# An Incremental Gray-box Physical Adversarial Attack on Neural Network
Training

Rabiah Al-qudah1, Moayad Aloqaily1, Bassem Ouni2, Mohsen Guizani1, Thierry
Lestable2
2{bassem.ouni<EMAIL_ADDRESS>
1Mohamed Bin Zayed University of Artificial Intelligence (MBZUAI), UAE
2Technology Innovation Institute, Abu Dhabi, UAE
E-mails: 1{rabiah.alqudah; moayad.aloqaily<EMAIL_ADDRESS>
###### Abstract

Neural networks have demonstrated remarkable success in learning and solving
complex tasks in a variety of fields. Nevertheless, the rise of those networks
in modern computing has been accompanied by concerns regarding their
vulnerability to adversarial attacks. In this work, we propose a novel
gradient-free, gray box, incremental attack that targets the training process
of neural networks. The proposed attack, which implicitly poisons the
intermediate data structures that retain the training instances between
training epochs acquires its high-risk property from attacking data structures
that are typically unobserved by professionals. Hence, the attack goes
unnoticed despite the damage it can cause. Moreover, the attack can be
executed without the attackers’ knowledge of the neural network structure or
training data making it more dangerous. The attack was tested under a
sensitive application of secure cognitive cities, namely, biometric
authentication. The conducted experiments showed that the proposed attack is
effective and stealthy. Finally, the attack effectiveness property was
concluded from the fact that it was able to flip the sign of the loss gradient
in the conducted experiments to become positive, which indicated noisy and
unstable training. Moreover, the attack was able to decrease the inference
probability in the poisoned networks compared to their unpoisoned counterparts
by 15.37%, 14.68%, and 24.88% for the Densenet, VGG, and Xception,
respectively. Finally, the attack retained its stealthiness despite its high
effectiveness. This was demonstrated by the fact that the attack did not cause
a notable increase in the training time, in addition, the Fscore values only
dropped by an average of 1.2%, 1.9%, and 1.5% for the poisoned Densenet, VGG,
and Xception, respectively.

###### Index Terms:

Adversarial Attacks, Data Poisoning, Neural Networks, Iris Recognition.

##  I Introduction

Cognitive cities [1] are proactive, hyper-connected, and citizen-driven cities
that are designed to minimize resource consumption, in order to achieve
sustainability. In addition, the vast advancement in Artificial Intelligence
(AI) and Internet of Things (IoT) technologies have enhanced the evolution of
research that integrates both technologies to deliver and automate services
for cognitive cities’ residents. In fact, the great development that emerged
from the integration of those technologies has brought unforeseen exposures to
cybersecurity, in addition to novel attacks that need to be addressed in order
to deliver secure automation to cognitive cities.

Securing access to different services and facilities, such as connected
buildings and data centers, and managing the flow of foot traffic are crucial
requirements when adopting the cognitive city paradigm. Those requirements can
be implemented using biometric authentication such as fingerprint recognition
and iris recognition. Despite the benefits of biometric authentication,
privacy concerns and security attacks pose serious challenges to this
technology after deployment. Attacks that target biometric recognition systems
typically include presenting human characteristics or artifacts directly to a
biometric system to interfere or bias with its standard operation. Such
attacks can result in granting access to unauthorized individuals into secured
premises, allowing tailgating, or triggering denial of service by rejecting
the biometrics of authorized individuals. For instance, in 2017, the Chaos
Computer Club executed a successful attack on the Samsung Galaxy S8 iris
scanner using a simple photograph and a contact lens [2].

On a different note, neural networks have gained wide popularity in the past
decade due to their supremacy in terms of accuracy and minimal need for human
intervention. Moreover, those networks are data hungry and are very sensitive
to patterns they are exposed to during the training phase. On the other hand,
neural networks are vulnerable and can be biased even with the introduction of
simple adversarial attacks. For example, altering a single pixel in the data
fed to an image classifier can disrupt the learning experience and result in a
biased model [3].

Adversarial attacks are considered white box when the attacker has full access
to the neural network and data, while gray box attacks assume having access to
either and black box attacks assume access to neither. Those attacks can be
categorized into digital attacks and physical attacks. Digital attacks
engineer pixel values of input images, whereas physical attacks insert pixel
patches that represent real world objects into the input image instance.
Attacker goals can vary from faulting the predictions of a certain class, in
what is called “targeted attacks”. Moreover, an attack can be “non-targeted”
and aim to fault the model in general.

Furthermore, attacks that target faulting the inference phase have been
extensively studied in the literature. On the contrary, only a handful of
papers focused on faulting the training phase and the intermediate values
related to its computations. In 2022, Breier et al. introduced the first
attack that directly targets the training phase by perturbing the ReLu values
while training [4]. In fact, the lack of research attention on attacks that
target the training phase puts many applications that rely on neural networks
in jeopardy. In this work, we propose and test a novel attack that focuses on
faulting the training process of neural networks in the domain of biometric
authentication through iris recognition. The contributions of this work can be
summarized as follows:

  1. 1.

We introduce a novel gradient-free, data poisoning attack that incrementally
and directly targets the training set during the training process of a neural
network with minimal knowledge by the attacker. To the best of our knowledge,
this is the first attack that executes between training epochs and targets the
intermediate data structures of the training phase.

  2. 2.

We conduct extensive experimental verification on the proposed attack to test
its effectiveness and stealthiness. We define four evaluation criteria to
quantify the effect of the attack, namely, the average of the loss change, the
average inference probability, the training time difference, and the
performance degradation measure.

  3. 3.

We experiment the proposed attack on an important aspect of a cognitive city,
namely, iris recognition. To the best of our knowledge, this is the first
attempt to test the effect of an adversarial attack that occurs during
training on the domain of iris recognition.

The rest of this paper is organized as follows: the most recent literature on
the domain of physical attacks and iris recognition is presented in Section
II. The proposed methods are outlined in Section III. The results are
described and discussed in Section IV. Finally, Section V concludes and
summarizes the main highlights and observations of this work.

##  II Related Work

###  II-A Attacks on Neural Networks

Patch attacks are physical attacks that replace a subset of pixels in an image
with pixels from adversarial patches to bias a model [5]. While many studies
have proposed attacks that target faulting the inference phase [6, 7], only a
handful of papers focused on faulting the training phase and the intermediate
values related to its computations [4]. For example, Zhao et al. [6] applied
the alternating direction method of multipliers at the inference time to solve
the optimization problem of the targeted fault sneaking attack. The results
showed that the attack was successful and stealthy, moreover, the success rate
was approximately 100% when the number of targeted images was less than 10.
Whereas, the success rate decreased as the number of fooled images increased.
Furthermore, the work in [7] studied the effects of bitwise perturbations at
inference time on 19 deep networks. The vulnerable parameters of the
experimented networks were identified using heuristic functions. The results
showed that most deep architectures have at least one parameter that causes an
accuracy loss of over 90% when a bit-flip is executed on their bitwise
representation.

In addition, the Fast Gradient Sign Method (FGSM) has been widely used in the
literature as an attacking strategy [8]. This method includes adding noise
whose direction is the same as the gradient of the cost function with respect
to the data using a trained model. The work in [4], proposed the first attack
that targets the training phase by changing the values of the ReLu function to
bias the neural network. The novel attack was proven to be effective and
stealthy.

###  II-B Attacks on Iris Recognition Systems

The crucial role iris recognition has played in securing premises, in addition
to the threatening effects of breaching such authentication systems, have made
iris biometric authentication systems an active target for adversarial
attacks. A novel morph attack on iris recognition systems was tackled in [9].
Sharma et al. generated morphed iris images using the Indian Institute of
Technology Delhi (IITD) Iris Database and West Virginia University (WVU)
multi-modal datasets. The morph attack achieved a success rate higher than 90%
on two state-of-the-art iris recognition methods, which indicates the
vulnerability of iris recognition systems.

In order to protect against the increasing attacks, researchers have also
focused on studying countermeasures and detection mechanisms for iris
recognition attacks. For example, Thukral et al. [10] proposed an iris
spoofing detection system that utilized Gabor filters and Histogram of
Gradient (HOG) bins to extract features. Next, a Support Vector Machine (SVM)
was used to detect if the extracted features represented fake or real iris.
The proposed system was able to detect spoofing attacks with an accuracy of
98%. Finally, Tapia et al. [11] tackled testing the liveness of the scanned
iris to protect the system from being fooled by printed images or artificial
eyes. The proposed work utilized a MobileNetV2 network, which was trained from
scratch. Moreover, the authors increased the number of filters and weighted
each class based on the number of its instances. The proposed method was able
to accurately classify irises with competitive Bona Fide Classification Error
Rates (BPCER) of less than 4% in all experiments.

##  III Physical Gray-box Adversarial Attacks

A labeled training set of size $s$ can be represented as $DS=\\{(x^{i}$,
$y^{i})\\}^{s}_{i=1}$, where $y^{i}\in\mathcal{Y}$ and $\mathcal{Y}$ is the
set of all possible output classes for an image classification problem. When
training a deep classifier, we aim to optimize a discriminant function
$\mathcal{F}$ that maps each instance,$x^{i}$, to the class associated with
the highest class probability, as can be seen in Equation 1. This optimization
process takes place during the training process by passing $DS$ to a deep
classifier for a number of training rounds. The number of training rounds will
be referred to as $Epochs$ throughout the rest of this paper. The
aforementioned setting of training $\mathcal{F}$ without any attacks will be
referred to as the base model throughout this work.

$\mathcal{F}\rightarrow argmax(P(\mathcal{Y}\mid x^{i}))$ (1)

###  III-A Attack Definition

In our proposed attack, an attacker aims to corrupt the training process by
perturbing the training instances incrementally between training epochs in
order to optimize a corrupted poisoned discriminant function
$\mathcal{F^{\prime}}$ that produces faulty probability distributions over the
possible output classes. The attack is executed implicitly in multiple rounds.
In each poisoning round, a poisoning procedure that selects $X\subseteq DS$ of
size $|X|=\alpha*s$ is executed, where $\alpha\in(0\%,100\%]$ is the poisoning
percentage coefficient. The attacker’s goal is to replace $X=\\{(x^{i}$,
$y^{i})\\}^{|X|}_{i=1}$ with a poisoned set $X^{\prime}=\\{g(x^{i}$),
$y^{i})\\}^{|X|}_{i=1}$, where g(.) is the poisoning function that modifies
$x^{i}$ at a pixel level. The poisoning function replaces the pixels that fall
within a selected area, namely $Patch_{Area}$, with faulty pixels,
$x^{\prime}$, in order to corrupt the image representation and result in a
faulty training process. The poisoning function can be seen in Equation 2,
where $W$ and $H$ are the width and height of the training image instance
$x^{i}$.

$g(x)=\begin{cases}x^{\prime}_{u,v}&if(u,v)\in Patch_{Area}\\\ &\hskip
85.35826pt,u\in[0,W),v\in[0,H)\\\ x_{u,v}&Else\end{cases}$ (2)

The attack targets the intermediate data structures, where the training
instances are saved. In addition, it is executed incrementally between
training epochs, such that a different $X$ is selected every poisoning round
in order to accumulate the poisoned training instances and increase the
effectiveness of the attack.

The attack frequency coefficient determines the number of poisoning rounds and
is called $\beta\in[1,Epochs]$. When the value of $\beta$ is chosen to be 1,
then the attack will be executed after each training epoch causing an
increased risk of damage. On the contrary, if the value is chosen to be
$Epochs$, then the poisoning process will only happen once after the first
training epoch.

###  III-B Poisoning Strategy

Function $g(.)$ in Equation 2 replaces pixels in a training instance within
the defined poisoning area, $Patch_{Area}$. This poisoning procedure can be
implemented in multiple ways. In this work, we opted to implement $g(.)$ to
execute local perturbations and global perturbations [12]. It is worth
mentioning that only one type of perturbations was considered in each of the
conducted experiments in this work.

In the local perturbations setting, a small area called physical patch in the
training instance is selected and replaced with pixels from another image. In
this work, the physical patch was chosen to be close to the training set
domain, hence it was an image of a human eye. It is worth mentioning that the
size of the $Patch_{Area}$ and its location are randomized, and optimizing
them is out of the scope of this work [5].

On the other hand, in the global perturbations setting, all the instances in
$X$ are replaced with another randomly selected image from the training set.
This way the classifier will be exposed to a highly redundant training set
which corrupts the training process by increasing the risk of overfitting.
Both poisoning strategies are not easy to blacklist, since the local setting
only alters a small area of each instance and the global perturbation setting
uses an image from within the training instances in a manner that imitates
image augmentation, which is a benign, widely used technique in training
neural networks.

###  III-C Attack Characteristics

The attack specifications can be summarized as:

  1. 1.

The attack is non-targeted: the attack definition in III-A shows that no
restrictions apply on the choice of $y^{i}$ in $X$. Moreover, the value of
$y^{i}$ remains unchanged after poisoning takes place in $X^{\prime}$.

  2. 2.

The attack does not affect packets delay: the attack only targets the training
phase, whereas the inference phase is executed in the usual manner. Hence, the
attack is stealthy in the sense that it does not affect the packet delay when
the deep classifier is deployed on the cloud.

  3. 3.

The attack samples without replacement: to guarantee faster and stealthier
execution, $X$ is sampled every poisoning round without replacement; that is
an instance can only be included once in $X$ at a certain poisoning round,
however an instance can be included in multiple poisoning rounds. This implies
that the network will be exposed to a different training set after every
poisoning round, which results in a higher training instability.

  4. 4.

The attack is incremental for increased effectiveness: the poisoned instances
in $X^{\prime}$ accumulate in the training set after each poisoning round and
throughout the training phase, which in turn intensifies the effect of
poisoning even at a low value of $\alpha$.

  5. 5.

The attack is gradient-free [13] and is gray box: the attack is gray box since
we assume that the attacker only has access to the intermediate data
structures of the training process without the need to access the physical
path of the training instances or the neural network architecture. In other
words, the attack is agnostic to the neural network architecture. The attack
is also gradient-free since it perturbs the training data between epochs
without the need to access the gradients of the attacked neural network.

  6. 6.

The attack targets intermediate data structures: typically developers’ efforts
are more focused on preparing and preprocessing the training set before
training. On the other hand, what happens during training and the values of
the intermediate data structures that keep the training instances are
overlooked, especially that the training is usually conducted on powerful
servers with limited physical access. Hence, this attack which poisons the
data implicitly between training epochs, acquires its high risk property from
attacking data structures that are typically not monitored by professionals,
and hence the attack goes unnoticed despite the damage it causes.

###  III-D Evaluation Metrics

In each experiment, the neural networks will be evaluated and compared in
terms of the following evaluation measures:

  1. 1.

Attack effectiveness measures: an attack is called effective if it achieves
its intended goals. In our proposed attack, the goal is to expose the deep
classifier to an unstable training process, which in turn, will result in
faulty probability distributions produced by the network at the inference
stage.

    1. (a)

Average of Loss Change $(ALC)$: the loss function is typically expected to
decrease as the training process progresses. This is due to backpropagation,
which reflects what the network learned during each training epoch. The $ALC$
measures the average change in the loss value over the training epochs, and
the sign of this evaluation metric is a leading element, as it reflects
whether the loss was decreasing or increasing throughout training. Executing
the attack is expected to cause instability in the training process due to the
noisy poisoned data and, hence, increase the $ALC$ value. The $ALC$ can be
defined as follows, where the $\ell$ is the loss and $Epochs$ is the number of
training epochs:

$ALC=\frac{\sum_{i=1}^{Epochs}(\ell_{i}-\ell_{i-1})}{Epochs-1}$ (3)

    2. (b)

Average Inference Probability (AIP): the softmax function is typically used in
the last layer of deep classifiers to normalize the output to a probability
distribution over the possible output classes. Each test instance is
classified as the class of the highest probability. In this evaluation
criterion, we assess the effect of the attack on the probabilities produced by
the model at the inference stage, as typically higher probabilities imply more
confidence about the selected class. As a result, a decreased average
probability reflects the effectiveness of the attack on the final output of
the model. $AIP$ can be calculated using Equation 4, where $t^{i}$ is a test
instance.

$AIP=Average(argmax(P(Y\mid t^{i})))$ (4)

  2. 2.

Attack stealthiness measures: an attack is called stealthy if the evaluation
metrics of the corrupted classifier $\mathcal{F^{\prime}}$ are close to the
metrics of the base model $\mathcal{F}$ [4].

    1. (a)

Training Time Difference $(TTD)$: training a neural network can be a lengthy
process, especially when the training instances are large. Hence, it is
crucial to ensure that executing the attack will not cause an observable added
amount of time to the training phase, in order to keep the attack unnoticed.
The $TTD$ measure can be defined as follows:

$TTD=TrainingTime^{\prime}-TrainingTime_{base}$ (5)

where $TrainingTime_{base}$ is the time taken to train the base model, and
$TrainingTime^{\prime}$ is the training time when the neural network is
trained with poisoned data.

    2. (b)

Performance Degradation Measure (PDM): in order to confirm the attack
stealthiness, the metrics of the poisoned classifier need to be reasonably
close to the metrics of the base classifier. In this evaluation criterion, the
difference between the macro Fscore of the base model and each poisoned model
is calculated, as described in Equation 6, where $Fscore^{\prime}$ is the
Fscore of a poisoned model.

$PDM={Fscore}_{base}-Fscore^{\prime}$ (6)

###  III-E Datasets

The proposed attack perturbs images and hence can target any computer vision
application. Nevertheless, we opted to apply it to an iris recognition
dataset, due to the significance of this domain. The CASIA Iris Subject Ageing
dataset [14] was considered in our experiments. This dataset was collected by
the National Laboratory of Pattern Recognition (NLPR) in China in April 2009
and April 2013. In this work, the subset of CASIA Iris Subject Ageing which
was collected in 2009 using the H100 sensor was chosen due to its high
diversity and good size. The subset comprises 37912 instances of the left and
right eyes of 48 individuals. The dataset instances pose some challenging
scenarios, like glasses, partially closed eyes, Moreover, some instances have
very low brightness. The cross-validation method was used to train and
evaluate the neural networks, and 100 images from each user subject were
randomly selected for the test dataset.

###  III-F Technical and Experimental Setup

Three state-of-the-art deep classifiers, namely, Densenet, VGG, and Xception
were considered for this work. Moreover, the number of epochs was set to 10,
the cross entropy loss function was used and the networks were trained with a
learning rate of .01 on the Google Colab Pro platform which utilizes NVIDIA
GPUs. It is worth mentioning that the code of this work is available on Github
[15].

Each of the 3 considered deep classifiers were experimented with $\alpha$
values of 5%, 10%,15%, and 20%, as 20% is typically the maximum poisoning
percentage considered in the literature [16]. In the experiments description
and results, the local perturbations poisoning strategy will be referred to as
$P$, and the global perturbations strategy will be referred to as $R$.

##  IV Results and Discussion

In this section, the results of evaluating the proposed attack will be
presented in detail. Figures 1, 2, and 3 depict the results of the evaluation
metrics described in III-D. In all figures, the result of the base model is
depicted as the origin point ($\alpha$ = 0%).

Figure 1: Experimental results of the Average of Loss Change (ALC) values
Figure 2: Experimental results of the Average Inference Probability (AIP)
values Figure 3: Experimental results of the Performance Degradation Measure
(PDM) values

###  IV-A Analysis of Attack Effectiveness

Figure 1 depicts the $ALC$ results for the 3 considered deep classifiers. A
positive $ALC$ value indicates increasing loss values and poor training,
whereas a low negative value indicates a more stable training process. From
Figure 1, it can be noted that increasing $\alpha$ was always associated with
increased $ALC$ values, hence, it can be concluded that increasing the
poisoning percentage increases the effectiveness of the attack.

On a different note, increasing the attack frequency (i.e., a lower $\beta$)
resulted in increased effectiveness in all experiments. In the experiments
where $\beta$’s value was set to 1, the $ALC$ kept increasing as the value of
$\alpha$ increased, and the value was positive in all experiments where
$\alpha\geq 10\%$. On the other hand, when $\beta=Epochs$, the $ALC$ results
were increasing but negative in all experiments, which means that the loss
values were still decreasing but at a lower rate compared to the base model
and the experiments of higher frequency.

The $AIP$ results are depicted in Figure 2, where it can be seen that
increasing the value of $\alpha$ resulted in decreasing the $AIP$ in all
experiments. However, this decrease varied in the experiments; for example,
the decrease was slight, even when $\alpha$ increased, in the experiments
where $\beta$=$Epochs$. On the other hand, increasing $\alpha$ with a higher
frequency ($\beta=1$) resulted in a more noticeable drop in the $AIP$ values.
For example, it can be seen in Figure 2(c) that the $AIP$ value dropped by
24.88% when $\alpha=20\%$ and $\beta=1$ in the random poisoning experiment,
$R$. Whereas, the $AIP$ value only dropped by 5% when we only changed the
value of $\beta$ to be equal to the number of $Epochs$. Furthermore, the
highest drop in the $AIP$ in the poisoned networks compared to their
unpoisoned counterparts at inference time was 15.37%, 14.68%, and 24.88% for
the Densenet, VGG, and Xception, respectively. Overall, we can conclude that
the attack was effective in all conducted experiments. Moreover, the attack
effectiveness has a positive correlation with the percentage $\alpha$ and
frequency $\beta$.

###  IV-B Analysis of Attack Stealthiness

It is crucial to keep the proposed attack undetected. The attack can be easily
noticed if it takes long to execute, thus, to ensure the attack stealthiness,
the $TTD$ measure is monitored in all experiments. Among all conducted
experiments, the maximum $TTD$ value was 63 seconds. Hence, the attack did not
add a noticeable period of time to the training time of the base model.
Moreover, to monitor the stealthiness of the attack, the $PDM$ values were
recorded as can be seen in Figure 3. The maximum $PDM$ value was recorded for
the VGG network with $\alpha=20\%$ and $\beta=1$ in the random poisoning
experiment, $R$. Overall, the average $PDM$ values were 1.2%, 1.9%, and 1.5%
for the Densenet, VGG, and Xception, respectively. Hence, it can be concluded
that the attack demonstrated a stealthy behavior.

###  IV-C Analysis of Poisoning Strategy

As explained in Section III-B, the attack was experimented under local
perturbations setting ($P$) and global perturbations setting ($R$). The
influence of the perturbation type was highly associated with the value of
$\beta$. It can be seen in Figures 1, 2 and 3 that in the experiments of low
frequency, where $\beta=Epochs$, both perturbation types achieved comparable
results. On the other hand, when the poisoning rounds were executed after
every epoch, where $\beta$=1, the attack showed the highest effectiveness in
the global perturbations setting, $P$.

Finally, the results showed that the proposed attack is effective and
stealthy. Those properties increase when the attack is intensified by
increasing the value of $\alpha$, increasing the number of affected pixels,
similar to the case of global perturbations, and decreasing $\beta$ for higher
execution frequency. Moreover, the proposed attack inherits its riskiness from
attacking unobserved data structures that usually reside on powerful servers
with limited physical access. The attack is also incremental and accumulates
poisoned data gradually to intensify its effectiveness across the training
epochs. In addition, the attack requires no knowledge about the neural network
structure, as all experiments in this work were conducted using the same
injection code.

##  V Conclusion and Future work

Neural networks are vulnerable to adversarial attacks. Moreover, the digital
transformation adopted worldwide implies continuous acquisition and analytics
of big streams of data, which has brought novel digital threats and unforeseen
exposures to cybersecurity. In this work, we propose a novel gradient-free,
gray box, incremental attack that targets the intermediate data structures of
the training phase of neural networks. The attack has 3 main parameters: the
attack percentage coefficient, the attack frequency coefficient, and the
poisoning strategy. In all conducted experiments, it was noted that the attack
stealthiness and effectiveness had a positive correlation with the
aforementioned parameters.

Moreover, the attack resulted in unstable training, as it made the loss values
increase which in turn indicates poor learning and generalization. Moreover,
the attack was able to decrease the probability of the output class ($AIP$) in
the poisoned networks compared to their unpoisoned counterparts at inference
time by 15.37%, 14.68%, and 24.88% for the Densenet, VGG, and Xception,
respectively. Despite its effectiveness, the attack remained stealthy as it
only dropped the Fscore values by 1.2%, 1.9%, and 1.5% for the poisoned
Densenet, VGG, and Xception, respectively.

In future works, further sensitivity analyses will be conducted on existing
and new parameters, such as the type of communication protocol, and the area
and size of the patch area. Moreover, the attack will be compared to other
iris recognition attacks.

## Acknowledgements

This research was supported by the Technology Innovation Institute (TII), Abu
Dhabi, UAE, under the CyberAI project (grant number: TII/DSRC/2022/3036).

## References

  * [1] J. Machin, E. Batista, A. Ballesté, and A. Solanas, “Privacy and security in cognitive cities: A systematic review,” _Applied Sciences_ , vol. 11, p. 4471, 05 2021.
  * [2] A. Morales, J. Fierrez, J. Galbally, and M. Gomez-Barrero, “Introduction to iris presentation attack detection,” in _Handbook of Biometric Anti-Spoofing, 2nd Ed._ , 2019.
  * [3] J. Su, D. V. Vargas, and K. Sakurai, “One pixel attack for fooling deep neural networks,” _IEEE Transactions on Evolutionary Computation_ , vol. 23, no. 5, pp. 828–841, 2019.
  * [4] J. Breier, X. Hou, M. Ochoa, and J. Solano, “Foobar: Fault fooling backdoor attack on neural network training,” _IEEE Transactions on Dependable and Secure Computing_ , pp. 1–1, 2022.
  * [5] X. Li and S. Ji, “Generative dynamic patch attack,” 2021.
  * [6] P. Zhao, S. Wang, C. Gongye, Y. Wang, Y. Fei, and X. Lin, “Fault sneaking attack: a stealthy framework for misleading deep neural networks,” _2019 56th ACM/IEEE Design Automation Conference (DAC)_ , pp. 1–6, 2019.
  * [7] S. Hong, P. Frigo, Y. Kaya, C. Giuffrida, and T. Dumitraş, “Terminal brain damage: Exposing the graceless degradation in deep neural networks under hardware fault attacks,” in _Proceedings of the 28th USENIX Conference on Security Symposium_ , ser. SEC’19. USA: USENIX Association, 2019, p. 497–514.
  * [8] V. W. Anelli, A. Bellogín, Y. Deldjoo, T. Di Noia, and F. A. Merra, “Msap: Multi-step adversarial perturbations on recommender systems embeddings,” _The International FLAIRS Conference Proceedings_ , vol. 34, April 2021.
  * [9] R. Sharma and A. Ross, “Image-level iris morph attack,” in _2021 IEEE International Conference on Image Processing (ICIP)_ , 2021, pp. 3013–3017.
  * [10] A. Thukral, Jyoti, and M. Kumar, “Iris spoofing through print attack using svm classification with gabor and hog features,” in _2022 International Conference for Advancement in Technology (ICONAT)_ , 2022, pp. 1–6.
  * [11] J. E. Tapia, S. Gonzalez, and C. Busch, “Iris liveness detection using a cascade of dedicated deep learning networks,” _IEEE Transactions on Information Forensics and Security_ , vol. 17, pp. 42–52, 2022.
  * [12] C. Yang, A. Kortylewski, C. Xie, Y. Cao, and A. Yuille, “Patchattack: A black-box texture-based attack with reinforcement learning,” in _Computer Vision – ECCV 2020_ , A. Vedaldi, H. Bischof, T. Brox, and J.-M. Frahm, Eds. Cham: Springer International Publishing, 2020, pp. 681–698.
  * [13] M. Alzantot, Y. Sharma, S. Chakraborty, H. Zhang, C.-J. Hsieh, and M. Srivastava, “Genattack: Practical black-box attacks with gradient-free optimization,” 2018.
  * [14] National Laboratory of Pattern Recognition (NLPR) - Institute of Automation, Chinese Academy of Sciences (CASIA), “CASIA Iris Subject Ageing,” http://biometrics.idealtest.org/, Accessed in October 4th 2022.
  * [15] Artifitialleap-MBZUAI, “Incremental Training Data Attack,” https://github.com/Artifitialleap-MBZUAI/IncrementalTrainingDataPoisoning, October 2022.
  * [16] M. Jagielski, A. Oprea, B. Biggio, C. Liu, C. Nita-Rotaru, and B. Li, “Manipulating machine learning: Poisoning attacks and countermeasures for regression learning,” _2018 IEEE Symposium on Security and Privacy (SP)_ , pp. 19–35, 2018.


* Rogers et al. (2013) Rogers, T. M., Lin, D. N. C., McElwaine, J. N., & Lau, H. H. B. 2013, ApJ, 772, 21
  * Sadeghi Ardestani et al. (2017) Sadeghi Ardestani, L., Guillot, T., & Morel, P. 2017, MNRAS, 472, 2590
  * Santos et al. (2003) Santos, N. C., Israelian, G., Mayor, M., Rebolo, R., & Udry, S. 2003, A&A, 398, 363
  * Savonije & Papaloizou (1983) Savonije, G. J. & Papaloizou, J. C. B. 1983, MNRAS, 203, 581
  * Savonije & Papaloizou (1984) Savonije, G. J. & Papaloizou, J. C. B. 1984, MNRAS, 207, 685
  * Savonije & Papaloizou (1997) Savonije, G. J. & Papaloizou, J. C. B. 1997, MNRAS, 291, 633
  * Savonije, Papaloizou & Alberts (1995) Savonije, G. J., Papaloizou, J. C. B. & Alberts, F. 1995, MNRAS, 277, 471
  * Schlaufman & Winn (2013) Schlaufman K. C. & Winn J. N., 2013, ApJ, 772, 143
  * Schneider et al. (2011) Schneider, J., Dedieu, C., Le Sidaner, P., Savalle, R., & Zolotukhin, I. 2011, A&A, 532, A79
  * Skumanich (1972) Skumanich, A. 1972, ApJ, 171, 565
  * Siess et al. (2000) Siess, L., Dufour, E. & Forestini, M. 2000, A&A, 358, 593
  * Spiegel & Veronis (1960) Spiegel, E. A., & Veronis, G. 1960, ApJ, 131, 442
  * Stevenson (1979) Stevenson, D. J. 1979, GApFD, 12, 139
  * Strugarek et al. (2017) Strugarek, A., Bolmont, E., Mathis, S., Brun, A.S., Réville, V., Gallet, F., Charbonnel, C. 2017, ApJL, 847, 2
  * Strugarek et al. (2014) Strugarek A., Brun A. S., Matt S. P. & Réville V., 2014, ApJ, 795, 86
  * Strugarek et al. (2015) Strugarek, A., Brun, A. S., Matt, S. P., & Réville, V. 2015, ApJ, 815, 111
  * Terquem et al. (1998) Terquem C., Papaloizou J. C. B., Nelson R. P. & Lin D. N. C. 1998, ApJ, 502, 788
  * Valdettaro et al. (2007) Valdettaro, L., Rieutord, M., Braconnier, T., & Fraysse, V. 2007, Journal of Computational and Applied Mathematics, 205, 382
  * Vick & Lai (2020) Vick, M. & Lai, D. 2020, MNRAS, 496, 3
  * Weinberg et al. (2017) Weinberg, N. N., Sun, M., Arras, P., & Essick, R. 2017, ApJ, 849, L11
  * Witte & Savonije (2002) Witte, M.G. & Savonije, G.J. 2002, A&A, 386, 222
  * Zahn (1966) Zahn, J. P. 1970, A&A, 29, 489
  * Zahn (1970) Zahn, J. P. 1975, A&A, 4, 452
  * Zahn (1975) Zahn, J. P. 1975, A&A, 41, 329
  * Zahn (1977) Zahn, J.-P. 1977, A&A, 57, 383
  * Zahn, Talon & Matias (1997) Zahn, J.-P., Talon, S. & Matias, J. 1997, A&A, 322, 320

##  Appendix A Computation of a particular solution in the radiative zone near
the interface

The goal of this section is to compute a particular solution of Eq. (20) in
the radiative zone, near the interface. In such a configuration, Eq. (20)
becomes

$\frac{d^{2}\psi}{d\eta^{2}}+v^{2}\eta\psi=v^{2}\eta Z.$ (156)

For a given function $f$, we will write in this section
$\frac{df}{d\eta}=f^{\prime}$. We choose
$\psi_{1}(\eta)=\text{Ai}[v^{\frac{2}{3}}(-\eta)]$ and
$\psi_{2}(\eta)=\text{Bi}[v^{\frac{2}{3}}(-\eta)]$ as the two basis solutions
of the corresponding homogeneous equation. Their Wronskian $\Lambda_{A}$ can
be written as

$\Lambda_{A}=\psi_{1}\psi_{2}^{\prime}-\psi_{2}\psi_{1}^{\prime}=-\frac{v^{\frac{2}{3}}}{\pi}.$
(157)

Then a particular solution of the inhomogeneous Airy equation, vanishing at
the interface, can be expressed as

$\begin{split}\psi_{\text{p}}(\eta)=&-\left(\int_{0}^{\eta}{\Lambda_{A}^{-1}v^{2}\eta
Z\psi_{2}(\eta)d\eta}\right)\psi_{1}(\eta)\\\
&+\left(\int_{0}^{\eta}{\Lambda_{A}^{-1}v^{2}\eta
Z\psi_{1}(\eta)d\eta}\right)\psi_{2}(\eta).\end{split}$ (158)

From Eq. (156) we obtain

$\frac{\psi_{\text{p}}(\eta)}{v^{-\frac{2}{3}}\pi}=\left(\int_{0}^{\eta}{\\!\\!\\!-Z\psi_{2}^{\prime\prime}(\eta)d\eta}\right)\psi_{1}(\eta)+\left(\int_{0}^{\eta}{Z\psi_{1}^{\prime\prime}(\eta)d\eta}\right)\psi_{2}(\eta),$
(159)

which leads to

$\begin{split}\frac{\psi_{\text{p}}(\eta)}{v^{-\frac{2}{3}}\pi}=&-Z(\eta)\Lambda_{A}+Z(0)\left[\psi_{2}^{\prime}(0)\psi_{1}(\eta)-\psi_{1}^{\prime}(0)\psi_{2}(\eta)\right]\\\
&+\left[Z^{\prime}\psi_{2}\right]_{0}^{\eta}\psi_{1}-\left[Z^{\prime}\psi_{1}\right]_{0}^{\eta}\psi_{2}+\mathcal{I},\end{split}$
(160)

with
$\mathcal{I}=-\left(\int_{0}^{\eta}{Z^{\prime\prime}\psi_{2}(\eta)d\eta}\right)\psi_{1}+\left(\int_{0}^{\eta}{Z^{\prime\prime}\psi_{1}(\eta)d\eta}\right)\psi_{2}$.
Such a term will be neglected from now on by assuming that the equilibrium
tide varies slowly compared to the dynamical tide in the radiative zone. Since
$\psi_{1}^{\prime}(0)=-v^{\frac{2}{3}}\text{Ai}^{\prime}(0)$ and
$\psi_{2}^{\prime}(0)=-v^{\frac{2}{3}}\text{Bi}^{\prime}(0)$, we obtain:

$\begin{split}\psi_{\text{p}}(\eta)=&Z(\eta)-Z(0)\pi\left[\text{Bi}^{\prime}(0)\psi_{1}(\eta)-\text{Ai}^{\prime}(0)\psi_{2}(\eta)\right]\\\
&-v^{-\frac{2}{3}}\pi
Z^{\prime}(0)\left[\text{Bi}(0)\psi_{1}(\eta)-\text{Ai}(0)\psi_{2}(\eta)\right].\end{split}$
(161)

Knowing that
$\pi=[\text{Ai}(0)\text{Bi}^{\prime}(0)-\text{Bi}(0)\text{Ai}^{\prime}(0)]^{-1}=\frac{1}{2}3^{\frac{3}{2}}\Gamma\left(\frac{4}{3}\right)\Gamma\left(\frac{2}{3}\right)$
the particular solution becomes

$\begin{split}\psi_{\text{p}}(\eta)=Z(\eta)+\left(\frac{\tau}{2}\right)^{\frac{1}{3}}\left[\alpha_{\text{rad,p}}J_{\frac{1}{3}}(\tau)+\beta_{\text{rad,p}}J_{-\frac{1}{3}}(\tau)\right],\end{split}$
(162)

where
$\displaystyle\alpha_{\text{rad,p}}=-\frac{dZ}{d\eta}(0)\left(\frac{v}{3}\right)^{-\frac{2}{3}}\Gamma\left(\frac{4}{3}\right)$
and $\beta_{\text{rad,p}}=-Z(0)\Gamma\left(\frac{2}{3}\right)$.

##  Appendix B Forcing term and radial displacement for a low-mass star

We aim in this section to link the forcing term to the radial displacement
linked to the dynamical tide, which is comparing formulations from Zahn (1975)
and Goodman & Dickson (1998). One can express the derivative of the radial
displacement at the interface linked to the dynamical tide with the notations
we used in Sect. 2:

$\left.\partial_{r}{\xi_{r}^{\text{dyn}}}\right|_{\text{int}}=\partial_{r}\left[{\rho_{0}^{-\frac{1}{2}}r^{-2}(\rho_{0}^{-\frac{1}{2}}X-Z)}\right]_{\text{int}}.$
(163)

By expressing the radial displacement $\xi_{r}$ in the ($S_{+},S_{-}$) basis,
knowing that $\mathcal{T}_{1}=0$ we obtain from Eqs. (44), (60) and (63):

$\begin{split}&\left.\partial_{r}{\xi_{r}^{\text{dyn}}}\right|_{\text{int}}=\left.\partial_{r}\left(\rho_{0}^{-\frac{1}{2}}r^{-2}\right)\right|_{\text{int}}\left[\frac{\beta_{\text{conv}}+\beta_{\text{conv,p}}}{\Gamma\left(\frac{2}{3}\right)}-Z(0)\right]\\\
&+\rho_{0}^{-\frac{1}{2}}(r_{\text{int}})r_{\text{int}}^{-2}\left[\frac{\beta_{\text{conv}}+\beta_{\text{conv,p}}}{\Gamma(\frac{2}{3})}\frac{\frac{d}{dr}(\rho_{0}^{-\frac{1}{2}}X_{h})_{\text{int}}}{(\rho_{0}^{-\frac{1}{2}}X_{h})_{\text{int}}}+\mathcal{T}-\partial_{r}Z(0)\right]\end{split}$
(164)

with

$\begin{split}\mathcal{T}=&\rho_{0}^{\frac{1}{2}}(r_{\text{int}})r_{\text{int}}^{2}\left\\{-\frac{\rho_{0}^{\prime}(r_{\text{int}})}{\rho_{0}(r_{\text{int}})}-\frac{\left(\rho_{0}^{-\frac{1}{2}}Z\right)_{\text{int}}^{\prime}}{\left(\rho_{0}^{-\frac{1}{2}}Z\right)_{\text{int}}}+\frac{X_{1}^{\prime}(r_{\text{int}})}{X_{1}(r_{\text{int}})}\right\\}\left(\frac{\varphi_{T}}{g}\right)_{\text{int}}\\\
&+\rho_{0}^{\frac{1}{2}}(r_{\text{int}})\mathcal{F}.\end{split}$ (165)

Since $C_{2}=0$, the homogeneous solution $X_{h}$ in the convective zone is
proportional to the basis solution $X_{1}$, which leads to

$\partial_{r}{\xi_{r}^{\text{dyn}}}=\left.\frac{\partial_{r}(\rho_{0}^{-1}r^{-2}X_{h})}{\rho_{0}^{-1}r^{-2}X_{h}}\right|_{\text{int}}\xi_{r}^{\text{dyn}}(r_{\text{int}})+r_{\text{int}}^{-2}\mathcal{F},$
(166)

where
$\displaystyle\xi_{r}^{\text{dyn}}(r_{\text{int}})=\rho_{0}^{-\frac{1}{2}}(r_{\text{int}})r_{\text{int}}^{-2}\left(\frac{\beta_{\text{conv}}+\beta_{\text{conv,p}}}{\Gamma\left(\frac{2}{3}\right)}-Z(0)\right)$.
By assuming slow variations of the density and the radius compared to the
characteristic length of variation of the gravity waves in the radial
direction
$\lambda=v^{-\frac{2}{3}}=\omega^{\frac{2}{3}}\left[l(l+1)\right]^{-\frac{1}{3}}\left|\frac{dN^{2}}{d\ln
r}\right|^{-\frac{1}{3}}_{r_{\text{int}}}r_{\text{int}}$ (Goodman & Dickson,
1998; Kushnir et al., 2017), we obtain from Eq. (44)

$\left.\partial_{r}{\xi_{r}^{\text{dyn}}}\right|_{\text{int}}\sim\frac{\Gamma(\frac{2}{3})}{3^{\frac{2}{3}}\Gamma(\frac{4}{3})}\frac{\alpha_{\text{conv}}}{\beta_{\text{conv}}}\frac{\xi_{r}^{\text{dyn}}(r_{\text{int}})}{\lambda}+r_{\text{int}}^{-2}\mathcal{F}.$
(167)

Since
$\xi_{r}^{\text{dyn}}(r_{\text{int}})\sim\lambda\left.\partial_{r}\xi_{r}^{\text{dyn}}\right|_{\text{int}}$
(Goodman & Dickson, 1998) and $\alpha_{\text{conv}}\ll\beta_{\text{conv}}$, we
have

$\left.\partial_{r}\xi_{r}^{\text{dyn}}\right|_{\text{int}}\sim
r_{\text{int}}^{-2}\mathcal{F},$ (168)

which ensures the equivalence between the formulations from Zahn (1975) and
Goodman & Dickson (1998).

##  Appendix C Stress-free condition at the stellar surface

The goal of this section is to investigate the consequences on tidal
dissipation of low-mass stars of a stress-free boundary condition coupled with
a nonzero density at the stellar surface. In this case, the Lagrangian
perturbation of pressure vanishes at $r=R_{\star}$:

$\delta
P=\rho_{0}(R_{\star})\left[y-g_{0}(R_{\star})\xi_{r}(R_{\star})\right]=0.$
(169)

We will consider the case where $\rho_{0}(R_{\star})>0$ and
$\frac{\rho_{0}^{\prime}(R_{\star})}{\rho_{0}(R_{\star})}$ is the only large
parameter involved, to account for the density behavior near the photosphere.
From Eqs. (12) in the anelastic approximation, we obtain

$\xi_{r}(R_{\star})=-\frac{\varphi_{T}(R_{\star})}{g_{0}(R_{\star})}+\frac{\omega^{2}}{\omega_{\text{dyn}}^{2}}\frac{1}{l(l+1)R_{\star}}\partial_{r}(r^{2}\xi_{r}).$
(170)

By assuming low frequency waves, i.e. $\omega\ll\omega_{\text{dyn}}$, the
stress-free condition becomes

$X(R_{\star})=-\rho_{0}(R_{\star})R_{\star}^{2}\frac{\varphi_{T}(R_{\star})}{g_{0}(R_{\star})},$
(171)

which accounts for the equilibrium tide. In the convective zone, we choose the
basis solution $X_{1}$ as the solution of the homogeneous equation associated
to Eq. (35) verifying $X_{1}(R_{\star})=X(R_{\star})$ and
$X_{1}^{\prime}(R_{\star})=X^{\prime}(R_{\star})$. This way, we fix
$C_{2}=\mathcal{T}_{0}=\mathcal{T}_{2}=0$. As in section 5.1, near the
surface, $X_{1}$ is a solution of the following equation:

$X^{\prime\prime}-\frac{\rho_{0}^{\prime}}{\rho_{0}}X^{\prime}=0,$ (172)

which leads to $X_{1}^{\prime}\propto\rho_{0}$. We now impose that
$X^{\prime}(R_{\star})=X_{1}^{\prime}(R_{\star})=R_{\star}^{2}\rho_{0}(R_{\star})$.

If we assume that the interface between convective and radiative zone is close
to the stellar surface, one can assume that

$\begin{split}X_{1}^{\prime}(r)&=R_{\star}^{2}\left[\rho_{0}(R_{\star})+\rho_{0}^{\prime}(R_{\star})(r-R_{\star})\right]\\\
X_{1}(r)&=X_{1}(R_{\star})\\!+\\!R_{\star}^{2}\\!\left[\rho_{0}(R_{\star})(r-R_{\star})\\!+\\!\frac{1}{2}\rho_{0}^{\prime}(R_{\star})(r-R_{\star})^{2}\\!\right].\end{split}$
(173)

Such expressions are adopted as a boundary condition in our numerical
treatment of tidal dissipation to deal with the surface singularity in the
case of solar-type stars. Furthermore, if we assume that
$\displaystyle\frac{\rho_{0}(R_{\star})}{\rho_{0}^{\prime}(R_{\star})}\ll
R_{\star}^{2}(\alpha-1)^{2}$ we obtain

$\displaystyle\frac{X_{1}^{\prime}(R_{\star})}{X_{1}(r_{\text{int}})}=\frac{1}{-\frac{\varphi_{T}(R_{\star})}{g(R_{\star})}+R_{\star}(\alpha-1)+\frac{1}{2}\frac{\rho_{0}^{\prime}(R_{\star})}{\rho_{0}(R_{\star})}R_{\star}^{2}(\alpha-1)^{2}}\ll
1,$ (174)
$\displaystyle\frac{X_{1}(R_{\star})}{X_{1}(r_{\text{int}})}=\frac{-\frac{\varphi_{T}(R_{\star})}{g(R_{\star})}}{-\frac{\varphi_{T}(R_{\star})}{g(R_{\star})}+R_{\star}(\alpha-1)+\frac{1}{2}\frac{\rho_{0}^{\prime}(R_{\star})}{\rho_{0}(R_{\star})}R_{\star}^{2}(\alpha-1)^{2}}\ll
1.$ (175)

The $\mathcal{T}_{1}$ term then becomes

$\begin{split}\mathcal{T}_{1}=&\frac{\varphi_{T}(R_{\star})}{g(R_{\star})}\alpha^{-2}\frac{\rho_{0}^{\prime}(R_{\star})}{\rho_{0}(R_{\star})}\frac{X_{1}(R_{\star})}{X_{1}(r_{\text{int}})}\\\
&\sim-2\left(\frac{\varphi_{T}(R_{\star})}{g(R_{\star})}\right)^{2}\alpha^{-2}(1-\alpha)^{-2}R_{\star}^{-2}.\end{split}$
(176)

Furthermore, in the case of a thin convective layer, from Eq. (127) we have

$r_{\text{int}}^{-2}\mathcal{F}=3\frac{1-\gamma}{1-\alpha}\frac{\alpha^{5}}{\beta}\left(\frac{2\alpha}{3}-1\right)\alpha^{-2}\frac{\varphi_{T}(R_{\star})}{g(R_{\star})}R_{\star}^{-1}.$
(177)

Then we obtain

$\frac{\mathcal{T}_{1}}{r_{\text{int}}^{-2}\mathcal{F}}=-\frac{2}{3}\frac{\beta}{\alpha^{5}(1-\gamma)(1-\alpha)\left(\displaystyle\frac{2\alpha}{3}-1\right)}\frac{\varphi_{T}(R_{\star})}{g(R_{\star})}R_{\star}^{-1}.$
(178)

Since $\gamma=\frac{\alpha^{3}(1-\beta)}{\beta(1-\alpha^{3})}$ we have

$\frac{\mathcal{T}_{1}}{r_{\text{int}}^{-2}\mathcal{F}}=-\frac{2}{3}\frac{\beta^{2}(1+\alpha+\alpha^{2})}{\alpha^{5}\left(\displaystyle\frac{2\alpha}{3}-1\right)(\beta-\alpha^{3})}\frac{\varphi_{T}(R_{\star})}{g(R_{\star})}R_{\star}^{-1}.$
(179)

The values of such a ratio for all the possible values of
$\alpha=R_{r}/R_{\star}$ and $\beta=M_{r}/M_{\star}$ are represented in Fig.
13. As we assumed that the convective zone is sufficiently thin to linearize
the density profile, only values of $\alpha$ close to 1 are relevant in this
analysis. Therefore, we can assume that the $\mathcal{T}_{1}$ term marginally
affects our prescription for tidal dissipation in the radiative zone in the
case of a surface density sufficiently weak. A more detailed study on surface
boundary conditions is left for future work.

Figure 13: Value of $\mathcal{T}_{1}/r_{\text{int}}^{-2}\mathcal{F}$ for all
the possible values of $\alpha=R_{r}/R_{\star}$ and $\beta=M_{r}/M_{\star}$.
In black: values of $\alpha$ and $\beta$ for which the ratio is equal to 1.

##  Appendix D A wave breaking criterion for solar-type stars

To provide a general criterion for wave braking in the case of solar-type
stars, we rely on the non-linearity factor $\epsilon_{nl}$, which is the ratio
of the amplitude of the radial displacement to the radial wavelength (Press,
1981; Barker & Ogilvie, 2010; Barker, 2020)

$\epsilon_{nl}=|k_{r}\xi_{r}|.$ (180)

Non-linearities become important when $\epsilon_{nl}\geq 1$. In particular,
wave braking is likely to occur. One can assess this non-linearity factor
through the energy luminosity of the tidal gravity wave. Indeed, from Eq.
(75), we have

$|L_{E}|=\frac{\omega^{3}}{2l(l+1)}|C_{W}|^{2}.$ (181)

Furthermore, by defining $\xi_{r}^{\text{dyn}}$ the radial displacement linked
to the dynamical tide, we obtain in the WKBJ approximation:

$\xi_{r}^{\text{dyn}}(r)=\rho_{0}^{-\frac{1}{2}}r^{-2}C_{W}\frac{1}{\sqrt{k_{r}}}e^{\epsilon
i(\tau_{W}-\tau_{0})},$ (182)

where $k_{r}\approx\sqrt{\frac{N^{2}}{\omega^{2}}\frac{l(l+1)}{r^{2}}}$ is the
radial wavenumber. This leads to

$|C_{W}|^{2}=\rho_{0}r^{3}\frac{N}{\omega}\sqrt{l(l+1)}\left|\xi_{r}^{\text{dyn}}\right|^{2}.$
(183)

The energy luminosity then becomes:

$|L_{E}|=\frac{N\omega^{2}\rho_{0}r^{3}}{2\sqrt{l(l+1)}}\left|\xi_{r}^{\text{dyn}}\right|^{2}.$
(184)

Hence, one can assess $\epsilon_{nl}$ as

$\epsilon_{nl}=\sqrt{\frac{2[l(l+1)]^{\frac{3}{2}}N|L_{E}|}{\rho_{0}r^{5}\omega^{4}}},$
(185)

which is similar to the expression obtained in Eq. (53) in Barker (2020).
Furthermore, in the case of a solar-type star, we find that the energy
luminosity $L_{E}$ is equal to

$L_{E}=-\frac{3^{\frac{2}{3}}\Gamma^{2}\left(\displaystyle\frac{1}{3}\right)}{8\pi}\omega^{\frac{11}{3}}\left[l(l+1)\right]^{-\frac{4}{3}}\rho_{0}(r_{\text{int}})r_{\text{int}}\left|\frac{dN^{2}}{d\ln
r}\right|_{r_{\text{int}}}^{-\frac{1}{3}}\mathcal{F}^{2}.$ (186)

with

$\mathcal{F}=\int_{r_{\text{int}}}^{R_{\star}}{\left[\left(\frac{r^{2}\varphi_{T}}{g_{0}}\right)^{\prime\prime}-\frac{l(l+1)}{r^{2}}\left(\frac{r^{2}\varphi_{T}}{g_{0}}\right)\right]\frac{X_{1}}{X_{1}(r_{\text{int}})}}dr.$
(187)

As $L_{E}\propto\mathcal{F}^{2}$, we introduce $|L_{E}|=L_{E,0}\
m_{p}^{2}n^{4}\omega^{\frac{11}{3}}$, where $L_{E,0}$ is independent of the
tidal frequency and planetary properties, $m_{p}$ is the planetary mass and
$n$ the mean motion of its orbit. Hence, wave braking may occur if
$\epsilon_{nl}\geq 1$, which leads to

$\frac{2[l(l+1)]^{\frac{3}{2}}NL_{E,0}m_{p}^{2}n^{4}}{\rho_{0}r^{5}}\omega^{-\frac{1}{3}}\geq
1$ (188)

In the absence of stellar rotation, we have $\omega=2n$. Furthermore, near the
stellar center, the radial profile of the Brunt-Väisälä is approximately
linear. We then assume that $N\approx Cr$, where $C\approx 8\times 10^{-11}\
\text{m}^{-1}.\text{s}^{-1}$ for the current Sun (Barker, 2020). Such a
quantity is here estimated at a given stellar mass and stellar age by relying
on STAREVOL grids. Following Goodman & Dickson (1998), one can estimate the
location $r_{\text{inner}}$ of the inner turning point, defined as $N=\omega$,
as follows:

$r_{\text{inner}}=\frac{2n}{C}.$ (189)

Then, estimating the non-linearity factor at the inner turning point gives

$\frac{2^{-\frac{10}{3}}[l(l+1)]^{\frac{3}{2}}C^{5}L_{E,0}}{\rho_{0}(r_{\text{inner}})}m_{p}^{2}n^{-\frac{1}{3}}\geq
1$ (190)

which, by introducing the orbital period $P_{\text{orb}}$, gives the following
criterion on the planetary mass

$m_{p}\geq(2\pi)^{\frac{1}{6}}\frac{2^{\frac{5}{3}}\rho_{0}(r_{\text{inner}})}{[l(l+1)]^{\frac{3}{4}}C^{\frac{5}{2}}L_{E,0}^{\frac{1}{2}}}P_{\text{orb}}^{-\frac{1}{6}}\equiv
M_{cr}.$ (191)

We then find a similar result as the Barker & Ogilvie (2010) criterion (see
also Barker 2011, 2020), which is based on an overturning of the
stratification. Such a condition depends weakly on the orbital period (a
decrease by one order of magnitude in $P_{\text{orb}}$ lead to an increase of
$M_{\text{cr}}$ of around 31.9 %). If a given planet has a mass higher than
$M_{\text{cr}}$, then wave breaking may occur in the star, and the tidal
quality factor is expected to behave according the results of our work.
Otherwise, other dissipation processes, like radiative damping in the case of
progressive waves or critical layers, may lead to a similar tidal dissipation.
We present in Fig. 14 the evolution of $M_{\text{cr}}$ as a function of the
age of the system, for stellar masses ($M_{\star}$) between 0.4 and 1.4
$M_{\odot}$. As already pointed out in Barker (2020), for stellar masses
larger than 0.9 $M_{\odot}$, the critical planetary mass may fall below 1
Jupiter mass for all ages greater than 10 Gyr. It then allows super-Earths and
hot Neptunes to trigger wave braking in their host stars during the sub-giant
phase and the RGB.

Figure 14: Evolution of the critical planetary mass $M_{\text{cr}}$ as a
function of the age of the system, for stellar masses ($M_{\star}$) between
0.4 and 1.4 $M_{\odot}$. Wave braking may occur for planetary masses higher
than $M_{\text{cr}}$.

##  Appendix E Angular momentum transport and tidal torque

The goal of this section is to clarify the relationship between the angular
momentum transport and the net torque applied to the radiative zone. To this
end, we consider a radiative zone between $r=r_{0}$ and $r=r_{1}>r_{0}$. The
equation for the transport of angular momentum, horizontally averaged and
focusing only on waves, is given by Mathis (2009):

$\rho_{0}\frac{d}{dt}\left(r^{2}\int_{\theta=0}^{\theta=\pi}\sin^{3}\theta\
\Omega d\theta\right)=-\frac{1}{2\pi
r^{2}}\partial_{r}\left(r^{2}\int_{\theta=0}^{\theta=\pi}F_{J}\sin\theta
d\theta\right),$ (192)

where $\Omega$ is the angular velocity of the radiative zone and $F_{J}$ is
the radial component of flux of angular momentum transported by gravity waves’
Reynolds stresses, whose expression is given in Eq. (78). By integrating along
the radial and latitudinal directions, this leads to

$\frac{dJ_{RZ}}{dt}=-\int_{r_{0}}^{r_{1}}(\partial_{r}L_{J})dr,$ (193)

where $\displaystyle
J_{RZ}=\rho_{0}\int_{r=r_{0}}^{r=r_{1}}\int_{\theta=0}^{\theta=\pi}\int_{\varphi=0}^{\varphi=2\pi}r^{4}\sin^{3}\theta\
\Omega\ d\varphi d\theta dr$ is the total angular momentum of the radiative
zone and $\displaystyle
L_{J}=2\pi\int_{\theta=0}^{\theta=\pi}r^{2}F_{J}\sin\theta d\theta$ is the
luminosity of angular momentum. Hence we obtain

$\frac{dJ_{RZ}}{dt}=L_{J}(r_{0})-L_{J}(r_{1}).$ (194)

In the case of an inward energy transport ($\epsilon=1$, corresponding to the
configuration of solar-type stars), tidal gravity waves are excited at
$r=r_{1}$ and are totally dissipated before reaching the radius $r=r_{0}$.
Hence we obtain

$\frac{dJ_{RZ}}{dt}=-L_{J}(r_{1}).$ (195)

In the case of an outward energy transport ($\epsilon=-1$, corresponding to
the massive and intermediate-mass stars’ configuration), tidal gravity waves
are excited at $r=r_{0}$ and are totally dissipated before reaching the radius
$r=r_{1}$. In this configuration, we have

$\frac{dJ_{RZ}}{dt}=L_{J}(r_{0}).$ (196)

Hence, one can compute the torque $T$ applied to the whole radiative zone with
a single expression:

$T=-\epsilon L_{J,\text{exc}},$ (197)

where $L_{J,\text{exc}}$ is the luminosity of angular momentum estimated at
the region of excitation of tidal gravity waves.