InfoAT: Improving Adversarial Training Using the Information Bottleneck Principle

Mengting Xu, Tao Zhang, Zhongnian Li,
and Daoqiang Zhang
Mengting Xu, Tao Zhang, Zhongnian Li and Daoqiang Zhang are with the College of Computer Science and Technology, Nanjing University of Aeronautics and Astronautics, Nanjing 211106, China (e-mail: {xumengting<EMAIL_ADDRESS>Daoqiang Zhang is the corresponding author
Manuscript received May 09, 2021; revised May 09, 2021 .

Journal of  Class Files, Vol. 14, No. 8, August 2015
Shell et al.: Bare Demo of IEEEtran.cls for IEEE Journals

Adversarial training has shown excellent high performance in defensing against adversarial examples. Recent studies demonstrate that examples are not equally important to the final robustness of models during adversarial training, i.e., the so-called hard examples which can be attacked easily exhibit more influence than robust examples on the final robustness. Therefore, guaranting the robustness of hard examples is crucial for improving the final robustness of the model.
However, defining an effective heuristics to search hard examples is still difficult.
In this paper, inspired by information bottleneck (IB) principle, we uncover that example with high mutual information of the input and its associated latent representation is more likely to be attacked. Based on this observation, we propose a novel and effective adversarial training method (InfoAT). InfoAT is encouraged to find examples with high mutual information and exploit them efficiently to improve the final robustness of models.
Experimental results show that InfoAT achieves the best robustness among different datasets and models in comparison with several state-of-the-art methods.

adversarial training, robustness, information bottleneck, mutual information.

§ INTRODUCTION

Despite the great success of deep neural networks on diverse tasks such as image classification [1], speech recognition and natural language processing [2].

Recent studies have shown that their adversarial robustness is very poor [3, 4]. When attacked by adversarial examples which added visually imperceptible perturbations, deep neural networks can be easily misleaded by a high confidence.
The vulnerability of deep neural networks to adversarial examples may pose a huge threat to applications and services that are highly dependent on security performance, such as autonomous driving systems [5, 6], computer-aided disease diagnosis based on medical images [7], and malware detection protocols [8].

Considering the significance of adversarial robustness in neural networks, a range of defense methods have been proposed [9, 10, 11, 12, 7].
Sun et al. [13] achieved high level of robustness by projecting both clean and adversarially attacked input images into a low-dimensional quasi-natural image space. Zhang et al. [14]  proposed to progressively minimize the divergence of different distributions, such that the gap between the clean and adversarial domains in the intermediate feature space and decision space is minimum.

Examples with high mutual information are more likely to be attacked. (a) Most non-robust (can be successfully attacked) examples have higher mutual information (dashed orange line) than robust examples (blue line). (b) The minimum adversarial perturbation required for examples with different mutual information to be successfully attacked. The larger the example mutual information, the smaller the perturbation required for a successful attack.  The dataset is CIFAR-10. The model is ResNet-18 trained by TRADES [15]. The attack method is Project Gradient Descent (PGD) [16] with 10 steps.

Among them, adversarial training, which continuously adds newly generated adversarial examples in the neural network training process, has been proven to be one of the most effective defense strategies against adversarial attacks.
Many adversarial training strategies employ the “worst-case" adversarial example to maximize the loss for updating the current model such as standard adversarial training (AT) [16], TRADES [15], and robust self-training (RST) [17].
Zhang et al. [18] generated adversarial images for adversarial training through feature scattering in the latent space, which is unsupervised in nature and avoids label leaking.
Liu et al. designed a GanDef, which utilizes a competition game to regulate the feature selection during the adversarial training [19] [20]. And [21] showed that adversarially training a network with an attack method helps defending against that particular attack method, but has limited effect for other attack methods.
Furthermore, recent studies [22, 23] have shown examples along with their adversarial variants are not equally important to the robustness of models during adversarial training.
Specifically, the so-called hard examples (can be attacked easily) exhibit more influence than robust examples on the final robustness.
Therefore, it is crucial to define an effective heuristics to search hard examples for improving the robustness of model.

In this paper,
we propose a novel and effective adversarial training strategy (InfoAT) from an information theoretic perspective. It uses the Information Bottleneck (IB) principle [24] to find the hard examples.

Recently, the studies of IB principle to deep neural network training have developed rapidly [25, 26], but its effect on the effectiveness of adversarial training still remains unclear.
The IB principle shows that when the valid information of the input cannot be well compressed by the model, the neural network cannot generalize the out-of-distribution data well, that is, the mutual information between the input data and its related latent representation is high.
As shown in Fig. <ref>, hard (i.e., non-robust, can successfully attacked by Project Gradient Descent (PGD) [16]  attack) examples are more likely to have higher mutual information than robust examples. What's more, Fig. <ref> shows the larger the mutual information of example, the smaller the perturbation required for a successful attack.
These phenomena show that example with high mutual information is more vulnerable than other examples. This is because when the mutual information is high, the latent representation of the network has learned a large number of features of the input image.
And these features often contain some redundant information and non-robust features, so when there is adversarial perturbations in the image, the model will be easily fooled.
Motivated by these conceptual and experimental observations, we adopt the mutual information of the original examples between the input and latent distribution with the current model to select the hard examples, and guarantee them to be robust against attackers to improve the robustness of the model.

Our main contributions are:

* We show that the example with high mutual information is more likely to be attacked in Fig. <ref>.
High mutual information means that the latent representation of the network contains a lot of information about the input image, including the redundant information and adversarial perturbations that are useless for the prediction results, which makes the network more vulnerable on these examples.

* We propose a novel and effective adversarial training (InfoAT) using the IB principle, and address the problem of selecting hard example with high mutual information. To the best of our knowledge, it has not been studied yet.

* We show the effectiveness of InfoAT by different networks and datasets. Specifically,
under the most common comparison setting (PGD attack with 20 steps on CIFAR- 10, with  $L_\infty$ perturbation $\epsilon=8/255$), InfoAT achieves the state-of-the-art robustness of 60.46% with WideResNet, which improves $\sim 7\%$ over standard AT [16], $\sim 6\%$ over GanDef [19], $\sim4\%$ over TRADES [15] and $\sim2\%$ even over MART [22].

§ BACKGROUND AND RELATED WORK

§.§ Base Classifier

For a $K$-class ($K\geq 2$) classification problem, denote a dataset $\{(\bm{x}_i ,y_i)\}_{i=1,\cdots,n}$ with distribution $\bm{x}_i \in \mathbb{R}^d $ as natural input and $y_i \in \{1,\cdots,K\}$ represents its corresponding true label, a classifier $h_{\bm{\theta}}$
with parameter $\bm{\theta}$ predicts the class label of an input example $\bm{x}_i$:

\begin{equation}
h_{\bm{\theta}}(\bm{x}_i)=\mathop {\arg\max}_{k=1,\cdots,K} \bm{p}_k(\bm{x}_i,\bm{\theta}),
\end{equation}

\begin{equation}
\bm{p}_k(\bm{x}_i,\bm{\theta})=\exp(\bm{z}_k(\bm{x}_i,\bm{\theta}))/ \sum_{k^\prime=1}^K \exp(\bm{z}_{k^\prime}(\bm{x}_i,\bm{\theta})),
\end{equation}

$\bm{z}_k(\bm{x}_i,\bm{\theta})$ is the network logits output with respect to class $k$, and $\bm{p}_k(\bm{x}_i,\bm{\theta})$ is the probability (softmax on logits) that $\bm{x}_i$ belonging to class $k$.

§.§ Adversarial Training

One of the most successful empirical defenses to date is adversarial training. It was first proposed in [3] and [4], where they showed that adding adversarial examples to the training set can improve the robustness against attacks. More recently, [16] formulated adversarial training as a min-max optimization problem and demonstrated that adversarial training with Project Gradient Descent (PGD) attack leads to empirical robust model. Specifically, the objective function of standard adversarial training (AT) is:

\begin{equation}
\label{equ:AT}
\mathcal{L}_{\rm AT}=\min \frac{1}{n} \sum_{i=1}^{n} \ell (\htheta(\hat \bx_i^{\prime}) ,y_i),
\end{equation}

\begin{equation}
\label{equ:ATX}
\hat \bx_i^{\prime} = \arg \max_{\bx_i^{\prime}\in \mathcal{B}_\epsilon(\bx_i)} \ell (\htheta(\bx_i^\prime),y_i),
\end{equation}

$\ell$($\cdot$) represents the loss function such as commonly used cross entropy loss, and $\mathcal{B}_\epsilon(\bm{x}_i)=\{\bm{x}_i^\prime:||\bm{x}_i^\prime-\bm{x}_i||_p\leq\epsilon\}$ denotes the $L_p$-norm ball centered at $\bm{x}_i$ with radius $\epsilon$. In this work, we only focus on the $L_\infty$-norm.

Based on the primary AT framework, the recent researches have proposed many improvements from different perspectives, and demonstrated strong performance.
TRADES [15] trades adversarial robustness off against accuracy.

The objective function of TRADES is a linear combination of natural loss and regularization term. Its regularization term uses Kullback-Leibler (KL) divergence to constrain the output probability between the original example and its adversarial example.
The objective function of TRADES can be described as follows:

\begin{equation}
\begin{split}
\mathcal{L}_{\rm TRADES} = & \min \frac{1}{n} \sum_{i=1}^{n} \{\ell (\htheta(\bx_i),y_i)\\&+\lambda \cdot  \mathcal{\rm KL}(\bp(\bx_i,\btheta)||\bp(\hat \bx_i^\prime,\btheta))\},
\end{split}
\end{equation}

\begin{equation}
\hat \bx_i^{\prime} = \arg \max_{\bx_i^{\prime}\in \mathcal{B}_\epsilon(\bx_i)} \mathcal{\rm KL}(\bm{p}(\bm{x}_i,\btheta)||\bm{p}(\bx_i^\prime,\btheta)),
\end{equation}

\begin{equation}
\mathcal{\rm KL}(\bm{p}(\bm{x}_i,\btheta)||\bm{p}(\hat \bx_i^\prime,\btheta))=\sum_{k=1}^K \bm{p}_k(\bm{x}_i,\theta)\log \frac{\bm{p}_k(\bm{x}_i,\theta)}{\bm{p}_k(\hat\bx_i^\prime,\theta)}
\end{equation}

measures the difference of two distributions.
MART [22] gives the misclassified examples and correctly classified examples different weights during adversarial training and adopts a regularized adversarial loss involving both adversarial and natural examples.
The objective function of MART is as follows:

\begin{equation}
\begin{split}
&\mathcal{L}_{\rm MART}=\min \frac{1}{n}\sum_{i=1}^{n}\{{\rm BCE} (\htheta(\hat\bx_i^\prime),y_i) \\&+\lambda \cdot {\rm KL}(\bp(\bx_i,\btheta)||\bp(\hat\bx_i^\prime,\btheta)) \cdot (1-\bp_{y_i}(\bx_i,\btheta))\},
\end{split}
\end{equation}

\begin{equation}
\label{equ:MARTX}
\hat \bx_i^{\prime} = \arg \max_{\bx_i^{\prime}\in \mathcal{B}_\epsilon(\bx_i)} \ell (\htheta(\bx_i^\prime),y_i),
\end{equation}

where ${\rm BCE(\cdot)}$ is boosted cross-entropy loss proposed by [22],
and $\bp_{y_i}(\bx_i,\btheta)$ is the probability of $\bx_i$ belonging to class $y_i$.

§.§ Information Bottleneck (IB) Principle

Different from these methods, our method selects hard examples to efficiently improve the model robustness using the information bottleneck principle.

The Information bottleneck (IB) [24] is a principled method of finding a latent representation $Z$, which represents the information contained in the input variable $X$ about the output $Y$.
The mutual information of $X$ and $Z$ can be written as $I(X;Z)$.
$I(X;Z) ={\rm KL}(P_{XZ}||P_{X}P_{Z})$, where $P_{XZ}$ is the joint distribution and $P_{X}, P_{Z}$ are the marginal distributions of input variables $X,Z$, respectively.

Intuitively, $I(X;Z)$ measures the uncertainty of $X$ given $Z$. It not only reflects how much $Z$ compresses $X$ through $I(X;Z)$, but also reflects how well $Z$ predicts $Y$ through $I(Y;Z)$. In practice, this IB principle is achieved by minimizing the following IB Lagrangian:

\begin{equation}
\label{equ:IB}
\min \{I(X;Z)-\lambda \cdot I(Y;Z)\},
\end{equation}

where $\lambda$ represents a positive parameter, used to controls the trade-off between compression and prediction.

Through the compression item $I(X;Z)$ to control the amount of compression in $Z$, we can adjust the required features of the training model, such as  data augmentation [27], generalization error [26], and detection of out-of-distribution data [28].
In this paper, we use IB principle to select hard examples with high mutual information during adversarial training.
Specifically, we use $I(X=\bx_i;Z=\bz_i)$ to denote the point-wise mutual information [29] of the input $\bx_i$ and its latent representation $\bz_i$, which means the relevant information that $\bz_i$ provides about $\bx_i$ [24]. Hereafter, to avoid notational clutter, we will shorten $``X=\bx_i"$ to $\bx_i$, $``Z=\bz_i"$ to $\bz_i$ and $``Y=y_i"$ to $y_i$ in all conditionals and point-wise mutual information theoretic functions.

§ METHODS

§.§ Regularizations Using IB Principle

Note that the adversarial risk in Equations (<ref>)-(<ref>) treat all examples equally,

regardless of the different effects of these examples on the robustness of the model.

Therefore, the main idea of our paper is to apply the IB principle to adversarial training to exploit hard examples efficiently so as to improve the robustness of models.

According to Equation (<ref>),

when the natural input information cannot be well compressed by the model, the neural network cannot well generalize the out-of-distribution data, that is, the mutual information of the natural input and its related latent representation is very high,
as confirmed in Fig. <ref>.  Based on these observations, we consider adding the IB-weighted regularization of natural input to the standard cross-entropy loss.
The IB-weighted regularization on natural input is defined as follows:

\begin{equation}
\mathcal{L}_{\rm IB}(\bx,\btheta) =\frac{1}{n} \sum_{i=1}^{n}I(\bx_i;\bz_i) \cdot \mathds{1}(\htheta(\hat\bx_i^\prime) \neq \htheta(\bx_i)),
\end{equation}

where $\hat\bx_i^\prime$ is the “worst-case" adversarial examples with the $\epsilon$-ball of natural input $\bx_i$, $I(\bx_i;\bz_i)$ is the point-wise mutual information of the input $\bx_i$ and its latent representation $\bz_i$, which was used to select the hard examples (this will be large for hard examples and small for robust examples). $\mathds{1}(\htheta(\hat\bx^\prime) \neq \htheta(\bx))$ aims to encourage the output of neural network to be stable against example which has high mutual information.

$\mathds{1}(\htheta(\hat\bx_i^\prime) \neq \htheta(\bx_i))=1$ when $\htheta(\hat\bx_i^\prime) \neq \htheta(\bx_i)$, and $\mathds{1}(\htheta(\hat\bx_i^\prime) \neq \htheta(\bx_i))=0$ otherwise.

Moreover, [30] disentangles adversarial examples as a natural consequence of non-robust features. A common belief is that adversarial robustness comes from feature representations learned through adversarial examples [31, 30]. From this perspective, the network is expected to maintain more information of adversarial examples (robust features), i.e., the mutual information of the adversarial input and its associated latent adversarial representation should to be high. Therefore, the newly added adversarial regularization on adversarial examples is defined as follows:

\begin{equation}
\label{equ:reg}
\mathcal{L}_{\rm Reg}(\hat\bx^\prime,\btheta) = \frac{1}{n}\sum_{i=1}^{n}-I(\hat\bx_i^\prime;\hat\bz_i^\prime),
\end{equation}

where $I(\hat \bx_i^\prime;\hat\bz_i^\prime)$ is the point-wise mutual information of the adversarial example $\hat \bx_i^\prime$ and its latent representation $\hat\bz_i^\prime$.

Finally, by combining the proposed IB-weighted regularization and adversarial regularization in the adversarial training framework, we can train a network by proposed InfoAT that minimizes the following risk:

\begin{equation}
\begin{split}
\mathcal{L}_{\rm min}(\bx,\btheta)& = \min_\btheta \frac{1}{n} \sum_{i=1}^{n} \{\ell (\htheta(\hat \bx_i^\prime),y_i)\\&+\lambda \cdot I(\bx_i;\bz_i) \cdot \mathds{1}(\htheta(\hat \bx_i^\prime) \neq \htheta(\bx_i))  \\&-\beta \cdot I(\hat \bx_i^\prime;\hat\bz_i^\prime) \},
\end{split}
\end{equation}

where $\lambda,\beta$ are tunable scaling parameters which are fixed for all training examples, $\ell(\cdot)$ is the standard cross-entropy loss. Next, we will describe how to generate the “worst-case" adversarial example $\hat \bx_i^\prime$ in our InfoAT.

Adversarial training using the information bottleneck principle (InfoAT)

Input: $\{\bx_i,y_i\}_{i=1\cdots n}$: training data; $T_O$: outer iteration number; $T_I$: inner iteration step; $\epsilon$: maximum perturbation; $\alpha_I$: step size for inner optimization; $\alpha_O$: step size for outer optimization; $m$: the number of each batch size; $\lambda$ and $\beta$: tunable scaling parameter.

Initialization: Standard random initialization of $\htheta$

Output: Robust classifier $\htheta$
[1]
$t=1,\cdots T_O$
Uniformly sample a minibatch of training data $B^{(t)}$
$\bx_i\in B^{(t)}$
$\bx_i^\prime=\bx_i+\epsilon\cdot \xi$, with $\xi \sim \mathcal{U}(-1,1)$
# $\mathcal{U}$ is a uniform distribution
$\bx_i^\prime \leftarrow \Pi_{\mathcal{B}_\epsilon(\bx_i)}(\bx_i^\prime+\alpha_I\cdot {\rm sign}(\nabla_{\bx_i^\prime} {\rm CE}(\bp(\bx_i^\prime),y_i)+\lambda \nabla_{\bx_i^\prime}H(\bp(\bx_i)) \cdot ||\bp(\bx_i^\prime) -\bp(\bx_i)||_2^2 ))$
# $\Pi(\cdot)$ is the projection operator
$\hat \bx_i^\prime \leftarrow \bx_i^\prime$
$\btheta \leftarrow \btheta-\alpha_O\frac{1}{m}\sum_{\bx_i\in B^{(t)}} \nabla_\btheta\{ -\beta \cdot H(\bp(\hat \bx_i^\prime)) +{\rm CE} (\bp(\hat \bx_i^\prime),y_i) +\lambda \cdot H(\bp(\bx_i)) \cdot ||\bp(\hat \bx_i^\prime) -\bp(\bx_i)||_2^2
\}$

Standard adversarial training essentially minimizes a lower bound on the inner maximum “worst-case" loss, which will mislead an optimizer to search for a local optimal value [32]. To alleviate this pessimism, we also consider to incorporate IB regularization into maximization phase.
In maximization phase, the model parameters $\btheta$ are fixed, and $\bz_i$ is a deterministic representation of input $\bx_i$, i.e., any given input is mapped to a fixed representation. Consequently, it holds that $I(\bx_i,\bz_i)$ is a different constant for different input $\bx_i$.

Therefore, the IB regularization can be used to search more out-of-distribution adversarial data (i.e., the mutual information of its natural example is high) in the maximization phase.
From this perspective, we extend the proposed IB regularization to maximization phase to search for the “worst-case" (i.e., more out-of-distribution) data to improve model robustness.
We have verified its effectiveness in experiments.
The generation of $\hat \bx_i^\prime$ can be defined as:

\begin{equation}
\label{equ:advexp}
\begin{split}
\hat \bx_i^{\prime} &= \arg \max_{\bx_i^{\prime}\in \mathcal{B}_\epsilon(\bx_i)} \{\ell (\htheta(\bx_i^\prime),y_i) \\&+\lambda \cdot I(\bx_i;\bz_i) \cdot \mathds{1}(\htheta(\bx_i^\prime) \neq \htheta(\bx_i))\}.
\end{split}
\end{equation}

§.§ Optimization for InfoAT

As analysed in previous section, we derived the adversarial risk of InfoAT based on point-wise mutual information (i.e., $I(\bx_i;\bz_i)$, $I(\hat\bx_i^\prime;\hat\bz_i^\prime)$) and 0-1 loss (i.e., $\mathds{1}(\htheta(\bx_i^\prime) \neq \htheta(\bx_i)))$. However, mutual information in example-level is shown to be intractable in the literature [33, 34] since $\bz_i$ is high dimensional and optimization over 0-1 loss is also difficult, therefore directly optimizing this objective is challenging. We then propose the optimization strategies, by surrogating mutual information with entropy, and replacing 0-1 loss with proper distance function, which are both physically meaningful and computationally tractable.

§.§.§ Surrogating Mutual Information with Entropy

A variety of methods have been proposed for estimating mutual information [35, 36, 37]. One of the most effective estimators is the mutual information neural estimator (MINE) [33]. It proves that, for all $\eta \ge 0$, there exists $M \in \mathbb{Z}$ that satisfies certain constraints, such that for any $m \geq M$, $|\hat{I}_m(X;Z)-I(X;Z)|\leq \eta$ almost holds, where $m$ is the number of sampling examples.

However, our work exploits mutual information of each example (instead of on $m\geq M$ examples) to select the hard example. From this perspective, MINE may not be applicable in our case.
On example-level, the mutual information $I(\bx_i,\bz_i)$ for example $\bx_i$ is still intractable.

Our approach in this paper is that, when in the task of classification scenarios, $I(\bx_i;\bz_i)$ can be effectively approximated during training. As we will show, this process can be effectively realized by the entropy $H(\tilde y_i)$ predicted by the network, which is a tractable lower bound of $I(\bx_i;\bz_i)$,
$H(\cdot)$ is the Shannon entropy and $\tilde{y_i}$ is the output prediction of current model $\htheta(\cdot)$.

As described in  [26], a deep neural network can be viewed as a Markov chain of continuous representation of the input, where the information flow follows the following structure: $x_i \rightarrow z_i \rightarrow \tilde{y}_i$, where $\tilde{y}_i$ is network prediction.
According to the data processing inequality [38], $I(x_i;z_i) \geq I(x_i;\tilde{y}_i)$ can be got, where $I(x_i; \tilde{y}_i) =H(\tilde{y}_i)-H(\tilde{y_i}|x_i)$.
In other words, when calculating mutual information during the adversarial training process, the model parameter $\btheta$ is fixed, and any given input $x_i$ is mapped to a single class. That is, $H(\tilde{y_i}|x_i)=0$. After putting all these together, we have the following proposition.

Consider a deterministic neural network, the parameter $\btheta$ of which is fixed. Given an input $x_i$, a network prediction $\tilde{y}_i$, and a latent representation $z_i$. Then, the entropy $H(\tilde{y}_i)$ is the lower bound of the mutual information $I(x_i;z_i)$, i.e.,

\begin{equation}
I(x_i;z_i) \geq I(x_i;\tilde{y}_i) =H(\tilde{y}_i) -H(\tilde{y_i}|x_i) =H(\tilde{y}_i).
\end{equation}

There are two important benefits of surrogating mutual information with entropy to be discussed. First, $H(\tilde{y}_i)$ is the lower bound of $I(x_i;z_i)$, so it is the most representative term for choosing hard example which is non-robust to adversarial attack (i.e., a high entropy example indicates a high mutual information). Besides, $H(\tilde{y}_i)$ can be easily computed from the softmax output of a classification network.
Therefore, for point-wise mutual information, we surrogate $I(\bx_i;\bz_i)$ with $H(\bp(\bx_i))$, $I(\hat\bx_i^\prime;\hat\bz_i^\prime)$ with $H(\bp(\hat \bx_i^\prime))$.

[The choice of $\lambda$]

[The choice of $\beta$]

The sensitivities to parameters $\lambda$ and $\beta$. The units of “Test robustness" is (%). The dataset is CIFAR-10. The model is ResNet-18. The attack method is PGD with 20 steps.

Robustness (%) and accuracy (%) based on MINE estimation mutual information on different parameter $\lambda$, where $\beta=0.2$.

$\lambda$     Natural     $\rm PGD^{20}$

5*layer #1     0.5     84.42     56.71

1.0     84.53     56.79

1.5     84.69     57.21

2.0     82.52     56.09

5*layer #2     1.0     84.43     57.02

1.5     84.74     56.88

2.0     83.93     57.29

2.5     83.36     57.73

3.0     83.30    57.46

5*layer #3     1.0     83.90     57.07

1.5     84.23     57.55

2.0     83.31     57.54

2.5     83.20     57.55

3.0     83.36    57.74

5*layer #4     1.0     84.15    57.39

1.5     83.86     57.76

2.0     83.92     57.67

2.5     83.62     57.46

3.0     83.90    57.40

[Mutual information estimation]

[Different weighting methods]

[Different divergences]

[Different regularizations]

The comprehensive ablation experiments of InfoAT. In (a), $l \in \{\#1,\#2,\#3,\#4\}$ represent the mutual information estimated by MINE on different layer latent representations $\bz^{(l)}$, and $\#5$ represents the mutual information surragoted by entropy based on softmax output on the last layer $\#5$. In (b), (c), and (d), the red line represents our InfoAT method.
The dataset is CIFAR-10. The model is ResNet-18. The attack method is PGD with 20 steps.

White-box robustness (accuracy (%) on white-box test attacks, $\epsilon=8/255$) on CIFAR-10, CIFAR-100, and SVHN with the ResNet18.

Dataset     Model     Natural     FGSM    $\rm PGD^{20}$     $\rm PGD^{100}$     $\rm PGD^+$     $\rm CW_\infty^{20}$     $\rm CW_\infty^{100}$    BPDA    $\rm InfoPGD^{20}$   AA

6*CIFAR-10    GanDef    86.31   63.63   49.25   44.71   45.09   49.44   45.62   48.18   47.57   47.13

AT     83.56     63.21    51.47     49.54     49.71     51.23     49.51     52.91   52.29   47.25

TRADES     82.21     63.40     53.92     52.66     52.57     51.81     50.56     54.42   54.49   49.59

MART     79.24     63.74     56.01     54.79     54.62     51.12     49.76     56.07   56.63    48.45

MART+     79.52   64.19   56.69   55.22   55.10   51.37   50.01   55.67   56.17   48.50

InfoAT (Ours)     83.23     67.23     57.95     56.15     56.14     52.91     51.17     56.84   57.08    49.67

6*CIFAR-100     GanDef    65.15   38.52   27.67   25.86   25.70   26.38   25.24   26.60   26.31   22.03

AT    57.28    35.10     26.46     25.10     25.10     25.25     24.47     30.80   30.58    22.89

TRADES     55.27     35.32     28.89     28.01     27.80     25.88     25.26     30.97   31.13    24.56

MART     53.91     38.72     33.03     32.61     32.46     29.01     28.45     33.10   33.48    26.67

MART+     47.84   36.96   32.30   31.93   31.82   27.00   26.62   31.94   32.73   26.50

InfoAT (Ours)     58.23     40.62     34.08      33.39     33.06     29.51     28.68    33.43   33.92    26.76

6*SVHN     GanDef    93.25   73.89   56.86   52.74   52.76   55.19   51.84   55.53   58.96   47.00

AT     89.97     69.63    54.78     51.61     51.76     50.87     48.78     53.53   53.02    46.99

TRADES     89.26     71.43     58.01     55.87     55.51     54.77     52.97    57.03   60.74    50.82

MART     92.76     76.67     62.46     59.42     58.87     56.95     53.98     63.56   65.40    49.25

MART+     90.28   73.58   62.67   60.62   60.39   57.15   54.54   61.84   64.68   50.15

InfoAT (Ours)     92.37     76.91     63.16     60.72     60.14     57.22     54.64     64.37   67.05    51.37

Black-box robustness (accuracy (%)) on CIFAR-10 with ResNet18 under SPSA attack with different batch sizes and $\epsilon=8/255$.

Model     $\rm SPSA_{128}$     $\rm SPSA_{256}$     $\rm SPSA_{512}$     $\rm SPSA_{1024}$

GanDef    56.70   53.81   51.65   50.08

AT     58.23     55.77     53.90     52.74

TRADES     58.69     56.48     54.82     53.60

MART     57.41     55.50     53.84     52.52

MART+     57.73   55.62   53.20   52.58

InfoAT (Ours)     59.56     57.40     55.79     54.51

Weight loss surface across different methods on CIFAR-10 with ResNet18.

§.§.§ Replacing 0-1 Loss with Distance Function

For the 0-1 indicator function $\mathds{1}(\htheta(\bx_i^\prime) \neq \htheta(\bx_i))$, we use Mean Square Error (MSE) divergence as the surrogate loss function [39],
since $\htheta(\bx_i^\prime) \neq \htheta(\bx_i)$ represents that the output distributions of the adversarial example and the natural example are different. Thus, we have

\begin{equation}
{\rm{MSE}}(\bx_i^\prime, \bx_i) = ||\bp(\bx_i^\prime) -\bp(\bx_i)||_2^2.
\end{equation}

This will be large when the difference of distribution on adversarial examples and natural examples is high, and small otherwise.

§.§ The Overall Objective Function

Based on the above surrogate loss functions, we can illustrate the final objective function of InfoAT we proposed:

\begin{equation}
\label{equ:ob}
\begin{split}
\mathcal{L}_{\rm InfoAT}(\bx,\btheta) &=\min_{\btheta}\frac{1}{n}\sum_{i=1}^{n} \{
{\rm CE} (\bp(\hat \bx_i^\prime),y_i) \\ &+\lambda \cdot H(\bp(\bx_i)) \cdot ||\bp(\hat \bx_i^\prime) -\bp(\bx_i)||_2^2 \\&-\beta \cdot H(\bp(\hat \bx_i^\prime))
\},
\end{split}
\end{equation}

\begin{equation}
\begin{split}
\hat \bx_i^{\prime} &= \arg \max_{\bx_i^{\prime}\in \mathcal{B}_\epsilon(\bx_i)} \{{\rm CE} (\bp(\bx_i^\prime),y_i) +\\&\lambda \cdot H(\bp(\bx_i)) \cdot ||\bp(\bx_i^\prime) -\bp(\bx_i)||_2^2 \},
\end{split}
\label{equ:findadv}
\end{equation}

${\rm CE}(\cdot)$ is the cross-entropy loss. $\lambda,\beta$ are tunable scaling parameters used to balance three parts of the final loss, which are fixed for all training examples.

Algorithm <ref> describes the complete training procedure of InfoAT.

§ EXPERIMENTS

In this section, first we conduct a large number of ablation studies to fully understand our proposed InfoAT, and then we evaluate its robustness on the benchmark datasets under the black-box and white-box settings. Finally, we use the WideResNet to benchmark the state-of-the-art robustness and use unlabeled data for further robustness evaluation of our method.

Experimental Setup Three commonly used datasets (i.e., CIFAR-10, CIFAR-100 and SVHN) and two networks (i.e., ResNet18 and WideResNet-34-10) are utilized in our experiments.
All the models with three datasets are trained using SGD, the momentum is 0.9, weight decay is $3.5 \times 10^{-3}$, and the initial learning rate is 0.01, which is divided by 10 at the 75-th, 90-th, and 100-th epoch. The attack used for training is ${\rm PGD}^{10}$ (PGD attack with 10 steps) with random start. The maximun perturbation $\epsilon=8/255$ and step size $\epsilon/4$, while the test attack is $\rm PGD^{10}$ with random start unless otherwise stated.

We perform all experiments on a desktop PC using a single GeForce RTX 2080 Ti GPU and 12-core Intel(R) Core(TM) i7-8700 CPU @ 3.20GHz. We implement training and certification in PyTorch.

§.§ Ablation Study

Here, we first investigate the parameter $\lambda \in [0,8]$ and $\beta \in [0.1,2.0]$ in InfoAT objective function. We present the results of $\lambda$ and $\beta$ in Fig. <ref> and Fig. <ref>, respectively. InfoAT achieves good robustness across different choices of $\lambda$ and $\beta$. We choose $\lambda = 2.5, \beta=0.2$ for further experiments.

Plot of the loss surface of an InfoAT trained model on perturbed images $\bx_i^\prime, i \in \{1,2,3,4,5,6,7,8,9,10\}$. The dataset is CIFAR-10. The model is ResNet-18.

Average decision boundary (ADBD) and robust accuracy (Rob.Acc) of defense methods against black-box hard-label RayS attack.
c ccccc c cc
3*Methods    5cCIFAR-10        2cSVHN

(lr)2-6 (lr)8-9
2cResNet18         2cWideResNet         2cResNet18

(lr)2-3 (lr)5-6 (lr)8-9
ADBD     Rob.Acc         ADBD     Rob.Acc         ADBD     Rob.Acc

GanDef    0.0328   49.60      0.0376   55.10      0.0367   50.00

AT     0.0361     53.30         0.0371     54.20         0.0355     49.80

TRADES     0.0379     51.90         0.0402     55.20         0.0383     52.80

MART     0.0374     52.60         0.0399     56.50         0.0374     53.30

InfoAT (Ours)     0.0380     56.20         0.0402     56.50         0.0378     53.60

Then, we investigate InfoAT from four aspects: (1) Evaluating the effectiveness of surrogating mutual information with entropy, (2) employing different weighting methods, (3) replacing divergence of InfoAT, (4) exploring different regularizations in the outer minimization.

The effectiveness of surrogating mutual information with entropy
In this part, we evaluate the effectiveness of our method (i.e., surrogating mutual information with entropy) by comparing with MINE.
MINE is a method estimates the mutual information of $m \geq M$ examples. Therefore, we regularize each batch of $m$ examples with the same mutual information estimated by MINE, as shown below:

\begin{equation}
\frac{1}{n}\sum_{i=1}^{b}\sum_{j=1}^{m} I(\bx_{i:};\bz_{i:}) \mathds{1}(\htheta(\bx_{ij}^\prime) \neq \htheta(\bx_{ij})),
\end{equation}

where $b$ is the number of batch, $m$ is the number of examples in each batch,  $I(\bx_{i:};\bz_{i:})$ represents the mutual information on batch $i$.
Here, we show the results of model robustness and accuracy based on MINE estimation mutual information on different parameter $\lambda$ in TABLE <ref>, where $\{\#1,\#2,\#3,\#4\}$ represent the mutual information estimated by MINE on different layer latent representations $\bz^{(l)}, l \in \{\#1,\#2,\#3,\#4\}$. The other settings are the same as the InfoAT.

The best model robustness of mutual information estimated by MINE and surrogated by entropy is shown in Fig. <ref>, where $\#5$ represents the mutual information surragoted by entropy based on softmax output on the last layer $\#5$.
From Fig. <ref> we can observe, surrogating mutural information with entropy (i.e., red bar) leads to a significant robustness improvement compared with any other MINE estimation mutual information.

Employing different weighting methods. Instead of the weighting method which selects hard examples with high mutual information, we also evaluate the effect of other methods (i.e., unweighted (giving all examples the same weight) and misclassification aware weighting method [22]) in Fig. <ref>.
Fig. <ref> shows that the robustness of model is higher by using entropy ($H(x\_{nat})$, red line) than unweighted ($None$, green line) or misclassification aware ($1-p(x\_{nat})$, orange line), which indicates the effectiveness of our claim that using mutual information (lower bounded by entropy) to select hard examples.

Replacing divergence of InfoAT. As we show in Fig. <ref>, when the MSE divergence (red line) is replaced by Jensen-Shannon (JS, orange line) [40], Cross-entropy (CE, green line) [41], and Kullback-Leibler divergence (KL, blue line) [42], the final robustness decreases by a substantial amount. It suggests that learning with MSE rather than other divergences can constrain the distribution of adversarial example with its natural example more efficiently.

Exploring different regularization in the outer minimization. Here, we show the contribution of our proposed regularization (i.e., $-I(\hat\bx_i^\prime;\hat\bz_i^\prime)$ in Equation (<ref>) as well as $-H(\bp(\hat{\bx_i}^\prime))$ in Equation (<ref>)) to the final robustness. Specifically, we perform five regularization terms of natural examples (i.e., $+H(x\_{nat})$ with orange line, $-H(x\_{nat})$ with purple line), adversarial examples (i.e., $+H(x\_{adv})$ with green line, $-H(x\_{adv})$ with red line)  and no regularization (i.e., $None$ with blue line) in Fig. <ref>. As can be observed, the robustness can be improved steadily by our proposed regularization (red line). This verifies the effectiveness of our regularization, i.e., improving the mutual information of adversarial example with its associated representation during training.

White-box robustness (accuracy (%) on white-box test attacks, $\epsilon=8/255$) on CIFAR-10 and CIFAR-100 with WideResNet-34-10.

Dataset     Model     Natural    FGSM    $\rm PGD^{20}$     $\rm PGD^{100}$     $\rm PGD^+$     $\rm CW_\infty^{20}$     $\rm CW_\infty^{100}$     BPDA    $\rm InfoPGD^{20}$   AA

6*CIFAR-10     GanDef    88.78   68.04   55.68   52.84   52.98   54.34   52.19   54.43   53.83   48.20

AT     87.05     66.58     53.56     51.22     51.53     53.54     51.67     56.05   56.26   49.70

TRADES     84.93     66.95     56.48     54.72     54.63     54.61    53.48     57.30   57.53   52.35

MART     84.10     67.14     58.29     56.77     56.67     54.49     53.02     57.16   57.59   51.64

MART+     84.22   68.43   59.50   57.75   57.73   55.26   53.34   58.60   58.91   51.70

InfoAT (Ours)     85.62     68.91     60.46     59.17     59.00     55.32     54.07     59.54   60.09   52.86

6*CIFAR-100     GanDef    68.68   41.04   29.17   26.36   26.64   29.85   29.55   27.84   27.66   24.05

AT     60.86     36.63     27.67     26.12     26.20     27.10     26.38    32.48   32.55    24.51

TRADES     56.75     37.91     31.31     30.41     30.27     28.22     27.78     31.91   32.20   27.09

MART     56.07     40.10     34.84     33.60     33.39     30.91     30.32     34.20   34.99   28.53

MART+     53.76   40.59   35.12   34.55   34.38   29.88   29.03   34.52   35.64   28.62

InfoAT (Ours)     60.29     42.85     35.55     34.89     34.69     31.37     30.74    34.37   37.05   28.99

White-box robustness (%) on WideResNet-28-10 with 500K unlabeled data.

Model     Natural     $\rm PGD^{20}$

UAT++     86.21    62.76

RST     90.60    63.60

MART     90.20    64.80

InfoAT (Ours)     90.00     65.40

§.§ Robustness Evaluation and Analysis

In this part, we evaluate the robustness of InfoAT on CIFAR-10, CIFAR-100 and SVHN datasets with ResNet18 against various white-box and black-box attacks.

We consider five types of representative adversarial training methods here: 1) AT [16], 2) TRADES [15], and 3) MART [22], 4) MART+ (replacing 1-prob in MART [22] with the proposed mutual information weight), and 5) GanDef [19], following their original papers.

White-Box robustness

The robustness of all defense models is evaluated against nine types of attacks:
FGSM, $\rm PGD^{20}$, $\rm PGD^{100}$ (20-step/100-step PGD with step size $\epsilon/4$), $\rm PGD^+$ ($\rm PGD^+$ is PGD with five random restarts, and each restart has 40 steps with step size 0.01, which keeps the same as [17]), $\rm CW_{\infty}^{20}$, $\rm CW_{\infty}^{100}$
($L_\infty$ version of CW optimized through $\rm PGD^{20}/ \rm PGD^{100}$), BPDA [43], $\rm InfoPGD^{20}$ (20-step adaptive PGD attack [44] using Equation (<ref>) to find adversarial examples),
and Auto Attack (AA) [45], which is a powerful and reliable attack that integrates many parameter-free attacks to evaluate the robustness of the network. AA includes three white-box attacks (APGD-CE, APGD-DLR and FAB [46]) and a black-box attack (Square Attack [47]).
All attacks are subject to the same $L_\infty$ perturbation limit, specifically, $\epsilon=8/255$.
TABLE <ref> shows the white-box robustness of all defense models, where “Natural” represents the accuracy on natural test images.
From TABLE <ref> we can observe, InfoAT achieves the best robustness against all nine types of attacks on all CIFAR-10, CIFAR-100 and SVHN datasets.
For example, on CIFAR-10 dataset, when attacked by BPDA, InfoAT achieves 56.84% defense accuracy, which is much higher than that (48.18%) on GanDef. When we apply the adaptive $\rm InfoPGD^{20}$ attack, we get a accuracy of
33.92% for InfoAT on CIFAR-100, which is still higher than the accuracy of 30.58% for AT.
Furthermore, compared with MART, we can observe that MART+ further improves the robustness of the model (e.g., on SVHN dataset, the accuracy of MART+ is 57.15% when attacked by $\rm CW_{\infty}^{20}$, while the accuracy of MART is 56.95%).
This verifies the effectiveness of using mutual information to weight examples.
It should be noted that the InfoAT robustness improvement is not caused by the so-called “obfuscated gradients” [43]. This can be verified from three phenomenons: (1) strong test attacks (e.g., $\rm PGD^{20}$) have higher success rates (lower accuracies) than weak test attacks (e.g., FGSM), and (2) InfoAT can defense AA effectively (i.e., InfoAT achieves 49.67% accuracy when attacked by AA on CIFAR-10 dataset).
(3) Following [48],
we plot the adversarial loss change by moving the weight $\bw$ along a random direction $d$ with magnitude $\delta$ to visualize the weight loss surface.
As presented in Fig. <ref>, the weight loss surface is flatter (red line) than AT (blue line), TRADES (orange line), and MART (green line). This indicates the effectiveness and stablity of our proposed InfoAT.

(4) Fig. <ref> shows the loss surfaces of our proposed InfoAT trained model on perturbed images of the form $\bx_i^\prime=\bx_i+\delta_1v+\delta_2r$, obtained by varying $\delta_1$ and $\delta_2$. We craft $\rm PGD^{10}$ perturbation as the normal direction $v$, and $r$ be a random direction, under the $L_\infty$ constraint of $8/255$. From Fig. <ref> we can observe, the loss surfaces of InfoAT trained model on perturbed images are smooth, which reveals the fact that the robustness improvement of our proposed InfoAT is not caused by gradient obfuscation.

Black-Box robustness

We utilize SPSA [49] to perform query-based black box attacks. To estimate the gradients, we set the batch size to 128, 256, 512, and 1024, the learning rate to 0.01, and the perturbation size to 0.001. SPSA attacks are run for 100 iterations, and early-stop when it caused misclassification.
TABLE <ref> shows the experiment results.
Our method obtains better robustness over other five methods in each setting. The results verify InfoAT reliably improves the robustness rather than causing gradient masking.

We further perform more black-box attack using hard-label attack RayS [50].
We record the Average Decision Boundary Distance (ADBD) and robust accuracy (Rob.Acc) against RayS in TABLE <ref>. On CIFAR-10 dataset, InfoAT achieves maximum ADBD and best robust accuracy within ResNet18 and WideResNet-34-10. On SVHN, InfoAT also achieves competitive ADBD and best robust accuracy.

These analysis verify that InfoAT improves adversarial robustness effectively rather than  gradient obfuscation or masking.

§.§ Benchmarking the State-of-the-Art Robustness

In this part, we conduct more experiments on the large-capacity network WideResNet to arrive at a state-of-the-art robustness benchmark. In addition, we also used unlabeled data for further robustness evaluation.

Performance on WideResNet

We evaluate the robustness of our proposed InfoAT defense method more comprehensively on the WideResNet-34-10 network, and given the state-of-the-art robustness benchmarks on the CIFAR-10 and CIFAR-100 datasets. TABLE <ref> shows the results of our experiment.
As shown in the TABLE <ref>,
the InfoAT we proposed is superior to all baseline methods in terms of robustness. Especially under the $\rm PGD^{20}$ attack on CIFAR-10, which is the most common comparison setting. InfoAT improves $\sim 7\%$ over standard AT, $\sim 6\%$ over GanDef, $\sim4\%$ over TRADES and $\sim2\%$ even over MART. For CIFAR-100, a similar improvement trend can also be observed.

Boosting with additional unlabeled data In this part, the effectiveness of proposed InfoAT is evaluated on semi-supervised version.
Following the exact settings in UAT++ [51], RST [17], and MART, we compare the robustness of InfoAT with them on WideResNet-28-10 against $\rm PGD^{20}$ respectively. The dataset is CIFAR-10 with 500K unlabeled data, which is extracted from the 80 Million Tiny Images dataset [52].
As confirmed in TABLE <ref>, our proposed InfoAT also achieves the best robustness (e.g., 65.4% accuracy on WideResNet-28-10 against $\rm PGD^{20}$ with 500K unlabeled data). This again verifies the benefit of exploiting mutual information to select “hard" examples for improving robustness, and further
provess the superiority of our proposed method.

§ CONCLUSION

In this paper, inspired by information bottleneck (IB) principle, we showed that the example with high mutual information is more likely to be attacked.
Based on this observation, we designed a novel and effective adversarial training using the IB principle (InfoAT), which encourages the network to find hard examples with high mutual information and guarantee them to be robust against attackers, thus improving the robustness of model.

As the experimental results show, with respect to the state-of-the-ar technology, InfoAT can significantly improve adversarial robustness, and it can also achieve the best robustness in semi-supervised task.
In the future,
we plan to
investigate the trade-off between robustness and natural accuracy on adversarial training, and
exploit the different impact of examples to improve the robustness as well as accuracy of models efficiently.

§ ACKNOWLEDGMENT

This work was supported by the National Natural Science Foundation of China (Nos. 62136004, 61876082, 61732006), the National Key R&D Program of China (Grant Nos. 2018YFC2001600, 2018YFC2001602), and also by the CAAI-Huawei MindSpore Open Fund.

[1]
A. Krizhevsky, I. Sutskever, and G. E. Hinton, “Imagenet classification with
deep convolutional neural networks,” Advances in neural information
processing systems, vol. 25, pp. 1097–1105, 2012.

[2]
Y. Taigman, M. Yang, M. Ranzato, and L. Wolf, “Deepface: Closing the gap to
human-level performance in face verification,” in Proceedings of the
IEEE conference on computer vision and pattern recognition, 2014, pp.

[3]
C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and
R. Fergus, “Intriguing properties of neural networks,” in
International Conference on Learning Representations, 2014.

[4]
I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing
adversarial examples,” in International Conference on Learning
Representations, 2015.

[5]
J. Levinson, J. Askeland, J. Becker, J. Dolson, D. Held, S. Kammel, J. Z.
Kolter, D. Langer, O. Pink, V. Pratt et al., “Towards fully
autonomous driving: Systems and algorithms,” in 2011 IEEE Intelligent
Vehicles Symposium (IV).1em plus 0.5em minus 0.4emIEEE, 2011,
pp. 163–168.

[6]
C. Chen, A. Seff, A. Kornhauser, and J. Xiao, “Deepdriving: Learning
affordance for direct perception in autonomous driving,” in
Proceedings of the IEEE international conference on computer vision,
2015, pp. 2722–2730.

[7]
M. Xu, T. Zhang, Z. Li, M. Liu, and D. Zhang, “Towards evaluating the
robustness of deep diagnostic models by adversarial attack,” Medical
Image Analysis, vol. 69, p. 101977, 2021.

[8]
J. A. Marpaung, M. Sain, and H.-J. Lee, “Survey on malware evasion techniques:
State of the art and challenges,” in 2012 14th International
Conference on Advanced Communication Technology (ICACT).1em plus
0.5em minus 0.4emIEEE, 2012, pp. 744–749.

[9]
C. Guo, M. Rana, M. Cisse, and L. van der Maaten, “Countering adversarial
images using input transformations,” in International Conference on
Learning Representations, 2018.

[10]
D. Meng and H. Chen, “Magnet: a two-pronged defense against adversarial
examples,” in Proceedings of the 2017 ACM SIGSAC conference on
computer and communications security, 2017, pp. 135–147.

[11]
J. Buckman, A. Roy, C. Raffel, and I. Goodfellow, “Thermometer encoding: One
hot way to resist adversarial examples,” in International Conference
on Learning Representations, 2018.

[12]
Z. Zou, T. Shi, Z. Shi, and J. Ye, “Adversarial training for solving inverse
problems in image processing,” IEEE Transactions on Image Processing,
vol. 30, pp. 2513–2525, 2021.

[13]
B. Sun, N.-h. Tsai, F. Liu, R. Yu, and H. Su, “Adversarial defense by
stratified convolutional sparse coding,” in Proceedings of the
IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2019, pp.
11 447–11 456.

[14]
X. Zhang, J. Wang, T. Wang, R. Jiang, J. Xu, and L. Zhao, “Robust feature
learning for adversarial defense via hierarchical feature alignment,”
Information Sciences, vol. 560, pp. 256–270, 2021.

[15]
H. Zhang, Y. Yu, J. Jiao, E. Xing, L. El Ghaoui, and M. Jordan, “Theoretically
principled trade-off between robustness and accuracy,” in
International Conference on Machine Learning, 2019, pp. 7472–7482.

[16]
A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep
learning models resistant to adversarial attacks,” in International
Conference on Learning Representations, 2018.

[17]
Y. Carmon, A. Raghunathan, L. Schmidt, and J. Duchi, “Unlabeled data improves
adversarial robustness,” Advances in neural information processing
systems, 2019.

[18]
H. Zhang and J. Wang, “Defense against adversarial attacks using feature
scattering-based adversarial training,” Advances in Neural Information
Processing Systems, vol. 32, pp. 1831–1841, 2019.

[19]
G. Liu, I. Khalil, and A. Khreishah, “Gandef: A gan based adversarial training
defense for neural network classifier,” in IFIP International
Conference on ICT Systems Security and Privacy Protection.1em plus
0.5em minus 0.4emSpringer, 2019, pp. 19–32.

[20]
G. Liu, I. Khalil, and Khreishah, “Zk-gandef: A gan based zero knowledge
adversarial training defense for neural networks,” in 2019 49th Annual
IEEE/IFIP International Conference on Dependable Systems and Networks
(DSN).1em plus 0.5em minus 0.4emIEEE, 2019, pp. 64–75.

[21]
S. Park and J. So, “On the effectiveness of adversarial training in defending
against adversarial example attacks for image classification,” Applied
Sciences, vol. 10, no. 22, p. 8079, 2020.

[22]
Y. Wang, D. Zou, J. Yi, J. Bailey, X. Ma, and Q. Gu, “Improving adversarial
robustness requires revisiting misclassified examples,” in
International Conference on Learning Representations, 2019.

[23]
J. Zhang, J. Zhu, G. Niu, B. Han, M. Sugiyama, and M. Kankanhalli,
“Geometry-aware instance-reweighted adversarial training,” arXiv
preprint arXiv:2010.01736, 2020.

[24]
N. Tishby, F. C. Pereira, and W. Bialek, “The information bottleneck method,”
arXiv preprint physics/0004057, 2000.

[25]
A. Achille and S. Soatto, “Information dropout: Learning optimal
representations through noisy computation,” IEEE transactions on
pattern analysis and machine intelligence, vol. 40, no. 12, pp. 2897–2905,

[26]
R. A. Amjad and B. C. Geiger, “Learning representations for neural
network-based classification using the information bottleneck principle,”
IEEE transactions on pattern analysis and machine intelligence, 2019.

[27]
L. Zhao, T. Liu, X. Peng, and D. Metaxas, “Maximum-entropy adversarial data
augmentation for improved generalization and robustness,” in Advances
in neural information processing systems, 2020.

[28]
A. A. Alemi, I. Fischer, and J. V. Dillon, “Uncertainty in the variational
information bottleneck,” arXiv preprint arXiv:1807.00906, 2018.

[29]
R. A. Ince, “Measuring multivariate redundant information with pointwise
common change in surprisal,” Entropy, vol. 19, no. 7, p. 318, 2017.

[30]
A. Ilyas, S. Santurkar, L. Engstrom, B. Tran, and A. Madry, “Adversarial
examples are not bugs, they are features,” Advances in neural
information processing systems, vol. 32, 2019.

[31]
S. Santurkar, D. Tsipras, B. Tran, A. Ilyas, L. Engstrom, and A. Madry, “Image
synthesis with a single (robust) classifier,” Advances in Neural
Information Processing Systems, vol. 32, 2019.

[32]
H. Zhang, H. Chen, C. Xiao, S. Gowal, R. Stanforth, B. Li, D. Boning, and C.-J.
Hsieh, “Towards stable and efficient training of verifiably robust neural
networks,” in International Conference on Learning Representations,

[33]
M. I. Belghazi, A. Baratin, S. Rajeshwar, S. Ozair, Y. Bengio, A. Courville,
and D. Hjelm, “Mutual information neural estimation,” in
International Conference on Machine Learning, 2018, pp. 531–540.

[34]
J. Song and S. Ermon, “Understanding the limitations of variational mutual
information estimators,” in International Conference on Learning
Representations, 2019.

[35]
K. Kandasamy, A. Krishnamurthy, B. Poczos et al., “Nonparametric von
mises estimators for entropies, divergences and mutual informations,” in
Advances in neural information processing systems, 2015, pp. 397–405.

[36]
K. R. Moon, K. Sricharan, and A. O. Hero, “Ensemble estimation of mutual
information,” in 2017 IEEE International Symposium on Information
Theory (ISIT).1em plus 0.5em minus 0.4emIEEE, 2017, pp.

[37]
J. Walters-Williams and Y. Li, “Estimation of mutual information: A survey,”
in International Conference on Rough Sets and Knowledge
Technology.1em plus 0.5em minus 0.4emSpringer, 2009, pp.

[38]
T. M. Cover, Elements of information theory.1em plus 0.5em minus
0.4emJohn Wiley & Sons, 1999.

[39]
H. Kannan, A. Kurakin, and I. Goodfellow, “Adversarial logit pairing,”
arXiv preprint arXiv:1803.06373, 2018.

[40]
B. Fuglede and F. Topsoe, “Jensen-shannon divergence and hilbert space
embedding,” in International Symposium onInformation Theory, 2004.
ISIT 2004. Proceedings.1em plus 0.5em minus 0.4emIEEE, 2004,
p. 31.

[41]
P.-T. De Boer, D. P. Kroese, S. Mannor, and R. Y. Rubinstein, “A tutorial on
the cross-entropy method,” Annals of operations research, vol. 134,
no. 1, pp. 19–67, 2005.

[42]
T. Van Erven and P. Harremos, “Rényi divergence and kullback-leibler
divergence,” IEEE Transactions on Information Theory, vol. 60, no. 7,
pp. 3797–3820, 2014.

[43]
A. Athalye, N. Carlini, and D. Wagner, “Obfuscated gradients give a false
sense of security: Circumventing defenses to adversarial examples,”
arXiv preprint arXiv:1802.00420, 2018.

[44]
F. Tramer, N. Carlini, W. Brendel, and A. Madry, “On adaptive attacks to
adversarial example defenses,” Advances in Neural Information
Processing Systems, vol. 33, 2020.

[45]
F. Croce and M. Hein, “Reliable evaluation of adversarial robustness with an
ensemble of diverse parameter-free attacks,” arXiv preprint
arXiv:2003.01690, 2020.

[46]
——, “Minimally distorted adversarial examples with a fast adaptive
boundary attack,” in International Conference on Machine Learning,

[47]
M. Andriushchenko, F. Croce, N. Flammarion, and M. Hein, “Square attack: a
query-efficient black-box adversarial attack via random search,” in
European Conference on Computer Vision.1em plus 0.5em minus
0.4emSpringer, 2020, pp. 484–501.

[48]
D. Wu, S.-T. Xia, and Y. Wang, “Adversarial weight perturbation helps robust
generalization,” Advances in neural information processing systems,
vol. 33, 2020.

[49]
J. Uesato, B. O’donoghue, P. Kohli, and A. Oord, “Adversarial risk and the
dangers of evaluating against weak attacks,” in International
Conference on Machine Learning, 2018, pp. 5025–5034.

[50]
J. Chen and Q. Gu, “Rays: A ray searching method for hard-label adversarial
attack,” in Proceedings of the 26th ACM SIGKDD International
Conference on Knowledge Discovery & Data Mining, 2020, pp. 1739–1747.

[51]
J.-B. Alayrac, J. Uesato, P.-S. Huang, A. Fawzi, R. Stanforth, and P. Kohli,
“Are labels required for improving adversarial robustness?” arXiv
preprint arXiv:1905.13725, 2019.

[52]
A. Torralba, R. Fergus, and W. T. Freeman, “80 million tiny images: A large
data set for nonparametric object and scene recognition,” IEEE
transactions on pattern analysis and machine intelligence, vol. 30, no. 11,
pp. 1958–1970, 2008.


[2]E. Leason

1]Department of Physics, Lancaster University, Lancaster LA1 4YB, UK 2]
Department of Physics, Royal Holloway University of London, Egham, TW20 0EX,
UK 3] Department of Physics, University of Oxford, Oxford, OX1 3PJ, UK 4]
Department of Physics, University of Sussex, Brighton, BN1 9QH, UK

# QUEST-DMC: Background Modelling and Resulting Heat Deposit for a Superfluid
Helium-3 Bolometer

S. Autti  A. Casey  N. Eng  N. Darvishi  P. Franchini  R.P. Haley  P.J.
Heikkinen  A. Kemp<EMAIL_ADDRESS>L.V. Levitin  J. Monroe  J.
March-Russel  M.T. Noble  J.R. Prance  X. Rojas  T. Salmon  J. Saunders  R.
Smith  M.D. Thompson  V. Tsepelin  S.M. West  L. Whitehead  V.V. Zavjalov  K.
Zhang  D.E. Zmeev  [  [  [  [

###### Abstract

We report the results of radioactivity assays and heat leak calculations for a
range of common cryogenic materials, considered for use in the QUEST-DMC
superfluid 3He dark matter detector. The bolometer, instrumented with
nanomechanical resonators, will be sensitive to energy deposits from dark
matter interactions. Events from radioactive decays and cosmic rays constitute
a significant background and must be precisely modelled, using a combination
of material screening and Monte Carlo simulations. However, the results
presented here are of wider interest for experiments and quantum devices
sensitive to minute heat leaks and spurious events, thus we present heat leak
per unit mass or surface area for every material studied. This can inform
material choices for other experiments, especially if underground operation is
considered – where the radiogenic backgrounds will dominate even at shallow
depths.

##  1 Introduction

The nature of dark matter remains an open question in fundamental physics,
with extensive direct, indirect and collider searches all returning null
results. These searches have typically focused on GeV/c2 \- TeV/c2 mass
particle dark matter. An increasing number of experiments are also
investigating ultra-light boson dark matter with masses much below eV/c2,
using techniques to search for wavelike phenomena. However, low mass particle
dark matter in the intermediate mass range is not well constrained.

Superfluid helium is an attractive target for low mass dark matter searches
due to good kinematic matching, intrinsic radiopurity and small superfluid
energy gap. The Herald [1] and DELight [2] collaborations are investigating
the use of 4He target for a dark matter search. The QUEST-DMC collaboration is
exploring the complementary use of superfluid 3He to search for spin-dependent
dark matter interactions in the sub-GeV mass range [3]. With a projected
energy threshold of 0.51 eV for nuclear recoil interactions, we expect to be
able to probe dark matter masses down to $\sim 25$ $\rm MeV/c^{2}$ and spin-
dependent cross sections down to $\sim 10^{36}$ cm2 with a 4.9 g day exposure,
from a 6 month run.

###  1.1 QUEST-DMC Experiment

The idea of using 3He as a bolometer for particle detection dates back to 1988
[4] and was explored by the MACHe3 [5] and ULTIMA projects [6]. In the QUEST-
DMC experiment the superfluid 3He target will be enclosed in a $\sim$ 1 cm3
transparent box instrumented with a nanomechanical resonators (NEMS) [7]. This
is surrounded by a secondary superfluid volume with connection via a $\sim$ 1
mm2 hole in the bolometer wall. Energy deposition following a dark matter
scattering interaction with 3He leads to the production of quasiparticles
(broken Cooper pairs) and scintillation photons (following excitation and
ionization processes). The quasiparticles are detected as a damping force on
the NEMS driven on resonance. Superfluid 3He in the bolometer is cooled to
around $100\text{\,}\mathrm{\SIUnitSymbolMicro}\mathrm{K}$ to ensure a small
thermal population of quasiparticles and maximise sensitivity of the detector
to generated quasiparticles. Scintillation photons can be detected using
photon sensors surrounding the bolometer. For a complete description of the
detector and operation see Ref. [3].

##  2 Background Modelling

Energy deposition from particles such as cosmic rays or radioactive decay
products interacting with target atoms can mimic a dark matter interaction — a
significant background in a rare event search. Modelling those events using
Monte Carlo simulation and material screening is important for experiment
design, assessment of the projected dark matter sensitivity and eventual limit
setting. In the context of QUEST-DMC, detailed modelling of energy deposits in
the system will also be useful for future studies of superfluid helium
physics.

Background sources can be external to the experiment — cosmic rays, neutrons
and $\gamma$ rays coming from the surroundings, or internal — radioisotope
decays in the detector materials, surfaces or the target itself. The incoming
particles can transfer energy to the target through interactions with either
electrons or nucleons, which result in the production of quasiparticles and
photons described above. External backgrounds depend on the experiment
location and can be mitigated using shielding or external veto tagging
detectors. Radiogenic backgrounds from detector materials can be minimised
using careful design choices in material selection and detector geometry.
Internal radiogenic backgrounds from intrinsic contaminants can be minimised
by improving material purity and surface contaminants can be minimised using
strict cleaning protocols. Once mitigations are implemented it is important to
accurately understand the expected background levels, in order to establish or
rule out the presence of any candidate dark matter signal.

Superfluid 3He is intrinsically radiopure — at this operating temperature
impurities will have frozen out before entering the bolometer. The only other
possible liquid is 4He, but the solubility is sufficiently low that no atoms
are expected in the bulk liquid at sub-millikelvin temperatures. Therefore,
our assessment of radiogenic backgrounds will focus on naturally occurring
radioisotopes embedded in the detector materials. The most common
radioisotopes are: 238U, 235U, 232 Th, 40K, 60Co and 137Cs. Uranium and
thorium isotopes and their progeny form chains which decay through multiple
$\alpha$ and $\beta$ (and subsequent $\gamma$) emissions to eventually form
stable lead isotopes. The isotopes 40K, 60Co and 137Cs undergo single $\beta$
decays, with subsequent $\gamma$ ray emission.

The 238U and 232Th decay chains are typically assumed to be in secular
equilibrium, due to the long lifetimes of parent nuclei relative to their
daughters, allowing a measurement of activity in one part of the chain to
determine the activity of the rest. However, secular equilibrium can be broken
in both chains by enrichment or removal of radium. In the 238U chain there is
a simple equilibrium break at 226Ra, which has a half life of 1600 years so
any change will take thousands of years to be restored. The chain can be
divided into “early” — for isotopes above 226Ra and “late” — for 226Ra and
below, both of which are in secular equilibrium. Similarly, the 232Th chain is
split into “early”, above 224Ra, and “late”, including and below 224Ra.

###  2.1 Material Screening

A range of spectroscopic assay techniques are used to measure radioisotope
activity from materials, with each method sensitive to different radiation
types and energy ranges. Commonly used measurements include high purity
germanium (HPGe) spectrometry, inductively coupled plasma mass spectrometry,
radon emanation and alpha detection. For the uranium and thorium chains at
keV-MeV energies HPGe is the most relevant technique and has the advantage of
being non-destructive. HPGe assays use a Ge crystal for gamma spectroscopy, to
determine levels of naturally occurring radioisotopes embedded in a sample
through detection of $\gamma$ rays associated with their decay.

The Boulby Underground Germanium Suite (BUGS), located 1.1 km underground in
Boulby Mine, was used to perform HPGe measurements of potential materials for
the QUEST-DMC experiment. The BUGS facility consists of seven HPGe detectors
in a class 1000 cleanroom [8, 9]. For these measurements the ultra-low
background detectors Chaloner and Lunehead and speciality ultra-low background
detector Roseberry were used. The detectors are housed inside multi-layer
castles, consisting of 10 cm high-purity copper and 10 cm lead, to shield them
from environmental $\gamma$ rays. Detector materials used inside the castle
are specially selected based on low radioactivity and the manufacturing
process is carefully controlled to minimise contaminants. The castle is purged
using N2 gas to remove airborne radon, with residual radon in the N2 removed
using charcoal traps.

Detectors in the BUGS facility have a range of different types and
configurations to allow for a range of different sample geometries and cover a
large range of $\gamma$ ray energies. Roseberry is a Mirion BE6530 Broad
Energy Germanium (BEGe) planar detector with a 65 cm2 face and 30 mm
thickness, giving high sensivity to low energy $\gamma$ rays. Chaloner is a
Mirion BE5030 BEGe planar detector with a 50 cm2 face and 30 mm thickness,
again giving high efficiency for low energy gammas, but a small volume (150
cm2) best suited for small samples. Lunehead is a p-type coaxial Ortec GEM-
XX240-S detector, with a larger (370 cm2) volume but reduced sensitivity to
the lowest energy $\gamma$ rays. The 46.5 keV $\gamma$ ray emission from 210Pb
cannot be detected by Lunehead, preventing measurement of the 210Pb activity.

Table 1: Samples and measured activities for gamma spectroscopy carried out by the Boulby Underground Germanium Screening facility. Where upper limits are reported these are at the 90% confidence level. The Lunehead detector has no sensitivity to Pb210 activity. Two further results not included in the table, in units mBq/kg: Silver sinters Ag108m $42\pm 5$ and Painted Al Cs137 $5.4\pm 0.8$. For comparison two samples have been added from the SNOLAB radiopurity database [10] \- OFHC Cu screened by XENON1T [11] and kapton Cu PCBs screened by TREX [12] \- note that reported upper limits for these samples are at the 95% confidence level. Results not shown in the table for these samples, in units mBq/kg: Cu U235 $<1.8$, Co60 $0.07\pm 0.01$, Cs137 $<0.008$, Kapton Cu PCBs U235 $<0.12$, Co60 $<1.06$, Cs137 $<1.23$. |  |  |  |  | Measured activity [mBq/kg]
---|---|---|---|---|---
Sample | Mass [g] | Detector | U$\rm{}^{238}_{early}$ | U$\rm{}^{238}_{late}$ | Pb210 | Th$\rm{}^{232}_{early}$ | Th$\rm{}^{232}_{late}$ | K40
Stainless steel | 544.2 | Roseberry | $16\pm 8.2$ | $2.5\pm 0.9$ | $82.2\pm 27.2$ | $3.1\pm 1.2$ | $3.9\pm 0.9$ | $<6.2$
Al 6061-O | 642.6 | Lunehead | $8332.5\pm 267.6$ | $15.3\pm 3.9$ | - | $356.1\pm 12.2$ | $334.4\pm 8.2$ | $55.7\pm 17.9$
Painted Al | 923.0 | Chaloner | $25679.1\pm 228$ | $16.2\pm 3.2$ | $60475.4\pm 543.3$ | $259.2\pm 8.3$ | $342.2\pm 6.2$ | $21.8\pm 9.6$
Brass | 107 | Roseberry | $<7.6$ | $3.6\pm 1$ | $14985.8\pm 354.7$ | $<1$ | $<1.1$ | $<7.3$
Silver sinters | 37.1 | Roseberry | $<90$ | $<36$ | $430\pm 320$ | $<27$ | $<28$ | $<385$
Vespel | 38.3 | Chaloner | $86.6\pm 65.7$ | $89.6\pm 14.3$ | $418.3\pm 84.6$ | $111\pm 25.4$ | $63.6\pm 14.2$ | $430.9\pm 238.8$
Fiberglass | 6.02 | Chaloner | $32580.5\pm 636.6$ | $15153.5\pm 62.4$ | $68641\pm 1417.5$ | $11416.3\pm 102.1$ | $12004.9\pm 61.6$ | $23524.5\pm 437.2$
Araldite | 161.9 | Roseberry | $<3.6$ | $<4.8$ | $14.5\pm 9.7$ | $<3.4$ | $<2.2$ | $<25.5$
Stycast | 131.5 | Chaloner | $<10.5$ | $<9.5$ | $<14.9$ | $<12.9$ | $<6.2$ | $<122.2$
GRP | 106.9 | Lunehead | $5684.2\pm 1029.8$ | $7464\pm 115.6$ | - | $7844.5\pm 155.9$ | $7353.6\pm 100.8$ | $4904.7\pm 565.3$
PEN | 35.1 | Roseberry | $<4.2$ | $6.4\pm 2.7$ | $25.8\pm 13$ | $<3.4$ | $<2.4$ | $<22.8$
|  |  |  |  |  |  |  |
OFHC Cu | 8.8 | GeMPI I | $<0.19$ | $<0.13$ | - | $0.090\pm 0.04$ | $0.090\pm 0.004$ | $0.5\pm 0.2$
Kapton Cu PCB | - | Ge Paquito | $<184.86$ | $<5.72$ | - | $<4.84$ | $<2.91$ | $<17.6$

In the process of designing the QUEST-DMC experiment and evaluating the
sensitivity to dark matter interactions eleven materials, commonly used in
ultra-low temperature physics experiments, have been screened. Each sample was
screened for 1-2 weeks at the BUGS facility. Samples, detector details and
measured radioisotope activity levels in these materials are shown in Table 1.
The samples screened consisted of cryostat metal parts, other cryostat
materials and candidate materials for the experimental cell, described below:

  * •

stainless steel grade 304, used for the vacuum can – 15 cm square sheet sample

  * •

aluminum 6061, with and without paint, used to make the helium dewar
surrounding the experiment – machined disks

  * •

brass (typically CZ121), used for radiation shield cap – 6 cm disk

  * •

silver sinters, immersed in the 3He for thermal coupling – four blocks

  * •

vespel pillars, used as thermally-insulating mechanical supports between
different stages of the dilution refrigerator – three hollow cylindrical
pillars

  * •

copper coated fiberglass PCB – 20 cm sheet

  * •

Stycast 1266 epoxy manufactured by Henkel (parts A and B, with 100:28 mixing
ratio by mass), used for experimental cell – single cuboid

  * •

Araldite epoxy – two cylindrical pieces

  * •

glass reinforced plastic (GRP) black nylon 66 with 30% glass reinforcement,
possible experimental cell material – three cylindrical pieces

  * •

poly ethylene naphthalate (PEN), possible cell material or wavelength shifter
– 3 m folded sheet

In addition, we can make use of assay results previously reported by other
groups, which are extensively catalogued in the SNOLAB radiopurity database
[10]. Two examples of candidate materials screened by other dark matter
experiments are; oxygen-free high conductivity (OFHC) copper C10100 by the
XENON1T collaboration [11] and kapton copper monolayer printed PCBs by the
TREX collaboration [12]. The screening results for these materials, chosen
specifically for their low activities, are shown in Table 1 for comparison. It
is also important to note that the level of contaminants in epoxies such as
Stycast and Araldite can vary a lot between batches, depending on the ratios
and mixing process e.g. Araldite screening results reported on [10] have
U$\rm{}^{238}_{early}$ activities varying from $22.2\pm 2.5$ mBq/kg to
$119.8\pm 6.2$ mBq/kg.

###  2.2 Heat Leak

The measured activities from material screening can be converted into a heat
leak for each material in pW per kg. This is done by considering all $\alpha$,
$\beta$ and $\gamma$ emitting processes for the U, Th decay chains and
individual radioisotopes. The power $P$, is calculated by taking the product
of energy $E_{i}$, activity $a_{i}$, branching ratio $br_{i}$ for every decay
in each chain then the summing over all decays of a given type:

$P=\sum_{i}E_{i}\times a_{i}\times br_{i}.$ (1)

For the $\alpha$ and $\gamma$ emissions $E_{i}$ is the discrete energy of the
decay, whilst for $\beta$ emission the mean energy of the emitted spectrum is
used. Only decays with branching ratios greater than 1% are considered,
branching ratio and decay energies are taken from the ENSDF database [13].
Resulting powers per unit mass of sample are shown in Table 2 for the
different decay types.

Table 2: Emitted power per unit mass for each sample, based on the screening results reported and calculation reported above. | Emitted Power [pW/kg]
---|---
Sample | Alpha | Beta | Gamma
Al | $20.1\pm 0.3$ | $1.145\pm 0.03$ | $0.252\pm 0.004$
Painted Al | $110.0\pm 0.5$ | $7.21\pm 0.04$ | $0.374\pm 0.003$
Stainless steel | $0.14\pm 0.02$ | $0.009\pm 0.002$ | $0.0036\pm 0.0004$
Brass | $12.8\pm 0.3$ | $1.43\pm 0.02$ | $0.022\pm 0.004$
Silver sinters | $0.87\pm 0.29$ | $0.06\pm 0.02$ | $0.038\pm 0.012$
Vespel | $1.40\pm 0.14$ | $0.07\pm 0.01$ | $0.082\pm 0.009$
Fiberglass | $261.6\pm 1.4$ | $1.46\pm 0.12$ | $12.51\pm 0.03$
Araldite | $0.06\pm 0.01$ | $0.0027\pm 0.0007$ | $0.0037\pm 0.0006$
Stycast | $0.13\pm 0.02$ | $0.0036\pm 0.0013$ | $0.00\pm 0.0017$
GRP | $151.7\pm 1.5$ | $10.01\pm 0.15$ | $8.132\pm 0.047$
PEN | $0.07\pm 0.01$ | $0.0035\pm 0.0009$ | $0.0041\pm 0.0056$
|  |  |
OFHC Cu | $0.0053\pm 0.0015$ | $0.00028\pm 0.0001$ | $0.00015\pm 0.00003$
Kapton Cu PCB | $4.48\pm 0.02$ | $1.12\pm 0.02$ | $0.0049\pm 0.0009$
|  |  |
Sample | Alpha power [pW m-2]
---|---
Al | $0.85\pm 0.01$
Painted Al | $5.76\pm 0.03$
Stainless | $0.015\pm 0.002$
Araldite | $0.0021\pm 0.0005$
Stycast | $0.004\pm 0.001$
GRP | $6.37\pm 0.50$
Brass | $1.15\pm 0.03$
Silver sinters | $0.10\pm 0.03$
Vespel | $1.05\pm 0.01$
Fiberglass | $19.0\pm 0.5$
PEN | $0.0024\pm 0.0005$
|
OFHC Cu | $0.0004\pm 0.0001$
Kapton Cu PCB | $0.016\pm 0.004$
|
Table 3: Emitted power per unit area for $\alpha$ decays from a given sample
material. These units are used since the stopping length of $\alpha$ particles
is below 1 mm in most materials, so not all $\alpha$ particles emitted in the
bulk will escape the surface of a material.

It is important to note that the stopping powers of the three radiation types
will differ, so their expected ranges will vary. For example an $\alpha$
particle with kinetic energy of 1 MeV will have a range of
$\sim$3\text{\,}\mathrm{\SIUnitSymbolMicro m}$$ in aluminium, whilst a 1 MeV
$\beta$ will have a $\sim$ 2 mm range and 1 MeV $\gamma$ a $\sim$ 6 cm range
[14]. Therefore many of the emitted $\alpha$ particles will not escape source
material which is more than $\text{\,}\mathrm{\SIUnitSymbolMicro m}$
thickness, so we can also report the $\alpha$ heat leak per unit surface area.
Tabulated mass range values (g/cm2) as a function of $\alpha$ energy are taken
from the ASTAR database [14] for different materials and interpolated to find
the range corresponding to the decay product energy. The power corresponding
to each decay is again calculated from the product of energy, activity,
branching ratio and range. The sum is then taken over all decays to give the
total power emitted per unit surface area, reported in Table 3.

These results allow for a comparison of relative radioactive emission by
different materials, however the decay products can be attenuated or stopped
by surrounding materials and the heat leak in a given volume will depend
strongly on the geometry and combination of materials used. Power emitted by
certain popular construction materials makes them unusable for ultra-low
temperature experiments. It is careful choice of materials that ultimately
defines the lowest achievable experimental temperatures.

###  2.3 Background Simulations

| Events/cell/day | Average power/cell [pW]
---|---|---
Radiogenic | $487\pm 24$ | $(1.15\pm 0.09)\times 10^{-4}$
Cosmic ray surface | $5224\pm 73$ | $(6.25\pm 0.10)\times 10^{-4}$
Cosmic ray underground | $(1.28\pm 0.05)\times 10^{-2}$ | $(1.53\pm 0.06)\times 10^{-9}$
|  |
Table 4: Expected event rates and calculated average power for energy deposits
due to radiogenic decay products and cosmic rays (or secondaries) interacting
with 3He in a 0.315 cm3 experimental cell used in the QUEST-DMC detector
(operated at 0 bar pressure and 0.12 $\rm T/T_{c}$). This shows an example of
the full heat leak expected in a typical ultra-low temperature cryostat.

In order to build up a picture of the full energy deposited in an experimental
cell a detailed model of the surrounding materials is required. This can be
made using the GEANT4 software [15, 16] which simulates interactions of
particles with matter across a wide range of energies, tracking their
interactions and energy deposits. As described in Ref. [3] a detailed model of
the QUEST-DMC detector and cryostat volumes has been constructed and for each
volume $10^{5}$-$10^{10}$ primary decays are simulated per isotope, depending
on distance from the cell. The resulting energy in the cell is recorded and
normalised using screening or previous results from the SNOLAB radiopurity
database [10]. Energy spectra for all isotopes are summed to find the total
radiogenic background expected.

Since the experiment will be located above ground we also expect a significant
background from cosmic ray interactions in the cell. This is also simulated
using GEANT4, plus the CRY library [17] as a particle generator for incident
cosmic rays. The cosmic ray flux at the Earth’s surface is normalised to $\rm
0.017/cm^{2}/s$. Many dark matter experiments operate underground in order to
minimise the cosmic ray induced background, for example a muon flux of
$(4.09\pm 0.15)\times 10^{-8}\rm/cm^{2}/s$ has been measured at a depth of 1.1
km in Boulby mine [18].

Figure 1 shows the energy spectra expected from radiogenic decays and cosmic
rays in a 0.315 cm3 experimental cell in the Lancaster cryostat described in
Ref. [3], operated at 0.12$\rm T/T_{C}$ and 0 bar pressure. Table 4 shows the
average power in the cell resulting from these energy deposits, where the
cosmic ray induced power is shown for both a surface experiment and one
located underground e.g. at Boulby.

Figure 1: Simulated energy spectrum of background events depositing energy in
the 3He target in a QUEST-DMC experimental cell (0.315 cm3, operated at
0.12$\rm T/T_{C}$ and 0 bar pressure). The sum of radiogenic backgrounds from
all isotopes in the main cryostat volumes surrounding the detector is shown,
along with cosmic ray generated events (assuming operation on the Earth’s
surface).

##  3 Conclusion

The QUEST-DMC programme aims to utilise superfluid 3He instrumented with
nanomechanical resonators as a bolometer for dark matter detection. Design and
realisation of a search for rare interactions requires detailed knowledge of
potential background events. These can be modelled using Monte Carlo
simulations, normalised using extensive radioassay measurement campaigns.
Here, the background modelling efforts for the QUEST-DMC experiment are
reported, including germanium screening results for materials commonly used in
ultra-low temperature cryostats and comprehensive GEANT4 simulations of both
radiogenic and cosmic ray backgrounds. These simulation results have been used
to select materials for the design of the QUEST-DMC experiment and evaluate
the dark matter sensitivity, as reported in Ref. [3].

Since heating in the experimental cell is of interest beyond the dark matter
community, the screening results have also been converted into heat leaks per
unit mass or surface area for the different materials. The expected energy
spectrum, event rate and heat leak in a single QUEST-DMC cell is shown as an
example for a typical ultra-low temperature cryostat. For an experiment on the
Earth’s surface, with no dedicated shielding, cosmic ray backgrounds are
expected to dominate, particularly at low energies. However, if such an
experiment is operated underground e.g. at a depth of 1.1 km in Boulby mine
the cosmic ray background is reduced by $\sim 6$ orders of magnitude.
Modelling of muon energy loss at small depths based on Ref. [19], validated
using Ref. [20], shows that cosmic muon flux is reduced by more than an order
of magnitude for depths greater than 18 m in standard rock (density 2.65 g
cm-3). At greater depths the radiogenic heat leak will dominate over cosmic
ray energy deposits, limiting the experimental sensitivity – so choice of
radiopure materials and construction techniques becomes critical for any
underground operation.

An increasing number of cryogenic experiments rely on isolation from
interactions with the environment, specifically energy deposits. Successful
operation of nuclear demagnetisation cryostats at sub-mK temperatures depends
on minimising heat leaks. Once thermal and vibrational isolation has been
optimised it may be important to consider heat generated by ionising radiation
from radioactivity and cosmic rays, as done in Ref. [21]. In recent years
superconducting circuits and qubit technology have improved sufficiently that
this is also reaching the point of being limited by energy deposits from
cosmic rays or radioactive decays [22], which must be well understood to
enable robust error correction [23].

Acknowledgements This work was funded by UKRI EPSRC and STFC (Grants
ST/T006773/1, EP/P024203/1, EP/W015730/1 and EP/W028417/1), as well the
European Union’s Horizon 2020 Research and Innovation Programme under Grant
Agreement no 824109 (European Microkelvin Platform). M.D.T acknowledges
financial support from the Royal Academy of Engineering (RF\201819\18\2), We
thank Boulby Underground Laboratory for radioassaying the materials.

## References

  *   * [1] S.A. Hertel, A. Biekert, J. Lin, V. Velan, D.N. McKinsey, Direct detection of sub-GeV dark matter using a superfluid ${}^{4}\mathrm{He}$ target.  Phys. Rev. D 100, 092007 (2019).  10.1103/PhysRevD.100.092007.  URL https://link.aps.org/doi/10.1103/PhysRevD.100.092007
  * [2] B. von Krosigk, et al.  Delight: a direct search experiment for light dark matter with superfluid helium (2022).  URL https://arxiv.org/abs/2209.10950
  * [3] S. Autti, A. Casey, N. Eng, N. Darvishi, P. Franchini, R.P. Haley, P.J. Heikkinen, A. Jennings, A. Kemp, E. Leason, L.V. Levitin, J. Monroe, J. March-Russel, M.T. Noble, J.R. Prance, X. Rojas, T. Salmon, J. Saunders, R. Smith, M.D. Thompson, V. Tsepelin, S.M. West, L. Whitehead, V.V. Zavjalov, D.E. Zmeev.  Quest-dmc superfluid 3he detector for sub-gev dark matter (2023).  URL https://https://arxiv.org/abs/2310.11304
  * [4] G.R. Pickett, _Proceedings of the Second European Workshop on neutrinos and Dark Matter Detectors_ (1988), p. 377
  * [5] F. Mayet, D. Santos, G. Perrin, Y.M. Bunkov, H. Godfrin, Design optimization of MACHe3, a project of superfluid He-3 detector for direct dark matter search.  Nucl. Instrum. Meth. A 455, 554–563 (2000).  10.1016/S0168-9002(00)00540-4
  * [6] C.B. Winkelmann, J. Elbs, Y.M. Bunkov, E. Collin, H. Godfrin, M. Krusius, Bolometric calibration of a superfluid 3He detector for Dark Matter search: Direct measurement of the scintillated energy fraction for neutron, electron and muon events.  Nucl. Instrum. Meth. A 574(2), 264–271 (2007).  10.1016/j.nima.2007.01.180
  * [7] S. Autti, A. Casey, M. Connelly, N. Darvishi, P. Franchini, J. Gorman, R.P. Haley, P.J. Heikkinen, A. Kemp, E. Leason, J. March-Russell, J. Monroe, T. Noble, G.R. Pickett, J.R. Prance, X. Rojas, T. Salmon, J. Saunders, J. Slater, R. Smith, M.D. Thompson, S.M. West, L. Whitehead, V.V. Zavjalov, K. Zhang, D.E. Zmeev.  Long nanomechanical resonators with circular cross-section (2023).  URL https://arxiv.org/abs/2311.02452
  * [8] P. Scovell, E. Meehan, H. Araújo, J. Dobson, C. Ghag, H. Kraus, V. Kudryavtsev, X.R. Liu, P. Majewski, S. Paling, R. Preece, R. Saakyan, A. Tomás, C. Toth, L. Yeoman, Low-background gamma spectroscopy at the boulby underground laboratory.  Astropart. Phys. 97, 160–173 (2018).  10.1016/j.astropartphys.2017.11.006.  URL https://doi.org/10.1016%2Fj.astropartphys.2017.11.006
  * [9] P.R. Scovell, E. Meehan, S.M. Paling, M. Thiesse, X. Liu, C. Ghag, M. Ginsz, P. Quirin, D. Ralet.  Ultra-low background germanium assay at the boulby underground laboratory (2023).  URL https://arxiv.org/abs/2308.03444
  * [10] J.C. Loach, J. Cooley, G.A. Cox, Z. Li, K.D. Nguyen, A.W.P. Poon, A database for storing the results of material radiopurity measurements.  Nucl. Instrum. Meth. A 839, 6–11 (2016).  https://doi.org/10.1016/j.nima.2016.09.036.  URL https://www.sciencedirect.com/science/article/pii/S0168900216309639
  * [11] E. Aprile, et al., Material radioassay and selection for the XENON1t dark matter experiment.  Eur. Phys. J. C 77(12) (2017).  10.1140/epjc/s10052-017-5329-0.  URL https://doi.org/10.1140%2Fepjc%2Fs10052-017-5329-0
  * [12] J. Castel, S. Cebrián, I. Coarasa, T. Dafni, J. Galán, F.J. Iguaz, I.G. Irastorza, G. Luzón, H. Mirallas, A.O. de Solórzano, E. Ruiz-Chóliz, Background assessment for the TREX dark matter experiment.  Eur. Phys. J. C 79(9) (2019).  10.1140/epjc/s10052-019-7282-6.  URL https://doi.org/10.1140%2Fepjc%2Fs10052-019-7282-6
  * [13] NNDC, Evaluated nuclear structure data file (ensdf).  Nucl. Instrum. Meth. A 10.18139/nndc.ensdf/1845010.  URL https://www.osti.gov/biblio/1845010
  * [14] M. Berger, J. Coursey, M. Zucker.  Estar, pstar, and astar: Computer programs for calculating stopping-power and range tables for electrons, protons, and helium ions (version 1.21) (1999).  URL https://physics.nist.gov/PhysRefData/Star/Text/ASTAR.html
  * [15] S. Agostinelli, et al., Geant4 – a simulation toolkit.  Nucl. Instrum. Meth. A 506(3), 250–303 (2003).  https://doi.org/10.1016/S0168-9002(03)01368-8.  URL https://www.sciencedirect.com/science/article/pii/S0168900203013688
  * [16] J. Allison, et al., Recent developments in Geant4.  Nucl. Instrum. Meth. A 835, 186–225 (2016).  https://doi.org/10.1016/j.nima.2016.06.125
  * [17] Cosmic-ray shower library (cry) version 1.7.  URL https://nuclear.llnl.gov/simulation/main.html
  * [18] M. Robinson, V. Kudryavtsev, R. Lüscher, J. McMillan, P. Lightfoot, N. Spooner, N. Smith, I. Liubarsky, Measurements of muon flux at vertical depth in the boulby underground laboratory.  Nucl. Instrum. Meth. A 511(3), 347–353 (2003).  10.1016/s0168-9002(03)01973-9.  URL https://doi.org/10.1016%2Fs0168-9002%2803%2901973-9
  * [19] R.L. Workman, et al., Review of Particle Physics.  PTEP 2022, 083C01 (2022).  10.1093/ptep/ptac097
  * [20] A.I. Barbouti, B.C. Rastin, A study of the absolute intensity of muons at sea level and under various thicknesses of absorber.  J. Phys. G-Nucl. 9(12), 1577 (1983).  10.1088/0305-4616/9/12/018.  URL https://dx.doi.org/10.1088/0305-4616/9/12/018
  * [21] E. Nazaretski, V. Kostroun, S. Dimov, R. Pohl, J. Parpia, Heat inputs to sub-mk temperature cryostats and experiments from $\gamma$-radiation and cosmic ray muons.  J. Low Temp. Phys. 137(5), 609–623 (2004).  10.1007/s10909-004-0896-5.  URL https://doi.org/10.1007/s10909-004-0896-5
  * [22] L. Cardani, et al., Reducing the impact of radioactivity on quantum circuits in a deep-underground facility.  Nat. Commun. 12(1) (2021).  10.1038/s41467-021-23032-z.  URL https://doi.org/10.1038%2Fs41467-021-23032-z
  * [23] C. Wilen, S. Abdullah, N. Kurinsky, C. Stanford, L. Cardani, G. D’Imperio, C. Tomei, L. Faoro, L. Ioffe, C. Liu, A. Opremcak, B. Christensen, J. DuBois, R. McDermott, Correlated charge noise and relaxation errors in superconducting qubits.  Nature 594, 369–373 (2021).  10.1038/s41586-021-03557-5