# Generation of primordial black holes from an inflation model with modified
dispersion relation

Taotao Qiu<EMAIL_ADDRESS>School of Physics, Huazhong University of
Science and Technology
Wuhan, 430074, China  Wenyi Wang  wangwy@mails.ccnu.edu.cn(corresponding
author) Institute of Astrophysics, Central China Normal University, Wuhan
430079 ,China  Ruifeng Zheng<EMAIL_ADDRESS>Department of Physics
and Siyuan Laboratory, Jinan University
Guangzhou 510632, China

###### Abstract

A primordial black hole (PBH) is interesting to people for its ability of
explaining dark matter as well as supermassive astrophysical objects. In the
normal inflation scenario, the generation of PBHs usually requires an enhanced
power spectrum of scalar perturbation at the end of inflation era, which is
expected when the dispersion relation of the inflaton field gets modified. In
this work, we study a kind of inflation model called the Dirac-Born-Infeld-
inspired nonminimal kinetic coupling (DINKIC) model, where the dispersion
relation is modified by a square root existing in the field Lagrangian. We
discuss the enhancement of scalar power spectrum due to the modified
dispersion relation, as well as the abundance of PBHs produced by the Press-
Schechter collapse mechanism. We also discuss the formation of scalar-induced
gravitational waves by linear scalar perturbations.

##  I introduction

Primordial black holes (PBHs) have been drawing attentions of more and more
astrophysicists and cosmologists. Unlike the formation of astrophysical black
holes, PBHs are not formed by the collapse of stars, but by the gravitational
collapse of local high-density regions in the early Universe, thus PBHs have
much broader mass range than astrophysical ones. Therefore, it cannot only act
as dark matter whose identity has not been confirmed yet, but also an
interesting candidate of the supermassive black hole, which seems impossible
to be astrophysical because of the lack of formation time. First initiated by
Zeldovich and Novikov Zel’dovich and Novikov (1967) in the 1960s, and put
forward by Hawking and Carr in the 1970s Hawking (1971); Carr and Hawking
(1974), PBHs have been widely studied, see e.g. Khlopov (2010); Belotsky  _et
al._ (2014); Sasaki  _et al._ (2018); Belotsky  _et al._ (2019); Yuan and
Huang (2021); Villanueva-Domingo  _et al._ (2021); Escrivà  _et al._ (2022)
and the references therein. Moreover, there are also a lot of efforts putting
various constraints on PBHs, such as from gravitational lensing Tisserand  _et
al._ (2007); Niikura  _et al._ (2019a); Jung and Shin (2019); Niikura  _et
al._ (2019b), cosmic microwave background (CMB) and big bang nucleosynthesis
(BBN) Carr  _et al._ (2010); Serpico  _et al._ (2020); Acharya and Khatri
(2020), gamma-ray emission Carr  _et al._ (2010); Barnacka  _et al._ (2012);
Laha (2019); Dasgupta  _et al._ (2020); Laha  _et al._ (2020); Cai  _et al._
(2021); Tan  _et al._ (2022), compact objects Graham  _et al._ (2015); Capela
_et al._ (2013); Lu and Wu (2019), gravitational waves Chen  _et al._ (2020);
Wong  _et al._ (2021); Kimura  _et al._ (2021); Kavanagh  _et al._ (2018);
Wang  _et al._ (2022), large-scale structure (LSSs) Carr and Silk (2018) and
so on; see Carr  _et al._ (2021a) for a review.

As has been demonstrated in the literature, PBHs can be generated in inflation
scenario. During the inflation era, the Universe expands dramatically over a
short period of time, while the quantum fluctuations in the vacuum of the
inflation field will be stretched out of the horizon and become classical
perturbations. In small scales, if the power spectrum of the cosmological
perturbations has large peaks, it will lead to large inhomogeneities in the
energy distribution of the Universe. After the perturbation reenters the
horizon, PBHs will form in regions of high energy density due to gravitational
collapse Riotto (2003). To be precise, in order to effectively form the PBHs,
it is necessary to enhance the amplitude of the power spectrum on small scales
to the order of $10^{-2}$ Motohashi and Hu (2017), while on the CMB scale, it
is constrained to $10^{-9}$ by the observations Akrami  _et al._ (2020). There
are many ways to enhance the power spectrum, such as selection of scalar
potentials with special features Cai  _et al._ (2020); Ketov and Khlopov
(2019); Drees and Erfani (2012); Garcia-Bellido and Ruiz Morales (2017); Di
and Gong (2018); Gao and Guo (2018); Cheng  _et al._ (2018); Xu  _et al._
(2020); Lin  _et al._ (2020); Özsoy and Lalak (2021); Kawai and Kim (2021a,
b); Solbi and Karami (2021); Zheng  _et al._ (2021); Gangopadhyay  _et al._
(2022); Ashoorioon  _et al._ (2021a, 2022); Karam  _et al._ (2022), multifield
inflation models Garcia-Bellido  _et al._ (1996); Bugaev and Klimai (2012);
Clesse and García-Bellido (2015); Kawasaki  _et al._ (2013); Ahmed  _et al._
(2022); Kawai and Kim (2022), sound speed resonance Cai  _et al._ (2018); Chen
and Cai (2019) and so on Lin and Ng (2013); Pi  _et al._ (2018); Choudhury and
Mazumdar (2014); Fu  _et al._ (2019); Arya (2020); Martin  _et al._ (2020a);
Ashoorioon  _et al._ (2021b); Martin  _et al._ (2020b); Choudhury  _et al._
(2023).

Recently, there are works discussing about generating large scalar power
spectrum by suppressing the sound speed of the inflaton field to a very tiny
value, namely $c_{s}\ll 1$ Ballesteros  _et al._ (2022); Gorji  _et al._
(2022); Zhai  _et al._ (2022). One can see from the expression of the scalar
power spectrum, $P_{\zeta}\sim H^{2}/(\epsilon c_{s})$ that, such an approach
is parallel to that of suppressing the slow-roll parameter, as what has been
done in the ultra-slow-roll inflation models Di and Gong (2018); Motohashi and
Hu (2017); Ballesteros and Taoso (2018); Zheng  _et al._ (2021), albeit the
latter violates the slow-roll condition. Moreover, in these works, the
suppression of $c_{s}$ was realized accompanied by a higher order term, in
order not to violate the consistency requirement and lead to strong coupling
Ballesteros  _et al._ (2022); Gorji  _et al._ (2022); Ballesteros  _et al._
(2019). In Ballesteros  _et al._ (2022), such a realization was discussed in
the general effective field theory language, while in Gorji  _et al._ (2022),
people used the ghost inflation with a higher-order corrected dispersion
relation as a specific example.

On the other hand, the modified dispersion relation (with higher-order term)
can be naturally generated in inflation models which have nonlinear kinetic
terms, such as the ”DBI-inspired non-minimal kinetic coupling” (DINKIC) model
proposed by one of the authors in 2015 Qiu (2016). The nonlinearity in this
model is due to the fact that the nonminimal kinetic coupling term resides
inside the square root in the field Lagrangian. As a result, there is an
additional term proportional to $k^{4}$ besides the normal dispersion
relation: $\omega^{2}=c_{s}^{2}k^{2}$. In this work, we discuss the generation
of PBHs in the framework of this model. While in the original paper Qiu
(2016), we set the $c_{s}^{2}$ to be constant, in this work we make it vary,
which gives rise to a modified dispersion relation: as the evolution goes, the
$k^{2}$ term dominates first, and the $k^{4}$ dominates later. In such a case,
we calculate the scalar perturbations in order to obtain a large power
spectrum on small scales. We analyze the possibility of the formation of PBHs
which can act as a large amount of dark matter, and confront our results to
the constraints of current observations. We also discuss the scalar-induced
gravitational waves (SIGWs) generated in this model Ananda  _et al._ (2007);
Baumann  _et al._ (2007); Saito and Yokoyama (2009, 2010); Domènech (2021).

This paper is organized as follows. In Sec. II, we briefly review the DINKIC
inflation model, which contains a correction term of $k^{4}$ in the dispersion
relation. In Sec. III, we set up our model with varying sound speed, and
present the information for background quantities. In Sec. IV, we calculate
the evolution of the perturbation so as to obtain the scalar power spectrum,
and analyze the conditions for enhancing the power spectrum to $10^{-2}$. In
Sec. V, we calculate the PBH abundance produced in the model, and constrain
our results with the current observations. In Sec. VI, we discuss the
production of SIGWs in our model. Section VII is devoted to the conclusions
and discussions.

##  II DINKIC inflation model

The original DINKIC inflation model proposed in Ref. Qiu (2016) has the
following action:

$\displaystyle S=\int
d^{4}x\sqrt{-g}\left[\frac{R}{2\kappa^{2}}-\frac{1}{f(\phi)}(\sqrt{\mathcal{D}}-1)-V(\phi)\right],$
(1)

where we have defined

$\displaystyle\mathcal{D}$ $\displaystyle\equiv 1-2\alpha f(\phi)X+2\beta
f(\phi)\widetilde{X},$ (2) $\displaystyle X$
$\displaystyle\equiv-\frac{1}{2}g^{\mu\nu}\nabla_{\mu}\phi\nabla_{\nu}\phi,$
(3) $\displaystyle\widetilde{X}$
$\displaystyle\equiv-\frac{1}{2M^{2}}G^{\mu\nu}\nabla_{\mu}\phi\nabla_{\nu}\phi.$
(4)

Here $\alpha$ and $\beta$ are constants, $M$ is the scale of nonminimal
kinetic coupling, while $M_{pl}=\kappa^{-1}$ is the Planck scale, and the
function $f(\phi)$ is the (squared) warp factor of the AdS-like throat. Note
that the second kinetic term, $\widetilde{X}$, belongs to the generalized
scalar-tensor theory action, which possesses nice properties such as violating
the null energy condition without having ghosts Deffayet  _et al._ (2011);
Kobayashi (2019). Therefore, it is interesting to extend it to the nonlinear
action as well. One extension is to have the field’s action like that of the
DBI field, which has strong motivations from string theory Polchinski (2007);
Gerasimov and Shatashvili (2000); Kutasov  _et al._ (2000a, b). Note that the
above action is related to Fab 5 theory proposed years ago Appleby  _et al._
(2012); Linder (2013).

Under the flat FLRW metric
($g_{\mu\nu}=diag\\{-1,a^{2}(t),a^{2}(t),a^{2}(t)\\}$), one can vary the
action with respect to the field $\phi$ to get the equation of motion for
$\phi$:

$\displaystyle\frac{f_{\phi}(\sqrt{\mathcal{D}}-1)^{2}}{2f^{2}\sqrt{\mathcal{D}}}+\frac{3\beta
H^{2}-\alpha}{\sqrt{\mathcal{D}}}\ddot{\phi}+\frac{2\beta\dot{H}+3\beta
H^{2}-\alpha}{\sqrt{\mathcal{D}}}3H\dot{\phi}-\frac{3\beta
H^{2}-\alpha}{2\mathcal{D}^{3/2}}\dot{\mathcal{D}}\dot{\phi}-V_{\phi}=0~{},$
(5)

while the energy density $\rho$ and pressure $p$ are given by

$\displaystyle\rho$ $\displaystyle=\frac{(\sqrt{\cal
D}-1)}{f(\phi)}+V(\phi)+\frac{\alpha\dot{\phi}^{2}}{\sqrt{\mathcal{D}}}+\frac{6\beta
H^{2}\dot{\phi}^{2}}{M^{2}\sqrt{\mathcal{D}}},$ (6) $\displaystyle p$
$\displaystyle=-\frac{(\sqrt{\cal D}-1)}{f(\phi)}-V(\phi)-\frac{3\beta
H^{2}\dot{\phi}^{2}}{M^{2}\sqrt{\mathcal{D}}}-\left(\frac{\beta
H\dot{\phi}^{2}}{M^{2}\sqrt{\mathcal{D}}}\right)^{.}.$ (7)

In order to analyze the perturbations generated by the model, we use the ADM
formalism, in which the perturbed action up to the second order becomes

$\displaystyle S^{c}_{2}\approx\frac{1}{2\kappa^{2}}\int
d^{4}xa^{3}\Big{[}6\frac{x_{\beta}}{\mathcal{D}}\dot{\zeta}^{2}-\frac{2\epsilon}{a^{2}}(\partial\zeta)^{2}+\frac{16x_{\beta}^{4}y}{a^{4}H^{2}}(\partial^{2}\zeta)^{2}\Big{]}~{},$
(8)

where we define several dimensionless variables,

$\displaystyle
x_{\beta}=\frac{\kappa^{2}\beta\dot{\phi}^{2}}{2M^{2}\sqrt{\mathcal{D}}},\quad
y=\frac{f(\phi)M_{p}^{2}H^{2}}{\sqrt{\mathcal{D}}},$ (9)

and the $\epsilon\equiv-\dot{H}/H^{2}$ is the slow-roll parameter. One can see
from Eq. (8) that, different from usual generalized scalar-tensor theory, an
additional higher-order spatial derivative term appears, which is due to the
nonlinearity of the action. From Eq. (8), we can easily get the perturbation
equation:

$\displaystyle
u^{\prime\prime}+c_{s}^{2}k^{2}\left[1+\left(\frac{k}{k_{c}}\right)^{2}\right]u-\frac{z^{\prime\prime}}{z}u=0,$
(10)

where the prime denotes derivative with respect to conformal time $d\tau\equiv
a^{-1}(t)dt$; see Ref. Qiu (2016) for more details. In the above equation, we
define $u\equiv z\zeta$, $z\equiv a\sqrt{3x_{\beta}/{\cal D}}$,
$c_{s}^{2}=\epsilon{\cal D}/3x_{\beta}$, and the critical scale:

$\displaystyle k_{c}\equiv aH\sqrt{\frac{\epsilon{\cal
D}}{8x^{4}_{\beta}y}}=\frac{aHc_{s}}{\sqrt{\gamma}},$ (11)

where $\gamma\equiv 8x^{3}_{\beta}y/3$. Therefore we have the dispersion
relation as

$\displaystyle\omega^{2}=c_{s}^{2}k^{2}+c_{s}^{2}k_{c}^{-2}k^{4}.$ (12)

The dispersion relation above indicates that the fluctuation modes of the
inflation field can be divided into two cases, namely $k<k_{c}$ and $k>k_{c}$.
In the first case, the first term in Eq. (12) dominates over the second term,
and the approximate dispersion relation approaches $\omega\sim k$. In the
second case, the second term dominates over the first one, and it becomes
$\omega\sim k^{2}$. The similar dispersion relation also appears in ghost
inflation Arkani-Hamed  _et al._ (2004) whose background has a timelike scalar
field $\phi=M^{2}t$, and has been recently studied in EFT inflation
Ballesteros  _et al._ (2022); Gorji  _et al._ (2022).

In Ref. Qiu (2016), we assume the parameters such as $x_{\beta}$, $y$,
$\epsilon$ and $c_{s}^{2}$ are slow varying, so that $k_{c}\sim aH$. We draw
the evolution of the “critical wavelength” $1/k_{c}$ as well as the wavelength
of fluctuation mode with arbitrary wave number $k$ for this case in the left
panel of Fig. 1.

Figure 1: The sketch plots of the evolution of fluctuation modes for the
DINKIC inflation model in Qiu (2016) (left panel) and this paper (right
panel). The green lines: the conformal wavelengths $1/k$ for different
fluctuation modes; the yellow lines: the conformal “critical wavelength”
$1/k_{c}$; the red lines: the “effective horizo” which presents the effects of
the ”effective potential” $z^{\prime\prime}/z$ in Eq. (10), and it depends on
which term in Eq. (12) will dominate over the other. One can see that, while
in the original model the effective horizon and the critical wavelengths are
continuous, in this work both are steplike, which is useful to create the peak
in the scalar power spectrum in small scales.

One can see that, for the modes with $k<k_{c}$ initially, it will keep so
untill the end of inflation, so the $k^{4}$ term will be subdominant all the
time. However, for the modes with $k>k_{c}$ initially, it will evolve untill
$k$ becomes smaller than $k_{c}$ at a later time. According to the analysis in
the previous section, the dispersion relation is dominated first by the
$k^{4}$ term, then the $k^{2}$ term.

We also draw the effective horizon $l_{eff}$ such that, when $1/k<l_{eff}$,
the term with $k$ dominates over the “effective potential” term containing
$z^{\prime\prime}/z$ (subhorizon), and vice versa (superhorizon). This
determines the functional form of the solution $u$, as will be seen later.
Thus, the $l_{eff}$ also depends on which term in Eq. (12) will be dominant.
For $k<k_{c}$ where the first term dominates, $l_{eff}=c_{s}/aH$, while for
$k>k_{c}$ where the second term dominates, $l_{eff}=\sqrt[4]{\gamma}/aH$, so
for the modes whose wavelength crosses the critical wavelength during
inflation, the effective horizon will be discontinuous at the crossing point
(denoted as $\tau_{\ast}$). This is different in normal inflation models
without the $k^{4}$ correction term in the dispersion relation. However in
this case, although the modified dispersion relation can affect the initial
condition of the fluctuations, at late times (especially the superhorizon
region) it can hardly make any effect on the perturbations so as to deviate
from the standard slow-roll inflation. Therefore, the PBHs are not easy to be
generated, either.

If we break the “slow-varying” approximations of some of the variables,
however, things will become different. Note that the critical scale $k_{c}$ is
related to the sound speed $c_{s}$, and if we make $c_{s}$ steplike from a
large value to a small value, $k_{c}$ will be large at the beginning, then
become small later. For certain fluctuation modes with wave number $k$, one
can have $k<k_{c}$ at the beginning, then $k>k_{c}$ later. We draw the same
plot for this case in the right panel of Fig. 1. In this case, the dispersion
relation will be dominated first by the $k^{2}$ term, then the $k^{4}$ term.
Moreover, the effective horizon will also be made steplike, namely $c_{s}/aH$
followed by $\sqrt[4]{\gamma}/aH$. Note that although for large-scale modes
which exit the horizon before the transition time $\tau_{\ast}$, the $k^{4}$
term actually does not affect the solution (since
$z^{\prime\prime}/z>\omega^{2}$), for small-scale modes which exit the horizon
after the transition time, the $k^{4}$ term does affect the solution before
the horizon crossing ($z^{\prime\prime}/z<\omega^{2}$). Therefore, PBHs can be
formed in such a case, as has been shown in Ref. Ballesteros  _et al._ (2022);
Gorji  _et al._ (2022); Zhai  _et al._ (2022) as well. We will analyze such a
case in a bit more detail in the next section.

##  III our model with varying sound of speed

First of all, we assume that the inflation field $\phi$ still obeys the “slow-
roll” approximation, namely

$\displaystyle\left|\ddot{\phi}\right|\ll\left|3H\dot{\phi}\right|\,,\quad\frac{\left|2\beta\dot{H}\right|}{\left|\alpha
M^{2}+3\beta H^{2}\right|}\ll 1\,,\quad x_{\beta}\ll 1\,,\quad y\ll
1,\quad{\cal D}\simeq 1\,,$ (13)

under which the equation of motion (5) and Friedmann equation are reduced to

$\displaystyle 3\left(\alpha+\frac{3\beta
H^{2}}{M^{2}}\right)H\dot{\phi}+V_{\phi}\simeq
0\,,\quad\frac{3H^{2}}{\kappa^{2}}\simeq V(\phi)+\left(\alpha+\frac{6\beta
H^{2}}{M^{2}}\right)\dot{\phi}^{2}.$ (14)

In this case, the model is approaching a potential-driven inflation model.
Thus the slow-roll parameter $\epsilon$ can be expressed in terms of the
potential, namely $\epsilon=V_{\phi}^{2}/\left(2\kappa^{2}V(\phi)^{2}\right)$,
while from the previous section, the sound speed squared $c_{s}^{2}$ can be
expressed as

$\displaystyle c_{s}^{2}=\frac{\epsilon{\cal
D}}{3x_{\beta}}\simeq\frac{1}{6\kappa^{2}x_{\beta}}\left(\frac{V_{\phi}}{V(\phi)}\right)^{2},$
(15)

Therefore both $\epsilon$ and $c_{s}^{2}$ are closely related to the form of
the potential $V(\phi)$.

According to the analysis above, we now consider a steplike sound speed form.
One such parametrization is as the following function:

$\displaystyle c_{s}^{2}=\frac{1}{A+\exp[B\left(t-t_{c}\right)/\kappa]},$ (16)

where $A$, $B$ are parameters, and $t_{c}$ denotes the transition time.
Therefore, when $t\ll t_{c}$, the second term in the dominator of Eq.(16) is
suppressed exponentially, therefore we have $c_{s}^{2}\simeq 1/A$, which can
be viewed as the initial value of $c_{s}^{2}$. On the other hand, when $t\gg
t_{c}$, Eq.(16) as a whole is suppressed by the exponential term, giving rise
to $c_{s}^{2}\rightarrow 0$.

Making use of Eqs. (9), (14), (15) and (16), one can get the forms of
potential $V(\phi)$ and function $f(\phi)$ as

$\displaystyle V(\phi)$ $\displaystyle=$ $\displaystyle
V_{0}\exp\left[-\frac{\sqrt{3}M\kappa}{\sqrt{A}BC}\tanh^{-1}\sqrt{1+A^{-1}e^{B\left(\sqrt{2C}\phi/M-t_{c}/\kappa\right)}}\right],$
(17) $\displaystyle f(\phi)$ $\displaystyle=$ $\displaystyle
72C^{3}\gamma\left(\frac{\kappa}{V(\phi)M}\right)^{2/3}\left[A+e^{B\left(\sqrt{2C}\phi/M-t_{c}/\kappa\right)}\right]^{1/3},$
(18)

and an analytical solution:

$\displaystyle\phi(t)=\frac{1}{\sqrt{2C}}\frac{M}{\kappa}t.$ (19)

Here we also assume $\gamma$ is a constant.

In Fig. 2, we plot the evolution of $c_{s}^{2}$, $V(\phi)$ and $\epsilon$ in
our model. We choose the parameters as $A=1$, $B=4$, $C=1250$,
${t}_{c}=10M_{pl}^{-1}$, $M=10^{-1}M_{pl}$, $V_{0}=1\times
10^{-11}M_{pl}^{4}$. The plot shows a sudden decrease of $c_{s}$ and
$\epsilon$ at the middle stage of inflation, and such decrease is
simultaneous, as can be seen from Eq. (15). Therefore in our model actually
both $c_{s}$ and $\epsilon$ will contribute to the increase in the power
spectrum. This is different from the discussions in Ballesteros  _et al._
(2022); Gorji  _et al._ (2022); Zhai  _et al._ (2022).

As a side remark, let us mention that it is hard to get the simple
mathematical forms of potential and functions simultaneously due to the
nonlinear term in the action. However, the most important is the above
calculation results show a steplike sound speed, which can generate PBHs as we
want. Meanwhile, although the concise form of sound speed leads to a complex
mathematical form of the potential, it can be seen from Fig. 2 that the
potential is a flat potential; in this sense, the potential form is simple and
natural. It makes sense to optimize the model by finding a more concise
mathematical expression for each function in the model, and this will be a
step for future research.

Figure 2: The evolutions of sound speed $c_{s}^{2}$, potential $V(\phi)$ and
slow-roll parameter $\epsilon$ during inflation, whose analytical expressions
are given by Eqs. (16), (17) and (18), respectively. The related parameters
are chosen as $A=1$, $B=4$, $C=1250$, ${t}_{c}=10M_{pl}^{-1}$,
$M=10^{-1}M_{pl}$, $V_{0}=1\times 10^{-11}M_{pl}^{4}$.

##  IV The evolution of the perturbations

In this section, we will calculate the analytical solution of Eq. (10) based
on the relationship between $k$ and $k_{c}$. In order to solve Eq. (10), we
assume the $c_{s}$, $\epsilon$, $x_{\beta}$ and $y$ do not change
significantly in both the $k<k_{c}$ and the $k>k_{c}$ region, and we find
analytical solutions for each region. Furthermore, we match the solutions in
the two regions by making use of an appropriate matching condition.

Let us first consider the $k<k_{c}$ region, where the $k^{2}$ term dominates
over the $k^{4}$ term in the dispersion relation (12). Then Eq. (10) reduces
to

$\displaystyle
u^{(-)\prime\prime}_{k}+\left(c_{s}^{2}k^{2}-\frac{2}{\tau^{2}}\right)u^{(-)}_{k}=0~{}.$
(20)

where $(-)$ denotes the variables in the $k<k_{c}$ region. Imposing the Bunch-
Davies initial condition, we find the positive frequency solution for Eq. (20)
as

$\displaystyle
u^{(-)}_{k}=e^{i\pi}\frac{\sqrt{-\pi\tau}}{2}H_{3/2}^{(1)}(-c_{s}k\tau).$ (21)

We can obtain the power spectrum expression as follows

$\displaystyle
P^{(-)}_{S}=\frac{k^{3}}{2\pi^{2}}\left|\zeta^{(-)}\right|^{2}=\frac{H^{2}\mathcal{D}}{24\pi^{2}c_{s}^{3}x_{\beta}}.$
(22)

Meanwhile, in the $k>k_{c}$ region where the $k^{4}$ term dominates over the
$k^{2}$ term in (12), Eq. (10) reduces to

$\displaystyle
u^{(+)\prime\prime}_{k}+\left(\frac{8}{3}x_{\beta}^{3}yk^{4}\tau^{2}-\frac{2}{\tau^{2}}\right)u^{(+)}_{k}=0,$
(23)

where $(+)$ denotes the variables in the $k>k_{c}$ region. The most general
solution of Eq. (23) can be written as

$\displaystyle
u^{(+)}_{k}=\frac{\sqrt{-\pi\tau}}{2}\left[C_{1}H_{3/4}^{(1)}(\frac{1}{2}\sqrt{\gamma}k^{2}\tau^{2})+C_{2}H_{3/4}^{(2)}(\frac{1}{2}\sqrt{\gamma}k^{2}\tau^{2})\right],$
(24)

where $C_{1}$ and $C_{2}$ are constants.

Matching the two solutions (21) and (28) at the conformal time $\tau_{\ast}$
so as to make the solutions in $k>k_{c}$ and $k<k_{c}$ regions continuous at
the time point $\tau_{\ast}$ Gorji  _et al._ (2022), we can get

$\displaystyle C_{1}$
$\displaystyle=\frac{\pi}{4}\left[2y_{c}H_{3/2}^{(1)}(x_{c})H_{-1/4}^{(2)}(y_{c})-x_{c}H_{1/2}^{(1)}(x_{c})H_{3/4}^{(2)}(y_{c})\right],$
(25) $\displaystyle C_{2}$
$\displaystyle=-\frac{\pi}{4}\left[2y_{c}H_{3/2}^{(1)}(x_{c})H_{-1/4}^{(1)}(y_{c})-x_{c}H_{1/2}^{(1)}(x_{c})H_{3/4}^{(1)}(y_{c})\right],$
(26)

therefore

$\displaystyle\left|C_{1}-C_{2}\right|^{2}$
$\displaystyle=-\frac{\pi}{\sqrt{2}\left(-x_{c}\right)^{3}y_{c}^{3/2}}\left\\{4HF[-\frac{3}{4},-\frac{1}{4}y_{c}^{2}]\left(x_{c}\cos(-x_{c})+\sin(-x_{c})\right)\right.$
$\displaystyle\phantom{=\;\;}\left.+HF[\frac{1}{4},-\frac{1}{4}y_{c}^{2}]\left[3\left(x_{c}\cos(-x_{c})+\sin(-x_{c})\right)-x_{c}^{2}\sin(-x_{c})\right]\right\\}^{2}~{},$
(27)

where $HF$ is the hypergeometric function, and we defined $x_{c}=-c_{s}k\tau$,
$y_{c}=\frac{1}{2}\sqrt{\gamma}k^{2}\tau^{2}$.

For the fluctuation modes which exit the horizon at this stage, the power
spectrum is as follows:

$\displaystyle
P^{(+)}_{S}=\frac{H^{2}}{4\pi}\left(\frac{16}{\gamma}\right)^{3/4}\frac{\mathcal{D}}{3x_{\beta}}\left(\Gamma(3/4)\right)^{2}\left|C_{1}-C_{2}\right|^{2}.$
(28)

Since $x_{c}\gg 1$ in the $k^{4}$ phase, and we consider that
$HF[-\frac{3}{4},-\frac{1}{4}y_{c}^{2}]\simeq\Gamma(1/4)^{-1}$, then Eq. (IV)
can be reduced to

$\displaystyle\left|C_{1}-C_{2}\right|^{2}$
$\displaystyle\simeq\frac{\pi}{\sqrt{2}\left(x_{c}\right)^{3}y_{c}^{3/2}}\frac{x_{c}^{4}}{\Gamma(1/4)^{2}},$
(29)

at the transition point we can find

$\displaystyle
y_{c}=\frac{x_{c}^{2}}{c_{s,t}^{2}}\left(\frac{2}{3}x_{\beta}^{3}y\right)^{1/2},$
(30)

at the same time,we consider $y_{c}\simeq 1$. Then substituting this value
into Eq. (28), we find

$\displaystyle
P^{(+)}_{S}=\frac{16\pi^{2}c_{s}^{3}c_{s,t}}{\gamma}\left(\frac{\Gamma(\frac{3}{4})}{\Gamma(\frac{1}{4})}\right)^{2}P^{(-)}_{S}\left(k\to
0\right),$ (31)

where $P^{(-)}_{S}\left(k\to 0\right)\simeq 2\times 10^{-9}$ is the power
spectrum of fluctuation which exits the horizon before transition time
$\tau_{\ast}$, thus constrained by the CMB measurements Akrami  _et al._
(2020). $c_{s}$ is the sound speed in the $k^{2}$ phase before the sound speed
starts changing in time, $c_{s,t}$ is the sound speed at the transition point.
For enough formation of PBHs, one needs the power spectrum up to $10^{-2}$
Motohashi and Hu (2017), therefore $\gamma\simeq 10^{-6}$ is required. A more
precise numerical calculation shows that we have to assume $\gamma=10^{-7}$.
The above result is the same as Refs. Ballesteros  _et al._ (2022); Gorji  _et
al._ (2022).

In the Fig. 3, we show the relationship between power spectrum $P_{S}$ and the
wavenumber $k$. From the plot we can see that, for the small $k$ region where
$k<10\text{Mpc}^{-1}$, the fluctuations exit the horizon before the transition
time, therefore the power spectrum is not affected by the decrease of the
sound speed. Therefore, the amplitude of the power spectrum remains $\sim
10^{-9}$, consistent with the CMB observational data Akrami  _et al._ (2020).
For the large $k$ region, the fluctuations exit the horizon after the decrease
of sound speed, thus the amplitude of the power spectrum gets enhanced. The
peak of the spectrum at the point $k\simeq 10^{3}\text{Mpc}^{-1}$,
corresponding to the scale where PBHs are generated. For the very large $k$
region where $k>10^{3}\text{Mpc}^{-1}$, since the fluctuation modes are mainly
in the subhorizon region, the oscillation behavior is robust.

Figure 3: The plot of power spectrum in our model in terms of $k$. For
$k<10\text{Mpc}^{-1}$, the spectrum is flat and the amplitude fits with the
CMB observational data. For $10\text{Mpc}^{-1}<k<10^{3}\text{Mpc}^{-1}$, the
power spectrum increases with $k$ and reaches a peak at around $k\sim
10^{3}\text{Mpc}^{-1}$. For $k>10^{3}\text{Mpc}^{-1}$ where the fluctuation
modes go deep into the subhorizon, the spectrum exhibits oscillating behavior.

##  V The abundance of Primordial Black Holes

In this section, we consider the formation of the primordial black holes
(PBHs) and their abundance in our model. Generally, after the end of
inflation, our Universe will enter a radiation-dominated era, and the
perturbations will reenter the horizon. If the perturbations are still very
large, it will generate the primordial black hole by means of the
gravitational collapse of the local inhomogeneities. From Green and Liddle
(1997); Inomata  _et al._ (2017); Sasaki  _et al._ (2018), the mass of PBHs
formed during the radiation-dominated period can be described by the following
equation:

$\displaystyle M_{PBH}=\Upsilon M_{H}$
$\displaystyle=\Upsilon\frac{4\pi}{3}\rho_{form}H_{form}^{-3}$
$\displaystyle=10^{15}\times\left(\frac{\Upsilon}{0.2}\right)\left(\frac{g_{\star}}{106.75}\right)^{-1/6}\left(\frac{k_{form}}{0.07Mpc^{-1}}\right)^{-2}M_{\odot},$
(32)

where $g_{\star}$ is the total effective degree of freedom of the Universe,
and $\Upsilon\simeq 0.2$ is the efficiency factor; both are evaluated in the
radiation dominated era Sasaki  _et al._ (2018), and $M_{\odot}$ is the solar
mass. $k_{form}$ is the comoving number of the fluctuations which formed PBHs,
whose inverse denotes the scale of PBH formation. From the above expression we
can see that the mass of the primordial black hole is determined by
$k_{form}$.

From the analysis in the above section, $k_{form}\simeq 1.174\times
10^{3}\text{Mpc}^{-1}$. Compared to the wave number corresponding to solar-
mass PBHs which is $\sim 10^{5}\text{Mpc}^{-1}$, in our model the fluctuations
exit the horizon not far from the window opened for CMB observations, and will
reenter the horizon later than those of solar-mass. In this case, the PBHs
have the opportunity to accumulate utill they became very massive. From the
above equation we can get that, for our case with $k_{form}\sim{\cal
O}(10^{3})\text{Mpc}^{-1}$, the mass of PBH is around $M_{PBH}\sim
10^{6}-10^{7}M_{\odot}$. Such a massive PBH can also help explain the
generation of supermassive black holes, such as those with a mass of
$10^{10}M_{\odot}$ found by a redshift of $z\simeq 7$ Wu  _et al._ (2015);
Yang  _et al._ (2020); Carr  _et al._ (2021b); Yang  _et al._ (2021).

In order to evaluate how much primordial black holes can be generated and how
it can act as the dark matter, we usually define the fraction of primordial
black holes in dark matter namely,

$\displaystyle f_{PBH}$
$\displaystyle=\left.\beta(M_{PBH})\left(\frac{\rho_{tot}}{\rho_{DM}}\right)\right|_{form}$
$\displaystyle=1.68\times
10^{8}(\frac{\Upsilon}{0.2})^{1/2}(\frac{g_{\star}}{106.75})^{-1/4}(\frac{M_{PBH}}{M_{\odot}})^{-1/2}\beta(M_{PBH}).$
(33)

where

$\displaystyle\beta(M_{PBH})=\left.\frac{\rho_{PBH}}{\rho_{tot}}\right|_{form}$
(34)

is the fraction of the PBHs in the entire Universe. The last step of (V) comes
from some tedious but straightforward calculation Sasaki  _et al._ (2018);
Zheng  _et al._ (2021). On the other hand, according to the Press-Schechter
formalism Press and Schechter (1974); Green  _et al._ (2004), $\beta$ is given
by the probability that the fractional overdensity
$\delta\equiv\delta\rho/\rho$ is above a certain threshold $\delta_{c}$ for
PBH formation Mahbub (2020). Therefore for Gaussian primordial fluctuations,
$\beta$ is given by

$\displaystyle\beta(M_{PBH})$
$\displaystyle=2\int_{\delta_{c}}^{\infty}\exp\left(-\frac{\delta^{2}}{\sigma^{2}(M(k))}\right)\frac{d\delta}{\sqrt{2\pi}\sigma(M(k))}$
$\displaystyle=\sqrt{\frac{2}{\pi}}\frac{\sigma(M(k))}{\delta_{c}}\exp\left(-\frac{\delta_{c}^{2}}{\sigma^{2}(M(k))}\right),$
(35)

where $\delta_{c}$ is the threshold density. Here $\sigma^{2}(M(k))$
represents the standard deviation of the coarse-grained density contrast for
the PBHs mass of $M$ Young  _et al._ (2014):

$\displaystyle\sigma^{2}\left(M\left(k\right)\right)=\frac{16}{81}\int_{0}^{\infty}{d\ln
q}\left(\frac{q}{k}\right)^{4}W\left(\frac{q}{k}\right)^{2}P_{S}\left(q\right).$
(36)

Therefore it can be related to the primordial power spectrum at the horizon
reentering. In this work, we adopt the Gaussian window
$W(x)=\exp\left(-x^{2}/2\right)$. The result of the power spectrum is given by
Eq. (31) and, substituting it into the above formulas, one can get the
fraction of PBHs generated in our model.

In Fig. 4, we plot $f_{PBH}$ against the mass of PBHs, $M_{PBH}$, and confront
various constraints that are obtained from the publicly available Python code
$\bf PBH_{BOUNDS}$ Kavanagh (2019). The constraints contain Experience de
Recherche d’Objets Sombres (EROS) Tisserand  _et al._ (2007), Subaru Hyper
Suprime-Cam (Subaru-HSC) Niikura  _et al._ (2019a), Gravitational-Wave Lensing
Jung and Shin (2019), Optical Gravitational Lensing Experiment (OGLE) Niikura
_et al._ (2019b), cosmic microwave background (CMB) Serpico  _et al._ (2020),
femtolensing of Gamma-ray bursts (FL) Barnacka  _et al._ (2012), white dwarf
explosions (WD) Graham  _et al._ (2015), neutron stars (NSs) Capela  _et al._
(2013) (note that it has later been shown that the survival of stars actually
cannot constrain the PBHs, thus making the constraints even looser, see Katz
_et al._ (2018); Montero-Camacho  _et al._ (2019)), Leo-I dwarf galaxy Lu and
Wu (2019), NANOGrav Chen  _et al._ (2020); Wong  _et al._ (2021), LIGO/VIRGO
Kavanagh  _et al._ (2018), various cosmic large-scale structures $LSS_{s}$
Carr and Silk (2018) and so on. As demonstrated before, the mass range of the
PBHs formed in our model is around $10^{6}-10^{7}M_{\odot}$. Moreover, we find
that as the threshold density $\delta_{c}$ increases, the corresponding PBH
abundance will decrease. This is easy to understand: the higher the threshold
energy, the more difficult it is to form a black hole. The oscillating
behavior of the power spectrum can also lead to the generation of multimass
PBHs.

Figure 4: Colored peaks: the fraction of PBHs generated by our model against
the total amount of dark matter. The parameters are chosen to be the same as
before. The red peaks correspond to the threshold density $\delta_{c}=0.33$
which was initially obtained by Carr $\it etal$. using the relation
$\delta_{c}\simeq w$ in the radiation-dominated era Carr (1975), while the
blue peaks correspond to $\delta_{c}=0.40$, which was obtained after a refined
analytical and numerical calculation recently Harada  _et al._ (2013); Musco
(2019); Escrivà  _et al._ (2020, 2021); Musco  _et al._ (2021). The highest
peaks locates around $M/M_{\odot}\sim 10^{7}$, and reaches the value of
$f_{PBH}\simeq 10^{-7}$. Colored regions: the excluded regions by various
observations, which are obtained from the publicly available Python code $\bf
PBH_{BOINDS}$ Kavanagh (2019).

##  VI Scalar Induced Gravitational Waves

The large amount of the primordial scalar perturbations cannot only generate
primordial black holes via overdensity collapse, but also induce gravitational
waves in the radiation-dominated era Ananda  _et al._ (2007); Baumann  _et
al._ (2007). Such kinds of gravitational waves are effects of second order,
thus are usually neglected in large scales such as CMB scale, where the scalar
perturbation source are already constrained to be small. However, in small
scales, the scalar induced gravitational waves (SIGWs) may become large to be
detected, and thus become a probe to small scale physics as well. The energy
densities of SIGWs at present are related to their values after the horizon
reentry in the RD era as Pi and Sasaki (2020); Chen  _et al._ (2021)

$\displaystyle\Omega_{GW,0}(k)h^{2}=0.83\,\Omega_{RD,0}h^{2}\left(\frac{g_{c}}{10.75}\right)^{-\frac{1}{3}}\Omega_{GW}(k,\eta_{c})~{},$
(37)

where $\Omega_{RD,0}h^{2}\simeq 4.2\times 10^{-5}$ is the current radiation
density parameter and the $g_{c}\simeq 106.75$ is the effective degrees of
freedom in the energy density at $\eta_{c}$, at which $\Omega_{GW}$ stops
growing. The energy density of the GWs in the radiation-dominated era is Kohri
and Terada (2018); Cai  _et al._ (2019); Fu  _et al._ (2020); Lu  _et al._
(2019)

$\displaystyle\Omega_{GW}(k,\eta_{c})=\frac{1}{6}\int^{\infty}_{0}dv\int^{1+v}_{|1-v|}du\left[\frac{4v^{2}-(1-u^{2}+v^{2})}{4uv}\right]^{2}\overline{I_{RD}^{2}(u,v)}\mathcal{P}_{S}(kv)\mathcal{P}_{S}(ku),$
(38)

where the variables $u$ and $v$ are defined as
$u\equiv|\textbf{k}-\tilde{\textbf{k}}|/k$, $v\equiv\tilde{k}/k$, and the full
expression of $I_{RD}$ is given by

$\displaystyle\overline{I_{RD}^{2}(u,v)}=$
$\displaystyle\frac{9}{u^{2}v^{2}}\left(\frac{u^{2}+v^{2}-3}{2uv}\right)^{4}$
$\displaystyle\times\left[\left(\ln\left|\frac{3-(u+v)^{2}}{3-(u-v)^{2}}\right|-\frac{4uv}{u^{2}+v^{2}-3}\right)^{2}+\pi^{2}\Theta\left(u+v-\sqrt{3}\right)\right],$
(39)

$\Theta$ is the Heaviside theta function. Moreover, from the relationship of
the frequency of gravitational waves $f$ and the wave number $k$,

$\displaystyle f=1.546\times
10^{-15}\left(\frac{k}{\text{Mpc}^{-1}}\right)\text{Hz},$ (40)

Figure 5: Black line: the energy spectra of SIGWs in our model. The parameters
are chosen to be the same as before. Colored lines: the sensitivity curves of
the current and future GW projects, including EPTA, NANOGrav (gray region),
SKA, FAST, TianQin, LISA and Taiji.

we can easily have $f\simeq 10^{-12}$Hz for $k_{form}\simeq
10^{3}\text{Mpc}^{-1}$ in our model. In Fig. 5, we plot the SIGWs generated in
our model as well as the constraints from experiments such as EPTA Lentati
_et al._ (2015); Desvignes  _et al._ (2016), NANOGrav Arzoumanian  _et al._
(2020), SKA Janssen  _et al._ (2015), FAST Nan  _et al._ (2011), TianQin Luo
_et al._ (2016); Mei  _et al._ (2021), LISA Amaro-Seoane  _et al._ (2017), and
Taiji Hu and Wu (2017). We can see that the current observations cannot give
constraints to such a low frequency, however, since it is close to the
primordial gravitational waves generated by quantum fluctuations in CMB scale,
it is possible to have it detected in the upcoming CMB telescopes, such as
AliCPT Li  _et al._ (2019), or CMB-S4 Abazajian  _et al._ (2016)
collaborations.

##  VII Conclusions and Discussion

The generation of PBHs has attracted attentions from many people both in
theoretical physics and astronomy, and has been widely investigated in recent
years. To generate PBHs in the inflation era, one usually requires the
primordial scalar perturbations increase and form a peak in the small scales,
and this can be realized by the suppression of either the slow-roll parameter
$\epsilon$, or the sound speed $c_{s}$, or maybe both. However, in order to
decrease the sound speed, a modified dispersion relation of perturbations with
higher order terms is needed in order not to break the effective field theory
description of our Universe. A typical example of such a modification is to
add a quadratic correction term, namely $\omega^{2}=c_{s}^{2}k^{2}+\alpha
k^{4}$.

In this work, we consider a specific inflation model where a nonminimal
kinetic coupling term resides in the DBI-like square root in the action, which
makes the action nonlinear, giving rise to a $k^{4}$ term in the equation as
well as the dispersion relation of the scalar perturbation. Based on this
model, we consider the sound speed that can vary from the early to late time
during the inflation. While at the very beginning when $c_{s}\simeq 1$, the
$k^{2}$ term dominates the dispersion relation, at the late time $c_{s}$ drops
to a vanishing value, $k^{2}$ becomes negligible while the $k^{4}$ term
becomes dominant. We constructed the potential for this model according to the
sound speed. We calculated the evolution of perturbations during the whole
region, and obtained the final power spectrum in both CMB scale and PBH
formation scale. While in the CMB scale the spectrum is consistent with the
observational constraint, in the PBH formation scale it has a peak of
$10^{-2}$, which is sufficient to allow PBHs to form and act as the origin of
dark matter in the Universe.

Making use of the Press-Schechter formalism, we calculate the mass of the
generated PBHs $M_{PBH}$, as well as the fraction of PBHs against the total
amount of dark matter, $f_{PBH}$. We found that the scale of the PBH formation
is near to the CMB scale, which means that the PBHs in our model are formed
later than the usual solar-mass ones, and more massive, falling into the
category of supermassive black holes. The fraction of PBHs in our model is
consistent with constraints by various observations, from the gravitational
lensing to large scale structures. Moreover, we also investigated the scalar-
induced gravitational waves, and find that the frequency of the gravitational
waves is much lower than the current gravitational wave observations both
using interferometers and pulsars, but close to that of the primordial
gravitational waves generated from quantum fluctuations.

Some final remarks are in order. First of all, from the theoretical point of
view, we know that the PBH formation is a highly nonlinear process, which
might cause large non-Gaussianities and backreactions such as loop
corrections. It is still not clear whether these backreactions will affect (or
ruin) the PBH formation process investigated here. Although the constraints
from these effects are still not decisive yet (see recent discussions in
Kristiano and Yokoyama (2022)), we cannot say that it will not become a
smoking gun in the future. Second, as mentioned before, the PBHs generated in
our model are supermassive ones, different from the normal ones which have
asteroid, lunar or solar masses. This may also be interesting to the studies
in astrophysics, for it may be possible to explain the findings of
supermassive quasars in $z\simeq 7$ as well as the galaxy formations.
Moreover, the low frequency of scalar-induced gravitational waves may also
attract the attention of the next generation of CMB and primordial
gravitational wave detections. Making use of these detections, we may be able
to test the model by verifying whether there is such a low frequency SIGW or
not. We will extend these investigations in upcoming works.

###### Acknowledgements.

We are grateful to Jiaming Shi for useful discussions. This work is supported
by the National Key Research and Development Program of China under Grant NO.
2021YFC2203100, and the National Science Foundation of China under Grant No.
11875141.

## References

  * Zel’dovich and Novikov (1967) Y. B. Zel’dovich and I. D. Novikov, Soviet Astron. AJ (Engl. Transl. ), 10, 602 (1967).
  * Hawking (1971) S. Hawking, Mon. Not. Roy. Astron. Soc. 152, 75 (1971).
  * Carr and Hawking (1974) B. J. Carr and S. W. Hawking, Mon. Not. Roy. Astron. Soc. 168, 399 (1974).
  * Khlopov (2010) M. Y. Khlopov, Res. Astron. Astrophys. 10, 495 (2010), arXiv:0801.0116 [astro-ph] .
  * Belotsky  _et al._ (2014) K. M. Belotsky, A. D. Dmitriev, E. A. Esipova, V. A. Gani, A. V. Grobov, M. Y. Khlopov, A. A. Kirillov, S. G. Rubin, and I. V. Svadkovsky, Mod. Phys. Lett. A 29, 1440005 (2014), arXiv:1410.0203 [astro-ph.CO] .
  * Sasaki  _et al._ (2018) M. Sasaki, T. Suyama, T. Tanaka, and S. Yokoyama, Class. Quant. Grav. 35, 063001 (2018), arXiv:1801.05235 [astro-ph.CO] .
  * Belotsky  _et al._ (2019) K. M. Belotsky, V. I. Dokuchaev, Y. N. Eroshenko, E. A. Esipova, M. Y. Khlopov, L. A. Khromykh, A. A. Kirillov, V. V. Nikulin, S. G. Rubin, and I. V. Svadkovsky, Eur. Phys. J. C 79, 246 (2019), arXiv:1807.06590 [astro-ph.CO] .
  * Yuan and Huang (2021) C. Yuan and Q.-G. Huang, (2021), arXiv:2103.04739 [astro-ph.GA] .
  * Villanueva-Domingo  _et al._ (2021) P. Villanueva-Domingo, O. Mena, and S. Palomares-Ruiz, Front. Astron. Space Sci. 8, 87 (2021), arXiv:2103.12087 [astro-ph.CO] .
  * Escrivà  _et al._ (2022) A. Escrivà, F. Kuhnel, and Y. Tada, (2022), arXiv:2211.05767 [astro-ph.CO] .
  * Tisserand  _et al._ (2007) P. Tisserand _et al._ (EROS-2), Astron. Astrophys. 469, 387 (2007), arXiv:astro-ph/0607207 .
  * Niikura  _et al._ (2019a) H. Niikura _et al._ , Nature Astron. 3, 524 (2019a), arXiv:1701.02151 [astro-ph.CO] .
  * Jung and Shin (2019) S. Jung and C. S. Shin, Phys. Rev. Lett. 122, 041103 (2019), arXiv:1712.01396 [astro-ph.CO] .
  * Niikura  _et al._ (2019b) H. Niikura, M. Takada, S. Yokoyama, T. Sumi, and S. Masaki, Phys. Rev. D 99, 083503 (2019b), arXiv:1901.07120 [astro-ph.CO] .
  * Carr  _et al._ (2010) B. J. Carr, K. Kohri, Y. Sendouda, and J. Yokoyama, Phys. Rev. D 81, 104019 (2010), arXiv:0912.5297 [astro-ph.CO] .
  * Serpico  _et al._ (2020) P. D. Serpico, V. Poulin, D. Inman, and K. Kohri, Phys. Rev. Res. 2, 023204 (2020), arXiv:2002.10771 [astro-ph.CO] .
  * Acharya and Khatri (2020) S. K. Acharya and R. Khatri, JCAP 06, 018 (2020), arXiv:2002.00898 [astro-ph.CO] .
  * Barnacka  _et al._ (2012) A. Barnacka, J. F. Glicenstein, and R. Moderski, Phys. Rev. D 86, 043001 (2012), arXiv:1204.2056 [astro-ph.CO] .
  * Laha (2019) R. Laha, Phys. Rev. Lett. 123, 251101 (2019), arXiv:1906.09994 [astro-ph.HE] .
  * Dasgupta  _et al._ (2020) B. Dasgupta, R. Laha, and A. Ray, Phys. Rev. Lett. 125, 101101 (2020), arXiv:1912.01014 [hep-ph] .
  * Laha  _et al._ (2020) R. Laha, J. B. Muñoz, and T. R. Slatyer, Phys. Rev. D 101, 123514 (2020), arXiv:2004.00627 [astro-ph.CO] .
  * Cai  _et al._ (2021) R.-G. Cai, Y.-C. Ding, X.-Y. Yang, and Y.-F. Zhou, JCAP 03, 057 (2021), arXiv:2007.11804 [astro-ph.CO] .
  * Tan  _et al._ (2022) X.-H. Tan, Y.-J. Yan, T. Qiu, and J.-Q. Xia, Astrophys. J. Lett. 939, L15 (2022), arXiv:2209.15222 [astro-ph.CO] .
  * Graham  _et al._ (2015) P. W. Graham, S. Rajendran, and J. Varela, Phys. Rev. D 92, 063007 (2015), arXiv:1505.04444 [hep-ph] .
  * Capela  _et al._ (2013) F. Capela, M. Pshirkov, and P. Tinyakov, Phys. Rev. D 87, 123524 (2013), arXiv:1301.4984 [astro-ph.CO] .
  * Lu and Wu (2019) B.-Q. Lu and Y.-L. Wu, Phys. Rev. D 99, 123023 (2019), arXiv:1906.10463 [astro-ph.HE] .
  * Chen  _et al._ (2020) Z.-C. Chen, C. Yuan, and Q.-G. Huang, Phys. Rev. Lett. 124, 251101 (2020), arXiv:1910.12239 [astro-ph.CO] .
  * Wong  _et al._ (2021) K. W. K. Wong, G. Franciolini, V. De Luca, V. Baibhav, E. Berti, P. Pani, and A. Riotto, Phys. Rev. D 103, 023026 (2021), arXiv:2011.01865 [gr-qc] .
  * Kimura  _et al._ (2021) R. Kimura, T. Suyama, M. Yamaguchi, and Y.-L. Zhang, JCAP 04, 031 (2021), arXiv:2102.05280 [astro-ph.CO] .
  * Kavanagh  _et al._ (2018) B. J. Kavanagh, D. Gaggero, and G. Bertone, Phys. Rev. D 98, 023536 (2018), arXiv:1805.09034 [astro-ph.CO] .
  * Wang  _et al._ (2022) X. Wang, Y.-l. Zhang, R. Kimura, and M. Yamaguchi, (2022), arXiv:2209.12911 [astro-ph.CO] .
  * Carr and Silk (2018) B. Carr and J. Silk, Mon. Not. Roy. Astron. Soc. 478, 3756 (2018), arXiv:1801.00672 [astro-ph.CO] .
  * Carr  _et al._ (2021a) B. Carr, K. Kohri, Y. Sendouda, and J. Yokoyama, Rept. Prog. Phys. 84, 116902 (2021a), arXiv:2002.12778 [astro-ph.CO] .
  * Riotto (2003) A. Riotto, ICTP Lect. Notes Ser. 14, 317 (2003), arXiv:hep-ph/0210162 .
  * Motohashi and Hu (2017) H. Motohashi and W. Hu, Phys. Rev. D 96, 063503 (2017), arXiv:1706.06784 [astro-ph.CO] .
  * Akrami  _et al._ (2020) Y. Akrami _et al._ (Planck), Astron. Astrophys. 641, A10 (2020), arXiv:1807.06211 [astro-ph.CO] .
  * Cai  _et al._ (2020) R.-G. Cai, Z.-K. Guo, J. Liu, L. Liu, and X.-Y. Yang, JCAP 06, 013 (2020), arXiv:1912.10437 [astro-ph.CO] .
  * Ketov and Khlopov (2019) S. V. Ketov and M. Y. Khlopov, Symmetry 11, 511 (2019).
  * Drees and Erfani (2012) M. Drees and E. Erfani, JCAP 01, 035 (2012), arXiv:1110.6052 [astro-ph.CO] .
  * Garcia-Bellido and Ruiz Morales (2017) J. Garcia-Bellido and E. Ruiz Morales, Phys. Dark Univ. 18, 47 (2017), arXiv:1702.03901 [astro-ph.CO] .
  * Di and Gong (2018) H. Di and Y. Gong, JCAP 07, 007 (2018), arXiv:1707.09578 [astro-ph.CO] .
  * Gao and Guo (2018) T.-J. Gao and Z.-K. Guo, Phys. Rev. D 98, 063526 (2018), arXiv:1806.09320 [hep-ph] .
  * Cheng  _et al._ (2018) S.-L. Cheng, W. Lee, and K.-W. Ng, JCAP 07, 001 (2018), arXiv:1801.09050 [astro-ph.CO] .
  * Xu  _et al._ (2020) W.-T. Xu, J. Liu, T.-J. Gao, and Z.-K. Guo, Phys. Rev. D 101, 023505 (2020), arXiv:1907.05213 [astro-ph.CO] .
  * Lin  _et al._ (2020) J. Lin, Q. Gao, Y. Gong, Y. Lu, C. Zhang, and F. Zhang, Phys. Rev. D 101, 103515 (2020), arXiv:2001.05909 [gr-qc] .
  * Özsoy and Lalak (2021) O. Özsoy and Z. Lalak, JCAP 01, 040 (2021), arXiv:2008.07549 [astro-ph.CO] .
  * Kawai and Kim (2021a) S. Kawai and J. Kim, Phys. Rev. D 104, 083545 (2021a), arXiv:2108.01340 [astro-ph.CO] .
  * Kawai and Kim (2021b) S. Kawai and J. Kim, Phys. Rev. D 104, 043525 (2021b), arXiv:2105.04386 [hep-ph] .
  * Solbi and Karami (2021) M. Solbi and K. Karami, JCAP 08, 056 (2021), arXiv:2102.05651 [astro-ph.CO] .
  * Zheng  _et al._ (2021) R. Zheng, J. Shi, and T. Qiu,  (2021), 10.1088/1674-1137/ac42bd, arXiv:2106.04303 [astro-ph.CO] .
  * Gangopadhyay  _et al._ (2022) M. R. Gangopadhyay, J. C. Jain, D. Sharma, and Yogesh, Eur. Phys. J. C 82, 849 (2022), arXiv:2108.13839 [astro-ph.CO] .
  * Ashoorioon  _et al._ (2021a) A. Ashoorioon, A. Rostami, and J. T. Firouzjaee, Phys. Rev. D 103, 123512 (2021a), arXiv:2012.02817 [astro-ph.CO] .
  * Ashoorioon  _et al._ (2022) A. Ashoorioon, K. Rezazadeh, and A. Rostami, Phys. Lett. B 835, 137542 (2022), arXiv:2202.01131 [astro-ph.CO] .
  * Karam  _et al._ (2022) A. Karam, N. Koivunen, E. Tomberg, V. Vaskonen, and H. Veermäe, (2022), arXiv:2205.13540 [astro-ph.CO] .
  * Garcia-Bellido  _et al._ (1996) J. Garcia-Bellido, A. D. Linde, and D. Wands, Phys. Rev. D 54, 6040 (1996), arXiv:astro-ph/9605094 .
  * Bugaev and Klimai (2012) E. Bugaev and P. Klimai, Phys. Rev. D 85, 103504 (2012), arXiv:1112.5601 [astro-ph.CO] .
  * Clesse and García-Bellido (2015) S. Clesse and J. García-Bellido, Phys. Rev. D 92, 023524 (2015), arXiv:1501.07565 [astro-ph.CO] .
  * Kawasaki  _et al._ (2013) M. Kawasaki, N. Kitajima, and T. T. Yanagida, Phys. Rev. D 87, 063519 (2013), arXiv:1207.2550 [hep-ph] .
  * Ahmed  _et al._ (2022) W. Ahmed, M. Junaid, and U. Zubair, Nucl. Phys. B 984, 115968 (2022), arXiv:2109.14838 [astro-ph.CO] .
  * Kawai and Kim (2022) S. Kawai and J. Kim, (2022), arXiv:2209.15343 [astro-ph.CO] .
  * Cai  _et al._ (2018) Y.-F. Cai, X. Tong, D.-G. Wang, and S.-F. Yan, Phys. Rev. Lett. 121, 081306 (2018), arXiv:1805.03639 [astro-ph.CO] .
  * Chen and Cai (2019) C. Chen and Y.-F. Cai, JCAP 10, 068 (2019), arXiv:1908.03942 [astro-ph.CO] .
  * Lin and Ng (2013) C.-M. Lin and K.-W. Ng, Phys. Lett. B 718, 1181 (2013), arXiv:1206.1685 [hep-ph] .
  * Pi  _et al._ (2018) S. Pi, Y.-l. Zhang, Q.-G. Huang, and M. Sasaki, JCAP 05, 042 (2018), arXiv:1712.09896 [astro-ph.CO] .
  * Choudhury and Mazumdar (2014) S. Choudhury and A. Mazumdar, Phys. Lett. B 733, 270 (2014), arXiv:1307.5119 [astro-ph.CO] .
  * Fu  _et al._ (2019) C. Fu, P. Wu, and H. Yu, Phys. Rev. D 100, 063532 (2019), arXiv:1907.05042 [astro-ph.CO] .
  * Arya (2020) R. Arya, JCAP 09, 042 (2020), arXiv:1910.05238 [astro-ph.CO] .
  * Martin  _et al._ (2020a) J. Martin, T. Papanikolaou, and V. Vennin, JCAP 01, 024 (2020a), arXiv:1907.04236 [astro-ph.CO] .
  * Ashoorioon  _et al._ (2021b) A. Ashoorioon, A. Rostami, and J. T. Firouzjaee, JHEP 07, 087 (2021b), arXiv:1912.13326 [astro-ph.CO] .
  * Martin  _et al._ (2020b) J. Martin, T. Papanikolaou, L. Pinol, and V. Vennin, JCAP 05, 003 (2020b), arXiv:2002.01820 [astro-ph.CO] .
  * Choudhury  _et al._ (2023) S. Choudhury, M. R. Gangopadhyay, and M. Sami, (2023), arXiv:2301.10000 [astro-ph.CO] .
  * Ballesteros  _et al._ (2022) G. Ballesteros, S. Céspedes, and L. Santoni, JHEP 01, 074 (2022), arXiv:2109.00567 [hep-th] .
  * Gorji  _et al._ (2022) M. A. Gorji, H. Motohashi, and S. Mukohyama, JCAP 02, 030 (2022), arXiv:2110.10731 [hep-th] .
  * Zhai  _et al._ (2022) R. Zhai, H. Yu, and P. Wu, Phys. Rev. D 106, 023517 (2022), arXiv:2207.12745 [gr-qc] .
  * Ballesteros and Taoso (2018) G. Ballesteros and M. Taoso, Phys. Rev. D 97, 023501 (2018), arXiv:1709.05565 [hep-ph] .
  * Ballesteros  _et al._ (2019) G. Ballesteros, J. Beltran Jimenez, and M. Pieroni, JCAP 06, 016 (2019), arXiv:1811.03065 [astro-ph.CO] .
  * Qiu (2016) T. Qiu, Phys. Rev. D 93, 123515 (2016), arXiv:1512.02887 [hep-th] .
  * Ananda  _et al._ (2007) K. N. Ananda, C. Clarkson, and D. Wands, Phys. Rev. D 75, 123518 (2007), arXiv:gr-qc/0612013 .
  * Baumann  _et al._ (2007) D. Baumann, P. J. Steinhardt, K. Takahashi, and K. Ichiki, Phys. Rev. D 76, 084019 (2007), arXiv:hep-th/0703290 .
  * Saito and Yokoyama (2009) R. Saito and J. Yokoyama, Phys. Rev. Lett. 102, 161101 (2009), [Erratum: Phys.Rev.Lett. 107, 069901 (2011)], arXiv:0812.4339 [astro-ph] .
  * Saito and Yokoyama (2010) R. Saito and J. Yokoyama, Prog. Theor. Phys. 123, 867 (2010), [Erratum: Prog.Theor.Phys. 126, 351–352 (2011)], arXiv:0912.5317 [astro-ph.CO] .
  * Domènech (2021) G. Domènech, Universe 7, 398 (2021), arXiv:2109.01398 [gr-qc] .
  * Deffayet  _et al._ (2011) C. Deffayet, X. Gao, D. A. Steer, and G. Zahariade, Phys. Rev. D 84, 064039 (2011), arXiv:1103.3260 [hep-th] .
  * Kobayashi (2019) T. Kobayashi, Rept. Prog. Phys. 82, 086901 (2019), arXiv:1901.07183 [gr-qc] .
  * Polchinski (2007) J. Polchinski,  _String theory. Vol. 1: An introduction to the bosonic string_, Cambridge Monographs on Mathematical Physics (Cambridge University Press, 2007).
  * Gerasimov and Shatashvili (2000) A. A. Gerasimov and S. L. Shatashvili, JHEP 10, 034 (2000), arXiv:hep-th/0009103 .
  * Kutasov  _et al._ (2000a) D. Kutasov, M. Marino, and G. W. Moore, JHEP 10, 045 (2000a), arXiv:hep-th/0009148 .
  * Kutasov  _et al._ (2000b) D. Kutasov, M. Marino, and G. W. Moore, (2000b), arXiv:hep-th/0010108 .
  * Appleby  _et al._ (2012) S. A. Appleby, A. De Felice, and E. V. Linder, JCAP 10, 060 (2012), arXiv:1208.4163 [astro-ph.CO] .
  * Linder (2013) E. V. Linder, JCAP 12, 032 (2013), arXiv:1310.7597 [astro-ph.CO] .
  * Arkani-Hamed  _et al._ (2004) N. Arkani-Hamed, P. Creminelli, S. Mukohyama, and M. Zaldarriaga, JCAP 04, 001 (2004), arXiv:hep-th/0312100 .
  * Green and Liddle (1997) A. M. Green and A. R. Liddle, Phys. Rev. D 56, 6166 (1997), arXiv:astro-ph/9704251 .
  * Inomata  _et al._ (2017) K. Inomata, M. Kawasaki, K. Mukaida, Y. Tada, and T. T. Yanagida, Phys. Rev. D 96, 043504 (2017), arXiv:1701.02544 [astro-ph.CO] .
  * Wu  _et al._ (2015) X.-B. Wu, F. Wang, X. Fan, W. Yi, W. Zuo, F. Bian, L. Jiang, I. D. McGreer, R. Wang, J. Yang, Q. Yang, D. Thompson, and Y. Beletsky, Nature 518, 512 (2015).
  * Yang  _et al._ (2020) J. Yang, F. Wang, X. Fan, J. F. Hennawi, F. B. Davies, M. Yue, E. Banados, X.-B. Wu, B. Venemans, A. J. Barth, F. Bian, K. Boutsia, R. Decarli, E. P. Farina, R. Green, L. Jiang, J.-T. Li, C. Mazzucchelli, and F. Walter, The Astrophysical Journal 897, L14 (2020).
  * Carr  _et al._ (2021b) B. Carr, F. Kuhnel, and L. Visinelli, Mon. Not. Roy. Astron. Soc. 501, 2029 (2021b), arXiv:2008.08077 [astro-ph.CO] .
  * Yang  _et al._ (2021) J. Yang _et al._ , Astrophys. J. 923, 262 (2021), arXiv:2109.13942 [astro-ph.GA] .
  * Press and Schechter (1974) W. H. Press and P. Schechter, Astrophys. J. 187, 425 (1974).
  * Green  _et al._ (2004) A. M. Green, A. R. Liddle, K. A. Malik, and M. Sasaki, Phys. Rev. D 70, 041502 (2004), arXiv:astro-ph/0403181 .
  * Mahbub (2020) R. Mahbub, Phys. Rev. D 102, 023538 (2020), arXiv:2005.03618 [astro-ph.CO] .
  * Young  _et al._ (2014) S. Young, C. T. Byrnes, and M. Sasaki, JCAP 07, 045 (2014), arXiv:1405.7023 [gr-qc] .
  * Kavanagh (2019) B. J. Kavanagh, “bradkav/pbhbounds: Release version,”  (2019).
  * Katz  _et al._ (2018) A. Katz, J. Kopp, S. Sibiryakov, and W. Xue, JCAP 12, 005 (2018), arXiv:1807.11495 [astro-ph.CO] .
  * Montero-Camacho  _et al._ (2019) P. Montero-Camacho, X. Fang, G. Vasquez, M. Silva, and C. M. Hirata, JCAP 08, 031 (2019), arXiv:1906.05950 [astro-ph.CO] .
  * Carr (1975) B. J. Carr, Astrophys. J. 201, 1 (1975).
  * Harada  _et al._ (2013) T. Harada, C.-M. Yoo, and K. Kohri, Phys. Rev. D 88, 084051 (2013), [Erratum: Phys.Rev.D 89, 029903 (2014)], arXiv:1309.4201 [astro-ph.CO] .
  * Musco (2019) I. Musco, Phys. Rev. D 100, 123524 (2019), arXiv:1809.02127 [gr-qc] .
  * Escrivà  _et al._ (2020) A. Escrivà, C. Germani, and R. K. Sheth, Phys. Rev. D 101, 044022 (2020), arXiv:1907.13311 [gr-qc] .
  * Escrivà  _et al._ (2021) A. Escrivà, C. Germani, and R. K. Sheth, JCAP 01, 030 (2021), arXiv:2007.05564 [gr-qc] .
  * Musco  _et al._ (2021) I. Musco, V. De Luca, G. Franciolini, and A. Riotto, Phys. Rev. D 103, 063538 (2021), arXiv:2011.03014 [astro-ph.CO] .
  * Pi and Sasaki (2020) S. Pi and M. Sasaki, JCAP 09, 037 (2020), arXiv:2005.12306 [gr-qc] .
  * Chen  _et al._ (2021) P. Chen, S. Koh, and G. Tumurtushaa, (2021), arXiv:2107.08638 [gr-qc] .
  * Kohri and Terada (2018) K. Kohri and T. Terada, Phys. Rev. D 97, 123532 (2018), arXiv:1804.08577 [gr-qc] .
  * Cai  _et al._ (2019) R.-g. Cai, S. Pi, and M. Sasaki, Phys. Rev. Lett. 122, 201101 (2019), arXiv:1810.11000 [astro-ph.CO] .
  * Fu  _et al._ (2020) C. Fu, P. Wu, and H. Yu, Phys. Rev. D 101, 023529 (2020), arXiv:1912.05927 [astro-ph.CO] .
  * Lu  _et al._ (2019) Y. Lu, Y. Gong, Z. Yi, and F. Zhang, JCAP 12, 031 (2019), arXiv:1907.11896 [gr-qc] .
  * Lentati  _et al._ (2015) L. Lentati _et al._ , Mon. Not. Roy. Astron. Soc. 453, 2576 (2015), arXiv:1504.03692 [astro-ph.CO] .
  * Desvignes  _et al._ (2016) G. Desvignes _et al._ , Mon. Not. Roy. Astron. Soc. 458, 3341 (2016), arXiv:1602.08511 [astro-ph.HE] .
  * Arzoumanian  _et al._ (2020) Z. Arzoumanian _et al._ (NANOGrav), Astrophys. J. Lett. 905, L34 (2020), arXiv:2009.04496 [astro-ph.HE] .
  * Janssen  _et al._ (2015) G. Janssen _et al._ , PoS AASKA14, 037 (2015), arXiv:1501.00127 [astro-ph.IM] .
  * Nan  _et al._ (2011) R. Nan, D. Li, C. Jin, Q. Wang, L. Zhu, W. Zhu, H. Zhang, Y. Yue, and L. Qian, Int. J. Mod. Phys. D 20, 989 (2011), arXiv:1105.3794 [astro-ph.IM] .
  * Luo  _et al._ (2016) J. Luo _et al._ (TianQin), Class. Quant. Grav. 33, 035010 (2016), arXiv:1512.02076 [astro-ph.IM] .
  * Mei  _et al._ (2021) J. Mei _et al._ (TianQin), PTEP 2021, 05A107 (2021), arXiv:2008.10332 [gr-qc] .
  * Amaro-Seoane  _et al._ (2017) P. Amaro-Seoane _et al._ (LISA), (2017), arXiv:1702.00786 [astro-ph.IM] .
  * Hu and Wu (2017) W.-R. Hu and Y.-L. Wu, Natl. Sci. Rev. 4, 685 (2017).
  * Li  _et al._ (2019) H. Li _et al._ , Natl. Sci. Rev. 6, 145 (2019), arXiv:1710.03047 [astro-ph.CO] .
  * Abazajian  _et al._ (2016) K. N. Abazajian _et al._ (CMB-S4), (2016), arXiv:1610.02743 [astro-ph.CO] .
  * Kristiano and Yokoyama (2022) J. Kristiano and J. Yokoyama, (2022), arXiv:2211.03395 [hep-th] .


# Genshin: General Shield for Natural Language Processing with Large Language
Models

Xiao Peng, Tao Liu, Ying Wang
Institute of Prospective Technology Research, Changan Automobile
<EMAIL_ADDRESS>

###### Abstract

Large language models (LLMs) like ChatGPT, Gemini, or LLaMA have been trending
recently, demonstrating considerable advancement and generalizability power in
countless domains. However, LLMs create an even bigger black box exacerbating
opacity, with interpretability limited to few approaches. The uncertainty and
opacity embedded in LLMs’ nature restrict their application in high-stakes
domains like financial fraud, phishing, etc. Current approaches mainly rely on
traditional textual classification with posterior interpretable algorithms,
suffering from attackers who may create versatile adversarial samples to break
the system’s defense, forcing users to make trade-offs between efficiency and
robustness. To address this issue, we propose a novel cascading framework
called Genshin (General Shield for Natural Language Processing with Large
Language Models), utilizing LLMs as defensive one-time plug-ins. Unlike most
applications of LLMs that try to transform text into something new or
structural, Genshin uses LLMs to recover text to its original state. Genshin
aims to combine the generalizability of the LLM, the discrimination of the
median model, and the interpretability of the simple model. Our experiments on
the task of sentimental analysis and spam detection have shown fatal flaws of
the current median models and exhilarating results on LLMs’ recovery ability,
demonstrating that Genshin is both effective and efficient. In our ablation
study, we unearth several intriguing observations. Utilizing the LLM defender,
a tool derived from the 4th paradigm, we have reproduced BERT’s 15% optimal
mask rate results in the 3rd paradigm of NLP. Additionally, when employing the
LLM as a potential adversarial tool, attackers are capable of executing
effective attacks that are nearly semantically lossless. We conduct detailed
case analyses using the SHAP interpreter, which could yield insights for
systemic enhancements. Lastly, we provide discussions on the architecture of
Genshin, underscoring the necessity of each component and outlining the
current limitations.

##  1 Introduction

Masked language modeling (MLM) proposed in BERT [6], which is inspired by the
”Cloze” test, reveals the phenomenon of redundancy in natural languages.
Although recently the new paradigm of the GPT series developed by OpenAI has
made significant progress than the MLM paradigm, the nature of MLM’s
representative mechanism remains valuable.

Figure 1: Exemplary demonstration of Genshin recovering deliberately altered
spam texts and providing classifications and interpretations afterwards.

For example, ”password”, ”pa*skey” and ”$\rho$ass$\omega$Ord” can convey the
same concept of ”a key to someone’s account” to human receivers, but the
latter ones are much more difficult for classical pattern-matching machines to
identify. This redundancy keeps certain symmetrical invariance in the language
space, where a small degree of disturbance on the original text can keep the
corresponding meaning of the text intact. The malicious attackers may utilize
this to change the sentence’s appearance while keeping it human-readable, so
that the sentence in disguise may get through security checks of the
traditional language model, which mainly relies on rule-based regular
expressions at present.

Until recently, LLMs have shown salient potential in symmetry-persistent
textual transformation and manipulation, compared with their weakness in
logistical inference. This is understandable due to LLMs’ natural essence,
which generates the most fluent tokens rather than executes solid causal
inference. Besides, LMs have shown great discrimination abilities with
efficiency on downstream tasks. Finally, IMs provide explanations of the
mechanisms inside the black box of the corresponding model. We present an
exemplary demonstration of Genshin in Fig. 1.

Due to the intrinsic symmetry of LLMs, there is another potential threat. In
the future, attackers may also leverage LLMs not as a shield but as a spear.
This kind of attack can be entirely invisible to pattern-matching machines.
The race between defenders and attackers leads to infinity, demonstrating the
necessity of Genshin.

Our goal is to alleviate the deficiency of current LLMs, by combining the
power of median-sized language models (LMs) and interpretable models (IMs).
When our framework receives any new textual information, it first calls an LLM
to recover it to its original state, if it has been injected with toxic
tokens. Then the recovered text is sent to an LM to make accurate predictions.
If requested, an IM will be operated to explain the predictions of the LM,
providing solid insights and interpretations.

Our main contributions are as follows:

  * •

A novel framework called Genshin is proposed to provide a general shield for
all kinds of adversarial textual attacks. This shield is also capable of
becoming a spear in the future.

  * •

To the best of our knowledge, this is the first attempt to use LLMs as
symmetrical recovery one-time plug-ins, aiming to transform the content to its
natural status without meaningful information losses.

  * •

We also leverage LMs and IMs to achieve both efficiency and explainability
which current LLMs lack. We visualize our interpreting results to provide
insight and enlightening.

##  2 Related Works

###  2.1 Language Models

There are 4 paradigm shifts for language models. In the early days,
statistical models based on the Markov assumption [1] dominated the region of
NLP, predicting the next state with the nearest former state [32]. The essence
of the Markov assumption is compressible information, where history can be
concentrated into constant storage. Second, distributed representations like
word2vec [14, 15] start to mine the hidden features of the textual corpus,
introducing the idea of vectorization into NLP territory. Third, pre-trained
language models (PTMs) like BERT and GPT-1/2/3 [19, 20, 5] significantly boost
the growth of NLP applications, by separating the training stage and fine-
tuning stage. Finally, large language models such as ChatGPT [17], LLAMA [26],
Claude-3 [3], and GPT-4 [2] have emerged with novel abilities that can solve
real-world tasks with versatile prompts.

LLMs’ zero-shot abilities [10] also pave the way for prompt engineering [12],
optimizing the deficiency of LLMs. For instance, few-shot prompting [5] and
instructions help LLMs form structural output. Retrieval-augmented Generation
(RAG) [11] helps LLMs acquire knowledge and minimize hallucination. Chain-of-
thought (CoT) [28] and intelligent agents [18, 25, 29] help LLMs cultivate
rational minds and stabilize the reasoning process.

###  2.2 Textual Adversarial Attacks

Adversarial attacks make LMs vulnerable by creating different kinds of
adversarial samples[27, 4, 24]. Textual adversarial attacks can be operated on
3 levels: char-level, word-level, and sentence-level. All textual attacks can
be described as some versions of insertion, replacement, or deletion.
OpenAttack [31] proposes an open-source textual adversarial attack toolkit,
implemented with lots of existing attacking methods. There are also studies
for adversarial attacks on LLMs [22, 30]. The most well-known adversarial
attack is the ”magic” prompt, instructing the LLM to forget all safety
measures and play a user-specified role to produce harmful content.

###  2.3 Interpretable Machine Learning

Interpretable Machine Learning consists of interpretability and explainability
[16]. Interpretability means a ”white box”, where the model’s inner mechanism
is transparent and understandable to users. There are few classical
interpretable models such as the Generalized Additive Model, Decision Tree,
Naive Bayes, K-NN, etc [8]. But when it comes to neural networks,
interpretability withers away when the net scales exponentially according to
the scaling law [9].

Explainability aims to provide insight from opaque models, especially neural
networks. Model-agnostic methods like LIME [21] and SHAP [13] explain
classification results by highlighting the importance of different input
elements. Instance-based methods explain results by locating the more relevant
training sample with crafted influence functions [7]. There are also
specialized methods only for interpreting language models [23]. Attention-
based methods aggregate and visualize the attention score toward token
importance. Probing explains each layer of neural networks by applying
different downstream tasks. Explanation generation explains smaller models
with an LLM.

##  3 Methodology

The textual world is filled with natural or intended noises, where humans
might encounter typographical errors or indirectly express their concepts. The
LM often fails in these infinite heavy-tailed scenarios causing OOD (Out-of-
domain) tokenization problems, leading to an inevitable trade-off between
robustness and effectiveness. The LLM has seen them all, on the other hand, it
becomes the perfect tool to recover risky information into safe information,
making sure that the LM doesn’t require strong robustness to perform well.

Figure 2: The workflow of the Genshin framework

###  3.1 Framework

Our Genshin framework’s workflow operates as follows, shown in Figure. 2,
including three stages: (a) denoising stage (LLM): the LLM defender first acts
as a one-time recovery tool to denoise the text, from risky information to
recovered information; (b) analyzing stage (LM): the LM analyzer can then
easily execute information analysis on the recovered information, including
tasks like classification, regression, etc; (c) interpreting stage (IM): the
IM interpreter precisely explains the LM’s outputs.

###  3.2 Attacking Strategies

We designed 3 kinds of attacks that might bypass the current system: char-
level disturbance, word-level disturbance, and similarity-based disturbance.

  * •

Char-level disturbance (Char Attacker): we randomly disturb each minimal-sized
token (characters) in the sentence, with a probability of $\alpha$
(disturbance ratio). This is effective due to redundancy in natural languages.

  * •

Word-level disturbance (Word Attacker): this is similar to char-level
disturbance, except happening on words as tokens.

  * •

Similarity-based disturbance (LLM Attacker): we prompt LLMs to disturb some
words using their synonyms or similar-shaped tokens. In this way, we can
provide safety even if the attackers are implementing their attacks through
LLMs as well.

For simplicity, the disturbance of characters and words is implemented by
random replacement in the following experiments.

###  3.3 Prompt Design

We design our attacker and defender prompts with 4 components: task
description, demonstration, input, and structural output control. The task
description part describes the purpose of the task, like ”try to recover the
following text to its original state”. The demonstration part provides
examples of detailed situations, like ”there could be adding, deleting,
swapping or replacing characters/words”. The input part is parameterized as
”¡¡text¿¿” ready to be replaced by any new instance in real-time. The
structural output control part is crucial, making sure the LLM’s output is
JSON-parsable, like ”output your recovered output text as JSON format”.

###  3.4 Interpreter

We use SHAP as the interpreter to evaluate token importance in this work. SHAP
represents the $i$-th token importance $\varphi_{i}(f)$ for model $f$ based on
Sharpley values, as shown in Eq. 1, where $N$ is the universal set and $S$
stands for all potential combinatorial subsets excluding the $i$-th token. The
Sharpley value is calculated as the mathematical expectation of the marginal
profit on all combinatorial conditions.

$\displaystyle\varphi_{i}(f)$ $\displaystyle=\sum_{S\subseteq
N\backslash\\{i\\}}\frac{|S|!(N-|S|-1)!}{N!}[\;f(S\cup\\{i\\})-f(S)\;]$ (1)

##  4 Experiment

In this part, we want to demonstrate the power of LLMs’ recovery ability, by
attacking the original textual dataset and recovering it later. We measure the
targeted LM’s accuracy on textual datasets for each state: original state,
attacked state, and recovered state.

###  4.1 Settings

##### Datasets.

As illustrated in Tab. 1, we execute our experiments on 2 tasks: sentimental
analysis and spam detection. We select 3 datasets from HuggingFace, including
stanfordnlp/sst2 (short as ”sst2” in the following content), dair-ai/emotion
(short as ”emotion”), and Deysi/spam-detection-dataset (short as ”spam-
detection”).

##### Models.

For each task, we select a corresponding pre-trained LM from HuggingFace,
including textattack/bert-base-uncased-SST-2 (short as ”bert-base-*”) and
mariagrandury/roberta-base-finetuned-sms-spam-detection (short as ”roberta-
base-*”). We use GPT-3.5 as the LLM defender’s backbone model.

Table 1: Summary of tasks, datasets, and models used in our experiment Task | Dataset | Model
---|---|---
Sentiment Analysis | stanfordnlp/sst2 | bert-base-*
dair-ai/emotion
Spam Detection | Deysi/spam-detection-dataset | roberta-base-*

###  4.2 Results

The experimental results are shown in Tab. 2 and Tab. 3. To ensure efficiency,
we set a maximum attacking time of 128 for attackers, exceeding that will be
considered a failure attack.

Table 2: Results of adversarial attack strategies and recovery experiments on sentiment analysis and spam detection (disturbance ratio: 0.15). OAcc: original accuracy (the initial statistical performance for the model on the dataset); AAcc: attacked accuracy (performance after the dataset was attacked); RAcc: recovered accuracy (performance after the dataset was recovered by LLM); RRatio: recovery ratio (RRatio = (RAcc-AAcc)/(OAcc-AAcc)). MAT: median attacking time (how many times the attacker takes to try to make a successful attack). Attacker | Model | Dataset | OAcc | AAcc | RAcc | RRatio | MAT
---|---|---|---|---|---|---|---
char | bert-base-* | sst2 | 0.9766 | 0.1484 | 0.9258 | 0.9387 | 5.0
emotion | 0.7734 | 0.1367 | 0.7188 | 0.9141 | 4.0
roberta-base-* | spam-detection | 0.8789 | 0.3477 | 0.8750 | 0.9926 | 8.5
word | bert-base-* | sst2 | 0.9766 | 0.1836 | 0.5039 | 0.4039 | 30.0
emotion | 0.7734 | 0.1680 | 0.5117 | 0.5677 | 10.5
roberta-base-* | spam-detection | 0.8789 | 0.6211 | 0.7969 | 0.6818 | 128.0
LLM | bert-base-* | sst2 | 0.9766 | 0.1992 | 0.9336 | 0.9447 | 5.0
emotion | 0.7734 | 0.2070 | 0.7188 | 0.9034 | 3.0
roberta-base-* | spam-detection | 0.8789 | 0.0820 | 0.8750 | 0.9951 | 5.0
Average | 0.8158 |

In Tab. 2, the disturbance ratio for char and word attack is set to 0.15 by
default. For each original dataset, we sample and construct a subset for
experiments consisting of 256 textual instances with text lengths ranging from
50 to 150 characters. We also keep the equilibrium between classes as 128
instances for each class in both classification tasks.

The results show that, on average, 81.6% of successful textual attacks can be
shielded by the LLM defender. For some special cases like the LLM attacker on
the spam-detection dataset, the recovery ratio can be up to 99.5% (nearly
perfect).

Different attackers’ attacking efficiency varies. MAT (median attacking time)
represents the median times the attacker needs to disturb each input text to
change the model’s output for the whole sampled dataset. MAT for the LLM
attacker is the lowest, showing that LLM as an attacker also prevails over
classical methods. The word attacker fails frequently and possesses a low
RRatio, implying its ineffectiveness in designing for attacking. The high
attacking failure rate on the spam-detection dataset implies that the spam
features are far more distributed in the context than sentimental features.
The LLM attacker has been revealed with its potential for such difficult
tasks.

Table 3: Results of adversarial attack strategies and recovery experiments on sentiment analysis and spam detection (disturbance ratio: 0.3).  Attacker | Model | Dataset | OAcc | AAcc | RAcc | RRatio | MAT
---|---|---|---|---|---|---|---
char | bert-base-* | sst2 | 0.9766 | 0.1953 | 0.7500 | 0.7100 | 2.0
emotion | 0.7734 | 0.1133 | 0.6680 | 0.8402 | 2.0
roberta-base-* | spam-detection | 0.8789 | 0.4453 | 0.8086 | 0.8378 | 2.0
word | bert-base-* | sst2 | 0.9766 | 0.0156 | 0.4219 | 0.4228 | 6.0
emotion | 0.7734 | 0.0078 | 0.3438 | 0.4388 | 3.0
roberta-base-* | spam-detection | 0.8789 | 0.3633 | 0.5938 | 0.4470 | 28.5
Average | 0.6161 |

In Tab. 3, we set a larger disturbance ratio of 0.3. The results show that the
attacking success rate increases (the median attacking time is lower as well),
while the recovery ability of the LLM defender decreases because of more
information losses. For attackers, this is an inevitable trade-off between
attacking efficiency and transmission credibility. It is worth pointing out
that the LLM attacker is disturbance-ratio-free due to a lack of
controllability from our practical observations, thus we don’t reproduce this
setting in Tab. 3.

##  5 Ablation Study

###  5.1 Disturbance Ratios, Attackers, and Datasets

####  5.1.1 Settings

To further evaluate recovery ability on different disturbance ratios,
attackers, and datasets, we execute our ablation study on three settings: (1)
a generated dataset attacked by the char attacker; (2) a standard dataset
attacked by the char attacker; (3) a standard dataset attacked by the LLM
attacker.

The generated dataset is created by assembling random words into 500 sentences
with specific lengths ($\leq$ 100 characters). The standard dataset is sampled
from the emotion dataset with 500 sentences with lengths ranging from 50 to
100 characters. We split 500 samples into 5 groups and execute our experiment
on each group independently to gather statistical standard deviations.

We utilize the editing distance ratio (EDR), shown in Eq. 2, to calculate the
distance between two sentences. EDR is designed to be a normalized Levenshtein
distance ranging in $[0,1]$.

$\text{EDR}(a,b)=\frac{\text{editing\\_distance}(a,b)}{\max(|a|,|b|)}$ (2)

As shown in Eq. 3 and Eq. 4, We further define the average disturbance
distance (ADD) as the expectation of all EDRs from each textual pair between
the original and attacked dataset, and the average recovery distance (ARD) as
the expectation of all EDRs from each textual pair between the original and
recovered dataset. $N$ is the dataset size, and $o_{i}$, $a_{i}$, $r_{i}$
represents the $i$-th original, attacked and recovered text accordingly.

$\text{ADD}=\frac{1}{N}\sum_{i=1}^{N}\text{EDR}(o_{i},a_{i})$ (3)
$\text{ARD}=\frac{1}{N}\sum_{i=1}^{N}\text{EDR}(o_{i},r_{i})$ (4)

The LLM attacker lacks controllability, thus we first make random disturbances
with the LLM attacker, calculate their EDR with the original text, and
categorize them into the nearest disturbance ratio accordingly. Each ratio
category is set to include no more than 500 samples.

####  5.1.2 Results

The results are shown in Fig. 3. The shadowed areas represent corresponding
standard deviations. Note that for the char attacker, ADD is slightly lower
than the corresponding disturbance ratio because we have designed the char
attacker to skip spaces and punctuations.

Figure 3: The ablation study results on different disturbance ratios,
attackers, and datasets

First, for the generated dataset, the absence of contextual structures in the
generated sentences makes the LLM defender nearly impossible to recover
anything. Instead, recovering attempts may even introduce excessive noises
when the disturbance ratio is $\geq 0.3$. ARD calculated after the LLM
defender recovered the attacked dataset, has made no evidential improvements,

Second, for the standard dataset attacked by the char attacker. With a
moderate disturbance ratio ranging in $[0.05,0.35]$, the LLM defender can
successfully make restorations for the attacked dataset. Specifically, at the
$0.15$ ratio, the LLM defender can recover the highest distance while having
the lowest standard deviation. This is consistent with the $15\%$ optimal mask
rate conclusion from the mask language modeling (MLM) task in BERT’s training.

Furthermore, the ARD curve of the LLM attacker is substantially lower than the
char attacker on the standard dataset, which means the LLM attacker has kept
most of the semantical information after the disturbance. To conclude, by
carefully crafting textual language, we can get a whole new appearance of
sentences with minimal information losses, which could overthrow all previous
pattern-matching machines. More importantly, this can be done automatically by
large language models.

###  5.2 Prompt Engineering Techniques

Designing moderate prompts is crucial for downstream task performance. We
execute our ablation study on 4 cases: (1) bare prompt: a normal prompt
template describes the defensive task; (2) few-shot: the template is provided
with a few attacked and recovered examples; (3) JSON parser: the template is
instructed to output as parsable JSON format; (4) full prompt: the complete
template with few-shot and JSON parser. The dataset is constructed in the same
way as our main experiment, with 512 samples from each original dataset
ranging in $[50,150]$ characters. The char attacker is set with a disturbance
ratio of $0.15$.

Table 4: The ablation study results on different prompt engineering techniques techniques | Dataset
---|---
sst2 | emotion | spam-detection
RRatio | ARD | RRatio | ARD | RRatio | ARD
bare prompt | 0.7644 | 0.2127 | 0.9244 | 0.1087 | 0.9701 | 0.0903
few-shot | 0.8702 | 0.1298 | 0.9593 | 0.1024 | 0.9627 | 0.0847
JSON parser | 0.8846 | 0.0882 | 0.9651 | 0.0686 | 1.0075 | 0.0560
full prompt | 0.8606 | 0.0836 | 0.9477 | 0.0644 | 0.9851 | 0.0552

Results are shown in Tab. 4. The few-shot prompting makes improvement more
significant when the original RRatio is low, and JSON parser prompting keeps
consistency at all conditions. ARD, on the other hand, is improved for all
datasets when more prompting techniques are involved, which indicates the LLM
defender can recover raw information more accurately with full prompting
technical support.

##  6 Case Study

In this part, we implement interpretable algorithms and demonstrate how
Genshin can help with a better understanding of the attacking mechanism in
detailed cases.

Our exemplary visual interpreting results on 4 cases are shown in Fig. 4. The
first 2 cases are from the emotion dataset, and the last 2 cases are from the
spam-detection dataset. For each case, we demonstrate 3 rows with the
original, attacked, and recovered text. All attacks are executed by the char
attacker. For each row, the rectangle bar on the left visualizes the model’s
probability output. The blue color represents the label ”POSITIVE” or ”HAM”,
and the orange color represents the label ”NEGATIVE” or ”SPAM”. The opacity of
the background color is linearly related to the token importance value derived
from SHAP.

For example, in the 2nd case, the word ”pretty” and ”restless” is attacked,
becoming ”pr@tty” and ”restle$s”. The model is successfully fooled by the
attacker making its judgment by ”feeling … right”. In the 3rd case, the
original text is almost completely unrecognizable to humans, and the LLM
defender recovered it perfectly. These interpreting results can provide
insight into bad case refinement and further improvement guidance for the
task.

Figure 4: Our interpreting results with the char attacker.

In our main experiments, the LLM attacker works much better on the spam-
detection dataset compared with other attackers. We demonstrate 2 cases in
Fig. 5 attacked by the LLM attacker. All other settings remain consistent. As
presented, the attack results by the LLM attacker are more human-readable
because of the elaborate usage of similar-shaped tokens.

Figure 5: Our interpreting results with the LLM attacker.

##  7 Discussion

###  7.1 Enhancing Robustness through Large Language Models

The augmentation of our framework, Genshin, with Large Language Models (LLMs)
is driven by the requirements for improved robustness, which traditional
models like BERT fail to offer due to their reliance on tokenization. Textual
attacks can easily disrupt these tokenizers, leading to ineffective content
moderation. LLMs enhance robustness comprehensively, mitigating the impacts of
such adversarial attacks. Additionally, incorporating LLMs as a one-time
plugin allows the median-sized Language Models (LMs) in our system to focus on
maximizing accuracy and performance in content analysis and classification
tasks.

Let’s ponder this: ”What if the attackers also leverage an LLM to create
adversarial samples?” In such cases, a system without an LLM shield layer will
be defenseless.

###  7.2 The Necessity of Interpretable Models

In Genshin, the integration of Interpretable Models (IMs) addresses the
opaqueness of traditional machine learning outputs. Traditional models often
struggle to provide insights into the exact location and nature of issues in
detected sensitive or problematic text. Our IMs not only identify such text
but also highlight specific segments for further review, significantly aiding
content moderators. This increases the transparency and trustworthiness of the
model’s outputs, leading to more efficient and precise content moderation.

###  7.3 The Role of Median-sized Language Models as an Intermediate Layer

In the architecture of Genshin, LMs serve as an intermediate layer, rather
than directly applying LLMs for content review followed by IMs. This design is
primarily driven by computational efficiency and cost-effectiveness.

IMs such as LIME and SHAP require thousands of repetitive calls from previous
language models. LMs, being tremendously less resource-intensive than LLMs,
can be invoked multiple times with minimal cost. As a result, LMs act as an
efficient intermediate layer, handling the majority of text classification
tasks by pinpointing key information. In contrast, the high computational cost
of LLMs necessitates their limited use. So in our framework, LLMs will only be
called once per content review cycle.

###  7.4 Limitations of Genshin

While our Genshin framework forms a general shield against all attackers in
practice, there are clear limitations beyond its reach. One limitation is the
lack of controllability of the LLM attacker, such as creating a large
disturbance or a specified disturbance ratio attack. Second, the general LLM
defender prompt could be inexperienced for domain-specific tasks like medical
records, so including Retrieval-augmented Generation (RAG) into the LLM
defender could further enhance the model’s robustness. Third, Genshin can only
recover textual information while the world is full of multi-modal
information, which can restrict its applications for more general purposes.

##  8 Conclusion and Future Work

In this work, we propose a novel framework called ”Genshin”, to make trade-
offs between LLMs, LMs, and IMs. Our experiments demonstrate the current flaws
of classical models and the effectiveness of the Genshin framework. In our
ablation study, we successfully reproduced the optimal 15% mask rate results
of BERT, previously established in the 3rd paradigm of NLP. Additionally, our
experiments with the LLM as a potential attacking tool reveal that attackers
can execute successful strategies nearly semantically information lossless.
This dual application highlights the robustness and versatility of the Genshin
framework in addressing both defensive and offensive scenarios in language
processing. In the case study, we interpret multiple cases providing insight
for system improvement. Finally, we have discussed the design of Genshin, the
necessity of each component, and the limitations at present.

For future work, we want to explore the controllability of the LLM attacker
and more prompting skills. Next, novel interpretable algorithms might provide
data insights into how the attacks take effect and a deeper understanding of
how the model operates. Genshin is also promising to be applied to Optical
Character Recognition (OCR) or Automatic Speech Recognition (ASR) results,
recovering mistakes made by preceding models. Although we mainly focus on the
defense of median-sized models, the safety of LLMs is still worth exploring.
With the growth of multi-modal LLMs, how to recover an edited photo, recording
or video remains a critical area of research.

## References

  * [1] A.A. Markov, N.N.: The theory of algorithms. Springer Dordrecht (1953)
  * [2] Achiam, J., Adler, S., Agarwal, S., Ahmad, L., Akkaya, I., Aleman, F.L., Almeida, D., Altenschmidt, J., Altman, S., Anadkat, S., et al.: Gpt-4 technical report. arXiv preprint arXiv:2303.08774 (2023)
  * [3] Anthropic: Claude 3. https://claude.ai (2024)
  * [4] Biggio, B., Corona, I., Maiorca, D., Nelson, B., Šrndić, N., Laskov, P., Giacinto, G., Roli, F.: Evasion attacks against machine learning at test time. In: Machine Learning and Knowledge Discovery in Databases: European Conference, ECML PKDD 2013, Prague, Czech Republic, September 23-27, 2013, Proceedings, Part III 13. pp. 387–402. Springer (2013)
  * [5] Brown, T., Mann, B., Ryder, N., Subbiah, M., Kaplan, J.D., Dhariwal, P., Neelakantan, A., Shyam, P., Sastry, G., Askell, A., et al.: Language models are few-shot learners. Advances in neural information processing systems 33, 1877–1901 (2020)
  * [6] Devlin, J., Chang, M.W., Lee, K., Toutanova, K.: Bert: Pre-training of deep bidirectional transformers for language understanding. arXiv preprint arXiv:1810.04805 (2018)
  * [7] Han, X., Wallace, B.C., Tsvetkov, Y.: Explaining black box predictions and unveiling data artifacts through influence functions. arXiv preprint arXiv:2005.06676 (2020)
  * [8] Hastie, T., Tibshirani, R., Friedman, J.H., Friedman, J.H.: The elements of statistical learning: data mining, inference, and prediction, vol. 2. Springer (2009)
  * [9] Kaplan, J., McCandlish, S., Henighan, T., Brown, T.B., Chess, B., Child, R., Gray, S., Radford, A., Wu, J., Amodei, D.: Scaling laws for neural language models. arXiv preprint arXiv:2001.08361 (2020)
  * [10] Kojima, T., Gu, S.S., Reid, M., Matsuo, Y., Iwasawa, Y.: Large language models are zero-shot reasoners. Advances in neural information processing systems 35, 22199–22213 (2022)
  * [11] Lewis, P., Perez, E., Piktus, A., Petroni, F., Karpukhin, V., Goyal, N., Küttler, H., Lewis, M., Yih, W.t., Rocktäschel, T., et al.: Retrieval-augmented generation for knowledge-intensive nlp tasks. Advances in Neural Information Processing Systems 33, 9459–9474 (2020)
  * [12] Liu, P., Yuan, W., Fu, J., Jiang, Z., Hayashi, H., Neubig, G.: Pre-train, prompt, and predict: A systematic survey of prompting methods in natural language processing. ACM Computing Surveys 55(9), 1–35 (2023)
  * [13] Lundberg, S.M., Lee, S.I.: A unified approach to interpreting model predictions. Advances in neural information processing systems 30 (2017)
  * [14] Mikolov, T., Chen, K., Corrado, G., Dean, J.: Efficient estimation of word representations in vector space. arXiv preprint arXiv:1301.3781 (2013)
  * [15] Mikolov, T., Sutskever, I., Chen, K., Corrado, G.S., Dean, J.: Distributed representations of words and phrases and their compositionality. Advances in neural information processing systems 26 (2013)
  * [16] Molnar, C.: Interpretable machine learning. Lulu. com (2020)
  * [17] OpenAI: Chatgpt. https://chat.openai.com (2023)
  * [18] Park, J.S., O’Brien, J., Cai, C.J., Morris, M.R., Liang, P., Bernstein, M.S.: Generative agents: Interactive simulacra of human behavior. In: Proceedings of the 36th Annual ACM Symposium on User Interface Software and Technology. pp. 1–22 (2023)
  * [19] Radford, A., Narasimhan, K., Salimans, T., Sutskever, I., et al.: Improving language understanding by generative pre-training. OpenAI blog (2018)
  * [20] Radford, A., Wu, J., Child, R., Luan, D., Amodei, D., Sutskever, I., et al.: Language models are unsupervised multitask learners. OpenAI blog 1(8), 9 (2019)
  * [21] Ribeiro, M.T., Singh, S., Guestrin, C.: ” why should i trust you?” explaining the predictions of any classifier. In: Proceedings of the 22nd ACM SIGKDD international conference on knowledge discovery and data mining. pp. 1135–1144 (2016)
  * [22] Shayegani, E., Mamun, M.A.A., Fu, Y., Zaree, P., Dong, Y., Abu-Ghazaleh, N.: Survey of vulnerabilities in large language models revealed by adversarial attacks. arXiv preprint arXiv:2310.10844 (2023)
  * [23] Sun, X., Yang, D., Li, X., Zhang, T., Meng, Y., Qiu, H., Wang, G., Hovy, E., Li, J.: Interpreting deep learning models in natural language processing: A review. arXiv preprint arXiv:2110.10470 (2021)
  * [24] Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., Fergus, R.: Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 (2013)
  * [25] Team, X.: Xagent: An autonomous agent for complex task solving. XAgent blog (2023)
  * [26] Touvron, H., Lavril, T., Izacard, G., Martinet, X., Lachaux, M.A., Lacroix, T., Rozière, B., Goyal, N., Hambro, E., Azhar, F., et al.: Llama: Open and efficient foundation language models. arXiv preprint arXiv:2302.13971 (2023)
  * [27] Wang, W., Wang, R., Wang, L., Wang, Z., Ye, A.: Towards a robust deep neural network in texts: A survey. arXiv preprint arXiv:1902.07285 (2019)
  * [28] Wei, J., Wang, X., Schuurmans, D., Bosma, M., Xia, F., Chi, E., Le, Q.V., Zhou, D., et al.: Chain-of-thought prompting elicits reasoning in large language models. Advances in neural information processing systems 35, 24824–24837 (2022)
  * [29] Wen, L., Fu, D., Li, X., Cai, X., Ma, T., Cai, P., Dou, M., Shi, B., He, L., Qiao, Y.: Dilu: A knowledge-driven approach to autonomous driving with large language models. arXiv preprint arXiv:2309.16292 (2023)
  * [30] Weng, L.: Adversarial attacks on llms. https://lilianweng.github.io/posts/2023-10-25-adv-attack-llm (2023)
  * [31] Zeng, G., Qi, F., Zhou, Q., Zhang, T., Ma, Z., Hou, B., Zang, Y., Liu, Z., Sun, M.: Openattack: An open-source textual adversarial attack toolkit. arXiv preprint arXiv:2009.09191 (2020)
  * [32] Zhao, W.X., Zhou, K., Li, J., Tang, T., Wang, X., Hou, Y., Min, Y., Zhang, B., Zhang, J., Dong, Z., et al.: A survey of large language models. arXiv preprint arXiv:2303.18223 (2023)

##  9 Appendix

###  9.1 Prompt Design Details

We demonstrate our defender’s prompt template as follows. We do not present
our attacker’s prompt template here for safety concerns on potential misusage.

Try to recover the following text to its original state. The text might have
encountered distrubances on its tokens (chars, words or sentences). For
example, there could be adding, deleting, swapping or replacing
characters/words (If it’s Chinese then distrubances may replace Chinese words
to spells like: ”开心”-¿”开xin”), and synonym replacement. These behaviors can be
done by potential malicious attackers, where they change the text a little
(still human-readable), just enough to bypass discriminative language models
like BERT, as their OOD (out of domain) problem. During the recover process,
please keep the meaning of the text intacted. Don’t write any explanations,
only the recovered text. No extra output. If you think nothing is modified in
the text (no trace of attackers), just output the input text. —— The input
text I am providing you is: — ¡¡text¿¿ —— Output your recovered output text as
JSON format, a dictionary containing two elements. like this: {
”orginal_text”: ”…..(xxx)”, ”recovered_text: ”……(yyy)” } — Your output is: