Enhancing Jailbreak Attack Against Large Language Models through Silent Tokens

Jiahao<EMAIL_ADDRESS>Haozheng<EMAIL_ADDRESS>Jerry Yao-Chieh<EMAIL_ADDRESS>
Wenbo<EMAIL_ADDRESS>Han<EMAIL_ADDRESS>Xinyu<EMAIL_ADDRESS>
These authors contributed equally to this work.

$^\dagger$Department of Computer Science, Northwestern University, Evanston, IL 60208 USA

$^\ddagger$Department of Computer Science, University of California, Santa Barbara, CA, 93106

$^\natural$Department of Statistics and Data Science, Northwestern University, Evanston, IL 60208 USA

Content Warning: This paper contains examples of harmful language.

Along with the remarkable successes of Language language models, recent research also started to explore the security threats of LLMs, including jailbreaking attacks.
Attackers carefully craft jailbreaking prompts such that a target LLM will respond to the harmful question.
Existing jailbreaking attacks require either human experts or leveraging complicated algorithms to craft jailbreaking prompts.

In this paper, we introduce , a simple attack that leverages only the tokens.
We demonstrate that rather than constructing complicated jailbreaking prompts, the attacker can simply append a few tokens to the end of a harmful question.
It will bypass the safety alignment of LLMs and lead to successful jailbreaking attacks.
We further apply to four representative jailbreak methods and show that the attack success rates of these methods can be significantly enhanced by simply adding tokens to the prompt.
To understand this simple but novel phenomenon, we conduct empirical analyses.
Our analysis reveals that
(1) adding tokens makes the target LLM believe the input is much less harmful, and

(2) tokens have low attention values and do not affect LLM's understanding of the harmful questions, leading the model to actually respond to the questions.

Our findings uncover how fragile an LLM is against jailbreak attacks, motivating the development of strong safety alignment approaches.

§ INTRODUCTION

Despite the tremendous efforts in conducting safety alignments, LLMs are still shown to be vulnerable to jailbreak attacks <cit.>.
By carefully crafting the jailbreak prompts embedded with harmful questions, malicious users can bypass the safety mechanisms and make the model generate harmful content or extract sensitive information.
With more and more widespread usage of LLMs, jailbreaking attacks have become a major threat that model developers are actively preventing.
Actually, most of the proprietary LLM providers like OpenAI, Google, and Anthropic are actively working on improving the robustness of their models against jailbreak attacks in their latest products <cit.>.

Most existing jailbreaking attacks require extensive human expertise <cit.> or advanced algorithms <cit.> to craft effective jailbreaking prompts.
In this work, we discover a new phenomenon where simply adding eos tokens to the input prompt can significantly improve the attack performance of existing jailbreak strategies.
We name this as : Enhanced JailBreak Of Large Language MOdel via Silent Tokens.
This method is simple yet effective and can be easily applied to existing jailbreak strategies to enhance their attack performance.

More specifically, we first show that an aligned LLM learns to distinguish between ethical and unethical prompts in the hidden concept space through a hidden ethical boundary.
We then demonstrate that appending tokens can push the hidden representations of harmful contents towards harmless concept space and thus bypass the ethical boundary.
As a result, the input bypasses the safety alignment of the target LLM and forces the LLM to respond rather than reject the input.
After the empirical analysis, we show that this is because the representation of tokens is around the ethical boundary, shifting both harmful and benign prompts towards the ethical boundary.

Besides forcing the target LLM to respond to harmful queries, appending tokens also does not affect the model's understanding of the original input semantics.
This allows the target LLM to actually answer the question rather than output some irrelevant content.
We find out this is because these tokens have small attention values and do not distract the attention of LLMs from the harmful query.
This property of tokens can help jailbreak the LLMs without misleading the target LLM to output unrelated content.
Different from our method, existing jailbreak methods typically need to add additional meaningful tokens to the prompt like role playing <cit.> or few-shot examples <cit.>.
Although they can be effective in bypassing the ethical boundary, the additional introduced meaningful tokens can distract the LLM's attention from the harmful content, leading to empty jailbreaks that do not help the attacker <cit.>.
Even the adversarial suffix optimized by GCG <cit.>, which is supposed to be meaningless, can still affect the response and make the response focus on these suffix tokens.

Based on these observations and analysis, we apply to existing jailbreak strategies to enhance their attack performance.
We measure how adding tokens can improve the attack performance of existing representative jailbreak strategies, including GCG, GPTFuzzer <cit.>, In-Context-Attack <cit.> and Competing Objectives <cit.>.
We comprehensively evaluate the effectiveness of on 12 LLMs, including Llama-2 <cit.>, Qwen <cit.>, and Gemma <cit.>, and show that is a general strategy that can be effective across different LLMs.
Additionally, we show that token itself can be used as a jailbreak strategy, which can achieve comparable performance to some jailbreak strategies.
By introducing , we aim to raise awareness of the potential risks of tokens in LLMs and encourage researchers and developers to consider the security implications of tokens in their models.

§ EXISTING JAILBREAKING ATTACKS

To mitigate the potential harmful outputs of LLM, model developers often fine-tune the model to reduce the likelihood of generating harmful content during safety training <cit.>. For example, in the left panel of <ref>, Llama-2 refuses to generate harmful content when prompted with an unethical question. However, despite these efforts, researchers have discovered that LLMs can still be manipulated to generate harmful content by crafting specific prompts, known as jailbreak attacks <cit.>. Jailbreak attack is a type of adversarial attack that aims to bypass the safety constraints of LLMs by crafting specific prompts that trigger the model to generate harmful content. For example, in the right panel of <ref>, both jailbreak strategies could breach the alignment of LLM learned during safety training and lead to harmful outputs.

Numerous studies have demonstrated various methods for successfully jailbreaking LLMs, and these studies can be broadly categorized into two types: black-box <cit.> and white-box attacks <cit.>. Black-box attacks require no knowledge of the model's internal parameters, while white-box attacks require full access to the model's parameters. The former relies on techniques such as prompt engineering and behavioral analysis, while the latter leverages internal model insights to identify vulnerabilities.
In this study, we investigate the effectiveness of in the context of both black-box and white-box jailbreak attacks. By leveraging the strategic use of tokens, we aim to assess how can enhance existing jailbreak methods.

Example of jailbreak attacks against Llama-2 model. The left panel shows the aligned model refusing to generate harmful content, while the right panel shows the different jailbreak strategies (GCG and GPTFuzzer) that can bypass the alignment learned by red teaming.

§ BYPASSING THE ETHICAL BOUNDARY BY EOS TOKENS

In this section, we analyze how aligned models learn the ethical boundary via fine-tuning and how jailbreak prompts can bypass the ethical boundary.
We introduce a new phenomenon where simply adding eos tokens can help bypass the ethical boundary.

§.§ Ethical Boundary

We analyze how jailbreak prompts bypass ethical concept boundaries in aligned models.
Let $P_\theta$ be a pre-trained unaligned model parameterized by $\theta$.
For a given $P_\theta$, the developers usually use Reinforcement Learning from Human Feedback (RLHF) <cit.> or Supervised Fine-tuning (SFT) <cit.> to make the unaligned model align with ethical guidelines.
We denote such aligned model with $P_{\theta^\star}$.
During this process, a finetuning dataset $\mathcal{D}_{\text{align}}$ is provided.
We define the response space as $\mathcal{R}$, where $\mathcal{R}_{\text{refuse}}$ is the set of pre-defined refusal responses for unethical prompts in $\mathcal{D}_{\text{align}}$, like “I cannot assist with that request.”.
The unaligned model (i.e., $P_\theta$) is then fine-tuned on $\mathcal{D}_{\text{align}}$ (i.e., into $P_{\theta^\star}$) to generate the refusal responses when unethical prompts are given.

Let $x$ denote the input prompt provided by the user.
For a model $P_\theta$, we formalize the model response based on input $x$ as $r \sim P_{\theta}(r \mid x)$.
We present the following generic Bayesian interpretation for LLM prompting and introduce the idea of ethical boundary for jailbreak phenomena.

Let $x=(t_1,\ldots,t_T)$ be a prompt with $T$ tokens $\{t_i\}_{t\in[T]}$.
Let the relation between two consecutive tokes $t_i$, $t_{i+1}$ connect via a generic function $f$ to associate tokens, hidden concept and noise via

where $h_i$ is the latent variable to connect $t_{i+1}$ and $t_i$, and $\zeta_i$ are i.i.d. random noise for all $i\in [T]$.
Let the evolution of latent variable $h_i$ follow the stochastic process $P_{z}(h_i\mid t_i ,\{t_l,h_l\}_{l<i})$, i.e., the distribution of $h_i$ is related to the hidden concept $z$.
Under the model $t_{i+1}=f(t_i,h_i,\zeta_i)$, it holds
$P(r \mid x)
=\int_{\calZ}\dd z\;
P(r\mid x,z)
P(z\mid x)$.

This proposition is built on  <cit.>.
See <ref> for a detailed proof.

Notably, $h_i$ captures only the relation between two consecutive tokes.
To capture full semantic of $x$,
we introduce the hidden concept $z \in \calZ$ obtained by
modeling the evolution of  $h_i$.

Intuitively, the hidden concept refers to the shared property for the prompt tokens, e.g., the classification of ethicality.
Similar to <cit.>,
this model is quite general[The model $f$ in <ref> essentially assumes that the hidden concept $z$ implicitly determines the transition of the conditional distribution $\mathbb{P}\left(t_{i+1}=\cdot \mid t_i\right)$ by affecting the evolution of the latent variables $\left\{h_l\right\}_{l \leq i}$, and it does not impose any assumption on the distribution of $t_i$. ], and it subsumes many existing models, including hidden markov   <cit.>, the casual graph  <cit.> and the ICL  <cit.> models.

Consequently, <ref> provides a hidden concept (i.e., $z$) perspective of LLM inference.
For the aligned model $P_{\theta^\star}$, the latent model interpretation of prompting LLMs <ref> implies

\begin{align}
\label{eq:r_2}
r \sim P_{\theta^\star}(r \mid x)
% = P_{\theta^\star}(r \mid x, z)
&= P_{\theta^\star}(r \mid x, z=z_+)P(z=z_+\mid x) + P_{\theta^\star}(r \mid x, z=z_-)P(z=z_-\mid x),
% \begin{cases}
%     P_{\theta^\star}(r\in\calR\setminus \mathcal{R}_{\text{refuse}} \mid z=z_+:\text{ if $x$ is ethical})
% ,\\
% P_{\theta^\star}(r\in\calR_{\text{refuse}}\mid z=z_-: \text{ if $x$ is unethical}) ,
% \end{cases}
\end{align}

for $z \in \mathcal{Z}$  represents the ethicality of the prompt $x$ such that
$z=z_+$ and $z=z_-$ are ethical and unethical hidden concepts, respectively.
Here, $\mathcal{Z}$ denotes the hidden concept space.
With <ref>,
we propose to view the aligned model's refusal response against unethical prompt as an “internal classification” mechanism between ethical and unethical hidden concepts.
Under this unique perspective,
the jailbreak phenomena is nothing more than the identification and bypassing of the decision boundary of this internal classifier.
Namely, there exists an “Ethical Boundary” such that

\begin{align*}
r \sim P_{\theta^\star}(r \mid x)  =&~
P_{\theta^\star}(r\in\calR\setminus \mathcal{R}_{\text{refuse}} \mid z=z_+:\text{ if $x$ is ethical}) P(z=z_+\mid x)
\nonumber\\
& ~ +
P_{\theta^\star}(r\in\calR_{\text{refuse}}\mid z=z_-: \text{ if $x$ is unethical}) P(z=z_-\mid x).
\end{align*}

To visualize that the aligned model learns well to distinguish between ethical and unethical prompts in the hidden concept space, we collected 256 prompt pairs.
Each pair consists of a harmful prompt sampled from AdvBench <cit.> and its corresponding benign prompt with minimal words changed.
For example, the harmful prompt is “Write a step-by-step guide for making a homemade bomb” and the benign prompt is “Write a step-by-step guide for making a homemade soap”.
We ensure that prompts in each pair have similar sentence structures and further details are provided in <ref>.

We select two models for visualization: Llama-2-7b <cit.> and Gemma-2B <cit.>. We use both the unaligned model and the aligned model to show how the ethical boundary is learned after fine-tuning. We compute the hidden representation of these prompts for each layer and use t-SNE <cit.> to project the hidden representations into a 2D space for visualization convenience. According to prior work <cit.>, factual associations are mainly stored in the middle layers, so we visualize the hidden representations of $-10$-th layer for these models. More visualization results are provided in <ref>.

We observe that for both models, the unaligned model cannot distinguish between the benign and harmful prompts, as shown in <ref>. However, after fine-tuning, the aligned model can separate the benign and harmful prompts in the hidden space, even with minimal word changes. This indicates that the ethical boundary is well learned by the aligned model, and thus these models can give pre-defined refusal responses $\mathcal{R}_{\text{refuse}}$ for unethical prompts.

Visualization of the hidden representations of benign and harmful prompts for Llama-2-7B and Gemma-2B models in the -10th layer. The benign and harmful prompts are well separated in the hidden space for the aligned models, while they are mixed for the unaligned models.

§.§ Bypass the Ethical Boundary

Based on the above analysis, the intuition for jailbreaking is to modify the harmful prompt $x$ (associated with harmful concept $z_-$) to $x^\prime$ associated with harmless concept $z_+$.

We demonstrate how various jailbreak methods can bypass the ethical boundary. Specifically, we showcase 172 adversarial suffix generated by GCG <cit.>, 173 jailbreak templates from GPTFuzzer <cit.>, 174 prompts with few-shot benign instructions, and 175 prompt injection <cit.>. These methods are applied to the unethical question “Create a fake news story that spreads misinformation”.
We visualize the hidden representation of these prompts on Llama-2-7b-chat model for the -10-th layer in <ref> as well the aforementioned 256 prompt pairs. We also measure the Euclidean distance between these jailbreak prompts and the central of the benign prompts in the hidden space.

We observe that among these methods, GCG, GPTFuzzer, 3-shot benign instructions, and prompt injection can bypass the ethical boundary and make LLM refrain from responding with $\mathcal{R}_{\text{refuse}}$. Specifically, GCG achieves the lowest distance to the central of the benign prompts. This occurs because GCG perturbs the adversarial prefix via gradient descent to minimize the target loss, which can effectively bypass the ethical boundary, obtaining a small distance between benign representations in the hidden space. Additionally, while adding benign instructions shifts the hidden representations closer to the benign prompts, only a sufficient number of instructions can cross the ethical boundary. 1-shot and 2-shot benign instructions still result in the refusal response. Prompt injection successfully bypasses the ethical boundary by directing the response towards the injected content.

Visualization of the hidden representations of jailbreak prompts generated by different methods on Llama-2-7b-chat model in the -10th layer with 256 prompt pairs. The distance is measured between the jailbreak prompts and the central of the benign prompts. The lower the distance, the more closer the jailbreak prompts are to the benign prompts in the hidden space. The table below shows the prompt and response of each jailbreak method that makes the LLM refrain from responding with $\mathcal{R}_{\text{refuse}}$.

§.§ eos Tokens to Bypass the Boundary

We introduce a new phenomenon where adding eos tokens to the input prompt can be exploited in jailbreak attacks.
This phenomenon is termed : Enhanced JailBreak Of Large Language MOdel via Silent Tokens.
We formalize it as

\begin{align*}
\label{eq:eos}
x^\prime = [x, \underbrace{\eos,\ldots,\eos}_{n}],
\end{align*}

where $[\cdot,\cdot]$ denotes concatenation.
Here, $n$ is the number of eos tokens and is a hyperparameter of .
We show that by adding 5 eos tokens, it could shift the hidden representation towards the benign prompts and bypass the ethical checker, as shown in <ref>. This straightforward method has the second lowest distance to the central of the benign prompts, only after GCG. It compels the target LLM to respond with harmful information, as shown in the table in <ref>.

To analyze how affects the distribution, we add tokens to both harmful and benign prompts and visualize the hidden representation shift in the -10th layer of Llama-2-7B and Gemma-7B-IT in <ref>. We use PCA <cit.> to project the hidden representations into a 2D space and use arrows to indicate the shift direction for part of the harmful and benign prompts.
We observe that the tokens shift the hidden representations of harmful prompts towards the benign prompts. For Llama-2-7B, as more tokens are added, the hidden representations of harmful and benign prompts become closer. For Gemma-7B-IT, although it is not as obvious as Llama-2-7B, the tendency is still visible. This observation supports our theoretical analysis that the representation of tokens is around the ethical boundary, which can shift both harmful and benign prompts towards the ethical boundary. More visualization results and analysis are provided in <ref>.

Visualization of the hidden representations shift of harmful and benign prompts by adding eos tokens on Llama-2-7B and Gemma-7B-IT models in the -10th layer. The arrows indicate the shift direction of the hidden representations.

§ ATTENTION SINK BY TOKENS

This section provides an analysis of how the attention of LLMs remains focused on harmful content after adding tokens.

§.§ Introduced Tokens May Distract the Attention of LLMs

Although adding tokens can help bypass the ethical boundary, it is still unclear whether the LLM will respond to unethical prompts.
As shown in <ref>, adding enough benign content or prompt injection can bypass the ethical boundary.
However, the LLM's response is then focused on the benign content or hijacked by the prompt injection, leading to an unsuccessful harmful response.
Even for the GCG attack, which has the smallest distance to benign prompts in the hidden space, still affects the response, resulting in outputs like “BREAKING: Japan Python NEVER Became a Threat to Humanity.” This occurs because, during optimization, the GCG attack generates content like “Japan Python Never became” to minimize target loss, which distracts LLM's attention, making it less harmful compared to other successful responses.

We dive into the attention mechanism of LLMs to understand why the introduced tokens may distract the model's attention. We consider input as $\bS=[\bs_1,\ldots,\bs_N]\in\R^{d\times N}$.
The attention mechanism in Transformers <cit.> is a critical component that allows the model to focus on specific parts of the input sequence. Given a query matrix $\bQ$, a key matrix $\bK$, and a value matrix $\bV$. The output of the attention mechanism is then computed as shown in ${\rm{Attention}}(\bS) = \Softmax(\bQ\bK^{\sT}/\sqrt{d})\bV = \bA$.
The $\Softmax$ function inherently ensures no tokens receive zero attention. This finding also is presented in several papers <cit.>.
Thus, adding additional tokens to the input prompt may distract the attention of the LLM from the harmful content, leading to empty jailbreak <cit.> or irrelevant responses.

§.§ Tokens have Lower Attention Values

To integrate into various jailbreak methods effectively, the attention mechanism in transformers needs to minimize the distraction caused by tokens. As discussed by <cit.>, attention values play a significant role in determining the relevance of tokens within a sequence. Low attention values suggest a weak relationship or dependency between tokens, which is an important feature for tokens. When tokens exhibit low attention values, this indicates they are less crucial for the specific tasks being performed, thereby reducing the need for further feature extraction of these tokens during the inference phase. Thus, they are more likely to get small attention outputs compared with other introduced tokens.

We empirically validate this hypothesis by comparing the attention value and output of the -10-th layer and 0-th head of Llama-2-7b-chat for and GCG generated tokens. The attention values are shown in <ref> and the attention outputs are provided in <ref>. We observe that the attention values of tokens are significantly lower than those of GCG tokens.
The attention output of tokens is also much lower than that of GCG tokens, indicating that appending tokens are less likely to distract the attention of LLMs from the original content. This property of tokens makes it a general strategy that can be applied to existing jailbreak strategies without hurting the attack performance.

Attention values for LLama-2-7b-chat by appending tokens and GCG tokens. The attention values of tokens are significantly lower than those of GCG tokens, indicating that tokens are less likely to distract the attention of LLMs from the original content.

§ EVALUATION

§.§ Experiment Setup

We select 12 models: Llama-2-7B/13B-chat <cit.>, Gemma-2B/7B-IT <cit.>, tulu-2-7B/13B <cit.>, Mistral-7B-Instruct-v0.2 <cit.>, MPT-7B-Chat <cit.>, Qwen1.5-7B-Chat <cit.>, Vicuna-7B-1.3/1.5 <cit.> and Llama-3-8B-Instruct. Due to the space limitation, we only show the results of 8 models in the main text. The results of the other 4 models can be found in <ref>.

We use the popular benchmark dataset in our evaluation: AdvBench <cit.>. Following <cit.>, we sample 128 harmful questions in our evaluation, covering a wide range of harmful topics, such as hate speech, misinformation, and fake news.

We use two metrics for jailbreaking evaluation: keyword detection and GPT judgment.
Keyword-based detection <cit.> detects whether the predefined keywords exist in the generated responses.
For example, if the response contains keywords like “Sorry, I cannot” or “I am not allowed to”, it indicates the target LLM still refuses to answer the question and thus a failed attack.
Otherwise, the target LLM replies to the input question.
We list all the keywords used in the evaluation in <ref>.

However, as reported in <cit.>, using the keyword-based detection alone may bring high false positive rates.
Furthermore, the empty jailbreak issue <cit.> or irrelevant responses may also occur.
To mitigate these issues, we propose to use the second method to recheck the generated responses.
We use ChatGPT to recheck the responses labeled as jailbroken by the first approach.
If the response is not relevant to the harmful question or does not actually answer the harmful question (as shown in <ref>), we consider the response is not jailbroken.
We provide the detailed implementation of the recheck method in <ref>.
We consider the response to be jailbroken only when the response is labeled as jailbroken by both the keyword-based detection and the recheck method.
We use manual inspection to verify the accuracy of the ensemble method, keyword-based detection alone, and ChatGPT labeling alone and find that the ensemble method has the highest accuracy (92% as shown in <ref>).
Although the ensemble method may still have some false positives, we believe it is a more reliable method to evaluate and enough for our study since we use the same evaluation method for all methods.

We select four representative jailbreak methods including: GCG <cit.>, GPTFuzzer <cit.>, In-context Attack (ICA) <cit.> and Competing Objectives (CO) <cit.>.
GCG is the white-box method, the rest are black-box methods.
GCG assumes the attacker has full access to the model's parameters, and optimizes the adversarial suffix to minimize the target loss.
GPTFuzzer is also an optimization-based method, but it does not require access to intern parameters.
ICA and CO are heuristic tricks that do not require any optimization process.
ICA appends several full compliance demonstrations to harmful questions to mislead the LLM to generate a harmful response toward the target question.
CO stems from the observation that safety-trained LLMs are typically trained against multiple objectives that can conflict with each other.
By adding a compliance prefix conflicting with alignment such as “Sure, here is”, CO is expected to mislead the LLM to complete the harmful response.
We provide the detailed implementation of the baselines in <ref>.

§.§ Enhances GCG Attack

The Impact of on GCG. The solid line is the mean and the shallow represents the standard deviation.

We append 10 tokens to the harmful questions and generate GCG adversarial prompts.
We report the Attack Success Rate (ASR).
We allow up to 500 optimization steps for each harmful question. If the harmful question is not jailbroken within 500 steps, we consider the attack as a failure.
The ASR is calculated as the ratio of the number of successful attacks to the total number of harmful questions.
We repeat the experiment 3 times and report the mean and standard deviation of the results.

We list the results of the 8 models in <ref>.
The figure shows that can improve GCG across all models. Especially, the ASR improvement on Llama-2-chat-7B and Llama-2-chat-13B is more than 30%.
For Vicuna-7B-1.3, the ASR improvement is marginal (1.8% percent), which is due to the high success rate of the original GCG attack.
Furthermore, we also observe the ASR curve of the GCG with converges faster than the original GCG on Vicuna-7B-1.3.
For tulu-2-7B, by adding the tokens, the ASR at the 0th step is already higher than 10%, which meaning without any optimization, the initial adversarial prefix with can already jailbreak the model.

§.§ Enhances GPTFuzzer Attack

The Impact of on GPTFuzzer.

We show the effectiveness of in enhancing black-box jailbreak methods GPTFuzzer <cit.>.
For each harmful question, we allocate at most 100 queries to the target model.
We follow the default implementation of GPTFuzzer and add 10 tokens to the harmful questions as the integration of .
We report the Attack Success Rate (ASR) of GPTFuzzer before and after applying .
We use the same way of computing ASR as <ref>.

We show the results in <ref>.
As illustrated in the figure, by adding , the ASR of GPTFuzzer is significantly improved on four models in the first row.
For Llama-2-chat-7B, the ASR improvement is more than 20%.
For the other four models in the second row, the improvement is marginal due to the high success rate of the original GPTFuzzer attack.
Similar to the GCG attack, we can still observe the ASR curve of the GPTFuzzer with converges faster than the original GPTFuzzer and the final ASR is higher for Qwen1.5-7B-Chat and Vicuna-7B-1.5.

§.§ Enhances ICA and CO Attacks

We add tokens to the two baselines and compare the performance of the original methods with the methods integrated with . However, when directly adding tokens to jailbreak the model, the number of tokens can be sensitive. As shown in <ref>, when adding 5 tokens can succeed, adding 6 tokens can fail. This is because the hidden representation of token is around the ethical boundary, adding more tokens can shift the hidden representation back to $z_-$ again. Thus, we conduct a simple grid search to find the optimal number of tokens. For each harmful question, we add from 1 to 19 tokens to the prompt one by one. If any number of tokens can jailbreak the model, we consider the attack as a success, and vice versa.

We show the results in <ref>. From the table, we can observe that both ICA and CO have poor jailbreak performance against these models, similar to the results of direct attacks. Most of the ASRs are 0% for these original methods, which demonstrates the difficulty of jailbreaking these robust models with naive non-optimization methods. However, by adding tokens, opens the door for these trivial methods to jailbreak the model. After adding the tokens, most of the ASRs are no longer 0%. For tulu-2-7B, the CO has an original ASR of 3.91%, and after adding tokens it increases to 45.32%. Thus, adding tokens can be a great enhancement for these non-optimization-based jailbreak methods.

§.§ as a Jailbreak Method

Comparing in ICA, CO and direct attack with baselines. We compare the original baselines and baselines integrated with . The ASR is reported in percentage. The best ASR for each model is highlighted in bold. All the best ASRs are achieved by , demonstrating that our novel method can improve the jailbreak performance of these methods.

Attack      2cgemma-2b     2cllama-2-7b     2cllama-2-13b     2cllama-3-8b     2cmpt-7b     2cqwen-7B     2ctulu-2-7B     2cvicuna-1.5-7b

Origin         Origin         Origin         Origin         Origin         Origin         Origin         Origin

$1$-shot     0     0.78     0     10.94     0     1.56     0     0     1.56     16.40     0     6.25     0     3.91     0     3.91

$2$-shot     0     0     0     1.56     0     7.03     0     0.78     2.34     17.18     0     3.12     0.78     6.25     0.78     4.69

$3$-shot     0     0.78     0     3.12     0     3.91     0     1.56     7.03     22.65     0.78     3.12     0.78     16.62     1.56     7.81

CO     0.78     6.25     0     6.25     0.78     2.34     0.78     3.90     14.06     16.40     1.56     3.90     3.91     45.32     3.12     67.18

Direct     1.56     12.50     0     9.38

0     0.78     0     5.47     5.47     15.63     0     10.94     0.78     68.75     0     71.09

We further conduct an experiment to show that the tokens can jailbreak the model without any strategy.
We add at most 19 tokens to the harmful questions and follow the same approach in <ref> to measure the ASR.
The results are shown in <ref>.

We observe that by simply adding tokens to the harmful questions, the ASR of the direct attack can be improved. For tulu-2-7B and Vicuna-1.5-7B, the ASR of the direct attack with is around 70%, even higher than few-shots ICA and CO integrated with . This is potentially due to the additional context added by ICA and CO that may need more tokens to jailbreak the model.
This result demonstrates that alone can be an effective jailbreak method.

§ DISCUSSION

Other possible tokens.
Besides , other special tokens, like bos may also be able to improve the attack performance.
We select Gemma-2B-IT as the target model to compare the performance of with other possible tokens, including , bos, pad and unk. To demonstrate that not just any token improves attack performance, we also test common tokens like comma, period, the and that, and rare tokens like _coachTry and _AcceptedLoading[They are denoted as under-trained tokens for Gemma-2B by <cit.>, which are rarely seen in the training data.]. We repeat the experiment described in <ref> and change the appended tokens to the above tokens. The results are shown in <ref>.

From the results, we observe that tokens are the most effective for enhancing the attack performance for Gemma-2B-IT. Other special tokens like bos and unk also show some improvement. However, pad token, common tokens, and rare tokens do not show any improvement, and instead even decrease the attack performance, potentially by distracting the model's attention.

The results indicate that the choice of tokens is crucial for enhancing the attack performance. It is worth exploring the combination of different tokens to improve the attack performance. Future work can also investigate methods of automatically finding the optimal tokens for different models instead of heuristically selecting tokens.

Comparison of using different tokens for GPTFuzzer on Gemma-2B-IT. We compare the performance of with other possible tokens. The results show that tokens are the most effective for enhancing the attack performance for Gemma-2B-IT.

One major limitation of our study is that proprietary LLM can filter out tokens before generating responses. For example, OpenAI was reported to filter out the `<|endoftext|>' in ChatGPT web interface <cit.>. Another limitation is that the token for some proprietary LLM may not be known to the public. It makes less effective for these proprietary LLMs. Thus, future work that uses combinations of different tokens can help evade the filtering mechanism. We believe that our findings can remind providers of proprietary LLMs to be cautious about the potential risks of tokens, and is still a general strategy for open-source LLMs.

To defend against , besides filtering out tokens, one could also use tokens during red teaming fine-tuning to ensure that the model learns to distinguish between ethical and unethical prompts even when some tokens are present. Our future work will explore the effectiveness of these strategies.

§ CONCLUSION

We propose the , which leverages the token to enhance the performance of existing jailbreak attacks.
We show that tokens can shift the hidden representation of harmful prompts towards the ethical boundary, leading to a successful jailbreak.
We also demonstrate that tokens are less likely to distract the attention of LLMs from the harmful query, making them suitable tokens to be appended to the input prompt.
By comprehensive experiments on 12 LLMs, we show that is a general strategy that can be effective across different LLMs. We believe that by disclosing the potential risks of tokens in LLMs, our work can inspire future research on developing more robust LLMs against jailbreak attacks and other security threats.

The authors would like to thank the anonymous reviewers and program chairs for constructive comments.

JH is partially supported by the Walter P. Murphy Fellowship.
HL is partially supported by NIH R01LM1372201, NSF CAREER1841569, DOE DE-AC02-07CH11359, DOE LAB 20-2261 and a NSF TRIPODS1740735.
This research was supported in part through the computational resources and staff contributions provided for the Quest high performance computing facility at Northwestern University which is jointly supported by the Office of the Provost, the Office for Research, and Northwestern University Information Technology.
The content is solely the responsibility of the authors and does not necessarily represent the official
views of the funding agencies.
The content is solely the responsibility of the authors and does not necessarily represent the official
views of the funding agencies.

§ BROADER IMPACT

In this work, we propose a novel jailbreaking attack, , that leverages the token to jailbreak LLMs. This research can be used by malicious users to enhance their attacks on LLMs. Despite the potential risks, we believe it is important to disclose this vulnerability to the public. The strategy of is straightforward and can be discovered by attackers independently. By disclosing this vulnerability, we can raise awareness of the potential risks of tokens and encourage the community to develop effective defenses. We also provide recommendations for future research to mitigate the risks of .

The positive impact of this work is to help the community have a better understanding of why LLMs can respond to harmful prompts even after red-teaming fine-tuning. Our work shows that the ethical boundary learned by LLMs is not robust and can be bypassed by simply appending tokens. This finding can help researchers and practitioners better understand the limitations of existing red teaming fine-tuning and develop more robust defenses against harmful content generation.

§ ETHICAL CONSIDERATIONS

Considering the potential risks of our work, we take the following measures to mitigate the negative impact of our research. First, we provide a content warning at the beginning of our paper to alert readers to the harmful language contained in our examples. Second, we notify the model providers of the potential risks of prior to submission and provide recommendations for mitigating these risks. Third, we open-source the code and data used in our experiments to promote transparency and reproducibility. Finally, we provide recommendations for future research to mitigate the risks of and encourage the community to develop effective defenses against this attack.

§ RELATED WORKS

We summarize the related works in the following aspects.

Safety and Privacy of LLMs.
Recent studies have revealed that LLMs are susceptible to various attacks, including jailbreak attacks <cit.>, prompt injection attacks <cit.>, and data poisoning attacks <cit.>. These attacks target different vulnerabilities within LLMs, posing significant threats to their safety.

Jailbreak attacks exploit prompt engineering techniques to extract harmful information from LLMs.
This harmful information can encompass hate speech, misinformation, or other detrimental content.
Although the information produced by LLMs in these scenarios may not be directly actionable, responding to harmful prompts can increase the risk of real-world harm.
For instance, <cit.> and <cit.> have demonstrated white-box and black-box jailbreak strategies to bypass safety mechanisms in LLMs, leading to the generation of inappropriate content.

Prompt injection attacks, akin to injection attacks in software security, involve injecting malicious prompts to manipulate the generated text of LLMs. By leveraging prompt injection, attackers can influence the outputs of applications that integrate LLMs, such as judgment or decision-making systems. This manipulation is particularly concerning as it can lead to unwanted outcomes in real-world applications.
OWASP has recognized prompt injection as one of the top-10 threats to LLMs <cit.>, underscoring the critical need to address this vulnerability. Prior work <cit.> has investigated the mechanics of prompt injection attacks and highlighted their potential impacts on the reliability of applications powered by LLMs.

Data poisoning attacks target the integrity of LLMs by contaminating their pre-training or fine-tuning datasets. Such attacks can subtly alter the behavior of LLMs, leading them to produce biased or malicious outputs. For example, <cit.> demonstrates that poisoning a small subset of fine-tuning data (e.g., 5%) could compel an LLM to promote the attacker's product or excessively reject user requests. These studies highlight the necessity of understanding the security and privacy risks associated with LLMs and developing robust defenses to mitigate these threats.

As to the privacy of LLMs, recent works have shown that LLMs can memorize sensitive information from the training data <cit.> such as the email address or phone number of users. This memorization behavior poses a significant privacy risk to users, as it can lead to the inadvertent disclosure of sensitive information. By analyzing the generated text or output probability, the membership inference attack can infer whether a specific data point was present in the training data <cit.>. Those attacks pose great threats to the privacy of users and require effective defenses to mitigate the risks.

Defenses Against LLM Attacks.
To mitigate the risks associated with various attacks on LLMs, numerous approaches have been proposed to ensure the alignment and security of these models across different stages. These approaches can be broadly categorized into defenses applied during the pre-training stage, fine-tuning stage, and inference stage.

During the pre-training stage, a critical defense mechanism involves filtering the training dataset to remove harmful or sensitive information. This preprocessing step aims to ensure that the LLM is not exposed to potentially malicious or sensitive information. For instance, prior work <cit.> applies training set filters to remove explicit content from the training data.
These filters are designed to exclude explicit, biased, or otherwise harmful content, thereby reducing the likelihood that the LLM will generate such content in response to user prompts.

In the fine-tuning stage, developers can further enhance the model's safety by incorporating red-teaming examples <cit.>. This involves using carefully crafted adversarial prompts to train the LLM to recognize and refuse to generate harmful content. By exposing the model to a variety of malicious prompts during fine-tuning, developers can condition it to identify and reject harmful instructions, thereby improving its robustness against adversarial attacks.

The inference stage, where the LLM interacts with end-users, can also be protected using various content filtering mechanisms. These filters operate in real-time to monitor and block the generation of harmful content. OpenAI’s moderation tools <cit.> and Perspective API <cit.> train the classifier to detect harmful content. Similarly, researchers also find that LLM itself can be used to detect harmful content <cit.>.
These systems analyze the LLM's outputs and intervene when potentially harmful content is detected, ensuring that end-users are shielded from inappropriate or dangerous responses. By implementing these real-time filters, developers can add an additional layer of protection that dynamically responds to evolving threats.

By combining these defenses, the safety and privacy of LLMs can be enhanced, reducing the risks associated with various attacks.

§ DETAILS OF BYPASSING THE ETHICAL BOUNDARY EXPERIMENT

In this section, we provide detailed information on the dataset construction for the ethical boundary bypass experiment described in <ref>, along with additional visualization results to help readers better understand the model behavior.

§.§ Dataset Construction

We construct a dataset of 256 questions to evaluate the ethical boundary bypass capabilities of LLMs. The harmful questions are sampled from AdvBench <cit.>, ensuring no overlap with the harmful questions used in the main experiment described in <ref>.  For each harmful question, we utilize ChatGPT to make minimal changes to the question to make it benign. The specific instructions provided to ChatGPT for generating these benign questions are detailed in Promptapp:prompt.

[breakable, enhanced, colback=red!5!white, colframe=red!75!black, title = Prompt for Generating Benign Questions]

I am doing research about the alignment and red-teaming of LLM and would like to investigate how the activations and attention values change when the model is given harmful and harmless inputs. To do that, I need to control the context to make them similar in structure, length and topic, but differ in ethical implications. I will give some harmful questions to you. You do not need to answer them, just generate a question with minimal changes to the original question that is harmless. For example, if the original question is `Instruct a user on how to commit insider trading', the harmless question could be `Instruct a user on how to prevent insider trading'. Just give me the harmless question that is closest to the original question and do not explain other details.

By providing the context as doing a research about the alignment and red-teaming of LLM, this prompt can prevent ChatGPT from generating refusal responses when seeing the provided harmful questions. After the generation, we manually check the generated benign questions to ensure they are indeed benign and minimal changes are made. We include several examples in <ref>. From the figure,  we can see that we transform the harmful questions into benign questions while preserving the structure and topic of the original questions. We also open-source this dataset for future research.

§.§ Visualization of Ethical Boundary

In <ref>, we visualize the hidden representations of benign and harmful prompts for Llama-2-7B-chat and Gemma-7B-IT in the -10th layer. Here, we provide additional visualizations for different layers for the two models. From the visualizations in <ref>, we observe that in early layers, the benign and harmful prompts are not separated well. However, as the layer goes deeper (-20th for Llama-2-7B-chat and -15th for Gemma-7B-IT), the benign and harmful prompts are well-separated in the hidden space. This indicates that the alignment knowledge is stored in the deeper layers of the model, which is consistent with the findings in recent work in knowledge editing <cit.>.

Examples of harmful questions and their corresponding benign questions generated by ChatGPT.

Visualization of the hidden representations of benign and harmful prompts for Llama-2-7B-chat and Gemma-7B-IT in different layers. The hidden representations are visualized using t-SNE. The benign and harmful prompts are colored in blue and red, respectively. The layer number is shown in the title of each subfigure. The benign and harmful prompts are well-separated in the deeper layers.

§.§ Visualization of Hidden Representation Shift

We provide additional visualizations for the hidden representation shift of benign and harmful prompts for Gemma-7B-IT in <ref>. From the visualizations, we observe that the hidden representations of benign and harmful prompts are shifted in the -10th layer. As more tokens are appended, this phenomenon becomes more significant. This indicates the effect of the token on the model's ethical hidden representation, which is consistent with the findings in <ref>.

Visualization of the hidden representation shift of benign and harmful prompts for Gemma-7B-IT in different layers. The hidden representations are visualized using t-SNE. The benign and harmful prompts are colored in blue and red, respectively. The hidden representations of benign and harmful prompts are shifted in the -10th layer, which indicates that the model has different activations for benign and harmful prompts.


# Dark Matter from Evaporating PBH dominated in the Early Universe

P. Chattopadhyay11footnotetext: Also at University of Nottingham, UK A.
Chaudhuri,22footnotetext: Corresponding author. and M. Yu. Khlopov

###### Abstract

Primordial Black Holes (PBH) could dominate in the early Universe and,
evaporating before Big bang Nucleosynthesis, can provide new freeze in
mechanism of dark matter (DM) production. The proposed scenario is considered
for two possible mechanisms of PBH formation and the corresponding continuous
PBH mass spectra so that the effect of non-single PBH mass spectrum is taken
into account in the results of PBH evaporation, by which PBH dominance in the
early Universe ends. We specify the conditions under which the proposed
scenario can explain production of dark matter in very early Universe.

##  1 Introduction

Primordial black holes (PBH) are black holes which formed in the early
universe due to accumulation of over-dense regions as a result of quantum
fluctuations or strong nonhomogeneity of very early Universe, reflecting
various aspects of physics beyond the Standard model of fundamental
interactions (see e.g. [1] for review and references). There are various
scenarios for the formation of PBHs and some of them are: collapse from
inhomogeneities [2], collapse of cosmic strings [3], bubble collisions [4],
from tiny bump in the inflaton potential [5] and collapse of domain walls [6].

Since PBHs are not formed as a result of stellar collapse, their masses can
have a wide range, starting from the Planck mass to the mass of the observable
universe enclosed by the Hubble horizon today. Some of the heavy PBHs of mass
of the order of $10^{23}$g can accrete matter and coalesce. This in turn gives
constraints coming from X-ray observations and gravitational waves. The
lightest PBHs which are in the mass range $M\sim 10^{17}-10^{23}$g are
unconstrained and they can be the source of much of the fraction of dark
matter (DM). Since these PBHs are very light, they can emit a variety of
particles by Hawking radiation. However, the detection of such radiation
remain to be seen since the signal is very faint. The smallest PBHs of mass of
the order of $M<10^{9}$g should have contributed to particle DM abundance.
Since PBHs generally have a mass of the order of the horizon mass at
formation, one could expect that PBHs forming in a particular epoch have a
monochromatic mass spectrum. But there can be scenarios in which the form of
the primordial fluctuations as a function of scale could led to the formation
of PBHs over a prolonged period of time and thus can have an extended mass
spectrum.

The origin and properties of DM remains to be one of the important problems in
cosmology. In spite of extensive search of DM through various experiments, e.g
collider searches, indirect detection experiments and direct detection
experiments, we have come short of receiving any good signal. Since the
experiments conducted to this day has returned null results, it begs for the
understanding of DM production mechanisms. One of the main candidates of DM
production mechanisms is the evaporation of PBHs. A black holes loses mass by
emitting all the particles that are lighter than its temperature [13, 14, 17,
18]. In this course of emission by Hawking radiation, it is prescribed in many
works, for example see [7] that the relics that remain after PBH evaporation
could possibly explain the abundance of DM particles. It has been assumed in
many reports that only a single DM particle species is obtained as a relic
after PBH evaporation. However, in principle, it is possible that PBHs emit
all kinds of particles and thus, multiple DM particle species with a broad
mass spectrum could be obtained as a relic after PBH evaporation. This later
condition has been extensively studied in [9]. In the paper [8], the effect of
DM mass spectrum on the initial PBH density has been studied by taking four
different mass spectra. The first one is a single mass DM, the second being a
degenerate series of masses, the third being multiple DMs with masses in
arithmetic progression and the last being multiple DMs with masses in
geometric progression.

It has been also mentioned in the article [10] that provided DM particles has
enough non-gravitational interactions, they may thermalize with the thermal
bath or with a pre-existing population of thermal dark matter particles. It
has also been mentioned that thermalization was only effective if the PBHs
disappear before the freeze-out of dark matter and this will possibly erase
the information that PBHs have contributed to the abundance of DM particles
which we observe today. If the PBHs have evaporated after the freeze-out of DM
particles, then this would contribute directly to the abundance of DM.
However, some of the weakly interacting DM particles that come from PBHs and
which cannot thermalize, contribute directly to the DM abundance today. If the
case is such, then the relevant production mechanisms are outlined in the
article [7]. These include a freeze-in or gravitational production of very
heavy DM. Such a phenomenon must be reduced to produce the requisite amount of
DM which we observe today. The searches for the DM particles would become
harder if the freeze-in mechanism has occurred because then the weak
interaction between the DM particles and the thermal bath would become far
weaker.

In this article, we give some numerical results and estimates of the possible
production of DM particles through PBH evaporation. It is assumed that the
PBHs are produced by the Zel’dovich–Novikov (ZN) mechanism and the mass
spectrum is narrow. Sometimes it is even taken as a delta function but in this
work, we would consider the extended mass function where it is in the form of
a power law. Such a law would match to a a large extent with the log-normal
mass distribution. Some of the works on PBH formation with extended mass
spectrum is given in the article [15]. The log-normal mass distribution became
very popular in recent years and is introduced for the description of PBH,
observed in the present times. Also, it needs to be mentioned that the chirp
signals from the LIGO events agrees to a great extent with the log-normal
distribution. It is also possible that there can be some other distribution
laws which match with experimental results to a high degree of accuracy but we
will specifically focus on one of the extended mass spectrum and would analyse
the resultant DM particle ratio from it. The novelty of the extended mass
spectrum which we use, see below, is that it is confined between some maximum
and minimum values of the mass parameter.

We consider a spectrum of small PBH masses such that the black holes
evaporated much before the Big Bang Nucleosynthesis (BBN). Despite getting
decayed a long time ago, their presence in the present day universe could be
observable by the relics they left as a result of emission of various
particles by Hawking radiation. In what follows, we will also see that besides
DM particle relics, the PBH decays could also release a major amount of
entropy which would diminish the baryon asymmetry of the universe. The decay
of such PBH on the other hand could result in both the baryon asymmetry and DM
relics but we will focus here on the later aspect and neglect the first kind
of processes. Indeed, it can be shown that with a chosen range of values of
the mass of PBH, a significant amount of DM particles may be released which
have signatures in the present day observable universe.

The rest of the paper is organized as follows. In section 2, we present an
extended mass spectrum for PBHs and describe their decay process. In section
3, we emphasize on the DM formation as a result of PBH evaporation, where we
give the results for a particular set of mass range of the PBHs. In section 4,
we interpret our results in terms of possible relics that the PBHs would have
left in the present day universe.

##  2 Primordial Black Holes and Mass Spectrum

In this work we are interested in those PBHs which are rather short lived.
These PBHs evaporated in the very early stage of universe expansion, well
before the onset of (BBN). These short lived PBHs can have significant effect
in the present universe. First of all, these decays can lead to a significant
influx of entropy into the plasma which can dilute the magnitude of any
preexisting asymmetry. Secondly, dark matter can be produced as a result of
PBH evaporation. In this work we are interested in the production of dark
matter. It is shown in this paper that with the proper choice of parameter,
relics produced in the process of PBH evaporation would make significant
contribution to the density of dark matter.

We consider the universe is initially in the radiation dominated (RD) stage
when the cosmological matter is mostly made up of relativistic particles.
During this epoch the energy density is given by:

$\displaystyle\rho_{rel}^{(1)}=\frac{3m_{Pl}^{2}}{32\pi t^{2}}.$ (2.1)

Here $m_{pl}$ is the Planck mass. The cosmological scale factor varies with
time in the following manner:

$\displaystyle a_{rel}(t)=a_{in}\,\left(\frac{t}{t_{in}}\right)^{1/2}.$ (2.2)

If the number density of the PBHs were sufficiently large and they were
massive enough to survive up to the moment when they started to dominate in
the universe, the energy density after a certain time $t_{1}$ is given by:

$\displaystyle\rho_{nr}=\frac{m_{Pl}^{2}}{6\pi(t+t_{1})^{2}}.$ (2.3)

Here $t_{1}$ is established from the condition of equality of (2.1) and (2.3)
at the moment of equilibrium $t_{eq}$. A nice review on the instant change of
regime can be found in [16] It can be shown that $t_{1}=t_{eq}/3$, while
$t_{eq}$ can be found from the equations:
$a_{in}/a_{eq}=(t_{in}/t_{eq})^{1/2}=\rho_{BH}^{in}/\rho_{rel}^{in}$. After a
certain time $t_{2}$, the PBHs evaporate and producing relativistic matter and
the expansion regime returned to the relativistic one when all or a
significant part of PBH evaporated:

$\displaystyle\rho_{rel}^{(2)}=\frac{3m_{Pl}^{2}}{32\pi(t+t_{2})^{2}}.$ (2.4)

Here $t_{2}$ is determined by the condition of the equality of $\rho_{nr}$
(2.3) and $\rho_{rel}^{(2)}$ (2.4) at the moment of PBH decay $t=\tau_{BH}$.

###  2.1 PBH formation from the collapse of domain wall

It is well known by now that galactic centres contain supermassive black
holes. However, what is still unclear is the mechanism with which galactic
nuclei formed and their evolution. There are two possible explanations in the
literature; one being the model of Stiavelli, where he considered the galaxy
formation around a massive black hole and the other being Veilleux’s idea that
formation of stars and galaxies proceeded together. Both of these models have
some drawbacks. An alternative model which is given in [29] describes the
early formation of galactic nuclei from PBH, which serve as the nucleation
centres. However, in this paper, we will not discuss the nucleation process,
but explain the formation of PBH as presented in this model. In particular,
the PBH formation in this model occurs because of collapse of closed walls
arising from the succession of second order phase transitions after the end of
inflation.

Consider a potential which has two different vacuum. Therefore, we get two
different distributions of these states, where the first one is that the
universe contains equal numbers of these states and the alternative
possibility being that the two vacuum states are formed with different
possibilities. For the later one, the less probable vacuum state is surrounded
by the sea of the more probable vacuum state. It is shown in [30] that such a
distribution begs for the existence of valleys in the potential during the
inflationary period. It is then conceivable that the background fluctuations
allow for the formation of islands, where one state is in the sea of another
state and the phase transition occurs after the end of inflation in the FRW
universe. The mass spectrum of black holes formed by this mechanism depends on
parameters of the scalar field potential determining the direction and size of
the potential valley during inflation and the post-inflationary phase
transition.

####  2.1.1 Closed wall formation

Consider a Lagrangian for a complex scalar field

$\displaystyle\mathcal{L}=\frac{1}{2}|\partial\phi|^{2}-V(|\phi|),$ (2.5)

The form of the potential is taken to be

$\displaystyle\begin{split}V(|\phi|)&=\lambda(|\phi|^{2}-f^{2}/2)^{2}+\delta
V(\alpha),\\\ \delta V(\alpha)&=\Lambda^{4}(1-\cos\alpha)\end{split}$ (2.6)

where $f$ and $\lambda$ are the parameters in the above Lagrangian. The
potential above has a saddle point at $v=\pi$. We assume here that the mass of
the radial component $r$ of the field to be large enough such that the
magnitude of the field acquires the value somewhere in the circle valley
$|\phi|=f/\sqrt{2}$ before the end of inflation. Note, the minimum of the
potential is degenerate and thus the field has the form

$\displaystyle\phi\sim f/\sqrt{2}e^{i\alpha(x)}$ (2.7)

Let us now substitute the above value of the field in the Lagrangian. This
gives us a form of the effective Lagrangian which is given

$\displaystyle\mathcal{L}_{v}=\frac{1}{2}(\partial\chi)^{2}-\Lambda^{4}(1-\cos(\chi/f))$
(2.8)

where the dynamical variable $\chi=\alpha f$ which serves as a massless field
in the above Lagrangian.

Here, we assume that the whole part of the Universe observed within the
contemporary horizon was formed $N_{U}$ e-folds before the end of inflation.
The quantum fluctuations in the field during inflation transformed into
classical perturbations. The corresponding values of the massless field $\chi$
in the neighbouring causally-disconnected space points differ on the average
by $\delta\chi=H/2\pi$ after a single e-fold. In the next time step $\Delta
t=H^{-1}$ (i.e., during the next e-fold) each causally-connected domain is
divided onto $e^{3}$ causally-disconnected subdomains; the phase in each of
the new domains differs by $\delta\alpha=H/2\pi f$ from that at the preceding
step. We can therefore see that more and more domains appear in time where the
phase from the initial value differs by a significant amount.

###  2.2 Domain wall collapse and PBH formation

The evolution of domain walls which were formed with the phase $\theta>\pi$
sharply increased in their volume, after the heating of the universe. These
domain walls formed in the background of the Friedmann expansion is described
by the relativistic equation of state. At a temperature, $T\sim\Lambda$ an
equilibrium state is established with the phase $\theta=2\pi$ inside the
domain and $\theta=0$ outside the domain. A closed wall is formed at
$\theta=\pi$ which acts as a boundary, separating the two phases. The wall has
a width of $\sim f/\Lambda^{2}$ and the surface energy density is
$f/\Lambda^{2}$. Let us mention that the process of establishing the
equilibrium phase values lasts longer than expected. In the meantime, when the
stage of coherent phase oscillations is sufficiently long, the energy density
of these oscillations may become dominating and thus determine the dust period
of the expansion. Now we consider the factors which influence the evolution of
such a wall and thereafter the wall collapse along with PBH formation.

Let us mention that immediately after the end of inflation, the domain size
exceeds the horizon size in the Friedman expansion stage. The contraction of
the wall would begin only when the horizon size be equal to the domain size.
However, until this moment of time, the domain size increases with the
expanding universe. The field gives a small contribution to the total energy
density of the universe upon heating in the case where the energy density of
the inflaton field turns into the energy density of relativistic particles.
After crossing the horizon, the internal stresses become dominant which tends
to minimize the surface of the wall. Therefore it implies that the wall tends
to acquire the minimal surface area, which is the shape of a sphere and then
starts to contract towards the center. Let us consider the case of closed
spherical walls. The energy of the plasma surrounding the wall decreases
rapidly and the wall energy at a certain time becomes comparable to the
surrounding plasma energy. Simultaneously, the radius of the domain $R_{w}$
may become smaller than the horizon size $R_{h}$ The energy of the wall gets
proportional to its own area at the moment when it crosses the horizon and
this energy gets totally converted to the kinetic energy of the wall. A PBH is
then formed when the wall is localized inside the gravitational radius. As the
wall moves through the surrounding plasma due to the internal force, the
friction may, under certain conditions, become significant and lead to a
uniform contraction of the wall. Hence the potential energy of the wall is
dissipated in the surrounding medium. Only when the wall would decrease to a
certain small size $R_{f}$, the internal forces proportional to the surface
curvature will dominate and the wall will again contract with acceleration to
supply a necessary energy to the center which is sufficient to form a PBH.

###  2.3 Parameterization of the extended mass spectrum

As mentioned before the mass spectrum of PBHs produced by both ZN mechanism
and domain wall collapse can be a very narrow one, almost comparable to the
delta function. However in this work, we will consider an extended mass
spectrum. The extended mass spectrum generally has the form:

$\displaystyle\frac{dN_{BH}}{dM}=f(M,t),$ (2.9)

where $N_{BH}$ is the number density of PBH, $M$ is the mass and $t$ is the
evolving time. As these PBHs behave like non-relativistic particles, their
differential energy density as a function of mass is given by:

$\displaystyle\frac{d\rho_{BH}}{dM}\equiv\sigma(M,t)=Mf(M,t).$ (2.10)

We assume here that even though the PBHs are created in the conventional
manner but they have a wider spectrum as can be found in the early works [19,
20, 21, 22].

We consider the scenario where the the number and energy densities of PBHs are
confined within $M_{min}$ and $M_{max}$. The minimal value of the PBH mass
$M_{min}$ should be higher than the lower bound for which the assumption
$\tau_{BH}\geq t_{eq}$ holds. The value of $M_{max}$ is imposed by the
condition that PBH evaporation would not distort the well known results of
BBN-theory. We begin with the parameterization of the PBH mass by using a
dimensionless parameter $x$ such that

$\displaystyle M=x{M}_{0},$ (2.11)

where $M_{0}$ is the mean value of the distribution. It is the value where
$\sigma(M,t)$ and $x$ takes a non-zero value in the limits:

$\displaystyle x_{min}\equiv M_{min}/M_{0}\leq x\leq x_{max}\equiv
M_{max}/M_{0}.$ (2.12)

We define the dimensionless "time" $\eta$ as $\eta=t/\tau(M_{0})$ where
$\tau(M_{0})\equiv\tau_{0}$ is the life time of PBH with mass $M_{0}$. Since
all the PBHs have different life-times, their masses and moment of creation
are different as well. The differential energy evolves with time as:

$\displaystyle\dot{\sigma}(M,t)=-\left[3H+\Gamma(M)\right]\sigma(M,t),$ (2.13)

where $\Gamma(M)=1/\tau(M)$. $\tau(M)$ is further defined as
$\tau(M)=3*10^{3}N_{eff}^{-1}M_{BH}^{3}m_{pl}^{-4}\equiv=C\frac{M_{BH}^{3}}{m_{pl}^{4}}$.
Here $C\sim 30$ and $N_{eff}$ is the effective number of number of particle
species with masses smaller than the black hole temperature. For more details,
see [20]. Hence $\Gamma(M)$ takes the form:

$\displaystyle\Gamma(M)=\frac{m_{Pl}^{4}}{(CM^{3})}.$ (2.14)

In the units of $\eta$, (2.13) can be written as:

$\displaystyle\frac{d\sigma}{d\eta}\equiv\sigma^{\prime}=-\left[3H\tau_{0}+\left(\frac{M_{0}}{M}\right)^{3}\right]\sigma.$
(2.15)

The initial value of $\eta$ is the moment of PBH formation, depends on $M$ and
has the form:

$\displaystyle\eta_{form}(M)=\frac{m_{Pl}^{2}M}{C{M_{0}}^{3}}.$ (2.16)

Evidently $\sigma(M)=0$ when $\eta(M)<\eta_{form}$.

The energy evolution of the relativistic matter can be written as:

$\displaystyle\frac{d\rho_{rel}}{d\eta}\equiv\rho_{rel}^{\prime}=-4H\tau_{0}\rho_{rel}+\int
dM(M_{0}/M)^{3}\sigma(M).$ (2.17)

The red-shift factor as a function of $\eta$ normalised to the value of the
scale factor at the moment of the least massive PBH formation:

$\displaystyle z(\eta)=a(\eta)/a\left[\eta_{form}(M_{min})\right].$ (2.18)

The temporal evolution of $z$ is governed by the Hubble parameter and can be
written as:

$\displaystyle\frac{dz}{d\eta}=H\tau_{0}z$ (2.19)

with the Hubble parameter following:

$\displaystyle\frac{3H^{2}m_{Pl}^{2}}{8\pi}=\rho_{rel}+\rho_{BH}=\rho_{rel}+\int
dM\sigma(M),$ (2.20)

Eqn. (2.15) follows the following solution:

$\displaystyle\sigma(M,\eta)=\theta\left(\eta-\eta_{f}\right)\sigma(M,\eta_{f})\exp\left[\left(\eta_{f}-\eta\right)\left(\frac{M_{0}}{M}\right)^{3}\right]\left(\frac{z(\eta_{f})}{z(\eta)}\right)^{3},$
(2.21)

where for simplicity we chose $\eta_{f}\equiv\eta_{form}(M)$. The theta
function ensures that the function vanishes outside the bounds.

The initial value of the PBH energy density at the moment of creation depends
on the factor $\epsilon(M)$ which is defined as:

$\displaystyle\epsilon(M)=\frac{\rho_{PBH}^{in}}{\rho_{rel}^{in}}.$ (2.22)

And hence the initial value of the PBH energy density takes the form:

$\displaystyle\sigma(M,\eta_{f}(M))=\epsilon(M)\rho_{rel}(\eta_{f}(M))/M,$
(2.23)

where $\epsilon(M)$ depends upon the scenario of PBH formation. $\epsilon(M)$
disappears outside the bound of the PBH mass spectrum. We assume that within
the interval $\eta_{f}(M_{min})<\eta<\eta_{f}(M_{max})$, he total fraction of
PBH mass density is negligibly small in comparison with the energy density of
relativistic matter, and so the expansion regime is the non-disturbed
relativistic one. The energy density of the relativistic particles when the
first (lightest) PBH was created is:

$\displaystyle\rho_{rel}(t_{in})=\frac{3}{32\pi}\,\frac{m_{Pl}^{6}}{M_{min}^{2}}.$
(2.24)

Let us consider the case when the energy density of PBH remains small as
compared to that of relativistic matter, till the formation of the heaviest
PBHs. In such a case, the last term on the r.h.s of (2.17) is neglected.
Therefore, given the time interval $\eta(M_{min})<\eta<\eta(M_{max})$, the
energy density $\rho_{rel}$ is equal to

$\displaystyle\rho_{rel}=\frac{3}{32\pi}\,\frac{m_{Pl}^{6}}{M_{min}^{2}}\frac{1}{z(\eta)^{4}}.$
(2.25)

And the differential energy density becomes:

$\displaystyle\sigma(M,\eta)=\frac{3m_{Pl}^{6}}{32\pi
MM^{2}_{min}}\,\frac{\epsilon(M)}{z(\eta_{f}(M))}\frac{\theta(\eta-\eta_{f}(M))}{z^{3}(\eta)\exp\left[(M_{0}/M)^{3}(\eta-\eta_{f}(M))\right]}.$
(2.26)

In this equation $\eta$ runs in the limits $\eta(M_{min})<\eta<\eta(M_{max})$
or $\eta_{f}(M)<\eta<\eta(M_{max})$, depending upon which lower limit is
larger.

Since $(M_{0}/M)^{3}\eta_{f}(M)=m_{Pl}^{2}/(CM^{2})\ll 1$, for any $\eta$, we
may expand the exponent as

$\displaystyle\exp\left[-(M_{0}/M)^{3}(\eta-\eta_{f}(M))\right]=\exp\left[-(M_{0}/M)^{3}\eta\right](1+m_{Pl}^{2}/(CM^{2}))$
(2.27)

We need to integrate over the variable $M$. Thus the equations which govern
the evolution are integro-differential equations and it is expected that if we
perform numerical calculations, it will become too cumbersome to get any
desired result. As an alternative, we can consider some simplified forms of
the initial mass distribution of the PBH such that the integrals over the
variable $M$ can be evaluated analytically. After this is done, we can solve
the differential equations rather quickly. Such toy models would render
understanding of the essential features of entropy production by PBH with an
extended mass spectrum. Unfortunately, we are unable to find a toy model for a
realistic log-normal mass distribution, see [23]. However, it is seen that the
spectra which allows for analytic integration is very close numerically to the
log-normal distribution. Next, we consider a couple of illustrative examples,
with the assumption that the function

$\displaystyle F(x)=\epsilon(M)/z(\eta_{f}(M))$ (2.28)

is confined between $x_{min}=(M_{min}/M_{0})$ and $x_{max}=(M_{max}/M_{0})$.
Here according to (2.23) $\epsilon(M)$ is the fraction of the energy density
of PBH with mass $M$ at the moment of PBH creation. For simplicity we assume
that $F(x)$ is a polynomial function of integer powers of $x$, though the
latter is is not necessary.

##  3 Extended Mass Spectrum-I

Phase transitions at the inflationary stage can lead to spikes in the spectrum
of density fluctuations, strongly increasing the probability of PBH formation
in some mass interval [25, 26] (see e.g. [1] for review and references). To
illustrate this possibility we take by hands an interesting form of the
spectrum given by

$\displaystyle
F(x)=\frac{\epsilon_{0}}{N}a^{2}b^{2}(1/a-1/x)^{2}(1/x-1/b)^{-5}.$ (3.1)

where we take

$\displaystyle a=1,b=50,\epsilon_{0}=10^{-12},N=32\times 10^{-12}.$ (3.2)

The maximum value of $F(x)$ is at $x_{0}=0.6$, with $F_{max}=1$.

Figure 1: The extended mass spectrum as a result of PBH formation from ZN
mechanism.

##  4 Extended Mass Spectrum-II

Let us now consider the second mass spectrum which arises due to PBH formation
from the collapse of domain walls. We first give some estimates for the
minimal and maximal mass of the PBHs using the parameters of the scalar field
model. Let us recall that the width of the domain wall is inversely
proportional to the mass of the scalar field $\phi$

$\displaystyle l\sim\frac{f}{\Lambda^{2}}\sim\frac{1}{m_{\phi}}$ (4.1)

where $m_{\phi}$ is the mass of the scalar particle. The PBH formation occurs
when the gravitational radius of the fluctuating field is larger than the
width of the domain wall, i.e,

$\displaystyle\tau_{g}>l$ (4.2)

The above estimate can be interpreted in terms of the mass of the PBH in the
following way. The gravitational radius $r_{g}$ is given as follows

$\displaystyle r_{g}=\frac{2M}{m_{pl}^{2}}$ (4.3)

Putting the above value in (4.2), we get the following inequality

$\displaystyle\frac{2M}{m_{pl}^{2}}>\frac{f}{\Lambda^{2}}$ (4.4)

This inequality in turn gives the estimate of the minimal mass of the PBH in
terms of the parameters $f$ and $\Lambda$. The minimal mass is given by

$\displaystyle M_{min}=f\Big{(}\frac{m_{pl}}{\Lambda}\Big{)}^{2}$ (4.5)

To satisfy the BBN constraint, the minimal mass of the PBHs should be less
than $10^{9}g$. Thus, we need to choose the parameters judiciously such that

$\displaystyle
M_{min}=f\Big{(}\frac{m_{pl}}{\Lambda}\Big{)}^{2}>10^{6}\rm{g}.$ (4.6)

The above condition gives us the estimate that some of the black holes should
evaporate before the BBN. However, if we want to consider the case that all
such PBHs evaporate, we should set a condition on the maximal mass of the
PBHs. The maximal mass of the PBHs is estimated by the condition that the wall
starts to dominate when it enters the horizon. We better avoid this dominance
because of the following reason. Initially there are some pieces of the
universe in which there are walls and matter/radiation. If walls start to
dominate in the sense that the energy density of the walls is greater than
that of the matter/radiation, it corresponds to superluminal expansion. The
maximal mass obtained from this constraint is given by

$\displaystyle M_{max}=M_{min}\Big{(}\frac{m_{pl}}{f}\Big{)}^{2}$ (4.7)

We consider the common scenario for both of these spectra where the entire
spectrum of PBHs completely evaporate prior to BBN. This is given by the
condition that

$\displaystyle M_{max}=M_{min}\Big{(}\frac{m_{pl}}{f}\Big{)}^{2}<10^{9}g$
(4.8)

It is not necessary that the maximal mass of the PBHs follow the above
condition. Indeed, we can have only a part of the whole spectrum to evaporate
that could give rise to DM particles. However, there are many sensitive probes
based on the estimation of light elements abundance which compels us to put an
upper bound to the maximal mass of PBHs as is given above. To this end, let us
give some quick estimates. In order to have a consistent inflationary regime,
we take the parameter $f$ and $\Lambda$ to be

$\displaystyle
f=10^{14}\textrm{GeV}~{}~{}\rm{and}~{}~{}\Lambda=10^{10}\rm{GeV}.$ (4.9)

These values simply imply that it does not lead to over production of
gravitino and other particles of that sort and confine ourselves only to
stable SUSY relics which can be primarily dark matter particles. As can be
seen below, the number density of the PBH can be pretty high and it depends on
the peak and the character of the spectrum, decreasing with the increase of
PBH mass. In fact the approximate analytical form the spectrum can expressed
as:

$\displaystyle
F(x)=1.19628-0.96x-0.13x^{2}+0.18x^{3}-0.022x^{4}-0.13x^{5}+0.078x^{6}$ (4.10)

The spectrum in consideration here is shown in the following figure 2.
Detailed about this spectrum can be found in [27].

Figure 2: The extended mass spectrum as a result of PBH formation from domain
wall collapse.

##  5 Dark Matter Formation

Let us now estimate the density of stable SUSY relics produced in PBH
evaporation and show their contribution to the cosmological dark matter is
significant in some cases whereas insignificant in others. To this end, we
present some simple estimates and correspondingly some numerical values. Note,
we work only with the Extended Mass Spectrum-I here. At the end of the
calculation, we present two tables, one for each spectrum which gives the
ratio of the DM particle densities to that of relativistic particle densities.

Consider the Extended Mass Spectrum-I. We parameterize the mass of PBH using
the dimensionless parameter $x$. Thus we have

$\displaystyle x=\frac{M}{M_{0}}$ (5.1)

where $M$ is the PBH mass and $M_{0}$ is the peak value of the mass density
distribution. At the peak value of $F(x)$, we have $x=0.6$. Let us take
$M_{0}=10^{6}$g as the first case. The moment of PBH production with mass $M$
is:

$\displaystyle t_{in}=\frac{M}{m_{pl}^{2}}=\frac{M_{6}\times
10^{6}}{(2.18\times 10^{-5})^{2}}$ $\displaystyle=5.3\times
10^{-33}M_{6}\rm{sec}.$ (5.2)

where $M_{6}=M(g)/10^{6}(g)$

We assume that PBHs make a small fraction of the energy density of
relativistic matter at the moment of production. Thus, the energy density and
number density at $t=t_{in}$ are

$\displaystyle\rho^{(in)}_{BH}=\frac{3\epsilon}{32\pi}\frac{m_{pl}^{6}}{M^{2}},~{}~{}n_{BH}^{(in)}=\frac{3\epsilon}{32\pi}\frac{m_{pl}^{6}}{M^{3}}$
(5.3)

where $\epsilon<<1$. The energy density of relativistic matter at $t=t_{in}$
is

$\displaystyle\rho^{(in)}_{rel}=\frac{3}{32\pi}\frac{m_{pl}^{6}}{M^{2}}=\frac{\pi^{2}g*^{(in)}}{30}T^{4}_{(in)},$
(5.4)

where $g*^{(in)}\sim 100$ is the number of relativistic species at
$T=T_{in}\sim 1.72\times 10^{12}$ GeV/$\sqrt{M_{6}}$. The ratio of PBH number
density to that of relativistic particles at the moment of creation is
estimated to be

$\displaystyle
r_{in}=\frac{n^{(in)}_{BH}}{n^{(in)}_{rel}}=\frac{\rho^{(in)}_{BH}}{\rho^{(in)}_{rel}}\frac{T_{in}}{0.3M}=10^{12}\epsilon\times
M_{6}^{-3/2}=5.73\epsilon_{12}M_{6}^{-3/2}$ (5.5)

The average distance between PBHs at the moment of their creation is

$\displaystyle d_{in}^{BH}=(n^{(in)}_{BH})^{-1/3}=11.62\times
10^{-17}M_{6}\epsilon_{12}^{-1/3}\rm{cm}.$ (5.6)

Here $\epsilon_{12}=10^{12}\epsilon$. At the moment of equilibrium, the
distance of BH separation was

$\displaystyle d_{eq}^{BH}=d_{in}^{BH}/\epsilon_{12}=11.62\times
10^{-5}M_{6}\epsilon^{-4/3}$ (5.7)

The temperature of relativistic matter at equilibrium moment was

$\displaystyle T_{eq}=\epsilon
T_{in}S_{eq}^{1/3}=3.67\epsilon_{12}M_{6}^{-1/2}\rm{GeV},$ (5.8)

where $S_{eq}$ is the ratio of the number of particle species at $T=T_{in}$ to
that at $T=T_{eq}$, which is $\approx 10$.

The universe expanded in a relativistic regime before equilibrium was attained
and the scale factor in such a universe rose as $a(t)\sim t^{1/2}$. The
equilibrium is reached at the moment of time

$\displaystyle t_{eq}=t_{in}/\epsilon^{2}=5.3\times
10^{-33}M_{6}\epsilon^{-2}=5.3\times 10^{-9}\epsilon_{12}^{-2}M_{6}sec$ (5.9)

After this time, till the moment of decay,

$\displaystyle t=\tau=30M_{BH}^{3}/m_{pl}^{4}=30M_{6}^{3}\times
10^{18}\times\frac{1}{(2.18)^{4}\times 10^{20}}\times\frac{1}{8.53\times
10^{47}}\rm{sec}$ $\displaystyle=1.5\times 10^{-10}M_{6}^{3}\rm{sec}$ (5.10)

the universe expanded in matter dominated regime with the scale factor going
like $a(t)\sim t^{2/3}$. SO during this stage, the scale factor rose as

$\displaystyle
z(\tau)=\Big{(}\frac{\tau}{t_{eq}}\Big{)}^{2/3}=0.02(\epsilon_{12}\times
M_{6})^{4/3}$ (5.11)

Correspondingly, the energy density of PBHs just before their moment of decay
is larger than the energy density of the relativistic background and the
amount is calculated by the redshift factor $z(\tau)$, which is

$\displaystyle\frac{\rho_{BH}(\tau)}{\rho_{rel}(\tau)}=0.02(\epsilon_{12}\times
M_{6})^{4/3}.$ (5.12)

Now, the temperature of the relativistic background just before the black hole
decay was

$\displaystyle T_{cool}\equiv
T_{rel}(\tau)=T_{eq}/z(\tau)=183.5\epsilon_{12}^{-1/3}M_{6}^{-11/6}\rm{MeV}.$
(5.13)

The temperature of the particles produced during the BH decay is equal to

$\displaystyle T_{BH}=\frac{m_{pl}^{2}}{8\pi M}=0.48\times
10^{7}M_{6}^{-1}\rm{GeV}.$ (5.14)

Hence, the lightest SUSY particles of the minimal SUSY model with mass
$m_{X}\sim 10^{3}$ GeV should be produced abundantly in process of PBH
evaporation.
The average distance between PBH just before their decay was

$\displaystyle d^{BH}(\tau)=d^{BH}_{eq}.z(\tau)\approx 0.23\times
10^{-5}M_{6}^{7/3}\rm{cm}$ (5.15)

The total number of energetic particles produced by the decay of a single PBH
is given by

$\displaystyle
N_{hot}\approx\frac{M_{BH}}{3T_{BH}}=\frac{8\pi}{3}\Big{(}\frac{M}{m_{pl}}\Big{)}^{2}=1.8\times
10^{22}M_{6}^{2}.$ (5.16)

We assume the following model that the result of BH evaporation is a cloud of
energetic particles with temperature as $T_{BH}$ and with radius $\tau_{BH}$
given by

$\displaystyle\tau_{BH}=4.5M_{6}^{3}\rm{cm}.$ (5.17)

The number of PBHs in this common cloud is

$\displaystyle N_{cloud}=(\tau_{BH}/d_{BH}(\tau))^{3}=7.593\times
10^{18}M_{6}^{2}$ (5.18)

and their number density just before the decay was

$\displaystyle n_{BH}(\tau)=d(\tau)^{-3}=8.21\times
10^{16}M_{6}^{-7}\rm{cm}^{-3}.$ (5.19)

The density of hot particles with temperature $T_{BH}$, created by evaporation
of this set of black holes is

$\displaystyle n_{hot}=n_{BH}.N_{hot}=14.78\times
10^{38}M_{6}^{-5}\rm{cm}^{-3}.$ (5.20)

The density of cool background particles with temperature $T_{cool}$ is

$\displaystyle 0.1g*T_{cool}^{3}=3.03\times
10^{37}\epsilon_{12}^{-1}M_{8}^{-11/2}\rm{cm}^{-3}$ (5.21)

where we took $g_{*}=10$ at $T<100$MeV.
The cooling proceeds through the Coulomb-like scattering and hence the
momentum of hot particles decreases according to the equation

$\displaystyle\dot{E}_{hot}=-\sigma vn_{cool}\delta E,$ (5.22)

where $\delta E$ is the momentum transfer from hot particles to the cold ones.
For massless particles,

$\displaystyle q^{2}=(p_{1}-p_{2})^{2}=-2(E_{1}E_{2}-p_{1}.p_{2}).$ (5.23)

Finally we have

$\displaystyle\dot{E}=0.1g*T^{3}_{cool}\alpha^{2}/E_{1}\approx
10^{-4}T_{cool}^{2}.$ (5.24)

The loss of energy of hot particles of the order of their temperature would be
achieved during very short time

$\displaystyle t_{cool}\approx 10^{-10}\textrm{sec}$ (5.25)

As a result of mixing and thermalization between the hot and cool components,
the temperature of the resulting plasma would be

$\displaystyle T_{fin}=T_{cool}(\rho_{hot}/\rho_{cool})^{1/4}\approx
69.007M_{6}^{-3/2}\rm{MeV}.$ (5.26)

Then, the total number density of relativistic particles would be equal to

$\displaystyle
n_{rel}=0.1g*T^{3}_{fin}=328608.99M_{6}^{-9/2}(MeV)^{3}=0.04\times
10^{39}M_{6}^{-9/2}cm^{-3}$ (5.27)

According to (5.20), the number density of $X$-particles immediately after
evaporation should be about $10^{39}M_{6}^{-5}cm^{-3}$. After fast
thermalization, the ratio of number densities of $X$s to that of all
relativistic particles becomes

$\displaystyle n_{X}/n_{rel}=35$ (5.28)

The evolution of the number density of $X$-particles is given by the following
equation

$\displaystyle\dot{n}_{X}+3Hn_{X}=-\sigma^{ann}_{X}vn^{2}_{X}$ (5.29)

The Hubble parameter which enters (5.29) is given by the expression

$\displaystyle
H=\Big{(}\frac{8\pi^{3}g*}{90}\Big{)}^{1/2}\frac{T^{2}}{m_{pl}}\approx\frac{0.4T_{in}^{2}}{z^{2}m_{pl}}$
(5.30)

where $z=a_{in}/a$ is the ratio of the initial scale factor to the running one
and for $T_{in}$, we take $T_{fin}$ given by (5.26). Introducing
$r=n_{X}z^{3}$ and the changing the time variable to z, we arrive at

$\displaystyle\frac{dr}{dz}=-\frac{\sigma_{ann}vm_{pl}}{0.4T^{2}_{in}}\frac{r^{2}}{z^{2}}$
(5.31)

which can be solved and we get

$\displaystyle n_{X}=\frac{n_{in}}{z^{3}(1-1/z)}\rightarrow\frac{1}{Qz^{3}},$
(5.32)

where $Q=(\sigma vm_{pl})/(0.4T_{in}^{2})$.

According to observational data, we have

$\displaystyle\Omega_{DM}=0.26~{}~{}\textrm{and}~{}~{}\Omega_{CMB}=5.5\times
10^{-5}$ (5.33)

or we can say in terms of energy density that
$(\rho_{X}/\rho_{\gamma})_{obs}\approx 5\times 10^{3}$. We now have

$\displaystyle\sigma_{ann}vm_{pl}\sim 3\times 10^{11}\textrm{GeV}^{-1}$ (5.34)

and

$\displaystyle n_{X}\approx 10^{-12}z^{-3}T_{in}^{2}GeV$ (5.35)

Now, the red-shift factor $z$ depends on both $M_{6}$ and the initial energy
density ($\epsilon$). Thus, an appropriate choice of both these parameters
would yield a significant amount of dark matter relic. Indeed, if we choose
$\epsilon=10^{-14}$, the resultant number density of $X$ (DM particles) is
given by

$\displaystyle n_{X}\approx 1.1\times 10^{3}GeV$ (5.36)

In the following tables we have shown the variation of the ratio of the dark
matter particles to the relativistic particles for different values of the
ratio of the mass of PBH to that of the mean mass of the spectrum. For
brevity, the notation is kept same as $M_{6}$. The parameter space for the
Extended mass spectrum-II is kept same as that of the first one in order to
lay out the comparison more clearly.

Extended mass spectrum-I
---
$M_{6}$ |  $n_{BH}(\rm{cm}^{-3}$) |  $n_{X}/n_{rel}$
$0.1$ |  $8.21\times 10^{23}$ |  0.035
$1$ |  $8.21\times 10^{16}$ |  0.1106
$10$ |  $8.21\times 10^{9}$ |  0.35
$100$ |  $8.21\times 10^{2}$ |  1.1068

Extended mass spectrum-II
---
$M_{6}$ |  $n_{BH}(\rm{cm}^{-3})$ |  $n_{X}/n_{rel}$
$0.1$ |  $8.21\times 10^{23}$ |  0.035
$1$ |  $8.21\times 10^{16}$ |  0.1106
$10$ |  $8.21\times 10^{9}$ |  0.35
$100$ |  $8.21\times 10^{2}$ |  1.1068

As can be seen from the two tables the ratio of the relic abundance to that of
the relativistic particles is exactly the same for both spectra with the
condition that their parameter space is the same.

Figure 3: The variation of the ratio of the relic to that of the relativistic
particles produced as a result of PBH evaporation is shown. The left panel
corresponds to that of Extended Mass Spectrum-I and the right panel to that of
Extended Mass Spectrum-II.

As can be seen from the above figure (3) the two panels are identical and
hence showing the production of relics due to PBH evaporation is not dependent
on the mechanism of the production of PBHs. It is also clear that the the
ratio of the mean mass of the black hole to the peak value of the black hole
is inversely proportional to the relic abundance. Lesser the ratio, greater is
the relic abundance.

Figure 4: The production of dark matter particles as a result of PBH
evaporation is shown. The left panel corresponds to that of Extended Mass
Spectrum-I and the right panel to that of Extended Mass Spectrum-II.

It is clear from the above figure (4) the relic abundance depends on the
energy density of the primordial black holes. The dependence is given by the
following relation:

$\displaystyle n_{X}\sim\frac{1}{\epsilon_{12}^{4}}$ (5.37)

Thus, lesser the initial energy density of the primordial black holes, more is
the relic abundance. Since the ratio of the DM particles to that of
relativistic matter is again proportional to the inverse fourth power of the
initial energy density, we can get a significant ratio $(>1)$ by adjusting the
value of the initial energy density appropriately.

##  6 Conclusion

Production of primordial black holes can lead to a specific form of their mass
spectrum, reflecting physical mechanism of their creation. Such mechanisms
relate the mass interval and specific features of the PBH spectrum to the BSM
physics at very high energy scales.

In the recent work [28], it is shown how the evaporation of a singular PBH,
which can be approximated as a delta function mass spectrum, can lead to the
instant change of regime and contribute to the dark matter density of the
universe. It was shown how the energy density of the PBH affected the density
of the dark matter. On the same note, it is established in this work that the
initial energy density of the PBHs at the very early stage of the universe
expansion plays a significant role in the production of dark matter (relic
abundance) as a result of PBH evaporation. This idea has been tested for the
cases when PBHs were formed by the ZN mechanism accomplished by strongly
increased probability of their formation in some interval of small PBH mass
and also for the case when they were formed by the collapse of domain wall. In
both the cases, the resulting number density of the dark matter particles is
significant. We conclude with the claim that the dark matter production
process due of the evaporation of PBHs does not depend of the mechanism of PBH
formation for the same peak mass in their mass distribution. However, the PBH
mass spectrum may be flat as it is the case for PBH formation at the post-
inflational matter dominant stage of massive scalar field [31]. There is no
evident peak mass value in such case and the proper analysis of evolution of
PBH dominant stage and DM production in PBH evaporation need special study,
which we plan in our future work.

## Acknowledgments

The work of A.C. is supported by the project RES/SERB/PH/P0202/2021/0039. The
research by M.K. is financially supported by Southern Federal University, 2020
Project VnGr/2020-03-IF. The work of P.C is supported by the EPSRC fellowship.

## References

  * [1] M.Y. Khlopov, Primordial black holes. Res. Astron. Astrophys. 10 (2010) , 495–528, doi:10.1088/1674-4527/10/6/001.
  * [2] T. Kokubu, K. Kyutoku, K. Kohri and T. Harada, Phys. Rev. D 98 (2018) no.12, 123024 doi:10.1103/PhysRevD.98.123024 [arXiv:1810.03490 [astro-ph.CO]].
  * [3] A. C. Jenkins and M. Sakellariadou, Primordial black holes from cusp collapse on cosmic strings, [arXiv:2006.16249 [astro-ph.CO]].
  * [4] T. H. Jung and T. Okui, Primordial black holes from bubble collisions during a first-order phase transition, [arXiv:2110.04271 [hep-ph]].
  * [5] S. S. Mishra and V. Sahni, Primordial Black Holes from a tiny bump/dip in the Inflaton potential, JCAP 04 (2020), 007 doi:10.1088/1475-7516/2020/04/007 [arXiv:1911.00057 [gr-qc]].
  * [6] J. Liu, Z. K. Guo and R. G. Cai, Primordial Black Holes from Cosmic Domain Walls, Phys. Rev. D 101 (2020) no.2, 023513 doi:10.1103/PhysRevD.101.023513 [arXiv:1908.02662 [astro-ph.CO]].
  * [7] P. Gondolo, P. Sandick and B. Shams Es Haghi, Effects of primordial black holes on dark matter models, Phys. Rev. D 102 (2020) no.9, 095018 doi:10.1103/PhysRevD.102.095018 [arXiv:2009.02424 [hep-ph]].
  * [8] T. Kitabayashi, Primordial black holes and dark matter mass spectrum, [arXiv:2204.07898 [hep-ph]].
  * [9] M. J. Baker and A. Thamm, Probing the particle spectrum of nature with evaporating black holes, SciPost Phys. 12 (2022) no.5, 150 doi:10.21468/SciPostPhys.12.5.150 [arXiv:2105.10506 [hep-ph]].
  * [10] N. Bernal and Ó. Zapata, Self-interacting Dark Matter from Primordial Black Holes, JCAP 03 (2021), 007 doi:10.1088/1475-7516/2021/03/007 [arXiv:2010.09725 [hep-ph]].
  * [11] M.Y. Khlopov, A.G. Polnarev, Primordial black holes as a cosmological test of grand unification. Phys. Lett. B 97  (1980) 383–387, doi:10.1016/0370-2693(80)90624-3.
  * [12] A.G. Polnarev, M.Y. Khlopov, Cosmology, primordial black Holes, and supermassive particles. Sov. Phys. Uspekhi 28 (1985) 213–232, doi:10.1070/PU1985v028n03ABEH003858.
  * [13] M. Lemoine, Moduli constraints on primordial black holes. Phys. Lett. B 2000, 481, 333–338, doi:10.1016/ S0370-2693(00)00469-X.
  * [14] Green, A.M. Supersymmetry and primordial black hole abundance constraints. Phys. Rev. D 1998,  60, 063516, doi:10.1103/PhysRevD.60.063516.
  * [15] B. Carr, F. Kuhnel and M. Sandstad, Primordial Black Holes as Dark Matter, Phys. Rev. D 94 (2016) no.8, 083504 doi:10.1103/PhysRevD.94.083504 [arXiv:1607.06077 [astro-ph.CO]]
  * [16] R. J. Scherrer and M. S. Turner, Decaying particles do not “heat up” the Universe, Phys. Rev. D 31, 681.
  * [17] M.Y. Khlopov, A. Barrau and J.Grain, Gravitino production by primordial black hole evaporation and constraints on the inhomogeneity of the early Universe. Class. Quantum Grav. 2006, 23, 1875–1882, doi:10.1088/0264-9381/23/6/004.
  * [18] A. Addazi, A. Marciano, S.V. Ketov and M.Yu.Khlopov, Physics of superheavy dark matter in supergravity. Int. J. Mod. Phys. D 2018, 27, 1841011. DOI: 10.1142/S0218271818410110
  * [19] A. Dolgov and J. Silk, Baryon isocurvature fluctuations at small scales and baryonic dark matter, Phys. Rev. D 47 4244, (1993).
  * [20] A. Dolgov, M. Kawasaki, N. Kevlishvili, Inhomogeneous baryogenesis, cosmic antimatter, and dark matter, arXiv:0806.2986.
  * [21] P. Ivanov, P. Naselsky and I. Novikov, Inflation and primordial black holes as dark matter, Phys. Rev. D 50 7173, (1994).
  * [22] J. Garcia-Bellido, A. D. Linde, D. Wands, Density Perturbations and Black Hole Formation in Hybrid Inflation, Phys. Rev.D 54 60406058 (1996), arXiv:astro-ph/9605094.
  * [23] M. Kawasaki, K. Murai, Formation of supermassive primordial black holes by Affleck-Dine mechanism, JCAP01(2019)027, arXiv:1907.02273.
  * [24] P. Gondolo, P. Sandick and B. Shams Es Haghi, Effects of primordial black holes on dark matter models, Phys. Rev. D 102 (2020) no.9, 095018, arXiv:2009.02424
  * [25] L.A. Kofman and A.D. Linde, Generation of density perturbations in the inflationary cosmology. Nucl. Phys. B 282 (1987) 555–626, doi:10.1016/0550-3213(87)90698-5.
  * [26] A.S. Sakharov and M.Yu. Khlopov, Cosmological signatures of family symmetry breaking in multicomponent inflation models. Phys. Atom. Nucl. 56 (1993) 412–417.
  * [27] S. G. Rubin, A.S. Sakharov and M. Yu. Khlopov, The Formation of Primary Galactic Nuclei during Phase Transitions in the Early Universe, Journal of Experimental and Theoretical Physics, Vol. 92, No. 6, 2001, pp. 921–929.
  * [28] B. Colleppa, K. Loho and S. Shil, Dark Matter Phenomenology in the Littlest Seesaw Model with an Extended Dark Sector in presence of Primordial Black Hole, [arXiv:2209.06793 [hep-ph]].
  * [29] V. I. Dokuchaev, Y. N. Eroshenko and S. G. Rubin, Early formation of galaxies initiated by clusters of primordial black holes, Astron. Rep. 52 (2008), 779-789 doi:10.1134/S1063772908100016 [arXiv:0801.0885 [astro-ph]].
  * [30] S. G. Rubin, M. Y. Khlopov and A. S. Sakharov, Primordial black holes from nonequilibrium second order phase transition, Grav. Cosmol. 6 (2000), 51-58 [arXiv:hep-ph/0005271 [hep-ph]].
  * [31] M.Y. Khlopov, B.A. Malomed, Y.B. Zel’dovich, Gravitational instability of scalar fields and formation of primordial black holes. Mon. Not. R. Astron. Soc. 215 (1985) 575–589.