# Improving Adversarial Robustness in Weight-quantized Neural Networks

Chang Song1, Elias Fallon2, Hai Li1

###### Abstract

Neural networks are getting deeper and more computation-intensive nowadays.
Quantization is a useful technique in deploying neural networks on hardware
platforms and saving computation costs with negligible performance loss.
However, recent research reveals that neural network models, no matter full-
precision or quantized, are vulnerable to adversarial attacks. In this work,
we analyze both adversarial and quantization losses and then introduce
criteria to evaluate them. We propose a boundary-based retraining method to
mitigate adversarial and quantization losses together and adopt a nonlinear
mapping method to defend against white-box gradient-based adversarial attacks.
The evaluations demonstrate that our method can better restore accuracy after
quantization than other baseline methods on both black-box and white-box
adversarial attacks. The results also show that adversarial training suffers
quantization loss and does not cooperate well with other training methods.

## Introduction

Neural networks achieve rapid development recently and have been widely
applied in various areas (LeCun, Bengio, and Hinton 2015). With more layers
and more complex structures, neural network models demonstrate near or even
beyond human-level accuracy in classification problems (Graham 2014). Neural
networks not only become main trend in image recognition, object detection,
speech recognition, and natural language processing tasks, but also are widely
adopted by security industry (Tao et al. 2006), including surveillance,
authentication, facial recognition, vehicle detection, and crowd behavior
analysis.

With the assist of rapid development of hardware platforms, neural network
architecture evolve dramatically, handling more complicated datasets and
achieving better performance. From initially shallow structures like LeNet
(LeCun et al. 1998) and AlexNet (Krizhevsky, Sutskever, and Hinton 2012), to
deeper and wider designs such as GoogLeNet (a.k.a Inception) (Szegedy et al.
2015), VGG (Simonyan and Zisserman 2014) and ResNet (He et al. 2016), the
parameters of neural network models grow exponentially from 60 thousand to
over 100 million, and the total multiply-accumulate operations (MACs)
increases from 341 thousand to 15 billion. Such explosions in model sizes and
MACs require large computation resources and memory storage and result in high
power consumption. This makes the deployment of neural networks very
challenging, especially on low-power mobile devices, such as autonomous
vehicle systems (Maqueda et al. 2018) and real-time robot navigation systems
(Ribeiro et al. 2017). In order to fit neural networks into such resource-
constrained hardware platforms, model compression methods such as quantization
(Hubara et al. 2017), sparsification (Wen et al. 2016; Liu et al. 2015a), and
pruning (Han et al. 2015) have been extensively studied to save memory and
computation costs, improve execution speed, while maintaining performance.

In addition to the execution efficiency, the deep learning research community
pays a close attention to security and privacy problems in the last few years.
Recent research shows that neural network models are vulnerable to certain
attacks, especially the so-called adversarial attacks (Szegedy et al. 2013).
Adversarial attacks can easily fool models and lead to misclassifications by
elaborately generating imperceptible perturbations adding to inputs (a.k.a.
adversarial examples). Moreover, adversarial attacks are transferable, that
is, adversarial examples generated by a model can even influence other models
with different structures (Papernot, McDaniel, and Goodfellow 2016). Such
imperceptible attacks with great transferability unveil the blind spots in
neural networks and raise severe reliability and security concerns. As the
research on machine learning and neural networks go deeper, different types of
adversarial attacks are proposed. However, most defenses are targeted and
effective only to one specific attack. For example, Athalye _et al._ claim
that the attacks based-on the obfuscated gradients they proposed could
circumvent 7 out of 9 noncertified white-box-secure defenses that were
accepted by the International Conference on Learning Representations (ICLR) in
that year (Athalye, Carlini, and Wagner 2018). To better address the
universality issue and to fully analyze adversarial attacks, some researchers
focus on robustness of models instead of solely relying on accuracy of certain
attacks.

In this work, we aim to improve the robustness of weight-quantized neural
networks. Compared to existing works on defending adversarial attacks and
improving neural network robustness, our major contributions include:

  * •

We theoretically analyze both adversarial and quantization losses and come up
with using the Lipschitz constant to measure the quantization error
amplification effect in each neural network layer.

  * •

We observe that adversarially-trained neural networks are vulnerable to
quantization loss, which means adversarial training can not be directly used
in quantized models.

  * •

We deploy a boundary-based error-tolerant retraining method to minimize both
losses at the same time and adopt a nonlinear mapping method to defend white-
box gradient-based attacks.

  * •

We validate the effectiveness of the proposed method through extensive
experiments and evaluations. Results also indicate that adversarially-trained
models do not cooperate well with other training techniques.

The remainder of this paper is organized as follows: Background summarizes the
background about adversarial attacks, model robustness, and the quantization
process. Motivation and Theoretical Explanation analyzes both adversarial and
quantization losses and finds that adversarial models are more vulnerable to
quantization loss. Methodology describes the details of all the procedures to
improve adversarial and quantization robustness. Experimental Evaluations
presents and discusses experimental results. In the end, we conclude this work
in Conclusions.

## Background

### Adversarial Examples and Attacks

Adversarial attacks generate adversarial examples to fool models. An
adversarial example $\widetilde{X}$ is generated by injecting adversarial
perturbation $\epsilon$ to a clean sample $X$, such as:
$\widetilde{X}=X+\epsilon$. Usually, adversarial perturbations are so tiny
that are even imperceptible to human eyes. However, the carefully designed
adversarial perturbations can fool a neural network to misclassify adversarial
examples with high confidence levels (Goodfellow, Shlens, and Szegedy 2015).
There are multiple methods to generate $\epsilon$, such as FGSM (Goodfellow,
Shlens, and Szegedy 2015), CW (Carlini and Wagner 2017), and PGD (Madry et al.
2018). $\epsilon$ is also referred to as adversarial strength, larger
$\epsilon$ means $\widetilde{X}$ is further away from $X$ in the decision
space. Adversarial attacks raises security concerns about the applications of
neural networks in real-world scenarios. For example, attackers could alter a
“stop” sign imperceptibly and make an autonomous vehicle interpret as a
“yield” sign (Papernot et al. 2017).

According to the attackers’ knowledge, adversarial attacks can be classified
as black-box attacks and white-box attacks. Black-box attacks generally mean
that the attackers can access only the inputs and outputs of the target model.
They don’t have information about the target model’s structure and parameters.
Thus the attackers usually design and train their own model to generate
adversarial examples. In white-box attacks, the attackers have a full access
to the target model, and therefore can elaborate specific adversarial examples
against the target model. A given model usually has worse performance against
white-box attacks than black-box attacks (with the same attack strengths), as
the attacker has more knowledge about the model in white-box scenarios. Due to
the model transferability (Papernot, McDaniel, and Goodfellow 2016), black-box
attacks are feasible but they usually need larger adversarial strengths to
downgrade accuracy compared to white-box attacks.

Other key adversarial attack definitions include targeted vs. non-targeted
attacks, iterative vs. non-iterative attacks (Yuan et al. 2019). The goal of
targeted attacks is to fool a model to classify examples in one class as a
specific class, while non-targeted attacks aim to increase the model’s
misclassification rate but do not care the classification results. Iterative
attacks perform multiple steps of attacks to optimize the final adversarial
examples and non-iterative attacks only perturb the samples once.

In this paper, we mainly focus on non-targeted attacks. And we will give equal
consideration to white-box and black-box, iterative and non-iterative attacks.

### Robustness

Robustness indicates how well models can tolerate different types of
perturbations and remain proper function. Before adversarial attacks were
discovered, robustness is discussed mainly in random noise scenarios (Uličnỳ,
Lundström, and Byttner 2016). Adversarial perturbations $\epsilon$ can be
regarded as the worst-case noise which result in large classification errors
with minimum efforts. In this work, we consider accuracy of different types of
test examples as an indicator of robustness: if a model can achieve an overall
high accuracy against multiple types of attacks, the model is robust.

So far, adversarial training is taken as the most effective and efficient way
to mitigate the damage of adversarial attacks and to improve model robustness.
It includes adversarial examples in the training set to enhance models’
resilience to adversarial attacks. The main idea of adversarial training is
similar to data augmentation: to facilitate training by providing more
information on data distribution. The effectiveness of adversarial training
has been demonstrated and explained by (Goodfellow, Shlens, and Szegedy 2015).
Note that in adversarial training, the model that is used to generate the
adversarial examples is not necessarily identical to the model being attacked.

Some other popular methods have been studied to improve the robustness of
neural networks. Generally, these methods can be cataloged as two types: (1)
Gradient masking: Its main idea is to build a model to hide or smooth the
gradient between original and adversarial examples (Papernot et al. 2017). It
is particularly effective against white-box attacks. When the attacker use a
model different from the protected model, the performance can significantly
degrade. (2) Defensive distillation: The target of this method is to create a
model whose decision boundaries are smoothed along the directions that the
attacker may exploit. Defensive distillation makes it difficult for the
attacker to discover adversarial input tweaks that lead to incorrect classes.

### Quantization

The recent performance enhancement of neural networks mainly benefits from
more parameters and operations. Such costs are not tolerable for limited-power
or real-time applications. The neural network quantization helps save
computation and memory costs and therefore improve power efficiency. Moreover,
quantization enables the deployment of neural networks on limited-precision
hardware. Many hardware systems have physical constraints and do not allow
full-precision models directly mapping to them. For example, GPUs support half
precision floating point arithmetic (FP16), while using lower bit widths gives
significant speedups and saves energy consumption. ReRAM (a.k.a memristor)
(Strukov et al. 2008) only allows limited precision because of process
variations (Hu et al. 2014; Liu et al. 2015b).

There are two types of quantization methods: post-training quantization and
quantization-aware training. Post-training quantization directly quantizes a
model without retraining. However, recent research show that 8-bit post-
training quantization does not preserve accuracy in some cases, especially for
small models (Jacob et al. 2018). Quantization-aware training emulates
inference-time quantization, and keeps a copy of full-precision weights to
accumulate gradient changes. During the backpropagation, the quantization
functions are discrete-valued and cannot produce derivatives for training. A
popular bypass is using the straight-through estimator (STE) to approximate
the backpropagation process (Bengio, Léonard, and Courville 2013).

The quantization levels could be linear or logarithmic (Miyashita, Lee, and
Murmann 2016). In linear quantization, quantization levels are uniformly
distributed. While in logarithmic quantization, quantization levels follow
logarithmic functions. Both of them are feasible and show similar effect. In
this work, we consider only the linear distribution for simplicity. The
quantization can be applied to weight parameters as well as activations. It
has been observed that activations are more sensitive to quantization than
weights (Zhou et al. 2016). Some works quantize activations to a higher
precision than weights, some only quantize weights and keep activation at
full-precision, and only a few studies explore both (Yang et al. 2019). We
consider the weight-quantization only as we agree that quantization do more
harm to activations than to weights.

Recent works show that quantization can defend adversarial attacks to some
extent (Galloway, Taylor, and Moussa 2017), acting as a gradient masking
method. We believe both neural network security issues and hardware implements
are crucial and it is the reason that we further explore robustness in
quantization scenarios based on existing research.

## Motivation and Theoretical Explanation

### Adversarial and Quantization Losses

For a single fully-connected layer, suppose $W$ is the weight matrix,
$W+\Delta W$ is the weight after quantization, $x$ is the original input, and
$x+\Delta x$ is the adversarial input. The difference in the output of this
layer ($\delta$) can be represented as followed:

$\delta=(W+\Delta W)\cdot(x+\Delta x)-Wx=\underbrace{W\Delta
x}_{\text{Adv.}}+\underbrace{\Delta Wx}_{\text{Quant.}}+\Delta W\Delta x.$ (1)

The first term on the right hand side of Eq. (1) is the adversarial loss
introduced by adversarial examples, the second term is the quantization loss
introduced by weight quantization, and the third term is the loss introduced
by adversarial examples and quantization together. Since the third term is
much smaller than the first two, we omitted it for simplicity.

The adversarial loss can be easily measured by the accuracy drop under
adversarial attacks. For quantization loss, the accuracy drop could reflect
the change in weights, but not directly. The difference in outputs between a
full-precision model and its quantized counterpart reflect the effect of
quantization, but it also depends on the input. Thus, an input-independent
criterion is essentially necessary to evaluate the quantization process.

### The Quantization Error Amplification Effect and the Lipschitz Constant

The quantization error amplification effect was initially introduced in (Liao
et al. 2018). It indicates the situation that small residual perturbation is
amplified to a large magnitude in top layers of a model and finally leads to a
wrong prediction. This effect mentioned in (Liao et al. 2018) mainly focuses
on the input-level perturbation, especially adversarial perturbations. In this
work, we focus more on the weight-level error. Similar to its original
definition, the quantization error amplification effect means that each layer
will inject a quantization loss. The error introduced by quantization can be
amplified layer by layer and eventaully results in misclassification in the
output.

To measure the influence of quantization loss, we propose to use the Lipschitz
constant as a quantization error amplification indicator. Based on (Cisse et
al. 2017), the Lipschitz constant of the weight loss ($\Delta W$) introduced
by quantization can be defined as:

$\left\|\Delta W\right\|_{p}=\sup_{z:\left\|z\right\|_{p}=1}\left\|\Delta
Wz\right\|_{p},$ (2)

where, $z$ is an arbitary normalized input. Eq. (2) shows that the
quantization loss can be upper-bounded by the Lipschitz constant of $\Delta
W$. A Lipschitz constant greater than 1 denotes that the weight undergoes a
large quantization loss, otherwise a Lipschitz constant less than 1 means the
weight has a small loss after quantization.

$\left\|\Delta W\right\|_{2}$ when $p=2$ is called the spectral norm of
$\Delta W$, which is the maximum singular value of $\Delta W$. $\left\|\Delta
W\right\|_{\infty}$ when $p=+\infty$ is the maximum 1-norm of the rows of
$\Delta W$. Thus, we have a quantitative way to measure quantization loss
using the Lipschitz constant.

All the layers aforementioned in Motivation and Theoretical Explanation are
fully-connected layers, which perform basic matrix-vector or matrix-matrix
multiplications. For more complicated layer structures, such as convolutional
layers, (Cisse et al. 2017) has already given detailed explanations on how to
represent convolution operations as basic matrix multiplications and we have
verified the correctness of their derivations.

### Adversarial Training and Quantization

As discovered in (Lin, Gan, and Han 2019), quantized models are more
vulnerable to adversarial attacks than their original full-precision models.
We reproduce their experiments and obtained the similar results. Furthermore,
we find that adversarially-trained models are vulnerable to the quantization
process. Figure 1 presents two example cases (refer Experimental Evaluations
for the setup details). Here, Orig. is a vanilla model with standard training
methods, Adv. was adversarially-trained by (Madry et al. 2018), F.L. was
retrained from the original model using feedback learning, as proposed in
(Song, Wang, and Li 2019).

Figure 1: Clean Accuracy vs. Quantization Levels.

Figure 1 shows that for both examples, as the weight quantization level
decreases, the accuracy of adversarially-trained models drops more quickly
than that of other models. For both MNIST and CIFAR-10 datasets, the F.L.
model has the best resistance to the weight quantization. The adversarial
model is vulnerable to quantization loss, which has an even lower accuracy
than the original model, especially when the precision level is low. For the
MNIST dataset, the accuracy gap between the adversarial model and the other
two models enlarges as the quantization level drops. In contrast, for the
CIFAR-10 dataset, all three models depreciate at 1-bit and 2-bit quantization.
The different performance of two datasets implies that complicated datasets
and models need higher precision than simple datasets and models. In this
work, we mainly focus on 3-bit quantization to get better a understanding of
different training techniques.

Here is a possible explanation of why adversarial training does not perform
well in the quantized model. Adversarial training introduces additional
examples to the training set, which helps reshape decision boundaries to
better defend adversarial attacks. However, it fails to compensate for the
quantization effect on decision boundaries and even leads to larger
quantization loss. We will validate this explanation in Experimental
Evaluations using Lipschitz constant.

## Methodology

Our proposed method integrates two orthogonal components to improve overall
robustness against adversarial and quantization losses, including a boundary-
based error-tolerant retraining method to minimize both adversarial loss and
quantization loss, and a nonlinear mapping method to defend white-box
adversarial attacks. In this section, we will elaborate the details of the
proposed method.

### Boundary-based Error-tolerant Retraining

To minimize both adversarial loss and quantization loss at the same time, we
seek for a method that can utilize the similarity between these two types of
losses. Adversarial loss occurs as adversarial examples move away from
original data points in the decision space and cross the model’s decision
boundaries. By adding adversarial examples into the training set, adversarial
training can slightly relocate the decision boundaries to reduce adversarial
loss. Quantization loss is introduced when weights are quantized to discrete
values, which also alter the location of decision boundaries. Thus, a direct
intuition is to find a boundary-based method that can minimize both losses.

Feedback learning proposed by (Song, Wang, and Li 2019) measures the boundary
information of a pre-trained model and then generates examples to increase the
margins between samples and decision boundaries in the decision space. It is
similar to adversarial training w.r.t. data augmentation, but more generalized
than adversarial training. It can efficiently improve adversarial robustness
and also increase tolerance between data and decision boundaries. In our work,
we leverage feedback learning and take advantage of its margin-improving
ability to save quantization loss.

### Defending White-box Gradient-based Attacks with Nonlinear Mapping

As previously explained in Background, white-box attacks may have more
critical influence than black-box attacks with the same attack strengths. Here
we introduce model nonlinearity as a gradient masking method to improve
model’s robustness against white-box gradient-based attacks. We adopt a
nonlinear mapping method called $\mu$-law algorithm used in wireless
communication. $\mu$-law is a compressing-expanding (a.k.a. companding)
algorithm that compresses the signals before transmitting on a band-limited
channel and then expands them when received. The process can be formulated by

$\displaystyle F(x)$
$\displaystyle=sgn(x)\frac{\ln(1+\mu\left|x\right|)}{\ln(1+\mu)},~{}-1\leq
x\leq 1,\text{~{}and}$ (3a) $\displaystyle F^{-1}(y)$
$\displaystyle=sgn(y)\frac{(1+\mu)^{\left|y\right|}-1}{\mu},~{}-1\leq y\leq
1.$ (3b)

Where, $x$ is the input signal, $y$ is the companded signal, $sgn(\cdot)$ is
the sign function. Eq. (3a) is for compression, and Eq. (3b) is for expansion.
We will only use the compression function to increase nonlinearity. Fig. 2
shows that the curvatures and nonlinearities of the compression mapping curves
increase when $\mu$ increases. In other words, by controlling the value of
$\mu$, we can control the nonlinearity of a model after mapping.

Figure 2: An illustration of $\mu$-law nonlinear mapping.

In analog systems, this method can increase the signal-to-noise ratio (SNR)
achieved during transmission. In the digital domain, it can reduce the
quantization error, and hence, increase the signal to quantization noise
ratio. After neural network training, mapping the weights directly to a
different distribution can increase model nonlinearity. Such a mapping method
may increase classification error. However, the monotonicity of the mapping
curve guarantees that the mapping will not alter the classification results a
lot.

In the post-training phase, nonlinear mapping can be applied to specific
layers of a model to improve model nonlinearity, which in turn can enhance its
resistance to adversarial attacks. We believe that nonlinearity is more
crucial in the last few layers in a model than earlier layers for the
following two reasons: First, mapping earlier layers will introduce more
accuracy loss than mapping latter layers. For instance, our initial experiment
shows that if the first basic residual block in ResNet-32 for the CIFAR-10
dataset is mapped nonlinearly, the accuracy of clean image will drop from 95%
to around 15%. Comparably, mapping only the last residual block only leads to
an accuracy loss of less than 0.1%. Second, earlier layers in a model are
mainly to extract features from the inputs, while the last few layers act as
classifiers to vote on the extracted features and to make decisions.
Adversarial perturbations have a larger impact on models’ decision-making than
feature extraction, as shown in (Inkawhich et al. 2019). Defending in the last
few layers of a model is more reasonable to mitigate the error introduced by
adversarial perturbations.

## Experimental Evaluations

We implement our method with two neural network structures on two datasets: a
four-layer CNN on MNIST and a wide ResNet-32 on CIFAR-10. Experiments are
conducted on TensorFlow (v1.8.0) (Abadi et al. 2016). Most tests and attacks
are performed using the CleverHans library (v2.1.0) (Papernot et al. 2016).
Please note that robustness discussed in this section is represented by the
overall accuracy against all considered attacks.

For simplicity, we use abbreviations to represent models and attack types. For
models with different training techniques, Orig. is a vanilla model trained
without additional methods, Adv. was adversarially-trained by (Madry et al.
2018), and F.L. was retrained from the original model using feedback learning
(Song, Wang, and Li 2019). Models labeled with “(Q)” denotes the corresponding
weight-quantized models, and “+mu” means that $\mu$-law nonlinear mapping is
applied after training. For adversarial and non-adversarial attacks, we
consider Carlini & Wagner (CW-L2) (Carlini and Wagner 2017), fast gradient
sign method (FGSM) (Goodfellow, Shlens, and Szegedy 2015), projected gradient
descent (PGD) (Madry et al. 2018), basic iterative method (BIM) (Kurakin,
Goodfellow, and Bengio 2017), momentum iterative method (MIM) (Dong et al.
2017), random noise (with a uniform distribution), and Gaussian noise. FGSM
(w/m/s) represents weak, medium, or strong attack strengths, respectively.
Note that the attack strengths of attacks vary, as iterative and non-iterative
attacks, black-box and white-box attacks all have different degrees of effects
on models.

In this section, we only consider the weight quantization and fix the
quantization level to 3-bit precision. We adopt the same parameters from
(Song, Wang, and Li 2019) for the boundary-based error-tolerant retraining. We
select $\mu=255.0$ for nonlinear mapping and apply the $\mu$-law mapping to
the last layer of the MNIST model and the last three layers (a residual block
and the FC layer) of the CIFAR-10 model.

### Method Effectiveness

Table 1: The accuracy of white-box attacks on MNIST models.

Models | Clean | CW-L2 | FGSM (w) | FGSM (s) | PGD | BIM | MIM
---|---|---|---|---|---|---|---
Orig. | 99.17% | 39.40% | 73.53% | 7.67% | 4.38% | 5.68% | 6.77%
Orig. (Q) | 98.97% | 36.98% | 68.70% | 7.40% | 2.63% | 3.53% | 4.27%
Adv. | 98.40% | 94.51% | 98.01% | 96.24% | 97.77% | 97.41% | 97.32%
Adv. (Q) | 42.69% | 25.56% | 37.28% | 32.28% | 33.78% | 31.44% | 30.72%
F.L. | 99.17% | 51.60% | 89.69% | 39.43% | 39.92% | 41.42% | 43.25%
F.L. (Q) | 98.99% | 49.49% | 87.93% | 38.36% | 35.35% | 36.48% | 38.33%
Orig.+mu | 99.06% | 34.97% | 78.55% | 6.32% | 7.25% | 8.61% | 9.04%
Orig.+mu (Q) | 98.94% | 33.09% | 73.78% | 5.95% | 5.21% | 6.32% | 6.82%
Adv.+mu | 97.97% | 91.77% | 97.00% | 95.18% | 96.79% | 95.99% | 95.90%
Adv.+mu (Q) | 37.12% | 28.20% | 35.35% | 31.15% | 34.29% | 32.64% | 32.15%
F.L.+mu | 99.11% | 48.08% | 89.25% | 70.86% | 57.39% | 64.53% | 64.92%
F.L.+mu (Q) | 98.93% | 47.65% | 88.31% | 69.45% | 55.24% | 62.64% | 62.92%

The comparison for white-box attacks on MNIST is summarized in Table 1. The
results show that the Orig. and F.L. models greatly suffer from the
adversarial loss, while F.L. performs relatively better than the Orig. model.
The quantization loss affects significantly the Adv. model, which presents a
big accuracy gap between the full-precision model and the corresponding
quantized version. Nonlinear mapping does not have much effect on the Orig.
and Adv. models. Combining the nonlinear mapping with the F.L. model, however,
makes a strike on the performance improvements.

Table 2: The accuracy of black-box attacks and noises on MNIST models.

Models | CW-L2 | FGSM (w) | FGSM (m) | FGSM (s) | Normal | Uniform
---|---|---|---|---|---|---
Orig. | 97.56% | 98.95% | 97.80% | 93.30% | 97.19% | 98.85%
Orig. (Q) | 97.47% | 98.47% | 96.26% | 90.08% | 95.50% | 98.38%
Adv. | 97.28% | 98.30% | 98.22% | 96.17% | 77.16% | 98.37%
Adv. (Q) | 39.42% | 45.09% | 43.14% | 28.02% | 17.62% | 42.99%
F.L. | 97.04% | 98.90% | 97.36% | 94.99% | 97.01% | 98.67%
F.L. (Q) | 96.38% | 98.54% | 96.84% | 94.38% | 96.58% | 98.44%
Orig.+mu | 97.31% | 98.72% | 97.16% | 90.61% | 96.16% | 98.69%
Orig.+mu (Q) | 96.83% | 98.31% | 96.15% | 88.69% | 95.16% | 98.27%
Adv.+mu | 97.44% | 97.83% | 97.62% | 94.09% | 74.06% | 97.81%
Adv.+mu (Q) | 38.02% | 40.06% | 39.60% | 24.48% | 15.69% | 37.32%
F.L.+mu | 97.47% | 98.70% | 96.72% | 93.76% | 96.64% | 98.58%
F.L.+mu (Q) | 97.68% | 98.46% | 96.44% | 93.54% | 96.36% | 98.21%

For black-box attacks on MNIST as shown in Table 2, all full-precision models
have high accuracy. Compared with the results in Table 1, white-box attacks
have more severe results than black-box attacks with the same attack
strengths. This difference is mainly due to the transferability issue as
mentioned in Background. All quantized models except adversarially-trained
ones maintain high accuracy; among them, the models with the best performance
are the F.L. models, with or without the nonlinear mapping.

Table 3: The accuracy of white-box attacks on CIFAR-10 models.

Models | Clean | CW-L2 | FGSM (w) | FGSM (s) | PGD | BIM | MIM
---|---|---|---|---|---|---|---
Orig. | 95.00% | 9.30% | 20.90% | 10.60% | 2.20% | 2.60% | 2.50%
Orig. (Q) | 47.92% | 13.60% | 16.80% | 11.90% | 11.10% | 17.80% | 17.70%
Adv. | 87.27% | 54.20% | 74.70% | 36.80% | 66.80% | 57.60% | 59.70%
Adv. (Q) | 19.84% | 15.80% | 17.50% | 10.90% | 17.90% | 18.20% | 17.70%
F.L. | 93.77% | 20.30% | 39.70% | 27.50% | 4.00% | 4.00% | 4.00%
F.L. (Q) | 90.14% | 21.30% | 42.60% | 28.70% | 5.90% | 5.90% | 5.80%
Orig.+mu | 94.05% | 5.30% | 95.30% | 94.90% | 64.40% | 95.30% | 95.30%
Orig.+mu (Q) | 51.55% | 11.60% | 45.10% | 46.80% | 30.80% | 49.50% | 49.40%
Adv.+mu | 85.70% | 51.90% | 83.30% | 83.20% | 81.60% | 83.30% | 83.30%
Adv.+mu (Q) | 16.80% | 17.00% | 16.70% | 16.70% | 17.00% | 17.30% | 17.50%
F.L.+mu | 93.80% | 20.70% | 92.80% | 92.30% | 89.50% | 92.80% | 92.80%
F.L.+mu (Q) | 92.20% | 23.10% | 90.80% | 90.70% | 86.90% | 90.80% | 90.80%

As the CIFAR-10 dataset is more complicated than MNIST, we implement a model
with a much deeper structure. Although the results have a broader range than
the MNIST results, the observations and conclusions remain consistent. As
shown in Table 3, the Orig. model suffers a lot from adversarial loss, and the
Adv. model is still the one that has a considerable accuracy drop after
quantization. The quantized F.L. model with nonlinear mapping outperforms all
other quantized models in our white-box attack scenario to the CIFAR-10
dataset.

Table 4: The accuracy of black-box attacks and noises on CIFAR-10 models.

Models | CW-L2 | FGSM (w) | FGSM (m) | FGSM (s) | Normal | Uniform
---|---|---|---|---|---|---
Orig. | 58.90% | 55.07% | 46.87% | 41.12% | 21.40% | 43.80%
Orig. (Q) | 23.00% | 22.60% | 20.64% | 19.17% | 19.30% | 21.80%
Adv. | 76.44% | 75.82% | 74.61% | 73.48% | 70.30% | 84.90%
Adv. (Q) | 19.38% | 19.32% | 18.92% | 18.55% | 15.60% | 17.80%
F.L. | 64.70% | 61.82% | 57.12% | 53.68% | 79.10% | 85.50%
F.L. (Q) | 62.99% | 60.30% | 56.07% | 52.44% | 72.40% | 81.90%
Orig.+mu | 55.95% | 52.58% | 44.74% | 38.62% | 20.90% | 41.00%
Orig.+mu (Q) | 25.64% | 24.53% | 21.41% | 20.01% | 15.80% | 19.30%
Adv.+mu | 73.24% | 72.79% | 71.52% | 69.90% | 68.20% | 82.30%
Adv.+mu (Q) | 15.74% | 15.67% | 15.23% | 14.69% | 11.10% | 12.10%
F.L.+mu | 63.69% | 60.37% | 55.58% | 52.04% | 73.60% | 84.00%
F.L.+mu (Q) | 62.54% | 59.65% | 55.03% | 51.69% | 72.20% | 81.90%

For black-box attacks on CIFAR-10 in Table 4, the nonlinear mapping does not
help and it has a minor negative effect on the models’ performance. We believe
the accuracy drop after applying nonlinear mapping is negligible, compared to
the accuracy recovery in white-box gradient-based attacks.

Overall, the best quantized model for defending both white-box and black-box
adversarial attacks is F.L.+mu (Q), which has an average improvement of 20.54%
on MNIST and 52.69% on CIFAR-10 compared to the Orig. model. Compared to the
second best model, F.L. (Q), our method’s average accuracy improves 7.55% on
MNIST and 27.84% on CIFAR-10.

### Verification with the Lipschitz Constant

To further validate the effectiveness of our method, we examine the Lipschitz
constant of $\Delta W$ of some layers. Here we only consider $p=2$ for
simplicity. As given in Eq. (2), when $p=2$, the Lipschitz constant of $\Delta
W$ is the maximum singular value of $\Delta W$. The layer-wise results for
MNIST and CIFAR-10 are shown in Figure 3 and Figure 4, respectively.

Figure 3: The Lipschitz constant of $\Delta W$ in different layers (MNIST).
Figure 4: The Lipschitz constant of $\Delta W$ in different layers (CIFAR-10).

In Figure 3, the $x$-axis represents the number of layers. In Figure 4, layers
1 to 4 denote the last two residual blocks, and layer 5 is the last FC layer.
The “(+mu)” in both figures represents the specific layers are mapped
nonlinearly. We only map the last layer for the MNIST dataset, and the last
three layers (one residual block with two layers and the only FC layer) for
the CIFAR-10 dataset. Our findings from the results are summarized as follows:

  * •

The Adv. model has the largest Lipschitz results among three models on MNIST,
the Orig. model has the lowest, and the F.L. model is slightly worse than the
Orig. model.

  * •

For CIFAR-10, the results are varied by layers. For all layers except the last
layer, the Orig. and Adv. models both have lower Lipschitz constants than the
F.L. model’s Lipschitz constants, which are still less than 1 and only have
minor quantization error amplification effect. For the last layer, however,
Adv. has a Lipschitz constant over 2, greater than the other two models.

  * •

Using nonlinear mapping will not significantly change the Lipschitz constant
of $\Delta W$ in the Orig. and F.L. models. For the last layer in the CIFAR-10
model, Adv. result increases by 34.29%, far larger than Orig. (2.28%) and Adv.
(22.20%) results.

The Lipschitz results show that adversarial training has weak tolerance to
quantization, which is consistent with Figure 1. The results also reveal that
adversarial training is incapable of cooperating with other techniques, such
as the nonlinear mapping method. A Lipschitz constant of $\Delta W$ greater
than 1 means the quantization error may be amplified in this layer. Based on
the results shown in Method Effectiveness and the Lipschitz results, we
believe the last few layers, especially the last layer, matter more than the
other layers in terms of the Lipschitz constant of $\Delta W$. Such results
indicate that the last few layers have more notable quantization error
amplification effect than the previous layers.

### Other Experiment Attempts

We also implement other training techniques such as the quantization-aware
training and the defensive quantization method proposed in (Lin, Gan, and Han
2019), but the results are not as good as expected or reported. Combining the
adversarial training with the quantization-aware training has even worse
performance than implementing only adversarial training (results are omitted
due to page limit). The downgrade of such a combination is because the goals
of adversarial training and quantization-aware training are not well aligned
with each other. The results also indicate the importance and necessity of an
integrated method to mitigate both adversarial and quantization losses.
Another attempt is to replicate (Lin, Gan, and Han 2019). The defensive
quantization method is simple to understand and implement, but the computation
cost of the regularization term becomes too much as the neural network gets
deeper and wider. Therefore these methods are not considered as our baselines.

## Conclusions

This work focuses on the robustness of quantized neural networks. We observe
that adversarially-trained neural networks are vulnerable to quantization
loss. For the reason, adversarial training cannot be directly applied to
quantized models. In this work, we theoretically analyze both adversarial and
quantization losses and come up with criteria to measure the two losses. We
also propose a solution to minimize both losses at the same time and conduct
various experiments to show its effectiveness. The results show that our
method is capable of defending both black-box and white-box gradient-based
adversarial attacks and minimizing the quantization loss, showing an average
accuracy improvement against adversarial attacks of 7.55% on MNIST and 27.84%
on CIFAR-10 compared to the next best approach studied.

## References

  * Abadi et al. (2016) Abadi, M.; Barham, P.; Chen, J.; Chen, Z.; Davis, A.; Dean, J.; Devin, M.; Ghemawat, S.; Irving, G.; Isard, M.; et al. 2016.  Tensorflow: A system for large-scale machine learning.  In _12th $USENIX$ Symposium on Operating Systems Design and Implementation ($OSDI$ 16)_, 265–283.
  * Athalye, Carlini, and Wagner (2018) Athalye, A.; Carlini, N.; and Wagner, D. 2018.  Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples.  _Proceedings of the 35th International Conference on Machine Learning_ .
  * Bengio, Léonard, and Courville (2013) Bengio, Y.; Léonard, N.; and Courville, A. 2013.  Estimating or propagating gradients through stochastic neurons for conditional computation.  _arXiv preprint arXiv:1308.3432_ .
  * Carlini and Wagner (2017) Carlini, N.; and Wagner, D. 2017.  Towards evaluating the robustness of neural networks.  In _2017 IEEE Symposium on Security and Privacy (SP)_ , 39–57. IEEE.
  * Cisse et al. (2017) Cisse, M.; Bojanowski, P.; Grave, E.; Dauphin, Y.; and Usunier, N. 2017.  Parseval networks: Improving robustness to adversarial examples.  In _Proceedings of the 34th International Conference on Machine Learning_ , 854–863.
  * Dong et al. (2017) Dong, Y.; Liao, F.; Pang, T.; Su, H.; Hu, X.; Li, J.; and Zhu, J. 2017.  Boosting adversarial attacks with momentum.  _arXiv preprint arXiv:1710.06081_ .
  * Galloway, Taylor, and Moussa (2017) Galloway, A.; Taylor, G. W.; and Moussa, M. 2017.  Attacking binarized neural networks.  _arXiv preprint arXiv:1711.00449_ .
  * Goodfellow, Shlens, and Szegedy (2015) Goodfellow, I. J.; Shlens, J.; and Szegedy, C. 2015.  Explaining and harnessing adversarial examples.  _Proceedings of the International Conference on Learning Representations (ICLR)_ .
  * Graham (2014) Graham, B. 2014.  Fractional max-pooling.  _arXiv preprint arXiv:1412.6071_ .
  * Han et al. (2015) Han, S.; Pool, J.; Tran, J.; and Dally, W. 2015.  Learning both weights and connections for efficient neural network.  In _Advances in neural information processing systems_ , 1135–1143.
  * He et al. (2016) He, K.; Zhang, X.; Ren, S.; and Sun, J. 2016.  Deep residual learning for image recognition.  In _Proceedings of the IEEE conference on computer vision and pattern recognition_ , 770–778.
  * Hu et al. (2014) Hu, M.; Li, H.; Chen, Y.; Wu, Q.; Rose, G. S.; and Linderman, R. W. 2014\.  Memristor Crossbar-Based Neuromorphic Computing System: A Case Study.  _IEEE Transactions on Neural Networks and Learning Systems_ 25(10): 1864–1878.
  * Hubara et al. (2017) Hubara, I.; Courbariaux, M.; Soudry, D.; El-Yaniv, R.; and Bengio, Y. 2017.  Quantized neural networks: Training neural networks with low precision weights and activations.  _The Journal of Machine Learning Research_ 18(1): 6869–6898.
  * Inkawhich et al. (2019) Inkawhich, N.; Wen, W.; Li, H. H.; and Chen, Y. 2019.  Feature space perturbations yield more transferable adversarial examples.  In _Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition_ , 7066–7074.
  * Jacob et al. (2018) Jacob, B.; Kligys, S.; Chen, B.; Zhu, M.; Tang, M.; Howard, A.; Adam, H.; and Kalenichenko, D. 2018.  Quantization and training of neural networks for efficient integer-arithmetic-only inference.  In _Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition_ , 2704–2713.
  * Krizhevsky, Sutskever, and Hinton (2012) Krizhevsky, A.; Sutskever, I.; and Hinton, G. E. 2012.  Imagenet classification with deep convolutional neural networks.  In _Advances in neural information processing systems_ , 1097–1105.
  * Kurakin, Goodfellow, and Bengio (2017) Kurakin, A.; Goodfellow, I. J.; and Bengio, S. 2017.  Adversarial machine learning at scale.  _Proceedings of the International Conference on Learning Representations (ICLR)_ .
  * LeCun, Bengio, and Hinton (2015) LeCun, Y.; Bengio, Y.; and Hinton, G. 2015.  Deep learning.  _nature_ 521(7553): 436–444.
  * LeCun et al. (1998) LeCun, Y.; Bottou, L.; Bengio, Y.; and Haffner, P. 1998.  Gradient-based learning applied to document recognition.  _Proceedings of the IEEE_ 86(11): 2278–2324.
  * Liao et al. (2018) Liao, F.; Liang, M.; Dong, Y.; Pang, T.; Hu, X.; and Zhu, J. 2018.  Defense against adversarial attacks using high-level representation guided denoiser.  In _IEEE Conference on Computer Vision and Pattern Recognition_ , 1778–1787.
  * Lin, Gan, and Han (2019) Lin, J.; Gan, C.; and Han, S. 2019.  Defensive quantization: When efficiency meets robustness.  _arXiv preprint arXiv:1904.08444_ .
  * Liu et al. (2015a) Liu, B.; Wang, M.; Foroosh, H.; Tappen, M.; and Pensky, M. 2015a.  Sparse convolutional neural networks.  In _Proceedings of the IEEE conference on computer vision and pattern recognition_ , 806–814.
  * Liu et al. (2015b) Liu, X.; Mao, M.; Liu, B.; Li, H.; Chen, Y.; Li, B.; Wang, Y.; Jiang, H.; Barnell, M.; Wu, Q.; and Yang, J. 2015b.  RENO: A High-Efficient Reconfigurable Neuromorphic Computing Accelerator Design.  In _Design Automation Conference_.
  * Madry et al. (2018) Madry, A.; Makelov, A.; Schmidt, L.; Tsipras, D.; and Vladu, A. 2018.  Towards deep learning models resistant to adversarial attacks.  In _International Conference on Learning Representations_.
  * Maqueda et al. (2018) Maqueda, A. I.; Loquercio, A.; Gallego, G.; García, N.; and Scaramuzza, D. 2018\.  Event-based vision meets deep learning on steering prediction for self-driving cars.  In _Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition_ , 5419–5427.
  * Miyashita, Lee, and Murmann (2016) Miyashita, D.; Lee, E. H.; and Murmann, B. 2016.  Convolutional neural networks using logarithmic data representation.  _arXiv preprint arXiv:1603.01025_ .
  * Papernot et al. (2016) Papernot, N.; Faghri, F.; Carlini, N.; Goodfellow, I.; Feinman, R.; Kurakin, A.; Xie, C.; Sharma, Y.; Brown, T.; Roy, A.; et al. 2016.  Technical report on the cleverhans v2. 1.0 adversarial examples library.  _arXiv preprint arXiv:1610.00768_ .
  * Papernot, McDaniel, and Goodfellow (2016) Papernot, N.; McDaniel, P.; and Goodfellow, I. 2016.  Transferability in machine learning: from phenomena to black-box attacks using adversarial samples.  _arXiv preprint arXiv:1605.07277_ .
  * Papernot et al. (2017) Papernot, N.; McDaniel, P.; Goodfellow, I. J.; Jha, S.; Celik, Z. B.; and Swami, A. 2017.  Practical black-box attacks against machine learning.  In _ACM on Asia Conference on Computer and Communications Security_ , 506–519.
  * Ribeiro et al. (2017) Ribeiro, D.; Mateus, A.; Miraldo, P.; and Nascimento, J. C. 2017.  A real-time deep learning pedestrian detector for robot navigation.  In _2017 IEEE international conference on autonomous robot systems and competitions (ICARSC)_ , 165–171. IEEE.
  * Simonyan and Zisserman (2014) Simonyan, K.; and Zisserman, A. 2014.  Very deep convolutional networks for large-scale image recognition.  _arXiv preprint arXiv:1409.1556_ .
  * Song, Wang, and Li (2019) Song, C.; Wang, Z.; and Li, H. 2019.  Feedback Learning for Improving the Robustness of Neural Networks.  In _2019 18th IEEE International Conference On Machine Learning And Applications (ICMLA)_ , 686–693.
  * Strukov et al. (2008) Strukov, D. B.; Snider, G. S.; Stewart, D. R.; and Williams, R. S. 2008.  The missing memristor found.  _nature_ 453(7191): 80–83.
  * Szegedy et al. (2015) Szegedy, C.; Liu, W.; Jia, Y.; Sermanet, P.; Reed, S.; Anguelov, D.; Erhan, D.; Vanhoucke, V.; and Rabinovich, A. 2015.  Going deeper with convolutions.  In _conference on computer vision and pattern recognition_ , 1–9.
  * Szegedy et al. (2013) Szegedy, C.; Zaremba, W.; Sutskever, I.; Bruna, J.; Erhan, D.; Goodfellow, I.; and Fergus, R. 2013.  Intriguing properties of neural networks.  _arXiv preprint arXiv:1312.6199_ .
  * Tao et al. (2006) Tao, D.; Li, X.; Maybank, S. J.; and Wu, X. 2006.  Human carrying status in visual surveillance.  In _Computer Vision and Pattern Recognition_ , 1670–1677.
  * Uličnỳ, Lundström, and Byttner (2016) Uličnỳ, M.; Lundström, J.; and Byttner, S. 2016.  Robustness of deep convolutional neural networks for image recognition.  In _International Symposium on Intelligent Computing Systems_ , 16–30. Springer.
  * Wen et al. (2016) Wen, W.; Wu, C.; Wang, Y.; Chen, Y.; and Li, H. 2016.  Learning Structured Sparsity in Deep Neural Networks.  In _Advances in Neural Information Processing Systems_ , 2074–2082.
  * Yang et al. (2019) Yang, Q.; Wen, W.; Wang, Z.; and Li, H. 2019.  Joint Regularization on Activations and Weights for Efficient Neural Network Pruning.  In _IEEE Conference On Machine Learning And Applications (ICMLA)_ , 790–797.
  * Yuan et al. (2019) Yuan, X.; He, P.; Zhu, Q.; and Li, X. 2019.  Adversarial examples: Attacks and defenses for deep learning.  _IEEE transactions on neural networks and learning systems_ 30(9): 2805–2824.
  * Zhou et al. (2016) Zhou, S.; Wu, Y.; Ni, Z.; Zhou, X.; Wen, H.; and Zou, Y. 2016.  Dorefa-net: Training low bitwidth convolutional neural networks with low bitwidth gradients.  _arXiv preprint arXiv:1606.06160_ .


eprint Nisho-1-2022

# Radiation Burst by Axion Star Collision with Star in the Andromeda Galaxy

Aiichi Iwazaki  International Economics and Politics, Nishogakusha University,
6-16 3-bantyo Chiyoda Tokyo 102-8336, Japan

(Mar. 15, 2022)

###### Abstract

Axion is a promising candidate of dark matter in the universe. A fraction of
dark matter axion may forms axion star with radius $\sim 10^{2}$km. We show
that the axion star emits radiation burst by the collision with K and M types
main sequence star in the Andromeda Galaxy. The emission arises in the
atmosphere of the star, in which electrons coherently oscillate due to
oscillating electric field of the axion star. The electric field is produced
under magnetic field $B$ of the star. We estimate the flux density of the
radiation $\sim 1.6\times
10^{-3}\mbox{Jy}(10^{-12}M_{\odot}/M_{a})^{2}(10^{-5}\mbox{eV}/m_{a})^{3}(B/10^{2}\mbox{G})^{2}\sqrt{3\times
10^{3}\mbox{K}/T}$ and the rate of the collision per hour $\sim
0.06/\mbox{hour}\,(10^{-12}M_{\odot}/M_{a})$ in the galaxy, where $M_{a}$ (
$m_{a}$ ) denotes the mass of axion star ( axion ) and $T$ does temperature of
the electrons. We assume the number $10^{11}$ of the stars with $B\sim
10^{2}$G and radius $\sim 3.5\times 10^{5}$km in the galaxy. We also assume
that a half of the dark matter is composed of axion star. We show that the
emission of the radiation burst only arises in the atmosphere in which the
plasma frequency $m_{p}\simeq m_{a}$. The duration of the burst lasts for the
period which it takes the axion star to pass the region with $m_{p}\simeq
m_{a}$. It would be longer than $1$ second.

Axion is the Goldstone boson of Peccei Quinn symmetryaxion , which naturally
solves strong CP problem. The axion is also a promising candidate of dark
matter in the universe. Therefore, its detectionadmx ; carrack ; haystac ;
abracadabra ; organ ; madmax ; brass ; cast ; sumico ; iwazaki01  is urgent
issue for exploring beyond standard model. Such an axion is called as QCD
axion, which was originally introduced to solve strong CP problem. We only
consider the QCD axion whose mass is constrained to the rangeWil  of
approximately $10^{-6}\mbox{eV}\sim 10^{-3}$ eV. Especially, we assume that
Peccei Quinn symmetry is spontaneously broken after inflation in early
universe. So, axion miniclusterminicluster ; minicluster1  may form and
subsequently axion staraxionstar ; axionstar1 ; axionstar2 ; review  forms.
Therefore, there is a possibility that a fraction of the dark matter axions
form boson starsbosonstar1 ; bosonstar2 ; bosonstar3 ; bosonstar4 , i.e. axion
stars.

In this paper we propose a new way of detection of the axion star. The
detection is to observe radiation burst from the Andromeda Galaxy. We consider
radiations emitted by the axion star when it collides main sequence star in
the galaxy. The axion star we consider is stable and a gravitationally loosely
bound state of axions ( dilute axion star ). That is, binding energy of axion
is much less than the axion mass $m_{a}$. The mass of the axion star is
supposed to be of the order of $10^{-12}M_{\odot}$. The radius $R_{a}$ of such
an axion star is approximately givenradius ; iwazaki  such that $R_{a}\simeq
1/Gm_{a}^{2}M_{a}$ with gravitational constant $G$ and mass $M_{a}$ of axion
star. Numerically, $R_{a}\simeq
260\mbox{km}(10^{-12}M_{\odot}/M_{a})(10^{-5}eV/m_{a})^{2}$. Such axion stars
may collide ordinary stars made of baryons. Because the axion star is a
coherent state of axions, the axion star generates classical oscillating
electric fieldiwazakiold  under the magnetic field of the main sequence star.
The frequency of the oscillation is just given by the axion mass. Then,
electrons in the atmosphere of the star are forced to oscillate by the
electric field and coherently emit radiationscoherentradiation . Because the
coherent length $R_{a}\sim 100$km is large, a large number of electrons
$N_{e}\propto n_{e}R_{a}^{3}\sim 10^{32}(n_{e}/10^{10}\rm cm^{3})$ coherently
emit radiations so that their flux $\propto N_{e}^{2}$ can be extremely large.
The argument is very naive. We give more accurate estimation of the flux by
solving Maxwell equations and equation of motion of electron under both
electric fields induced by the axions and of the emitted radiations. We
confirm that the naive argument is essentially correct, although we have
additional small factor in the flux coming from small velocity of radiation in
the electron plasma.

Radiations from axion dark matter under stellar magnetic field have been
previously discussedpopov ; coherentradiation ; tka ; hook ; ben ; hama ; bu ;
pr ; am . Main emission mechanism of radiations is non resonant conversion of
axions into radiations, that is, incoherent conversion of an axion into a
photon. On the other hand, resonant conversion of dark matter axion have been
also discussedhook ; ben  in neutron star. But, the flux of such radiations
are much smaller than the radiations discussed in this paper. The flux
discussed previously is small because of non resonant conversion or small
energy density of uniformly distributed axion dark matter. Our point is the
coherent emission by a large number of electrons under axion star: Energy
density of axion star is $10^{24}$ times bigger than that of uniformly
distributed axion dark matter. The mechanism is essentially the same as
resonant conversionresonant ; bu  of axion into radiations. Photon in plasma
acquires effective mass of plasma frequency $m_{p}$ and mixes with the axion
in external magnetic field. Then, the resonant conversion of the axion into
radiations occurs only when $m_{p}\simeq m_{a}$. In this paper, by exactly
solving Maxwell equations involving electric current of plasma, we show that a
large amount of radiations arise only when $m_{p}\simeq m_{a}$. This is
similar to the resonant conversion of axion into radiations. We make clear the
relation between resonant conversionresonant ; bu  of axion into radiations
and coherent emission of radiations by electronscoherentradiation . The
resonant conversion and the coherent emission are intimately related each
other.

Actual structure of magnetic field in the atmosphere of main sequence star is
not well known. In this paper we assume main sequence star whose surface
magnetic field is $\sim 10^{2}$G and radius is $0.5R_{\odot}\simeq 0.35\times
10^{6}$km. We also assume that the magnetic field does not vary in time at
least while the axion star emits large amount of radiations. Such a stronger
magnetic field than that of the sun is observed in K and M types main sequence
starMstar . Probably, they are main components in the Milky Way Galaxy and
Andromeda Galaxy. Especially, we suppose that the number of the stars
colliding the axion star in the Andromeda Galaxy is of the order of $10^{11}$.
There is a perspective that there are such main sequence stars with $B\sim
10^{2}$G because white dwarfs are known to have strong magnetic field $\sim
10^{6}$G. Their magnetic fields are originated in the magnetic field of main
sequence stars with $B\sim 10^{2}$G.

In general, radiation flux is larger as magnetic field is stronger. Although
radiation flux emitted in the axion star collision with stars of stronger
magnetic field like white dwarfs ( $B=10^{6}$G ) or neutron stars (
$B=10^{12}$G )coherentradiation ; bu  is much larger, the rate of the
collisioncoherentradiation ; bu  is much small to not be detectable. Thus, we
consider the axion star collision with the main sequence stars of the magnetic
field $10^{2}$G in the Andromeda Galaxy. Their number is much larger than
those of white dwarfs and neutron stars.

When the axion star collides a main sequence star, at first it enter the
atmosphere of the star. The electron number density $n_{e}$ of the atmosphere
as well as the strength of magnetic field gradually increase in the view of
the axion star. The plasma frequency $m_{p}=\sqrt{e^{2}n_{e}/m_{e}}$ with
electron mass $m_{e}$ also increases. Accordingly, the radiation flux emitted
by the electrons also gradually increases. But the radiation flux is suddenly
enhanced when the axion star passes the region with the electron number
density being nearly equal to a critical number density $n_{e}^{cr}$. That is,
the region with $m_{p}\simeq m_{a}$. The resonant conversion of axion into
radiations occurs. It should be noted that such an emission of a large amount
of radiation stops because the axion star soon enters the region with
$n_{e}>n_{e}^{cr}=m_{e}m_{a}^{2}/e^{2}$, in other words $m_{p}>m_{a}$. The
radiations emitted in dense atmosphere with $m_{p}>m_{a}$ never arrive the
earth. They are absorbed in the atmosphere. Thus, the maximum flux of the
radiations we observe is produced when the axion star passes the region with
the critical electron number density $n_{e}^{cr}=m_{e}m_{a}^{2}/e^{2}$ in the
atmosphere. The duration of the radiation burst lasts for the period during
which the axion star passes the region with $m_{p}\simeq m_{a}$.

Axion star we consider is a loosely bounded state of axions ( dilute axion
staraxionstar ; iwazaki  ). There are no self interactions except for the mass
term because the field $a(t,\vec{x})$ is much small compared with the decay
constant $f_{a}$. It is only bounded by gravitational force. ( The axion field
$a(t,\vec{x})$ describes the angle $\theta\equiv a(t,\vec{x})/f_{a}$ of
complex scalar field $\Phi\propto\exp(i\theta)$. Thus, the angle $\theta\ll 1$
in the dilute axion star is very small. The overall scale of the field
$a(t,\vec{x})$ is fixed by $f_{a}$. )

The field of the spherical axion stariwazaki ; review
$a(t,\vec{x})=a(r)\cos(\omega t)$ is described by Schrodinger- Poisson
equation,

$-\frac{k^{2}}{2m_{a}}a(r)=-\frac{\vec{\partial}^{2}}{2m_{a}}a(r)+m_{a}\phi(\vec{x})a(r)$
(1)

with $\omega^{2}=m_{a}^{2}-k^{2}$ ( $k\ll m_{a}$ ) and $r=|\vec{x}|$, where
the gravitational potential $\phi(\vec{x})$ satisfies

$\vec{\partial}^{2}\phi(\vec{x})=2\pi Gm_{a}^{2}a(r)^{2}$ (2)

and it behaves such as $\phi(\vec{x})\simeq-GM_{a}/r$ for $r\to\infty$. The
mass $M_{a}$ of the axion star is given such that $M_{a}=\int
d^{3}x(\omega^{2}a(r)^{2}+m_{a}^{2}a(r)^{2})/4\simeq\int
d^{3}x\,m_{a}^{2}a(r)^{2}/2$.

The Schrodinger- Poisson equation is approximately rewritten for $r\to\infty$
such that

$-\frac{k^{2}}{2m_{a}}a(r)=-\frac{1}{2m_{a}}(\partial_{r}^{2}+\frac{2\partial_{r}}{r})a(r)-\frac{Gm_{a}M_{a}}{r}a(r)$
(3)

Then, we find that the spherical solution of the star is approximately
described by $\tilde{a}(t,r)=f_{a}a_{0}\exp(-r/R_{a})\cos(\omega t)$ with
$k=1/R_{a}$, where the radius $R_{a}$ of the axion star is

$R_{a}=\frac{1}{Gm_{a}^{2}M_{a}}$ (4)

with $M_{a}=\pi m_{a}^{2}f_{a}^{2}a_{0}^{2}R_{a}^{3}/2$.

We note that the radius $R_{a}$ is inversely proportional to the mass $M_{a}$.
Such an axion star with small mass $M_{a}\sim 10^{-12}M_{\odot}$ is known to
be stable. Numerically,

$R_{a}=260\mbox{km}\frac{10^{-12}M_{\odot}}{M_{a}}\Big{(}\frac{10^{-5}\mbox{eV}}{m_{a}}\Big{)}^{2}.$
(5)

( Although more detail analysisradius  shows larger radius than the formula
$R_{a}=1/Gm_{a}^{2}M_{a}$, we use the formula in eq(5). The essence of our
result does not change even if we use the larger radius. ) When the axion star
passes the atmosphere of star with magnetic field $B=10^{2}$G, the electric
field is induced on the axion star,

$\vec{E}_{a}=-g_{\gamma}\alpha\frac{\tilde{a}(t,\vec{x})\vec{B}}{f_{a}\pi}\simeq-\frac{\alpha
a_{0}\vec{B}}{\pi}\cos(m_{a}t)\simeq 4.2\times
10^{-28}\mbox{GeV}^{2}\cos(m_{a}t)\Big{(}\frac{M_{a}}{10^{-12}M_{\odot}}\Big{)}^{2}\Big{(}\frac{m_{a}}{10^{-5}\mbox{eV}}\Big{)}^{3}\frac{\vec{B}}{10^{2}\mbox{G}}$
(6)

with the fine structure constant $\alpha\simeq 1/137$ and we put
$g_{\gamma}=1$, coupling strength between photon and axion described below. (
The sign of the electric field is not important in our discussion. )

We explain how the electric field arises when the axion star is in the
background magnetic field $B$. It comes from the interaction such that the
axion $a(t,\vec{x})$ couples with electric $\vec{E}$ and magnetic fields
$\vec{B}$,

$L_{aEB}=g_{\gamma}\alpha\frac{a(t,\vec{x})\vec{E}\cdot\vec{B}}{f_{a}\pi}\equiv
g_{a\gamma\gamma}a(t,\vec{x})\vec{E}\cdot\vec{B}$ (7)

where the numerical constant $g_{\gamma}$ depends on axion models; typically
it is of the order of one. The standard notation $g_{a\gamma\gamma}$ is such
that $g_{a\gamma\gamma}=g_{\gamma}\alpha/f_{a}\pi\simeq 0.14(m_{a}/\rm
GeV^{2})$ for DFSZ modeldfsz ; dfsz1  and
$g_{a\gamma\gamma}\simeq-0.39(m_{a}/\rm GeV^{2})$ for KSVZ modelksvz ; ksvz1 .
In other words, $g_{\gamma}\simeq 0.37$ for DFSZ and $g_{\gamma}\simeq-0.96$
for KSVZ. The axion decay constant $f_{a}$ is related with the axion mass
$m_{a}$ in the QCD axion; $m_{a}f_{a}\simeq 6\times 10^{-6}\rm eV\times
10^{12}$GeV. We only consider the QCD axion in this paper.

The interaction in eq(7) between axion and electromagnetic field slightly
modifies Maxwell equations in vacuum

$\displaystyle\vec{\partial}\cdot(\vec{E}+g_{a\gamma\gamma}a(t,\vec{x})\vec{B})$
$\displaystyle=0$
$\displaystyle,\quad\vec{\partial}\times\Big{(}\vec{B}-g_{a\gamma\gamma}a(t,\vec{x})\vec{E}\Big{)}-\partial_{t}\Big{(}\vec{E}+g_{a\gamma\gamma}a(t,\vec{x})\vec{B}\Big{)}=0,$
$\displaystyle\vec{\partial}\cdot\vec{B}$ $\displaystyle=0$
$\displaystyle,\quad\vec{\partial}\times\vec{E}+\partial_{t}\vec{B}=0.$ (8)

From the equations, we approximately obtain the electric field
$\vec{E}_{a}=-g_{a\gamma\gamma}\tilde{a}(t,\vec{x})\vec{B}\simeq-\alpha
a_{0}\vec{B}\cos(m_{a}t)/\pi$ in eq(6) generated by the axion star
$\tilde{a}(t,\vec{x})$ under background magnetic field $\vec{B}$. It is of the
order of $g_{a\gamma\gamma}\tilde{a}(t,\vec{x})$ ( $\ll 1$. )

First of all, we give a naive argument how large radiations arise when the
axion star collides electron gas. In the argument we consider only electric
field $\vec{E}_{a}$, which makes electrons oscillate. Later, we discuss the
radiations by taking account of not only the electric field $\vec{E}_{a}$ but
also electric field $\vec{E}_{rd}$ of radiations emitted by electrons
themselves. We find that the naive argument is essentially correct, although
there is an additional much small factor suppressing radiation flux in the
electron plasma when $m_{p}\simeq m_{a}$.

The electric field $E_{a}$ makes an electron harmonically oscillate because it
oscillates with frequency $m_{a}$. Because there are many electrons in the
atmosphere of main sequence star, the oscillating electric field of the axion
star induces coherent oscillation of the electrons over the axion star. The
coherent length is approximately given by $R_{a}$. They emit coherent dipole
radiations, i.e. coherent electromagnetic radiations with the frequency
$m_{a}/2\pi\simeq 2.4\mbox{GHz}(m_{a}/10^{-5}\mbox{eV})$. Thus, the power of
the radiation $\dot{\omega}N_{e}^{2}$ is extremely enhanced because the number
$N_{e}=4\pi n_{e}R_{a}^{3}/3$ of the electrons is large, where
$\dot{\omega}=2\alpha(eE_{a})^{2}/3m_{e}^{2}$ denotes the radiation power
emitted by a single electron with its mass $m_{e}$. Numerically, the power of
a single electron averaged in time is

$\dot{\omega}=\overline{2\alpha(eE_{a})^{2}/3m_{e}^{2}}=3.8\times
10^{-31}\mbox{erg/s}\Big{(}\frac{M_{a}}{10^{-12}M_{\odot}}\Big{)}^{4}\Big{(}\frac{m_{a}}{10^{-5}\mbox{eV}}\Big{)}^{6}\Big{(}\frac{B}{10^{2}\mbox{G}}\Big{)}^{2}$
(9)

with time average $\overline{Q}$ of $Q$.

The radiations are mainly emitted into the direction perpendicular to the
magnetic field $\vec{B}$ because electrons harmonically oscillate in the
direction $\vec{E}_{a}$ parallel to $\vec{B}$. It implies that they are hardly
affected by the magnetic field. The radiations can propagate to the outside of
the atmosphere without absorption, in which the plasma frequency is lower than
the frequency $m_{a}$.

When the axion star enters the atmosphere of a main sequence star in the
collision, the flux of the radiations gradually increases as the electron
number density increases. But the radiations are suddenly enhanced, when it
passes the region with $m_{p}\simeq m_{a}$. After the enhancement of the
emission, the radiations stop because it goes into the deep region of the
atmosphere in which the plasma frequency $m_{p}=\sqrt{e^{2}n_{e}/m_{e}}$ is
larger than the frequency $m_{a}$. The critical number density is given by
$n_{e}^{cl}\simeq 7\times 10^{10}/\mbox{cm}^{3}(m_{a}/10^{-5}\mbox{eV})^{2}$.
The radiations are absorbed in such dense electron gas with
$n_{e}>n_{e}^{cl}$.

Thus, the maximum power of the coherent radiations is given by

$\dot{\omega}N_{e}^{2}\simeq 1.0\times
10^{30}\mbox{W}\Big{(}\frac{10^{-12}M_{\odot}}{M_{a}}\Big{)}^{2}\Big{(}\frac{10^{-5}\mbox{eV}}{m_{a}}\Big{)}^{2}\Big{(}\frac{B}{10^{2}\mbox{G}}\Big{)}^{2}$
(10)

with $1\mbox{W}=10^{7}\mbox{erg/s}$, where we assume that the number density
of electrons emitting the radiations is given by $n_{e}^{cl}=7\times
10^{10}(m_{a}/10^{-5}\mbox{eV})^{2}/\mbox{cm}^{3}$. We note that
$\dot{\omega}\propto M_{a}^{4}m_{a}^{6}B^{2}$ and $N_{e}^{2}\propto
n_{e}^{2}R_{a}^{6}\propto M_{a}^{-6}m_{a}^{-8}$. The result is obtained with
the naive argument which only takes into account the electric field
$\vec{E}_{a}$ induced by the axion star. When we take into account electric
field $\vec{E}_{rd}$ of the radiation emitted by electrons, we have additional
much small factor in the formula $\dot{\omega}N^{2}$. Furthermore, we find
that the enhanced radiation only arises in the region with $m_{p}\simeq
m_{a}$.

Now, we would like to more accurately discuss the radiations by taking account
of back reactions of the emitted radiations on electrons. An electron with
velocity $\vec{v}$ is made to oscillate by electric fields according to the
equation of motion,

$m_{e}\dot{\vec{v}}=e(\vec{E}_{a}+\vec{E}_{rd})$ (11)

where $\vec{E}_{rd}$ denotes the electric field of the radiations emitted by
the electrons themselves. We notice that electron receives the effects of two
types of electric fields. One is the electric field $\vec{E}_{a}$ induced on
the axion star under the magnetic field $\vec{B}$, while the another one is
$\vec{E}_{rd}$. In the naive argument above, we have not taken into account
the effect of the electric field $\vec{E}_{rd}$.

Using Maxwell equations,
$\vec{\partial}\times\vec{B}_{rd}=\vec{J}+\partial_{t}\vec{E}_{rd}$ and
$\vec{\partial}\times\vec{E}_{rd}=-\partial_{t}\vec{B}_{rd}$ with electric
current $\vec{J}=en_{e}\vec{v}$, we find that the electric field
$\vec{E}_{rd}$ satisfies the equation

$(\partial_{t}^{2}-\vec{\partial}^{2}+m_{p}^{2})\vec{E}_{rd}=-m_{p}^{2}\vec{E}_{a}$
(12)

with the plasma frequency $m_{p}$; $m_{p}^{2}=e^{2}n_{e}/m_{e}$. It can be
also derived by using the equations(Radiation Burst by Axion Star Collision
with Star in the Andromeda Galaxy) with the current $\vec{J}$. The equation in
(12) describes the emission of radiation produced by the electric current
$\vec{J}$.

We note $\vec{E}_{a}\propto\vec{B}$. Thus, supposing that
$\vec{E}_{a}=(0,0,E_{a})$ and $E_{a}=E_{a}^{0}\exp(-r/R_{a})\exp(-im_{a}t)$
with $E_{a}^{0}\equiv\alpha a_{0}B/\pi$, we find the solution
$\vec{E}_{rd}=(0,0,E_{rd})$,

$E_{rd}=\exp(-im_{a}t)\Big{(}\frac{-p_{2}\exp(ikr)}{r}+\frac{p_{1}r+p_{2}}{r}\exp(-\frac{r}{R_{a}})\Big{)},$
(13)

with $k=\sqrt{m_{a}^{2}-m_{p}^{2}}$ ( we assume $m_{a}\geq m_{p}$. ),
$p_{1}=E_{a}^{0}m_{p}^{2}R_{a}^{2}/(k^{2}R_{a}^{2}+1)$ and
$p_{2}=2E_{a}^{0}m_{p}^{2}R_{a}^{3}/(k^{2}R_{a}^{2}+1)^{2}$, where $k$ denotes
the momentum of radiation in the electron gas with plasma frequency $m_{p}$.
The momentum $k$ is not equal to the frequency $m_{a}$ of radiation in the
plasma. The coefficient $p_{2}$ of the term $\propto\exp(-im_{a}t+ikr)$ is
determined by the regularity at $r=0$ of the electric field $E_{rd}$. The term
represents the radiation propagating far from the axon star.

The magnetic field $\vec{B}_{rd}$ is also obtained using the formula,
$\vec{\partial}\times\vec{E}_{rd}=-\partial_{t}\vec{B}_{rd}=im_{a}\vec{B}_{rd}$,

$\displaystyle\vec{B}_{rd}$ $\displaystyle=$
$\displaystyle\frac{1}{im_{a}}(\partial_{x}E_{rd},-\partial_{y}E_{rd},0)=\frac{1}{im_{a}}(\frac{y}{r},-\frac{x}{r},0)\exp(-im_{a}t)\epsilon$
(14) $\displaystyle\epsilon$ $\displaystyle\equiv$ $\displaystyle
p_{2}(\frac{-ik}{r}+\frac{1}{r^{2}})\exp(ikr)-(\frac{p_{a}}{r^{2}}+\frac{p_{1}r+p_{2}}{R_{a}r})\exp(-\frac{r}{R_{a}})$
(15)

The field strengths at the large distance $r\gg R_{a}$ behave as

$\vec{E}_{rd}\to\exp(-im_{a}t+ikr)\frac{-p_{2}}{r}\big{(}0,0,1\big{)},\quad\vec{B}_{rd}\to\exp(-im_{a}t+ikr)\frac{-kp_{2}}{m_{a}r}\big{(}\frac{y}{r},\frac{x}{r},0\big{)}\quad\mbox{for}\quad
r\gg R_{a}$ (16)

Because $p_{2}\simeq E_{a}^{0}m_{p}^{2}R_{a}^{3}\propto n_{e}R_{a}^{3}\gg 1$
for $kR_{a}<1$, the radiation is coherently emitted by electrons with their
number $N_{e}\sim n_{e}R_{a}^{3}$. The field strength is very large. This is
the situation mentioned above in the naive argument where $N_{e}$ electrons
coherently oscillate by the electric field $\vec{E}_{a}$. On the other hand,
$p_{2}\sim E_{a}^{0}m_{p}^{2}k^{-4}R_{a}^{-1}\sim
n_{e}R_{a}^{3}/(kR_{a})^{4}\ll n_{e}R_{a}^{3}$ for $kR_{a}\gg 1$. Thus, the
radiation is suppressed. The momentum range $k<1/R_{a}$ ( $k/m_{a}\sim
10^{-7}$ ) for the enhancement is extremely small. It implies that the
emission of a large amount of the radiation occurs only in such a narrow
range. This is similar to resonant conversion of axion into radiations.

In other words, when the coherent length $1/k$ of the radiation
$\vec{E}_{rd}\propto\exp(ikr)$ is larger than or similar equal to the coherent
length $R_{a}\sim 100$km of the electric field
$\vec{E}_{a}\propto\exp(-r/R_{a})$ i.e. $kR_{a}\leq 1$, the coherent
oscillation by $\vec{E}_{a}$ is not disturbed by the radiation $\vec{E}_{rd}$.
Thus, the coherent radiations arise. This corresponds to the resonant
conversion of axion into radiations. On the other hand, when $1/k$ is much
smaller than $R_{a}$, such coherent radiations do not arise. The radiation
field $\vec{E}_{rd}$ emitted by electrons disturbs the coherent oscillation by
$\vec{E}_{a}$. Thus, the radiations emitted by the electrons are very weak.

At the first glance, our emission mechanism of the radio burst is different
from the emission due to axion resonant conversion. Our mechanism requires
coherent oscillation of electrons, while the resonant conversion does the
mixing of photon and axion with identical mass. When plasma frequency is equal
to the axion mass, both wave lengths of the photon $1/k_{rd}$ and axion
$1/k_{a}$ are identical, i.e. $k_{rd}=k_{a}$. Thus, electric field induced by
the axion makes electron coherently oscillate over the wave length $1/k_{a}$
and the coherent oscillation is never disturbed by the electric field of the
photon emitted by the electrons themselves. Thus, physically, the resonant
conversion of axion into radiations takes place owing to the coherent emission
by electrons.

As we have obtained electromagnetic fields propagating at large distance, we
can find the flux of the radiations,

$F=\frac{1}{2}\int
d\vec{S}\cdot(\vec{E}_{rd}\times\vec{B^{\dagger}}_{rd})=\frac{4\pi
k}{3m_{a}}p_{2}^{2}=\frac{4\pi
k}{3m_{a}}\Big{(}\frac{2E_{a}^{0}m_{p}^{2}R_{a}^{3}}{(k^{2}R_{a}^{2}+1)^{2}}\Big{)}^{2}\simeq\frac{\pi
k}{3m_{a}}(E_{a}^{0}m_{p}^{2}R_{a}^{3})^{2}=\frac{9}{4}\frac{k}{m_{a}}\dot{\omega}N_{e}^{2}$
(17)

with $kR_{a}\simeq 1$ ( $m_{p}\simeq m_{a}$ ), where we consider the region
with plasma frequency $m_{p}$ being nearly equal to $m_{a}$ in which the flux
is enhanced due to the coherent emission by $N_{e}=4\pi n_{e}R_{a}^{3}/3$
electrons.

We should notice that the flux in eq(17) is different with the naive one in
eq(10) by the factor $k/m_{a}\simeq k/m_{p}$. The factor
$k/m_{p}=1/m_{p}R_{a}\sim 10^{-7}(260\mbox{km}/R_{a})(10^{-5}\mbox{eV}/m_{a})$
describes the velocity of the radiations inside the plasma. Thus, the flux is
much smaller than the naive one because the velocity is much small; the naive
estimation assumes the light velocity of the radiations in the vacuum.

We now proceed to examine the radiation flux from the Andromeda Galaxy in
which the axion star collides main sequence star with magnetic field $\sim
10^{2}$G. Because the distance to the Andromeda Galaxy is $\sim 2.5\times
10^{6}\rm ly$, the observed flux density $S_{\nu}$ of the radiation is
estimated in the following,

$S_{\nu}=\frac{F}{4\pi(2.5\times
10^{6}\mbox{ly})^{2}}\frac{1}{\delta\nu}\simeq 1.6\times
10^{-3}\mbox{Jy}\Big{(}\frac{g_{\gamma}}{1.0}\Big{)}^{2}\Big{(}\frac{10^{-12}M_{\odot}}{M_{a}}\Big{)}\Big{(}\frac{10^{-5}\mbox{eV}}{m_{a}}\Big{)}^{2}\Big{(}\frac{B}{10^{2}\mbox{G}}\Big{)}^{2}\sqrt{\frac{3\times
10^{3}\mbox{K}}{T}}$ (18)

with $1$Jy$=10^{-26}\mbox{W}/(\rm m^{2}Hz)$, and $g_{\gamma}=0.37$ (
$g_{\gamma}=-0.96$ ) for DFSZ ( KSVZ ), where the bandwidth $\delta\nu$ of the
line spectrum is caused by the temperature $T$ of electron gas:
$\delta\nu=(m_{a}/2\pi)(\sqrt{T/m_{e}})\simeq
1.7\mbox{MHz}(m_{a}/10^{-5}\mbox{eV})\sqrt{T/(3\times 10^{3}\rm K)}$. The line
spectrum is thermally broadened. We tentatively use the value $T=3\times
10^{3}$K of the temperature, although real ones would be different in each
collision. ( We consider red dwarf with low surface temperature such as
$T=3\times 10^{3}$K. ) The emission of the burst lasts for the time in which
it takes for the axion star to pass such a region with $m_{p}\simeq m_{a}$. It
would be more than $1$ second because the velocity of the axion star is of the
order of $3\times 10^{2}$km/s.

When the axion star collides a main sequence star, at first it enter the
atmosphere of the star in which the plasma frequency is much smaller than
$m_{a}$ and the radiation from electrons is very weak because $k\simeq m_{a}$
or $kR_{a}\gg 1$. Then, it proceeds to deep inside the atmosphere and reaches
the critical region with $m_{p}\simeq m_{a}$, in which coherent radiations
with the large flux in eq(17) are emitted. In other words, the momentum $k$ (
velocity ) of the radiations gradually decreases as the plasma frequency
increases. Finally, enhanced coherent radiations are emitted in the critical
region with $m_{p}\simeq m_{a}$, where the momentum ( velocity $=k/m_{p}$ ) is
very small, $k\sim R_{a}^{-1}$.

We now estimate the event rate of the axion star collisions with main sequence
stars in the Andromeda Galaxy. Especially we consider K and M types star
because they would make up more than a half of stars in the galaxy and they
have strong surface magnetic fieldMstar  of the order of $10^{3}$G. We suppose
that the number of $N_{s}=10^{11}$ such stars collide the axion star and that
the fraction of the axion star in the dark matter is $1/2$. That is, the
number density $n_{a}$ of the axion star is given by
$n_{a}=0.5\times\rho_{d}/M_{a}$ where we denote the dark matter density as
$\rho_{d}$. It is assumed that $\rho_{d}\simeq 0.3\mbox{GeV}/\mbox{cm}^{3}$.
Thus, we estimate the event rate of the collisions per hour in the Andromeda
galaxy is

$\mbox{event rate of collision per hour}=n_{a}\times N_{s}\times Dv\simeq
0.06/\mbox{hour}\Big{(}\frac{10^{-12}M_{\odot}}{M_{a}}\Big{)}\Big{(}\frac{\rho_{a}}{0.5\rho_{d}}\Big{)}\Big{(}\frac{N_{s}}{10^{11}}\Big{)}$
(19)

with relative velocity $v=10^{-3}$ between axion star and the main sequence
star, where the collision cross section $D$ is given by

$D=\pi(R_{s}+R_{a})^{2}\Big{(}1+\frac{2GM_{s}}{v^{2}(R_{s}+R_{a})}\Big{)}\simeq\pi
R_{s}^{2}\Big{(}1+\frac{2GM_{s}}{v^{2}R_{s}}\Big{)}\simeq 5.3\pi R_{s}^{2},$
(20)

supposing radius $R_{s}=0.5R_{\odot}\simeq 3.5\times 10^{5}$km and mass
$M_{s}=0.5M_{\odot}$ of the colliding star. Therefore, such a collision
between the axion star and K, M type main sequence star in the Andromeda
Galaxy occurs so frequently that we can observe the collision using existing
radio telescopes.

We have several comments on the above discussions.

First, we have assumed the mass of the axion star $M_{a}\sim
10^{-12}M_{\odot}$. Such an axion star is stableradius . ( The critical mass
beyond which axion stars are unstable is approximately given by
$10^{-11}M_{a}$ for $m_{a}=10^{-5}$eV. ) The mass is consistent with the
estimationminicluster ; minicluster1  of the mass of axion minicluster. The
minicluster is discussedlev ; egg  to become axion star by axion condensation.
It is reasonable to use the mass. Additionally, it is
proposedcoherentradiation ; iwazaki1 ; bu ; iwazaki2  that fast radio bursts
arise by axion star collisions with neutron star. The event rate of the
collisions is consistent with the burst event when $M_{a}\sim
10^{-12}M_{\odot}$. These are the reason for our choice of the mass $M_{a}\sim
10^{-12}M_{\odot}$.

Secondly, The above estimation involves some ambiguities. The most ambiguous
one is the assumption of number density $n_{a}=0.5\times\rho_{d}/M_{a}$ of
axion star. It might be a fraction of the dark matter such as $n_{a}\sim
0.1\times\rho_{d}/M_{a}$. Furthermore, we have used the parameter $B=10^{2}$G.
But, in general, K and M types main sequence stars would possess stronger
magnetic field than $10^{2}$G. Then, the flux density $S_{\nu}$ is much larger
than the estimation $\sim 10^{-3}\mbox{Jy}(B/10^{2}\rm G)^{2}$. For instance,
$S_{\nu}\sim 10^{-1}$Jy $(B/10^{3}\rm G)^{2}$. The signal of the collision is
much clearer. Additionally, in general, we have no detailed observation of
magnetic field configuration and the distribution of electron plasma in star.
Thus, we cannot definitely anticipate the duration of the radio burst. It is
given by the time which it takes for axion star to pass the region with
$m_{p}\simeq m_{a}$ and $B\simeq 10^{2}$G.

Thirdly, although we have examined radio bursts arising the Andromeda Galaxy,
we may consider the bursts arising in our Milky Way Galaxy. Then, the
radiation flux of the bursts are $4$ orders of magnitude larger than that in
the Andromeda Galaxy because the distance to the burst in our galaxy is of the
order of $10^{2}$ times smaller than that to burst in the Andromeda Galaxy.
Thus, we expect large flux density $S_{\nu}\sim 10\rm Jy(B/10^{2}\rm G)^{2}$,
although the detection efficiency is much small. We cannot observe the whole
of our galaxy in one time.

Finally, we would like to make a comment on the deformation of the axion star
by tidal force caused by the main sequence star. The deformation begins to
occur when the axion star approaches the star within the distanceiwazaki3
$R_{c}=R_{a}(0.5M_{\odot}/M_{a})^{1/3}\simeq 1.9\times 10^{6}$km. The distance
is roughly equal to the radius $R_{s}=3.5\times 10^{5}$km of the star. Thus,
the use of the spherical form $\tilde{a}(t,r)$ of the axion star is good
approximation. The deform from the spherical form is not so large for the
deformation to make an effect on the above estimation.

To summarize, our emission mechanism ( radiation burst from axion star
collision with magnetic main sequence star ) is a promising way for the
observation of the axion star. Indeed, the axion star collision with K and M
types main sequence stars in the Andromeda Galaxy frequently occurs $\sim
1/\rm day$. The flux density $\sim 10^{-1}$ Jy$(B/10^{3}\rm G)^{2}$ of the
radiation burst would be large enough for the detection if the duration is
longer than $1$ second. The burst shows line spectrum with very small width
$\delta\nu\sim 1$MHz. Therefore, the burst may be detectable with existing
radio telescopes. The observation of the burst reveals the existence of the
axion and determines the value of the axion mass.

The author expresses thanks to S. Kisaka for useful information and members of
theory group in KEK for their hospitality. This work is supported in part by
Grant-in-Aid for Scientific Research ( KAKENHI ), No.19K03832.

## References

  * (1) R. D. Peccei and H. R. Quinn, Phys. Rev. Lett. 38 (1977) 1440.
S. Weinberg, Phys. Rev. Lett. 40 (1978) 223.
F. Wilczek, Phys. Rev. Lett. 40 (1978) 279.

  * (2) T. Braine et al, Phys. Rev. Lett. 124, (2020) 101303.
  * (3) K. Yamamoto, et al. hep-ph/0101200.
  * (4) L. Zhong, et al. Phys. Rev. D97 (2018) 092001.
  * (5) J. L. Ouellet, et al. Phys. Rev. Lett. 122 (2020) 12, 121802.
  * (6) B. T. McAllister, et al. Phys. Dark Univ. 18 (2017) 67.
  * (7) X. Li, et al. PoS ICHEP2020 (2021) 645.
  * (8) D. Horns, J. Jaeckel, A. Lindner, A. Lobanov, J. Redondo, and A. Ringwald, JCAP 04 (2013) 016.
  * (9) V. Anastassopoulos, et al. Nature Phys. 13 (2017) 584.
  * (10) R. Ohta, et al. Nucl. Instr. Meth. A670 (2012) 73.
  * (11) A. Iwazaki, arXiv: 2111.09468.
  * (12) J. Preskill, M. B. Wise and F. Wilczek, Phys. Lett. 120B (1983) 127.
  * (13) L. F. Abbott and P. Sikivie, Phys. Lett. B120 (1983) 133.
  * (14) M. Dine and W. Fischler, Phys. Lett. B120 (1983) 137.
  * (15) E. W. Kolb and I. I. Tkachev, Phys. Rev. Lett. 71 (1993) 3051; Astrophys. J. 460 (1996) L25.
  * (16) J. Enander, A. Pargner and T. Schwetz, JCAP 12 (2017) 038.
  * (17) Bogolubsky IL, and V.G. Makhankov, JETP Lett., 24, (1976) 12.
  * (18) I. I. Tkachev (1991), Phys. Lett., B261 (1991) 289.
  * (19) J. Barranco, A. Bernal, Phys.Rev. D83 (2011) 043525.
  * (20) E. Braaten and H. Zhang, Rev. Mod. Phys. 91, 4 (2019) 041002.
  * (21) D. J. Kaup, Phys. Rev. 172 (1968) 1331.
  * (22) R. Ruffini and S. Bonazzola, Phys. Rev. 187 (1969) 1767.
  * (23) J. Breit, S. Gupta and A. Zaks, Phys Lett. 140 (1984) 329.
  * (24) M. Colpi, S. L. Shapiro, and I. Wasserman, Phys. Rev. Lett. 57, (1986) 2485.
  * (25) Chavanis P-H and L. Delfini, Phys. Rev. D84 (2011) 043532.
  * (26) A. Iwazaki, arXiv:1412.7825.
  * (27) A. Iwazaki, Phys. Rev. D 60 (1999) 025001.
  * (28) A. iwazaki, Phys. Rev.D 91 (2015) 2, 023008.
  * (29) I. I. Tkachev, JETP Lett. 101 (2015) 1.
  * (30) M. S. Pshirkov and S. B. Popov, J.Exp.Theor. Phys.108 (2009) 384.
  * (31) A. Hook, Y. Kahn, B. R. Safdi and Z. Sun, Phys. Rev. Lett. 121 (2018) 241102.
  * (32) B. R. Safdi, Z. Sun and A. Y. Chen, Phys. Rev. D 99 (2019) 123021.
  * (33) Y. Bai, and Y. Hamada, Phys. Lett. B 781 (2018) 187.
  * (34) J. H. Buckley, P. S. B. Dev, F. Ferrer and F. P. Huang, Phys. Rev.D 103 (2021) 043015.
  * (35) A. Prabhu and N. M. Rapidis, JCAP 10 (2020) 054.
  * (36) M. A. Amin, A. J. Long, Z-G. Mou and P. Saffin, JHEP 06 (2021) 182.
  * (37) F. P. Huang, K. Kadota, T. Sekiguchi and H. Tashiro, Phys. Rev. D 97 (2018) 123001.
  * (38) A. Reiners, Living Rev. Sol. Phys. 9 (2012) 1.
  * (39) S. C. Marsden, et.al., MNRAS, 444, (2014) 3517.
  * (40) M. Dine, W. Fischler and M. Srednicki, Phys. Lett. 104B (1981) 199.
  * (41) A. R. Zhitnitsky, Sov. J. Nucl. Phys. 31 (1980) 260.
  * (42) J. E. Kim, Phys. Rev. Lett. 43, (1979) 103.
  * (43) M. A. Shifman, A. I. Vainshtein and V. I. Zakharov, Nucl. Phys. B166 (1980) 493.
  * (44) D. G. Levkov, A. G. Panin, and I. I. Tkachev, Phys. Rev. Lett. 121 (2018) 151301.
  * (45) B. Eggemeier and J. Niemeyer, Phys. Rev. D 100 (2019) 6.
  * (46) A. Iwazaki, PTEP 2020 (2020) 1.
  * (47) A. Iwazaki, Phys. Rev. D 104 (2021) 043022.
  * (48) A. Iwazaki, arXiv:1512.06245.