# The properties of AGN in dwarf galaxies identified via SED fitting

B. Bichang’a,1 S. Kaviraj,1 I. Lazar,1 R. A. Jackson,2 S. Das,1 D. J. B.
Smith,1 A. E. Watkins,1 G. Martin3
1Centre for Astrophysics Research, University of Hertfordshire, Hatfield AL10
9AB, UK
2Department of Physics and Astronomy, University of Victoria, BC V8P 5C2,
Canada
3School of Physics and Astronomy, University of Nottingham, University Park,
Nottingham NG7 2RD, UK
E-mail<EMAIL_ADDRESS>
###### Abstract

Given their dominance of the galaxy number density, dwarf galaxies are central
to our understanding of galaxy formation. While the incidence of AGN and their
impact on galaxy evolution has been extensively studied in massive galaxies,
much less is known about the role of AGN in the evolution of dwarfs. We search
for radiatively-efficient AGN in the nearby ($0.1<z<0.3$) dwarf (108 M⊙ <
$M_{\rm{\star}}$ < 1010 M⊙) population, using SED fitting (via Prospector)
applied to deep ultraviolet to mid-infrared photometry of 508 dwarf galaxies.
Around a third (32 $\pm$ 2 per cent) of our dwarfs show signs of AGN activity.
We compare the properties of our dwarf AGN to control samples, constructed
from non-AGN, which have the same distributions of redshift and stellar mass
as their AGN counterparts. KS tests between the AGN and control distributions
indicates that the AGN do not show differences in their distances to nodes,
filaments and nearby massive galaxies from their control counterparts. This
indicates that AGN triggering in the dwarf regime is not strongly correlated
with local environment. The fraction of AGN hosts with early-type morphology
and those that are interacting are also indistinguishable from the controls
within the uncertainties, suggesting that interactions do not play a
significant role in inducing AGN activity in our sample. Finally, the star
formation activity in dwarf AGN is only slightly lower than that in their
control counterparts, suggesting that the presence of radiatively-efficient
AGN does not lead to significant, prompt quenching of star formation in these
systems.

###### keywords:

galaxies: evolution – galaxies: formation – galaxies: interactions – galaxies:
dwarf – galaxies:active

††pagerange: The properties of AGN in dwarf galaxies identified via SED
fitting–The properties of AGN in dwarf galaxies identified via SED fitting

##  1 Introduction

The steep rise in the galaxy stellar mass function in the dwarf
($M_{\rm{\star}}$ < 1010 M⊙) regime (e.g. Wright et al., 2017; Martin et al.,
2019; Driver et al., 2022) indicates that dwarf galaxies dominate the galaxy
number density at all redshifts and in all environments. This makes them
vital, both for our empirical understanding of galaxy evolution and for
constraining theoretical models. Our current picture of how galaxies evolve is
largely based on massive galaxies, since these objects are bright enough to be
detectable, across a large range in redshift, in past wide-area surveys (e.g.
Jackson et al., 2021).

The properties of dwarf galaxies have been studied in detail in our local
neighbourhood, out to distances of $\sim$50 Mpc (e.g. Mateo, 1998; Tolstoy et
al., 2009). However, typical dwarfs become undetectable at cosmological
distances, in past surveys like the Sloan Digital Sky Survey (SDSS; York et
al., 2000; Alam et al., 2015), which offer large footprints but are relatively
shallow (e.g. Jackson et al., 2021; Lazar et al., 2024). In the specific case
of the SDSS, it is worth noting that, while the limiting magnitude of its
standard depth imaging is $r\sim$22.7, many scientific analyses, including
past dwarf studies using the SDSS, use the spectroscopic main galaxy sample
(MGS). The MGS, however, has a much shallower magnitude limit of $r\sim$17.77
(Strauss et al., 2002). The dwarfs that exist in datasets like the SDSS MGS
tend to have high star formation rates (SFRs), which boost their luminosities
above the detection thresholds of shallow surveys but also bias them towards
systems that are blue, star-forming and potentially dominated by late-type
morphologies (e.g. Lazar et al., 2024).

The advent of new surveys that are both deep and wide, like the recent Hyper
Suprime-Cam Subaru Strategic Program (HSC-SSP; Aihara et al., 2018) and, in
the near future, Rubin Observatory’s LSST (Ivezić et al., 2019), offer optical
photometry with unprecedented depth over large areas of the sky. Such datasets
can be used to identify dwarfs down to $M_{\rm{\star}}$ $\sim$ 108 M⊙ out to
at least $z\sim 0.3$ (Jackson et al., 2021). In conjunction with similarly
deep surveys at ancillary wavelengths, such datasets are likely to transform
our understanding of the dwarf regime outside the very local Universe. It is
worth noting that the shallow potential wells of dwarf galaxies are more
sensitive to key processes that affect galaxy evolution (e.g. ram pressure
stripping, tidal interactions, and baryonic feedback from stars and AGN) than
massive galaxies (Martin et al., 2019). Statistical studies of dwarfs outside
the local neighbourhood are, therefore, likely to lead to significant gains in
our understanding of the physics of galaxy evolution.

A prominent topic in the recent literature is the presence of black holes
(BHs) and the role of AGN in galaxy evolution. The massive galaxy regime is
well studied in this context, with both observations and theory suggesting
that not only do all massive systems likely host black holes (Richstone et
al., 1998), but that star formation activity, and therefore the growth of the
host galaxy, is heavily influenced by AGN feedback (e.g. Fabian, 2012;
Beckmann et al., 2017; Kaviraj et al., 2017; Davies et al., 2023). However,
less is currently known about the presence of BHs in dwarfs and their
potential role in driving galaxy evolution in this regime (e.g. Silk, 2017;
Volonteri et al., 2021). While there is accumulating observational evidence of
AGN in dwarf galaxies (e.g. Greene & Ho, 2007; Reines et al., 2013; Marleau et
al., 2017; Nyland et al., 2017; Satyapal et al., 2018; Mezcua et al., 2018;
Mezcua et al., 2019; Kaviraj et al., 2019; Baldassare et al., 2020; Davis et
al., 2022), questions persist regarding their frequency, the processes that
might trigger the BHs, correlations with local environment and whether
feedback from the AGN can have a similar impact in dwarfs as it does in the
massive-galaxy regime. It is worth noting that, in the dwarf regime, BHs tend
not to grow in current cosmological simulations. This is because the BHs
either wander for significant fractions of their lifetimes in regions of low
gas density, away from the barycentres of the galaxies, or because supernova
feedback displaces material around the BH and and prevents it from feeding
(e.g. Dubois et al., 2021). However, it remains unclear whether this behaviour
truly mimics that of real dwarf galaxies or may be a result of the
characteristics of such simulations (e.g. their relatively low mass and
spatial resolutions). Empirical constraints on the incidence of AGN in dwarfs
and the properties of their host galaxies are, therefore, valuable.

While AGN emission contributes to all parts of the spectral energy
distribution (SED), the samples of AGN recovered from probing specific
wavelength ranges differ, with unique challenges experienced in the different
methods that are employed. For example, AGN selection based on X-ray
luminosity (e.g. Latimer et al., 2019), may not be ideal for identifying AGN
in the dwarf regime, due to the long exposure times required to detect low-
luminosity AGN (e.g. Reines et al., 2020). AGN selection in dwarfs via optical
variability (e.g. Baldassare et al., 2020; Martínez-Palomera et al., 2020),
ideally requires optical surveys that are both deep and wide, to ensure that
the dwarfs being studied do not suffer from the biases in shallow surveys
described above. Employing emission-line diagnostics (e.g. Baldwin et al.,
1981; Kewley et al., 2001; Cid Fernandes et al., 2010; Cid Fernandes et al.,
2011) to detect AGN in dwarfs in shallow surveys may similarly miss some AGN.
This is because, if dwarfs in such surveys are biased towards star-forming
systems then the impact of the AGN on the emission lines may be dominated by
the star formation activity.

Several studies in the literature have used radio excess to detect AGN (e.g.
Lofthouse et al., 2018; Gürkan et al., 2018, Drake et al. in preparation).
However, an implementation of this technique on data from the LOFAR Two-metre
Sky Survey (Shimwell et al., 2019) indicates that, given the lower radio
luminosities of dwarf AGN, only young radio AGN are likely to be found in
dwarf galaxies (e.g. Davis et al., 2022), even in the deepest high-resolution
radio surveys that are currently available.

In this context, SED fitting (e.g. Leja et al., 2018), using deep multi-
wavelength broadband photometry is a useful avenue for identifying AGN in
dwarf galaxies (e.g. Das et al., 2024; Delvecchio et al., 2014, 2017; Thorne
et al., 2022; Best et al., 2023). Using the full SED simultaneously leverages
the impact of the AGN over a range of wavelengths. Furthermore, since high
signal-to-noise ratio observations of fainter objects like dwarfs are easier
to achieve via broadband photometry, more complete samples of dwarfs can be
probed for the presence of AGN, at least in the nearby Universe. The purpose
of this paper is to use deep broadband multi-wavelength photometry to search
for dwarfs which exhibit signs of AGN at low redshift ($z<0.3$), probe the
role of interactions and environment in AGN triggering and study whether there
is evidence for significant prompt quenching of star formation in these
systems.

This paper is organized as follows. In Section 2 we describe the broadband
photometric data that is used in the SED fitting, the calculation of
environmental parameters, the selection of our sample of dwarf galaxies and
the morphological classification of these systems using Hubble Space Telescope
(HST) images. In Section 3, we describe the calculation of physical parameters
using the SED-fitting code Prospector (Johnson et al., 2019; Leja et al.,
2019; Johnson et al., 2021). In Section 4, we use the outputs of our SED
fitting to explore the incidence of AGN in our dwarf galaxies, study the role
of interactions and local environment in AGN triggering and compare the star
formation activity in AGN and non-AGN to explore the possibility of AGN-driven
quenching. We summarise our findings in Section 5.

##  2 Data

###  2.1 The COSMOS2020 catalogue

We employ photometric data from the Classic version of the COSMOS2020
catalogue (Weaver et al., 2022), which provides deep multi-wavelength ultra-
violet (UV) to mid-infrared (MIR) photometric data in the COSMOS field.
Notable improvements in this catalogue compared to its predecessor, the
COSMOS2015 catalogue (Laigle et al., 2016), is the incorporation of ultra-deep
optical ($griz$) data from the Hyper Suprime-Cam (HSC) Subaru Strategic
Program (Aihara et al., 2018) for object detection, improved Spitzer/IRAC data
processing using IRACLEAN and improved astrometric precision from aligning the
imaging data with the Gaia DR1 (Gaia Collaboration et al., 2016). The optical
HSC photometry has a point source depth of $\sim$28 mag, significantly deeper
than past surveys such as the SDSS (in which the optical images are $\sim$5
mag shallower than those from the HSC in COSMOS). We refer readers to Weaver
et al. (2022) for further details of the processing of the photometric data.

We use total magnitudes from 15 broadband filters that span the full UV to MIR
wavelength range provided by the catalogue from the following surveys: $FUV$
and $NUV$ data from GALEX (Zamojski et al., 2007), $u$/$u^{*}$ from
MegaCam/CFHT (Sawicki et al., 2019), $g$, $r$, $i$, $z$, $y$ from Subaru/Hyper
Suprime-Cam (Aihara et al., 2019), $Y$, $J$, $H$ and $K_{s}$ from VIRCAM/VISTA
(McCracken et al., 2012) and mid-infrared data from IRAC/Spitzer Channels 1,
2, 3 and 4 (Ashby et al., 2013; Steinhardt et al., 2014; Ashby et al., 2015,
2018). The optical and infrared photometry is extracted using the SExtractor
and IRACLEAN codes respectively. Since we are specifically interested in
dwarfs, which have smaller angular sizes, the high resolution of the IRAC MIR
imaging (2 arcsec; Fazio et al., 2004) is an advantage.

In the $u$-band footprint, the catalogue offers photometry from two virtually
identical filters, $u$ and $u^{*}$. The $u$ filter has a slightly shorter
central wavelength and has replaced $u^{*}$ in recent CFHT surveys, such as
the Large Area U-band Deep Survey (CLAUDS; Sawicki et al., 2019). While the
two filters span a similar wavelength range, the $u$ filter does not cover the
full COSMOS field. $u^{*}$ data is deeper in the central region than the $u$
band which, however, is more uniform across the field. For our work, we use
the deeper of the two bands when both are available. The filterset available
spans emission from starlight through to the hot dust that is likely to be
associated with the AGN (e.g. Hickox & Alexander, 2018). The IRAC wavebands
are able to provide significant discrimination between the MIR emission
produced by stellar populations from that originating from the AGN (e.g. Assef
et al., 2010).

Figure 1: Example HST/F814W images of dwarf galaxies in our sample, including
ETGs (top row), LTGs (middle row) and interacting systems (bottom row). In the
bottom row, the images in the first three columns show examples of interacting
ETGs, while the last three columns show examples of interacting LTGs. Each
image has a size of 5 arcseconds on a side. At the median redshift of our
dwarf sample ($z\sim 0.21$), this corresponds to a physical size of around 18
kpc.

###  2.2 Environmental parameters

Since we are interested in probing the role of environment in AGN triggering,
we estimate environmental parameters using the DIScrete PERsistent Structure
Extractor (DisPerSE; Sousbie et al., 2011). Following Laigle et al. (2018) and
Lazar et al. (2023), we use DisPerSE to construct topological maps of the
large-scale structure within the COSMOS footprint, in our redshift range of
interest111Libeskind et al. (2018) provide a comprehensive comparison of
filament finding algorithms including DisPerSE..

DisPerSE computes a discrete Morse complex, using the Delaunay tessellation
field estimator (DTFE; Schaap & van de Weygaert, 2000; Cautun & van de
Weygaert, 2011) to create a density map. It first uses galaxy positions to
compute Delaunay tessellations, i.e. the triangulation of discrete points such
that no points from the defining distribution are within any of the resulting
triangles. It then computes the density ($\delta$) of the resulting cells,
where $\delta$ = (area of cell)-1, and identifies the locations of stationary
points (i.e. maxima, minima and saddle points). Finally, from this computed
density field, segments are used to connect the nodes with the saddle points.
The set of segments represents the filamentary structure of the cosmic web.

DisPerSE utilises the concept of persistence to ensure the robustness of its
density maps. It defines a persistence parameter ($N$) which serves as a
threshold for the critical pairs that contribute to the density map and is
important for constructing a robust filament structure devoid of noisy
structures. The algorithm only retains critical pairs which have Poisson
probabilities above $N\sigma$ from the mean. Following Laigle et al. (2018)
and Lazar et al. (2023), we set $N$ equal to 2. We use massive
($M_{\rm{\star}}$ > 1010 M⊙) galaxies to build our density maps, as they
dominate the local gravitational potential, with the thicknesses of the slices
($\delta z\sim 0.03$) being driven by the median redshift uncertainties of the
massive galaxies.

###  2.3 Sample Selection

As noted in the introduction, given the depth of the photometry in COSMOS2020,
complete samples of dwarfs can be constructed down to $M_{\rm{\star}}$ $\sim$
108 M⊙, out to at least $z\sim 0.3$ (e.g. Jackson et al., 2021). For our
study, we leverage the COSMOS2020 catalogue to pre-select our galaxies as
follows. Tests indicate that, for the same set of UV – MIR photometric data
points, the stellar masses outputted by Prospector are slightly larger than
those produced by LePhare (which underpins COSMOS2020) by around 0.3 dex (this
trend has also been noted by Pacifici et al. (2023)). Our pre-selected sample
consists of COSMOS2020 galaxies at $0.1<z<0.3$ in which the 16th percentile
(i.e. the -1$\sigma$) value of the probability density function (PDF) of the
stellar mass is greater than 107.5 M⊙ and the 84th percentile (i.e. the
+1$\sigma$) value is less than 109.5 M⊙.

There are $\sim$6500 such COSMOS2020 objects which are both classified as
galaxies in this catalogue (lp_type = 0) and as ‘extended’ (i.e. galaxies) in
the $g$, $r$, $i$ and $z$ bands by the HSC pipeline and which lie outside
masked regions such as bright star masks and image edges. Of these, 1146
galaxies have the full complement of UV to MIR photometry. These galaxies form
the initial sample of objects on which we perform SED fitting using
Prospector, as described in Section 3 below. For each galaxy, we use the
photometric redshift from the COSMOS2020 catalogue and the median stellar mass
as a first guess in the SED fitting process. As described in Section 4 below,
when identifying AGN and studying their properties, we refine the sample
further, by applying additional cuts on redshift accuracy and the quality of
the SED fits from Prospector.

###  2.4 Morphological classification using HST/F814W images

We use visual inspection of HST F814W ($I$-band) images of the COSMOS field
(Koekemoer et al., 2007; Massey et al., 2010) to morphologically classify our
dwarf galaxy sample. These images have a 5$\sigma$ point-source depth of 27.8
mag and an angular resolution of $\sim$0.05 arcseconds. The visual inspection
is performed by one expert classifier (SK). We classify our dwarfs into two
broad morphological classes: early-type galaxies (ETGs) and late-type galaxies
(LTGs). We also flag galaxies that show evidence of an ongoing or recent
interaction e.g. tidal features, internal asymmetries or tidal bridges due to
an ongoing merger with another galaxy. Figure 1 presents example images of our
dwarfs, including ETGs (top row), LTGs (middle row) and interacting systems
(bottom row). Images in the first three columns in the bottom row show
examples of interacting ETGs, while the last three columns show examples of
interacting LTGs.

##  3 SED fitting using Prospector

We use Prospector, a Python-based SED-fitting code to fit the photometry of
our dwarf sample. Prospector is a Bayesian forward-modelling code (see Table 1
in Pacifici et al., 2023, for a list of popular codes in the current
literature) that can be used to infer galaxy properties, using either
photometric or spectro-photometric data. Prospector is able to fit either
parametric or non-parametric star formation histories (SFHs) to galaxy data
and simultaneously constrain the AGN contribution to the SED. The code uses
the Flexible Stellar Population Synthesis package (FSPS; Conroy et al., 2009)
to generate SED models on the fly using Python-FSPS (Foreman-Mackey et al.,
2014).

We sample the posterior parameter distribution using Dynesty (Speagle, 2020),
which utilises the dynamic nested sampling algorithms of Higson et al. (2019).
We adopt the non-parametric continuity-sfh models within Prospector as a basis
for our analysis. Compared to their parametric counterparts, non-parametric
models can typically explore more complex SFHs, which can include features
like starbursts and episodes of quenching and rejuvenation (e.g. Simha et al.,
2014; Diemer et al., 2017; Leja et al., 2019; Johnson et al., 2021), which are
challenging to explore using parametric models (e.g. Suess et al., 2022).

The parameters in the Prospector model that we use for our analysis are
briefly described below and summarised in Table 1.

Parameter | Prior | Description
---|---|---
$\log(M_{\star}$/M⊙) |  Uniform (min = $5$, max = $13$) | Stellar mass
$\log r_{\rm i}$ | Student’s t-distribution | Ratio of SFRs in adjacent bins
$\log(Z_{\star}/Z_{\odot})$ |  Uniform (min =$-2.0$, max = $0.2$) | Stellar metallicity
$\tau_{\rm 5500,diffuse}$ |  Clipped normal (mean = $0.3$, std. dev. = $1.0$, min = $0$, max = $4$) | Optical depth of diffuse dust
$\tau_{\rm young}/\tau_{\rm diffuse}$ |  Clipped normal (mean = $1$, std. dev. = $0.3$, min = $0$, max = $1.5$) | Ratio of optical depth of birth clouds to optical depth of diffuse dust
$\Gamma_{\rm dust}$ |  Clipped normal (mean = $0$, std. dev. = $0.5$, min = $-1$, max = $0.4$) | Delta of the slope of attenuation curve compared to Calzetti law
$U_{\rm min}$ |  Uniform (min = $0.1$, max= $25$) | Minimum intensity of light affecting the dust
$Q_{\rm PAH}$ |  Uniform (min = $0.5$ , max= $7$) | Fraction of dust mass in PAHs
$\log\gamma_{\rm dust}$ | Uniform (min = -3, max = 0.15) |  Fraction of dust mass exposed to $U_{\rm min}$
$\log f_{\rm AGN}$ | Uniform (min = -5, max = 3) | AGN luminosity as a fraction of the galaxy’s bolometric luminosity
$\log\tau_{\rm AGN}$ | Uniform (min = 5, max = 150) | Optical depth of the AGN torus
$\log U_{\rm gas}$ | Uniform (min = -4, max = 1) | Gas phase ionization parameter
Table 1: SED-fitting parameters, and their associated priors, in our
Prospector model.

  * •

SFH: We implement continuity-sfh by adopting six age bins divided
logarithmically, except the first two age bins which are fixed at 0 – 30 Myr,
30 – 100 Myr and the final age bin which is fixed to cover 15 percent of the
age of the Universe. We utilise the Student’s t-distribution for the prior
(the log of the ratio of the SFRs in adjacent bins) with $\mu$ = 2 (where
$\mu$ is the number of degrees of freedom) and a scale-factor ($\sigma$) of
0.3.

  * •

Stellar mass: We adopt a uniform prior for the log of the stellar mass in the
range 5 < log ($M_{\star}$/M⊙) < 13.

  * •

Stellar metallicity: A uniform prior is adopted for the log of the stellar
metallicity in the range -2.0 < log ($Z_{\star}/\rm Z_{\odot}$) < 0.2
following Leja et al. (2017). This range brackets the stellar metallicities
observed in nearby dwarf galaxies (e.g. Gallazzi et al., 2005; Panter et al.,
2008).

  * •

Dust attenuation: Following Johnson et al. (2021), we implement the two-
component Charlot & Fall (2000) dust model that treats the effect of dust from
birth clouds (which impacts young stars) separately from that due to the
diffuse dust (which impacts light from both young and old stars). Following
Kriek & Conroy (2013), the strength of the UV bump is tied to the power-law
index of the curve (because steeper attenuation laws tend to have stronger
bumps). As described in Table 1, the three parameters used to describe dust
attenuation are the optical depth of the diffuse dust ($\tau_{\rm
5500,diffuse}$), the ratio of the optical depth of the birth clouds to that
due to the diffuse dust ($\tau_{\rm young}$/$\tau_{\rm diffuse}$), and a delta
modifier ($\Gamma_{\rm dust}$) to the slope of the Calzetti dust law (Calzetti
et al., 2000).

  * •

Dust emission: The dust templates adopted (Draine & Li, 2007) include infrared
emission from small and large dust grains and polycyclic aromatic hydrocarbons
(PAHs). The model includes three free parameters: $U_{\rm min}$, $\gamma_{\rm
dust}$ and $Q_{\rm PAH}$. $\gamma_{\rm dust}$ describes the fraction of dust
mass affected by the minimum intensity of starlight required to heat up the
diffuse dust and interstellar medium in the galaxy ($U_{\rm min}$). $Q_{\rm
PAH}$ describes the fraction of dust mass contributed by PAHs, which are
responsible for strong emission in the mid-infrared wavelengths. A uniform
prior is adopted for all three free parameters within the ranges shown in
Table 1.

  * •

AGN templates: The AGN templates adopted by Prospector are based on the CLUMPY
models (Nenkova et al., 2008a, b) and include two free parameters:
$f_{\rm{AGN}}$ and $\tau_{\rm{AGN}}$. $f_{\rm{AGN}}$ describes the ratio of
the AGN luminosity to the galaxy’s bolometric luminosity, while the latter
describes the optical depth of the AGN torus. We adopt a uniform prior in the
log of these parameters, within the ranges shown in Table 1.

  * •

Nebular emission: Nebular emission in Prospector uses the FSPS implementation
of the CLOUDY photoionization code (Ferland et al., 2013), where the ionising
sources are the stellar populations produced by FSPS, as described by Byler et
al. (2017). The model is parametrized by the gas phase metallicity and the
ionization parameter, $U_{\rm gas}$ (Leja et al., 2017). Following the default
implementation within Prospector, we tie the gas-phase metallicity to the
stellar metallicity and allow the log of the ionization parameter to vary
between -4 and 1.

We consider the acceptability of our fits following Smith et al. (2012). A fit
is considered to be acceptable if its best-fit $\chi^{2}$ is below the 99
percent confidence threshold for the given number of photometric bands. We fit
each galaxy with and without the AGN templates. We use the ratio of the
$\chi^{2}$ of the best-fit model with and without the AGN templates to
estimate the significance of including an AGN in the fit. As described in
Section 4.1 below, we then use that information, together with the value of
$f_{\rm AGN}$, to identify dwarfs which are likely to show signs of AGN
activity.

##  4 AGN in nearby dwarf galaxies

In this section we use the outputs from our SED fitting to probe the incidence
of AGN in nearby dwarfs, study the role of interactions and environment in AGN
triggering and compare the star formation activity in dwarf AGN to their non-
AGN counterparts. For the analysis below, we restrict our initial sample of
$1146$ galaxies to those which have photometric redshift errors less than 20
per cent and have acceptable fits as described above. This produces a final
sample of 508 dwarf galaxies that underpins our analysis below. Of these, 476
galaxies (i.e. around 94 per cent) lie within the HST footprint and our
morphological analysis in Section 4.3 is therefore restricted to these
systems. It is worth noting that, by construction, the AGN that we study here
are only those that are radiatively-efficient and leave a signature in the UV
to MIR wavelengths. The stellar mass and SFR values used in our analysis below
are the median values of these parameters, calculated using Prospector, for
each galaxy.

###  4.1 The incidence of AGN in dwarf galaxies

While we use the median values of stellar mass and SFR, we employ the 5th
percentile values of $f_{\rm{AGN}}$, denoted by $f_{\rm{AGN,5}}$ hereafter, to
identify dwarfs which show signs of AGN activity in our sample. This ensures
that 95 per cent of the $f_{\rm{AGN}}$ distribution in each galaxy is above
the chosen threshold that defines an AGN. This is more conservative than
using, for example, the 16th percentile value, as in other recent studies
(e.g. Das et al., 2024; Best et al., 2023). Figure 2 presents the values of
$f_{\rm{AGN,5}}$ in our final sample of dwarfs. The bimodality of the
distribution (around $\log f_{\rm{AGN,5}}\sim-2.8$) suggests the presence of a
population of AGN in these dwarf galaxies that could be demarcated by this
value. We use this distribution to define AGN as galaxies where (1) $\log
f_{\rm{AGN,5}}>-2.8$ and (2) including the AGN in the fitting improves the
quality of the fit (i.e. the $\chi^{2}$ value of the best-fit model with AGN
templates included is smaller than its counterpart without an AGN). The red
histogram denotes the galaxy population that we define to be AGN in our
sample. The grey histogram denotes non-AGN i.e. galaxies that either have
$\log f_{\rm{AGN,5}}<-2.8$ or have $\log f_{\rm{AGN,5}}>-2.8$ but where
including the AGN templates does not result in a better fit.

Figure 2: Distribution of $f_{\rm{AGN,5}}$ in our final sample of 508 dwarf galaxies, which exhibits a bimodality around $\log f_{\rm{AGN,5}}\sim-2.8$. The red histogram denotes galaxies that we define to be AGN. These are galaxies which have $\log f_{\rm{AGN,5}}>-2.8$ and in which including the AGN in the fitting improves the quality of the fit (i.e. the $\chi^{2}$ value of the best-fit model with an AGN template included is smaller than its counterpart without an AGN). The grey histogram corresponds to galaxies that are classified as non-AGN. These are systems that either have $\log f_{\rm{AGN,5}}<-2.8$ or where $\log f_{\rm{AGN,5}}>-2.8$ but including the AGN does not result in a better fit (see the text in Section 4.1 for more details). Figure 3: The contribution of dwarf AGN in different parts of the Prospector-derived stellar mass vs $f_{\rm{AGN,5}}$ parameter space to the overall AGN percentage in our dwarf sample. The histogram shows how this contribution varies as a function of $f_{\rm{AGN,5}}$ (regardless of the value of stellar mass). Summing the numbers in either the heatmap or the histogram yields the overall AGN percentage of $\sim$32 per cent. | AGN | Control
---|---|---
Median projected distance to nearest node (Mpc) | $3.16\pm 0.42$ | $2.56\pm 0.24$
Median projected distance to nearest filament (Mpc) | $0.76\pm 0.13$ | $0.84\pm 0.11$
Median projected distance to nearest massive galaxy (Mpc) | $0.53\pm 0.09$ | $0.48\pm 0.08$
Fraction of galaxies which are ETGs | $0.30\pm 0.04$ | $0.33\pm 0.04$
Fraction of galaxies that are interacting | $0.14\pm 0.03$ | $0.16\pm 0.03$
Median log (sSFR / yr-1) | $-10.37\pm 0.05$ | $-10.22\pm 0.04$
Table 2: Comparisons of various quantities between dwarf AGN and control
samples constructed from the non-AGN dwarfs which have the same distributions
of redshift and stellar mass as the AGN. Note that, while the analysis in rows
1–3 is restricted to the redshift range $0.2<z<0.3$ (because, as noted in
Section 4.2, there are not enough massive galaxies to create reliable density
maps at $z<0.2$), the analysis in rows 4-6 uses the full redshift range of our
study ($0.1<z<0.3$). Rows 1–3 compare the distances to nodes, filaments and
massive galaxies of the AGN and their control counterparts. The number of AGN
on which this environmental analysis is based is 63. Rows 4 and 5 compare the
fractions of AGN and control galaxies that are classified as ETGs and
interacting respectively. The number of AGN which have HST images and underpin
the analysis in these rows is 155. The uncertainties in rows 1–5 are
calculated following Cameron (2011). Row 6 compares the median specific SFR
(sSFR) of dwarf AGN to their control counterparts. The number of AGN that
underpins this analysis is 162. The uncertainties in this row are calculated
via bootstrapping.

It is worth noting that the typical spatial scales of accretion disks are
around $\sim$10-2 pc (e.g. Hawkins, 2007). This is around 5 orders of
magnitude smaller on a linear scale (and therefore around 15 orders of
magnitude smaller in terms of volume) than the host dwarf galaxies, which have
spatial scales of around a kpc (e.g. Watkins et al., 2023). Values of $\log
f_{\rm{AGN,5}}$ values greater than -2.8 (i.e. $f_{\rm{AGN,5}}$ values greater
than $\sim$0.16 per cent) may, therefore, represent relatively bright
radiatively-efficient AGN in our dwarf population. Given the selection
criteria above, around a third (162 out of 508 or 32 $\pm$ 2 per cent) of the
dwarfs in our sample show signs of AGN activity.

In Figure 3, we show the contribution of dwarf AGN in different parts of the
$f_{\rm{AGN,5}}$ vs stellar mass space to the overall percentage of galaxies
classified as AGN in our dwarf sample. The histogram shows how this
contribution varies as a function of $f_{\rm{AGN,5}}$ (regardless of the value
of stellar mass). Summing the numbers in the heatmap or the histogram yields
the overall AGN percentage (around 32 per cent) within our dwarf sample.
Recall that the galaxy population studied here is likely to be complete down
to $M_{\rm{\star}}$ $\sim$ 108 M⊙, out to $z\sim 0.3$ (Jackson et al., 2021).

While past studies have estimated BH occupation and active fractions in dwarfs
via different methods, our estimate for the AGN fraction in dwarfs is
consistent with the findings of the recent dwarf literature. Recent work
indicates that the BH occupation fraction in dwarfs is likely to be high
(estimates typically vary between 40 and 100 per cent within the stellar mass
range probed in this study, see e.g. Ricarte & Natarajan, 2018; Bellovary et
al., 2019; Nguyen et al., 2019). Inevitably, the active fractions are lower.

For example, Mezcua & Domínguez Sánchez (2024) use spatially-resolved
emission-line diagnostics from integral-field spectroscopy to estimate an AGN
fraction of 20 per cent in SDSS dwarfs. This is consistent with the fractions
found using mid-infrared photometry (10–30 per cent, e.g. Kaviraj et al.,
2019). It is interesting to note that the AGN fractions derived using a
spaxel-by-spaxel analysis, as performed by Mezcua & Domínguez Sánchez (2024),
are much larger than those derived using single fibre diagnostics in the SDSS
($\sim$ 1 per cent). This is because, as noted in the introduction, the star
formation activity across the galaxy is likely to swamp the emission-line
signal due to the AGN in the highly star-forming dwarfs that are detectable in
the SDSS. A spatially-resolved analysis, on the other hand, is able to isolate
the region that may host an AGN, thus enabling a more sensitive probe of its
existence within the galaxy. Interestingly, Dickey et al. (2019) use a sample
of dwarfs with a median redshift of $z\sim 0.024$ to show that, in the very
nearby Universe – where relatively unbiased dwarf samples can be constructed
even using the SDSS – around $\sim$80 per cent of quiescent dwarf galaxies in
low-density environments show central AGN-like emission-line ratios.

Pacucci et al. (2021) estimate that 5 – 22 per cent of the BHs in the dwarf
population are likely to be active. This rises to around 30 per cent if the
host metallicities are lower ($Z<\rm Z_{\odot}$), which is indeed the case for
dwarf galaxies (e.g. Gallazzi et al., 2005; Panter et al., 2008). Davis et al.
(2022) combine deep radio and optical data, from LOFAR and HSC respectively,
with theoretical models to conclude that AGN triggering in dwarfs is likely to
be stochastic and a common phenomenon. This appears consistent with the
observation that dwarfs may lie on an extrapolation of the $M$ – $\sigma$
relation seen in massive galaxies (e.g. Schutte et al., 2019; Davis et al.,
2020). Since BH feedback predicts a universal M $\propto$ $\sigma^{4}$
relation (e.g. Silk & Rees, 1998; King & Nealon, 2021), this suggests that
frequent AGN activity could be important in the dwarf regime, consistent with
the incidence of AGN being derived by recent work, including this study. Taken
together, these studies suggest a growing consensus that a significant
minority of dwarfs in the nearby Universe show signs of AGN activity.

###  4.2 The role of environment in triggering dwarf AGN

We proceed by comparing the environments of our dwarf AGN to their non-AGN
counterparts. For this analysis, we consider galaxies in the redshift range
$0.2<z<0.3$ because the relatively small number of massive galaxies at $z<0.2$
means that reliable density maps cannot be created for these redshifts. To
perform this comparison, we construct a control sample of dwarfs in which
$\log f_{\rm{AGN,5}}<-2.8$ and which has the same distributions of stellar
mass and redshift as their dwarf AGN counterparts222We construct the control
sample as follows. For each AGN we identify all non-AGN with $\log
f_{\rm{AGN,5}}<-2.8$ within stellar mass and redshift tolerances of 0.05 dex
and 0.04 respectively. We then select, at random, one of these galaxies to be
the control counterpart of the AGN in question. No control galaxy is assigned
to more than one AGN. The results in this section do not change if different
tolerances are used..

Figure 4: An example density map, generated using DisPerSE, as described in
Section 2.2 The redshift limits of the map are shown in the top left-hand
corner. Filaments are shown using solid lines, with a random subset of AGN
(filled red circles) and non-AGN (open black circles) shown overplotted.
Figure 5: Projected distances to nearest nodes (top), filaments (middle) and
massive galaxies (bottom) for dwarf AGN (red) and the control sample of non-
AGN (grey).

In Figure 4, we show an example density map, created using DisPerSE as
described in Section 2.2. The filaments are shown using solid lines and random
examples of dwarf AGN and control galaxies that reside within the redshift
slice are indicated using filled red and open black circles respectively. In
Figure 5, we present the distributions of the projected distances to the
nearest filaments, nodes and massive galaxies for the AGN and the control
sample. Median values and their associated uncertainties, calculated via
bootstrapping, are shown using the vertical lines and also described in rows
1, 2 and 3 of Table 2.

Applying a two-sample Kolmogorov-Smirnov (KS) test to the AGN and control
distributions produces $p$-values of 0.25, 0.45 and 0.99 for the distances to
nodes, filaments and massive galaxies respectively. Based on both the median
values and their uncertainties and the results of the KS tests, we do not find
evidence of a difference in these distances between the AGN and their control
counterparts. This suggests that the environment in which they reside are
unlikely to play a significant role in AGN triggering.

While various studies have probed the role of environment using different
methods, our conclusions appear consistent with the results of other recent
work which has explored the dwarf regime. For example, Kristensen et al.
(2020), who define local environment using the distance to the tenth nearest
neighbour, find that environment is not an important factor in triggering AGN
activity in dwarfs. This is similar to the results of Sabater et al. (2015),
whose galaxy sample includes objects at the upper mass end of the dwarf
regime. They find that the effect of either the local density or of galaxy
interactions is minor in the prevalence of AGN activity.

###  4.3 Morphology and the role of interactions in AGN triggering

In this section we consider the morphological properties of our dwarf AGN
compared to their non-AGN counterparts. Recall from Section 4.3 that
morphological information is available for 476 galaxies out of the final
sample of 508 which lie within the HST footprint. In a similar vein to Section
4.3 above, we construct a control sample which is matched in stellar mass and
redshift to the AGN (but this time without any restriction in redshift).

In rows 4 and 5 of Table 2, we summarise the fraction of AGN and control
galaxies that are classified as ETGs and interacting respectively. The ETG and
interacting fractions in the AGN and control samples are indistinguishable,
given the uncertainties. The similar interacting fractions, combined with the
fact that interactions reinforce dispersion-dominated ETG-like structures over
time (e.g. Martin et al., 2018), suggests that this process does not play a
significant role in triggering the AGN in this study. This result appears
aligned with the findings of Kaviraj et al. (2019), who have shown that the
fraction of dwarf AGN in ongoing mergers does not appear to show an excess
compared to that in their control counterparts. It is also consistent with the
fact that AGN appear not to preferentially occupy regions of higher density
(from Section 4.2 above) where the incidence of interactions is likely to be
higher. Finally, it is worth noting that the lack of influence of either local
environment or the presence of interactions appears consistent with the
conclusions of Davis et al. (2022) that AGN triggering in the dwarf regime may
be a largely stochastic process.

###  4.4 Star formation activity in dwarf AGN

We conclude our study by exploring whether there are differences in the star
formation activity of dwarfs which contain AGN and those which do not. In
particular, it is interesting to explore whether, given their relatively
shallow potential wells, dwarf galaxies may be more susceptible to prompt
quenching of star formation than their massive counterparts. In row 6 of Table
2, we compare the median values of the specific SFRs (sSFRs), and their
associated uncertainties, in dwarf AGN with those of the control sample
defined in Section 4.3. Given the median values and their uncertainties, the
star formation activity in the AGN is marginally lower compared to those in
their control counterparts. However, we do not find evidence of a significant,
prompt quenching of star formation in dwarf galaxies which host AGN activity.

It is worth discussing this result in the context of AGN feedback suppressing
star formation in dwarf galaxies, the potential for which has been
demonstrated from both theoretical (Barai & de Gouveia Dal Pino, 2019;
Koudmani et al., 2022; Arjona-Galvez et al., 2024) and empirical (e.g. Penny
et al., 2018) points of view. Recent work has shown that the presence of AGN
feedback does not necessarily manifest itself in lower instantaneous SFRs
during individual star formation episodes (e.g. Ward et al., 2022). Rather,
the indicators of quenching correlate more strongly with the BH mass, which is
a measure of the cumulative output of the AGN over the lifetime of the galaxy
(e.g. Piotrowska et al., 2022). While measuring BH masses is beyond the scope
of this study, we note that our results do not argue against AGN feedback
having an influence on star formation in the dwarf regime. Indeed, recent work
(e.g. Davis et al., 2022) has suggested that the central gas reservoirs in
dwarfs are much larger than what is required to fuel the black hole and the
energetics suggest that AGN feedback is both plausible and likely in these
systems.

##  5 Summary

We have employed SED fitting via Prospector using deep UV to MIR broadband
photometry in the COSMOS field, to search for radiatively-efficient AGN in
nearby ($0.1<z<0.3$) dwarf (108 M⊙ < $M_{\rm{\star}}$ < 1010 M⊙) galaxies. We
have explored the percentage of nearby dwarfs that show signs of AGN activity,
investigated the potential role of environment and interactions in triggering
our AGN and studied whether the sSFRs of our AGN are different from their non-
AGN counterparts. Our main conclusions are as follows:

  * •

Around a third (32 $\pm$ 2 per cent) of dwarf galaxies in our sample show
signs of AGN activity, consistent with the dwarf AGN fractions derived, via
various techniques, in the recent literature.

  * •

The local environments of dwarf AGN, parameterised by the projected distances
to nodes, filaments and massive galaxies, are indistinguishable from those of
a control sample (which has the same distribution of redshift and stellar
mass) constructed from non-AGN dwarfs. This suggests that local environment is
not likely to play a significant role in AGN triggering.

  * •

The early-type and interacting fractions in our AGN are also indistinguishable
from those of a control sample, suggesting that the onset of AGN, at least in
the sample studied here, is not strongly influenced by galaxy interactions.

  * •

Given the median values of sSFR and their uncertainties, the star formation
activity in dwarf AGN is marginally lower compared to those in their control
counterparts. However, we do not find strong evidence of a significant, prompt
quenching of star formation in dwarf galaxies which host AGN activity.

Our study adds to the burgeoning body of work which suggests that a
significant minority of nearby dwarf galaxies show signs of AGN activity. It
also demonstrates the potential of SED fitting for exploring AGN populations
within dwarfs in future multi-wavelength deep-wide datasets. These studies
will be important, both for putting such results on a firmer statistical
footing, and for exploring how the AGN populations in dwarfs may evolve over
cosmic time.

## Acknowledgements

We thank the referee for several constructive comments that improved the
presentation of the paper. BB and IL acknowledge PhD studentships from the
Centre for Astrophysics Research at the University of Hertfordshire. SK and
AEW acknowledge support from the STFC (grant numbers ST/S00615X/1 and
ST/X001318/1). SK also acknowledges a Senior Research Fellowship from
Worcester College Oxford. SD acknowledges support from the STFC via grant
ST/W507490/1. DJBS acknowledges support from the STFC via grant ST/V000624/1.
For the purpose of open access, the author has applied a Creative Commons
Attribution (CC BY) licence to any Author Accepted Manuscript version arising
from this submission.

## Data Availability

The parameters calculated in this study can be shared upon reasonable request
to the authors.

## References

  * Aihara et al. (2018) Aihara H., et al., 2018, PASJ, 70, S8
  * Aihara et al. (2019) Aihara H., et al., 2019, PASJ, 71, 114
  * Alam et al. (2015) Alam S., et al., 2015, ApJS, 219, 12
  * Arjona-Galvez et al. (2024) Arjona-Galvez E., Di Cintio A., Grand R. J. J., 2024, arXiv e-prints, p. arXiv:2402.00929
  * Ashby et al. (2013) Ashby M. L. N., et al., 2013, ApJ, 769, 80
  * Ashby et al. (2015) Ashby M. L. N., et al., 2015, ApJS, 218, 33
  * Ashby et al. (2018) Ashby M. L. N., et al., 2018, ApJS, 237, 39
  * Assef et al. (2010) Assef R. J., et al., 2010, ApJ, 713, 970
  * Baldassare et al. (2020) Baldassare V. F., Geha M., Greene J., 2020, ApJ, 896, 10
  * Baldwin et al. (1981) Baldwin J. A., Phillips M. M., Terlevich R., 1981, PASP, 93, 5
  * Barai & de Gouveia Dal Pino (2019) Barai P., de Gouveia Dal Pino E. M., 2019, MNRAS, 487, 5549
  * Beckmann et al. (2017) Beckmann R. S., et al., 2017, MNRAS, 472, 949
  * Bellovary et al. (2019) Bellovary J. M., Cleary C. E., Munshi F., Tremmel M., Christensen C. R., Brooks A., Quinn T. R., 2019, MNRAS, 482, 2913
  * Best et al. (2023) Best P. N., et al., 2023, MNRAS, 523, 1729
  * Byler et al. (2017) Byler N., Dalcanton J. J., Conroy C., Johnson B. D., 2017, ApJ, 840, 44
  * Calzetti et al. (2000) Calzetti D., Armus L., Bohlin R. C., Kinney A. L., Koornneef J., Storchi-Bergmann T., 2000, ApJ, 533, 682
  * Cameron (2011) Cameron E., 2011, Publ. Astron. Soc. Australia, 28, 128
  * Cautun & van de Weygaert (2011) Cautun M. C., van de Weygaert R., 2011, arXiv e-prints, p. arXiv:1105.0370
  * Charlot & Fall (2000) Charlot S., Fall S. M., 2000, ApJ, 539, 718
  * Cid Fernandes et al. (2010) Cid Fernandes R., Stasińska G., Schlickmann M. S., Mateus A., Vale Asari N., Schoenell W., Sodré L., 2010, MNRAS, 403, 1036
  * Cid Fernandes et al. (2011) Cid Fernandes R., Stasińska G., Mateus A., Vale Asari N., 2011, MNRAS, 413, 1687
  * Conroy et al. (2009) Conroy C., Gunn J. E., White M., 2009, ApJ, 699, 486
  * Das et al. (2024) Das S., et al., 2024, MNRAS, 531, 977
  * Davies et al. (2023) Davies R. L., et al., 2023, arXiv e-prints, p. arXiv:2310.17939
  * Davis et al. (2020) Davis T. A., et al., 2020, MNRAS, 496, 4061
  * Davis et al. (2022) Davis F., et al., 2022, MNRAS, 511, 4109
  * Delvecchio et al. (2014) Delvecchio I., et al., 2014, MNRAS, 439, 2736
  * Delvecchio et al. (2017) Delvecchio I., et al., 2017, A&A, 602, A3
  * Dickey et al. (2019) Dickey C. M., Geha M., Wetzel A., El-Badry K., 2019, ApJ, 884, 180
  * Diemer et al. (2017) Diemer B., Sparre M., Abramson L. E., Torrey P., 2017, ApJ, 839, 26
  * Draine & Li (2007) Draine B. T., Li A., 2007, ApJ, 657, 810
  * Driver et al. (2022) Driver S. P., et al., 2022, MNRAS, 513, 439
  * Dubois et al. (2021) Dubois Y., et al., 2021, A&A, 651, A109
  * Fabian (2012) Fabian A. C., 2012, ARA&A, 50, 455
  * Fazio et al. (2004) Fazio G. G., et al., 2004, ApJS, 154, 10
  * Ferland et al. (2013) Ferland G. J., et al., 2013, Rev. Mex. Astron. Astrofis., 49, 137
  * Foreman-Mackey et al. (2014) Foreman-Mackey D., Sick J., Johnson B., 2014, python-fsps: Python bindings to FSPS (v0.1.1), doi:10.5281/zenodo.12157, https://doi.org/10.5281/zenodo.12157
  * Gaia Collaboration et al. (2016) Gaia Collaboration et al., 2016, A&A, 595, A1
  * Gallazzi et al. (2005) Gallazzi A., Charlot S., Brinchmann J., White S. D. M., Tremonti C. A., 2005, MNRAS, 362, 41
  * Greene & Ho (2007) Greene J. E., Ho L. C., 2007, ApJ, 670, 92
  * Gürkan et al. (2018) Gürkan G., et al., 2018, MNRAS, 475, 3010
  * Hawkins (2007) Hawkins M. R. S., 2007, A&A, 462, 581
  * Hickox & Alexander (2018) Hickox R. C., Alexander D. M., 2018, ARA&A, 56, 625
  * Higson et al. (2019) Higson E., Handley W., Hobson M., Lasenby A., 2019, Statistics and Computing, 29, 891
  * Ivezić et al. (2019) Ivezić Ž., et al., 2019, ApJ, 873, 111
  * Jackson et al. (2021) Jackson R. A., et al., 2021, MNRAS, 502, 4262
  * Johnson et al. (2019) Johnson B. D., Leja J. L., Conroy C., Speagle J. S., 2019, Prospector: Stellar population inference from spectra and SEDs (ascl:1905.025)
  * Johnson et al. (2021) Johnson B. D., Leja J., Conroy C., Speagle J. S., 2021, ApJS, 254, 22
  * Kaviraj et al. (2017) Kaviraj S., et al., 2017, MNRAS, 467, 4739
  * Kaviraj et al. (2019) Kaviraj S., Martin G., Silk J., 2019, MNRAS, 489, L12
  * Kewley et al. (2001) Kewley L. J., Dopita M. A., Sutherland R. S., Heisler C. A., Trevena J., 2001, ApJ, 556, 121
  * King & Nealon (2021) King A., Nealon R., 2021, MNRAS, 502, L1
  * Koekemoer et al. (2007) Koekemoer A. M., et al., 2007, ApJS, 172, 196
  * Koudmani et al. (2022) Koudmani S., Sijacki D., Smith M. C., 2022, MNRAS, 516, 2112
  * Kriek & Conroy (2013) Kriek M., Conroy C., 2013, ApJ, 775, L16
  * Kristensen et al. (2020) Kristensen M. T., Pimbblet K., Penny S., 2020, MNRAS, 496, 2577
  * Laigle et al. (2016) Laigle C., et al., 2016, ApJS, 224, 24
  * Laigle et al. (2018) Laigle C., et al., 2018, MNRAS, 474, 5437
  * Latimer et al. (2019) Latimer L. J., Reines A. E., Plotkin R. M., Russell T. D., Condon J. J., 2019, ApJ, 884, 78
  * Lazar et al. (2023) Lazar I., Kaviraj S., Martin G., Laigle C., Watkins A., Jackson R. A., 2023, MNRAS, 520, 2109
  * Lazar et al. (2024) Lazar I., Kaviraj S., Watkins A. E., Martin G., Bichang’a B., Jackson R. A., 2024, arXiv e-prints, p. arXiv:2402.12440
  * Leja et al. (2017) Leja J., Johnson B. D., Conroy C., van Dokkum P. G., Byler N., 2017, ApJ, 837, 170
  * Leja et al. (2018) Leja J., Johnson B. D., Conroy C., van Dokkum P., 2018, ApJ, 854, 62
  * Leja et al. (2019) Leja J., Carnall A. C., Johnson B. D., Conroy C., Speagle J. S., 2019, ApJ, 876, 3
  * Libeskind et al. (2018) Libeskind N. I., et al., 2018, MNRAS, 473, 1195
  * Lofthouse et al. (2018) Lofthouse E. K., Kaviraj S., Smith D. J. B., Hardcastle M. J., 2018, MNRAS, 479, 807
  * Marleau et al. (2017) Marleau F. R., Clancy D., Habas R., Bianconi M., 2017, A&A, 602, A28
  * Martin et al. (2018) Martin G., Kaviraj S., Devriendt J. E. G., Dubois Y., Pichon C., 2018, MNRAS, p. 1855
  * Martin et al. (2019) Martin G., et al., 2019, MNRAS, 485, 796
  * Martínez-Palomera et al. (2020) Martínez-Palomera J., Lira P., Bhalla-Ladd I., Förster F., Plotkin R. M., 2020, ApJ, 889, 113
  * Massey et al. (2010) Massey R., Stoughton C., Leauthaud A., Rhodes J., Koekemoer A., Ellis R., Shaghoulian E., 2010, MNRAS, 401, 371
  * Mateo (1998) Mateo M. L., 1998, ARA&A, 36, 435
  * McCracken et al. (2012) McCracken H. J., et al., 2012, A&A, 544, A156
  * Mezcua & Domínguez Sánchez (2024) Mezcua M., Domínguez Sánchez H., 2024, MNRAS, 528, 5252
  * Mezcua et al. (2018) Mezcua M., Civano F., Marchesi S., Suh H., Fabbiano G., Volonteri M., 2018, MNRAS, 478, 2576
  * Mezcua et al. (2019) Mezcua M., Suh H., Civano F., 2019, MNRAS, 488, 685
  * Nenkova et al. (2008a) Nenkova M., Sirocky M. M., Ivezić Ž., Elitzur M., 2008a, ApJ, 685, 147
  * Nenkova et al. (2008b) Nenkova M., Sirocky M. M., Nikutta R., Ivezić Ž., Elitzur M., 2008b, ApJ, 685, 160
  * Nguyen et al. (2019) Nguyen D. D., et al., 2019, ApJ, 872, 104
  * Nyland et al. (2017) Nyland K., et al., 2017, ApJ, 845, 50
  * Pacifici et al. (2023) Pacifici C., et al., 2023, ApJ, 944, 141
  * Pacucci et al. (2021) Pacucci F., Mezcua M., Regan J. A., 2021, ApJ, 920, 134
  * Panter et al. (2008) Panter B., Jimenez R., Heavens A. F., Charlot S., 2008, MNRAS, 391, 1117
  * Penny et al. (2018) Penny S. J., et al., 2018, MNRAS, 476, 979
  * Piotrowska et al. (2022) Piotrowska J. M., Bluck A. F. L., Maiolino R., Peng Y., 2022, MNRAS, 512, 1052
  * Reines et al. (2013) Reines A. E., Greene J. E., Geha M., 2013, ApJ, 775, 116
  * Reines et al. (2020) Reines A. E., Condon J. J., Darling J., Greene J. E., 2020, ApJ, 888, 36
  * Ricarte & Natarajan (2018) Ricarte A., Natarajan P., 2018, MNRAS, 474, 1995
  * Richstone et al. (1998) Richstone D., et al., 1998, Nature, 385, A14
  * Sabater et al. (2015) Sabater J., Best P. N., Heckman T. M., 2015, MNRAS, 447, 110
  * Satyapal et al. (2018) Satyapal S., Abel N. P., Secrest N. J., 2018, ApJ, 858, 38
  * Sawicki et al. (2019) Sawicki M., et al., 2019, MNRAS, 489, 5202
  * Schaap & van de Weygaert (2000) Schaap W. E., van de Weygaert R., 2000, A&A, 363, L29
  * Schutte et al. (2019) Schutte Z., Reines A. E., Greene J. E., 2019, ApJ, 887, 245
  * Shimwell et al. (2019) Shimwell T. W., et al., 2019, A&A, 622, A1
  * Silk (2017) Silk J., 2017, ApJ, 839, L13
  * Silk & Rees (1998) Silk J., Rees M. J., 1998, A&A, 331, L1
  * Simha et al. (2014) Simha V., Weinberg D. H., Conroy C., Dave R., Fardal M., Katz N., Oppenheimer B. D., 2014, arXiv e-prints, p. arXiv:1404.0402
  * Smith et al. (2012) Smith D. J. B., et al., 2012, MNRAS, 427, 703
  * Sousbie et al. (2011) Sousbie T., Pichon C., Kawahara H., 2011, MNRAS, 414, 384
  * Speagle (2020) Speagle J. S., 2020, MNRAS, 493, 3132
  * Steinhardt et al. (2014) Steinhardt C. L., et al., 2014, ApJ, 791, L25
  * Strauss et al. (2002) Strauss M. A., et al., 2002, AJ, 124, 1810
  * Suess et al. (2022) Suess K. A., et al., 2022, ApJ, 935, 146
  * Thorne et al. (2022) Thorne J. E., et al., 2022, MNRAS, 509, 4940
  * Tolstoy et al. (2009) Tolstoy E., Hill V., Tosi M., 2009, ARA&A, 47, 371
  * Volonteri et al. (2021) Volonteri M., Habouzit M., Colpi M., 2021, Nature Reviews Physics, 3, 732
  * Ward et al. (2022) Ward S. R., Harrison C. M., Costa T., Mainieri V., 2022, MNRAS, 514, 2936
  * Watkins et al. (2023) Watkins A. E., Salo H., Kaviraj S., Collins C. A., Knapen J. H., Venhola A., Román J., 2023, MNRAS, 521, 2012
  * Weaver et al. (2022) Weaver J. R., et al., 2022, ApJS, 258, 11
  * Wright et al. (2017) Wright A. H., et al., 2017, MNRAS, 470, 283
  * York et al. (2000) York D. G., et al., 2000, AJ, 120, 1579
  * Zamojski et al. (2007) Zamojski M. A., et al., 2007, ApJS, 172, 468


# Soft Adversarial Training Can Retain Natural Accuracy

Abhijith Sharma
The University of British Columbia
Canada
<EMAIL_ADDRESS>Apurva Narayan
The University of British Columbia
Canada
<EMAIL_ADDRESS>
###### Abstract

Adversarial training for neural networks has been in the limelight in recent
years. The advancement in neural network architectures over the last decade
has led to significant improvement in their performance. It sparked an
interest in their deployment for real-time applications. This process
initiated the need to understand the vulnerability of these models to
adversarial attacks. It is instrumental in designing models that are robust
against adversaries. Recent works have proposed novel techniques to counter
the adversaries, most often sacrificing natural accuracy. Most suggest
training with an adversarial version of the inputs, constantly moving away
from the original distribution. The focus of our work is to use abstract
certification to extract a subset of inputs for (hence we call it ’soft’)
adversarial training. We propose a training framework that can retain natural
accuracy without sacrificing robustness in a constrained setting. Our
framework specifically targets moderately critical applications which require
a reasonable balance between robustness and accuracy. The results testify to
the idea of soft adversarial training for the defense against adversarial
attacks. At last, we propose the scope of future work for further improvement
of this framework.

##  1 Introduction

Deep Neural Networks (DNNs) have been through tremendous advancement in recent
times. Unsurprisingly, we have also observed a simultaneous interest among the
researchers to adopt deep learning techniques for the models in various
applications. Especially, DNNs are being extensively utilised in designing
models for computer vision [21], [8] and natural language processing (NLP)
[14] applications. Although there are many areas where DNNs can be adopted
apart from the two stated above, we have settled for conventional machine
learning methods due to the lack of interpretability in DNNs. Most of these
examples can be attributed to the applications in business contexts, where
feature engineering on top of machine learning models [4] is adopted to
achieve the goals. Even though, the shortcoming of lack of interpretability in
DNNs is quite evident, but we cannot take away their credit for powerful
behavior. In the past decade, researchers have been quite involved in the
process of producing more and more powerful models. It induced an unwavering
interest among researchers for its implementation in critical real-time
systems. Interestingly, until quite recently, we were ignorant of the
robustness aspect of DNN models. It unveiled an unexplored space of DNN’s
behavior against adversarial attacks.
Despite the powerful capabilities of DNNs, the lack of reliability and
explainability in the technique restricts it from playing a comprehensive role
in a real-time system. Hence, it became increasingly necessary to understand
and explain the behavior of DNNs even in vision or NLP-based applications.
Some of the famous works of [6] and [13] have exposed the vulnerability of
neural networks against adversaries. Moreover, [15] has demonstrated that the
attacks are transferable, which implies that it is effortless to design an
attack even without the exact knowledge of the model. Even though producing a
secure DNN model is an active area of research, authors in [12] have shown
that the idea is achievable. Another exciting approach towards interpretable
artificial intelligence, focusing on developing robust models against attacks,
is evident in the work of [5]. In this work, the authors proposed an idea of
abstract approximation of possible perturbation to the inputs in the setting.
The theory of abstract interpretation dates back to the 1970s [3]. Although
prominently it was being used as an elegant theoretical framework for
automated analyzers, authors in [5] have presented a new dimension for its
utilization in analyzing neural networks. On similar lines, authors in [19],
and [18] have demonstrated certified verification of model with abstract
symbolic regions and abstract transformers for operations in the context of
neural networks.

##  2 Motivation

Our work combines the idea of adversarial training as proposed in [12] and the
abstract certification. In this paper, we propose a new training strategy by
amalgamating the conventional adversarial training and abstract interpretation
techniques to find a better space of inputs for the adversarial training.
Typically, in the traditional adversarial training, we perturb every input in
original data space and train the models with the new perturbed adversarial
space.

Actual SpaceAdversarial SpaceGood adversarial and natural accuracyGood
adversarialbad naturalaccuracyGood natural andbad
adversarialaccuracyTruckDogHorse

Figure 1: Illustration of Input Space.

However, in this process we tend to sacrifice our natural accuracy as the
model is trained on a space different from the original one. The intuition
behind our reasoning is as shown in 1. In this figure, one can see how we move
away from original distribution during adversarial attacks. Hence, in this
research we investigate the trade off between severity of adversarial attack
and natural accuracy. The safety critical applications require strong
adversarial training, however, there exist applications that are not overly
critical, and we aim for a decent trade-off between accuracy and robustness
[7], [24], [2] . In these scenarios, we do not want to perform adversarial
training on the complete set of inputs. In practice, we might observe data
points in input space that may not get affected by the adversaries. Hence, in
our work, we focus on understanding each of the inputs’ behavior through an
abstract interpretation-based certification [5] in a constrained setting.
Later, we perform an adversarial training over specific subset of original
distribution.

##  3 Background

###  3.1 Attacks and Adversarial Training

There has been extensive work on designing adversarial attacks on neural
networks, each having its specificity and specialty [1]. Subsequently, the
motivation to build robust models had led to the design of a defense mechanism
for such attacks [23]. Most of the popular defenses built to date are broadly
inspired by the setting as proposed in [12] for training against the
adversarial attack. In the problem formulation of the defenses, we consider a
robust generalization of the optimization problem as given in 1:

$\min_{x}\rho(\theta);\rho(\theta)=\mathbf{E}_{(x,y)\sim
D}\left[\max_{\delta\in S}\mathcal{L}(\theta,x+\delta,y)\right]$ (1)

The above expression is a saddle point optimization problem with an inner
maximization problem aiming for high loss with respect to adversarial example
$x+\delta$, where $\delta$ is imperceptible perturbation to the original input
x. At the same time, outer minimization problem tries to find the model
parameters to reduce the overall expected loss in classification. Here, we
incorporate adversarial attacks during the training phase for optimizing the
inner maximization problem. One of the famous attacks is Projected Gradient
Descent (PGD), which is quite simple to implement and has performed
exceptionally well in practice. It is derived from Fast Gradient Sign Method
(FGSM) [6]. It is essentially a one-step $l_{\infty}$ bounded adversary, which
finds an adversarial example as given in 2:

$x+\epsilon.sgn(\nabla_{x}\mathcal{L}(\theta,x,y))$ (2)

Predominantly, PGD is an iterative version of FGSM with an additional
projection utility to ensure the solution lies within the predefined bounds
$\epsilon$. This inherent characteristic of PGD makes it more potent than one-
step-based attacks like FGSM. Each iteration in a PGD attack is as given in
equation 3:

$x^{t+1}=\mathcal{P}_{x+S}\;(x^{t}+\alpha.sgn(\nabla_{x}\mathcal{L}(\theta,x,y)))$
(3)

where $\mathcal{P}_{x+S}$ is the projection of the point on the boundary $S$,
and $\alpha$ is the step size.

Y1.0e0]ptOUTER MINIMIZATIONY1.0e0]ptINNER MAXIMIZATION Original Data Perform
Attack Adversarial Data Train Model Model Validate

Figure 2: Traditional training procedure.

In recent times, the newer upgraded versions outperformed the idea proposed by
[12], either in efficiency [16] or speed [22]. However, all these settings are
similar in that we disturb our original distribution of inputs by generating
an adversarial substitute for each of the input space data points. Figure 2
depicts the design flow of each training epoch in conventional adversarial
training.

###  3.2 Abstract Certification

The response of each input to an adversarial attack might be different. Hence,
it is quite reasonable that some inputs might be more vulnerable than the
rest. Here, we define an input as vulnerable if it violates a property over
outputs called post-condition $\psi$ for a pre-defined input property $\phi$
($l_{\infty}$ bound in case of brightening attack). The $\phi$, also known as
pre-condition, is defined as:

$Ball(\emph{x})_{\epsilon}=\\{\acute{\emph{x}}\;\mid\;\|\emph{x}-\acute{\emph{x}}\|_{\infty}<\epsilon\\}$
(4)

where x and $\acute{\emph{x}}$ are actual and perturbed input, respectively.
The $\psi$ is defined as:

$\forall\;\emph{j}\in[0,K],\quad o_{k}\geq o_{\emph{j}}$ (5)

where $K$ is the number of classes, $k$ is the actual label of the input being
verified, and $o_{\emph{j}}$ is the ${\emph{j}}^{th}$ element of the output
vector. Even though authors in [12] have shown the presence of a local maximum
of loss value in a PGD attack, one cannot guarantee the absence of an
adversary. In fact, it is infeasible to enumerate all possible adversaries of
an input. For example, in the MNIST data set, we have 28 $\times$ 28 = 784
total pixels for each image. Even if we consider the binary perturbation for
each pixel (0 for black, 1 for white), we will end up enumerating $2^{784}$
total perturbed version of a single image. Hence, abstract interpretation of
neural networks helps overcome the shortcoming of working with a finite but
significant number of images.

In abstract certification, the output is formulated using abstract
transformation of symbolic regions, unlike concrete transformers, where
operations are performed over concrete vectors.

Figure 3: Illustration of abstract certification to verify all possible
perturbations. Initially, the input distribution is approximated by an box
abstract region. It is then propagated through layers through suitable box
transformations. $\\#$ shows that the transformations are abstract. At the
last stage, it verify if all points in abstract region corresponds to the same
output label.

This certification is carried out using state-of-the-art sound, precise and
scalable toolbox: ETH’s Robustness ANalyzer (ERAN) [20], which is a robustness
analyzer based on abstract interpretation for verification of neural network
model. The elements of the abstract certification are explained below:

  * •

Region Definition:  This is the most important decision in an abstract
certification. The type of symbolic region determines the precision of the
analysis. In practice, we aim for regions that are scalable to large networks
and, at the same time, approximates the perturbation in the best possible way.
The symbolic region in figure 3 is Box. Some examples of other regions are
DeepZono and DeepPoly, which are inspired by the geometry of regular zonotope
and polytope, respectively, and are modified in the context of neural
networks. The DeepPoly is the most precise region but has expensive
scalability.
Scalability:  Box $>$ DeepZono $>$ DeepPoly
Precision:  DeepPoly $>$ DeepZono $>$ Box
The trade-off between scalability and precision exists, as definition
complexity increase with precision leading to expensive time complexity.

  * •

Region Transformation:  To work with symbolic regions, we define abstract
operations for the transformations of these regions in a typical DNN. Some
examples of transformations include affine, ReLU, Max-pool, sigmoid, etc. In
Figure 3, we observe the abstract transformations of box region. These
transformations may lose precision during the operation, and hence, it is
necessary to design the transformations carefully. We aim for
exactness(completeness) and soundness in this process. However, most often,
the scalable regions lose precision and hence are incomplete methods. As we
see in Figure 3, the colored regions inside the boxes are the actual region of
the presence of data points; however, the box transformations lead to loss of
precision at each step.

  * •

Verification:  The goal of the final stage is verification. In general, to
have a guarantee, the output shape produced after all the transformations
should satisfy the condition in 6:

$\forall\;\emph{i}\in
I,\emph{i}\vDash\phi\implies\mathcal{N}(\emph{i})\vDash\psi$ (6)

where I is the input space, and $\mathcal{N}(\emph{i})$ is the output after
passing an input through neural network $\mathcal{N}$ transformations. In
other words, every concrete point inside the output region should classify to
the same label, which means the entire region has to lie inside the space
represented by postcondition $\psi$ as shown in figure 3.

The authors in [5], [19], [18] and [17] have shown detailed analysis of box,
zonotope and polytope regions with their abstract transformations. Designing
symbolic regions is an active area of research to achieve higher precision.

##  4 Training Methodology

In this section, we describe the training strategy. As stated earlier, the
goal is to use the subset of the original dataset for adversarial training.
The following steps are involved in the proposed methodology:

  * •

Select a model of choice and required dataset

  * •

Define a pre-condition $\phi$ bounded by $\epsilon$. The larger the value of
$\epsilon$, the higher the risk of an attack

  * •

Run the ERAN toolbox with the model, defined pre-condition, required symbolic
region, and the whole training dataset

  * •

For every input in the training dataset, the toolbox initially checks whether
the input is correctly classified or not.

  * •

Once it is correctly classified, the toolbox verifies the image. Hence, the
dataset is partitioned into three subsets: incorrectly classified, correctly
classified but unverified, and correctly classified, which are verified.

  * •

In each training epoch, the inputs that were verified and classified correctly
are not touched and are used for training using the natural method.

  * •

In the same training epoch, we perform training with adversarial examples from
the group of inputs that are either incorrectly classified or correctly
classified but unverified.

  * •

The model is finally validated using the test data

Adopting the training methodology ensures that that the verified samples are
not attacked. Unlike conventional adversarial training, we do not disturb the
whole input distribution. Hence, we have comparable robust performance, i.e.,
adversarial accuracy, to the conventional adversarial training using this
methodology. However, the beauty of this methodology lies in the lesser
sacrifice of natural accuracy. Figure 4 shows the flow of the proposed
training procedure.

Y1.0e0]ptOUTER MINIMIZATIONY1.0e0]ptINNER MAXIMIZATIONY1.0e0]ptABSTRACT
CERTIFICATIONY1.0e0]ptERANY1.0e0]ptADVERSARIALTRAINING Model Original Data
Define Property Symbolic Abstraction and Transformations Correct? Verified?
Perform Attack Custom Dataset Train Model Validate YesNoNoYes

Figure 4: Our training procedure.

##  5 Experiments

In order to demonstrate our reasoning, we propose the following datasets,
neural network architectures, and other conditions (attack type, symbolic
region, etc.), establishing the environment required for the experiments. The
proposed training method is evaluated using the two datasets

  * •

MNIST: dataset for digit recognition [11] . The dataset contains 60,000
grayscale training images with 28 $\times$ 28 pixels. Each image is labelled
as one of the ten digits (0-9).

  * •

CIFAR10: dataset of tiny images [10]. The data set set contains 5 batches of
10,000 training images. Every image consists of RGB channels each having 32
$\times$ 32 pixels, where each image belongs to one of the 10 different
classes (e.g, dog, cat, truck, ship etc.)

We have considered a small, simple, and similar convolution-based architecture
for both MNIST and CIFAR10 datasets for neural network models. The simplicity
of the data sets will ensure less time to be spent on training and will help
to focus more on the method. However, the idea is general and can be easily
implemented for other data sets of interest. In order to define the
convolutional layer, we use a notation $N_{p\times q}$, where N is the filters
present in each layer and p and q being the dimension of the kernel.
Similarly, for a fully connected layer, we use another notation $A\times B$,
where A is the number of layers present in the network and B is the total
neurons in each layer. We are interested in defining our architectures in
terms of neurons present in them because the time complexity of certification
largely depends on the neuron present in the model. The proposed architecture
for our preliminary study is given in table 1. For training, adversarial
examples are generated by attacking the inputs samples. In our case, we have
used a PyTorch based attack library named Torchattacks [9]. It consists of
many options to select an attack. However, we have settled for the old famous
PGD attack in our study. The results refer to conventional adversarial
training as ’Adversarial Training’ and our methodology as ’Our Training.’ We
are limiting ourselves to DeepPoly abstractions for symbolic regions due to
their high precision compared to other symbolic regions.

Table 1: Model Architecture MNIST | CIFAR10
---|---
Shape | Neurons | Shape | Neurons
$16_{4\times 4}$ |  | $16_{4\times 4}$ |
$32_{4\times 4}$ |  | $32_{4\times 4}$ |
$1\times 800$ | 3,614 | $1\times 1152$ | 4,862
$1\times 100$ |  | $1\times 100$ |
$1\times 10$ |  | $1\times 10$ |
Figure 5:  MNIST Trial: Epochs:50 $\epsilon$:0.1 Steps:20 $\alpha:0.01$

(a) Epochs:64 $\epsilon$:1/255 Steps:15 $\alpha:0.001$

(b) Epochs:64 $\epsilon$:2/255 Steps:15 $\alpha:0.001$

(c) Epochs:64 $\epsilon$:4/255 Steps:15 $\alpha:0.005$

(d) Epochs:64 $\epsilon$:8/255 Steps:15 $\alpha:0.005$

Figure 6: CIFAR10 Trial

Additionally, the toolbox has a variant of DeepPoly called GPUPoly for fast
verification of models on GPU. For MNIST, we have conducted the trial with 20
iterations of PGD attack with a step size of 0.01. The adversarial training
and evaluation are carried out with $l_{\infty}$ bound ($\epsilon$) of 0.1 for
50 epochs. Figure 5 shows the result of the trial. We observe that for the
MNIST dataset, the improvement is not considerable. Also, when we tried to
increase $\epsilon$ beyond 0.1, the subset of verified inputs was minimal to
produce considerable improvement against conventional adversarial training.
Here we observed a reasonable trade-off where increasing $\epsilon$ lead to
meager verified samples while reducing $\epsilon$ led to the insignificant
difference between natural and adversarial accuracy.
For CIFAR 10, we conducted the experiments with 15 iterations of the PGD
attack. The adversarial training and evaluation is carried out with
$l_{\infty}$ bounds ($\epsilon$) of 1/255 (Figure 6(a)), 2/255 (Figure 6(b)),
4/255 (Figure 6(c)), 8/255 (Figure 6(d)) respectively for 64 epochs. We
observe that the accuracy achieved is less as we have used a primitive and
small convolutional model. However, our experiments aim to demonstrate the
boost of natural accuracy. Although not very significant, we have observed
around 1.5$\%$ \- 2$\%$ improvement in Figure 6(c) and Figure 6(d). Since the
accuracy achieved is lower, the verified samples being a subset tends to be
lower. Hence, using powerful models will improve accuracy, leading to a larger
set of verified inputs. It naturally increases the possibility of achieving
significant improvement in natural accuracy. However, unsurprisingly, the need
for computational resources and the training time also increases, and this
analysis will be a necessary component of our future work. We also observe the
similar trade-off as observed with MNIST dataset; the number of verified
samples becomes less as we increase $\epsilon$. Specifically, when $\epsilon$
is made to 10/255, we observed no verified samples through abstract
certification leading to the comparable performance by ’Our Training’ and
’Adversarial Training’ in terms of natural and adversarial accuracy.

##  6 Conclusions

In this position paper, we have demonstrated the utilization of abstract
certification for training neural networks against adversarial attacks. The
proposed framework is practical and straightforward to boost the natural
accuracy in applications where natural accuracy is as important as the defense
against adversaries. The preliminary results pave the way for the broader
research that can be done in this area. The study aimed to initially evaluate
the feasibility of the framework implementation and then understand the scope
of improvement in the performance. We have achieved satisfactory results with
the initial set of experiments; however, we aim to validate this work in
future with more concrete results. Hence, we propose some of the possible
directions to extend our work:

  * •

Train with powerful models to observe the considerable improvement in accuracy

  * •

Train with different types and variants of attacks to understand the
generalization of the method. Also, training defense against geometric
adversaries will be interesting as the ERAN toolbox supports geometric
certification.

  * •

Extending the work to real-life datasets will give better insights into this
framework. Even the simplest of the models already have a good performance on
simple datasets like MNIST.

  * •

Formulate hyper-parameter tuning to get right $\epsilon$ for abstract
certification to achieve maximum improvement in accuracy

##  7 Acknowledgement

We gratefully acknowledge the support from the advanced research computing
platform: Sockeye at The University of British Columbia for the resource
allocation for this study.

## References

  * [1] Naveed Akhtar and Ajmal Mian.  Threat of adversarial attacks on deep learning in computer vision: A survey.  Ieee Access, 6:14410–14430, 2018.
  * [2] Tadhg Brosnan and Da-Wen Sun.  Improving quality inspection of food products by computer vision—-a review.  Journal of food engineering, 61(1):3–16, 2004.
  * [3] Patrick Cousot and Radhia Cousot.  Abstract interpretation: a unified lattice model for static analysis of programs by construction or approximation of fixpoints.  In Proceedings of the 4th ACM SIGACT-SIGPLAN symposium on Principles of programming languages, pages 238–252, 1977.
  * [4] Guozhu Dong and Huan Liu.  Feature engineering for machine learning and data analytics.  CRC Press, 2018.
  * [5] Timon Gehr, Matthew Mirman, Dana Drachsler-Cohen, Petar Tsankov, Swarat Chaudhuri, and Martin Vechev.  Ai2: Safety and robustness certification of neural networks with abstract interpretation.  In 2018 IEEE Symposium on Security and Privacy (SP), pages 3–18. IEEE, 2018.
  * [6] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy.  Explaining and harnessing adversarial examples.  arXiv preprint arXiv:1412.6572, 2014.
  * [7] Andreas Kamilaris and Francesc X Prenafeta-Boldú.  Deep learning in agriculture: A survey.  Computers and electronics in agriculture, 147:70–90, 2018.
  * [8] Salman Khan, Hossein Rahmani, Syed Afaq Ali Shah, and Mohammed Bennamoun.  A guide to convolutional neural networks for computer vision.  Synthesis Lectures on Computer Vision, 8(1):1–207, 2018.
  * [9] Hoki Kim.  Torchattacks: A pytorch repository for adversarial attacks.  arXiv preprint arXiv:2010.01950, 2020.
  * [10] Alex Krizhevsky, Geoffrey Hinton, et al.  Learning multiple layers of features from tiny images.  2009\.
  * [11] Yann LeCun.  The mnist database of handwritten digits.  http://yann. lecun. com/exdb/mnist/, 1998.
  * [12] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu.  Towards deep learning models resistant to adversarial attacks.  arXiv preprint arXiv:1706.06083, 2017.
  * [13] Anh Nguyen, Jason Yosinski, and Jeff Clune.  Deep neural networks are easily fooled: High confidence predictions for unrecognizable images.  In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 427–436, 2015.
  * [14] Daniel W Otter, Julian R Medina, and Jugal K Kalita.  A survey of the usages of deep learning for natural language processing.  IEEE Transactions on Neural Networks and Learning Systems, 32(2):604–624, 2020.
  * [15] Nicolas Papernot, Patrick McDaniel, and Ian Goodfellow.  Transferability in machine learning: from phenomena to black-box attacks using adversarial samples.  arXiv preprint arXiv:1605.07277, 2016.
  * [16] Ali Shafahi, Mahyar Najibi, Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S Davis, Gavin Taylor, and Tom Goldstein.  Adversarial training for free!  arXiv preprint arXiv:1904.12843, 2019.
  * [17] Gagandeep Singh, Rupanshu Ganvir, Markus Püschel, and Martin Vechev.  Beyond the single neuron convex barrier for neural network certification.  2019\.
  * [18] Gagandeep Singh, Timon Gehr, Matthew Mirman, Markus Püschel, and Martin T Vechev.  Fast and effective robustness certification.  NeurIPS, 1(4):6, 2018.
  * [19] Gagandeep Singh, Timon Gehr, Markus Püschel, and Martin Vechev.  An abstract domain for certifying neural networks.  Proceedings of the ACM on Programming Languages, 3(POPL):1–30, 2019\.
  * [20] Gagandeep Singh, M Mirman, T Gehr, A Hoffman, P Tsankov, D Drachsler-Cohen, M Püschel, and M Vechev.  Eth robustness analyzer for neural networks (eran), 2019.
  * [21] Athanasios Voulodimos, Nikolaos Doulamis, Anastasios Doulamis, and Eftychios Protopapadakis.  Deep learning for computer vision: A brief review.  Computational intelligence and neuroscience, 2018, 2018.
  * [22] Eric Wong, Leslie Rice, and J Zico Kolter.  Fast is better than free: Revisiting adversarial training.  arXiv preprint arXiv:2001.03994, 2020.
  * [23] Han Xu, Yao Ma, Hao-Chen Liu, Debayan Deb, Hui Liu, Ji-Liang Tang, and Anil K Jain.  Adversarial attacks and defenses in images, graphs and text: A review.  International Journal of Automation and Computing, 17(2):151–178, 2020.
  * [24] Quanzeng You, Hailin Jin, Zhaowen Wang, Chen Fang, and Jiebo Luo.  Image captioning with semantic attention.  In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 4651–4659, 2016.