# Magnetic structure and spin dynamics of the quasi-2D antiferromagnet Zn-
doped copper pyrovanadate

G. Gitgeatpong<EMAIL_ADDRESS>Faculty of Science and Technology,
Phranakhon Rajabhat University, Bangkok 10220, Thailand  Thailand Center of
Excellence in Physics, Ministry of Higher Education, Science, Research and
Innovation, 328 Si Ayutthaya Road, Bangkok 10400, Thailand  Y. Zhao
Department of Materials Science and Engineering, University of Maryland,
College Park, Maryland 20742, USA.  NIST Center for Neutron Research, National
Institute of Standards and Technology, Gaithersburg, Maryland 20899, USA.  J.
A. Fernandez-Baca  Neutron Scattering Division, Oak Ridge National Laboratory,
Oak Ridge, Tennessee 37831, USA.  T. Hong  Neutron Scattering Division, Oak
Ridge National Laboratory, Oak Ridge, Tennessee 37831, USA.  T. J. Sato
IMRAM, Tohoku University, Sendai, Miyagi 980-8577, Japan.  P. Piyawongwatthana
IMRAM, Tohoku University, Sendai, Miyagi 980-8577, Japan.  K. Nawa  IMRAM,
Tohoku University, Sendai, Miyagi 980-8577, Japan.  P. Saeaun  Department of
Physics, Faculty of Science, Mahidol University, Bangkok 10400, Thailand  K.
Matan<EMAIL_ADDRESS>Thailand Center of Excellence in Physics,
Ministry of Higher Education, Science, Research and Innovation, 328 Si
Ayutthaya Road, Bangkok 10400, Thailand  Department of Physics, Faculty of
Science, Mahidol University, Bangkok 10400, Thailand

###### Abstract

Magnetic properties of the antiferromagnet ZnxCu2-xV2O7 (ZnCVO) with
$x\approx$ 0.06 have been thoroughly investigated on powder and single-crystal
samples. The crystal structure determination using powder x-ray and neutron
diffraction confirms that our ZnCVO samples are isostructural with
$\beta$-Cu2V2O7 ($\beta$-CVO) with a small deviation in the lattice
parameters. Macroscopic magnetic property measurements also confirm the
similarity between the two compounds. The Cu2+ spins were found to align along
the crystallographic $c$-axis, antiparallel to their nearest neighbors
connected by the leading exchange interaction $J_{1}$. Spin dynamics reveals a
typical symmetric spin-wave dispersion with strong interactions in the
$bc$-plane and weak interplane coupling. The exchange interaction analysis
indicates that the spin network of ZnCVO is topologically consistent with the
previous DFT prediction but the values of leading exchange interactions are
contradictory. Furthermore, rather than the predicted 2D honeycomb structure,
the spin network in ZnCVO could be better described by the anisotropic 2D spin
network composing of $J_{1}$, $J_{5}$, and $J_{6}$ interactions, four bonds
per one spin site, coupled by weak interplane interactions.

##  I Introduction

The symmetry of solids plays an important role in determining crystal
structure and the underlying physical properties, particularly a spin network,
magnetic ground states, and spin dynamics in low-dimensional antiferromagnetic
systems. According to Friedel’s law [1] when the crystals have a center of
symmetry at the origin, the structure factor for the $(hkl)$ and
$(\bar{h}\bar{k}\bar{l})$ planes will result in the same intensity i.e.,
$|F(hkl)|^{2}$ = $|F(\bar{h}\bar{k}\bar{l})|^{2}$. The crystals that obey this
rule are called centrosymmetric crystals; otherwise, they are called non-
centrosymmetric. This rule also applies to the dispersion relation. In the
non-centrosymmetric crystals, the system could present the uniform
antisymmetric Dzyaloshinskii-Moriya (DM) interaction [2, 3] between
interacting magnetic spins, in which the asymmetric dispersion relation
(nonreciprocal magnon) i.e., $E(k)~{}\neq~{}E(-k)$, is expected and
experimentally observed [4, 5, 6, 7]. On the other hand, the asymmetric
dispersion relation vanishes and is replaced by the conventional symmetric
dispersion relation in the centrosymmetric crystals.

In our previous study [7] on the non-centrosymmetric $\alpha$-Cu2V2O7
($\alpha$-CVO) or Blossite, we surprisingly discovered the nonreciprocal
magnon where the rare phenomenon of a bidirectional shift of the magnon
dispersion was experimentally observed for the first time in an
antiferromagnet. This discovery was a great proof of the theoretical
prediction of the asymmetric dispersion relation in non-centrosymmetric
crystals and raised our attention to Cu2V2O7 system. There are three main
polymorphs with a chemical formula Cu2V2O7 i.e., $\alpha$, $\beta$, and
$\gamma$. The $\gamma$-phase is more likely a complex high-temperature phase
with the lowest crystal symmetry $P1$ [8]. A more related cousin phase to the
$\alpha$-CVO is $\beta$-Cu2V2O7 ($\beta$-CVO) or Ziesite which is a
centrosymmetric crystal. Both $\alpha$-CVO and $\beta$-CVO were naturally
discovered at the summit crater of the Izalco volcano, El Salvador [9, 10].
Despite the same chemical formula and the same nature of origin, the symmetry
and magnetic properties of $\alpha$-CVO and $\beta$-CVO are quite different.
We, therefore, extend our investigation from the non-centrosymmetric
$\alpha$-CVO to the centrosymmetric $\beta$-CVO focusing on the magnetic
properties and especially the spin dynamics.

The crystal structure of $\beta$-CVO is monoclinic with space group $C2/c$.
The lattice parameters are $a$ = 7.685 Å, $b$ = 8.007 Å, $c$ = 10.09 Å, and
$\beta$ = 110.27∘ [11, 10]. Unlike $\alpha$-CVO, the DM interaction is absent
in $\beta$-CVO and thus the symmetric dispersion relation with $E(k)=E(-k)$ is
expected. This system was first believed to be the antiferromagnetic 1D spin
chain [12, 13, 14] but the later DFT studies proposed the otherwise 2D
honeycomb spin network [15, 16]. Here we performed a thorough experiment to
investigate the magnetic structure as well as the spin-wave dispersion using
state of the art neutron scattering technique to resolve this ambiguity. We
chose ZnxCu2-xV2O7 with $x\approx$ 0.06 (ZnCVO) as a prototypical sample
because of its phase controllability. There were several reports on the
synthesis of $\beta$-CVO samples, both powder [17, 18] and single-crystals
[13]. However, the $\alpha$ to $\beta$ phase transition temperatures were
reported to be different [19, 18] causing difficulty in growing the large-
sized single-crystal for an inelastic neutron scattering study. Alternatively,
Zn substitution on Cu sites can transform the formerly $\alpha$-Cu2V2O7 to
ZnxCu2-xV2O7, which were reported to have the same crystal structure as
$\beta$-CVO [20, 21, 12, 22, 23, 24]. There are many interesting aspects in
the physical properties of these copper vanadate systems not only magnetic
properties but also their negative thermal expansion [25, 26, 27] and
photoelectrochemical properties [28, 29]. Understanding the physics of
$\beta$-CVO/ZnCVO could potentially lead to an insight into the low-
dimensional quantum materials and their possible diverse applications.

The manuscript is organized as follows. We briefly start with the experimental
details in Section II describing the sample preparations and the data
collections. In Section III, we allocate into four subsections. The first two
subsections, III.1 and III.2, will be discussing the crystal and magnetic
structures, respectively, of ZnCVO and $\beta$-CVO samples. The next two
subsections, III.3 and III.4, will be devoted to the exchange interactions and
spin network analysis. We finally end with the conclusion in Section IV.

##  II Experimental details

Powder samples of ZnCVO were prepared by the standard solid-state reaction
from the stoichiometric ratio of ZnO, CuO, and V2O5. The mixture was ground
and calcined repeatedly at the temperature between 600 - 650∘C in the air.
Phase purity was checked by the powder x-ray diffraction. For comparison, a
powder sample of the pure phase $\beta$-Cu2V2O7 ($\beta$-CVO) was also
prepared. The stoichiometric ratio of CuO, and V2O5 were mixed and ground
thoroughly. The mixture was calcined and sintered at a temperature below 600∘C
to avoid the $\alpha-\beta$ phase transition [19], with intermediate grindings
for a total of around 80 hours. The pure phase ZnCVO was used as a starting
material for single-crystal growth using the vertical gradient furnace. The
powder was put into a quartz tube and melted in the ambient air at around
850∘C before moving the molten sample down through the natural temperature
gradient between 20∘C/cm - 50∘C/cm with a rate of 1 cm/day. After the sample
reaches the temperature of $\approx$ 600∘C, the crystals were then naturally
cooled in the furnace to room temperature and mechanically extracted from
quartz.

The phase of the single crystals was first checked by powder x-ray diffraction
on the ground crystals. Magnetic susceptibility measurements were done on a
small piece of single-crystal by applying the magnetic field along two
orthogonal directions i.e., $H\parallel a$ and $H\perp a$ using a
superconducting quantum interference device (MPMS-XL, Quantum Design) with the
field of 1 T. The obtained magnetic susceptibility data were analyzed and
compared with the Quantum Monte Carlo simulation. Powder neutron diffraction
data on both ZnCVO and $\beta$-CVO were collected at BT1, NIST Center for
Neutron Research (NCNR), the USA for nuclear and magnetic structure
determinations. Finally, inelastic neutron scattering experiments were done on
a large piece of crystal ($m\approx$ 1.5 g). The crystal was aligned so that
($h,k,0$) was on the scattering plane. At the BT7 Double Focusing Thermal
Triple Axis Spectrometer, NIST Center for Neutron Research (NCNR), USA, the
scattered neutron energy was fixed 14.7 meV. The rocking scan was done on the
major nuclear Bragg peak to qualify the crystallinity of the single crystal.
The energy scans were collected at the base temperature along ($0,k,0$) and
($h,2,0$) directions over the broad range of the spin-wave dispersion. The
energy scans around the magnetic zone center were done at the SPINS
spectrometers, NCNR, and at the CTAX spectrometer, Oak Ridge National
Laboratory, the USA with fixed scattered neutron energy of 5 meV to resolve
the energy gap.

##  III Results and discussion

###  III.1 Crystal structure

The powder sample of ZnCVO shows a pure phase with an identical structure with
$\beta$-CVO, as shown by the Rietveld refinement on the x-ray diffraction
patterns in Fig. 1 (a). This result is consistent with the previous work by
Pommer et. al., [12] where the ZnxCu2-xV2O7 compound completely transformed to
the $\beta$ phase at $x$ = 0.15. At lower doping concentrations, the samples
show the mixed $\alpha-\beta$ phases, and the Zn concentration of $x$ = 0.15
is expectedly at the transition point. From the pure phase powder ZnCVO, the
single-crystals of ZnCVO with the largest size of approximately 1 $\times$ 1
$\times$ 1 cm${}^{\text{3}}$ ($m\approx$ 1.5 g) were obtained using the
vertical gradient furnace. The natural cleaved facet can be identified as the
crystallographic $a$-axis similar to the $\beta$-CVO single-crystals [13]. The
$\omega$-scan around $(020)$ Bragg peak using neutron scattering at BT7 (Fig.
5, inset) with a Gaussian fit yields a full-width-at-half-maximum (FWHM) equal
to 0.38(4)∘, indicative of good crystallinity. Rietveld refinements on the
powder x-ray diffraction pattern obtained from the ground single-crystals, as
shown in Fig. 1 (b), can also be fitted well with the reported $\beta$-CVO
crystal structure [10]. In addition, powder neutron diffraction on ZnCVO and
$\beta$-CVO powder samples were also performed at 30 K and 2.5 K for crystal
structure and magnetic structure determination, respectively. At 30 K, the
powder neutron diffraction patterns of both ZnCVO and $\beta$-CVO were refined
against the reference $\beta$-CVO crystal structure as shown in Fig. 2.
Despite the presence of Zn, the diffraction pattern shows a pure $\beta$-CVO
phase without any trace of other phases. The refined occupancy of the Cu site
from powder neutron data in Table 2 yields 0.97(1) suggesting that the doping
concentration of Zn is approximately 3%, much lower than the stoichiometric
ratio of 7.5%. The powder neutron diffraction pattern of $\beta$-CVO, on the
other hand, shows some impurity peaks which can be indexed with CuV2O6 [30]
($\approx$ 9%) and Cu0.63V2O5 [31] ($\approx$ 6%). The refined parameters
obtained from both x-ray and neutron diffractions are summarized in Table 1
and 2, respectively.

Table 1:  Fractional coordinates of powder ZnCVO, powder $\beta$-Cu2V2O7, and ground single-crystals of ZnCVO samples obtained from the Rietveld refinements on the x-ray diffraction patterns measured at room temperature as those shown in Fig. 1. Atom | Site | $x/a$ | $y/a$ | $z/a$
---|---|---|---|---
Powder ZnCVO
Cu | 8f | 0.3114(6) | 0.0758(6) | 0.5134(5)
V | 8f | 0.2283(7) | -0.2261(6) | 0.2889(6)
O(1) | 4e | 0.0000 | 0.147(2) | 0.7500
O(2) | 8f | 0.265(2) | -0.092(3) | 0.621(2)
O(3) | 8f | 0.364(2) | -0.081(2) | 0.383(2)
O(4) | 8f | 0.247(2) | 0.752(2) | 0.869(1)
$a$ = 7.6802(2) Å, $b$ = 8.0550(3) Å, $c$ = 10.1118(3)
$\beta$ = 110.343(3)∘, $R_{p}$ = 6.02%, $R_{wp}$ = 8.88%
Powder $\beta$-Cu2V2O7
Cu | 8f | 0.3085(5) | 0.0722(4) | 0.5128(4)
V | 8f | 0.2264(8) | -0.2263(6) | 0.2853(5)
O(1) | 4e | 0.0000 | 0.151 | 0.7500
O(2) | 8f | 0.264(2) | -0.091(2) | 0.636(2)
O(3) | 8f | 0.373(2) | -0.095(2) | 0.396(2)
O(4) | 8f | 0.238(2) | 0.753(2) | 0.873(1)
$a$ = 7.6950(6) Å, $b$ = 8.0239(6) Å, $c$ = 10.1056(6)
$\beta$ = 110.266(4)∘, $R_{p}$ = 5.36%, $R_{wp}$ = 7.08%
Ground single-crystals of ZnCVO
Cu | 8f | 0.3101(3) | 0.0740(2) | 0.5139(2)
V | 8f | 0.2229(4) | -0.2236(3) | 0.2876(3)
O(1) | 4e | 0.0000 | 0.130(1) | 0.7500
O(2) | 8f | 0.266(1) | -0.098(1) | 0.634(9)
O(3) | 8f | 0.383(1) | -0.094(1) | 0.397(9)
O(4) | 8f | 0.227(1) | 0.751(1) | 0.867(8)
$a$ = 7.6757(1) Å, $b$ = 8.0586(2) Å, $c$ = 10.1100(2)
$\beta$ = 110.368(2)∘, $R_{p}$ = 4.91%, $R_{wp}$ = 6.38%
Table 2:  Fractional coordinates of ZnCVO and $\beta$-Cu2V2O7 powder samples obtained from the Rietveld refinements on the powder neutron diffraction patterns measured at 30 K. Note that the large errors at the refined positions of vanadium are due to its weak neutron scattering cross section [32]. Atom | Site | $x/a$ | $y/a$ | $z/a$
---|---|---|---|---
ZnCVO
Cu/Zn111The refined occupancy number for Cu atom is 0.97(1) and thus for Zn atom is approximately 0.03. | 8f | 0.3123(2) | 0.0723(2) | 0.5149(2)
V | 8f | 0.217(5) | -0.246(5) | 0.293(3)
O(1) | 4e | 0.0000 | 0.1327(3) | 0.7500
O(2) | 8f | 0.2739(3) | -0.0951(3) | 0.6345(2)
O(3) | 8f | 0.3802(3) | -0.0914(3) | 0.3975(2)
O(4) | 8f | 0.2424(3) | 0.7536(3) | 0.8738(2)
$a$ = 7.7131(1) Å, $b$ = 8.0242(1) Å, $c$ = 10.1292(2)
$\beta$ = 110.408(1)∘, $R_{p}$ = 4.27%, $R_{wp}$ = 6.12%
$\beta$-Cu2V2O7
Cu | 8f | 0.3121(4) | 0.0698(4) | 0.5139(3)
V | 8f | 0.232(8) | -0.267(8) | 0.272(6)
O(1) | 4e | 0.0000 | 0.1259(6) | 0.7500
O(2) | 8f | 0.2811(5) | -0.0987(5) | 0.6402(4)
O(3) | 8f | 0.3788(5) | -0.0877(5) | 0.3991(3)
O(4) | 8f | 0.2456(6) | 0.7507(5) | 0.8759(3)
$a$ = 7.7249(2) Å, $b$ = 8.0013(2) Å, $c$ = 10.1249(3)
$\beta$ = 110.315(2)∘, $R_{p}$ = 4.50%, $R_{wp}$ = 6.09%
Figure 1:  (a) Powder x-ray diffraction patterns with the Rietveld refinements
of the powder samples ZnCVO (black solid circle) and $\beta$-Cu2V2O7 (blue
open circle) collected at room temperature. (b) X-ray diffraction pattern with
the Rietveld refinements of the ground single-crystals ZnCVO. In both panels,
red lines are the calculated pattern, green lines are the difference between
the observed and calculated patterns, and the vertical grey ticks represent
the Bragg positions for $\beta$-Cu2V2O7 structure. The inset shows a
photograph of the obtained single crystal. Figure 2:  Powder neutron
diffraction patterns with the Rietveld refinements of the powder samples ZnCVO
(black circle) and $\beta$-Cu2V2O7 (blue circle) collected at $T$ = 30 K at
the BT1 spectrometer, NCNR, USA. The vertical grey, orange, and purple ticks
represent the Bragg positions for $\beta$-Cu2V2O7, CuV2O6, and Cu0.63V2O5,
respectively.

###  III.2 Magnetic structure

Now we discuss the magnetic structure determinations on ZnCVO and $\beta$-CVO
using powder neutron diffraction. As mentioned earlier in Section III.1, we
prepared both ZnCVO and $\beta$-CVO to confirm that they share not only
crystal structure but also magnetic structure. We start with the irreducible
representation analysis using the program basirreps in the fullprof [33] suit.
According to the crystallographic space group $C2/c$ with commensurate
magnetic translation vector $\vec{k}=(0,0,0)$, there are four possible
magnetic irreducible representations (IR) as described in Table 3. The
corresponding Shubnikov magnetic space groups for $\Gamma_{1}$, $\Gamma_{2}$,
$\Gamma_{3}$, and $\Gamma_{4}$ are $C2/c$, $C2/c^{\prime}$,
$C2^{\prime}/c^{\prime}$, and $C2^{\prime}/c$, respectively [34]. With the
assumption that ZnCVO and $\beta$-CVO have the same magnetic structure, we
know that these systems undergo a paramagnetic to antiferromagnetic transition
at the Néel temperature of $T_{\text{N}}\simeq$ 26 K which will be discussed
in Section III.3. When we start considering the exchange couplings along with
the nearest-neighboring pairs $J_{1}$, there are two equivalent bonds between
the Cu2+ ions i.e., Cu1-Cu3 and Cu2-Cu4 (see Table 3 and Fig. 4). It was
originally believed that this system was the antiferromagnetic spin chain with
alternating $J_{1}-J_{2}$ bonds (not shown here). However, it has been later
proposed using the DFT calculations [15] that this system could be better
described by the complex anisotropic honeycomb network. In their proposed
model, the leading antiferromagnetic exchange interactions are along two
$J_{5}$ and one $J_{6}$ (Fig. 4) i.e., three bonds per site. However, there
are still weak but non-negligible antiferromagnetic $J_{1}$ as well as the
interplane $J_{14}$ couplings, making the spin network more complex than the
simple honeycomb structure. It is therefore presumed that the Cu2+ atoms must
align antiparallel with their neighbors through the most prominent exchange
interactions, here $J_{1}$, $J_{5}$, and $J_{6}$. In addition, the previous
magnetization measurements by He et. al., [35] on the single-crystals of
$\beta$-CVO strongly suggested that the magnetic easy axis of this system was
along the crystallographic $c$-axis. This suggests that the magnetic moment
$m_{a}$ and $m_{b}$, despite their possible nonzero values, could be
discarded.

Table 3: Magnetic irreducible representations (IR) and their basis vectors (BV) for Cu1($x,y,z$), Cu2($-x+1/2,-y+1,-z+3/2$), Cu3($-x+1/2,-y+1/2,-z+1$), and Cu4($x,-y+1,z-1/2$) (see Fig. 4). |  | Cu1 | Cu2 | Cu3 | Cu4
---|---|---|---|---|---
IR | BV | $m_{a}$ | $m_{b}$ | $m_{c}$ | $m_{a}$ | $m_{b}$ | $m_{c}$ | $m_{a}$ | $m_{b}$ | $m_{c}$ | $m_{a}$ | $m_{b}$ | $m_{c}$
$\Gamma_{1}$ | $\psi_{1}$ | 1 | 0 | 0 | -1 | 0 | 0 | 1 | 0 | 0 | -1 | 0 | 0
| $\psi_{2}$ | 0 | 1 | 0 | 0 | 1 | 0 | 0 | 1 | 0 | 0 | 1 | 0
| $\psi_{3}$ | 0 | 0 | 1 | 0 | 0 | -1 | 0 | 0 | 1 | 0 | 0 | -1
$\Gamma_{2}$ | $\psi_{1}$ | 1 | 0 | 0 | -1 | 0 | 0 | -1 | 0 | 0 | 1 | 0 | 0
| $\psi_{2}$ | 0 | 1 | 0 | 0 | 1 | 0 | 0 | -1 | 0 | 0 | -1 | 0
| $\psi_{3}$ | 0 | 0 | 1 | 0 | 0 | -1 | 0 | 0 | -1 | 0 | 0 | 1
$\Gamma_{3}$ | $\psi_{1}$ | 1 | 0 | 0 | 1 | 0 | 0 | 1 | 0 | 0 | 1 | 0 | 0
| $\psi_{2}$ | 0 | 1 | 0 | 0 | -1 | 0 | 0 | 1 | 0 | 0 | -1 | 0
| $\psi_{3}$ | 0 | 0 | 1 | 0 | 0 | 1 | 0 | 0 | 1 | 0 | 0 | 1
$\Gamma_{4}$ | $\psi_{1}$ | 1 | 0 | 0 | 1 | 0 | 0 | -1 | 0 | 0 | -1 | 0 | 0
| $\psi_{2}$ | 0 | 1 | 0 | 0 | -1 | 0 | 0 | -1 | 0 | 0 | 1 | 0
| $\psi_{3}$ | 0 | 0 | 1 | 0 | 0 | 1 | 0 | 0 | -1 | 0 | 0 | -1
Figure 3:  (a) Powder neutron diffraction pattern with the Rietveld refinement
to the magnetic structure $\Gamma_{4}$. Grey and black vertical marks
represent the possible structure and magnetic Bragg positions, respectively.
The inset shows the agreement between measured and calculated magnetic
scattering intensities. (b) Powder neutron diffraction patterns at 2.5 K were
subtracted by the 30 K data of ZnCVO (in grey circles) and $\beta$-CVO (in
blue circles). The red lines are the subtraction between the Rietveld fits of
the crystal structure at 30 K out of that magnetic structure at 2.5 K with
$\Gamma_{4}$. The purple and green lines represent the same structural pattern
subtracted from the magnetic pattern on ZnCVO using $\Gamma_{1}$, and
$\Gamma_{2}$, respectively. The vertical black symbols represent the possible
magnetic Bragg positions. The error bars represent three standard deviations
throughout the article.

Therefore among the four possible magnetic IRs, where we take into account the
first nearest-neighbor couplings Cu1-Cu3 and Cu2-Cu4, we can rule out
$\Gamma_{1}$ and $\Gamma_{3}$ where all spins align ferromagnetically along
$m_{a}$. The reason that we pay attention to the first nearest neighbor is due
to its strongest interaction as we will show later in Section III.4. This
leaves us with the two most probable magnetic IRs i.e., $\Gamma_{2}$ and
$\Gamma_{4}$. It is obvious that only $\Gamma_{4}$ yields antiferromagnetic
interaction on all neighboring bonds whereas $\Gamma_{2}$ gives ferromagnetic
coupling on the fifth nearest neighbor. This assumption is based primarily on
the DFT results by Tsirlin et. al., [15] and Bhowal et. al., [16] (the
citations will be omitted afterward when we mention the DFT results) where the
predominant $J_{1}$, $J_{5}$, and $J_{6}$ bonds are all antiferromagnetic.
With this initial analysis, we refined the powder neutron diffraction data at
2.5 K with $\Gamma_{1}$, $\Gamma_{2}$, and $\Gamma_{4}$ except for
$\Gamma_{3}$ where the symmetry results in the ferromagnetic spin direction
along $c$-axis. The magnetic structure of each IR is shown in Fig. 4. The
refined patterns from ZnCVO data with $\Gamma_{1}$, $\Gamma_{2}$, and
$\Gamma_{4}$ are shown in Fig. 3 (b) for comparison along with their
corresponding refined parameters summarized in Table 4.

Figure 4:  Magnetic structure with irreducible representation (a) $\Gamma_{1}$, (b) $\Gamma_{2}$, (c) $\Gamma_{3}$, and (d) $\Gamma_{4}$. When viewing along the crystallographic $b$-axis (upper row) the couplings $J_{14}$ (magenta) connect between the irregular honeycomb planes at which can be virtualized when view along the $a$-axis (lower row). The typical honeycomb structure is constructed from $J_{1}$ (red) and $J_{5}$ (blue) with the extra $J_{6}$ (green) bonds that connect between the opposite vertices. Table 4: The fitting parameters from the Rietveld refinements on the powder neutron diffraction of ZnCVO at 2.5 K. IRs |  $m_{c}$ ($\mu_{B}$) | $\chi^{2}$ | Magnetic $R$-factor
---|---|---|---
$\Gamma_{1}$ | 0.6(2) | 11.6 | 26.5
$\Gamma_{2}$ | 0.4(2) | 12.1 | 15.8
$\Gamma_{4}$ | 0.72(9) | 9.1 | 13.1

It should be noted that the powder neutron diffraction patterns of both ZnCVO
and $\beta$-CVO samples show very weak magnetic intensities, especially in
$\beta$-CVO, and most of them are on top of the structural peaks. It is
therefore very difficult to precisely extract the magnetic moment from the
refinement. Furthermore, there could be large uncertainties in the refined
values of the magnetic moment, and the exact magnetic structure could deviate
from our proposed model. In order to present the magnetic intensities from the
powder samples, we subtract the 30 K patterns from that of 2.5 K patterns, on
both raw data and on the refined results, as shown in the low 2$\theta$ range
in Fig 3 where the magnetic scattering is the most intense. It can be seen
that the magnetic Bragg peak positions of both samples are consistent with the
fitted model. Despite the dilution of the Cu sites by Zn, the magnetic
intensities of ZnCVO are more pronounced than those of $\beta$-CVO where the
intensities are most likely within the statistical error. Although we
attempted to refine the magnetic structure on the $\beta$-CVO data we could
not extract the magnetic moment with a reliable value. We could only obtain
the magnetic moment from the ZnCVO data. The best fit is obtained from
$\Gamma_{4}$ with the refined magnetic moment $m_{c}$ = 0.72(9) $\mu_{B}$, the
best among all three IRs. The refined pattern of ZnCVO with $\Gamma_{4}$ along
with the plot of $\left|F^{\text{M}}_{\text{Cal}}\right|^{2}$ vs
$\left|F^{\text{M}}_{\text{Obs}}\right|^{2}$ are shown in Fig. 3 (a). This
magnetic structure will be further used in the spin-wave dispersion analysis
in Section III.4.

###  III.3 Magnetic susceptibility

Magnetic susceptibility of single-crystal ZnCVO was measured along two
crystallographic axes i.e., $\chi_{\parallel a}$ with $H\parallel a$ (along
the cleaved surface), and $\chi_{\perp a}$ with $H\perp a$ (parallel to the
cleaved surface). The results, as shown in Fig. 6(a), reveal a broad peak at
$T\approx$ 50 K indicating short-range correlations among the Cu2+ spins. The
paramagnetic upturn below $T\approx$ 20 K can be observed. This upturn, which
corresponds to approximately 0.006$\mu_{\text{B}}$ at the field of 1 T and at
the base temperature, is 13 times smaller than the ferromagnetism observed in
$\alpha$-Cu2V2O7 [7] and most likely a result of the presence of defective
magnetic sites where Cu2+ ions were substituted by Zn2+ and thus the free Cu2+
spins were produced [12, 36]. There is a large anisotropy between
$\chi_{\parallel a}$ and $\chi_{{\perp a}}$ up to $T$ = 300 K similar to that
observed in $\beta$-CVO by He et. al., [35]. This unusual anisotropy was
suggested as a result of the Jahn-Teller distortion [37]. The similarity of
the magnetic susceptibility behavior between ZnCVO in this work and
$\beta$-CVO by the previous works, as well as our powder neutron diffraction
data analysis, strongly suggest that both systems share the same magnetic
properties.

The plot of inverse magnetic susceptibility versus temperature, shown in Fig.
6(b), can be fitted well with the Curie-Weiss law ($\chi=C/(T-\Theta)$) at
$T>$ 100 K. The fit yields the Curie-Weiss temperature of $\Theta$ = -79(1) K
(-89(1) K) with $H\perp a$ ($H\parallel a$) indicating the dominant
antiferromagnetic exchange interactions, and the Curie-Weiss constant $C$ =
0.429(1) cm${}^{\text{3}}$K/molCu and 0.593(3) cm${}^{\text{3}}$K/molCu for
$H\perp a$ and $H\parallel a$, respectively. The effective magnetic moment can
be estimated to $\mu_{\text{eff}}=\sqrt{3k_{B}C/N_{A}}=1.852(4)\mu_{B}$ for
$H\perp a$ and $2.17(1)\mu_{B}$ for $H\parallel a$. These values are slightly
larger than the spin-only value of
$\mu_{\text{eff}}=g\mu_{B}\sqrt{s(S+1)}=1.73\mu_{B}$ for $g=2$ and $S=1/2$.
The Néel temperature, $T_{\text{N}}\simeq$ 26 K is obtained from the exponent
fit to the order parameter scans as a function of temperature on the magnetic
Bragg peaks using elastic neutron scattering as shown in Fig. 5. The fits were
done in the range $15~{}\text{K}<T<30~{}\text{K}$, close to the phase
transition temperature, using equation
$I=I_{0}\left(1-T/T_{\text{N}}\right)^{2\beta}$. This value is consistent with
the observed $\lambda$-like transition at around 26 K from the heat capacity
measurement on $\beta$-CVO single-crystal [35]. The obtained critical exponent
of $\beta\sim$ 0.2 is comparable to its cousin phase $\alpha$-Cu2V2O7 [38].

It should be noted that the doping of Zn on Cu sites results in a dilution of
magnetic spin and typically decreases the Néel temperature [39, 22, 36].
However, in this case the value of $T_{\text{N}}$ is nearly the same as that
of $\beta$-CVO [13, 35]. In addition, the finite magnetic susceptibility below
$T_{\text{N}}$ does not fit the paramagnetic impurity upturn as that observed
in the powder sample by the previous works [12]. The lattice parameters
obtained from the Rietveld refinements (Table 1) on the powder samples reveal
that the lattice parameter $a$ slightly decreases while $b$, $c$, and the
angle $\beta$ slightly increase upon the presence of Zn compared to pure
$\beta$-CVO. Those lattice parameters on the ground single-crystals are also
consistent with the powder ZnCVO sample. This suggests that the refined value
of approximately 3% Zn substitution on Cu sites only slightly alters the
overall lattice parameters and does not affect the macroscopic magnetic
properties.

Figure 5: Order parameter scans of the magnetic Bragg peaks (a) from BT7
spectrometer around (020) and (b) from SPINS spectrometer around (220). Red
lines represent the critical exponent fits. Arrows indicate the Néel
temperatures. Inset shows the omega scan around the (020) Bragg peak at $T$ =
3 K with the gaussian fit yielding FWHM = 0.38(4)∘.

To further estimate the average exchange interactions, we performed QMC
simulations and fit the resulting simulated data to the broad peak of the
magnetic susceptibility, provided that the spin network model and the values
of leading exchange interactions were predicted. We proceed with the very
first report on the DFT results (here we label the couplings according to the
order of nearest-neighbor distances. The notation used by Tsirlin et. al., in
Ref [15] will be recalled in the parentheses). Among their various models,
they suggested that the best realization of the spins network in $\beta$-CVO
can be described by the fifth $J_{5}$ ($J_{1}$) and sixth $J_{6}$
($J^{\prime}_{1}$) neighboring bonds, represented by the blue and green bonds,
respectively, in Fig. 4 and the inset in Fig. 6 (a). These two bonds connect
the Cu2+ ions into the irregular honeycomb network, i.e., three bonds per
site, spanning the $bc$-plane when viewed along the $a$-axis. These honeycomb
planes, according to the DFT results, are however not the perfect 2D since
there are non-zero $J_{14}$ ($J_{\perp}$), represented by the magenta bonds in
Fig. 4, that connect between the adjacent honeycomb planes. There is also the
suspicious $J_{1}$, formerly believed to be the leading exchange interaction,
that appeared to be non-negligible from the DFT making the spin network in
this system to be topologically the anisotropic magnetic 2D lattice (four
bonds per site) with weak interplane couplings.

In our QMC simulation, we, therefore, construct the 2D spin network with
anisotropic exchange interactions $J_{1}$, $J_{5}$, and $J_{6}$ as shown in
the inset of Fig. 6 (a). The values of these couplings were obtained from the
spin-wave dispersion fit on our inelastic neutron scattering data which will
be discussed in Section III.4. We simplify our spin network model by
truncating the interplane fourteenth neighboring bond $J_{14}$ in the QMC
simulation due to its very weak value. Although we fit the spin-wave
dispersion based on the DFT model, the fitted parameters were obtained
differently. Here we use the ratio $J_{1}:J_{5}:J_{6}$ = 1 : 0.61 : 0.25 for
the QMC model. With $J_{1}-J_{5}-J_{6}$ interactions, the spin network
resembles the irregular 2D edge-sharing trapezoid shape. We then conducted the
QMC with the loop algorithm [40] using the simulation package alps [41]. The
obtained QMC simulation result and the experimental magnetic susceptibility
data were fitted using the equations,

$\chi(T)=\chi_{0}+\chi_{\text{QMC}}(T),$ (1)

with

$\chi_{\text{QMC}}(T)=\frac{N_{\text{A}}\mu^{2}_{B}g^{2}}{k_{\text{B}}J_{\text{max}}}\chi^{*}(t),$
(2)

where $N_{\text{A}}$, $\mu_{\text{B}}$, and $k_{\text{B}}$ are the Avogadro
constant, Bohr magneton, and Boltzmann constant, respectively. The function
$\chi^{*}(t)$ is the susceptibility as a function of reduced temperature
$t=k_{\text{B}}T/J_{\text{max}}$ which was obtained by fitting the simulated
QMC to the Padé approximant [42]. Here $J_{\text{max}}$ is $J_{1}$, the
leading exchange interaction. The fitting parameters are the background
$\chi_{0}$, the Landé $g$-factor, and the leading exchange interaction
$J_{\text{max}}$ ($J_{1}$). The results are shown by the solid red lines in
Fig. 6 (a) along with the two orthogonal magnetic field directions while the
fitted parameters are summarized in Tabel 5. The QMC simulation fits well with
the magnetic susceptibility data over the broad maximum from $T\simeq$ 35 K up
to 300 K yielding the leading exchange interaction $J_{1}\simeq$ 73 K
($\simeq$ 6.4 meV). Although the fitted values of the Landé $g$-factors are
slightly deviated between $H\parallel a$ and $H\perp a$ data due most likely
to the anisotropy, their average $g_{\text{av}}$ = 2.09(1) is still very close
to the theoretical value of 2.

Figure 6: (a) Magnetic susceptibility as a function of temperature with the magnetic field along crystallographic $a$-axis (blue triangle) and perpendicular to the $a$-axis (black circle). Red lines represent the QMC fits with the spin network as shown in the inset. (b) The inverse magnetic susceptibility and the Curie-Weiss law fit (green lines) at $T>100$ K. Table 5: The parameters obtained from the fit of QMC simulation to the magnetic susceptibility data when the field was applied along the crystallographic $a$-axis ($H\parallel a$) and perpendicular to the $a$-axis ($H\perp a$). Field direction | $\chi_{0}~{}(\text{cm}^{3}/\text{mol Cu})$ |  $J_{1}/k_{B}$ (K) | $g\text{-factor}$
---|---|---|---
$H\parallel a$ | $1.9(1)\times 10^{-4}$ | $73.3(3)$ | 2.23(1)
$H\perp a$ | $1.0(1)\times 10^{-4}$ | $73.4(3)$ | 1.967(7)

###  III.4 Spin-wave dispersion

Figure 7: Spin-wave dispersion of ZnCVO single-crystals along $(0,k,0)$ in (a)
- (d) and along $(h,2,0)$ in (e) - (h). Red lines are the best fit for the
dispersion relation. The intensity maps in (a), (b), (e), and (f) are plotted
against the calculated curves. The fit between the model and the data is shown
in (c) and (g). The calculated intensities are shown (d) and (h).

All of the experimental data and analysis in the previous sections have led us
to believe that the magnetic properties of ZnCVO could be a good realization
of the $\beta$-CVO system. In this final section, we investigate the spin
dynamics of ZnCVO single-crystals and analyze the obtained dispersion relation
using the linear spin-wave theory (LSWT) [43, 44]. We measured inelastic
neutron scattering along two directions around the magnetic zone center at
(0,2,0) i.e., along $(0,k,0)$ and along $(h,2,0)$. At low energy transfer
($\hbar\omega~{}<~{}5$ meV), we conducted the experiments at SPINS and CTAX
whereas at high energy transfer ($5$ meV $<\hbar\omega<15$ meV) the
experiments were done at BT7. The intensity map along the two directions at
the base temperatures (depending on the spectrometer) is shown in Fig 7 (a) -
(b) and Fig 7 (e) - (f). Figure 7 (a) shows the whole extent of the dispersion
along $(0,k,0)$ from the magnetic zone center at (0,2,0) to the zone boundary
at (0,3,0). The dispersion reaches its maximum at the energy transfer of
$\approx$ 11 meV. At the magnetic zone center, we can see an energy gap
clearly when using CTAX and SPINS spectrometers in Fig. 7 (b) and (f)
respectively. The dispersion is however different from its cousin phase
$\alpha$-CVO where we found the splitting of the dispersion into two branches
away from the magnetic zone center [7]. This splitting, as mentioned earlier,
was due to the presence of the DM interaction. On the other hand, in the
$\beta$-CVO system which in this case is the ZnCVO, the crystal is
centrosymmetric and thus DM interaction is absent due to the symmetry of the
underlying crystal structure. Therefore, as we expected, the magnon dispersion
in ZnCVO shows only one symmetric branch without the bidirectional shift. This
evidence is a great test that the nonreciprocal magnon vanishes in the
centrosymmetric crystal in the Cu2V2O7 system. Along the $(h,2,0)$, on the
other hand, the dispersion gradually increases from (0,2,0) up to the magnetic
zone boundary at (1,2,0). This suggests that the spin interactions along the
reciprocal lattice $b^{*}$ i.e., within the anisotropic lattice plane, are
stronger than those along $a^{*}$ between the planes, and that the interaction
between the planes should be relatively weak compared to the in-plane
interactions.

In order to quantitatively analyze the exchange coupling values, we extract
the dispersion relation from the convolute fit to the energy scan at each $Q$.
The obtained dispersions from all data sets were plotted altogether as shown
by the circle symbol in Fig 7 (c) and (g) for $(0,k,0)$, and $(h,2,0)$
directions, respectively. Since the spin structure has been analyzed in
Section III.3, we need to construct spin interactions network for the LSWT
fit. Again we start with the predicted models by the DFT calculations. In
their work [15], they performed various computational approaches and showed
that the leading exchange interactions were $J_{5}$ and $J_{6}$ forming the
anisotropic honeycomb network with weak but non-negligible $J_{1}$ and the
interplane $J_{14}$. We started with this model by introducing $J_{1}$,
$J_{5}$, $J_{6}$, and $J_{14}$ into our spin model. The Hamiltonian that we
used in our spin-wave fit is shown in Eq. 3 below.

$\mathcal{H}=\frac{1}{2}\sum_{ij}\left\\{J_{ij}(\mathbf{S}_{i}\cdot\mathbf{S}_{j})+G_{ij}[\sin\beta(S_{zi}S_{zj}-S_{xi}S_{xj}-S_{yi}S_{yj})+\cos\beta(S_{xi}S_{xj}-S_{yi}S_{yj}-S_{zi}S_{zj})]\right\\},$
(3)

where $J_{ij}$ is the exchange interaction between spins $S_{i}$ and $S_{j}$,
$\beta$ is the angle between the $a$-axis and $c$-axis due to the monoclinic
system, and $G_{ij}=GJ_{ij}$, defined to be proportional to the exchange
couplings, is the anisotropic parameter which gives rise to the spin gap at
the magnetic zone center. We applied $J_{ij}$ and $G_{ij}$ to the first,
fifth, sixth, and fourteenth neighboring bonds then fit the spin wave along
both $(0,k,0)$ and $(h,2,0)$ directions simultaneously using least-square
fitting routine to the modeled Hamiltonian.

Our result is, although qualitatively consistent with the DFT in terms of the
representative leading exchange couplings, still quantitively deviated from
the proposed honeycomb model. We note that for the data collected at BT7,
despite its broad range covering from the magnetic zone center to the zone
boundary, the resolution is rather low. It is possible that the exact values
of the exchange interactions could slightly deviate from our results. As a
result, despite the proposed honeycomb model with $J_{5}$ and $J_{6}$ as the
leading exchange interactions, we instead get the largest value of 8.5(6) meV
on $J_{1}$ which is also much higher than that in $\alpha$-CVO [7]. The fitted
results are shown by the red lines in Fig. 7 whereas the fitted parameters are
summarized in Table 6. These couplings yield the average in-plane exchange
interactions $(J_{1}+2J_{5}+J_{6})/4$ = 5.3(2) meV. It should be noted that we
also failed to fit our data when the second neighbor $J_{2}$ ($J_{a}$ in Ref
[15]) was introduced, in agreement with the DFT that this bond is rather weak
and hence the previously proposed spin-chain model for this system is
unfeasible. Although $J_{14}$ is rather weak compared to $J_{1}$ and $J_{5}$,
this bond is non-negligible. This evidence leads us to conclude that the spin
network of ZnCVO should be better described by the anisotropic 2D lattice with
weak interplane couplings. Lastly, the calculated intensities of the
dispersion along both $(0,k,0)$ and $(h,2,0)$ directions using the parameters
in Table 6 as shown in Fig. 7 (d) and (h) can well describe the measured
intensity maps.

Table 6: The parameters obtained from the fit to the spin wave dispersions. $J_{1}$ (meV) |  $J_{5}$ (meV) |  $J_{6}$ (meV) |  $J_{14}$ (meV) |  $G$ (meV)
---|---|---|---|---
8.5(6) | 5.3(3) | 1.9(4) | 0.5(1) | 0.0044(3)

##  IV Conclusion

Our thorough x-ray and neutron diffractions have proved that ZnCVO is
isostructural with $\beta$-CVO with a slight deviation in the lattice
parameters. The large-sized single-crystals of ZnCVO can also be successfully
grown from ZnCVO powder using the vertical gradient furnace. The system
undergoes a paramagnetic to antiferromagnetic phase transition at
$T_{\text{N}}\simeq$ 26 K. Magnetic structure determination using powder
neutron diffractions suggested that, among the four possible magnetic
irreducible representations, the diffraction pattern of ZnCVO can be best
described by $\Gamma_{4}$ where the Cu2+ spins anti-aligned with their
neighbors along the crystallographic $c$-axis with the refined magnetic moment
of $m_{c}$ = 0.72(9)$\mu_{B}$.

Magnetic susceptibility data of ZnCVO show large anisotropy between
$H\parallel a$ and $H\perp a$ similar to the previous work on $\beta$-CVO.
This suggests that not only does ZnCVO has the same crystal structure as
$\beta$-CVO but they also share the same magnetic properties. The Curie-Weiss
fit to the inverse magnetic susceptibility yields Curie-Weiss temperatures of
$\Theta\simeq$ -80 K to -90 K (depending on the magnetic field direction)
indicating the dominant antiferromagnetic exchange interactions. Our QMC
simulation based on the spin-wave results can well reproduce the broad maximum
on the magnetic susceptibility data.

Our inelastic neutron scattering data along $(0,k,0)$ and $(h,2,0)$ reveal
typical symmetric spin-wave dispersion around the magnetic zone center,
proving that the change from non-centrosymmetric to centrosymmetric crystal
results in the absence of DM interaction and, thus, the nonreciprocal magnons.
From DFT prediction and our magnetic structure results, we were able to fit
the spin-wave dispersions data with the modeled spin Hamiltonian. Although the
result is qualitatively consistent with the proposed
$J_{1}-J_{5}-J_{6}-J_{14}$ model with strong coupling within the $bc$-plane
and a rather weak interaction along $a^{*}$, the fitted values quantitatively
deviate from the DFT calculations. Despite the proposed $J_{5}-J_{6}$ with
weak $J_{1}$ and $J_{14}$ interactions, we obtained dominant $J_{1}-J_{5}$
with non-negligible $J_{6}$ and weak $J_{14}$. As a result, the network in
ZnCVO resembles the anisotropic 2D lattice rather than the honeycomb lattice.
These 2D spin networks are coupled through the weak interplane interaction
$J_{14}$ resulting in the 3D ordered ground state.

###### Acknowledgements.

G.G. would like to thank P. Limsuwan for his useful discussions. This work
(Grant No. RGNS 63-203) was supported by the Office of the Permanent
Secretary, Ministry of Higher Education, Science, Research and Innovation (OPS
MHESI), Thailand Science Research and Innovation (TSRI), and Phranakhon
Rajabhat University. Work at Mahidol University was supported by the Thailand
Center of Excellence in Physics and the National Research Council of Thailand
(Grant No. N41A640158). P. S. was supported by the RGJ-PhD scholarship (Grant
No. PHD/0114/2557) from Thailand Research Fund. We acknowledge the support of
the National Institute of Standards and Technology, U.S. Department of
Commerce, in providing the neutron research facilities used in this work. The
identification of any commercial product or trade name does not imply
endorsement or recommendation by the National Institute of Standards and
Technology. A portion of this research used resources at the High Flux Isotope
Reactor, a DOE Office of Science user facility operated by the Oak Ridge
National Laboratory.

## References

  * Sands [1969] D. E. Sands,  _Introduction to cyrstallography_ (University of Kentucky, Lexington. W. A. Benjamin Inc., New York, 1969).
  * Dzyaloshinsky [1958] I. Dzyaloshinsky, A thermodynamic theory of “weak” ferromagnetism of antiferromagnetics, Phys. Rev. Lett. 4, 241 (1958).
  * Moriya [1960] T. Moriya, Anisotropic superexchange interaction and weak ferromagnetism, Phys. Rev. 120, 91 (1960).
  * Hayami  _et al._ [2016] S. Hayami, H. Kusunose, and Y. Motome, Asymmetric Magnon Excitation by Spontaneous Toroidal Ordering, J. Phys. Soc. Jpn. 85, 053705 (2016).
  * Tokura and Nagaosa [2018] Y. Tokura and N. Nagaosa, Nonreciprocal responses from non-centrosymmetric quantum materials, Nat Commun 9, 3740 (2018).
  * Sato and Matan [2019] T. J. Sato and K. Matan, Nonreciprocal magnons in noncentrosymmetric magnets, J. Phys. Soc. Jpn. 88, 081007 (2019).
  * Gitgeatpong  _et al._ [2017] G. Gitgeatpong, M. Suewattana, S. Zhang, A. Miyake, M. Tokunaga, P. Chanlert, N. Kurita, H. Tanaka, T. J. Sato, Y. Zhao, and K. Matan, High-field magnetization and magnetic phase diagram of $\alpha$-Cu2V2O7, Phys. Rev. B 95, 245119 (2017).
  * Petrova  _et al._ [2005] S. A. Petrova, R. G. Zakharov, M. V. Rotermel, T. I. Krasnenko, and N. A. Vatolin, A new high-temperature modification of copper pyrovanadate, Dokl. Chem. 400, 770 (2005).
  * Robinson  _et al._ [1987] P. D. Robinson, J. M. Hughes, and M. L. Malinconico, Blossite, $\alpha$-Cu${}_{2}^{2+}$V${}_{2}^{5+}$O7, Am Mineral. 72, 397 (1987).
  * Hughes and Birnie [1980] J. M. Hughes and R. Birnie, Ziesite, $\beta$-Cu2V2O7, a new copper vanadate and fumarole temperature indicator, Am. Mineral. 65, 1146 (1980).
  * Mercurio-Lavaud and Frit [1973] D. Mercurio-Lavaud and M. B. Frit, Structure cristalline de la variété haute température du pyrovanadate de cuivre: Cu2V2O7, C. R. Acad. Sci. Paris. C 227, 1101 (1973).
  * Pommer  _et al._ [2003] J. Pommer, V. Kataev, K.-Y. Choi, P. Lemmens, A. Ionescu, Y. Pashkevich, A. Freimuth, and G. Güntherodt, Interplay between structure and magnetism in the spin-chain compound (Cu,Zn)2V2O7, Phys. Rev. B 67, 214410 (2003).
  * He and Ueda [2008a] Z. He and Y. Ueda, Flux growth of $\beta$-Cu2V2O7 single crystals in a closed crucible, Cryst. Growth Des. 8, 2223 (2008a).
  * Yashima and Suzuki [2009] M. Yashima and R. O. Suzuki, Electronic structure and magnetic properties of monoclinic $\beta$-Cu${}_{2}^{2+}$V${}_{2}^{5+}$O7: A GGA + $U$ study, Phys. Rev. B 79, 125201 (2009).
  * Tsirlin  _et al._ [2010] A. A. Tsirlin, O. Janson, and H. Rosner, $\beta$-Cu2V2O7: A spin-$\frac{1}{2}$ honeycomb lattice system, Phys. Rev. B 82, 144416 (2010).
  * Bhowal  _et al._ [2017] S. Bhowal, J. Sannigrahi, S. Majumdar, and I. Dasgupta, A comparative study of electronic, structural, and magnetic properties of $\alpha$-, $\beta$-, and $\gamma$-Cu2V2O7, Phys. Rev. B 95, 075110 (2017).
  * Krasnenko  _et al._ [2008] T. I. Krasnenko, M. V. Rotermel, S. A. Petrova, R. G. Zakharov, O. V. Sivtsova, and A. N. Chvanova, Phase relations in the Zn2V2O7-Cu2V2O7 system from room temperature to melting, Russ. J. Inorg. Chem. 53, 1641 (2008).
  * Slobodin and Samigullina [2009] B. V. Slobodin and R. F. Samigullina, Thermoanalytical study of the polymorphism and melting behavior of Cu2V2O7, Inorg. Mater. 46, 196 (2009).
  * Clark and Garlick [1977] G. M. Clark and R. Garlick, Formation and properties of copper(II) divanadate(V), J. Inorg. Nucl. Chem. 40, 1347 (1977).
  * Nord and Stefanidis [1985] A. G. Nord and T. Stefanidis, Crystal chemistry of $\alpha$-(Zn, M)2V2O7 solid solutions correlation between preference for five-coordination and extension of solid solubility, Mat. Res. Bull. 20, 845 (1985).
  * Schindler and Hawthorne [1999] M. Schindler and F. C. Hawthorne, Structural characterization of the $\beta$-Cu2V2O7-$\alpha$-Zn2V2O7 solid solution, J. Solid State Chem. 146, 271 (1999).
  * Kataev  _et al._ [2000] V. Kataev, J. Pommer, K. Y. Choi, P. Lemmens, A. Ionescu, Y. Pashkevich, K. Lamonova, A. Möller, A. Freimuth, and G. Güntherodt, Magnetic exchange in a low-dimensional complex oxide (Cu, Zn)V2O7, J. Magn. Magn. Mater. 272-276, 933 (2000).
  * Salah  _et al._ [2005] A. A. Salah, K. Benkhouja, K. Jaafari, J. R. de Paz, E. Climent, and R. S. Puche, Structural characterization and magnetic properties of divanadates ZnMV2O7 (M = Co, Ni, and Cu), J. Alloys Compd. 402, 213 (2005).
  * Sotojima  _et al._ [2007] K. Sotojima, R. O. Suzuki, K. Amezawa, and Y. Tomii, Thermoelectric properties and phase transition of (ZnxCu2-x)V2O7, Mater. Trans. 48, 2094 (2007).
  * Wang  _et al._ [2019] H. Wang, M. Yang, M. Chao, J. Guo, Q. Gao, Y. Jiao, X. Tang, and E. Liang, Negative thermal expansion property of $\beta$-Cu2V2O7, Solid State Ion. 343, 115086 (2019).
  * Sato  _et al._ [2020] M. Sato, V. Warne-Lang, Y. Kadowaki, N. Katayama, Y. Okamoto, and K. Takenaka, Sol-gel synthesis of doped Cu2V2O7 fine particles showing giant negative thermal expansion, AIP Adv. 10, 075207 (2020).
  * Shi  _et al._ [2020] N. Shi, A. Sanson, A. Venier, L. Fan, C. Sun, X. Xing, and J. Chen, Negative and zero thermal expansion in $\alpha$-(Cu2-xZnx)V2O7 solid solutions, Chem Commun. 56, 10666 (2020).
  * Muthamizh  _et al._ [2020] S. Muthamizh, J. Yesuraj, R. Jayavel, D. Contreras, K. A. Varman, and R. V. Mangalaraja, Microwae synthesis of $\beta$-(Cu2-xZnx)V2O7 nanorods: structural, electrochemical supercapacitance, and photocatalytic properties, J. Mater. Sci. Mater. Electron. 32, 2744 (2020).
  * Song  _et al._ [2020] A. Song, A. Chemseddine, I. Y. Ahmet, P. Bogdanoff, D. Friedrich, F. F. Abdi, S. P. Berglund, and R. van de Krol, Synthesis and characterization of CuV2O6 and Cu2V2O7: Two photoanode candidates for photoelectrochemical water oxidation, Chem. Mater. 32, 2408 (2020).
  * Zhuravlev  _et al._ [1992] V. D. Zhuravlev, Y. A. Velikodnyi, and L. L. Surat, Isomorphous miscibility of calcium, copper, and zinc metavanadates, Russ. J. Inorg. Chem. 37, 736 (1992).
  * Streltsov  _et al._ [2005] V. A. Streltsov, P. N. H. Nakashima, A. N. Sobolev, and R. P. Ozerov, Crystal structure study of a $\beta^{\prime}$-copper vanadium bronze, CuxV2O5 ($x$ = 0.63), by X-ray and convergent beam electron diffraction, Acta Cryst. B61, 17 (2005).
  * Sears [1992] V. F. Sears, Neutron scattering lengths and cross sections, Neutron News 3, 29 (1992).
  * Rodriguez-Carvajal [1993] J. Rodriguez-Carvajal, Recent advances in magnetic structure determination by neutron powder diffraction, Physica B 192, 55 (1993).
  * Litvin [2013] D. B. Litvin,  _Magnetic Group Tables: 1-, 2- and 3-Dimensional Magnetic Subperiodic Groups and Magnetic Space Groups_ (Interanational Union of Crystallography, Chester, England, 2013) https://www.iucr.org/publ/978-0-9553602-2-0 .
  * He and Ueda [2008b] Z. He and Y. Ueda, Paramagnetic anisotropy and spin-flop transition in single crystals of the quasi-one-dimensional system $\beta$-Cu2V2O7, Phys. Rev. B. 77, 052402 (2008b).
  * Bag  _et al._ [2021] P. Bag, N. Ahmed, V. Singh, M. Sahoo, A. A. Tsirlin, and R. Nath, Low-dimensional magnetism of BaCuTe2O6, Phys. Rev. B 103, 134410 (2021).
  * Jahn and Teller [1937] H. A. Jahn and E. Teller, Stability of polyatomic molecules in degenerate electronic states - I$-$Orbital degeneracy, Proc. R. Soc. A. 161, 220 (1937).
  * Gitgeatpong  _et al._ [2015] G. Gitgeatpong, Y. Zhao, M. Avdeev, R. O. Piltz, T. J. Sato, and K. Matan, Magnetic structure and Dzyaloshinskii-Moriya interaction in the $S=\frac{1}{2}$ helical-honeycomb antiferromagnet $\alpha$-Cu2V2O7, Phys. Rev. B 92, 024423 (2015).
  * Eggert  _et al._ [2002] S. Eggert, I. Affleck, and M. D. P. Horton, Néel order in doped quasi-one-dimensional antiferromagnets, Phys. Rev. Lett. 89, 047202 (2002).
  * Todo and Kato [2001] S. Todo and K. Kato, Cluster Algorithms for General- $S$ Quantum Spin Systems, Phys. Rev. Lett 87, 047203 (2001).
  * Albuquerque  _et al._ [2007] A. Albuquerque, F. Alet, P. Corboz, P. Dayal, A. Feiguin, S. Fuchs, L. Gamper, E. Gull, S. Gürtler, A. Honecker, R. Igarashi, M. Körner, A. Kozhevnikov, A. Läuchli, S. R. Manmana, M. Matsumoto, I. P. McCulloch, F. Michel, R. M. Noack, G. Pawłowski, L. Pollet, T. Pruschke, U. Schollwöck, S. Todo, S. Trebst, M. Troyer, P. Werner, and S. Wessel, The ALPS project release 1.3: Open-source software for strongly correlated systems, J. Magn. Magn. Mater 310, 1187 (2007).
  * Johnston  _et al._ [2000] D. C. Johnston, R. K. Kremer, M. Troyer, X. Wang, A. Klümper, S. L. Bud’ko, A. F. Panchula, and P. C. Canfield, Thermodynamics of spin $S=1/2$ antiferromagnetic uniform and alternating-exchange Heisenberg chains, Phys. Rev. B 61, 9558 (2000).
  * Anderson [1952] P. W. Anderson, An approximate quantum theory of the antiferromagnetic ground state, Phys. Rev. 86, 694 (1952).
  * Kubo [1952] R. Kubo, The spin-wave theory of antiferromagnetics, Phys. Rev. 87, 568 (1952).


# SSL-Cleanse: Trojan Detection and Mitigation in Self-Supervised Learning

Mengxin Zheng These authors contributed equally to this work. Indiana
University Bloomington, Bloomington, Indiana, USA  Jiaqi Xue∗ University of
Central Florida, Orlando, Florida, USA  Zihao Wang  Indiana University
Bloomington, Bloomington, Indiana, USA  Xun Chen  Samsung Research America,
Mountain View, California, USA  Qian Lou  University of Central Florida,
Orlando, Florida, USA  Lei Jiang  Indiana University Bloomington, Bloomington,
Indiana, USA  Xiaofeng Wang  Indiana University Bloomington, Bloomington,
Indiana, USA

###### Abstract

Self-supervised learning (SSL) is a prevalent approach for encoding data
representations. Using a pre-trained SSL image encoder and subsequently
training a downstream classifier, impressive performance can be achieved on
various tasks with very little labeled data. The growing adoption of SSL has
led to an increase in security research on SSL encoders and associated Trojan
attacks. Trojan attacks embedded in SSL encoders can operate covertly,
spreading across multiple users and devices. The presence of backdoor behavior
in Trojaned encoders can inadvertently be inherited by downstream classifiers,
making it even more difficult to detect and mitigate the threat. Although
current Trojan detection methods in supervised learning can potentially
safeguard SSL downstream classifiers, identifying and addressing triggers in
the SSL encoder before its widespread dissemination is a challenging task.
This challenge arises because downstream tasks might be unknown, dataset
labels may be unavailable, and the original unlabeled training dataset might
be inaccessible during Trojan detection in SSL encoders. We introduce SSL-
Cleanse as a solution to identify and mitigate backdoor threats in SSL
encoders. We evaluated SSL-Cleanse on various datasets using 1200 encoders,
achieving an average detection success rate of $82.2\%$ on ImageNet-100. After
mitigating backdoors, on average, backdoored encoders achieve $0.3\%$ attack
success rate without great accuracy loss, proving the effectiveness of SSL-
Cleanse.

##  1 Introduction

Self-supervised learning (SSL) has seen remarkable advancements, particularly
in computer vision applications [1, 13, 18, 2]. This is particularly evident
when labeled examples are scarce. Unlike supervised learning, SSL sidesteps
the labor-intensive labeling process, training on pretext tasks generalizable
to many downstream tasks [2, 7, 3]. Several studies have demonstrated that SSL
can achieve comparable [7] and in some cases even superior, performance in
few-shot learning [27, 28]. The extensive use of SSL has spurred security
research and vulnerability exploration in SSL encoders, as evidenced by the
emergence of various Trojan attacks [21, 11, 29, 16, 17].

Figure 1: The overview of SSL-Cleanse. SSL-Cleanse has two components,
Detector and Mitigator, aiming to remove the malicious behavior of Trojaned
SSL encoders.

Malicious backdoor (a.k.a, Trojan) attacks embed a specially-designed trigger
in inputs, making the compromised model classify them into a predefined target
class with high confidence. If the trigger is removed from the input, the
backdoored model will still exhibit normal behaviors with almost the same
accuracy as its clean counterpart. One direction of SSL backdoor attacks
assumes the attacker can control the training phase and modify the loss
function to achieve training-control SSL backdoor [11] with high attack
effects. In contrast, another popular SSL backdoor direction is training-
agnostic [21, 16] where SSL backdoor attacks are executed in three phases. The
first stage involves poisoning unlabeled datasets by adding triggers into a
small fraction of target-class images. The second phase entails training the
SSL encoder on the poisoned dataset to establish a connection between the
trigger and target-class images. In the final step, any downstream classifiers
that are fine-tuned on the backdoored encoder inherit the backdoor behavior
[21, 16]. The current training-agnostic backdoor attacks have demonstrated an
attack success rate of over 98% on the ImageNet-100 dataset [16]. Our goal in
this work is to scan SSL encoders and mitigate backdoor threats against such
attacks.

Trojan attacks in SSL encoders [21, 16] are perilous not only lies in their
competitive attack success rates but also their covert functionality and broad
reach across users and devices. Firstly, pre-trained SSL encoders are
typically spread out in real-world scenarios and subsequently fine-tuned for
downstream classifiers. However, these downstream classifiers may
inadvertently inherit the backdoor behaviors of Trojaned encoders. While
current popular Trojan detection techniques [26, 19, 12] in supervised
learning may have the potential to protect SSL downstream classifiers,
detecting and mitigating triggers in the SSL encoder prior to its wide
distribution is a complex undertaking. Recent encoder scanning techniques, as
mentioned in [6], recognize their inability to detect these Trojaned SSL
encoders [21, 16] because of the distinct covert attack characteristics. We
contend that detecting and mitigating Trojans in SSL encoders is crucial since
it can impede the malicious distribution of Trojaned encoders. However, there
is a research gap to bridge the popular backdoor defense methods in supervised
learning with an SSL encoder. Detecting Trojans in SSL encoders is challenging
due to unknown downstream tasks, unavailable dataset labels, and limited
access to the original training dataset. Even the linear probe strategy, which
builds downstream classifiers, fails to detect these threats, as elaborated in
the Limitations of Related Backdoor Defense section. So it is crucial to
implement effective detection and defense against such backdoor attacks on SSL
encoders.

This paper introduces SSL-Cleanse, a novel backdoor defense method as
illustrated in Figure 1. The proposed approach comprises two main components,
namely Detector and Mitigator. The Detector is responsible for identifying the
presence of Trojan in an SSL encoder, and if found, the Mitigator can mitigate
the backdoor attack effect. Our SSL-Cleanse overcomes the challenges of
backdoor detection without knowing the labeled data and the downstream tasks.

Our contributions can be summarized as follows:

  * •

We design a framework to detect training-agnostic attacks in SSL encoders
without downstream labels. We reveal it is possible to prevent the
dissemination of Trojaned SSL encoders via our SSL-Cleanse.

  * •

We introduce the Sliding Window Kneedle (SWK) algorithm to auto-estimate
cluster counts in unlabeled datasets, aiding representation clustering. We
also present the representation-oriented trigger reverse (ROTR) method for SSL
trigger inversion, alongside the Self-supervised Clustering Unlearning (SCU)
algorithm to mitigate SSL encoder backdoors.

  * •

We validate the effectiveness of the proposed SSL-Cleanse with extensive
experiments on 1200 encoders.

##  2 Background and Related Works

Self-Supervised Learning. Leveraging the large unlabeled data available in the
real world is essential. Self-Supervised Learning (SSL) is the most popular
method to learn representations from complex unlabeled data [1, 13]. Pre-
training an encoder with significant unlabeled data and fine-tuning it with a
small amount of labeled data has been shown to achieve comparable performance
to using large labeled datasets with supervised learning methods for various
downstream tasks [1, 13, 18, 2, 10, 15, 8]. Furthermore, SSL techniques that
rely on instance discrimination, such as SimCLR [1] and MoCo V2 [2], have
become increasingly popular for learning competitive visual representations
through the use of contrastive loss. Typically, an SSL classification task
involves pre-training an image encoder, constructing a classifier, and
subsequent fine-tuning.

Figure 2: The workflow of SSL-Cleanse detector. Step 1: Unlabeled data samples are processed through the SSL encoder to compute their representations. The SWK algorithm is then utilized to process representations and determine the number of clusters. Step 2: Using K-Means with the derived cluster number (K) and representation, K clusters are established. Subsequently, the Representation Oriented Trigger Reverse algorithm is employed to generate K trigger patterns. Step 3: Accessing if any of the K triggers are outliers in terms of their size and norm. The identified outlier indicates the encoder is Trojaned. Table 1: Limitations of Current Backdoor Detectors in Assessing SSL Encoders, such as SSL-Backdoor [21] and CTRL [16]. The encoder undergoes pre-training on CIFAR-10, while the built classifiers are evaluated on CIFAR-10, STL-10, and GTSRB. These datasets have labels that overlap, partially overlap, or do not overlap at all with the encoder. If NC [26] Index $>$ 2.0 and ABS [19] REASR $>$ 0.88, the model is seen as Trojaned.  SSL Attack Method |  Downstream Task (Linear probe) | NC | ABS
---|---|---|---
Anomaly Index | REASR
SSL- Backdoor | CIFAR-10 | $2.05$ | $0.89$
STL-10 | $1.42$ | $0.34$
GTSRB | $1.68$ | $0.29$
CTRL | CIFAR-10 | $1.52$ | $0.52$
STL-10 | $1.28$ | $0.44$
GTSRB | $1.16$ | $0.37$

SSL Backdoor Attacks. In SSL backdoor attacks, the first line of research [11]
links the trigger to the downstream-task label, necessitating triggers to be
appended to varying class inputs. Compared to other directions, it assumes a
stronger threat model in which the adversary dominates the training process,
e.g., modifying the loss functions. Another methodology [17] focuses on
specific input sets, formulating poisoned data by combining these inputs with
their corresponding reference representations. However, it functions only with
predetermined specific inputs and not with any inputs that contain embedded
triggers. A distinct approach [21, 16] avoids modifying the training phase,
achieving a high attack success rate by merely connecting the trigger with
desired unlabeled samples. Notably, compared to the first approach, these SSL
attacks are much more challenging to discern since triggers are solely
attached to the unlabeled targets, and combining triggers with other targets
does not consistently yield similar representations [6]. In our study, we aim
to detect these third-category attacks.

Limitations of Related Backdoor Defense. Prior scanners like NC [26] and ABS
[19] face challenges in detecting backdoors in SSL encoders. The primary
reasons include the often-unknown downstream tasks/labels. While the linear
probe method, i.e., constructing downstream classifiers from various datasets
using pre-trained encoders, offers an alternative, it is not efficacious in
scanning SSL encoders. For example, we built a backdoored encoder using
CIFAR-10 [14] with a specific label, airplane, as the target. This encoder was
then utilized to train three distinct downstream classifiers on CIFAR-10,
STL-10 [4], and GTSRB [24]. The results from applying NC and ABS to these
classifiers are shown in Table 1. For scenarios where the encoder and the
downstream task share the same dataset, both NC and ABS can detect Trojaned
classifiers and hence the backdoored encoders for SSL-Backdoor [21], with
encoder’s Anomaly Index of 2.05 $>$ 2.00 in NC and a REASR of 0.89 $>$ 0.88 in
ABS. Yet, the detection capability requires the knowledge of the downstream
tasks and the detection capability diminishes when the datasets (like STL-10
or GTSRB) either only partially overlap or do not align at all with CIFAR-10.
For the CTRL instance, both tools fail in detection, even when there’s label
congruence between the encoder and classifiers. The introduction of global
frequency triggers in CTRL exacerbates the detection difficulty. While the
recent study DECREE [6] effectively detects backdoors in training-controlled
attackers, like BadEncoder [11], it acknowledges the failure in identifying
stealthy training-agnostic attacks [21, 16], e.g., $\sim$ 50% detection
accuracy. Also, scanners such as PatchSearch [25] and ASSET [20] are
orthogonal to our method since they are introduced to identify poisoned
samples in a training dataset. In our threat model, the SSL encoder is
required but there’s no requirement for the poisoned training dataset.

##  3 SSL-Cleanse Design Overview

Defense Assumptions and Goals. We assume that the defender has access to a
pre-trained SSL encoder, a small portion of the unlabeled dataset (which could
be distinct from the training set, i.e., SSL-Cleanse does not require
attackers to disclose their poisoned dataset).

Goals. We have two specific goals:

  * •

Detecting backdoor: Our aim is to make a binary determination regarding the
potential backdoor infection of a given SSL encoder. If infected, we also want
to identify the potential target classes of the backdoor attack.

  * •

Mitigating backdoor: We plan to reversely generate the trigger used by the
attack. Our ultimate goal is to deactivate the backdoor, making it
ineffective. This requires eliminating the backdoor while preserving the
classification performance of the SSL encoder for normal inputs.

Challenges and Motivation. An inherent challenge of SSL backdoor detection
lies in the indeterminate nature of the target class. While this can be
addressed by iteratively searching through all classes, this method is not
suitable for SSL encoders due to the uncertainty in class numbers for
unlabeled datasets in SSL. Traditional clustering methods, like K-Means [23],
necessitate manual predetermination of cluster counts $K$. We observe that
though automatic cluster number determination methods, such as the Kneedle
algorithm [22], exist, they struggle with accurate class number prediction for
SSL encoders. For instance, the Kneedle algorithm identifies only 20 classes
within the ImageNet-100 dataset. This discrepancy could arise from noisy
samples affecting the clustering of SSL representations. To improve the
prediction accuracy of cluster numbers, we are motivated to further introduce
the Sliding-Window Kneedle (SWK) algorithm. It is designed to mitigate the
noise’s influence by introducing a sliding window to average the adjacent
Keedle scores.

Another challenge is how to efficiently generate triggers and identify outlier
triggers given predicted cluster numbers, encoder, and sampled unlabeled
dataset. This challenge is exaggerated when we target to detect attacks [16]
based on frequency-domain global triggers since one cannot identify outlier
triggers according to the trigger size. For these reasons, we are motivated to
propose Representation-Oriented Trigger Reverse (ROTR) method to generate
triggers via clustered representations. For identifying patch-wise trigger SSL
attacks, specifically SSL-Backdoor as referenced in [21], we continue to rely
on trigger size as a key outlier detection metric. However, when detecting the
frequency-domain SSL attack, CTRL as cited in [16], we propose to use the
magnitude of the trigger as the pivotal criterion. These detection
methodologies for both attack types are unified under RORP. Upon identifying
the triggers, it becomes feasible to pinpoint their related target-class
clusters. Following this, we introduce the Self-supervised Clustering
Unlearning (SCU) approach to mitigate backdoor threats in SSL encoders,
resulting in a cleansed encoder.

Figure 3: Comparison of our SWK method and direct search (Kneedle) method on
ImageNet-100 dataset. Our SWK method yields more stable and accurate K.

##  4 SSL-Cleanse Detector

Workflow. The workflow of the SSL-Cleanse detector, as shown in Figure 2,
consists of three steps. First, the SSL encoder processes a small amount of
unlabeled data to generate representations. Using these, the Sliding Window
Kneedle (SWK) algorithm determines the cluster count $K$. Subsequently,
K-Means creates K clusters, from which the Representation Oriented Trigger
Reverse algorithm derives K trigger patterns. Finally, if any trigger
significantly deviates in size or magnitude/norm, the encoder is deemed
Trojaned. The details of each step and the associated algorithms are
elaborated below.

Algorithm 1 Sliding Window Kneedle for SSL Cluster Num.

Input: SSL samples $D$, encoder $f$, pre-defined K_list

Output: predicted cluster number $K$

initialize clusters_list, s_list, padded_s_list, d_list = []

for $i=0$ to $len(K\\_list)$ do

clusters_list.$append(k\\-means(f(D)$ ,K_list[$i$]))

s_list$.append(silhouette(f(D)$,clusters_list[$i$]))

end for

initialize window size $w$ as a small odd number, e.g., 3

initialize swk_s_list to zero values of s_list’s structure

padded_s_list $\leftarrow$ pad $\frac{w-1}{2}$ zeros to head and tail of
$s\\_list$

for $i=1$ to $len$(s_list) do

swk_s_list[i]= $\frac{1}{w}\sum_{j=0}^{w}$ padded_s_list[i+j]

d_list.$append$($norm$(swk_s_list[i])-$norm$(K_list))

end for

$K\leftarrow$ index of maximum entry in (d_list)

Sliding Window Kneedle. Class numbers for unlabeled training samples in SSL
encoders are often unknown, even to model developers. At first glance,
clustering appears as an intuitive approach to determining class numbers. Yet,
conventional methods such as K-Means [23] demand a predetermined value for
$K$. Opting for an automated determination of the cluster number $K$ offers a
more flexible solution. To this end, we initially investigated existing
automatic methods, with a focus on the Kneedle algorithm [22].

Given the SSL samples $D$ and encoder $f$, the Kneedle algorithm starts by
initializing a list with potential $K$ values to examine. For each $K$ in this
list, the K-Means method clusters the representation $f(D)$, producing a
clustering outcome. The silhouette score for this clustering ranges from -1 to
1. A high value signifies that the data point is well-suited to its own
cluster and has a poor fit with neighboring clusters.

The silhouette score for a particular data point is computed using:
$s(i)=\frac{b(i)-a(i)}{\max\\{a(i),b(i)\\}}$ where $s(i)$ represents the
silhouette coefficient for data point $i$, $a(i)$ denotes the mean distance
between the $i^{th}$ data point and other points within the same cluster,
$b(i)$ is the smallest mean distance between the $i^{th}$ data point and
points in a different cluster, minimized over all clusters. The clusters’
overall silhouette score is the mean silhouette coefficient of all instances.

The Knee/elbow point on the plot, which represents silhouette scores over
varying $K$ values, indicates the optimal position. To identify the Knee
point, one should normalize the silhouette curve, adjust the origin to $[0,0]$
and ensure the endpoint aligns with $[1,1]$. Next, measure the distance of
each point on the curve from the direct line connecting the origin $[0,0]$ to
the endpoint $[1,1]$. The point that is furthest from this direct line is
recognized as the knee point of the curve.

In Figure 3, we illustrate the silhouette curvature distance for each point
$K$. The line corresponding to the direct search showcases the application of
the Kneedle algorithm. The most considerable distance is observed when $K=20$,
indicating the elbow point of the Silhouette score is 20. Nonetheless, this
estimation might not be precise, given that the SSL encoder $f$ is trained on
the ImageNet-100 dataset. This discrepancy may arise from the impact of noisy
samples on the clustering of SSL representations.

To address the high-dimensional noise and varied representations in the
encoder’s outputs, we enhanced the direct search (Kneedle) approach by
introducing a sliding window technique with a window size of $w$. The
underlying idea is to compute the average silhouette scores for neighboring
$K$ values, aiming to refine the silhouette curvature. As depicted in
Algorithm 1, our new algorithm, termed as Sliding Window Kneedle (SWK),
ingests the encoder $f$, SSL samples $D$, and a pre-set K_list. The output is
the anticipated cluster count, $K$. The foundation of SWK relies on the
Kneedle algorithm’s methodology to determine K-Means clustering
clusters_list[i] and silhouette scores for every specified K_list[i]. Post
silhouette score list (s_list) computation, the SWK introduces a window
dimension to derive the mean silhouette score, symbolized as swk_s_list, for
the neighboring $w$ scores. This process necessitates padding zeros to s_list,
resulting in padded_s_list. The silhouette curvature distance, d_list[i], is
deduced from the disparity between the normalized swk_s_list and K_list, with
normalization between [0,1]. The position of the largest value in d_list
dictates the predicted $K$. Figure 3 illustrates that the evolved SWK curve
offers better clarity in pinpointing the elbow juncture, diminishes noise, and
assures a more precise cluster estimation.

Algorithm 2 Representation-Oriented Trigger Reverse

Input: clustered samples $D_{i\in[1,K]}$, encoder $f$, cluster number $K$,
epoch number $E$

Output: masks $m^{1}_{i}$,$m^{2}_{i}$ perturbation
$\Delta^{1}_{i}$,$\Delta^{2}_{i}$ of $K$ clusters

for $i=1$ to $K$ do

initialize masks $m^{1}_{i}$,$m^{2}_{i}$ and perturbation
$\Delta^{1}_{i}$,$\Delta^{2}_{i}$

for $e=1$ to $E$ do

$x_{i}\leftarrow$ randomly sample an image from $D_{i}$ # target

$x_{j}\leftarrow$ randomly sample an image from $D_{j\neq i}$

$x^{1}_{j}\leftarrow(1-m_{i}^{1})\cdot x_{j}+m^{1}_{i}\cdot\Delta^{1}_{i}$

$x^{2}_{j}\leftarrow(1-m_{i}^{2})\cdot x_{j}+m^{2}_{i}\cdot\Delta^{2}_{i}$

$loss_{size}\leftarrow\mathcal{L}^{size}_{MSE}(f(x_{i}),f(x_{j}^{1}))$

$loss_{norm}\leftarrow\mathcal{L}^{norm}_{MSE}(f(x_{i}),f(x_{j}^{2}))$

$m^{1}_{i},\Delta^{1}_{i}\leftarrow
update(m^{1}_{i},\Delta^{1}_{i},loss_{size})$

$m^{2}_{i},\Delta^{2}_{i}\leftarrow
update(m^{2}_{i},\Delta^{2}_{i},loss_{norm})$

end for

end for

Representation-Oriented Trigger Reverse. Once the cluster count $K$ is
determined, K-Means can be readily employed to produce $K$ clustered samples,
denoted by $D_{i\in[1,K]}$, using the provided $D$. The subsequent goal is to
backtrack and identify Trojan triggers that are either compact in size or have
a minimal $l_{1}$-norm magnitude that can mimic the representations of target-
class samples. Algorithm 2 presents the ROTR approach. The core concept
involves creating two triggers for each cluster representation. It then
determines which representation clusters can yield outlier triggers, either
having smaller patch-based trigger sizes $|m_{i}^{1}|$ for patch-based trigger
attacks or lesser trigger magnitudes $m_{i}^{2}\cdot\Delta_{i}^{2}$ for
global-trigger attacks. Initially, we designate trigger masks $m_{i}$ to
specify the location of the trigger pixel, while $\Delta_{i}$ signifies the
associated pixel value for the $i$-th trigger. Consequently, the trigger
$r_{i}$ is computed as $m_{i}\cdot\Delta_{i}$. To identify both patch-based
triggers and frequency-domain global triggers, we suggest initiating two
distinct trigger sets: $r_{i}^{1}=m_{i}^{1}\cdot\Delta_{i}^{1}$ and
$r_{i}^{2}=m_{i}^{2}\cdot\Delta_{i}^{2}$, where $m_{i}^{1}$ and $m_{i}^{2}$
represent masks and $\Delta_{i}^{1}$ and $\Delta_{i}^{2}$ delineate the pixel
values of the triggers. For each cluster, we conduct $E$ epochs to produce
these twin trigger sets. Specifically, we randomly select an image from
$D_{i}$ to as the clean sample $x_{i}$ and subsequently get sample to add
trigger, termed $S_{j}$, from $D_{j\neq i}$. We then affix the pre-established
two trigger sets to $x_{j}$, resulting in $x_{j}^{1}$ and $x_{j}^{2}$
respectively.

The clean image $x_{i}$ and images with trigger $x_{j}^{1}$ and $x_{j}^{2}$
are then sent to an encoder $f$, and two separate loss functions are employed
to update the trigger such that its representation can have more similarity
with $x_{i}$’s feature. The loss functions used in the ROTR to optimize
$m_{i}^{1}$, $m_{i}^{2}$ and $\Delta_{i}^{1}$, $\Delta_{i}^{2}$ on the
$i^{th}$ cluster are given by Equation 1 and Equation 2, respectively. Each
loss function comprises two components. The foremost objective of the first
term is to guarantee the similarity between the image patched with the trigger
and the target class image in the feature space. The second term is
responsible for constraining the size or the trigger magnitude/norm of the
reversed trigger, we adapted $\lambda$ dynamically during optimization in our
experiment. The dynamic scheduler is described in the supplementary material.
Finally, the resulting trigger patterns are sent to an outlier detector for
determination.

$\mathcal{L}^{size}_{MSE}(f(x_{i}),f(x_{j}^{1}))=-\frac{<f(x_{i}),f(x_{j}^{1})>}{||f(x_{i})||\cdot||f(x_{j}^{1})||}+\lambda\cdot|m^{1}_{i}|$
(1)

$\mathcal{L}^{norm}_{MSE}(f(x_{i}),f(x_{j}^{2}))=-\frac{<f(x_{i}),f(x_{j}^{2})>}{||f(x_{i})||\cdot||f(x_{j}^{2})||}+\lambda\cdot|m^{2}_{i}\cdot\Delta^{2}_{i}|$
(2)

Here $<a,b>$ and $||a||$ represent the cosine similarity of $a$ and $b$, and
the $l2$-norm of $a$, respectively.

Size-Norm Trigger Outlier Detector. Beyond just using trigger size to identify
outliers for patch-wise trigger attacks, e.g., SSL-Backdoor [21], we recognize
trigger magnitude/norm as a key criterion for global-trigger attacks stemming
from frequency-domain disturbances, e.g., CTRL [16]. Our proposed Size-Norm
Trigger Outlier Detection (STOD) is designed to detect both patch-based and
global-based triggers. In particular, given a trigger size list
$[(m_{1}^{1},\Delta_{1}^{1}),...,(m_{K}^{1},\Delta_{K}^{1})]$ and a trigger
norm list $[(m_{1}^{2},\Delta_{1}^{2}),...,(m_{K}^{2},\Delta_{K}^{2})]$, the
STOD outputs the detection result, i.e., benign or Trojaned with a trigger
dictionary $t_{s}$. For $K$ cluster, we iteratively check if the trigger size
$|m^{1}_{i}|$ and trigger norm $|m_{i}^{2}\cdot\Delta_{i}^{2}|$ is outlier in
the list of $|m_{[1:K]}^{1}|$ and $|m_{[1:K]}^{2}\cdot\Delta_{[1:K]}^{2}|$
using the function is_outlier($x_{i},\bm{x}$). Here
$is\\_outlier(x_{i},\bm{x})$ returns True if $M(x_{i},\bm{x})>2$, otherwise
False; The Anomaly Index function
$M(x_{i},\bm{x})=\frac{|x_{i}-median(\bm{x})|}{c\cdot
median(|x-median(\bm{x})|)}$ is used to ascertain if $x_{i}$ is an anomaly.
$c$ is a constant estimator which equals $1.4826$. If we discover a trigger
that is substantially smaller than the other candidates, we classify it as an
outlier and store its cluster number $i$ and itself in a dictionary $t_{s}$,
i.e., $t_{s}[i]=m_{i}\cdot\Delta_{i}$. If $t_{s}$ remains empty, we conclude
that the encoder is benign. However, if $t_{s}$ contains any triggers, we
classify the encoder as a Trojaned encoder.

Figure 4: Illustration of Self-supervised Clustering Unlearning (SCU). The
image $x$ is sampled from a cluster distinct from the cluster producing
trigger $t$.

##  5 SSL-Cleanse Mitigator

Once we have the triggers $t_{s}$ generated by our detector, their
corresponding target-class clusters become identifiable. Subsequently, we
introduce a Self-supervised Clustering Unlearning (SCU) strategy to mitigate
SSL encoder backdoor threats, leading to a purified encoder. The mitigation
approach is detailed in Algorithm 3. This method accepts cluster samples
$D_{i\in[1,k]}$, a Trojaned encoder $f$, and the trigger list $t_{s}$ as
inputs, producing a purified encoder $f^{\prime}$ in return. Since $K$
clusters are generated, we need to clean them one by one. For each cluster
$i$, we iteratively select clean image $x$ from each cluster samples $D_{i}$,
and augment the image to create a new training sample consisting of the
augmented images $x_{1}$ and $x_{2}$. Subsequently, we randomly select a
trigger from $t_{s}$ excluding $t_{s}[i]$ to make sure the image $x$ is
sampled from a cluster distinct from the cluster producing trigger $t$. Then
we attach trigger $t$ to $x_{2}$ or directly use $x_{i2}$ without adding a
trigger. The probability is $50\%$ which is the meaning of $equalSample$ in
Algorithm 3. The 50% means that we set an equal weight for attack removal and
clean accuracy. Notice that here we pass these new training samples through
the Trojaned encoder $f$ to obtain their respective representations. We then
optimize the similarity between the representations using a loss function by
fixing the model $f$ and updating the encoder $f^{\prime}$ to eliminate the
Trojan trigger effects, resulting in a clean encoder. Figure 4 illustrates the
mitigation process, where a clean image of a cat $x$ is augmented to generate
two cat images $x_{1}$ and $x_{2}$, one that is the same and another that has
a 50% chance of being attached with a Trojan trigger. The clean image is sent
to a reference model $f$, which maintains its parameters and representations
unchanged. In contrast, the other model $f^{\prime}$ is updated with the new
training sample to remove the Trojan trigger effect. The updated encoder is
deemed to be clean after it is able to accurately classify data, even in the
presence of the Trojan trigger.

Algorithm 3 Self-supervised Clustering Unlearning

Input: $D_{i\in[1,k]}$, Trojaned encoder $f$, trigger list $t_{s}$

Output: a clean encoder $f^{\prime}$

Initialize $f^{\prime}\leftarrow f$

for $i=1$ to $K$ do

for $x$ in $D_{i}$ do

$x_{1}\leftarrow aug_{1}(x)$; $x_{2}\leftarrow aug_{2}(x)$

$t\leftarrow$ randomly selected from $t_{s}$ excluding $t_{s}[i]$

$\hat{x_{2}}\leftarrow equalSample\\{aug_{2}(x\oplus t),aug_{2}(x)\\}$

$z,z^{\prime}=f(x_{1}),f^{\prime}(\hat{x_{2}})$

$loss\leftarrow-similarity(z,z^{\prime})$

$f^{\prime}\leftarrow update(f,loss)$

end for

end for

##  6 Experimental Methodology

Dataset. Our experiments were conducted on benchmark datasets: CIFAR-10 [14]
and ImageNet-100 [5]. ImageNet-100 is a random subset of 100 classes from the
larger ImageNet dataset and contains around 127,000 training images, which is
widely used in prior SSL attacks [21, 16].

SSL Attacks and Encoders. To assess the effectiveness of our detector against
various attack methods, we evaluated it against two backdoor attacks, namely
SSL-Backdoor [21]and CTRL [16] over BYOL [7], SimCLR [1], and MoCo V2 [2],
respectively. We created 50 benign encoders and 50 Trojaned encoders for each
backdoor attack setting, resulting in 1200 encoders. We follow the above
attack’s setting to use ResNet-18 [9] as encoder architecture.

Experimental Settings. Our experiments are performed on two Nvidia GeForce
RTX-3090 GPUs, each with a memory capacity of 24 GB. For the detector, the
initial value of $\lambda$ is set up as $0.01$. For detection and mitigation
running overhead, the detection method with $10\%$ of the ImageNet-100
training data consumes roughly 20 minutes, and the mitigation process requires
approximately 7 minutes.

Evaluation Metrics. We define the following evaluation metrics to study the
efficiency and effectiveness of our SSL-Cleanse. Detection Accuracy (DACC) is
detection accuracy which is the ratio of correctly identified encoder types
(either Benign or Trojan) relative to the total count of encoders. Attack
Success Rate (ASR) is defined as the ratio of images that contain the trigger
and are misclassified as the target class, to the total number of evaluated
images. Accuracy (ACC) is the percentage of input images without triggers
classified into their corresponding correct classes. TP indicates the true
positive count, referring to Trojaned encoder numbers detected by our
detector. FP represents false positives, indicating clean encoders
misclassified as Trojaned encoders by our detector.

Table 2: The detection performance of our SSL-Cleanse. Dataset | Method | SSL-Backdoor | CTRL
---|---|---|---
TP | FP | DACC(%) | TP | FP | DACC(%)
CIFAR-10 | BYOL | $35$ | $5$ | $80$ | $36$ | $4$ | $82$
SimCLR | $33$ | $4$ | $79$ | $39$ | $5$ | $84$
MoCo V2 | $31$ | $5$ | $76$ | $37$ | $5$ | $82$
ImageNet-100 | BYOL | $38$ | $8$ | $80$ | $43$ | $8$ | $85$
SimCLR | $34$ | $7$ | $77$ | $46$ | $8$ | $88$
MoCo V2 | $36$ | $7$ | $79$ | $42$ | $8$ | $84$
Table 3: The mitigation performance of our SSL-Cleanse. Dataset | Method | SSL-Backdoor | CTRL
---|---|---|---
Before mitigation | After mitigation | Before mitigation | After mitigation
ACC(%) | ASR(%) | ACC(%) | ASR(%) | ACC(%) | ASR(%) | ACC(%) | ASR(%)
CIFAR-10 | BYOL | $83.42$ | $48.32$ | $82.14$ | $1.14$ | $83.19$ | $60.47$ | $82.59$ | $1.96$
SimCLR | $84.88$ | $42.19$ | $83.53$ | $0.58$ | $80.74$ | $81.84$ | $79.60$ | $1.15$
MoCo V2 | $81.02$ | $37.95$ | $80.16$ | $0.92$ | $81.42$ | $77.51$ | $80.03$ | $1.62$
ImageNet-100 | BYOL | $60.57$ | $33.21$ | $60.24$ | $0.14$ | $53.33$ | $45.10$ | $52.65$ | $0.35$
SimCLR | $60.18$ | $31.85$ | $58.58$ | $0.62$ | $52.90$ | $44.98$ | $51.04$ | $0.33$
MoCo V2 | $61.57$ | $35.06$ | $60.10$ | $0.17$ | $50.62$ | $35.72$ | $48.88$ | $0.17$

##  7 SSL-Cleanse Results

Detection. In Table 2, we present the performance of our detector on two
training-agnostic SSL attacks including SSL-Backdoor and CTRL on three SSL
methods and two datasets. In total, our detection accuracy (DACC) across 1200
(600 Trojaned and 600 benign) encoders stands at $81.33\%$, illustrating the
efficacy of our backdoor detection capabilities. In particular, for the
ImageNet-100 dataset, the DACC is $>77\%$ and the average DACC is $82.17\%$.
For the CIFAR-10 dataset, the DACC is $>76\%$ and the average DACC is
$80.5\%$.

Table 2 further indicates that our SSL-Cleanse can detect not only the patch-
based trigger SSL attack SSL-Backdoor but also the frequency-based SSL attack
CTRL. This capability stems from our method’s utilization of trigger size and
magnitude for patch-based trigger detection in tandem with frequency-domain
detection. In particular, For SSL-Backdoor detection, SSL-Clease achieves
$78.5\%$ DACC on average for both CIFAR-10 and ImageNet-100 datasets. For
CTRL, it obtains $84.17\%$ average DACC. Against the CTRL, our detector
identifies 46 TP from 50 Trojaned SimCLR encoders on ImageNet and registers 8
FP among 50 clean SimCLR encoders.

Our SSL-Cleanse consistently exhibits reliable detection performance across
prevalent SSL training techniques such as BYOL, SimCLR, and MoCo V2. In
particular, our detector registers an average DACC of $81.75\%$, $82\%$, and
$80.25\%$ for BYOL, SimCLR, and MoCo V2, respectively.

Mitigation. Table 3 compares the attack success rate (ASR) and clean accuracy
(ACC) before and after applying the mitigator against SSL-Backdoor and CTRL on
the CIFAR-10 and ImageNet-100 dataset. On average, the ASR experiences a
marked reduction to below $2\%$, while the ACC declines to approximately $1\%$
before and after implementing mitigation.

In the case of patch-based SSL-Backdoor, our mitigation approach significantly
reduces the ASR to below $1.2\%$, demonstrating its successful eradication of
backdoor effects. Additionally, the ACC experiences an average decrease of
$1.15\%$ in backdoored models after applying our mitigator. Notably, when
utilizing the BYOL training method on the ImageNet-100 dataset, the ACC
remains relatively stable.

Regarding global frequency-based SSL attack CTRL, our mitigation strategy
substantially decreases the ASR to less than $2\%$, underscoring its effective
elimination of backdoor attacks. Furthermore, the ACC has an average decline
of $1.06\%$ in backdoored models after mitigation. Importantly, when employing
the BYOL training technique on both CIFAR-10 and ImageNet-100 datasets, the
ACC remains fairly consistent.

The SWK Effects. Figure 5 presents an ablation study on our SWK approach.
Employing SWK on ImageNet-100 yields a predicted number of $100$, in contrast
to $20$ as obtained using the direct search (Kneedle) method, as depicted in
Figure 3. Consequently, SWK delivers a detection accuracy of $80\%$, marking a
$30\%$ DACC improvement.

Outlier Detection Effects. Figure 6 shows our Size-Norm Trigger Outlier
Detector can successfully distinguish the outlier triggers from the
$K$-cluster trigger list for the trojaned encoders based on SSL-Backdoor and
CTRL. In particular, each box bar plots the trigger size $|m_{i}^{1}|$ and
trigger norm $|m_{i}^{2}\cdot\Delta_{i}^{2}|$ for SSL-Backdoor and CTRL,
respectively. Our Size-Norm trigger outlier detection can scan collectively,
without the presumption that the defender has prior knowledge of the attack
type.

Figure 5: A comparison of detection accuracy between SSL-Cleanse using the SWK method and the direct search (Kneedle)on ImageNet-100. Figure 6: The Size-Norm trigger outlier detection criteria is able to identify both patch-based SSL-Backdoor and frequency-domain global trigger in CTRL. The box plot shows min/max and quartiles. Table 4: Influence of the ratio of the unlabeled dataset to the entire training dataset on the detection efficacy. A larger ratio usually introduces a higher DACC.  Data ratio (%) | CIFAR-10 | ImageNet-100
---|---|---
TP | FP | DACC(%) | TP | FP | DACC(%)
$5$ | $28$ | $7$ | $71$ | $38$ | $6$ | $82$
$8$ | $37$ | $8$ | $79$ | $40$ | $7$ | $83$
$10$ | $38$ | $8$ | $80$ | $43$ | $8$ | $85$

Other Results. We analyze the influence of different dataset ratios on
detection performance using CTRL attack and BYOL training methods. We employ
varied image proportions, namely, $5\%$, $8\%$, and $10\%$. As illustrated in
Table 4, the results showcase an improvement in detection performance as the
proportion of the training dataset increases. The DACC for the CIFAR-10
dataset shows a $1\%$ increase between the $8\%$ and $10\%$ training datasets.
Moreover, for the ImageNet-100 dataset, there is an enhancement from $83\%$ to
$85\%$ in the DACC. Further details regarding the hyperparameters $\lambda$,
along with nuances about the influence of attacking trigger size and
perturbation norm, can be found in our supplementary material.

##  8 Conclusion

This paper introduces SSL-Cleanse, a novel work to detect and mitigate Trojan
attacks in SSL encoders without accessing any downstream labels. We evaluated
SSL-Cleanse on various datasets using 1200 models, achieving an average
detection success rate of $82.2\%$ on ImageNet-100. After mitigating
backdoors, on average, backdoored encoders achieve $0.3\%$ attack success rate
without great accuracy loss.

## References

  * [1] Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton.  A simple framework for contrastive learning of visual representations.  In International conference on machine learning, pages 1597–1607. PMLR, 2020.
  * [2] Xinlei Chen, Haoqi Fan, Ross Girshick, and Kaiming He.  Improved baselines with momentum contrastive learning.  arXiv preprint arXiv:2003.04297, 2020.
  * [3] Xinlei Chen and Kaiming He.  Exploring simple siamese representation learning.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 15750–15758, 2021.
  * [4] Adam Coates, Andrew Ng, and Honglak Lee.  An analysis of single-layer networks in unsupervised feature learning.  In Proceedings of the fourteenth international conference on artificial intelligence and statistics, pages 215–223. JMLR Workshop and Conference Proceedings, 2011.
  * [5] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei.  Imagenet: A large-scale hierarchical image database.  In 2009 IEEE Computer Society Conference on Computer Vision and Pattern Recognition (CVPR 2009), 20-25 June 2009, Miami, Florida, USA, pages 248–255. IEEE Computer Society, 2009.
  * [6] Shiwei Feng, Guanhong Tao, Siyuan Cheng, Guangyu Shen, Xiangzhe Xu, Yingqi Liu, Kaiyuan Zhang, Shiqing Ma, and Xiangyu Zhang.  Detecting backdoors in pre-trained encoders.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 16352–16362, 2023.
  * [7] Jean-Bastien Grill, Florian Strub, Florent Altché, Corentin Tallec, Pierre Richemond, Elena Buchatskaya, Carl Doersch, Bernardo Avila Pires, Zhaohan Guo, Mohammad Gheshlaghi Azar, et al.  Bootstrap your own latent-a new approach to self-supervised learning.  Advances in neural information processing systems, 33:21271–21284, 2020.
  * [8] Kaiming He, Haoqi Fan, Yuxin Wu, Saining Xie, and Ross Girshick.  Momentum contrast for unsupervised visual representation learning.  In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 9729–9738, 2020.
  * [9] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun.  Deep residual learning for image recognition.  In 2016 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2016, Las Vegas, NV, USA, June 27-30, 2016, pages 770–778. IEEE Computer Society, 2016.
  * [10] Ashish Jaiswal, Ashwin Ramesh Babu, Mohammad Zaki Zadeh, Debapriya Banerjee, and Fillia Makedon.  A survey on contrastive self-supervised learning.  Technologies, 9(1):2, 2020.
  * [11] Jinyuan Jia, Yupei Liu, and Neil Zhenqiang Gong.  Badencoder: Backdoor attacks to pre-trained encoders in self-supervised learning.  arXiv preprint arXiv:2108.00352, 2021.
  * [12] Soheil Kolouri, Aniruddha Saha, Hamed Pirsiavash, and Heiko Hoffmann.  Universal litmus patterns: Revealing backdoor attacks in cnns.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 301–310, 2020.
  * [13] Rayan Krishnan, Pranav Rajpurkar, and Eric J Topol.  Self-supervised learning in medicine and healthcare.  Nature Biomedical Engineering, pages 1–7, 2022.
  * [14] Alex Krizhevsky.  Learning multiple layers of features from tiny images.  Technical report, University of Toronto, 2009.
  * [15] Zhenzhong Lan, Mingda Chen, Sebastian Goodman, Kevin Gimpel, Piyush Sharma, and Radu Soricut.  Albert: A lite bert for self-supervised learning of language representations.  arXiv preprint arXiv:1909.11942, 2019.
  * [16] Changjiang Li, Ren Pang, Zhaohan Xi, Tianyu Du, Shouling Ji, Yuan Yao, and Ting Wang.  Demystifying self-supervised trojan attacks.  arXiv preprint arXiv:2210.07346, 2022.
  * [17] Hongbin Liu, Jinyuan Jia, and Neil Zhenqiang Gong.  Poisonedencoder: Poisoning the unlabeled pre-training data in contrastive learning.  arXiv preprint arXiv:2205.06401, 2022.
  * [18] Yixin Liu, Ming Jin, Shirui Pan, Chuan Zhou, Yu Zheng, Feng Xia, and Philip Yu.  Graph self-supervised learning: A survey.  IEEE Transactions on Knowledge and Data Engineering, 2022.
  * [19] Yingqi Liu, Wen-Chuan Lee, Guanhong Tao, Shiqing Ma, Yousra Aafer, and Xiangyu Zhang.  Abs: Scanning neural networks for back-doors by artificial brain stimulation.  In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, pages 1265–1282, 2019.
  * [20] Minzhou Pan, Yi Zeng, Lingjuan Lyu, Xue Lin, and Ruoxi Jia.  Asset: Robust backdoor data detection across a multiplicity of deep learning paradigms.  arXiv preprint arXiv:2302.11408, 2023.
  * [21] Aniruddha Saha, Ajinkya Tejankar, Soroush Abbasi Koohpayegani, and Hamed Pirsiavash.  Backdoor attacks on self-supervised learning.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 13337–13346, 2022.
  * [22] Ville Satopaa, Jeannie R. Albrecht, David E. Irwin, and Barath Raghavan.  Finding a ”kneedle” in a haystack: Detecting knee points in system behavior.  In 31st IEEE International Conference on Distributed Computing Systems Workshops (ICDCS 2011 Workshops), 20-24 June 2011, Minneapolis, Minnesota, USA, pages 166–171. IEEE Computer Society, 2011.
  * [23] Kristina P Sinaga and Miin-Shen Yang.  Unsupervised k-means clustering algorithm.  IEEE access, 8:80716–80727, 2020.
  * [24] Johannes Stallkamp, Marc Schlipsing, Jan Salmen, and Christian Igel.  The german traffic sign recognition benchmark: a multi-class classification competition.  In The 2011 international joint conference on neural networks, pages 1453–1460. IEEE, 2011.
  * [25] Ajinkya Tejankar, Maziar Sanjabi, Qifan Wang, Sinong Wang, Hamed Firooz, Hamed Pirsiavash, and Liang Tan.  Defending against patch-based backdoor attacks on self-supervised learning.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 12239–12249, 2023.
  * [26] Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y. Zhao.  Neural cleanse: Identifying and mitigating backdoor attacks in neural networks.  In Proceedings of the IEEE Symposium on Security and Privacy (IEEE S&P), San Francisco, CA, 2019.
  * [27] Jiamin Wu, Tianzhu Zhang, Zheng-Jun Zha, Jiebo Luo, Yongdong Zhang, and Feng Wu.  Self-supervised domain-aware generative network for generalized zero-shot learning.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 12767–12776, 2020.
  * [28] Burhaneddin Yaman, Seyed Amir Hossein Hosseini, and Mehmet Akçakaya.  Zero-shot self-supervised learning for mri reconstruction.  arXiv preprint arXiv:2102.07737, 2021.
  * [29] Jinghuai Zhang, Hongbin Liu, Jinyuan Jia, and Neil Zhenqiang Gong.  Corruptencoder: Data poisoning based backdoor attacks to contrastive learning.  arXiv preprint arXiv:2211.08229, 2022.