Dirichlet eigenvalue to be sufficiently small, right? So for all k such that you have this, we have that, of course, the Dirichlet eigenvalue is larger than the Neumann eigenvalue. But actually, the Neumann eigenvalue cannot be much larger. It's going to be of what size? Of size divided by c divided by l lambda k Dirichlet, OK? So it means that the Dirichlet eigenvalue and the Neumann eigenvalues, so this eigenvalue, or the Dirichlet eigenvalue, the smallest one is going to be of order when l is large, constant divided by l squared. This thing, lambda k Dirichlet l is going to be, if you take lambda 1, the first Dirichlet eigenvalue, it's going to be in the l large limit to be pi l squared. You can essentially forget about this, what happens here. The only thing that counts is just the Dirichlet eigenvalue for the Freela fashion, because anyway, the Dirichlet eigenfunction for this thing is going to vanish near these boundaries. So it doesn't count. It's going to be equivalent to this. And of course, what you can say is that for k, when k is not too large, you have the same phenomenon when k is not too large. And what this is telling you is that for the Neumann eigenvalue, it's the same thing. So the Neumann eigenvalue is actually close to the Dirichlet eigenvalue with a remainder term that you can control in terms of the Dirichlet eigenvalue. So what does this tell you? It tells you that because, yeah, one thing I should remind you of is that if you look at h omega l, this is, of course, bounded by h omega l restricted to the delta k's. These are the pieces, but now with Neumann. And from above, oops, by h omega l restricted to the same pieces. So these are just you put. These are the delta k's with Dirichlet. But now you know that the eigenvalues of those, you have an estimation. And these, for the large pieces, are actually essentially the same. What does this tell you? First, this tells you that if you want to have an eigenvalue that is low, you need the piece to be large just by the lower bound. If a piece is not large, the lower bound tells you that this one will not have small eigenvalues on small pieces because of this approximation. And the second thing it tells you, yeah, that's the first thing. So you need, you look at what's happening on large pieces. Now, what you could try to do once you've seen this instead of analyzing directly what is happening, because we are dealing with low lying energies, instead of analyzing directly what is happening for h omega l, you could actually sandwich, like I did it here, h omega l between these two operators. Do you have Dirichlet Neumann bracketing? Exactly, do Dirichlet Neumann bracketing. But plug this bracketing inside the definition of this, which gives you a Dirichlet Neumann bracketing for this operator. You could do this. The problem is the following. You see, the difference for every particle, the difference between this operator and this operator is of size this at low lying energies. So it means that if you really look at the minimal energies, it's going to be in size 1 over l cubed, because this is size 1 over l squared. And if you do such a comparison for this operator, what you get is that the error, the difference between the ground states of these two things, is going to be n times this. But do you remember? The error I want to measure is much smaller. Because remember, actually the right l is l rho. The l rho is defined roughly, it's defined as before. The error that I want to be able to measure is n times rho divided by l rho cubed. And l rho, in this case, is also of order 1 over log rho. And you see that this actually is much too big to be able to get errors of that type. So where's the problem? Well, the problem is that in this model, when a particle is localized, it's not localized in these pieces, in the same pieces given by the Poisson points. When a particle is localized, it's localized. So that's the first order analysis, but it doesn't work for this reason. When a particle is localized, imagine that you have a large piece. So let's say you have xk and here you have xk plus 1. And this distance is larger than a rho. Well, typically, surrounding such a large piece with a good probability, you have actually many small pieces. So here you have an interval. You have many small pieces. What is this? This length, of course, or this is a random system. So all configurations are going to appear. But what you can show is that if you want a configuration to appear that has a probability, which is roughly e to the minus rho times something which is not too small, it means that this stretch will be pretty large. But what happens is that for the true eigenfunction of your system, what is happening? So you have an eigenfunction here. And what is happening in here? Well, what is happening in here is tunneling. And it's well known what this tunneling does. This tunneling gives you some exponential decay here. The function needs to decay exponentially because this is the classically forbidden region. So the way to analyze this and the way to improve this result, so now imagine that you have, so I'm going to give a lemma, imagine that you're in a situation where you have such a thing which is of size larger than L. This thing here, this distance, the total distance, is of size larger than e to the L to some beta. Beta is something which is less than 1. And what do I mean by this picture? The picture means that none of these pieces, none of these intervals is of size, let's say, less than half of L. None of these pieces are of size larger than 1 half of L, L over 2. So assume you take a potential V, which depends on omega, satisfying this. I do it in pictures. And I do the following thing. Now I put a directly boundary condition here. And I put a directly boundary in, let's say, halfway in here and halfway in there. So I put here either directly normal, and here also either directly a normal. And I do the same statement. Well, I'll just do it for, because I chose half of L, I could take L, let me do it in the following, take gamma 1, and I take L to the gamma. So gamma is less than 1, take L to the gamma. And so what you can prove is that lambda k now directly of this operator minus lambda k of Neumann for this operator is going to be less than constant e to the minus e to the L to the beta over 2. And this is going to be, as long as lambda k, you look at the Dirichlet eigenvalues, so the indices for the Dirichlet eigenvalues, such that this is, what do I need? I said that this was L to the beta. So be less than, I need to think now. So yeah, Ne is less than 1 half of L to the minus 2 gamma. I actually don't need the 1 half, take L to the minus 2 gamma. So this means that the index k here, so this, remember, is typically, it's roughly, first order is going to be like pi squared divided by L squared. It means that k can be pretty large. So you control many eigenvalues here. So what I'm asking is the following thing is that the main part here, the eigenvalues are much smaller than the eigenvalues, the lowest eigenvalue that you get here. So that you are below the effective ground state of this stretch here. I'm asking, what's the, because these intervals, right, have size at most L to the gamma. The lowest eigenvalue inside this interval is going to be using the Neumann-Bracken that we had just up there. It's going to be of all the constants tied L to the minus 2 gamma. So I could do the following thing. I take a gamma prime, and I take gamma prime to be between gamma, OK? So I'm sure that this is much larger, right? Because the smallest Neumann eigenvalue here is going to be larger than L to the minus 2 gamma by the above result, OK? So as long as the Dirichlet eigenvalue are looking at satisfies this inequality, it is going to be much below the net effect of this barrier of potentials. But you see what you gain now is that if instead of taking Dirichlet-Neumann bracketing right at the boundary here, you take it in there, the precision you are looking for is much better. Instead of being just e to the L row, it's going to be e to the, sorry, a power of L row. It's going to be exponentially small in L row, right? And it will certainly be, so if you do this computation, so take n times e to the minus e to the L row over 2, this is going to be much smaller than actually the error you want to measure, right? Because remember, L row is of size 1 over log row, OK? And so what you do to analyze to get this result, right, is you introduce a new pieces model. It's just that the pieces are cut up in this way, OK? So, and actually the way you should do it is, let me explain a little bit more, OK? So this is what I call the good pieces. So to actually analyze this, you need some probability estimates, but I won't write these down. So what happens is that as I said, we are looking at low like eigenvalues, right? And the threshold is in terms of the length of the standard pieces given by L row. So what you look at is you look at configurations where you have one big piece, L, which is of size L row, but you can assume that the size of the piece itself is not too large. You can cut it off, all the pieces, right, the initial ones, meaning the ones given by the Poisson points, that are of size 5 halves of L row, you can forget about. Why? Because you can just put Dirichlet-Nurman standard Dirichlet-Nurman bracketing boundary conditions, because there are so few such pieces that, again, they do not contain a lot of energy or a lot of particle by the same reasoning as before. That's exactly the same thing as in the true pieces model. So you look at pieces that are of this size, OK? And now two things can happen.  Another thing that can happen is that, actually, you have two such pieces where you have a small barrier or no barrier at all in between, maybe just a single bump, right? And they are surrounded, again, by two nice barriers where you can do this cut off. Of course, there can be three and four and so on. But remember, you have two pieces like this that are of length, at least L row. And here, this total distance is roughly of size e to the L row to the beta. This is what we assumed here, OK? So actually, if you take two pieces that are very large like this because of the exponential decay of the distribution of these intervals, the probability to have more than two is actually going to be, again, like e to the minus L row. So it will kill this. So it's going to be like having a very large interval. And so, of course, it will happen. But it will happen very rarely, only very rarely, right? So again, there will be only very few pieces like this. So essentially, what you need to keep is pieces like this and like that. Because these happen with probability e to the minus 2L row, which is still of the size we need to control, OK? And so you take this. So within your big chunk of potential, you keep all of those, all the others, right? Either there are just pieces that are too small to contain any energy, right, below error, below error, or there are too few of them. And you know how to handle them just by the estimates I showed you for the free Laplacian, OK? And for those, what you need to do is, well, you're interested in the ground state, so you need to look at if this one is of size between L row and 2L row, you have a single state. Single ground state, the next one is going to be too large. But it is, if it is of size larger than 2L row, you need to consider the ground state and the first state, the first excited state, right? And here, same thing, depending on the, actually here, you can cut things off at, let's say, 3 halves of L row and this 3 halves of L row, because otherwise summing the two lengths going to be 5 halves of L row, right? And so in here, you need to cut two things that can happen. It could be that the states look like this. These are the first two states in there. But it could also be that the states are looking like this, meaning that there is some tunneling and the first two excited states are this, right? Because there could be some tunneling phenomenon, depending on the length of these things. There is, these things are possible, right? So this thing, we know actually what you can do is you know that this distance here is going to be small. It's going to be smaller than e to the, by this definition, L row to the beta, right? It's going to be smaller than that, because otherwise you can do the cutoff in the middle. Just as a threshold, you chose to cut off, right? Otherwise you have twice this picture. Okay, and now, within your system, you take all these states, okay? And you use this to construct psi-opt, right? You use this to construct psi-opt. And, well, once you use this to construct psi-opt, you bracket with Dirichlet and Neumann boundary conditions, right? And what you show is that using the bracketing, the ground state for this, I'm sorry, the ground state energy for this with Dirichlet is going to be given by something of this size, right? It's actually going to be converging to something to this, right? With an error term, yeah? The Neumann also, so of course the one that's in the middle, will have the same convergence property. Just by analyzing the pieces modeled, but with these new pieces, okay? And now, things are more tricky, right? If you look at the ground state itself, not the ground state energy. For the ground state energy, just the bracketing is going to give you a result. If you look at the ground state itself, it's more complicated. Why? Well, essentially because the bound that I have up there doesn't tell you anything on the eigenfunctions, right? It's essentially an energetic bound, okay? It just tells you that the energies are ordered in a certain way. But what can happen, you see, one of the things is if you take a one particle model, you take H omega L, right? So you have N over 2. If you look at the typical, so you have these barriers, if you look at the typical eigenfunction, right, low-lying eigenfunction, it's going to, we know that you have exponential decay. Actually, for this model, this has been shown. A typical eigenfunction will be living here, right? It's going to then, because of what I said, decay exponentially here. But it could again live, well, of course, it has to take into account exponential decay. But it could again live in some barrier over there, right?  Whereas if you take the Dirichlet and Neumann bracketing, of course, you have cut it off. And it has compact support. So the whole problem is to reconstruct this kind of long distance, right, how could I say, coherence of the eigenfunction, right? There's a long distance interaction. The fact that you have tunneling over long distances. Of course, tunneling at infinite distances is suppressed. You have exponentially decay, exponential decay, right? But still, any of the estimates I know of in localization tell you that the best estimates I know of in localization theory tell you that I can expect that if I take an eigenfunction for this system, a typical eigenfunction, it's only going to be localized in a, I should say it, it's only going to be the smallest box in which I can show it is localized. Meaning the smallest box in which you can show it has the majority of its mass is going to be of size log L times some constant, right? There is a good reason for that. This is actually, it's not because the methods are failing, this is because actually there are states like this, right? But it's going to be of size constant times log L. But you see this kind of size constant times log L is, of course, L goes to infinity. Rho is fixed. It's going to be much larger than e to the minus e to the L to the rho. This is a fixed number. Where does it go? There's no localization length independent of the capital. This is not the localization length. The localization length is something where you have half-life, right? It's the half-life thing. But the thing is what you want to know is where do you really see the thing decaying? It means that you need to take a box. It has to be large, right? The box has to be large. If you want to have localization in the sense that you want to find for phi, you want to find that phi outside of some box has mass, phi outside of some box has mass that goes to 0 when L goes to infinity, OK? Let me just show you that this actually happens. There is a localization length, right? But it's not going to be uniform over the spectrum. What does it mean? It's just the following phenomenon. Take your Poisson points, right? And look at what is the largest piece. What is the largest piece? Well, the largest piece is going to be of size log L on an interval of size L, right? Which means that the lowest eigenvalue, if you look at 0, starting from 0, even though the spectrum is localized, is going to be like pi over log L squared. And the eigenfunction of this one is going to live inside. It's going to look like sine pi over log L x minus some point where the thing is starting, right? And so I'm constant here. And so this one is not going to live in anything smaller than an interval of size log L. You could think that actually this is something which is related to the bottom of the spectrum, but that's not correct. Because at any energy level, you're going to have states like this. Simply take the following. Play with a periodic potential. Place your random things periodically. And this, again, you can show that with a probability close to 1, you're going to have such a sample. And this will give you something which is that energy positive.  So many things that happen. And this is going to happen with a probability if to take this of size, again, log L, or maybe a little bit smaller, or a half of log L. Such a state is going to happen as well in such a way that you can, of course, they're not going to be exactly periodic. But nevertheless, they're going to be periodic enough, close enough to periodic, so that you have something which decays slowly here. And this can happen at any energy. And so this is why you cannot expect that you have localization lengths in physics books. It's always written you have a localization lengths, right? But this is only going to hold for certain states, right? There are always a number of states. Of course, these states are quite exceptional. There are very few of them. But still, there is no way you're going to have something which is uniform, right? And, well, this is the problem that you meet, actually, is that these states, they exist, and you have to cope, right? Of course, what is saving you here, there is a way to do it, what is saving you here is that there are only very few of these states, right? And as I said, these few states correspond to few pieces, right? And because there are a few of them, they cannot carry many particles, OK, because it would be too costly an energy. So you can actually get rid of those, OK? So I think that's the only comments I wanted to do about the true. What I wanted to convince you of is that in one dimension, even if you don't have this toy model, you can analyze things and get approximate results, right? Or results of this kind. And also a description. You can get a description of the one particle density matrix of the ground state in terms of a psiopt, which is constructed from these states, right? In the same way as we did it in the true pieces model, because actually for such configurations that you put Dirichlet or Neumann boundary conditions here, doesn't change the state very much because the state is exponentially decaying in this region. So actually Dirichlet or Neumann will be just to change, the two functions are going just to change by something which is of that size, right, at the boundary. So they're essentially the same state again. So this gives you an approximation, right, in terms of these states. And now, of course, the real challenge comes if you want to do the same thing in higher dimensions, right, because of course the true model, I mean we live in three-dimensional life, okay? So the true model will be in dimension three particles, typically three-dimensional. So what about d larger than one? Well, there's not much done, but nevertheless. So this is related to an old, actually an old story which is essentially the level zero approximation, right? There was a number of papers in the 80s and 90s by Alain Solst-Nitman, which was, I think there's a single N, which is directly related to this, okay? And what was it about? It was the following thing. You take Poissonian traps, look at Brownian motion in Poissonian traps. And Stintman devised a method to analyze what's happening to Brownian motion in Stintman trap, in Poissonian traps, what does it mean? Essentially in terms of PDs, what he did is understand if you look at the heat equation, okay, so you look at the heat equation, you start from the constant one at time t equals zero, sorry, not one, zero, usually, and you want to understand how does u of t behave when t goes to infinity, right? Large time, you want to understand what is the large time behavior of this for the heat equation, okay? But you can directly relate the large time behavior for u of t to the spectrum or the spectral data of what, of minus Laplacian plus v omega restricted to some large box, right? Which, for example, directly boundary conditions, okay? And the v omega, yeah, I didn't write it, but the v omega he had in mind was v omega is integral of v of x minus y dm y omega, where this is a Poisson measure, Poisson measure, okay? So Stintman devised a very ingenious method called enlargement of obstacles to analyze this. Okay, so what's the idea? Well, that's, so what you have is you have your large cube of size L and you have your Poisson points, okay? And at the Poisson points, I draw it by its support, so you have a random potential attached, or you have a potential attached, these are random, the points are random, but the potential is not random, the potential that is attached is your fixed potential, okay, one of the cases you consider is when the potential is just a hard sphere, right?  And well, you see, if you look at this picture, there is no obvious way to define pieces, right? I mean, if you think of a classical model, your particle can go to infinity, can leak in many ways, right? So this is why it's called enlargement of obstacles, right? One of the ways to interpret Snitman's method, right? So this is not what Snitman did, but you can do it using this idea, so that's something, is the following. So take your cube and you split it into smaller cubes of size L0, that's not the way Snitman did it, but you can do it in this way. L0 is a length that you're going to choose, okay? And now what you control is the following thing. Now I need some different set of notes, actually. At first I didn't intend to speak of that, but okay. Now that you're not far. Yeah, the first thing that you can do is imagine that you take a cube of size L0 and assume that there is one potential inside this cube, right? And you look at minus laplacian plus this potential anywhere inside the cube, okay? You've got minus laplacian plus this potential inside V with Neumann boundary conditions. Neumann boundary conditions, right? Restricted to C L0. Then you can show that actually you can show that actually the ground state of this is going, no, I don't remember, so there is of course a constant, so a constant I forget, but now I need just to remember what's the order of magnitude. If I say, no, no, no, no, no, no, it's not as good as that, that's not correct, actually. That this is not the right order of magnitude, right? This is not the right order of magnitude. No, no, no, it's Neumann, yeah, sure, it's Neumann. If it's Dirichlet, you'll have one over L0, squared, no problem, but this is Neumann. You want to understand what's the effect of the potential, right? And no, I just need to do computation because I don't remember the result. So this is, yeah, C L0 to the minus D, right? Why is it C L0 to the minus D? Because you do the following thing, imagine what happens when you remove the, take a hard sphere here, okay? Okay, if you take a hard sphere, you can get this by just doing the following thing, by taking, sorry, no, no, no, you don't want to take the hard sphere. What do I want to say? There is a constant that depends on V, of course. This is larger than the constant depending on V. So the hard sphere is actually the limit case, but from above, okay? This is too small. Okay, yeah, what you do is the following thing. You do a perturbation expansion. You do perturbation expansion if the V is small, okay? So what you know is that, look at minus Laplacian with Neumann here, okay? And you know that the first eigenvalue is zero, and here you have the second eigenvalue is going to be of size L0 to the minus two, right? So the first thing is you rescale the problem, you rescale the problem to get scale one, scale one. So this gives you minus L0 to the minus two, right? Laplacian plus V, okay? So this is L0 to the minus two, and here you have L0 square V, right? Rescaled, of course, right? V is rescaled by L0, still Neumann. And so now what you want to understand is, now what you want to understand is, here you have an eigenvalue of zero, this is an eigenvalue, I say one, but it's just order one, right? And you add this thing. As long as, so you can, of course, you can diminish L0, right? You can, and you get a lower bound for the first eigenvalue. But if you do perturbation expansion, right? You can see that what you gain here by just, this is simple perturbation calculation, is that this one is larger than, sorry, I forget, I take, yeah, this is L0 to the minus two, minus Laplacian plus VL0 with some epsilon, such that you can do a perturbation expansion. And for this epsilon, you just take the true ground state, do the perturbation expansion, do the computation, and this tells you that this is L0 to the minus two, ties L0 to the D minus, sorry, to the two minus D. Just because this is the integral of V of L0, so this is L0 x, right? The x, this is a constant function, okay? You integrate. You can do it for the initial one. Yeah, you can do it for the initial one, but just for scaling, it gives you fixed constant here, right? And you get that this comes out like this, okay? And this gives you L0 to the minus D. So now, once you have this, you do the following thing. Now we are going to do the following thing. And remember the scales. What does it mean? So of course, here I count only a single one. I don't want to count what happens if you have more than one in there, okay? So what I'm going to do is, well, I know that the probability, the probability that one Poisson point in CL0 in CL0 is, well, zero Poisson point, sorry, in CL0 is E to the minus, well, L0 to the D, right? Okay, so I'm going to take this probability to be below the critical threshold for percolation, okay? And now what happens is that I color this one black, which is white on the board, if it contains one of these points and white if it doesn't, right? So this gets colored in this way. And now what you have, well, now you have pieces because as soon as something is surrounding by these white squares, right? As soon as you're not in the percolation cluster, okay? It means that you are surrounded by a barrier and this barrier will tell you that the eigenvalue is inside, right? I given by the shape. So that's where the clusters, oh, sorry, where the pieces come from, okay? Just by this simple approximation, right? It tells you, it gives you a way to region space in such a way that you have pieces appearing, right? And now, so this was also, so this is not the way, that's the way I do it, this is not the way Snitman does it, right? But in a way, it comes to the same. Actually, Snitman's procedure is much more involved, right, and precise in this because he takes into account the local density of the points which I don't want to do at this stage, right? Really what I want to do is to just single out some portions of space. And so once you've done this, what do you see? Well, what you will see is that you will have, so inside I do a growth thing, so you'll have these free clearings and outside it's essentially white. What does it mean? So the first thing you can prove is that the first thing you can prove is the following. So this is a lemma again, it's built on, well, it's not very difficult. Imagine that you take minus Laplacian plus V, where the V is the one we had, such that on omega, such that the omega is the following, you have the white cluster, so I'm drawing like this, right? And here you have a boundary, which is black. That means that there is a potential. Exactly, black means that in all the points next to the boundary, you have at least one of these potentials. Well, then this operator with Nerman boundary conditions on omega, so that's the exterior boundary of omega, right? It's going to be larger than some constant, one over C, one over the volume of omega to the power two over D, right? Where does it come from? Well, it comes from the isopameratric inequality, right? So the idea is just the following. You see, because this has a fixed length, you can cut off things here, right? There is no curvature problem because the width here is nice and fixed, so you can choose curvature to be of size one, and you just can do a cutoff, cutting off, if you have an eigenstate at some energy E, you can cut off the eigenfunction here so that you can transform it into some Dirichlet thing, okay? And once you have it for Dirichlet, well, it is well known that you have the isopameratric inequality is that the smallest value you get for a given volume is given by actually the ball of the same volume, right? And for the ball of the same volume, it's exactly given by this. So the constant that you lose here comes from the approximation procedure, right? But nevertheless, this tells you that if you want to look at low lying eigenvalues, which is what we want to do in our system row, you'll need only to look for the clusters or the clearings that are very small. Large, sorry, not small. The clearings that are very large need the volume to be large. If you want this to be small, the volume needs to be large, right? Exactly, the white ones. The ones that are free of potential, okay? And now the next thing is to actually refine this, because the next thing you want to show, right? Is that, so the next thing you need to notice is the following. Because of the nature of the Poisson process, right? The Poisson process only, if you want to measure the probability that something does not contain any points, it only depends on the volume of this something. It doesn't depend on its shape, okay? And so, it is natural. So, but if you look at the eigenvalues of the Laplacian, the Dirichlet Laplacian restricted to some object, right? How large this eigenvalue is in terms of the volume of the object depends very much on the shape. And the optimal shape, this again, it's not the isoparametric inequality, what's called the Faber-Kraner inequality, right? Tells you that the best possible shape, meaning giving you the lowest eigenvalue for a given volume is achieved for the ball, right? In any dimension. So, what happens is the following. What you want to do is now for the Poisson measure, balls, the fact that you have an empty set that is a ball or a cube or a triangle, given its volume doesn't change anything. So, what does it mean? It just means that balls appear more frequently. You have a large system of these things.  So, if you want to understand the low-lying states, because you have many of them, of course, some of them will be created by these clearings that have any arbitrary shape, but the majority, right? The ones that appear the most are going to be created by things that look like a ball, okay? This is exactly, if the restriction that you impose, right, is that such a clearing has an eigenvalue below some threshold, because the relation to the ball comes through the fiber-cron inequality, okay? So, the next thing, so essentially, the problem that you meet, right, is that you see, I have this clearing and in my picture, the boundary is obviously neglectable, the volume of this boundary. So, remember, this boundary is not thin, it's of size one. So, the volume of this boundary is obviously neglectable with respect to the volume of the inside, but in general, these things don't look like that at all, right? The volume of the these things look like something like this. Whoops, so that's the interior, right? And if you look at something like this, the volume of the boundary is actually of the same size as the volume of the interior, okay? But of course, such a thing, imagine that there is an interior inside here, right? Such a thing cannot have large, directly eigenvalues, why? Because if you look at this here, sorry, large Neumann eigenvalues, you have to imagine that here you have a boundary where there's the potential, because if you look at what's happening in the orthogonal direction, right? This will push the Neumann eigenvalue up. If you take an interval, take a large interval, right? Take this, so the example would just be a simple interval.  Well, what is driving the lowest Neumann eigenvalue is not this length, it's not the volume. It's actually this minimal diameter. This is what is driving Neumann eigenvalue, right? And using this, you can actually, such comparison principles, you can actually, if you have some shape, right? And things that wiggle out like this, you can actually erase these, right? Saying that the only thing that count is when the boundary is smaller order than the interior in terms of size, right? The boundary here has a volume, right? It has a d-dimensional volume because it's thick, right? It's always thick like this. And once you do this, you can actually then use farbocrane to obtain, here the problem is that the constant is something which is large arbitrary. You can obtain farbocrane to say that really the bores, right? The shapes of these clearings that are of size of bores are the ones that appear most often, okay? So this tells you where the particles should be living in the ground state, okay? Now, the next thing we need to understand, we need also to understand what are the states, what are the patches of space where you can have two particles living together, right? If all the particles would be living alone, you'd be happy, there would be no interaction. Interaction or not doesn't change anything, okay? Remember, in one d, we had the pieces that were of size roughly arrow and then there was of two sizes, two arrow where you had two eigenfunctions that were interacting once you switched on the interaction, okay? So again, the same thing is, so the natural question is, what are the domains in Rd? Such that if you look at the Dirichlet restrictions of the Laplacian on such a domain, the second eigenvalue is the smallest possible, right? Because you want the two eigenvalues to be as low as possible, so you want the second to be as low as possible. Well, the answer to that is no. For the single eigenvalue to be as low as possible for fixed volume, again, yeah, one thing you should keep in mind when I'm saying this is the volume is fixed because the volume is what gives you the probability of appearance of such a shape, right? Because it's a Poisson process that builds all of these shapes. If you have a larger volume, it will appear less frequently, okay? So for a given volume, what's the shape, what's, what does the open set that gives you the minimal second eigenvalue look like? Well, for the first eigenvalue, this is phabocron, it's this. For the second eigenvalue, so this is size, let's say one. It's not going to be size, let's say two. That's not this, right? It's going to be this. And you'll see that in one dimension, it gives the same thing. Oops, sorry. It's going to be two balls. Nobody has the thing to be connected. It's going to be two balls, right? Of radius one. Next to each other, right? This is the shape, the open set that minimizes the first two eigenvalues, okay? And of course, this has much smaller volume than this one, okay? This, of course, also will have two eigenvalues that are very low, right? But the volume of this one is going to be much larger because the dimension is larger than one. And thus this is going to be much more, much less frequent than this one, right? And now what you need to understand is what's the net effect? So you need, so in one dimension, there is no difference between this, this, and this, right? One, one, and two. It's the same thing. But in higher dimension, it's not, okay? And now you need to have, of course, in the system, right? You have these random potentials floating around. It's never going to be a real ball like this with Dirichlet boundary conditions, right? That's what makes the problem difficult to understand or actually to analyze precisely. Yeah, here, I'm not sure. These are really tangent to each other, right, at this point. So what you need to understand now is, well, imagine, so the first order, right? Take minus laplacian in ball one union ball two plus u of x one minus x two, right? U is the potential interaction, it's interaction potential, sorry, between the two balls. And you need to understand what is, so of course you take a large radius, L, and you need to understand what is the larger limit of the ground state of this, to play exactly the same game as we did in one D, okay? So I didn't do this yet, right? I'm not that far, that's to be common, okay? But the philosophy is the following, is that actually because the mechanism behind all this is the same and it doesn't depend on dimension, right? The difficulty of estimating thing depends on dimension, but the mechanism is the same. There are two things, it's tunneling, right? This is exactly what you are using here, is that the tunneling here is, these barriers prevent tunneling so that things need to be localized inside these clearings, right? That's the same as in one dimension. And the second thing is that you're looking at low eigenvalues, which actually make these barriers happen, right? And so it should be possible, I hope it will be in the next years, possible to analyze the true D dimensional model, right? And obtain the same kind of results I had in one D, right? But for these models, okay? Well, I stop here and thank you very much for your attention. For the end of the questions. Shop, can you use this type of results to estimate a Fermi-Gaden rule type of, for tunneling for long range? No, this is, it's going to be, yeah, no, that's another, yeah, that's more problematic. If you want, for example, to estimate, so here what the only thing I use here, right, is some very basic tunneling estimates telling me that I have some, once I leave these allowed areas, I have some exponential decay, right? And the rate of exponential decay. But if you want something like the Fermi-Gaden rule, what you are thinking of is lower bounds, right? Is understanding that I don't decay too fast, right? And, well, that's another matter actually, because this usually requires much more precise estimates and thus it requires much more precise settings in the sense that the cases where I know that you can get these lower bounds on tunneling, right? Is if you look at the double well, for example, right? But then you need your rather precise asymptotics on the, well, if you want on the potential or on the dynamical, on the classical system governing this quantum system, right? This was done for certain simple systems, right? But otherwise, these lower bounds are very difficult to obtain. Especially in higher dimensions, because in one dimension, well, everything is simple, right? There are not many places you can go. At first, the second things cannot vanish too much either. Right here, it's another story, right? You can vanish to a certain order. It's much more complicated. It was done. But you needed, in the studies I know, for example, what Simon or Helfer and Gerstrand did in the 80s, right? Where they studied double well tunneling, right? They really gave this lower bound on what the tunneling is, okay, to show the splitting of eigenvalues. And in some way it comes up to this Fermi-Gold rule. They needed some very precise assumptions on the potential, right? There's never, you're never going to be able to do that in this setting, right? Because of the randomness, too many things can happen. So one has to be a bit modest with the goals you want to reach in this case, right? I'd be happy to prove that indeed the end-body system lives in these pieces, and that in the pieces that look like this, right? You have some interaction going on, and you essentially do this same kind of compensation mechanism that I showed you in 1D, right? You move one particle to the other pieces to gain some energy. This would already be something that I wouldn't dream, I wouldn't have dreamt of actually a year ago, right? So, sure. Just something that confused me, that you said that the percolation you come throughout when there is some potential, then it's not critical. Yes, it's not critical, right? Just why? It's just to guarantee that the clusters are all finite size. But this is not the really important thing, the fact that it's sub- critical, then there will not be many isolated pieces. Well, then super critical if you prefer. I think it's just a matter of, right? What I want is that these isolated pieces will be many of them, there is no infinite component, right? There is no way to percolate from one side to the other one with a large probability, okay? So, but this is the fact that your sub-critical is not per se crucial, right? Really what you want to understand is that you have isolated these isolated components. As anyway, you look at finite boxes, right? A question, did this analysis of the shapes of the domains did it play a role in the proof of localization for the one particle model like for this random displacement model or random model? What's on that, sir? When you get localization of one particle? No, no, no, it didn't in a way that, no, it didn't, that's that there are two points of view that you'd like to reconcile actually. As you went up. No, in the proofs for localization for the one particle model for the Poisson case, I know two proofs and there's one one dimensional which is the older one is 95 paper by Gunther Stoltz where essentially what he does, he first, well actually I think he was not the one who did that but this was already known, get you get positivity after your pun of exponent, right? And then the next thing you need to do once you have positivity of your pun of exponent, you need when you want to understand the resolvent of this operator on some finite scale, you need to understand the small denominators, right? What you want is you need to understand, so you need something like a Wagner estimate, okay? And what Gunther did is he understood how you can analyze the variation of the eigenvalues of your Poisson model when you shift one of the Poisson points, right?  There's not exactly the way he phrased it but this is actually what he's doing, right? And the second proof which is in any dimension but well of course as it's any dimension it's only at the bottom of the spectrum. This was done by Germiné, Hyslop and Klein in about 10 years ago after the breakthrough paper of Bourguin and Koenig and what they did they actually adapted the ideas of Bourguin and Koenig to deal with the Poisson model. So in a way what they did is they approximated the Poisson model by some Bernoulli type model with a nice Bernoulli distribution, right? And so they use these ideas but again the main problem was to understand these small denominator problems, right? Because the main problem is that for the Poisson model you don't have any Wagner estimate. You don't know how to control given on a cube. You don't know how to control the probability that two eigenvalues of the operator restricted to a cube be close to each other, right? So what they did they devised using the Bourguin-Koenig method. They devised a way to do this control for the Poisson model, right? But it was not related at all to this, right? And actually these two things are in a way quite different because of the following thing. As I hinted at before localization is something which happens at a very long range, right? Much the range is much larger than the ranges I'm looking at if I want this precision in my expansion for the ground state energy, right? And so fortunately for me I don't need to control things at such a long range. I wouldn't be able to do it actually, right? Even in 1D, it's complicated. So, okay, thanks very much. And as I'm the last speaker, well it's my pleasure to thank the organizers and actually the organizer as far as I can judge for setting up this very nice meeting.


Okay y'all, today we are going to unbox the SD25DVPWM ESET board. This board has the SD25DVPWM device, basically an NFC tag device, SOA and package, and it has two PWM outputs, so technically you can use NFC to change the port with the duty cycle, the frequency, and basically change the PWM parameters, so you can use it to drive motors and LED drivers, whatnot, so to illustrate how to use this board, we need a USB micro, and you want to use the NFC tab app, and just do a read tag, go to more, in here we're going to do ST25 PWM control, here we can do a typical control of the duty cycle, so here the bank of LED illustrates the amount of the duty cycle of the PWM signal by changing the slide, it dynamically changes the PWM output, so if you want to be at about 50% duty cycle, you're about there, using the app you have option to change all the parameters including the frequency and the duty cycle of the signal, so these four pins has the PWM output ground and external VCC, so you can actually connect to a fed switch to a motor to control speed, be aware that the output of the PWM IC itself doesn't have enough current to drive the motor, because in many cases that could be tens of milliamps, so you would want to use an external power source and a fed switch of some sort to drive the motor, okay thank you.


Thank you so much for your interest in this topic that we want to talk about, which was in fact something that a couple of us discussed last KubeCon in Chicago. And that's the question, why do we as a cloud-native community not have a truly open and free way to collect and share threat intelligence with each other amongst ourselves? And the other question is, what would it take to change that? And this is what this talk is about. And in reference to the sans internet storm center, we were bold enough to call it the Kubernetes Storm Center. Maybe some of you know that podcast. It is mostly about endpoints and maybe printers and Adobe exploits. And what they do is they have a global network of honey pots from which they report what's currently going on, what's being exploited. And what we want to do in analogy to that is we want to use a network of honey clusters instrumented with ABPF to collect that threat intelligence and disseminate it. My name's Constance Eridic. I work at the Technical University of Vienna, teaching computer science, and doing all sorts of practical stuff. And with me is. Hello, everyone. I am James Callahan. Like Constance, I have a background as a theoretical physicist. However, around 10 years ago, I became interested in cybersecurity. And now I work as a principal consultant at Control Plane, working mainly in security architecture. In my spare time, I make music. And I also make very bad spinal tab jokes on slide decks. So if anyone actually gets that very, very niche reference, please come and talk to me afterwards, because we'll probably get on very, very well. On the topic of bad jokes, two theoretical physicists walk into KubeCon. Armed with a host of practical experience of the real world, like modeling the universe in n greater than four dimensions, we thought it would be good to do some real world practical experiments. I mean, how badly can it go, right? On that note, I mean, we're not going to take any liability for anything. But we should. So this is the agenda for the next 35 minutes. And we should always start with why. So why do we think this is relevant? And I hope that and think that most of you will have been in that situation where your deployment, your product, was almost ready for production. Then you had a threat model going on. And there's this discussion. Well, we found that there is attack vector A, attack path A to a target. But also attack vector B, attack path B to the same target. And then internally, you have your teams discussing, well, one is much harder, much more effortful to remediate than the other one. And now, how are we going to prioritize and get the budget, like which one should we prioritize in remediation? And of course, you could model this in n dimensions. You could hire pen testers. You could do bug bounty programs, all of that known withstanding, or what we're going to show you in the next 30 or so minutes on an example is you could model the attack instrument very lightweight. The critical attack path nodes with ABPF in this case, you take that instrumentation and stream the events. You have a method to reduce the baseline out. That means you only have a normal detection. And then you analyze these signals and disseminate them out. We're going to show you two real life experiments, one on an example attack path and one on a famous CVE that came out recently. And we're going to conclude with a four fold path to threat intelligence. That means how you could do that yourselves. If we want this to succeed, however, such that it becomes common practice that not just the tech giants, but also smaller enterprises, even budget constrained teams, can have benefits and run honey clusters for themselves, we need to have stringent requirements on ourselves, such as that it's truly free, not bigger budget impact. But also that it's minimally invasive. So if you have your cluster situation going on, we only do a delta epsilon of instrumentation on top. You don't need to change your firewall, et cetera, et cetera. And also, there's going to be no black magic, no machine learning, no fancy-payancy algorithms in n dimensions. No, it's going to be actually very accessible to, let's say, an average SRE that's been around in the field and a truly free license. And the idea, the vision is that this four fold path, this process of going from threat model via attack model to the instrumentation and the data collection, that this is really achievable by anyone and becomes common practice so that we have a wonderful sampling of the phase space and can really interpret what's going on in the world on our various configurations and deployments. But that's the vision. And the devil is in the detail, so let's start with the example attack model. OK, so the first thing to note is that open source threat intelligence is out there. So for example, you can check this really cool resource made available by Wiz, where you can see recent CV exploits. You can see threat actor information, tactics, techniques, and procedures that are being used in the wild. So this and a bunch of other sources are really good if you want to augment your threat models and understand a little bit more about real life what's going on. However, what happens if we want to verify and quantify our threat models? So at some point in threat modeling, we'll end up with something like this, an attack tree, where at the top, we have an attacker goal, and underneath it, we'll have a bunch of attack paths or steps made up of these attack nodes, which have to be realized for the attacker to achieve their goal. And we will have and nodes and all nodes. And together, this makes up the logic of our theoretical attack path. Now at some point, we need to know what's the likelihood that an attacker traverses a particular path through the tree. And the traditional way of doing this is by using experience and putting your finger in the air and saying, this is probably the likelihood, because I've observed these attacks. I've carried out these attacks as a red team, et cetera. And we put some probabilities on this thing. However, wouldn't it be really nice if we had empirical data to back this up? So first of all, going back to the fourfold path, our first path is getting a theoretical attack model. So we wanted a demo attack that you can run yourselves. We have this available in a kind cluster, which you can run. We'll show you the repo at the end. And we had a few requirements for our attack. We wanted it to work with baseline pod security standards, so we didn't want you to just be able to spin up a privileged pod in your cluster or something like that. We also wanted several distinct indicators of compromise. So we wanted a fairly long attack path, and this is purely as a demo. So this is not a real-world honey cluster. This is just to show you our instrumentation and how we would do this. So we want several distinct indicators of compromise, where each one has a unique signal. And finally, we wanted it to be semi-realistic, based on an over-privilege role, basically. So Constance will show you an example later on with a real-world CVE. But for this very simple base example, we just wanted to use plain old misconfiguration as the vector. So let's have a look at this attack tree, because these things can be a bit hard to understand and pass on first sighting. So let's just walk through it node by node. At the top, we have our goal, which is for an attacker to access sensitive data on a node on which a pod is running. We need to provide an entry point. And as you can see, from the entry point at the bottom, there's kind of two paths through this tree. There's this path on the right, which we'll go through in a second, and this more complex path with more nodes on the left. The one on the left is the one with more indicators of compromise and more stuff for us to demo. So this is the one that we're going to be interested in. And this is actually, it's quite an old attack path. It was raised in the Kubernetes audit by Trail of Bits a few years ago and expanded on in a really, really cool blog post by Jack Ledford. And we'll go through this step by step. So back to the bottom of the tree and to our starting point. We need initial entry into the cluster. Now, in a real world honey cluster, what we might want to do is run expose a vulnerable service to the world, maybe some RCE vulnerability and allow our attackers initial entry. However, we're doing something much more basic than that. We are just running a vulnerable SSH server in a cluster. So maybe this is a little bit too obvious, but it gets our point across. The credentials are root squared. This should be hitable by automatic scans and hopefully we should see some results from this. We're also going to introduce some misconfigured RBAC, which is the key for most Kubernetes escalation and pivoting. And then what we can do from here depends on how badly misconfigured or overprivileged the role is. So we have a pod as a service account, bounce some role, and let's say we have some operator like workload which can create pods. Well, we're saying we want this to work with baseline pod security standards enforced. Therefore, we can't just create a privileged pod or a pod with host path in its spec. However, let's say we can do something very privileged like create persistent volumes and associated claims. If we can do this, we can fully take the right hand path through this tree and we can just create a persistent volume with host path. We pick a directory on the host that we're interested in and we're good to go. However, the attack on the left, we wanted, again, a few more indicators of compromise and this is kind of a subset. So to achieve this attack on the left, it's not just any old host path. Maybe we have some restrictions in place. All we need is to be able to have a host path persistent volume to slash var slash log. We need to be able to run containers as root and we need to create a sim link in the new pod, this bad pod that gets spun up, a sim link from its log file to the interesting file on the host that we care about. Then, moving up one step, if we have a get on pod slash log, we can run keep control, get logs or do this programmatically from a script and we can cat out the interesting file line by line. Now, I showed this talk demo and the logic of the talk to my excellent colleague Ian Smart who said, well, in your demo, you haven't actually put any restrictions in place. So in the wild, if you run this as a honey cluster, the attacker would only go down the right hand path. And this is key because when you're doing these attack trees, you will always have multiple paths to the goal. And what you might have to do if you particularly want to observe a particular trace through the tree is you might have to put constraints in place. So you might have to say, let's have an environment where we don't have this such privilege role but maybe we can't create persistent volumes anymore but maybe there's a volume unclaimed lying around in the cluster, something like that. Or maybe we want to use some kind of logic as to why certain host path persistent volumes would be allowed. Maybe slash far slash log is allowed in this world, in this hypothetical honey cluster because there are pods in the cluster which want to observe other pods logs, something like that. Anyway, the key is that we might want to lead attackers down certain paths or we might just want to see what happens with a very, very generic setup. So let's have a look at this attack on kind. We're just going to run through this very, very quickly. So first of all, we are going to have a look in our cluster and we see that we have our SSH service running. We're just going to port forward this so that we can hit it. And here we will see a very bad over privileged role. Sorry, that was so short. And what we're going to do is use a Python script which, as you can see here, is going to create this persistent volume to slash far slash log and we're going to create an associated claim. Again, if you want to restrict what you do, this script might look different. So we'll copy the script into our container and we will run it and yet we've got the very secure root column root. And let's actually now run that. So we've copied our scripts in, now it's running and eventually we will see a new pod running in our cluster which will be called my pod or something like that. And this is the pod, there it is, which we're going to carry out our attack from. So we're executing to the pod, we are going to create this sim link and then this again is going to give us a very distinct indicator and then finally we're going to keep control logs and we see the start of a private key there which is obviously very, very bad. So bit of a forced example but you can see what we're trying to do with this. The next bit that Constance is going to take you through is how we instrument the cluster to observe these attacks. So for each node in the attack tree, we will have an individual indicator of compromise. And if you run this yourself on kind, you should see we've got to, we're streaming these events into Red Panda. Constance will go through the instrumentation and a lot more detail on the next slide but you can see here that we've got this detect K8s API invoke and this is watching our script. Make that call to the Kubernetes API. Baseline removal is something Constance will cover but essentially we're looking for things which shouldn't be calling the Kubernetes API. And with that, on to instrumentation. Exactly, so now we have this example, threat model and attack model. Now the question is how can we instrument a cluster in an extremely lightweight way without any black boxes to make this actually possible for non-experts. So we have a GitHub repo where you can run this yourself and judge for yourself if it's simple enough. So the bait, so now we're gonna go to real clusters. We're gonna use RK2 with Ranger on it for those real life clusters. The bait is gonna be very similar for that real cluster. It's a old fashioned reverse SSH tunnel to that vulnerable SSH server still root squared on it. So that's where we start. Now we have to instrument these traces. We use tetragone to abstract, so we do not have to write actual EBPF code. It's a Kubernetes CRD that lets us write YAML files to, for example, attach to K-Propes. The lock forwarding is achieved using Vector and we use Red Panda to implement the Kafka API. This is also so that if this were to take off, we have a very, very good scalability here, but importantly also that we can use Wasm inlays to achieve high-performance transformations for two purposes. And the one important purpose is this baseline removal and we're gonna look at a hash table that does this for us and that uses one Kafka feature which essentially achieves intelligent deduplication. And the other part that we do is we want to make this non-expert, so we implement in Wasm what is essentially a jQuery to get these very different looking K-Prop return values, return jasons into something that we can call a schema which we can then give to a database with sticks to format, sticks to taxi format and do our actual threat intelligence on that database. Also important if you do this in the wild with a real cluster and you're just doing that, you should have an actual tool that verifies what's going on and notifies you that if you actually get accidentally breached. So we're using SpiderBot, that also does ABPF instrumentation, gives us this really detailed UI so we can really trace arbitrary amounts of detail out just in case we're concerned that we're not catching the right stuff. Now, one of the core pieces that we have here and this is also why I think that people would get value out of this even if they don't participate in the threat dissemination is the baseline removal, making such a setup very quickly the simplest intrusion detection system that I've ever seen. So essentially, you take the ABPF instrumentation, stream it into Kafka and then create a key in order to do detailed duplication from anything so that you can classify anything that is known to be non-malicious as non-malicious. And the key here is, it takes a second to understand that the second line to concatenate the right UIDs that you have previously seen on your cluster and use them as a key for on which to do the duplication automatically. And so what we have with the right choice of hash is we have an IDS configured to avoid false positives completely. And implementing this in one of the Wasm inlays in WebAssembly transformations in Red Panda. So this turned actually out to be super simple. The thing that turned out to be not so super simple is how do we model with the tracing policies in ABPF to face-based correctly, such that we actually know this is the baseline, the baseline is the baseline and the attack is the attack, this is the anomaly. So we need to model this correctly. And here, of course, just enough is ideal. And this might be quite artful. However, if you're just getting started or we're getting started, you actually don't need to do this entire face-base. You can just go what we call the critical attack path along the critical attack path. What is that now? So we've seen the tree, which is relatively complex. However, you can identify along each attack path things that must occur. There's nothing that can stop them from having to be there. For example, a SSH socket will open a socket. There will be TCP traffic non-zero on that. If you spawn a new pod, there will be a new Linux namespace created. There will be credential changes. They must occur. If you're communicating from this overprivileged service account to the API, that is something that, again, must occur. And it's those points along each of the branches that we instrument with at least one trace point, in this case, tetragon tracing policies, to make sure we capture exactly that. So we don't need to already solve the entire problem up front. We can focus for each tree this critical path. And one important thing is that you should maybe verify that you actually capture it.  In this case, it's a make file. And first, we see that we see the raw values here being streamed into the Red Panda UI, which is the full nested JSON that you get back from these K-probes. And then also, we check that we can flatten it out and bring it into the standard format that we will then ship upstream to a threat intelligence system, for example. All right, so we have some events now. How do we share this data? This is the key. How do we make this open source and free for everyone to benefit from? So the UK's National Cyber Security Center, or NCSC, advised the use of a Stix2 and Taxi2. Now, Stix is the format for the data, and Taxi is how this is shared pretty much. Now, other standards do exist, such as MISP. However, MISP really focuses on describing incidents and past events. So the data model is extremely event-based. But what you're seeing here is we're more interested in these attack trees and actual linkages between observed events and those observed events with a theoretical threat model. So Stix is actually very well-suited to this because it's graph-based. Now, it is quite an old standard.  And it's quite complex, but with complexity comes flexibility. So we can actually model everything in terms of Stix objects, which we'll do on the next slide, or at least show you a suggestion of how this could be done. It's important to note that Stix is graph-based with relationships between objects. So it's very well-suited to these sorts of attack models and trees. We have here on the right-hand side a conceptual vision of what the Kubernetes Storm Center looks like. So we have organizations or individuals contributing to this Storm Center in a couple of different ways. The first way along the top is by running these instrumented honey clusters, where hopefully if the bait is tasty enough, we will get some observed events. These observed events can then be shared in a central threat intelligence database. But hopefully also people will contribute on the attack model side as well, because each cluster should have a counterpart threat model so that we can label things and match things up. We'll see on the next slide how we can actually relate these to Stix objects, which are these very generic objects, like I said, but this actually helps us out. So here we go. We've got the same diagram, but we've overlaid on these green objects, which are Stix 2 objects. So in version 2 of the standard, as you can see on the left, we have different classes of objects. We have domain objects, cyber-observable objects, and then relationship objects. So the organization is obviously going to map to something called an identity. That is fairly simple. This organization is hopefully observing events on their instrumented honey clusters. And we have a Stix SRO called a sighting, which hopefully maps nicely to an event. Now this is a relationship because the sighting can reference observable data. So as we saw in the example that Constance ran through, we are interested in a few key observables, such as the binary being run, the arguments. All of these are going to give us indicators as to the attack tree node which is being observed. We need to relate this back to the theoretical model. So you can see here we have an attack goal at the top in yellow. This is mapped again to a Stix object, which is an attack pattern. Now an attack pattern can have, again, very generic data structures in there.  So you can envisage the kill chain for an attack pattern being the underlying nodes which need to happen. It's that critical attack path. So there would be then a many to many relationship between indicators, which is another object, and these attack patterns. And an indicator would then go full circle by referencing the observed data. So we have indicators which map to the theoretical model, and then we have observables which give us our trace of, yes, this event is happening, and so everything is linked together now. We have real events mapped back to this threat model. Okay. Right, so far the reference implementation and what we thought to prove the point on the old, in the past, written threat model. Now, in January there was a rather famous CVE came out, and one question that we asked ourselves, well, now we've constructed this super cheap intrusion detection system. So what about, how much can we see if we have just the default configuration? None of the theoretical modeling of the actual attack model, but can we see simply by running multiple clusters that are vulnerable, can we see an attack campaign on such a CVE as if it just came out in January? And I guess some of you will know what I'm talking about. This is the leaky vessels attack. I'm gonna attack two of my own clusters by poisoning the supply chain. I have the baseline removal in place. I have only default tetragone config. These two clusters run full load. So they have, I think, 20 namespaces. They're slightly different. We'll pretend that the white one's my cluster, the black cluster is James's. And the way this exploit works is at the boot of a poison container, there is basically a out of wax file descriptor, and if I catch it, I can chidear into the host node and I can modify the host. And in this case, I'm gonna cut out a sensitive file. So in this video, what I'm gonna show is me attacking my own clusters. So we see on the bottom is the anomaly reduced signal. Now we look at the node, the node of the actual Kubernetes cluster is clean. Here is the green running default payload. And now I'm poisoning my registry by overtagging the image with the POC exploit for leaky vessel. And to expedite that it gets triggered, I'm deleting my green deployments. I could also just wait. And now I'm doing this on both clusters. And now when it, at the moment of the new container, the poison container booting, we see in the anomaly detection immediately a signal. I mean, I put in something that clearly stands out as an alert. And now we see that the chidear is happening, we're cutting out the file. We see it's the container de-shim being executed. And now let's see which pod was actually the one that got lucky with the out-of-work file descriptor. It is pod number eight. So if we go to this image number eight, sorry, and look at the logs, we do actually see in the logs the sensitive file. And if we go to the node, we will see that on the host, we have the new file having been created. That means the attack worked. And again, we look at the other cluster and we see, okay, we have obviously the same detection because what we did is a sort of self-made campaign of that leaky vessel exploit that we saw in both clusters. And we also verified it again on an independent tool that this is really what happened and we didn't see anything else. And what this proved to us is that we can't just do all this theoretical modeling with the instrumentation of these tracing policies, which can be a bit effortful, but we can also just use fingerprint correlation across without any effort from. The only thing we have to do is this baseline removal. And by running this on real load clusters for a period of two weeks, we saw that the baseline was actually quite stably removed and really the only thing it's doing is a fancy deduplication algorithm. And that's, I think, as simple as it gets. So in terms of our own requirements, I think it is accessible and simplicity so that the hardest part is that hash function, essentially, and some J queries. The most difficult part is if you were to fine tune the tracing policies on level of K probes because that does require kernel level knowledge. If you want to observe very specific things, but that was also something that we could crowd source together so that not everybody needs to be a kernel expert. Important was that we saw parity between a real tool and something we coded up in three weeks because that's not obvious. We could see the Lakey Vessel exploit and the one thing that I was a bit sad about that these clusters did actually not get properly attacked there were just a couple of SSH connections, but I got really excited last week when I got a lot of API calls, SimLynx and whatnot created, but then I asked the infrastructure team and it was the self-cluster that had a bit of a network wobble. But I mean, we saw it. So one of the potential reasons is that if you looked up the domain of this cluster you would very, very quickly come to this talk into my face. So that's potentially why it didn't get properly attacked. So what I think we need is a bit less obvious bait and more diverse setups that are not obvious as being traps. And of course this costs money to invest in this. Why do I think this should be invested in is if it was common knowledge that a certain percentage of all our clusters are essentially traps or honey traps. This could act as a repellent or detractor for real attackers, maybe not APTs, but real attackers that this could just be somebody fishing for attacks. And another thing is of course sentiment analysis of what our attacker friends are up to. Like this week we're really interested in doing a lot of copycat behavior on this attack and maybe next week it's a particular other attack that is currently on walk. So we can track what is in this particular time frame a priority to defend against. And that brings us back to the outset is if we are to have these discussions about what should we remediate first, how do we prioritize? This would bring us some facts in and we wouldn't have to just rely on the opinions or whoever speaks louder. And handing over. Okay, so thanks for staying with us so far. So to summarize our approach then, we have this fourfold path to threat intelligence. Step one, we create a threat model and we understand our critical attack path. Once we have this threat model, we instrument a honey cluster with EBPF tripwires and some bait. Step three, we then trace and stream events and remove the baseline as Constance has inscribed. And then finally we disseminate this so that people can gain knowledge and use this in their own threat models and understand these likelihoods of particular attack patterns being observed given a certain set of constraints. So this is a very big undertaking obviously and community is going to be crucial. We need the wonderful cloud native community to help us. Obviously clusters cost money and we need a wide variety of these honey pot honey clusters in order to build the Kubernetes storm center. So if anyone is interested in sponsoring a honey cluster, we will be extremely grateful and interested. But also we're interested in contributions on the attack path side as well. This will only work if we have a diverse library of attack paths within the Kubernetes storm center such that we can create instrumented honey clusters and look for observations. You can try everything that you've seen today for yourself.  And just another note about community, this talk would not have been possible without help from a tremendous number of people, a few of which we have named on this slide, particularly Liv Keats, we love these B and Spyder logos. Absolutely phenomenal work. So thank you to everyone who has helped us. And thank you for listening as well. If you'd like to give us some feedback, please do and we'll be around for the rest of the conference if you want to chat to us about anything. We do have time for questions because we finished five minutes earlier than we thought and we can hand out mics if anyone does have any questions. But if you prefer, we'll just hang around and you can talk to us in person, whatever people prefer.