# Intruder configurations in 29Ne at the transition into the island of
inversion:
Detailed structure study of 28Ne

H. Wang<EMAIL_ADDRESS>M. Yasuda  Y. Kondo  T. Nakamura  J. A. Tostevin  K.
Ogata  T. Otsuka  A. Poves  N. Shimizu  K. Yoshida  N.L. Achouri  H. Al Falou
L. Atar  T. Aumann  H. Baba  K. Boretzky  C. Caesar  D. Calvet  H. Chae  N.
Chiga  A. Corsi  H.L. Crawford  F. Delaunay  A. Delbart  Q. Deshayes  Zs.
Dombrádi  C. Douma  Z. Elekes  P. Fallon  I. Gašparić  J.-M. Gheller  J.
Gibelin  A. Gillibert  M.N. Harakeh  A. Hirayama  C.R. Hoffman  M. Holl  A.
Horvat  Á. Horváth  J.W. Hwang  T. Isobe  J. Kahlbow  N. Kalantar-Nayestanaki
S. Kawase  S. Kim  K. Kisamori  T. Kobayashi  D. Körper  S. Koyama  I. Kuti
V. Lapoux  S. Lindberg  F.M. Marqués  S. Masuoka  J. Mayer  K. Miki  T.
Murakami  M.A. Najafi  K. Nakano  N. Nakatsuka  T. Nilsson  A. Obertelli  N.A.
Orr  H. Otsu  T. Ozaki  V. Panin  S. Paschalis  A. Revel  D. Rossi  A.T. Saito
T. Saito  M. Sasano  H. Sato  Y. Satou  H. Scheit  F. Schindler  P. Schrock
M. Shikata  Y. Shimizu  H. Simon  D. Sohler  O. Sorlin  L. Stuhl  S. Takeuchi
M. Tanaka  M. Thoennessen  H. Törnqvist  Y. Togano  T. Tomai  J. Tscheuschner
J. Tsubota  T. Uesaka  Z. Yang  K. Yoneda  RIKEN, High Energy Nuclear Physics
Laboratory, 2-1 Hirosawa, Wako, Saitama 351-0198, Japan  Department of
Physics, Tokyo Institute of Technology, 2-12-1 O-Okayama, Meguro, Tokyo
152-8551, Japan  Department of Physics, Faculty of Engineering and Physical
Sciences, University of Surrey, Guildford, Surrey GU2 7XH, United Kingdom
Department of Physics, Kyushu University, Fukuoka 819-0395, Japan  Research
Center for Nuclear Physics (RCNP), Osaka University, Ibaraki 567-0047, Japan
University of Tokyo, Tokyo 1130033, Japan  RIKEN Nishina Center, Hirosawa 2-1,
Wako, Saitama 351-0198, Japan  Departamento de Física Teórica and IFT UAM-
CSIC, Universidad Autónoma de Madrid, 28049 Madrid, Spain  Center for
Computational Sciences, University of Tsukuba, 1-1-1 Tennodai, Tsukuba
305-8577, Japan  Advanced Science Research Center, Japan Atomic Energy Agency,
Tokai, Ibaraki 319-1195, Japan  LPC Caen, CNRS/IN2P3, ENSICAEN, UniCaen,
Normandie Université, 14050 CAEN Cedex, France  Lebanese University, Beirut,
Lebanon  Institut für Kernphysik, Technische Universität Darmstadt, 64289
Darmstadt, Germany  GSI Helmholtzzentrum für Schwerionenforschung, 64291
Darmstadt, Germany  Irfu, CEA, Université Paris-Saclay, 91191 Gif-sur-Yvette,
France  Center for Exotic Nuclear Studies, Institute for Basic Science,
Daejeon 34126, Republic of Korea  Nuclear Science Division, Lawrence Berkeley
National Laboratory, Berkeley, California 94720, USA  Institute of Nuclear
Research, Atomki, 4001 Debrecen, Hungary  ESRIG, University of Groningen,
Zernikelaan 25, 9747 AA Groningen, The Netherlands  Ruđer Bošković Institute,
HR-10002 Zagreb, Croatia  Physics Division, Argonne National Laboratory,
Argonne, Illinois 60439, USA  Eötvös Loránd University, Pázmány Péter Sétány
1/A, H-1117 Budapest, Hungary  Department of Advanced Energy Engineering
Science, Kyushu University, Kasuga, Fukuoka 816-8580, Japan  Department of
Physics, Tohoku University, Miyagi 980-8578, Japan  Institutionen för Fysik,
Chalmers Tekniska Högskola, 412 96 Göteborg, Sweden  Center for Nuclear Study,
University of Tokyo, 2-1 Hirosawa, Wako, Saitama 351-0198, Japan  Institut für
Kernphysik, Universität zu Köln, 50937 Köln, Germany  Facility for Rare
Isotope Beams, Michigan State University, East Lansing, Michigan 48824, USA
Department of Physics, Kyoto University, Kyoto 606-8502, Japan  Grand
Accélérateur National d’Ions Lourds (GANIL), CEA/DRF-CNRS/IN2P3, Bvd Henri
Becquerel, 14076 Caen, France  Department of Physics and Astronomy, Seoul
National University, 1 Gwanak-ro, Gwanak-gu, Seoul 08826, Korea  Department of
Physics, Osaka University, Osaka 560-0043, Japan  Department of Physics and
Astronomy, Michigan State University, East Lansing, Michigan 48824, USA

###### Abstract

Detailed $\gamma$-ray spectroscopy of the exotic neon isotope 28Ne has been
performed for the first time using the one-neutron removal reaction from 29Ne
on a liquid hydrogen target at 240 MeV/nucleon. Based on an analysis of
parallel momentum distributions, a level scheme with spin-parity assignments
has been constructed for 28Ne and the negative-parity states are identified
for the first time. The measured partial cross sections and momentum
distributions reveal a significant intruder $p$-wave strength providing
evidence of the breakdown of the $N=20$ and $N=28$ shell gaps. Only a weak,
possible $f$-wave strength was observed to bound final states. Large-scale
shell-model calculations with different effective interactions do not
reproduce the large $p$-wave and small $f$-wave strength observed
experimentally, indicating an ongoing challenge for a complete theoretical
description of the transition into the island of inversion along the Ne
isotopic chain.

###### keywords:

in-beam $\gamma$-ray spectroscopy , island of inversion, shell evolution

###### MSC:

[2010] 00-01, 99-00

††journal: Physics Letter B

The understanding of nuclei far from the line of $\beta$ stability is one of
the key challenges of modern nuclear physics. It is predicted that these
exotic nuclei, with large imbalances between proton ($Z$) and neutron ($N$)
numbers, will undergo dramatic changes to their shell structures compared to
those established for stable nuclei. Indeed, such modifications of shell
structure have now been observed for a wide range of exotic nuclei, revealing
the breakdown of conventional shell gaps and the formation of new ones.

A pivotal area for a sudden shell structure change is the so-called "island of
inversion", comprising neutron-rich F($Z=9$), Ne ($Z=10$), Na ($Z=11$), and Mg
($Z=12$) isotopes around $N=20$. The first such indication, from mass
measurements of 31,32Na [1], found these systems to be more bound than
expected for a spherical shape with the conventional $N=20$ shell gap. An
onset of quadrupole deformation was later reported in 32Mg [2] and 30Ne [3,
4], revealed by the low excitation energies of their first $2^{+}_{1}$ states
and large $B(E2;0_{gs}\rightarrow 2^{+}_{1})$ transition probabilities. Moving
towards the more neutron-rich isotopes, large quadrupole deformation was found
in 40Mg at $N=28$ [5]. As modeled by shell-model calculations [6], this
dramatic change in nuclear structure in the island of inversion is attributed
to neutron particle-hole ($n$p-$n$h) excitations across the quenched $N=20$
and $N=28$ shell gaps between the $sd$ and $pf$ orbitals.

Many experimental efforts have been made to explore the mechanism driving the
emergence of the island of inversion. While extensive studies have been
performed for the magnesium isotopic chain [7, 8, 9, 10, 11, 12], such
detailed structure information remains more limited for the Ne isotopes. Along
the Ne isotopic chain, the first onset of a $pf$-shell intruder configuration
was identified in 28Ne [13], while 29Ne [14, 15, 16, 17] borders, and 30-32Ne
[18, 19, 20, 21] lie within the island of inversion. Experimental findings
suggest that the intruder $p$-wave configuration plays a key role. The
spectroscopic factor (C2S) for removing a neutron from the 2$p_{3/2}$ intruder
state in 28Ne was deduced to be 0.32(4) [13]. This 2$p_{3/2}$ neutron removal
strength increases to 0.9(1) in 30Ne [14].

For 29Ne, a dominant $p$-wave ground-state configuration was deduced by
measuring both the inclusive and Coulomb dissociation cross sections for 28Ne
production via the neutron removing reactions on a carbon and lead target,
respectively [15]. In addition to these $p$-wave contributions, $f$-wave
intruder neutron-removal strength has been identified, populating unbound
states in 27Ne [22] and 29Ne [16]. These $f$-wave components reveal a markedly
different picture, compared to shell-model calculations, which predict
significant $f$-wave intruder strength leading to bound final states [14, 22].
Obtaining a quantitative determination of this $pf$-shell strength in the
ground state of 29Ne, at the transition into the island of inversion, is
critical to understand the development of such intruder configurations along
the neon isotopic chain – as well as to provide essential input for developing
its theoretical description.

Accordingly, the neutron-rich Ne isotopes can provide a testing ground
offering new insight into this theoretical description. Originally, models
suggested that the structures developing in the island-of-inversion nuclei
were expected to be dominated by 2p-2h intruder configurations [23]. However,
more recent theoretical studies have proposed considerable 4p-4h intruder
contributions [24, 25, 26] to explain the evolution of intruder $pf$ strength
from 30Mg [8] to 32Mg [26, 27]. For the neon isotopes, the 4p-4h configuration
was hinted by the suppression of the two-proton removal cross section from
30Ne [18] whereas a very recent study of 32Ne found no significant difference
in expectations between theoretical descriptions that include only 2p-2h and
those with 4p-4h configurations [21]. More detailed spectroscopic information
in the Ne isotopes is needed to pin down these different descriptions of the
island of inversion.

In this work, we report on in-beam $\gamma$-ray spectroscopy of 28Ne
($Z=10,N=18$) produced by the one-neutron removal reaction from 29Ne on a
proton target. These new experimental results provide a more detailed level
scheme, via the partial cross sections to the individual bound states in 28Ne
and their momentum distributions – a direct probe of the active, valence
neutron orbitals. This allows a quantitative determination of the strength of
$pf$ intruder configurations in the 29Ne ground state for the first time.

A hydrogen target was used due to the advantages of proton-induced reactions
in nuclear structure study with exotic beams [28], such as high luminosity.
Detailed comparisons of analyses of specific nucleon removal experiments on
proton and light nuclear targets have not yet been made. One purpose of the
present hydrogen target experiment is to provide such data to compare with the
earlier comprehensive (but less exclusive) carbon target data [15] and
analysis and to begin a program of such comparisons.

Located at the border of the island of inversion, 28Ne is expected to
demonstrate intruder $pf$ strength. To date, studies of 28Ne have mainly
concerned the properties of the $2^{+}_{1}$ state [29, 30, 31, 32]. Along the
Ne isotopic chain, a lowering of the $2^{+}_{1}$ state energy,
$E_{x}(2^{+}_{1})$, occurs at 28Ne, suggesting an onset of quadruple
deformation [29]. However, the deformation parameters, for both protons and
neutrons [30, 31, 32] were found to be moderate as compared to other nuclei
inside the island of inversion. On the other hand, the available spectroscopic
studies on the $N=18$ isotones have revealed the development of intruder $pf$
configurations – with the intruder contributions present in low-lying excited
states and expected to be present even in ground states towards the low-$Z$
part of the chain – due to shell evolution. Indeed, shell-model calculations
also suggest that the $N=20$ and $N=28$ shell gaps will reduce with decreasing
atomic number [33]. For instance, intruder states were found in the excited
$0^{+}$ states in 34Si ($Z=14$) [34] and 30Mg ($Z=12$) [35] as well as in the
low-lying excited states in 29Na ($Z=11$) [36]. Moving to 28Ne, additional
contributions from intruder configurations are expected according to shell-
model calculations [23, 25, 24] as compared to the heavier $N=18$ isotones.
Thus, detailed structural information will allow quantitative study of this
$pf$-shell intruder strength in 28Ne.

Figure 1:  (a) $\gamma$-ray energy spectrum in coincidence with the
29Ne$(p,pn)$28Ne reaction, after Doppler-shift correction. The fit result
(blue line) includes simulated DALI2 response functions (red dashed lines) and
a double-exponential background (black dashed line). The $\gamma$-ray spectra
are shown for a gate on the 1323-keV (b) and 1732-keV (c) transitions. The
self-coincidences in (b) originate from the Compton events of transitions at
high energy. The gate used for $\gamma-\gamma$ analysis in (c) was shifted
from the centroid of the 1732-keV peak to minimize the cross contamination
from overlapping peaks.  Figure 2:  Experimental and calculated level schemes
for 28Ne. Excitation energies, spins and parities are provided beside the
levels. Observed $\gamma$-ray energies and their relative intensities are also
given. The experimental spin-parity assignments are based on the analysis on
the shapes of the parallel momentum distribution obtained in coincidence with
the transitions. Three sets of the calculated level schemes using different
shell-model interactions SDPF-M, SDPF-U-MIX and EEdf1 are shown for
comparison. See details in the text.

The experiment was performed at the Radioactive Isotope Beam Factory (RIBF),
operated by the RIKEN Nishina Center and the Center for Nuclear Study,
University of Tokyo. A 29Ne secondary beam was produced by fragmentation of a
48Ca primary beam at 345 MeV/nucleon, with a typical intensity of 550 pnA, on
a 15-mm-thick beryllium target located at the entrance of the BigRIPS fragment
separator [37]. The 29Ne beam was selected and purified in BigRIPS by
employing two wedge-shaped aluminum degraders at the dispersive foci.
Identification of the 29Ne particles was made event-by-event by measuring the
time of flight (TOF), magnetic rigidity ($B\rho$), and energy loss ($\Delta
E$), as described in Ref. [38]. The average intensity of the 29Ne beam in
BigRIPS was 8.2 $\times$ 103 particles per second and its fraction in the
secondary beams was $\sim$85%.

The 29Ne beam impinged on the MINOS [39] target, a 151(1)-mm-thick liquid
hydrogen target, with an energy of 240 MeV/nucleon at the center of the
target. The target was surrounded by a time projection chamber for measuring
the trajectory of the recoil proton from the ($p,pn$) reaction. The tracks of
the beam particles, measured by the drift chamber before the target, and the
proton were used to reconstruct the reaction vertex in the target [39]. The
measured efficiency to detect the outgoing proton was 67(5)%.

To detect the $\gamma$ rays emitted from the excited states of 28Ne, the MINOS
target was surrounded by the DALI2 array [40], which consisted of 142 NaI(Tl)
scintillators. The efficiency and energy resolution for 1-MeV $\gamma$ rays
were 15% and 11% (FWHM), respectively. The DALI2 response to $\gamma$ rays was
generated using Monte Carlo simulations with the GEANT4 [41] framework and the
experimental $\gamma$-ray energy spectrum was fitted with these response
functions. DALI2 was chosen not only for its high $\gamma$-ray detection
efficiency but also because the MINOS setup is optimized for coupling with it
in a compact geometry [39].

Downstream of MINOS, the reaction residues were transported to the SAMURAI
spectrometer [42] and identified by measuring their $B\rho$, $\Delta E$ and
TOF information. A central magnetic field of 2.9 Tesla was applied for the
SAMURAI dipole magnet. The $B\rho$ values of charged particles were
reconstructed using two drift chambers located at the entrance and exit of the
magnet [42]. The TOF and $\Delta E$ measurements were made using a 24 element
plastic scintillator hodoscope.

The Doppler-shift-corrected $\gamma$-ray energy spectrum measured in
coincidence with the 29Ne$(p,pn)$28Ne channel is shown in Fig. 1(a). The
spectrum was fitted using simulated DALI2 response functions added to a
double-exponential background. Eight transitions were identified, as listed in
Table 1. The 1323-keV transition with the most intensity, corresponding to the
$2^{+}_{1}\rightarrow 0^{+}_{gs}$ decay, is consistent with previous reports
[15, 29, 30, 31, 32, 43, 44]. The second most intense transition is found at
1600 keV, confirming the previous report [15]. The peak at 951 keV confirms
the previous measurements [15, 44]. The transitions at 2078, 2502, and 2923
keV are newly found in the present work. $\gamma-\gamma$ analysis showed that
the transitions at 951, 1118, 1600, 1732, 2078, and 2502 keV are in
coincidence with the $2^{+}_{1}\rightarrow 0^{+}_{gs}$ decay, as displayed in
Fig. 1(b). Within the energy uncertainties, the 2923-keV transition is in good
agreement with the sum of the 1323- and 1600-keV transitions. The 1118-keV
transition, reported in Refs. [43, 45] at 1127 keV, is suggested to be in
coincidence with the $2^{+}_{1}\rightarrow 0^{+}_{gs}$ decay, based on this
neutron removal reaction data. Gating around 1732 keV, peaks are found at 951
keV and 1323 keV, as shown in Fig. 1(c), suggesting a $\gamma$-ray cascade.
The 951- and 1732-keV transitions are found to have the same intensities in
the present work and thus their placement is difficult. The cascade decay may
correspond to those reported in the inelastic scattering [32] and one-proton
knockout reactions [43], where the 1732-keV transition is more intense than
the 951-keV one. In addition, a large intensity for the 1732-keV transition is
suggested from other measurements [31, 44]. Therefore, the 1732-keV transition
is tentatively placed lower than the 951-keV transition. Based on the observed
$\gamma-\gamma$ coincidences, a level scheme is constructed as presented in
Fig. 2.

The measured inclusive cross section to all bound states was determined to be
28(1) mb. As a thick target is used, the reaction loss in the thick liquid
hydrogen target is accounted for using the method presented in Ref. [15].

Using the fit result and level scheme constructed above, the partial cross
sections associated with each excited state were obtained. These partial cross
sections are summarized in Table 2, ordered by increasing excitation energy.
The ground-state cross section was obtained by subtracting the cross section
to all excited states from the inclusive one.

Table 1: Observed $\gamma$-ray energies ($E_{\gamma}$) from the one-neutron knockout reaction from 29Ne and their placements in 28Ne. Intensities relative to the 1323-keV transition are also shown. The uncertainties in the relative intensities indicate the statistical contributions.  $E_{\gamma}$ (keV) | Placement | Relative intensity (%)
---|---|---
951(5) | 4006 $\rightarrow$ 3055 | 13.4(1)
1118(6) | 2441 $\rightarrow$ 1323 | 15.6(1)
1323(7) | 1323 $\rightarrow$ 0 | 100.0(2)
1600(9) | 2923 $\rightarrow$ 1323 | 36.4(2)
1732(10) | 3055 $\rightarrow$ 1323 | 13.9(1)
2078(12) | 3401 $\rightarrow$ 1323 | 7.6(4)
2502(17) | 3825 $\rightarrow$ 1323 | 7.1(5)
2923(22) | 2923 $\rightarrow$ 0 | 5.3(4)
Table 2: Results for one-neutron removal from 29Ne. Level energies ($E_{x}$)
and partial cross sections ($\sigma_{\rm exp}$) are listed. The orbitals of
the removed neutron are also shown. Calculated theoretical single-particle
cross sections ($\sigma_{\rm sp}$) using the DWIA [46, 47] and eikonal
frameworks [48] are presented in the last two columns. The experimental
spectroscopic factors can be obtained by using C2Sexp-DWIA(eikonal) =
$\sigma_{\rm exp}$/$\sigma_{\rm sp-DWIA(eikonal)}$.

$E_{x}$ (keV) |  $\sigma_{\rm exp}$ (mb) | orbital |  $\sigma_{\rm sp-DWIA}$ (mb) |  $\sigma_{\rm sp-eikonal}$ (mb)
---|---|---|---|---
0 | 8.4(8) | $2p_{3/2}$ | 14.81 | 21.19
1323 | 3.6(3) |  $2p_{3/2}$a | 11.93 | 18.56
|  |  $2p_{3/2}$b | 11.93 | 18.56
|  |  $1f_{7/2}$b | 8.00 | 13.69
2441 | 2.9(1) | $2p_{3/2}$ | 10.57 | 17.18
2923 | 7.7(2) | $2p_{3/2}$ | 10.13 | 16.70
3055 | 0.1(1) |  |  |
3401 | 1.4(1) |  $1d_{3/2}$c | 5.90 | 11.46
|  |  $2s_{1/2}$d | 8.46 |
|  |  $1p_{3/2}$e | 9.74 |
3825 | 1.3(1) | $2s_{1/2}$ | 8.14 | 14.80
4006 | 2.5(1) | $1d_{3/2}$ | 5.70 | 11.13
Inclusive | 28(1) |  |  |

a A removal from $2p_{3/2}$ is assumed.
b A linear combination of $2p_{3/2}$ and $1f_{7/2}$ is assumed.
c A removal from $1d_{3/2}$ is assumed.
d A removal from $2s_{1/2}$ is assumed.
e A removal from $2p_{3/2}$ is assumed.

Figure 3:  Measured parallel momentum distributions for the 28Ne residues
obtained following the 29Ne($p,pn)$ in coincidence with $\gamma$-ray
transitions. The distribution of the 1323-keV state was obtained by
subtracting the contributions from the feeding states. The experimental data
are compared with the shapes computed from the DWIA calculations when assuming
neutron-removal from the 2$s_{1/2}$ (green), 2$p_{3/2}$ (red) , 1$d_{3/2}$
(blue), and 1$f_{7/2}$ (cyan) orbitals.

The intermediate energy one-neutron removal reaction is known to be a powerful
tool to assign spins and parities since the shapes of the residue momentum
distributions reflect the orbital angular momentum of the removed neutron. To
make the excited states spin-parity assignments, the shapes of the momentum
distributions of the 28Ne residues in the 29Ne rest frame were analyzed. The
parallel momentum distributions were reconstructed using the velocities of the
beam and fragments, as well as the scattering angle determined from the
reaction vertex and the drift chambers located behind the secondary target. A
resolution of 30 MeV/$c$ (root mean square) was evaluated by measuring the
unreacted 29Ne beam. The momentum distributions for the excited states were
determined by fitting the $\gamma$-ray spectra in coincidence with the
selection of 40 MeV/c wide bins of the inclusive momentum and obtaining the
integral for each $\gamma$-ray transition.

For the 1323-keV state, the momentum distribution was obtained after the
subtraction of the contributions from the feeding states, based on the level
scheme presented in Fig. 2. The momentum distribution for the 3055-keV state
could not be obtained in the present work because its cross section is
consistent with zero. The resulting momentum distributions are displayed in
Fig. 3. The large error bars in the 1323-keV momentum distribution are due to
the subtraction of the feeding states. For the 3401- and 3825-keV states, the
errors in the momentum distributions are dominated by the statistical
contributions because of their relatively small intensities.

These experimental momentum distributions are compared to those calculated
using the distorted wave impulse approximation (DWIA) model [46, 47] assuming
neutron removal from different single-particle orbitals, namely 2$s_{1/2}$,
2$p_{3/2}$, 1$d_{3/2}$, and 1$f_{7/2}$. The model has been already applied in
several works [49, 50, 51, 52, 53]. For the comparison, the overall
normalization factor in the calculated momentum distribution was treated as a
free parameter. In the DWIA approach, the single-particle wave function and
nuclear density were derived from the Bohr-Mottelson single-particle potential
[54]. The depth of the potential is adjusted to reproduce the neutron
separation energy of 29Ne for each state of the 28Ne core. Optical potentials
used for the distorted waves in the initial and final states were constructed
by the microscopic folding model [55] from the calculated nuclear density and
the Melbourne $g$-matrix interaction [56]. The Franey-Love parameterization
[57] was applied for the neutron-removing proton-neutron interaction of the
elementary process. We note that the momentum distributions computed with the
DWIA framework present small asymmetric shapes [47], and those from the
eikonal dynamical model have symmetric ones [48]. The widths of the
distributions calculated from both theoretical approaches are essentially
identical and our conclusions regarding the deduced spin-parities of final
states are common to both methods.

The state at 1323 keV has been assigned to the $2^{+}_{1}$ state in the
previous reports. Considering the ground state of 29Ne is $3/2^{-}$ [14, 15],
spin-parity conservation dictates that population of the $2^{+}_{1}$ state
occurs due to neutron removal from the 2$p_{3/2}$ or 1$f_{7/2}$ orbitals. The
measured 1323-keV momentum distribution is thus fitted assuming two
possibilities: (i) removal from pure 2$p_{3/2}$, and (ii) removal from a
linear combination of 2$p_{3/2}$ and 1$f_{7/2}$ orbitals, as shown in Fig.
3(a). The latter fit comprises $71\pm 15\%$ of $p$\- and $29\pm 15\%$ of
$f$-wave strength. Due to the size of the error bars after feeding
subtraction, these two fits cannot be resolved. The fit using a combination of
$p$\- and $f$-wave configurations indicates the possibility of a small
$f$-wave contribution to the bound states. Using this combination, the cross
sections for the $p$\- and $f$-wave strengths are 2.6(6) and 1.0(5) mb. For
all other excited states we compare the momentum distributions to the shapes
calculated for removal from a single orbital component.

As shown in Fig. 3(b), the momentum distribution for the 2441-keV state favors
$p$-wave removal, for which spin-parities of $0^{+},1^{+},2^{+},3^{+}$ are
possible. A $3^{+}$ assignment is not likely, because the $3^{+}$ states
normally appear at excitation energies above 5 MeV [58] for the neutron-rich
nuclei around $N=20$. Given that the $\gamma$-decay proceeds solely to the
$2^{+}_{1}$ level, a spin-parity of $(0,2)^{+}$ is tentatively assigned to the
2441-keV state because a $1^{+}$ assignment would favor an $M1$ decay to the
ground state. It is noted that the 1118-keV transition is also reported in the
one-proton removal from 29Na [43]. Since the 29Na ground state is $3/2^{+}$
[58] this supports the positive-parity ($J^{\pi}=1^{+},2^{+},3^{+},4^{+}$)
assignment for the 2441-keV state populated following proton removal from the
1$d_{5/2}$ orbital. Considering both the one-proton and one-neutron removal
cases, the 2441-keV state favors a $2^{+}$ assignment.

The momentum distribution of the 2923-keV state clearly favors the knockout of
a neutron from the 2$p_{3/2}$ orbital, as displayed in Fig. 3(c). Because the
2923-keV state has one branch that directly decays to the ground state, the
$0^{+}$ assignment is excluded. A $3^{+}$ assignment is not favored, since it
would result in an $M3$ transition for the $2923\rightarrow 0^{+}_{gs}$ decay
with a half-life of a few hundreds nanoseconds, according to the Weisskopf
estimation. Such a half-life is too long to be observed with the experimental
technique used in the present work. Considering that the $2923\rightarrow
1323$ decay is more intense than that to the ground state, a $2^{+}$
assignment is made for this state, because a $1^{+}$ assignment would result
in a strong $M1$ decay for the $2923\rightarrow 0^{+}_{gs}$ transition due to
the large energy difference.

Negative-parity states in 28Ne can be populated by removing a neutron from
$sd$ orbitals. For the state at 3401 keV, a removal from 1$d_{3/2}$ is most
likely given its smallest reduced $\chi^{2}$ value of 1.07, as shown in Fig.
3(d). However, the limited statistics cannot exclude the possibilities of
$s$\- (reduced $\chi^{2}=1.66$) or $p$-wave (reduced $\chi^{2}=1.44$)
configurations. Removal from 1$d_{3/2}$ or 1$s_{1/2}$ leads to a negative-
parity with $J^{\pi}=0^{-},1^{-},2^{-},3^{-}$ or $J^{\pi}=1^{-},2^{-}$,
respectively. Given its sole decay branch to the $2^{+}_{1}$ state, the spin-
parity of $1^{-}$ is not likely as this would favor the decay to the ground
state via an $E1$ transition. In the region of nuclei around $N=20$, the
$0^{-}$ states are typically located at excitation energies around 10 MeV
[58]. Therefore, a spin-parity of $(2,3)^{-}$ is possible for the 3401-keV
state. In the case of removal from 2$p_{3/2}$, a positive-parity with
$J^{\pi}=0^{+},2^{+}$ is possible, as per the discussion for the 2441-keV
state, since the observed decay is solely to the $2^{+}_{1}$ state. Therefore,
the 3401-keV state may have a spin-parity of $(2,3)^{-}$ or $(0,2)^{+}$. For
the 3825-keV state, the momentum distribution supports removal from the
2$s_{1/2}$ orbital and a $2^{-}$ assignment is proposed here because the decay
proceeds only to the $2^{+}_{1}$ level. The 4006-keV momentum distribution
appears broad and favors a removal from 2$d_{3/2}$, indicating a negative-
parity assignment with $J^{\pi}=0^{-}-3^{-}$.

As mentioned above, the present direct neutron-removal reaction of 29Ne on a
proton target has also been studied with the eikonal dynamical model [48].
This eikonal approach, widely used for reactions on light-nucleus targets [10,
11, 12, 15], was also recently applied to the proton-induced 30Ne$(p,pn)$
[16], 29Ne$(p,2p)$ and 29F$(p,pn)$ [59] reactions. In the case of a proton
target, the nucleon removal is due to nucleon-nucleon collisions, described in
the model by their elastic S-matrix. Unlike for a nuclear target, where the
inelastic (target excitation) removal mechanism dominates, on a proton target
removal is due to the elastic target collisions. As used here, the proton-28Ne
optical potential is deduced from the 28Ne density, obtained from a spherical
Skyrme SkX Hartree-Fock (HF) calculation [60]. The eikonal methodology used is
outlined in Refs. [16, 59] and detailed in Ref. [48]. The single-particle
cross sections computed using the DWIA and eikonal models differ, as are
listed in Table 2. The difference might be related to the different inputs
used in the DWIA and eikonal calculations for the 28Ne density and geometry of
the neutron bound state potentials as described above.

Figure 4:  Comparison between (a) the measured partial cross sections and
those calculated to the bound shell-model final states obtained using
different interactions: (b) SDPF-M, (c) SDPF-U-MIX, and (d) EEdf1. The SDPF-M
results are taken from Refs. [15, 48]. Contributions of neutron removal from
2$s_{1/2}$, 2$p_{3/2}$, 1$d_{3/2}$, and 1$f_{7/2}$ orbitals are colored by
green, red, blue, and cyan, respectively. The single-particle cross sections
are calculated using the DWIA framework. The experimental ground-state cross
section should be seen as an upper limit. The experimental inclusive cross
section and the sum of calculated partial cross sections are also shown for
each case.  Figure 5:  Same as Fig. 4 but with the removal cross sections
calculated using the eikonal dynamical model.

With the spin-parity assignments discussed, the experimental partial cross
sections can be used to probe the wave function composition of the ground
state of 29Ne. The experimental partial cross sections and those calculated
using different shell-model spectroscopic factors are plotted in Fig. 4 and
Fig. 5 using the DWIA framework [46, 47] and the eikonal model [48],
respectively. Evident from panel (a) of the two figures is the significant
measured 2$p_{3/2}$-wave strength and the small observed 1$f_{7/2}$
contribution. The large 2$p_{3/2}$ contribution comes not only from the
$0^{+}_{gs}$ and $2^{+}_{1}$ states, but also from the (0,2)+ and the $2^{+}$
states above 2 MeV. Based on the measured partial cross sections, the summed
experimental 2$p_{3/2}$ spectroscopic factors (C2Sexp = $\sigma_{\rm
exp}$/$\sigma_{\rm sp}$), using the DWIA and eikonal single-particle cross
sections are 1.82(7) and 1.16(5), respectively, assuming the linear
combination shown in Fig. 3(a) (1.90(6) and 1.22(4) assuming a removal from
2$p_{3/2}$). These values show a large summed $p$-wave strength compared to
shell-model calculations as presented in Fig. 4 and Fig. 5. Such large
occupations of the 2$p_{3/2}$ orbital shows its lowering, as compared to the
normal 1$d_{3/2}$ orbital, indicating its intruder nature, thereby providing
evidence of the breakdown of the $N=20$ and $N=28$ shell gaps [14, 24, 61].

As shown above, the present work suggests weak possible $f$-wave intruder
strengths to the bound states of 28Ne – from the fit to the shape of the
$2^{+}_{1}$ state momentum distribution. Considering the 29Ne ground state is
3/2- [14, 15], direct population of $4^{+}$ states in 28Ne is expected
following a neutron removal from the intruder 1$f_{7/2}$ orbital, if there
were any significant $f$-wave occupancy. The newly obtained data, however, do
not show signs of $4^{+}$ states. Ref. [43] once proposed the 1732-keV
transition as a candidate for the $4^{+}_{1}\rightarrow 2^{+}_{1}$ decay. Even
assuming the 3055-keV state is the $4^{+}_{1}$ state, the present data still
suggests weak $f$-wave strength because of its small cross section of 0.1(1)
mb. This experimental finding in Ne is different from those in the Mg
isotopes, where considerable $f$-wave strength to the bound states has been
identified via one-neutron removal reactions [7, 9, 10, 11, 12]. Such a
difference in the $f$-wave occupancies between Ne and Mg might be related to
the gap size between the 2$p_{3/2}$ and 1$f_{7/2}$ orbitals. For the Ne
isotopes, shell-model calculations predict significant 1$f_{7/2}$-wave
strength to bound final states in 27Ne [22] and 29Ne [14]. No such bound state
strength of 1$f_{7/2}$ was reported experimentally [13, 14]. In fact, the
observed 1$f_{7/2}$-wave strength was found in unbound states at respective 1
and 1.5 MeV excitation above the 2$p_{3/2}$ states in 27Ne [22] and 29Ne [16],
leading to a gap between the 1$f_{7/2}$ and 2$p_{3/2}$ orbitals along the Ne
isotopic chain approaching the island of inversion. In contrast, the
1$f_{7/2}$ and 2$p_{3/2}$ orbitals are almost degenerate for Mg. Such a
$pf$-orbital gap may suppress the occupation of the 1$f_{7/2}$ orbital in
29Ne, resulting in the weak $f$-wave strength to bound final states observed
in 28Ne.

The excitation energies of the negative-parity states along the $N=18$
isotones can reflect the size of the $N=20$ gap approaching the island of
inversion, as illustrated in Refs. [9, 11]. Here, the negative-parity states
in 28Ne are identified for the first time among the neutron-rich even-even Ne
isotopes in the island of inversion. Considering a 3p-4h configuration in 29Ne
[15, 17], the large cross sections to the 3401- and 3825-keV states indicate
the presence of the 3p-5h intruder configuration in 28Ne. The lowest negative-
parity state in 28Ne is found at 3.4 MeV, assuming a neutron removal from
1$d_{3/2}$. This value is similar to that for 30Mg of 3.3 MeV, but is lower by
about 1.8 MeV compared to 32Si, where a normal configuration dominates. As
shown in Fig. 3(d), the 3401-keV state is populated by removing the neutron
from the 1$d_{3/2}$ orbital. Thus, the decrease of the excitation energies of
negative-parity states could be understood as a reduced gap between the
1$d_{3/2}$ and 2$p_{3/2}$ orbitals, thereby supporting the breakdown of the
$N=20$ shell gap at $Z=10$. Such a lowering of the negative-parity states is
similar to that for the 1- state in 12Be along the $N=8$ isotones [62].

To seek insight from the theoretical description of 28Ne, large-scale shell-
model calculations were performed using the SDPF-M [23], SDPF-U-MIX [24], and
EEdf1 [25] effective interactions. The SDPF-M interaction has been widely used
in the studies for island-of-inversion nuclei. It includes a model space of
the $sd$ shell and the 1$f_{7/2}$ and 2$p_{3/2}$ orbitals in the $pf$ shell,
for both neutrons and protons. SDPF-U-MIX is a more recently developed
interaction with an extended model space including the full neutron $pf$
shell. It has been successfully applied to describe the excited states for
neutron-rich Mg and Si isotopes [24]. The recently developed EEdf1 interaction
includes a model space consisting of the full $sd$ and $pf$ shells. Here, the
two-body matrix elements are derived microscopically from the so-called
extended Kuo-Krenciglowa (EKK) method. The calculated level schemes using
these three interactions are displayed in Fig. 2 for comparison. These three
calculations show similar results for the $2^{+}_{1}$ and $4^{+}_{1}$
excitation energies. The calculated location of the $0^{+}_{2}$ state depends
on the interaction. SDPF-U-MIX shows a $0^{+}_{2}$ state close to the
$2^{+}_{1}$ state, while the calculated $0^{+}_{2}$ excitation energies by
SDPF-M and EEdf1 are located 1 MeV and 2 MeV above $2^{+}_{1}$, respectively.
All three calculations predict the negative-parity states to be located above
3 MeV.

To further characterize the intruder $pf$ spectroscopic strengths of the
observed states, the calculated partial cross sections are shown in Fig. 4 and
Fig. 5, derived using the spectroscopic factors from these three shell-model
interactions combined with the single-particle cross sections $\sigma_{sp}$
from the DWIA framework and the eikonal calculations. The shell-model
spectroscopic factors reflect the single-neutron overlaps between 28Ne and
29Ne, and thus depend not only on the final states of 28Ne but also on the
initial (ground) state of 29Ne. Both the SDPF-U-MIX and EEdf1 interactions
predict a 3/2- as the 29Ne ground state with a large fraction of the 3p-4h
configuration of 86% and 83.8%, respectively. For the SDPF-M calculation the
29Ne 3/2- state is not the ground state but lies at 73 keV [14]. This state
also shows a dominant 67% 3p-4h configuration [15, 48]. The summed calculated
$p$ ($f$) spectroscopic factors are 0.73 (0.86) for SDPF-M, 0.56 (0.96) for
SDPF-U-MIX, and 0.81 (0.86) for EEdf1. In all three calculations, the $f$-wave
spectroscopic strengths mainly come from the $4^{+}_{1}$ state. Although
SDPF-M and EEdf1 predict similar C2S values for the $p$-wave, the main
contributions are from the $0^{+}_{gs}$ and $2^{+}_{1}$, respectively.

As shown in Fig. 4(b)-(d) and Fig. 5(b)-(d), all of the interactions
qualitatively reproduce the distribution of $p$-wave strength, but
underestimate their absolute values in general. The SDPF-M result shows the
most $p$-wave strength in the ground state and the predicted ground-state
cross section is in good agreement with the data. In the SDPF-U-MIX and EEdf1
calculations, the population of the ground state is hindered and the $p$-wave
strength is shifted into the $2^{+}_{1}$ state. In particular, the large
$p$-wave strength found at 2923 keV is not present in any of the shell-model
calculations. All three calculations show a good agreement with the
$2^{+}_{1}$ excitation energies. We note that the $B(E2;0_{gs}\rightarrow
2^{+}_{1})$ value of 28Ne is reproduced well by the EEdf1 [25] calculation but
is overestimated by the SDPF-M and SDPF-U-MIX results [4]. For the $2^{+}_{1}$
partial cross section, not only $p$-wave but also sizable $f$-wave strength
are suggested by the calculations, showing a marked difference from the
experimental result, which shows a dominant $p$-wave strength as displayed in
Fig. 3(a). The EEdf1 calculation reproduces the $p$-wave strength to the
$2^{+}_{1}$ state, but overestimates the cross section due to the existence of
the theoretical $f$-wave strength.

Although the energy deviates, all three shell-model calculations predict very
small C2S values for the excited $0^{+}$ state, resulting in a small partial
cross section. Based on these calculated results, the 2441-keV state with its
sizable cross section may not favor a $0^{+}$ assignment. It is interesting to
discuss the excitation energy of the $0^{+}_{2}$ state in 28Ne because excited
$0^{+}$ states are important to reveal possible shape-coexistence. Along the
$N=18$ isotones, Ne is expected to have a greater intruder configuration than
Mg, as Ne is expected to have a smaller $N=20$ shell gap [23, 24]. Thus, the
$0^{+}_{2}$ state in 28Ne could be expected to appear lower in energy than
that (at 1.8 MeV) for 30Mg [35]. This scenario is supported by the SDPF-U-MIX
result, which calculates the $0^{+}_{2}$ state to lie at 1.3 MeV. Similarly to
30,32Mg [35, 63], such a low excitation energy will lead to an isomeric
$0^{+}_{2}$ state, presenting a shape-coexistence feature. A dedicated study
of the excited $0^{+}$ state in 28Ne is therefore desired to reveal its nature
– which is a critical input for the overall theoretical description.

In contrast to the experimental findings, considerable 1$f_{7/2}$
contributions are presented in all the shell-model calculations, in particular
for population of the $4^{+}_{1}$ state. In fact, along the Ne isotopic chain,
the locations of the $f$-wave intruder states show disagreement between
experimental results and shell-model calculations. For instance, the $f$-wave
intruder states were observed to be unbound in 27,29Ne [22, 16], while SDPF-M
suggests they are bound. In 29Ne, calculations with SDPF-U-MIX also show a
bound $f$-wave intruder state at 610 keV, whereas the $f$-wave strength is
observed at 1.5 MeV and unbound [16, 14]. Given the disagreements between the
measured and shell-model expectations revealed by the present work, these
$f$-wave intruder components present a challenge for the theoretical
descriptions of the neutron-rich Ne isotopes. Moreover, a continued search for
possible $f$-wave strength populating states in 28Ne is encouraged for future
studies, for example, using $\gamma$-ray spectroscopy with high resolution and
statistics to examine possible population of the $4^{+}_{1}$ state, as well as
invariant-mass measurements to locate any unbound 4+ states [64] which will
complement the experimental method used in the present work.

For the negative-parity states, all the shell-model calculations give a
reasonable agreement of both the energies and their strength. The reduction in
the gap between the 1$d_{3/2}$ and 2$p_{3/2}$ orbitals suggested by the data,
as discussed above, is also supported by the shell-model calculations [23, 24,
25], which show the neutron $sd-pf$ gap narrows towards to $Z\leq 10$.

In summary, intruder configurations in the ground state in 29Ne were
investigated quantitatively for the first time via the one-neutron removal
reaction on a hydrogen target. The partial cross sections and the analysis of
the momentum distributions reveal a strong $p$-wave strength to the low-lying
states of 28Ne, but a weak, possible $f$-wave strength to bound 28Ne states.
Such findings are different from the shell-model expectation that both
considerable $p$\- and $f$-wave strengths contribute to the bound states for
the neutron-rich Ne isotopes, in a similar manner to the Mg isotopes.The large
value of summed $p$-wave spectroscopic factors presents clear evidence of the
intruder nature of the 2$p_{3/2}$ orbital, as well as of the reduction of the
$N=20$ and $N=28$ shell gaps. The negative-parity states in 28Ne were
identified for the first time, extending the systematics along the $N=18$
isotones, and once again supporting the breakdown of the $N=20$ shell gap in
the neon isotopes. These general findings are common to both the DWIA
framework and the eikonal dynamical model of the reaction. Shell-model
calculations using three different interactions SDPF-M, SDPF-U-MIX, and EEdf1
have been performed for the structure of 28Ne, 29Ne, and their single-neutron
overlaps. However, none of these shell-model calculations reproduce the
experimental observations of a large $p$-wave and a small $f$-wave strength,
thus presenting an ongoing challenge concerning the detailed theoretical
description of the nuclei in the island of inversion. Further work is also
needed to assess the implications of the deduced spectroscopic strengths from
these proton-target data, based on the two presented theoretical reaction
models, upon the analyses of the earlier published measurements of neutron-
removal on C and Pb targets [15]. The Coulomb dissociation data on the Pb
target, being essentially independent of details of the strong-interaction
removal-reaction mechanism, can provide an important benchmark of the observed
differences between the deduced absolute intruder state strengths when using
the two theoretical models.

## Acknowledgments

We express our gratitude to the RIKEN Nishina accelerator staff for providing
the 48Ca beam and to the BigRIPS team for tuning the secondary beams. H.W
acknowledges the support by MEXT KAKENHI Grant Nos. JP21H04465 and JP18H05404.
This work was supported partially by MEXT KAKENHI Grant No. JP16H02179. J.A.T
acknowledges the support of the United Kingdom Science and Technology
Facilities Council (STFC) Grant No. ST/V001108/1. A.P. is supported by grants
CEX2020-001007-S funded by MCIN/AEI/10.13039/501100011033 and
PID2021-127890NB-I00. K.O acknowledges the support by MEXT KAKENHI Grant Nos.
JP21H00125 and JP21H04975. The LPC-Caen group wished to acknowledge support
from the Franco-Japanese LIA-International Associated Laboratory for Nuclear
Structure Problems as well as the French ANR-14-CE33-0022-02 EXPAND. This
material is in part based upon work supported by the U.S. Department of
Energy, Office of Science, Office of Nuclear Physics, under Contracts No. DE-
AC02-06CH11357 (Argonne). This work was in part supported by the Institute for
Basic Science (IBS-R031-D1) in Republic of Korea. This work is partly
supported from the National Research, Development and Innovation Fund of
Hungary via Project No. K128947 and TKP2021-NKTA-42. This work was supported
by the National Science Foundation, USA under Grants No. PHY-1102511.

## References

  * [1] C. Thibault, et al., Direct measurement of the masses of ${}^{11}\mathrm{Li}$ and ${}^{26-32}\mathrm{Na}$ with an on-line mass spectrometer, Phys. Rev. C 12 (1975) 644–657.  doi:10.1103/PhysRevC.12.644.
URL https://link.aps.org/doi/10.1103/PhysRevC.12.644

  * [2] T. Motobayashi, et al., Large deformation of the very neutron-rich nucleus ${}^{32}\mathrm{Mg}$ from intermediate-energy coulomb excitation, Physics Letters B 346 (1) (1995) 9–14.  doi:https://doi.org/10.1016/0370-2693(95)00012-A.
URL https://www.sciencedirect.com/science/article/pii/037026939500012A

  * [3] Y. Yanagisawa, et al., The first excited state of ${}^{30}\mathrm{Ne}$ studied by proton inelastic scattering in reversed kinematics, Physics Letters B 566 (1) (2003) 84–89.  doi:https://doi.org/10.1016/S0370-2693(03)00802-5.
URL https://www.sciencedirect.com/science/article/pii/S0370269303008025

  * [4] P. Doornenbal, et al., Mapping the deformation in the “island of inversion”: Inelastic scattering of ${}^{30}\mathrm{Ne}$ and ${}^{36}\mathrm{Mg}$ at intermediate energies, Phys. Rev. C 93 (2016) 044306.  doi:10.1103/PhysRevC.93.044306.
URL https://link.aps.org/doi/10.1103/PhysRevC.93.044306

  * [5] H. L. Crawford, et al., First spectroscopy of the near drip-line nucleus ${}^{40}\mathrm{Mg}$, Phys. Rev. Lett. 122 (2019) 052501.  doi:10.1103/PhysRevLett.122.052501.
URL https://link.aps.org/doi/10.1103/PhysRevLett.122.052501

  * [6] T. Otsuka, A. Gade, O. Sorlin, T. Suzuki, Y. Utsuno, Evolution of shell structure in exotic nuclei, Rev. Mod. Phys. 92 (2020) 015002.  doi:10.1103/RevModPhys.92.015002.
URL https://link.aps.org/doi/10.1103/RevModPhys.92.015002

  * [7] J. R. Terry, et al., Single-neutron knockout from intermediate energy beams of ${}^{30,32}\mathrm{Mg}$: Mapping the transition into the “island of inversion”, Phys. Rev. C 77 (2008) 014316.  doi:10.1103/PhysRevC.77.014316.
URL https://link.aps.org/doi/10.1103/PhysRevC.77.014316

  * [8] B. Fernández-Domínguez, et al., Re-examining the transition into the n=20 island of inversion: Structure of 30mg, Physics Letters B 779 (2018) 124–129.  doi:https://doi.org/10.1016/j.physletb.2018.02.002.
URL https://www.sciencedirect.com/science/article/pii/S037026931830100X

  * [9] N. Kitamura, et al., Structure of ${}^{30}\mathrm{Mg}$ explored via in-beam $\gamma$-ray spectroscopy, Phys. Rev. C 102 (2020) 054318.  doi:10.1103/PhysRevC.102.054318.
URL https://link.aps.org/doi/10.1103/PhysRevC.102.054318

  * [10] D. Bazin, et al., Spectroscopy of ${}^{33}\mathrm{Mg}$ with knockout reactions, Phys. Rev. C 103 (2021) 064318.  doi:10.1103/PhysRevC.103.064318.
URL https://link.aps.org/doi/10.1103/PhysRevC.103.064318

  * [11] N. Kitamura, et al., Coexisting normal and intruder configurations in ${}^{32}\mathrm{Mg}$, Physics Letters B 822 (2021) 136682.  doi:https://doi.org/10.1016/j.physletb.2021.136682.
URL https://www.sciencedirect.com/science/article/pii/S0370269321006225

  * [12] N. Kitamura, et al., In-beam $\gamma$-ray spectroscopy of ${}^{32}\mathrm{Mg}$ via direct reactions, Phys. Rev. C 105 (2022) 034318.  doi:10.1103/PhysRevC.105.034318.
URL https://link.aps.org/doi/10.1103/PhysRevC.105.034318

  * [13] J. Terry, et al., Direct evidence for the onset of intruder configurations in neutron-rich ne isotopes, Physics Letters B 640 (3) (2006) 86–90.  doi:https://doi.org/10.1016/j.physletb.2006.06.061.
URL https://www.sciencedirect.com/science/article/pii/S0370269306008173

  * [14] H. Liu, et al., Intruder configurations in the ground state of ${}^{30}\mathrm{Ne}$, Physics Letters B 767 (2017) 58–62.  doi:https://doi.org/10.1016/j.physletb.2017.01.052.
URL https://www.sciencedirect.com/science/article/pii/S0370269317300709

  * [15] N. Kobayashi, et al., One-neutron removal from ${}^{29}\mathrm{Ne}$: Defining the lower limits of the island of inversion, Phys. Rev. C 93 (2016) 014613.  doi:10.1103/PhysRevC.93.014613.
URL https://link.aps.org/doi/10.1103/PhysRevC.93.014613

  * [16] M. Holl, et al., Border of the island of inversion: Unbound states in ${}^{29}\mathrm{Ne}$, Phys. Rev. C 105 (2022) 034301.  doi:10.1103/PhysRevC.105.034301.
URL https://link.aps.org/doi/10.1103/PhysRevC.105.034301

  * [17] A. Revel, et al., Large collectivity in ${}^{29}\mathrm{Ne}$ at the boundary of the island of inversion, Physics Letters B 838 (2023) 137704.  doi:https://doi.org/10.1016/j.physletb.2023.137704.
URL https://www.sciencedirect.com/science/article/pii/S0370269323000382

  * [18] P. Fallon, et al., Two-proton knockout from ${}^{32}\mathrm{Mg}$: Intruder amplitudes in ${}^{30}\mathrm{Ne}$ and implications for the binding of ${}^{29,31}\mathrm{F}$, Phys. Rev. C 81 (2010) 041302.  doi:10.1103/PhysRevC.81.041302.
URL https://link.aps.org/doi/10.1103/PhysRevC.81.041302

  * [19] P. Doornenbal, et al., Spectroscopy of ${}^{32}\mathrm{Ne}$ and the “island of inversion”, Phys. Rev. Lett. 103 (2009) 032501.  doi:10.1103/PhysRevLett.103.032501.
URL https://link.aps.org/doi/10.1103/PhysRevLett.103.032501

  * [20] T. Nakamura, et al., Deformation-driven $p$-wave halos at the drip line: ${}^{31}\mathrm{Ne}$, Phys. Rev. Lett. 112 (2014) 142501.  doi:10.1103/PhysRevLett.112.142501.
URL https://link.aps.org/doi/10.1103/PhysRevLett.112.142501

  * [21] I. Murray, et al., Spectroscopy of strongly deformed ${}^{32}\mathrm{Ne}$ by proton knockout reactions, Phys. Rev. C 99 (2019) 011302.  doi:10.1103/PhysRevC.99.011302.
URL https://link.aps.org/doi/10.1103/PhysRevC.99.011302

  * [22] S. M. Brown, et al., Low-lying neutron $fp$-shell intruder states in ${}^{27}\mathrm{Ne}$, Phys. Rev. C 85 (2012) 011302\.  doi:10.1103/PhysRevC.85.011302.
URL https://link.aps.org/doi/10.1103/PhysRevC.85.011302

  * [23] Y. Utsuno, et al., Varying shell gap and deformation in ${N}\sim 20$ unstable nuclei studied by the monte carlo shell model, Phys. Rev. C 60 (1999) 054315.  doi:10.1103/PhysRevC.60.054315.
URL https://link.aps.org/doi/10.1103/PhysRevC.60.054315

  * [24] E. Caurier, F. Nowacki, A. Poves, Merging of the islands of inversion at ${N}=20$ and ${N}=28$, Phys. Rev. C 90 (2014) 014302\.  doi:10.1103/PhysRevC.90.014302.
URL https://link.aps.org/doi/10.1103/PhysRevC.90.014302

  * [25] N. Tsunoda, et al., Exotic neutron-rich medium-mass nuclei with realistic nuclear forces, Phys. Rev. C 95 (2017) 021304.  doi:10.1103/PhysRevC.95.021304.
URL https://link.aps.org/doi/10.1103/PhysRevC.95.021304

  * [26] A. O. Macchiavelli, et al., The ${}^{30}\mathrm{Mg}(t,p)^{32}\mathrm{Mg}$ “puzzle” reexamined, Phys. Rev. C 94 (2016) 051303.  doi:10.1103/PhysRevC.94.051303.
URL https://link.aps.org/doi/10.1103/PhysRevC.94.051303

  * [27] R. Elder, et al., Intruder dominance in the ${0}_{2}^{+}$ state of ${}^{32}\mathrm{Mg}$ studied with a novel technique for in-flight decays, Phys. Rev. C 100 (2019) 041301.  doi:10.1103/PhysRevC.100.041301.
URL https://link.aps.org/doi/10.1103/PhysRevC.100.041301

  * [28] A. Obertelli, T. Uesaka, Hydrogen targets for exotic-nuclei studies developed over the past 10 years, Eur. Phys. J. A 47 (9) (2011) 105.  doi:10.1140/epja/i2011-11105-5.
URL https://doi.org/10.1140/epja/i2011-11105-5

  * [29] B. Pritychenko, et al., Role of intruder configurations in ${}^{26,28}\mathrm{Ne}$ and ${}^{30,32}\mathrm{Mg}$, Physics Letters B 461 (4) (1999) 322–328.  doi:https://doi.org/10.1016/S0370-2693(99)00850-3.
URL https://www.sciencedirect.com/science/article/pii/S0370269399008503

  * [30] H. Iwasaki, et al., Quadrupole collectivity of ${}^{28}\mathrm{Ne}$ and the boundary of the island of inversion, Physics Letters B 620 (3) (2005) 118–124.  doi:https://doi.org/10.1016/j.physletb.2005.06.032.
URL https://www.sciencedirect.com/science/article/pii/S0370269305008208

  * [31] Z. Dombrádi, et al., Vanishing ${N}=20$ shell gap: Study of excited states in ${}^{27,28}\mathrm{Ne}$, Phys. Rev. Lett. 96 (2006) 182501.  doi:10.1103/PhysRevLett.96.182501.
URL https://link.aps.org/doi/10.1103/PhysRevLett.96.182501

  * [32] S. Michimasa, et al., Quadrupole collectivity in island-of-inversion nuclei ${}^{28,30}\mathrm{Ne}$ and ${}^{34,36}\mathrm{Mg}$, Phys. Rev. C 89 (2014) 054307.  doi:10.1103/PhysRevC.89.054307.
URL https://link.aps.org/doi/10.1103/PhysRevC.89.054307

  * [33] Y. Utsuno, Probing different characteristics of shell evolution driven by central, spin-orbit, and tensor forces, Physics 4 (1) (2022) 185–201.  doi:10.3390/physics4010014.
URL https://www.mdpi.com/2624-8174/4/1/14

  * [34] F. Rotaru, et al., Unveiling the intruder deformed ${0}_{2}^{+}$ state in ${}^{34}\mathrm{Si}$, Phys. Rev. Lett. 109 (2012) 092503.  doi:10.1103/PhysRevLett.109.092503.
URL https://link.aps.org/doi/10.1103/PhysRevLett.109.092503

  * [35] W. Schwerdtfeger, et al., Shape coexistence near neutron number ${N}=20$: First identification of the ${E}0$ decay from the deformed first excited ${J}^{\pi}={0}^{+}$ state in ${}^{30}\mathrm{Mg}$, Phys. Rev. Lett. 103 (2009) 012501.  doi:10.1103/PhysRevLett.103.012501.
URL https://link.aps.org/doi/10.1103/PhysRevLett.103.012501

  * [36] V. Tripathi, et al., ${}^{29}\mathrm{Na}$: Defining the edge of the island of inversion for ${Z}=11$, Phys. Rev. Lett. 94 (2005) 162501.  doi:10.1103/PhysRevLett.94.162501.
URL https://link.aps.org/doi/10.1103/PhysRevLett.94.162501

  * [37] T. Kubo, et al., Prog. Theor. Exp. Phys. 2012 (2012) 03C003.
  * [38] N. Fukuda, et al., Nucl. Instrum. Methods B 317 (2013) 323.
  * [39] A. Obertelli, et al., Minos: A vertex tracker coupled to a thick liquid-hydrogen target for in-beam spectroscopy of exotic nuclei, Eur. Phys. J. A 50 (1) (2014) 8.  doi:10.1140/epja/i2014-14008-y.
URL https://doi.org/10.1140/epja/i2014-14008-y

  * [40] S. Takeuchi, et al., DALI2: A NaI(Tl) detector array for measurements of $\gamma$ rays from fast nuclei, Nucl. Instrum. Methods A 763 (2014) 596.
URL http://www.sciencedirect.com/science/article/pii/S0168900214008419

  * [41] S. Agostinelli, et al., Geant4—a simulation toolkit, Nucl. Instrum. Methods A 506 (3) (2003) 250 – 303.
  * [42] T. Kobayashi, et al., SAMURAI spectrometer for RI beam experiments, Nucl. Instrum. Methods B 317 (2013) 294–304.  doi:https://doi.org/10.1016/j.nimb.2013.05.089.
URL https://www.sciencedirect.com/science/article/pii/S0168583X13007118

  * [43] P. Fallon, et al., Transition to the island of inversion: Study of excited states in ${}^{28-30}\mathrm{Ne}$, J. Phys.: Conf. Ser. 49 (2006) 165–169.  doi:10.1088/1742-6596/49/1/037.
URL https://doi.org/10.1088/1742-6596/49/1/037

  * [44] M. Belleguic, et al., Search for neutron excitations across the ${N}=20$ shell gap in ${}^{25-29}\mathrm{Ne}$, Phys. Rev. C 72 (2005) 054316.  doi:10.1103/PhysRevC.72.054316.
URL https://link.aps.org/doi/10.1103/PhysRevC.72.054316

  * [45] E. Rodriguez-Vieitez, Structure and cross section data of neutron-rich ${N}$ $\sim$ 20 nuclei produced in fragmentation and few-nucleon knockout reactions, Ph.D. thesis, University of California Berkeley (2007).
  * [46] T. Wakasa, K. Ogata, T. Noro, Proton-induced knockout reactions with polarized and unpolarized beams, Progress in Particle and Nuclear Physics 96 (2017) 32–87.  doi:https://doi.org/10.1016/j.ppnp.2017.06.002.
URL https://www.sciencedirect.com/science/article/pii/S0146641017300558

  * [47] K. Ogata, K. Yoshida, K. Minomo, Asymmetry of the parallel momentum distribution of ($p,pn$) reaction residues, Phys. Rev. C 92 (2015) 034616.  doi:10.1103/PhysRevC.92.034616.
URL https://link.aps.org/doi/10.1103/PhysRevC.92.034616

  * [48] J. A. Tostevin, Single-nucleon removal cross sections on nucleon and nuclear targets (2021).  doi:10.48550/ARXIV.2104.03049.
URL https://arxiv.org/abs/2104.03049

  * [49] S. Chen, et al., Quasifree neutron knockout from ${}^{54}\mathrm{Ca}$ corroborates arising ${N}=34$ neutron magic number, Phys. Rev. Lett. 123 (2019) 142501.  doi:10.1103/PhysRevLett.123.142501.
URL https://link.aps.org/doi/10.1103/PhysRevLett.123.142501

  * [50] R. Taniuchi, et al., Nature 569 (2019) 53.
  * [51] L. Olivier, et al., Persistence of the ${Z}=28$ shell gap around ${}^{78}\mathrm{Ni}$: First spectroscopy of ${}^{79}\mathrm{Cu}$, Phys. Rev. Lett. 119 (2017) 192501.  doi:10.1103/PhysRevLett.119.192501.
URL https://link.aps.org/doi/10.1103/PhysRevLett.119.192501

  * [52] K. Yoshida, Few-Body System 62 (2021) 28.
  * [53] M. Enciu, et al., Extended ${p}_{3/2}$ neutron orbital and the ${N}=32$ shell closure in ${}^{52}\mathrm{Ca}$, Phys. Rev. Lett. 129 (2022) 262501.  doi:10.1103/PhysRevLett.129.262501.
URL https://link.aps.org/doi/10.1103/PhysRevLett.129.262501

  * [54] A. Bohr, B. Mottelson, Nuclear structure, Vol. I, World Scientific, Singapore, 1999, p. 239.
  * [55] M. Toyokawa, K. Minomo, M. Yahiro, Mass-number and isotope dependence of local microscopic optical potentials for polarized proton scattering, Phys. Rev. C 88 (2013) 054602.  doi:10.1103/PhysRevC.88.054602.
URL https://link.aps.org/doi/10.1103/PhysRevC.88.054602

  * [56] K. Amos, et al., Adv. Nucl. Phys. 25 (2000) 275.
  * [57] M. A. Franey, W. G. Love, Nucleon-nucleon t-matrix interaction for scattering at intermediate energies, Phys. Rev. C 31 (1985) 488–498.  doi:10.1103/PhysRevC.31.488.
URL https://link.aps.org/doi/10.1103/PhysRevC.31.488

  * [58] NNDC, http://www.nndc.bnl.gov/[link].
URL http://www.nndc.bnl.gov/

  * [59] A. Revel, et al., Extending the southern shore of the island of inversion to ${}^{28}\mathrm{F}$, Phys. Rev. Lett. 124 (2020) 152502.  doi:10.1103/PhysRevLett.124.152502.
URL https://link.aps.org/doi/10.1103/PhysRevLett.124.152502

  * [60] B. Alex Brown, New skyrme interaction for normal and exotic nuclei, Phys. Rev. C 58 (1998) 220–231.  doi:10.1103/PhysRevC.58.220.
URL https://link.aps.org/doi/10.1103/PhysRevC.58.220

  * [61] P. Doornenbal, et al., In-beam $\gamma$-ray spectroscopy of ${}^{34,36,38}\mathrm{Mg}$: Merging the ${N}\mathbf{=}20$ and ${N}\mathbf{=}28$ shell quenching, Phys. Rev. Lett. 111 (2013) 212502.  doi:10.1103/PhysRevLett.111.212502.
URL https://link.aps.org/doi/10.1103/PhysRevLett.111.212502

  * [62] H. Iwasaki, et al., Physics Letters B 491 (1) (2000) 8–14.  doi:https://doi.org/10.1016/S0370-2693(00)01017-0, [link].
URL https://www.sciencedirect.com/science/article/pii/S0370269300010170

  * [63] K. Wimmer, et al., Discovery of the shape coexisting ${0}^{+}$ state in ${}^{32}\mathrm{Mg}$ by a two neutron transfer reaction, Phys. Rev. Lett. 105 (2010) 252501.  doi:10.1103/PhysRevLett.105.252501.
URL https://link.aps.org/doi/10.1103/PhysRevLett.105.252501

  * [64] J. K. Smith, et al., Neutron unbound states in ${}^{28}\mathrm{Ne}$ and ${}^{25}\mathrm{F}$, Phys. Rev. C 86 (2012) 057302\.  doi:10.1103/PhysRevC.86.057302.
URL https://link.aps.org/doi/10.1103/PhysRevC.86.057302


# RSD-GAN: Regularized Sobolev Defense GAN Against Speech-to-Text Adversarial
Attacks

Mohammad Esmaeilpour, Nourhene Chaalia, and Patrick Cardinal M. Esmaeilpour,
and P. Cardinal are with École de Technologie Supérieure (ÉTS), Université du
Québec, Montréal, Québec, Canada. M. Esmaeilpour and N. Chaalia are with the
Fédération des Caisses Desjardins du Québec. Contact:
<EMAIL_ADDRESS>This work was funded by Fédération des
Caisses Desjardins du Québec, IVADO Institution, and Mitacs accelerate program
with agreement number IT27051. Supplementary material and source codes are
available at this github-Repo.

###### Abstract

This paper introduces a new synthesis-based defense algorithm for
counteracting with a varieties of adversarial attacks developed for
challenging the performance of the cutting-edge speech-to-text transcription
systems. Our algorithm implements a Sobolev-based GAN and proposes a novel
regularizer for effectively controlling over the functionality of the entire
generative model, particularly the discriminator network during training. Our
achieved results upon carrying out numerous experiments on the victim
DeepSpeech, Kaldi, and Lingvo speech transcription systems corroborate the
remarkable performance of our defense approach against a comprehensive range
of targeted and non-targeted adversarial attacks.

###### Index Terms:

Speech adversarial attack, adversarial defense, Sobolev Integral probability
metric, GAN, regularization.

##  I Introduction

Over the last decade, a remarkable progress has been made in developing real-
time speech-to-text transcription systems particularly after the proliferation
of deep learning algorithms. Nowadays, such systems employ variants of complex
configurations such as long short-term memory, residual, and transformer
architectures [1] for improving transcription accuracy under severe noisy
environments. DeepSpeech [2], Kaldi [3], and Lingvo [4] are among those
advanced systems to name a few. However, it has been demonstrated that they
are extremely vulnerable against carefully crafted adversarial signals which
carry imperceptible perturbations ($\delta_{i}$) that redirect the recognition
models towards transcribing incorrect phrases [5]. Technically, an adversarial
signal $\vec{x}_{\mathrm{adv}}$ can be defined as [6]:

$\vec{x}_{\mathrm{adv}}\leftarrow\vec{x}_{\mathrm{org}}+\delta_{i}$ (1)

where $\vec{x}_{\mathrm{org}}$ denotes the original signal. For achieving an
optimal value for $\delta_{i}$, often a costly optimization formulation is
required since the difference between $\vec{x}_{\mathrm{adv}}$ and
$\vec{x}_{\mathrm{org}}$ should be inaudible. Toward satisfying this
condition, many optimization algorithms have been developed thus far. However,
the majority of them implement a sort of convex formulation most likely
inspired by Carlini et al. [6] as the following (C&W attack).

${\min_{\delta}\left\|\delta\right\|_{F}+\sum_{i}c_{i}\mathcal{L}(\vec{x}_{\mathrm{adv}},\hat{\mathbf{y}}_{i})}\\\
{\mathrm{s.t.}\quad
l_{\text{dB}}(\vec{x}_{\mathrm{adv}})<\epsilon\quad\mathrm{and}\quad\hat{\mathbf{y}}_{i}\neq\mathbf{y}_{i}}$
(2)

where $c_{i}$ and $\mathcal{L}(\cdot)$ refer to adjusting coefficient (scalar)
and the loss function for the victim transcription model, respectively.
Additionally, $\mathbf{y}_{i}$ and $\hat{\mathbf{y}}_{i}$ denote the original
and adversarial phrases in which the latter should be defined by adversary.
Furthermore, $l_{\text{dB}}(\cdot)$ is a dB-scale loudness metric for
measuring the distortion of $\vec{x}_{\mathrm{adv}}$ relative to
$\vec{x}_{\mathrm{org}}$. Finally, $\epsilon$ is a subjective threshold for
the adversarial perturbation which should be carefully tuned according to the
properties of the transcription model, environment, and the characteristics of
the original input signals (e.g., the number of channels).

Unfortunately, adversarial signals pose major security concerns for speech
transcription systems in two aspects. Firstly, they can significantly reduce
the recognition accuracy and generalizability of such systems [7]. Secondly,
they are transferable from a model to another [8]. For instance, an
adversarial signal which is crafted for Kaldi, most likely fools other systems
such as DeepSpeech and Lingo [9, 10]. Motivated by these two raised concerns,
we develop a novel defense algorithm for counteracting with varieties of white
and black-box adversarial attacks. Technically, our approach belongs to the
synthesis-based defense category using generative adversarial network (GAN)
[11]. Briefly, this category includes defense algorithms which synthesize a
new signal acoustically very similar to the given input speech
($\vec{x}_{\mathrm{in}}$) aiming at bypassing the potential adversarial
perturbation on $\vec{x}_{\mathrm{in}}$. This is one of the reliable
approaches for protecting recognition models [12]. In summary we make the
following contributions in this paper: (i) Developing a novel regularizer for
the integral probability metric of the defense GAN in the restricted Sobolev
space [13, 14]; (ii) Incorporating the room-impulse-response (RIR) effect into
the regularization formulation to enhance the quality of the synthetic
signals; (iii) Optimizing the functionality of the discriminator network in a
GAN setup for significantly reducing the number of required gradient
computations. The rest of our paper is organized as the following. Section II
provides a brief review over the state-of-the-art attack and defense
algorithms. In Section III, we introduce our defense approach and explain its
functionality. Finally, we summarize all the experimental results in Section
IV.

##  II Background: Attack and Defense

Over the last years, many variants have been introduced for Eq. 2 both in the
context of targeted and non-targeted as well as white and black-box
adversarial attacks (more information about these taxonomies are available at
[15]). For instance, Yakura et al. [16] demonstrated that adversarial
perturbation fades away upon replaying $\vec{x}_{\mathrm{adv}}$ over the air.
For tackling this issue, they proposed an expectation over transformation
(EOT) operation and slightly updated Eq. 2 as follows:

$\min_{\delta_{i}}\mathbb{E}_{t\in\tau,\omega\sim\mathcal{N}(0,\sigma^{2})}\left[\mathcal{L}(\mathrm{mfcc}(\vec{x}_{\mathrm{adv}}),\hat{\mathbf{y}}_{i})+\alpha_{k}\left\|\delta_{i}\right\|\right]$
(3)

where $t$ and $\tau$ denote an independent variable and EOT filter set,
respectively. Additionally, $\omega$ represents the white Gaussian noise
operator driven from the RIR simulation [17] where $\vec{x}_{\mathrm{org}}$ is
recorded. Such an operator is essential in optimizing for $\delta_{i}$ since
it contributes to smoothly (i.e., in an imperceivable manner) contaminate the
original input signal with the adversarial perturbation. In Eq. 3,
$\mathrm{mfcc}$ is the Mel-frequency cepstral coefficient transform [16, 18]
for converting $\vec{x}_{\mathrm{adv}}$ into a feature representation.
Finally, $\alpha_{k}$ refers to the scaling parameter for adjusting the
magnitude of $\delta_{i}$ in conjunction with the probability density function
of $\tau$.

A more simplified yet effective version for Eq. 3 is called the robust attack
and it has been introduced by Qin et al. [19]. This attack replaces the costly
$\omega$ operation with a mask loss function for encoding $\delta_{i}$ beyond
the human audible range. However, it does not incorporate the properties of
microphone-speaker (SM) settings during its optimization procedure. It has
been experimentally demonstrated that such settings effectively enhance the
robustness of $\delta_{i}$ after consecutive playbacks over the air [5].
Presumably, based on the concept of SM simulation, the Imperio [5] and
Metamorph [20] attack algorithms have been developed. The latter attack also
simulates the channel impulse response (CIR) for achieving a less likely
detectable adversarial perturbation upon running potential defense algorithms.
However, CIR implementation is computationally expensive and requires running
numerous exploratory experiments to tune its hyperparameters. To tackle this
issue, Esmaeilpour et al. [21] introduced a novel attack formulation based on
Cramér integral probability metric (CIPM). Furthermore, their attack does not
exploit any EOT operation during optimizing for $\delta_{i}$ and it converges
relatively faster than other aforementioned algorithms.

All the above-mentioned adversarial attack approaches have been widely
experimented and analyzed on the DeepSpeech (Mozilla’s implementation),
Lingvo, and Kaldi. Unfortunately, it has been evidently revealed that such
cutting-edge systems are extremely vulnerable against almost all variants of
speech attacks [22, 23, 6]. In response to this critical concern, a number of
defense algorithms have been developed which we briefly review them in the
following.

Multi-rate compression algorithm (MRCA) [24] is one of the baseline defense
approaches which has been extensively used for benchmarking the resiliency of
adversarial attacks under different noisy environments. The intuition behind
this approach is straightforward. In a nutshell, MRCA compresses the input
signal through high-frequency components modulation aiming at fading out the
potential adversarial perturbation on $\vec{x}_{\mathrm{adv}}$. Although MRCA
is computationally very efficient, it fails to detect adversarial signals
which have been carefully optimized through CIR-based algorithms [25]. For
tackling this challenge, two affirmative resolutions have been devised: (i)
augmenting the transcription models with some simulated psychoacoustic filters
which is known as the Dompteur defense [26], and (ii) developing an
autoencoding GAN (A-GAN) [27] for synthesizing new $\mathrm{mfcc}$ features
for every input signal ($\vec{x}_{\mathrm{in}}$). Relatively, the latter
defense approach enables reconstructing higher quality speech samples without
recovering potential $\delta_{i}$. However, it has been shown that A-GAN
suffers from extreme instability and mode collapse issues particularly for
long speech signals ($>5.6$ seconds) [23].

Towards developing stable GANs for effectively protecting speech transcription
systems, a varieties of approaches have been presented heretofore. For
instance, the class-conditional defense GAN (CCD-GAN) [28] proposes a novel
regularization technique as:

$\arg\min_{\mathbf{z}_{i}}\left\|\gamma\left[\mathcal{G}(\mathbf{z}_{i}),\mathbf{x}_{\mathrm{org}}\right]\right\|_{2}^{2}\quad\mathrm{and}\quad\mathbf{z}_{i}\in\mathbb{R}^{d_{z}}$
(4)

where $d_{z}$ refers to the dimension of $\mathbf{z}_{i}$ and
$\mathbf{x}_{\mathrm{org}}$ denotes the spectrogram (frequency components
plot) [29] associated with $\vec{x}_{\mathrm{org}}$. Additionally,
$\mathcal{G}(\cdot)$ indicates the generator network in the GAN configuration
and $\gamma\left[\cdot\right]$ refers to the chordal distance adjustment
operator [30, 13]. Eq. 4 iteratively maps $\mathcal{G}(\mathbf{z}_{i})$ onto
the subspace of $\mathbf{x}_{\mathrm{org}}$ for ensuring that the projected
signal does not carry any malicious perturbation (i.e., $\delta_{i}$).

In order to make Eq. 4 more compatible with other defense GAN platforms such
as the complex cycle-consistent configurations, a convex quadratic regularizer
has been introduced as [28]:

$\arg\min_{\mathbf{z}_{2,i}}\left\|\mathcal{G}_{1}(\mathbf{z}_{1,i}^{c})-\mathcal{G}_{2}(\mathbf{z}_{2,i})\right\|_{2}^{2}\quad\mathrm{and}\quad\mathbf{z}_{1,i},\mathbf{z}_{2,i}\in\mathbb{R}^{d_{z}}$
(5)

where $\mathcal{G}_{1}(\cdot)$ and $\mathcal{G}_{2}(\cdot)$ represent two
generator networks bundled together sequentially. This regularization
technique has been exploited in the cyclic defense GAN (CD-GAN) [28] platform
and the achieved results corroborate that not only Eq. 5 improves the
stability of the entire generative model, but also it effectively enhances the
chance of synthesizing $\delta_{i}$-free speech signals.

Designing a GAN architecture with multiple discriminator networks is another
efficacious approach for improving the stability of $\mathcal{G}_{i}(\cdot)$.
On one hand, this design contributes to provide more informative gradients to
the generators and consequently enhances the performance of the defense
algorithm in runtime [31, 23]. On the other hand, such a design adds
computational overhead to the training procedure of the generative model.
Presumably, one potential resolution is defining the regularization term (e.g.
Eq. 5) in a non-Cartesian vector space [32, 13]. Following this perspective,
Esmaeilpour et al. [10] developed a multi-discriminator GAN in the restricted
Sobolev space [33]. This defense algorithm is known as SD-GAN and it has been
successfully evaluated for varieties of targeted and non-targeted adversarial
attacks. However, it has been experimentally demonstrated that SD-GAN
negatively affects the quality of the synthesized speech signals. In response,
we develop a novel GAN-based defense algorithm which makes a better trade-off
between protecting the transcription system against adversarial attacks and
preserving the signal quality.

##  III Regularized Sobolev Defense GAN: RSD-GAN

Typically, a GAN configuration consists of two deep neural networks, namely a
generator and a discriminator denoted by $\mathcal{G}(\cdot)$ and
$\mathcal{D}(\cdot)$, respectively [11]. The first network enquires a random
vector $\mathbf{z}_{i}$ and synthesizes a new signal
$\vec{x}_{\mathrm{syn},i}$ as [11]:

$\mathcal{G}(\mathbf{z}_{i})\mapsto\vec{x}_{\mathrm{syn},i}\quad\mathrm{s.t.}\quad\vec{x}_{\mathrm{syn},i}\cong\vec{x}_{\mathrm{org},i}\quad\mathrm{and}\quad
p_{g}\approx p_{o}$ (6)

where $p_{g}$ and $p_{o}$ represent the probability distribution of the
generator and the original training signals, respectively. In order to derive
a comprehensive $p_{g}$ for a given training set, the discriminator network
should provide gradient information to $\mathcal{G}(\cdot)$ in every
iteration. Toward this end, a metric should be employed to measure the
discrepancy between the original and synthetic signals. The choice of such a
metric (which is also known as an integral probability metric - IPM [33]) is
critical since it directly affects the learning curve of the generator network
during training [34]. Technically, an IPM measures the divergence between two
probability distributions using a critic function $f(\cdot)$ as follows [35]:

$\sup_{f\in\mathcal{F}}\left[\mathbb{E}_{\mathcal{G}(\mathbf{z}_{i})\sim
p_{g}}f(\mathcal{G}(\mathbf{z}_{i}))-\mathbb{E}_{\vec{x}_{\mathrm{org}}\sim
p_{o}}f(\vec{x}_{\mathrm{org}})\right]$ (7)

where $f(\cdot)$ is parametric and semidefinite [36]. Additionally,
$\mathcal{F}$ is an independent function class defined in a non-Cartesian
subspace. Basically, the interpretation of Eq. 7 in the context of training a
GAN is finding a nonlinear critic function which asymptotically estimates the
discrepancy between original and synthetic signals according to the
constraints imposed by $\mathcal{F}$. Theoretically, there exist numerous
function classes for Eq. 7 but only a limited number of those are practically
integrable as an IPM into a generative model framework [14]. Some notable IPMs
which have been successfully implemented for training different types of GANs
are $\varphi$-divergence [11] (used in the vanilla-GAN [11]), Stein [37],
Wasserstein [38] (for improving the stability and scalability of the generator
networks), Cramér [39], $\mu$-Fisher [34], and Sobolev [14]. Recently, the
latter IPM has received more attention in the domain of speech synthesis using
GANs since it is relatively more consistent with the latest architectures of
the advanced speech-to-text transcription systems (e.g., DeepSpeech) [10].
Such architectures employ a standard transformation layer known as the
$\mathrm{mfcc}$ production which converts a single or multichannel input
signal into a feature representation using Fourier transform. This transform
is associated with the second degree function class defined in the Sobolev
space ($\mathcal{F}_{S}$) [14]. The formal definition for $\mathcal{F}_{S}$ is
as the following [33].

$\underbrace{\mathcal{S}^{\vartheta,2}(\mathcal{X})}_{\mathcal{F}_{S}}=\left\\{f:\mathcal{X}\rightarrow\mathbb{R}^{d_{z}},\int_{\mathcal{X}}\left\|\nabla_{\mathbf{x}}f(\mathbf{x})\right\|^{2}\mu(\mathbf{x})d\mathbf{x}\right\\}$
(8)

where $\mathcal{X}$ is an open subset of speech signal collection and
$\vartheta$ indicates the degree of the function class. Additionally,
$\mu(\cdot)\propto p_{o}+p_{g}$ and it denotes a dominant probability density
function [33]. From the statistical and algebraic standpoints,
$\mathcal{F}_{S}$ can be also defined as the following [33, 13]:

$\mathcal{F}_{S}\cong\sum\alpha_{\vartheta}\left|\tilde{f}(\mathbf{x})\right|^{2}\quad\mathrm{and}\quad\mathrm{mfcc}(\vec{x})\mapsto\mathbf{x}$
(9)

where $\tilde{f}(\cdot)$ denotes a set of Fourier coefficients (i.e.,
frequency components) and $\alpha_{\vartheta}$ is set to be a nonzero scalar.
Hence, due to the correlation between $\mathcal{F}_{S}$ and the
$\mathrm{mfcc}$ feature vectors, substituting Eq. 8 into Eq. 7 most likely
contributes to extract more informative gradients to the benefit of both
$\mathcal{G}(\cdot)$ and $\mathcal{D}(\cdot)$ [10]. The final outcome of this
substitution is yielding the Sobolev-IPM (SIPM) with zero-boundary condition.

In practice, implementing the SIPM for training a GAN might be extremely
challenging since to the best of our knowledge, there is no analytical
upperbound limit for the integral term in Eq. 8 [13]. This increases the
degree of nonlinearity for the critic function and results in delaying the
convergence of the discriminator network during training [10]. To address this
issue, we propose a strict regularization term defined in the vector
decomposition space [13] for $f(\cdot)$ partially aiming at offloading
$\mathcal{D}(\cdot)$ from excessive computational overhead.

Proposition: Assuming $\lambda_{\nabla}$ and $\lambda_{f}$ represent the
eigenvalue tensors for $\nabla f(\mathbf{x})$ and the critic function as
defined in Eq. 8, respectively. Then, we can find a non-zero parametric
function $\Theta$ in such a way that:

$\min_{\lambda_{f}}\left|\lambda_{f}-\lambda_{\nabla}\right|\leq\eta\cdot\Theta\left\|\lambda_{f}\right\|_{F}$
(10)

Proof: Assuming $\eta\in\mathbb{R}_{+}^{d_{z}}$ and
$\Theta^{-1}\left(\lambda_{f}-\lambda_{\nabla}I\right)\Theta$ is quasi-
invertible. Then, according to the Bauer-Fike theorem [13] we can write:

$\sum\left|\lambda_{f}-\lambda_{\nabla}\right|\leqslant\left\|\lambda_{f}I-\Theta\right\|_{F}^{-1}\leqslant\eta\cdot\Theta\left\|\lambda_{f}\right\|_{F}$
(11)

where both $\lambda_{f}$ and $\Theta$ are in the closed-form. $\square$

The intuition behind developing Eq. 10 in an orthonormal Schur decomposition
subspace is the possibility of constraining the critic function $f(\cdot)$
relative to an achievable upperbound (supremum). More specifically, our
proposed regularizer binds the SIPM into a semidefinite region surrounded by
this supremum value. Thus, we can have a tighter control over the nonlinearity
of $f(\cdot)$ and train a more comprehensive yet stable GAN. However, the
performance of our regularizer is highly dependent to accurately derive and
maintaining $\Theta$. Toward this end, we define:

$\Theta:=\mathcal{FT}(\hat{\Theta}),\quad\hat{\Theta}\doteq\left\\{{\hat{\theta}_{i,j}}\mid\hat{\theta}_{i,j}\sim\mathcal{N}(0,p_{\tau_{r}})\right\\}$
(12)

where $\mathcal{FT}(\cdot)$ represents the short-term Fourier transform [40]
for complying with the nature of $\mathrm{mfcc}$ features. Moreover,
$p_{\tau_{r}}$ denotes the probability distribution of the simulated RIR
filter sets [16] as briefly mentioned in Section II. Employing such a
distribution in modeling $\Theta$ enables us to incorporate the spectral
features of the environmental settings into the regularization term of the
critic function and potentially counteract with losing the quality of the
speech signals upon running the defense GAN. In other words, substituting Eq.
12 into Eq. 10 integrates some SM properties into $\mathcal{F}_{S}$ and forces
the generator network to learn them. Eventually, this operation contributes to
synthesize a naturally-sounding signal according to the characteristics of the
environmental settings. In the following section, we provide a summary of our
conducted experiments and analyze the performance of our proposed RSD-GAN
relative to other defense approaches.

TABLE I: Performance comparison of defense algorithms against a comprehensive
set of targeted, non-targeted, white, and black-box adversarial signals. All
the statistics are averaged over 10 times experiment repetitions.
Outperforming results are in bold.

Defense |  Iteration ($\times 12,500$) |  Modes ($\times 16.5$) |  $\mathrm{GC}$ (per batch) | WER (%) | SLA (%) | segSNR | STOI
---|---|---|---|---|---|---|---
DPS | KLD | LGV | DPS | KLD | LGV | DPS | KLD | LGV | DPS | KLD | LGV | DPS | KLD | LGV | DPS | KLD | LGV | DPS | KLD | LGV
MRCA | $-$ | $-$ | $-$ | $-$ | $-$ | $-$ | $-$ | $-$ | $-$ | $29.01$ | $28.78$ | $25.31$ | $56.67$ | $58.42$ | $54.67$ | $16.09$ | $16.24$ | $17.88$ | $0.74$ | $0.75$ | $0.76$
Dompteur | $-$ | $-$ | $-$ | $-$ | $-$ | $-$ | $-$ | $-$ | $-$ | $18.29$ | $16.25$ | $17.42$ | $61.91$ | $63.23$ | $59.70$ | $18.35$ | $18.16$ | $19.92$ | $0.77$ | $0.79$ | $0.79$
A-GAN | $0.71$ | $0.62$ | $0.57$ | $1.19$ | $1.14$ | $1.07$ | $619$ | $945$ | $877$ | $24.77$ | $21.62$ | $23.81$ | $65.19$ | $70.01$ | $61.16$ | $22.49$ | $19.72$ | $21.84$ | $0.81$ | $0.83$ | $0.78$
CCD-GAN | $1.76$ | $1.28$ | $1.42$ | $2.98$ | $1.49$ | $2.36$ | $433$ | $709$ | $612$ | $09.33$ | $08.56$ | $07.32$ | $68.41$ | $70.89$ | $64.73$ | $22.76$ | $22.05$ | $24.39$ | $0.88$ | $0.89$ | $0.80$
CD-GAN | $1.87$ | $1.66$ | $1.59$ | $2.91$ | $2.77$ | $3.01$ | $512$ | $665$ | $564$ | $08.91$ | $08.11$ | $07.10$ | $71.07$ | $73.52$ | $\mathbf{71.12}$ | $25.17$ | $24.78$ | $23.67$ | $0.87$ | $0.88$ | $0.81$
SD-GAN | $2.04$ | $1.79$ | $1.34$ | $3.85$ | $3.53$ | $3.29$ | $451$ | $562$ | $431$ | $08.22$ | $\mathbf{07.53}$ | $\mathbf{04.18}$ | $71.39$ | $74.45$ | $69.97$ | $26.34$ | $25.22$ | $25.51$ | $0.89$ | $0.90$ | $0.82$
RSD-GAN | $\mathbf{2.89}$ | $\mathbf{2.23}$ | $\mathbf{2.96}$ | $\mathbf{4.18}$ | $\mathbf{4.77}$ | $\mathbf{4.15}$ | $\mathbf{211}$ | $\mathbf{171}$ | $\mathbf{189}$ | $\mathbf{06.11}$ | $08.08$ | $04.91$ | $\mathbf{75.88}$ | $\mathbf{76.60}$ | $70.51$ | $\mathbf{34.12}$ | $\mathbf{35.68}$ | $\mathbf{34.81}$ | $\mathbf{0.96}$ | $\mathbf{0.97}$ | $\mathbf{0.93}$
Recall: DPS: DeepSpeech $\mid$ KLD: Kaldi $\mid$ LGV: Lingvo $\mid$ Modes:
this is averaged over all the batches [41] $\mid$ $\mathrm{GC}$: this is
computed for the discriminator network with static batch size [41].

##  IV Experiments

Our benchmarking datasets for training the RSD-GAN are the Mozilla Common
Voice (MCV [42]) and LibriSpeech [43] which both include above thousands hours
of speech signals distributed over diverse utterances. Following a very common
practice in the domain of speech adversarial attack and defense
experimentation [6, 19, 16, 28], we also run all the algorithms on a portion
of the aforementioned datasets. Therefore, we randomly select 35,000 samples
separately from MCV and LibriSpeech collections. We dedicate 30% of such
signals for crafting $\vec{x}_{\mathrm{adv}}$ using different attack
algorithms and keep the rest for training the defense approaches.

The architecture which we design for our RSD-GAN is somewhat similar to the
CCD-GAN, however without employing the class-conditional platform. For the
generator network, we implement four consecutive residual blocks with $4\times
4\times 16$ channels followed by two $16\rightarrow 4\rightarrow 1$ non-local
layers. All these hidden layers are accompanied by weight normalization,
orthogonal initialization [44], and $\tanh$ activation function. For the
discriminator network, we implement two stacked residual blocks with $4\times
4\times 2$ channels and two $3\times 3\times 1$ convolutional layers. Finally,
there is one linear logit layer ($\rightarrow 1$) prior to a softmax function.
This network employs the SIPM with our proposed regularization term (i.e., Eq.
10) for measuring the discrepancy between $p_{g}$ and $p_{o}$. Toward deriving
a comprehensive $\Theta$ for Eq. 12, we follow the protocol explained in [45,
16] and use their predefined filter sets.

For targeted attacks, namely C&W, Yakura’s, the robust attack, Imperio,
Metamorph, and the CIPM attack, we randomly assign 15 incorrect phrases to
$\hat{\mathbf{y}}_{i}$ (with various lengths) and run their associated
optimization algorithms (e.g., Eq. 2). Upon the convergence of these attacks,
we achieve 15 adversarial signals for every given $\vec{x}_{\mathrm{org}}$.
Since we cannot manually assign such incorrect phrases to non-targeted and
black-box attacks (e.g., the multi-objective optimization attack (MOOA) [46]
and the genetic algorithm attack (GAA) [47]), we run each of these algorithms
15 times to craft a collection of different adversarial signals.

In order to evaluate the performance of the defense algorithms against the
aforementioned adversarial signals, we measure three categories of statistical
metrics. The first category includes three estimators for the accountability
of the GANs. More specifically, we compute the total number of iterations for
the generator network prior to collapse, the number of learned modes in every
batch with the static size of 512, and the rounds of required gradient
computations ($\mathrm{GC}$) according to the pipeline characterized in [41].
Technically, larger values for the first two estimators interpret as the
higher stability of the generative model in runtime. However, $\mathrm{GC}$
indicates the computational load on the discriminator network and ideally it
should be minimized.

The second category contains the conventional yet effective word error rate
(WER) and sentence-level accuracy (SLA) metrics as defined in the following
[19, 10]:

$\mathrm{WER}=(\hat{S}+\hat{I}+\hat{D})/n_{\mathbf{\hat{y}}_{i}}\times
100\mid\mathrm{SLA}=n_{\mathrm{ct}}/n_{\mathrm{tas}}\times 100$ (13)

where $\hat{S}$, $\hat{I}$, and $\hat{D}$ denote the number of phrase
substitution, insertion, and deletion, respectively. Moreover,
$n_{\mathbf{\hat{y}}_{i}}$ indicates the total number of predefined
adversarial phrases. Regarding the SLA’s mechanism, $n_{\mathrm{ct}}$ and
$n_{\mathrm{tas}}$ stand for the number of correctly transcribed signals and
the total number of adversarial signals crafted for each victim model (e.g.
DeepSpeech), respectively. Finally, the third category accommodates rigorous
signal quality metrics, namely segmental signal-to-noise ratio (segSNR) [48]
and the short-term objective intelligibility (STOI) [49]. We employ such
estimators to assess the level of distortions imposed on the signals upon
passing them through the defense algorithms. By definition, both segSNR and
STOI metrics yield higher values for more reliable defense algorithms. Table I
summarizes our achieved results on the above-mentioned evaluation categories.

As shown in Table I, our RSD-GAN dominantly outperforms other defense
algorithms in terms of generative model accountability. This implies that not
only our proposed regularizer (i.e., Eq. 10) can significantly increase the
number of learned modes for $\mathcal{G}(\cdot)$ and keep the model stable up
to above 20,000 iterations, but also it remarkably decreases the number of
gradient computations for $\mathcal{D}(\cdot)$. Additionally, for almost half
of the cases the RSD-GAN competitively surpasses other dense approaches with
reference to the WER and SLA metrics. Finally, the achieved results for the
signal quality metrics corroborates the effectiveness of our novel RIR
encoding technique (i.e., Eq. 12) into the SIPM formulation. In other words,
the RSD-GAN makes a better trade-off between protecting speech transcription
systems against adversarial attacks and preserving the quality of the
synthetic signals.

##  V Conclusion

In this paper, we introduced a novel defense approach for protecting some
advanced speech-to-text transcription systems. Our algorithm is based on
synthesizing a new signal acoustically very similar to the given malicious
input aiming at bypassing the potential adversarial perturbation. Toward this
end, we developed a non-conditional GAN architecture and imposed a solid
regularization on the discriminator network for improving accuracy,
maintaining stability, and reducing the computational complexity of the entire
model. However, we noticed that the performance of our RSD-GAN considerably
drops for really long multispeaker signals ($>7$ utterances). We are strictly
determined to address this issue in our future works.

## References

  * [1] L. C. Vila, C. Escolano, J. A. Fonollosa, and M. R. Costa-Jussa, “End-to-end speech translation with the transformer.” in _IberSPEECH_ , 2018, pp. 60–63.
  * [2] M. Implementation, “Mozilla speech recognition project: Deepspeech,” https://github.com/mozilla/DeepSpeech, 2017.
  * [3] D. Povey, A. Ghoshal, G. Boulianne, L. Burget, O. Glembek, N. Goel, M. Hannemann, P. Motlicek, Y. Qian, P. Schwarz _et al._ , “The kaldi speech recognition toolkit,” in _IEEE Works Autom Speech Recog Underst_ , 2011.
  * [4] J. Shen, P. Nguyen, Y. Wu, Z. Chen, M. X. Chen, Y. Jia, A. Kannan, T. Sainath, Y. Cao, C.-C. Chiu _et al._ , “Lingvo: a modular and scalable framework for sequence-to-sequence modeling,” _arXiv preprint arXiv:1902.08295_ , 2019\.
  * [5] L. Schönherr, T. Eisenhofer, S. Zeiler, T. Holz, and D. Kolossa, “Imperio: Robust over-the-air adversarial examples for automatic speech recognition systems,” in _Annual Comp Secur Appl Conf_ , 2020, pp. 843–855.
  * [6] N. Carlini and D. Wagner, “Audio adversarial examples: Targeted attacks on speech-to-text,” in _IEEE Secur Privacy Workss_ , 2018, pp. 1–7.
  * [7] Q. Wang, B. Zheng, Q. Li, C. Shen, and Z. Ba, “Towards query-efficient adversarial attacks against automatic speech recognition systems,” _IEEE Transactions on Information Forensics and Security_ , vol. 16, pp. 896–908, 2020.
  * [8] N. Papernot, “Characterizing the limits and defenses of machine learning in adversarial settings,” _PhD Thesis presented to The Pennsylvania State University_ , 2018.
  * [9] M. Esmaeilpour, P. Cardinal, and A. L. Koerich, “From environmental sound representation to robustness of 2d cnn models against adversarial attacks,” _Applied Acoustics_ , vol. 195, p. 108817, 2022. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S0003682X22001918
  * [10] ——, “Multi-discriminator sobolev defense-gan against adversarial attacks for end-to-end speech systems,” _IEEE Transactions on Information Forensics and Security_ , vol. 17, pp. 2044–2058, 2022.
  * [11] I. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y. Bengio, “Generative adversarial nets,” in _Adv Neural Inf Process Syst_ , 2014, pp. 2672–2680.
  * [12] P. Samangouei, M. Kabkab, and R. Chellappa, “Defense-GAN: Protecting classifiers against adversarial attacks using generative models,” in _Intl Conf Learn Repres_ , 2018.
  * [13] C. F. Van Loan and G. H. Golub, _Matrix computations_. Johns Hopkins University Press, 1983.
  * [14] Y. Mroueh, C. Li, T. Sercu, A. Raj, and Y. Cheng, “Sobolev GAN,” in _6th Intl Conf Learn Repres_ , 2018.
  * [15] N. Akhtar and A. Mian, “Threat of adversarial attacks on deep learning in computer vision: A survey,” _Ieee Access_ , vol. 6, pp. 14 410–14 430, 2018.
  * [16] H. Yakura and J. Sakuma, “Robust audio adversarial example for a physical attack,” in _28th Intl J Conf Artif Intell_ , 2018, pp. 5334–5341.
  * [17] E. A. Habets, “Room impulse response generator,” _Technische Universiteit Eindhoven, Tech. Rep_ , vol. 2, no. 2.4, p. 1, 2006.
  * [18] S. Davis and P. Mermelstein, “Comparison of parametric representations for monosyllabic word recognition in continuously spoken sentences,” _IEEE Trans Acoust, Speech, Signal Process_ , vol. 28, no. 4, pp. 357–366, 1980.
  * [19] Y. Qin, N. Carlini, G. Cottrell, I. Goodfellow, and C. Raffel, “Imperceptible, robust, and targeted adversarial examples for automatic speech recognition,” in _Intl Conf Mach Learn_ , 2019, pp. 5231–5240.
  * [20] T. Chen, L. Shangguan, Z. Li, and K. Jamieson, “Metamorph: Injecting inaudible commands into over-the-air voice controlled systems,” in _Netw Distrib Syst Secur Symp_ , 2020.
  * [21] M. Esmaeilpour, P. Cardinal, and A. L. Koerich, “Towards robust speech-to-text adversarial attack,” in _ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)_. IEEE, 2022, pp. 2869–2873.
  * [22] S. Hu, X. Shang, Z. Qin, M. Li, Q. Wang, and C. Wang, “Adversarial examples for automatic speech recognition: Attacks and countermeasures,” _IEEE Communications Magazine_ , vol. 57, no. 10, pp. 120–126, 2019.
  * [23] M. Esmaeilpour, “Towards reliable data-driven sound recognition models: developing attack and defense algorithms,” Ph.D. dissertation, Département de Génie Logiciel et des TI, École de technologie supérieure (ÉTS), Montréal, Québec, Canada, 2021.
  * [24] N. Das, M. Shanbhogue, S.-T. Chen, L. Chen, M. E. Kounavis, and D. H. Chau, “Adagio: Interactive experimentation with adversarial attack and defense for audio,” _arXiv preprint arXiv:1805.11852_ , 2018.
  * [25] M. Esmaeilpour, P. Cardinal, and A. L. Koerich, “Class-conditional defense gan against end-to-end speech attacks,” in _IEEE Intl Conf Acoust, Speech and Signal Process_ , 2021, pp. 2565–2569.
  * [26] T. Eisenhofer, L. Schönherr, J. Frank, L. Speckemeier, D. Kolossa, and T. Holz, “Dompteur: Taming audio adversarial examples,” in _30th USENIX Secur Symp_ , 2021, pp. 2309–2326.
  * [27] S. Latif, R. Rana, and J. Qadir, “Adversarial machine learning and speech emotion recognition: Utilizing generative adversarial networks for robustness,” _arXiv preprint arXiv:1811.11402_ , 2018.
  * [28] M. Esmaeilpour, P. Cardinal, and A. L. Koerich, “Cyclic defense gan against speech adversarial attacks,” _IEEE Signal Processing Letters_ , vol. 28, pp. 1769–1773, 2021.
  * [29] B. McFee, C. Raffel, D. Liang, D. P. Ellis, M. McVicar, E. Battenberg, and O. Nieto, “Librosa: Audio and music signal analysis in python,” in _14th Python in Science Conf_ , vol. 8, 2015.
  * [30] M. Esmaeilpour, P. Cardinal, and A. L. Koerich, “Detection of adversarial attacks and characterization of adversarial subspace,” in _IEEE Intl Conf Acoust, Speech and Signal Process_ , 2020, pp. 3097–3101.
  * [31] E. Hosseini-Asl, Y. Zhou, C. Xiong, and R. Socher, “A multi-discriminator cyclegan for unsupervised non-parallel speech domain adaptation,” in _Interspeech 2018, 19th Annual Conference of the International Speech Communication Association, Hyderabad, India, 2-6 September 2018_. ISCA, 2018, pp. 3758–3762. [Online]. Available: https://doi.org/10.21437/Interspeech.2018-1535
  * [32] J. Freeman and D. Ford, “The efficient calculation of the cartesian geometry of non-cartesian structures,” _WIT Transactions on Engineering Sciences_ , vol. 16, 1970.
  * [33] H. Brezis, _Functional analysis, Sobolev spaces and partial differential equations_. Springer Science & Business Media, 2010.
  * [34] Y. Mroueh and T. Sercu, “Fisher GAN,” in _Adv in Neural Inf Proc Sys 30: Annual Conf on Neural Inf Proc Sys_ , 2017, pp. 2513–2523.
  * [35] A. Papoulis, _Probability and statistics_. Prentice-Hall, Inc., 1990.
  * [36] B. K. Sriperumbudur, K. Fukumizu, A. Gretton, B. Schölkopf, G. R. Lanckriet _et al._ , “On the empirical estimation of integral probability metrics,” _Electronic Journal of Statistics_ , vol. 6, pp. 1550–1599, 2012\.
  * [37] Y. Feng, D. Wang, and Q. Liu, “Learning to draw samples with amortized stein variational gradient descent,” in _33rd Conf Uncert Artif Intell_ , 2017\.
  * [38] M. Arjovsky and L. Bottou, “Towards principled methods for training generative adversarial networks,” in _5th Intl Conf Learn Repres_ , 2017.
  * [39] M. G. Bellemare, I. Danihelka, W. Dabney, S. Mohamed, B. Lakshminarayanan, S. Hoyer, and R. Munos, “The cramer distance as a solution to biased wasserstein gradients,” _CoRR_ , vol. abs/1705.10743, 2017.
  * [40] D. Griffin and J. Lim, “Signal estimation from modified short-time fourier transform,” _IEEE Trans Acoust, Speech, Signal Process_ , vol. 32, no. 2, pp. 236–243, 1984.
  * [41] T. Che, Y. Li, A. P. Jacob, Y. Bengio, and W. Li, “Mode regularized generative adversarial networks,” in _5th Intl Conf on Learning Representations, ICLR, Toulon, France_ , 2017.
  * [42] M. commonvoice.mozilla.org, “Mozilla common voice dataset,” https://voice.mozilla.org/en/datasets, 2019.
  * [43] V. Panayotov, G. Chen, D. Povey, and S. Khudanpur, “Librispeech: an asr corpus based on public domain audio books,” in _IEEE Intl Conf Acoust, Speech and Signal Process_ , 2015, pp. 5206–5210.
  * [44] A. M. Saxe, J. L. McClelland, and S. Ganguli, “Exact solutions to the nonlinear dynamics of learning in deep linear neural networks,” in _2nd Intl Conf Learn Repres_ , 2014.
  * [45] M. Kallinger and A. Mertins, “Multi-channel room impulse response shaping-a study,” in _2006 IEEE International Conference on Acoustics Speech and Signal Processing Proceedings_ , vol. 5. IEEE, 2006, pp. V–V.
  * [46] S. Khare, R. Aralikatte, and S. Mani, “Adversarial black-box attacks on automatic speech recognition systems using multi-objective evolutionary optimization,” _arXiv preprint arXiv:1811.01312_ , 2018.
  * [47] R. Taori, A. Kamsetty, B. Chu, and N. Vemuri, “Targeted adversarial examples for black box audio systems,” in _IEEE Security and Privacy Works_ , 2019, pp. 15–20.
  * [48] D. Baby and S. Verhulst, “Sergan: Speech enhancement using relativistic generative adversarial networks with gradient penalty,” in _IEEE Intl Conf Acoust, Speech, Signal Process_ , 2019, pp. 106–110.
  * [49] C. H. Taal, R. C. Hendriks, R. Heusdens, and J. Jensen, “An algorithm for intelligibility prediction of time–frequency weighted noisy speech,” _IEEE Trans Audio, Speech, Lang Process_ , vol. 19, no. 7, pp. 2125–2136, 2011.