#  Evaluating the Robustness of Bayesian Neural Networks Against Different
Types of Attacks

Yutian Pang  Sheng Cheng  Jueming Hu  Yongming Liu
Arizona State University  Tempe  AZ
{yutian.pang, scheng53, jueming.hu<EMAIL_ADDRESS>

###### Abstract

To evaluate the robustness gain of Bayesian neural networks on image
classification tasks, we perform input perturbations, and adversarial attacks
to the state-of-the-art Bayesian neural networks, with a benchmark CNN model
as reference. The attacks are selected to simulate signal interference and
cyberattacks towards CNN-based machine learning systems. The result shows that
a Bayesian neural network achieves significantly higher robustness against
adversarial attacks generated against a deterministic neural network model,
without adversarial training. The Bayesian posterior can act as the safety
precursor of ongoing malicious activities. Furthermore, we show that the
stochastic classifier after the deterministic CNN extractor has sufficient
robustness enhancement rather than a stochastic feature extractor before the
stochastic classifier. This advises on utilizing stochastic layers in building
decision-making pipelines within a safety-critical domain.

##  1 Introduction

Deep Neural Networks (DNNs) have been integrated into various safety-critical
engineering applications (Unmanned Aerial Vehicle (UAV), Autonomous System
(AS), Surveillance System (SS)). The prediction made by these algorithms needs
to be reliable with sufficient robustness. A failed DNN can lead to
potentially fatal collisions, especially for the solely camera-based
autonomous systems. Several such real-world accidents have happened including
ones that resulted in a fatality [21], where the image of the white-colored
truck was classified as the cloud. On the other hand, it’s widely known that
the predicted labels of neural networks are vulnerable to adversarial samples
[1, 12, 13]. The research on adversarial machine learning has focused on
developing an enormous number of adversarial attack and defense methods [7, 8,
25]. Most of the adversarial attack/defense methods are developed towards the
classical convolutional neural network (CNN) on image classification tasks.
Typically, the defense requires adversarial training with adversarial samples
that are used to perform adversarial attacks. In this way, the model can act
more robust against these types of attacks. However, it’s worth pointing out
that the development of new attack methods never ends.

Bayesian NNs, with distributions over their weights, are gaining attention for
their uncertainty quantification ability and high robustness from Bayesian
regularization, while retaining the advantages of deterministic NNs [5]. The
robustness gain of BNNs is not rigorous studied in the literature yet lacking
quantified comparative experiments on a real-world dataset. In particular, we
compare various types of Bayesian inference methods to NNs including Bayes By
Backprop (BBB) [4] with (local) reparameterization [15, 19], Variational
Inference (VI) [16], and Flipout approximation [23]. BNNs are evaluated
against several types of input perturbations, white-box adversarial attacks,
and black-box adversarial attacks without adversarial training. These attacks
simulate the possible attacks toward a deployed NN system in the real world,
intentionally or unintentionally. The adversarial samples are generated with
the $L_{p}$ threat models. In this paper, we adopt 6 input perturbation
methods, 5 white-box adversarial attacks, 3 black-box attacks towards two
open-source datasets (German Traffic Sign Recognition (GTSRB) [14] & Planes in
Satellite Imagery (PlanesNet) [9]), both of which were in the safety-critical
domains (AS & SS).

We have several exciting findings by analyzing the experiment results
quantitatively. Firstly, we notice that BNN has limited robustness benefits
against various input perturbations since the classical CNN has also
demonstrated denoising capabilities Secondly, the Bayesian neural network
shows significant robustness in the experiments in terms of classification
accuracy, especially against constrained adversarial attacks [10]. Thirdly, we
realize that both models will fail when dealing with unconstrained adversarial
attacks. In this case, the attacks are obviously distinguishable by human
visions. Furthermore, the stochasticity on the classifier can achieve
comparative performance by putting weight uncertainties on both the
convolutional extractor and the classifier, with comparative computation time
consumption. These findings give advice on building robust stochastic image-
based classifiers in real-world machine learning system applications. More
discussions are presented in Sec 6.

Table 1: Performance Against Input Perturbations. Report Test Accuracy in %.

Dataset I: GTSRB(German Traffic Sign Recognition Benchmark)
---
Methods |  Clean |  Gaussian |  S&P |  Poisson |  RE |  RE Colorful |  Speckle
CNN |  Baseline |  $96.28\pm 0.69$ |  $96.19\pm 0.72$ |  $76.91\pm 4.37$ |  $96.29\pm 0.69$ |  $88.76\pm 0.79$ |  $72.50\pm 4.52$ |  $15.18\pm 2.33$
F-BNN |  Flipout |  $97.17\pm 0.22$ |  $97.19\pm 0.17$ |  $84.06\pm 1.00$ |  $97.18\pm 0.17$ |  $90.45\pm 0.33$ |  $82.12\pm 0.55$ |  $34.12\pm 3.27$
BBB |  $97.25\pm 0.16$ |  $97.27\pm 0.16$ |  $80.81\pm 1.61$ |  $97.26\pm 0.21$ |  $89.81\pm 0.92$ |  $79.69\pm 1.99$ |  $26.89\pm 2.81$
BNN |  Flipout |  $96.85\pm 0.51$ |  $96.87\pm 0.56$ |  $75.51\pm 4.49$ |  $96.90\pm 0.55$ |  $89.93\pm 0.85$ |  $72.96\pm 1.60$ |  $10.46\pm 4.52$
BBB |  $96.93\pm 0.32$ |  $96.94\pm 0.35$ |  $79.42\pm 1.93$ |  $96.93\pm 0.34$ |  $88.45\pm 1.32$ |  $73.65\pm 2.71$ |  $17.48\pm 2.97$
LRT |  $96.85\pm 0.16$ |  $96.83\pm 0.20$ |  $75.60\pm 1.13$ |  $96.83\pm 0.23$ |  $88.64\pm 1.22$ |  $71.88\pm 4.22$ |  $10.88\pm 2.50$
VI |  $95.37\pm 0.41$ |  $95.30\pm 0.44$ |  $73.33\pm 3.65$ |  $95.35\pm 0.40$ |  $85.83\pm 1.84$ |  $68.91\pm 0.99$ |  $10.05\pm 2.42$

##  2 Background

###  2.1 Bayesian neural networks

The formulation of Bayesian NN relies on Bayesian probabilistic modeling with
i.i.d. distributions over network parameters. The Bayesian approach gives a
space of parameters $\omega$ as a distribution $p(\omega)$ called the prior,
and a likelihood distribution $p(Y|X,\omega)$, which is a probabilistic model
of the model outputs given $X$ and $\omega$. The posterior is proportional to
the likelihood and the prior and the prediction is simply
$\mathbb{E}_{p(\omega|X,Y)}[p(Y^{*}|X^{*},\omega)]$. $X^{*}$ is the test input
and $Y^{*}$ is the prediction. However, the inference of the posterior and the
prediction are both intractable [4].

Variational Inference (VI) [16], as an approximate probabilistic inference
method, is used to resolve this. The objective is to minimize the distance
between the approximate variational distribution $q_{\theta}(\omega)$ for the
posterior $p(\omega|X,Y)$. The objective is further approximated as the
negative Evidence Lower BOund (ELBO). In practice, ELBO is approximated by
$\sum^{n}_{i=1}[q_{\omega(i)}(\omega)-\log p(\omega^{(i)})-\log
p(Y|X,\omega^{(i)})]$, where $\omega^{(i)}$ is the $i^{th}$ Monte Carlo sample
from $q_{\theta}(\omega)$. $\omega$ is reparameterized into $(\mu,\sigma)$ for
backpropagation [15, 19]. Sampling the network parameters stochastically
during training is referred as weight perturbations. The recent advancements
of weight perturbation method, Flipout, decorrelate the gradients within each
batch of the data [23], while boosting the inference process of BNN.

###  2.2 Adversarial Attacks

Adversarial attacks are defined based upon the concept of threat model [6].
Denote $f(\cdot)$ as a classification model, with original input $x$ and
adversarial samples $x^{adv}$, and $y$ denotes the ground-truth label. The
adversarial attack is to attack the model $f$ by adding small perturbation on
the original inputs. This perturbation measured by the $L_{p}$ norm is limited
by the perturbation budget $\varepsilon$, that is
$\|x-x^{adv}\|_{p}<\varepsilon$. Particularly, we use $L_{\infty}$ in this
paper which implies that the perturbation to each pixel in $x$ can’t be larger
than $\varepsilon$. The generation of adversarial samples is formulated into
two optimization problems depend on if $\varepsilon$ presented. Eq. (1) is to
generate an untargeted adversarial example by maximizing the cross-entropy
loss function $\mathcal{L}$. The second strategy is to find the minimum
perturbation as Eq. (2). $x^{\prime}$ is one proposed adversarial sample by
the generation algorithm.

$x^{adv}\leftarrow\underset{\|x-x^{\prime}\|_{p}<\varepsilon}{\mathrm{argmax}}\mathcal{L}(x^{\prime},y)$
(1)
$x^{adv}\leftarrow\underset{x^{\prime}}{\mathrm{argmin}}\|x-x^{\prime}\|_{p}$
(2)

The concept of white-box attacks and black-box attacks build upon the level of
adversary’s knowledge. White-box attacks typically acquire the full knowledge
of the model, including model architectures, parameters, loss formula. White-
box attack methods generate perturbations based on NN gradients given the
detailed knowledge of the model. Under Eq. (1), the Fast Gradient Sign Method
(FGSM) [13] generates $x^{adv}$ by an one-step update. Basic Iterative Method
(BIM) [17] is an iterative version of FGSM with a multi-step update. Projected
gradient descent method (PGD) [18] has a similar first-order setup but with
random initials. DeepF [20] and Carlini & Wagner’s method (C&W) [8] have been
used to solve Eq. (2).

Black-box attacks have limit/partial knowledge of the target model. Depending
on the portion of the knowledge to the model, it can be further categorized
into transfer-based, score-based, and decision-based black-box attacks.
Transfer-based attack uses distillation as a defense strategy by training a
substitute model with the knowledge of the training data. Momentum Iterative
Method (MIM) [11] gives guidance on update direction as an extension of BIM.
Score-based black-box attacks only acquire the output probabilities. It
estimates the gradients by gradient-free methods with limited queries. An
example of a score-based attack is SPSA [22]. Decision-based black-box attacks
solely acquire the hard-label predictions. The Square Attack [2] is an example
based on a random search on the decision boundary.

###  2.3 Input perturbations

Input perturbations to $x$, as a similar concept to data augmentation, are
also examined in this paper as they also exist in real-world cases. We adopt 6
types of input perturbation methods to simulate various user cases. Firstly,
we use the recent advancement Random Erasing (RE) [26]. RE randomly masks a
rectangular region with black color in $x$ with several masking parameters to
determine the size of the region. Furthermore, we generate RE with random
color as masking of the inputs. A typical case is stickers on the stop sign
and fails a self-driving car. We also adopt the salt-and-pepper noise [3], and
speckle noise to simulate signal interference. This includes the
electromagnetic interference (EMI) in unshielded twisted pairs (UTP) in
Ethernet or adjacent-channel interference in frequency modulation (FM)
systems. We use Gaussian/Possion blur on $x$ to simulate the system with low
data transmission speed, and/or bandwidth issues.

##  3 Experiments

###  3.1 Evaluated Datasets

We use the GTSRB [14] and PlanesNet [9] in this paper. The GTSRB images are
classified into 43 classes where the training set contains $39,209$ images and
$12,630$ in test set. The PlansNet has two class labels indicate plane or no-
plane given a input image. We use $10\%$ of the data for testing. The attack
methods discussed in Sec. 2.2 and Sec. 2.3 are used in the experiment. The
visualization of test images are shown in Appendix.

###  3.2 Evaluation Procedures

Firstly, we train the baseline CNN model, the F-BNN model, and the BNN model.
We build all the models following the VGG-16 architecture, but with stochastic
layers in the Bayesian formulation. F-BNN here refers to fully-Bayesian neural
network where both feature extractor and classifier are stochastic, while only
stochastic classifier presented in BNN model. Then, we generate different
types of adversarial samples of the test data w.r.t. the baseline CNN model
and test each of the trained model to get the classification accuracy against
adversarial attacks. Repeating this procedure for 5 times and averaging the
results to get the mean prediction accuracy and variance. The evaluation
procedure for input perturbations are similar to this procedure. We report the
quantitative results in Table. 1, Table. 2.

Table 2: Performance Against Adversarial Attacks with different $\varepsilon$
and dataset. Report Test Accuracy in $\%$.

Dataset I: GTSRB(German Traffic Sign Recognition Benchmark)
---
$L_{\infty}(\epsilon=.10$) | White-box Attacks | Black-box Attacks
Methods/Distance |  PGD/$0.056$ |  FGSM/$0.071$ |  BIM/$0.049$ |  C&W/$0.001$ |  DeepF/$0.283$ |  SPSA/$0.290$ |  MIM/$0.092$ |  Square/$0.088$
CNN |  Baseline |  $2.43\pm 0.50$ |  $28.79\pm 1.69$ |  $28.35\pm 1.65$ |  $83.80\pm 6.19$ |  $3.97\pm 0.64$ |  $3.27\pm 0.12$ |  $2.26\pm 0.41$ |  $15.26\pm 3.05$
F-BNN |  Flipout |  $77.86\pm 2.57$ |  $58.86\pm 1.68$ |  $68.08\pm 2.53$ |  $95.59\pm 0.27$ |  $20.58\pm 1.73$ |  $3.75\pm 0.04$ |  $61.59\pm 3.00$ |  $85.65\pm 4.36$
BBB |  $78.78\pm 3.27$ |  $59.96\pm 2.01$ |  $69.32\pm 2.88$ |  $95.76\pm 0.23$ |  $20.57\pm 1.90$ |  $3.78\pm 0.04$ |  $62.86\pm 3.47$ |  $80.19\pm 3.37$
BNN |  Flipout |  $75.55\pm 2.93$ |  $55.71\pm 2.39$ |  $65.77\pm 2.42$ |  $94.99\pm 0.61$ |  $18.57\pm 1.88$ |  $3.78\pm 0.06$ |  $57.30\pm 2.84$ |  $70.54\pm 5.01$
BBB |  $76.47\pm 1.68$ |  $57.13\pm 1.61$ |  $66.69\pm 1.58$ |  $95.44\pm 0.53$ |  $19.47\pm 2.65$ |  $3.76\pm 0.05$ |  $58.49\pm 2.20$ |  $71.65\pm 7.76$
LRT |  $76.78\pm 2.04$ |  $57.10\pm 1.86$ |  $67.25\pm 1.89$ |  $95.55\pm 0.35$ |  $19.33\pm 1.42$ |  $3.77\pm 0.05$ |  $58.90\pm 2.80$ |  $76.53\pm 5.79$
VI |  $73.14\pm 1.89$ |  $53.37\pm 1.16$ |  $63.51\pm 1.13$ |  $93.85\pm 0.59$ |  $17.79\pm 2.28$ |  $3.75\pm 0.08$ |  $53.97\pm 2.18$ |  $67.86\pm 8.42$

Dataset I: GTSRB(German Traffic Sign Recognition Benchmark)
---
$L_{\infty}(\epsilon=.15$) | White-box Attacks | Black-box Attacks
Methods/Distance |  PGD/$0.061$ |  FGSM/$0.104$ |  BIM/$0.060$ |  C&W/$0.002$ |  DeepF/$0.285$ |  SPSA/$0.293$ |  MIM/$0.133$ |  Square/$0.132$
CNN |  Baseline |  $2.41\pm 0.51$ |  $28.29\pm 1.77$ |  $28.32\pm 1.66$ |  $79.77\pm 2.49$ |  $3.99\pm 0.64$ |  $3.20\pm 0.09$ |  $2.21\pm 0.39$ |  $5.24\pm 1.66$
F-BNN |  Flipout |  $73.28\pm 2.97$ |  $42.79\pm 3.68$ |  $56.20\pm 4.42$ |  $94.94\pm 0.14$ |  $20.96\pm 0.84$ |  $3.80\pm 0.02$ |  $42.86\pm 4.41$ |  $73.10\pm 5.62$
BBB |  $70.00\pm 2.37$ |  $41.91\pm 1.84$ |  $53.87\pm 2.13$ |  $94.97\pm 0.14$ |  $19.92\pm 1.78$ |  $3.87\pm 0.04$ |  $39.76\pm 1.79$ |  $74.51\pm 5.97$
BNN |  Flipout |  $69.96\pm 3.26$ |  $40.88\pm 0.82$ |  $54.65\pm 1.25$ |  $94.65\pm 0.49$ |  $20.01\pm 0.27$ |  $3.75\pm 0.04$ |  $37.58\pm 2.41$ |  $62.82\pm 4.08$
BBB |  $70.21\pm 1.75$ |  $40.92\pm 1.41$ |  $54.23\pm 1.53$ |  $94.72\pm 0.38$ |  $19.89\pm 1.13$ |  $3.83\pm 0.04$ |  $38.54\pm 1.89$ |  $58.18\pm 9.47$
LRT |  $69.39\pm 2.20$ |  $40.48\pm 1.34$ |  $53.54\pm 1.44$ |  $94.76\pm 0.09$ |  $19.11\pm 2.36$ |  $3.78\pm 0.07$ |  $36.34\pm 1.81$ |  $60.43\pm 11.1$
VI |  $67.35\pm 3.84$ |  $39.89\pm 1.89$ |  $53.28\pm 2.45$ |  $93.23\pm 0.42$ |  $18.07\pm 1.75$ |  $3.79\pm 0.05$ |  $35.12\pm 2.43$ |  $53.86\pm 8.77$

Dataset II: PlanesNet(Detect Aircraft in Planet Satellite Image Chips)
---
$L_{\infty}(\epsilon=.10$) | White-box Attacks | Black-box Attacks
Methods/Distance |  PGD/$0.068$ |  FGSM/$0.086$ |  BIM/$0.061$ |  C&W/$0.005$ |  DeepF/$0.349$ |  SPSA/$0.212$ |  MIM/$0.094$ |  Square/$0.080$
CNN |  Baseline |  $1.81\pm 0.37$ |  $45.44\pm 2.40$ |  $13.50\pm 2.28$ |  $68.21\pm 2.13$ |  $43.77\pm 4.83$ |  $49.65\pm 0.91$ |  $1.83\pm 0.36$ |  $15.46\pm 1.70$
F-BNN |  Flipout |  $24.51\pm 3.70$ |  $57.69\pm 2.37$ |  $36.78\pm 4.35$ |  $91.13\pm 0.41$ |  $54.90\pm 2.84$ |  $60.88\pm 0.79$ |  $23.14\pm 2.71$ |  $75.36\pm 6.81$
BBB |  $28.43\pm 5.81$ |  $58.51\pm 2.65$ |  $40.96\pm 6.94$ |  $89.69\pm 0.82$ |  $48.54\pm 8.92$ |  $66.54\pm 1.06$ |  $26.28\pm 5.04$ |  $76.20\pm 7.44$
BNN |  Flipout |  $23.54\pm 2.67$ |  $62.77\pm 1.30$ |  $40.31\pm 3.33$ |  $91.33\pm 0.76$ |  $68.30\pm 1.33$ |  $65.58\pm 2.68$ |  $24.07\pm 2.25$ |  $75.89\pm 2.65$
BBB |  $22.58\pm 4.24$ |  $59.74\pm 4.23$ |  $38.69\pm 8.71$ |  $91.59\pm 1.35$ |  $61.85\pm 5.06$ |  $62.94\pm 2.94$ |  $22.72\pm 4.20$ |  $74.98\pm 4.11$
LRT |  $25.22\pm 1.80$ |  $62.59\pm 1.09$ |  $42.23\pm 3.93$ |  $91.47\pm 1.42$ |  $69.33\pm 2.28$ |  $65.57\pm 2.16$ |  $25.83\pm 2.42$ |  $77.79\pm 1.59$
VI |  $20.72\pm 5.56$ |  $55.79\pm 3.38$ |  $33.92\pm 6.17$ |  $91.19\pm 1.70$ |  $65.89\pm 4.76$ |  $60.30\pm 2.49$ |  $19.91\pm 5.57$ |  $72.56\pm 4.02$

##  4 Results

Table. 1 lists the quantitative results of each model setups against input
perturbations. Results with a clean test input show the CNN baseline is well-
trained. Variational Bayes performs slightly worse. We analysis input
perturbations by groups, a) The Gaussian/Possion noisy blur to the inputs
won’t affect the model performance. The reason is neural network has been
proved to have denoising capabilities, especially for parameterized
distributional noise. b) The F-BNN with the RE/Colorful RE input perturbations
has better performance among all cases. c) The S&P/Speckle signal interference
cases has the best attack performance.

In Table. 2, we report the results of different models against adversarial
attacks on two datasets. For GTSRB dataset, We generate the untargeted
adversarial samples using the $L_{\infty}$ threat model with
$\varepsilon=0.10$ and $\varepsilon=0.15$ on both of these two datasets. We
perform attacks as previously discussed in Sec. 2.2. We also evaluate the
$L_{\infty}$ norm between adversarial samples and the original inputs for each
run. We report the mean $L_{\infty}$ distance between $x$ and $x^{adv}$ for
different attack methods in the table (PGD/0.068).

We also perform training time analysis for BNN and F-BNN with various settings
in Figure. 1. The model architecture, layer setups, and training procedure for
different methods are kept identical to address a fair comparison. The minimum
median time used for training BNN is the Bayes By Backprop method, with
smaller interquartile range. This also holds true for F-BNN training where
only BBB and Flipout are used. We observe that BNN requires less computer
training time. The same pattern is discovered for both datasets.

Figure 1: Training time comparison on GTSRB with stochastic BNN. Left: BNN
with only classifier as stochastic. Right: F-BNN with stochasticity on each
neural network layer.

##  5 Discussions

For adversarial attacks, the PGD achieves best attack performance towards our
CNN baseline models with reasonable perturbations. However, BNN and F-BNN also
exhibit significant robustness gain under PGD attacks. The classification
accuracy rises to $80\%$ in F-BNN for GTSRB data. The white-box adversarial
samples generated with Eq. 2 show bipolarity. This indicates the generation
algorithm needs specific parameter tuning. This is beyond the scope of this
work. Bayesian NN also proves to be robust under these cases. The peer
comparison between stochastic setting shows that BNN and F-BNN are analogous,
in the sense of robustness against white-box adversarial attacks. The results
shows inconsistency among different types of black-box attacks, especially
adversarial samples based on Eq. 2. For instance, with $\varepsilon=0.10$,
SPSA shows better attack performance on GTSRB but MIM has the best attack
performance on PlanesNet. SPSA fails every model for GTSRB, still due to the
large perturbations to original inputs. Bayesian NN shows better performance
against black-box attacks. In some cases, F-BNN has slightly better
performance compare to BNN but others not. This peer comparison shows similar
results with white-box attacks.

Overall, Bayesian NN shows remarkably robustness against all types of
adversarial attacks except SPSA on GTSRB. This is due to the large, human-
visible perturbations generated from SPSA. Larger adversarial perturbations
cased by larger $\varepsilon$ value makes the model perform worse, unless the
model has already failed with small perturbations. BNN achieves comparable
performance to F-BNN in the sense of classification accuracy, for both white-
box and black-box attacks.

##  6 Conclusion

We highlight several discoveries here. Firstly, the Bayesian formulation of
Neural Network can remarkably improve the performance of deep learning models,
especially when dealing with constrained white-box adversarial attacks. Then,
we notice that solely a Bayesian classifier is sufficient to improve model
robustness. This decreases the time and space complexity with fewer parameter
distributions. It’s also insignificant when dealing with augmentation based
input perturbations since classical CNN has already shows satisfactory
denosing capabilities. Lastly, Bayesian neural network may fail. This happens
when dealing images with human-visible modifications.

In the future, it worth looking at the possible reasons of good performance on
image classification task. For instance, benefits of ensemble methods or the
feature of Bayesian statistics. Also, it’s interesting to look at the model
robustness against attacks that are developed specifically toward BNNs
(gradient-free adversarial attacks for BNN [24]). The Bayesian posterior
observed from BNN can act as the safety precursor of ongoing malicious
activities toward the deploy machine learning systems. This leads to the
detection of adversarial samples in cybersecurity.

## References

  * [1] Chirag Agarwal, Anh Nguyen, and Dan Schonfeld.  Improving robustness to adversarial examples by encouraging discriminative features.  In 2019 IEEE International Conference on Image Processing (ICIP), pages 3801–3505. IEEE, 2019.
  * [2] Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein.  Square attack: a query-efficient black-box adversarial attack via random search.  In European Conference on Computer Vision, pages 484–501. Springer, 2020.
  * [3] Jamil Azzeh, Bilal Zahran, and Ziad Alqadi.  Salt and pepper noise: Effects and removal.  JOIV: International Journal on Informatics Visualization, 2(4):252–256, 2018.
  * [4] Charles Blundell, Julien Cornebise, Koray Kavukcuoglu, and Daan Wierstra.  Weight uncertainty in neural network.  In International Conference on Machine Learning, pages 1613–1622. PMLR, 2015.
  * [5] Luca Cardelli, Marta Kwiatkowska, Luca Laurenti, Nicola Paoletti, Andrea Patane, and Matthew Wicker.  Statistical guarantees for the robustness of bayesian neural networks.  arXiv preprint arXiv:1903.01980, 2019.
  * [6] Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Ian Goodfellow, Aleksander Madry, and Alexey Kurakin.  On evaluating adversarial robustness.  arXiv preprint arXiv:1902.06705, 2019.
  * [7] Nicholas Carlini and David Wagner.  Adversarial examples are not easily detected: Bypassing ten detection methods.  In Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security, pages 3–14, 2017.
  * [8] Nicholas Carlini and David Wagner.  Towards evaluating the robustness of neural networks.  In 2017 ieee symposium on security and privacy (sp), pages 39–57. IEEE, 2017.
  * [9] Planet’s Open California dataset.  Planes in satellite imagery, 2018.
  * [10] Yinpeng Dong, Qi-An Fu, Xiao Yang, Tianyu Pang, Hang Su, Zihao Xiao, and Jun Zhu.  Benchmarking adversarial robustness on image classification.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 321–331, 2020.
  * [11] Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li.  Boosting adversarial attacks with momentum.  In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 9185–9193, 2018.
  * [12] Yinpeng Dong, Hang Su, Jun Zhu, and Fan Bao.  Towards interpretable deep neural networks by leveraging adversarial examples.  arXiv preprint arXiv:1708.05493, 2017.
  * [13] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy.  Explaining and harnessing adversarial examples.  arXiv preprint arXiv:1412.6572, 2014.
  * [14] Sebastian Houben, Johannes Stallkamp, Jan Salmen, Marc Schlipsing, and Christian Igel.  Detection of traffic signs in real-world images: The German Traffic Sign Detection Benchmark.  In International Joint Conference on Neural Networks, number 1288, 2013.
  * [15] Diederik P Kingma, Tim Salimans, and Max Welling.  Variational dropout and the local reparameterization trick.  arXiv preprint arXiv:1506.02557, 2015.
  * [16] Diederik P Kingma and Max Welling.  Auto-encoding variational bayes.  arXiv preprint arXiv:1312.6114, 2013.
  * [17] Alexey Kurakin, Ian Goodfellow, Samy Bengio, et al.  Adversarial examples in the physical world, 2016.
  * [18] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu.  Towards deep learning models resistant to adversarial attacks.  arXiv preprint arXiv:1706.06083, 2017.
  * [19] Dmitry Molchanov, Arsenii Ashukha, and Dmitry Vetrov.  Variational dropout sparsifies deep neural networks.  In International Conference on Machine Learning, pages 2498–2507. PMLR, 2017.
  * [20] Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard.  Deepfool: a simple and accurate method to fool deep neural networks.  In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 2574–2582, 2016.
  * [21] Yuchi Tian, Kexin Pei, Suman Jana, and Baishakhi Ray.  Deeptest: Automated testing of deep-neural-network-driven autonomous cars.  In Proceedings of the 40th international conference on software engineering, pages 303–314, 2018.
  * [22] Jonathan Uesato, Brendan O’donoghue, Pushmeet Kohli, and Aaron Oord.  Adversarial risk and the dangers of evaluating against weak attacks.  In International Conference on Machine Learning, pages 5025–5034. PMLR, 2018.
  * [23] Yeming Wen, Paul Vicol, Jimmy Ba, Dustin Tran, and Roger Grosse.  Flipout: Efficient pseudo-independent weight perturbations on mini-batches.  arXiv preprint arXiv:1803.04386, 2018.
  * [24] Matthew Yuan, Matthew Wicker, and Luca Laurenti.  Gradient-free adversarial attacks for bayesian neural networks.  arXiv preprint arXiv:2012.12640, 2020.
  * [25] Huan Zhang, Hongge Chen, Zhao Song, Duane Boning, Inderjit S Dhillon, and Cho-Jui Hsieh.  The limitations of adversarial training and the blind-spot attack.  arXiv preprint arXiv:1901.04684, 2019.
  * [26] Zhun Zhong, Liang Zheng, Guoliang Kang, Shaozi Li, and Yi Yang.  Random erasing data augmentation.  In Proceedings of the AAAI Conference on Artificial Intelligence (AAAI), 2020.

##  Appendix A Appendix

###  A.1 Evaluation Results on PlanesNet Dataset

We list the classification results of PlanesNet Dataset in Table. 3 and Table.
4. The PlanesNet Dataset is open-source online. The objective is to classify
the existence of aircrafts in surveillance satellite images. The PlanesNet has
two class labels indicate plane or not plane. PlanesNet is another good
example to demonstrate the potential benefits to the engineering applications
in a safety-critical domain. Table. 3 is the results against input
perturbations. Table. 4 is the results against adversarial attacks.

Table 3: Performance Against Input Perturbations. Report Test Accuracy in %.

Dataset II: PlanesNet(Detect Aircraft in Planet Satellite Image Chips)
---
Methods |  Clean |  Gaussian |  S&P |  Poisson |  RE |  RE Colorful |  Speckle
CNN |  Baseline |  $98.19\pm 0.37$ |  $98.21\pm 0.31$ |  $86.76\pm 1.29$ |  $98.22\pm 0.38$ |  $93.16\pm 0.60$ |  $88.99\pm 0.80$ |  $74.76\pm 0.41$
F-BNN |  Flipout |  $97.83\pm 0.12$ |  $97.79\pm 0.21$ |  $91.91\pm 0.41$ |  $97.86\pm 0.15$ |  $93.06\pm 0.24$ |  $89.43\pm 0.75$ |  $74.80\pm 0.90$
BBB |  $96.50\pm 0.69$ |  $96.59\pm 0.55$ |  $87.85\pm 1.84$ |  $96.59\pm 0.70$ |  $91.14\pm 0.92$ |  $88.39\pm 0.91$ |  $75.33\pm 0.91$
BNN |  Flipout |  $98.55\pm 0.28$ |  $98.44\pm 0.28$ |  $84.06\pm 3.02$ |  $98.53\pm 0.26$ |  $92.21\pm 0.57$ |  $89.44\pm 0.52$ |  $74.79\pm 0.23$
BBB |  $98.73\pm 0.23$ |  $98.65\pm 0.27$ |  $83.84\pm 2.96$ |  $98.71\pm 0.25$ |  $91.63\pm 0.70$ |  $88.98\pm 0.67$ |  $75.04\pm 0.32$
LRT |  $98.88\pm 0.12$ |  $98.87\pm 0.11$ |  $83.00\pm 1.88$ |  $98.89\pm 0.11$ |  $92.30\pm 0.55$ |  $89.04\pm 0.21$ |  $74.78\pm 0.12$
VI |  $96.41\pm 2.72$ |  $96.23\pm 2.82$ |  $82.73\pm 3.41$ |  $96.34\pm 2.67$ |  $89.86\pm 2.31$ |  $87.01\pm 1.33$ |  $72.96\pm 3.25$

Table 4: Performance Against Adversarial Attacks. Report Test Accuracy in %.

Dataset II: PlanesNet(Detect Aircraft in Planet Satellite Image Chips)
---
$L_{\infty}(\epsilon=.10$) | White-box Attacks | Black-box Attacks
Methods/Distance |  PGD/$0.068$ |  FGSM/$0.086$ |  BIM/$0.061$ |  C&W/$0.005$ |  DeepF/$0.349$ |  SPSA/$0.212$ |  MIM/$0.094$ |  Square/$0.080$
CNN |  Baseline |  $1.81\pm 0.37$ |  $45.44\pm 2.40$ |  $13.50\pm 2.28$ |  $68.21\pm 2.13$ |  $43.77\pm 4.83$ |  $49.65\pm 0.91$ |  $1.83\pm 0.36$ |  $15.46\pm 1.70$
F-BNN |  Flipout |  $24.51\pm 3.70$ |  $57.69\pm 2.37$ |  $36.78\pm 4.35$ |  $91.13\pm 0.41$ |  $54.90\pm 2.84$ |  $60.88\pm 0.79$ |  $23.14\pm 2.71$ |  $75.36\pm 6.81$
BBB |  $28.43\pm 5.81$ |  $58.51\pm 2.65$ |  $40.96\pm 6.94$ |  $89.69\pm 0.82$ |  $48.54\pm 8.92$ |  $66.54\pm 1.06$ |  $26.28\pm 5.04$ |  $76.20\pm 7.44$
BNN |  Flipout |  $23.54\pm 2.67$ |  $62.77\pm 1.30$ |  $40.31\pm 3.33$ |  $91.33\pm 0.76$ |  $68.30\pm 1.33$ |  $65.58\pm 2.68$ |  $24.07\pm 2.25$ |  $75.89\pm 2.65$
BBB |  $22.58\pm 4.24$ |  $59.74\pm 4.23$ |  $38.69\pm 8.71$ |  $91.59\pm 1.35$ |  $61.85\pm 5.06$ |  $62.94\pm 2.94$ |  $22.72\pm 4.20$ |  $74.98\pm 4.11$
LRT |  $25.22\pm 1.80$ |  $62.59\pm 1.09$ |  $42.23\pm 3.93$ |  $91.47\pm 1.42$ |  $69.33\pm 2.28$ |  $65.57\pm 2.16$ |  $25.83\pm 2.42$ |  $77.79\pm 1.59$
VI |  $20.72\pm 5.56$ |  $55.79\pm 3.38$ |  $33.92\pm 6.17$ |  $91.19\pm 1.70$ |  $65.89\pm 4.76$ |  $60.30\pm 2.49$ |  $19.91\pm 5.57$ |  $72.56\pm 4.02$

Dataset II: PlanesNet(Detect Aircraft in Planet Satellite Image Chips)
---
$L_{\infty}(\epsilon=.15$) | White-box Attacks | Black-box Attacks
Methods/Distance |  PGD/$0.085$ |  FGSM/$0.127$ |  BIM/$0.084$ |  C&W/$0.007$ |  DeepF/$0.352$ |  SPSA/$0.217$ |  MIM/$0.139$ |  Square/$0.113$
CNN |  Baseline |  $1.81\pm 0.37$ |  $50.96\pm 2.07$ |  $12.79\pm 2.37$ |  $63.92\pm 1.99$ |  $45.14\pm 4.89$ |  $49.03\pm 0.67$ |  $1.81\pm 0.36$ |  $12.53\pm 2.90$
F-BNN |  Flipout |  $16.71\pm 2.83$ |  $56.17\pm 1.66$ |  $20.74\pm 2.99$ |  $89.33\pm 0.86$ |  $52.86\pm 4.97$ |  $61.99\pm 0.60$ |  $17.28\pm 3.62$ |  $64.91\pm 7.99$
BBB |  $21.33\pm 5.90$ |  $57.48\pm 0.57$ |  $23.98\pm 3.64$ |  $87.85\pm 1.27$ |  $52.00\pm 3.38$ |  $68.57\pm 1.92$ |  $19.77\pm 4.45$ |  $68.76\pm 7.46$
BNN |  Flipout |  $19.33\pm 4.21$ |  $63.91\pm 4.22$ |  $25.28\pm 5.88$ |  $90.16\pm 0.56$ |  $67.64\pm 3.04$ |  $67.35\pm 2.32$ |  $22.76\pm 5.80$ |  $72.38\pm 1.57$
BBB |  $16.85\pm 3.95$ |  $63.92\pm 3.16$ |  $24.04\pm 3.61$ |  $90.32\pm 0.84$ |  $65.43\pm 2.05$ |  $67.89\pm 2.97$ |  $19.54\pm 4.39$ |  $72.58\pm 2.80$
LRT |  $19.01\pm 4.72$ |  $63.54\pm 2.56$ |  $24.27\pm 4.83$ |  $90.85\pm 0.34$ |  $69.08\pm 1.94$ |  $67.09\pm 1.24$ |  $21.52\pm 5.07$ |  $70.67\pm 2.45$
VI |  $24.82\pm 7.63$ |  $65.39\pm 4.98$ |  $32.04\pm 9.46$ |  $88.21\pm 3.27$ |  $68.59\pm 3.37$ |  $67.99\pm 4.05$ |  $30.16\pm 10.1$ |  $72.96\pm 1.64$

###  A.2 Visualization of the Data

We visualize the data with input perturbations in Fig. 2. The first 12 samples
in the test dataset are chosen with their correct class labels indicated at
the top-left corner. The types of input perturbation are Random Erasing,
Gaussian, Salt-and-Pepper, Possion, Speckle, Random Erasing Colorful, Clean.
Similarly, the adversarial test samples are visualized in Fig. 3, with
different perturbation budgets $\varepsilon=0.10$ for (a) & (b),
$\varepsilon=0.15$ for (c) & (d).

(a) PlanesNet with Input Perturbations

(b) GTSRB with Input Perturbations

Figure 2: Visualization of applying input perturbations to PlanesNet and
GTSRB. From top to bottom, the methods are: RE, Gaussian, S&P, Possion,
Speckle, RE Colorful, Clean. The ground-truth for class labels are indicated
at the top-left corner of each data plot. (a) PlanesNet. (b) GTSRB

(a) Adversarial Samples for PlanesNet: $\varepsilon=0.10$

(b) Adversarial Samples for GTSRB: $\varepsilon=0.10$

(c) Adversarial Samples for PlanesNet: $\varepsilon=0.15$

(d) Adversarial Samples for GTSRB: $\varepsilon=0.15$

Figure 3: Visualization of applying input perturbations to PlanesNet and
GTSRB. From top to bottom, the methods are: PGD, FGSM, BIM, C&W, DeepF, SPSA,
MIM, Square. The ground-truth for class labels are indicated at the top-left
corner of each data plot. (a) PlanesNet. (b) GTSRB

###  A.3 Training Time Analysis

The training time of different methods on both two datasets are compared in
Fig. 4 and Fig. 5. We can see BNNs require less training time.

(a) BNN Training time on GTSRB dataset

(b) F-BNN Training time on GTSRB dataset

Figure 4: Training time comparison with stochastic BNN. The figures for
PlaneNet are reported in Fig. 5. (a) BNN with only classifier as stochastic.
(b) F-BNN with stochasticity on every neural network layers.

(a) BNN on PlanesNet

(b) F-BNN on PlanesNet

Figure 5: Training time comparison with stochastic BNN. (a) BNN with only
classifier as stochastic. (b) F-BNN with stochasticity on every neural network
layers.


301 4

Timing of accreting neutron stars with future X-ray instruments… Vladimír
Karas et al.

11institutetext:  Astronomical Institute of the Czech Academy of Sciences
Boční II 1401, CZ-14100, Prague, Czech Republic
11email<EMAIL_ADDRESS>22institutetext: Research Centre for
Computational Physics and Data Processing,
Institute of Physics, Silesian University in Opava, Bezručovo nám. 13,
CZ-746-01 Opava, Czech Republic

# Timing of accreting neutron stars with future X-ray instruments: towards new
constraints on dense matter equation of state

V. Karas0000-0002-5760-0459 11 K. Klimovičová0000-0002-0930-0961 22 D.
Lančová0000-0003-0826-9787 22 M. Štolc0009-0001-7020-2711 11 J.
Svoboda0000-0003-2931-0742 11 G. Török0000-0003-3958-9441 22 M.
Matuszková0000-0002-4193-653X 22 E. Šrámková0009-0000-7736-6180 22 R.
Šprňa0000-0002-5085-9740 22 M. Urbanec0000-0001-9635-5495 22

(2023; July 20, 2023; September 14, 2023; March 8, 2003)

###### Abstract

The Enhanced X-ray Timing and Polarimetry (eXTP) mission is a space mission to
be launched in the late 2020s that is currently in development led by China in
international collaboration with European partners. Here we provide a progress
report on the Czech contribution to the eXTP science. We report on our
simulation results performed in Opava (Institute of Physics of the Silesian
University in Opava) and Prague (Astronomical Institute of the Czech Academy
of Sciences), where the advanced timing capabilities of the satellite have
been assessed for bright X-ray binaries that contain an accreting neutron star
(NS) and exhibit the quasi-periodic oscillations.

Measurements of X-ray variability originating in oscillations of fluid in the
innermost parts of the accretion region determined by general relativity, such
as the radial or Lense-Thirring precession, can serve for sensitive tests
enabling us to distinguish between the signatures of different viable dense
matter equations of state. We have developed formulae describing non-geodesic
oscillations of accreted fluid and their simplified practical forms that allow
for an expeditious application of the universal relations determining the NS
properties. These relations, along with our software tools for studying the
propagation of light in strong gravity and neutron star models, can be used
for precise modeling of the X-ray variability while focusing on properties of
the intended Large Area Detector (LAD).

We update the status of our program and set up an electronic repository that
will provide simulation results and gradual updates as the mission
specifications progress toward their final formulation.

###### keywords:

stars: black holes – stars: neutron – X-rays: binaries – polarimetry

††volume: 53

##  1 Introduction

The Enhanced X-ray Timing and Polarimetry (eXTP) project is an international
project led by China with European contribution (Zhang et al., 2019). eXTP
will be a science mission designed to study the state of matter under extreme
conditions of density, gravity, and magnetism (in’t Zand et al., 2019; Watts
et al., 2019; Santangelo et al., 2019). It aims to address three scientific
questions in fundamental physics.

Among the primary goals are the long-standing problems of determining the
Equation of State (EoS) of matter at supra-nuclear density, the study of
accretion in the strong-field regime of gravity, and the measurement of
quantum-electrodynamic (QED) effects in highly magnetized stars (Baym et al.,
1971; Uzdensky et al., 2019). Primary targets include compact objects:
isolated NS as well as those in binary systems, cosmic objects with strong
magnetic fields such as magnetars, and stellar-mass, supermassive and
tentative intermediate-mass black holes (De Rosa et al., 2019). eXTP will
provide a significant enhancement of sensitivity and scheduling flexibility of
the parametric measurements, which will build on the exciting results of the
currently active IXPE (Weisskopf et al., 2023; Soffitta et al., 2021). Indeed,
the magnetic intensity in these objects can reach almost a billion times
higher magnitude than what is achievable on Earth.

Almost exactly a decade ago at this conference (10th INTEGRAL/BART Workshop in
Karlovy Vary, 22-25 April 2013), we explored the appearance of X-ray signal
generated by hot spots moving along quasi-elliptic trajectories close to the
innermost stable circular orbit in the Schwarzschild spacetime. The aim of our
investigation was to reveal whether the observable characteristics of the
Fourier power-spectral density can distinguish between the competing models
(Karas et al., 2014). In the present contribution, we elaborate on the
approach of X-ray lightcurve timing analysis to constrain the NS EoS. In
particular, we are interested in the prospects of the upcoming space-borne
technology that has been meanwhile developed.

eXTP is an enhanced proposal based on its predecessor, the XTP mission
concept, that has been selected and funded as one of the so-called background
missions in the Strategic Priority Space Science Program of the Chinese
Academy of Sciences since 2011. The strong European participation has
significantly enhanced the scientific capabilities of eXTP (Feroci et al.,
2022). Likewise, the Italy-led development of the Large Area Detector is based
on the prior LOFT proposal for a mission of the European Space Agency (Feroci
et al., 2012, 2016; Costa et al., 2001). In January 2017, the Chinese National
Space Agency accepted the eXTP mission as a flagship space science mission,
initiated and led by China in an international collaboration (Zhang et al.,
2016). The planned launch date of the mission is in the late 2020s. The
science observations are planned for at least eight years with the possibility
of further extensions.

The mission carries a unique and unprecedented suite of state-of-the-art
scientific instruments enabling for the first time ever the simultaneous
spectral-timing-polarimetry studies of cosmic sources in the energy range from
0.5–30 keV (and beyond).

Figure 1: Quasi-Periodic Oscillations from accreting black holes across a wide
range of mass. Enhanced sensitivity and a multitude of instruments will make
eXTP an ideal mission to explore accretion flow oscillations from a variety of
black holes over the range of mass. Whereas the upper left section of the plot
corresponds to stellar-mass black holes in microquasars observed in the Milky
Way, the lower right section is populated by supermassive black holes in cores
of active galaxies. The orange stripe indicates the uncertainty range
corresponding to the spin parameter in the range from a non-rotating black
hole ($a=0$) up to maximum rotation ($a=1$). The yellow stripe gives the
uncertainty corresponding to the luminosity distribution from the inner part
of the standard (Keplerian) accretion disk, where more than 90% of the entire
disk luminosity is produced.

In a brief contribution, we discuss promising scenarios regarding the
detection and analysis of quasi-periodic phenomena in the context of eXTP,
where its large collection area in the most relevant keV range and advanced
timing capabilities offer a leap in our understanding of the puzzling sources.
Our research collaboration at the Astronomical Institute of the Czech Academy
of Sciences in Prague and the Institute of Physics of the Silesian University
in Opava takes part in the work on data simulations and detector performances
related to study of accreting NS and the electromagnetic signatures of the
internal structure via high-frequency quasi-periodic oscillations (HF QPOs)
(e.g. Karas, 1999; Bakala et al., 2014; Karas et al., 2014; Šrámková et al.,
2015; Török et al., 2019; Kotrlová et al., 2020; Török et al., 2022, and
further references cited therein). An updated overview has been given in a
recent Thesis (Lančová, 2023).

##  2 Rapid variability of accreting black holes and neutron stars

Accreting black holes (both stellar mass and supermassive) and NSs exhibit
extraordinarily complex phenomenology of X-ray variability patterns on various
timescales, including the shortest ones of millisecond periods (van der Klis,
1998; McClintock & Remillard, 2006; Motta, 2016, and more references cited
therein). Here we focus on the widely discussed twin kHz peaks that have been
detected in the Fourier power spectra of a few dozen of X-ray binaries, and
also in several AGN and the Galactic centre supermassive black hole Sgr A*
with correspondingly down-scaled frequency (Abramowicz et al., 2003; Bursa et
al., 2004; Török, 2005; Goluchová et al., 2019). The position of the two
peaks, and of the third (burst oscillation) one, as well as their significant
coherence, limit the variety of potential models of the geometry of the
system. Figure 1 shows the scaling relation of selected HF QPO sources in the
QPO frequency vs. black hole mass diagram; see also a detailed caption in
recent updates and analyses in Šrámková et al. (2021, 2023). The figure has
been amended from the original work of Goluchová et al. (2019) by revising
data points for several objects and including additional sources (XTE
J1859+226, H 1743-322, ASASSN-14li).111References to individual sources:
Greene et al. (2001); Strohmayer (2001); Orosz et al. (2002); Remillard et al.
(2002); Greiner et al. (2001); Remillard et al. (2004); Pasham et al. (2014,
2015); Mïller & Gültekin (2011); Reis et al. (2012); Czerny et al. (2016);
Gierliński et al. (2008); Bentz et al. (2016); Gupta et al. (2018); Hu et al.
(2016); Bian & Zhao (2003); Pan et al. (2016); Turner et al. (2006); Zhang et
al. (2017); Carpano & Jin (2018); Yanes-Rizo et al. (2022); Motta et al.
(2022); Wevers et al. (2017); Pasham et al. (2019); Molla et al. (2017); Zhou
et al. (2015).

Very recently, a novel phenomenon of quasi-periodic eruptions (QPE) and
outflows (QPOouts) has been diagnosed in a growing number of nuclei of
external galaxies (Pasham et al., 2019); the latter events have been
tentatively associated with Tidal Disruption Events (TDE) (Gezari, 2021). The
effects of general relativity cannot be ignored in modeling systems where the
signal is emerging from the immediate vicinity of the inner accretion region
near a compact body (Stella & Vietri, 1999; Stella et al., 1999; Ingram &
Motta, 2019). It has been argued that the oscillation frequencies can be
employed to constrain the viable EoS of the NS matter (Lattimer & Prakash,
2007) and to test the TDE mechanism and even the validity of the no-hair
theorem in the case of black holes space-times.

Figure 2: Left: Images illustrating Doppler shifts effects for Keplerian disks
around a rotating NS calculated assuming the same NS mass and spin frequency
but two different EoS. An emphasized view shows the spreading layer where
matter from the disks enters the rotating NS surface. Illustration based on
the work of Šprňa et al. (in preparation). Right: The LAD detector on board of
the eXTP satellite (isdc.unige.ch/extp) and examples of simulated time
evolution of the X-ray variability of NS accretion disk as predicted for the
LAD detector (Bakala et al., 2014; Zhang et al., 2016; De Rosa et al., 2019;
Feroci et al., 2022).

Here, we concentrate on predictions regarding suitable targets with respect to
the low-mass X-ray binaries (LMXBs; Török et al., 2016), and we extend the
range over the entire mass scale up to supermassive black holes. In the
stellar close-binary systems, the mass is transferred from the companion star
by overflowing the Roche lobe and forming an accretion disk or a torus that
surrounds the NS. The accretion flow forms the main component that contributes
to the high X-ray luminosity of these objects; most of the radiation arises
from its inner region and the boundary layer adjacent to the surface.
Oscillation properties of the flow should thus reflect the presence of the
central body and they could help us to constrain its internal EoS. Particular
attention has been attracted to the kilohertz QPOs. In the case of LMXBs,
these oscillations occur in the range of 100–1000 Hz; their intrinsic
frequencies are thus comparable to the orbital timescale near the surface of
the NS. This coincidence suggests that the emerging signal originates in the
innermost region of the accretion flow close to the NS surface. As their name
suggests, twin kHz QPOs are frequently observed in pairs; correlations between
the two peaks can be used to test the viability of different models.

##  3 Results

Figure 3: The technique of image mapping shows the Doppler shift effects, here
in the case of a Keplerian disk containing an orbiting hot spot (blue-green-
red color scale). Consecutive snapshots display the corresponding bolometric
intensity of the observed radiation in different parts of the orbital period
(red-to-yellow color scale).

We have developed a set of flexible simulation tools that are aimed at
exploring suitable observational strategies and identifying the
characteristics of promising targets for upcoming space programs. The focus
has been set on recurrent quasi-periodic events. These allow for an
expeditious application of various physical processes and searching for their
observable signatures using the LAD detector; see Figure 2 for an illustration
of various aspects of the adopted methodology. Efficient ray-tracing
computations with all General Relativity effects taken into account are
essential to account for the flux variations as well as spectral, timing, and
temporal characteristics (Karas et al., 1992; Dovčiak et al., 2004; Bakala et
al., 2005; Dovčiak et al., 2008; Bakala et al., 2014, 2015; Karas et al.,
2014). Hereafter, we show the setup and the main parameters that govern our
simulations.222Our simulation results are available together with a more
detailed description in an electronic form at astrocomp.physics.cz/simulator/.
Access to the data is open to all researchers; we ask for this article to be
acknowledged if the data are used in any follow-up publications.

Figure 4: In analogy with the preceding figure, we show snapshots that map the
Doppler energy shift effects for axisymmetric radial oscillations of an inner
accretion torus (blue-green-red color scale) and the corresponding snapshots
displaying the bolometric intensity of the observed radiation in different
parts of the disk oscillation period (red-to-yellow color scale).

Figure 5: A sequence of snapshots mapping Doppler shift effects in the case of
the radial precession (non-axisymmetric oscillations) of an inner accretion
torus (blue-green-red scale) and the corresponding snapshots showing the
bolometric intensity of the observed radiation in different parts of the disk
oscillation period (red-to-yellow scale).

Figure 6: The snapshots displaying the bolometric intensity of the observed
radiation in three different parts of the Keplerian period of a rotating
product of torus instability (red-to-yellow color scale) along with the
corresponding snapshots mapping the Doppler energy shift effects. The bottom
row contains three images calculated for a near-equatorial view and very
closely following parts of the Keplerian period, illustrating the strong
variability of such a configuration. General Relativity effects are all taken
into account in the ray-tracing computations.

###  3.1 Frequencies of QPOs: model predictions

Comparison between the observed and expected QPO frequencies can help reveal
the NS mass and angular momentum (Urbanec et al., 2010; Török et al., 2022).
To this end, sufficient sensitivity in the kiloelectronvolt band, as well as
fine temporal and spectral resolution, are required. In Török et al. (2012,
2016), we studied within the framework of general relativity the mass–angular-
momentum relations implied by a number of QPO models.

In the above-quoted papers, we showed that the degeneracy between the mass and
angular momentum constraints can be removed when the NS spin frequency is
determined in an independent way. Furthermore, in Török et al. (2016, 2022),
we extended our results to a large set of EoS and explored effects related to
the NS quadrupole moment and its rotationally induced oblateness. Remarkably,
we found that strong restrictions to the QPO model and the implied NS mass
could be obtained when the low-frequency QPOs or X-ray burst measurements were
taken into account.

###  3.2 Examining full synthetic data, and beyond

While calculations of the QPO frequencies enable comparisons between the
observed and synthetic data offering fruitful outputs, a complete comparison
of lightcurves that would include consideration of the QPO amplitudes,
coherence times, and spectral properties is even more promising.

In the present contribution, we reported on an extended set of model
simulations, where we take into account the expected specifications of eXTP
detectors, namely, their collecting area and energy and timing resolution.

The current work highly benefits from using our software package, which is
based on the consideration of NS models on the background of the Hartle-Thorne
geometry (HTstar, Urbanec et al., 2013; Urbancová et al., 2019) along with the
key outputs of the LSD code core (Lensing Simulation Device, Bakala et al.,
2007, 2014, 2015). Within the context of the QPO models, we assume various
configurations of oscillating radiating accreted fluid (disks, tori, spots,
spiral waves, etc.) along with a rotating NS that exhibits a hot spreading
layer of enhanced X-ray emission. Example images of such configurations are
given in Figures 3–6.

##  4 Conclusions

The enhanced X-ray Timing and Polarimetry (eXTP) mission has been developed by
a consortium led by the Institute of High-Energy Physics of the Chinese
Academy of Sciences and is envisaged to launch in the later-2020s. It is
currently considered to be a priority of the upcoming astrophysics program.
The Czech contribution is a part of the consortium of several European groups
led by the Italian INAF (Istituto Nazionale di Astrofisica). eXTP will carry
four instrument packages for the X-ray 0.5–50 keV bandpass, with the primary
purpose to explore matter under extreme density, strong-gravity effects on
spectra and polarization, and cosmic magnetism in and around compact objects.

The scientific part of our contribution consists mainly of the performance
analysis of the instrument to achieve the required scientific goals of the
eXTP mission concerning various hardware configurations and different targets.
In the present paper, we focused our attention on the dominant program of
X-ray timing of accreting NSs. So far, commonly to several promising QPO
models, even the QPO modulation mechanism remains unexplained. Using our
simulations we can show that a sufficiently strong modulation of the observed
radiation arises when we consider modulation of accretion rate, which provides
variable luminosity of the NS boundary layer and is combined with obscuration
of the radiation by structures present in the innermost accretion region (see
Figure 6 for an illustration).

QPOs offer an independent measurement of black hole mass and spin via modeling
the low and high (kilohertz) frequency QPOs observed in the intermediate
states of X-ray binaries. Low-frequency QPOs seen in the hard and intermediate
states are thought to be produced by the Lense-Thirring precession of the
inner hot flow. In this case, modeling the geometry of the precessing flow
using tomography and polarimetry will give a direct measure of the offset
between the black hole spin and disk angular momentum. This will allow us to
explore the accretion flows down to ISCO. An analogy will be explored in the
case of accreting supermassive black holes that exhibit the corresponding
quasi-periodicities.

Data availability. The synthetic data underlying this article will be shared
upon reasonable request. Simulation results and tools will be further added to
the above-cited repository (cf. footnote #2), and they will be updated once
new mission specifications become available.

###### Acknowledgements.

Our research has been carried out in the context of Czech participation to the
upcoming eXTP satellite mission. We acknowledge a continued support from
European Space Agency PRODEX program titled “Hardware contribution to the
Chinese X-ray mission eXTP” (ref. 4000132152), and from the Czech Science
Foundation EXPRO project on “Accreting black holes in the new era of X-ray
polarimetry missions” (ref. 21-06825X). We further acknowledge an internal
grant of the Silesian University, $\mathrm{SGS/31/2023}$, and the Astronomical
Institute’s institutional support, RVO 67985815.

## References

  * Abramowicz et al. (2003) Abramowicz, M. A., Karas, V., Kluzniak, W., Lee, W. H., & Rebusco, P., Non-Linear Resonance in Nearly Geodesic Motion in Low-Mass X-Ray Binaries. 2003, PASJ, 55, 467, DOI: 10.1093/pasj/55.2.467
  * Bakala et al. (2015) Bakala, P., Goluchová, K., Török, G., et al., Twin peak high-frequency quasi-periodic oscillations as a spectral imprint of dual oscillation modes of accretion tori. 2015, A&A, 581, A35, DOI: 10.1051/0004-6361/201525867
  * Bakala et al. (2014) Bakala, P., Török, G., Karas, V., et al., Power density spectra of modes of orbital motion in strongly curved space-time: obtaining the observable signal. 2014, MNRAS, 439, 1933, DOI: 10.1093/mnras/stu076
  * Bakala et al. (2007) Bakala, P., Čermák, P., Hledík, S., Stuchlík, Z., & Truparová, K., Extreme gravitational lensing in vicinity of Schwarzschild-de Sitter black holes. 2007, Central European Journal of Physics, 5, 599, DOI: 10.2478/s11534-007-0033-6
  * Bakala et al. (2005) Bakala, P., Čermák, P., Hledík, S., Stuchlík, Z., & Truparová Plšková, K., A virtual trip to the Schwarzschild-de Sitter black hole: Computer simulation of extreme gravitational lensing in Schwarzschild-de Sitter spacetimes. 2005, in RAGtime 6/7: Workshops on black holes and neutron stars, ed. S. Hledík & Z. Stuchlík, 11–28
  * Baym et al. (1971) Baym, G., Bethe, H. A., & Pethick, C. J., Neutron star matter. 1971, Nucl. Phys. A, 175, 225, DOI: 10.1016/0375-9474(71)90281-8
  * Bentz et al. (2016) Bentz, M. C., Cackett, E. M., Crenshaw, D. M., et al., A Reverberation-based Black Hole Mass for MCG-06-30-15. 2016, ApJ, 830, 136, DOI: 10.3847/0004-637X/830/2/136
  * Bian & Zhao (2003) Bian, W. & Zhao, Y., On X-ray variability in narrow-line and broad-line active galactic nuclei. 2003, MNRAS, 343, 164, DOI: 10.1046/j.1365-8711.2003.06650.x
  * Bursa et al. (2004) Bursa, M., Abramowicz, M. A., Karas, V., & Kluźniak, W., The Upper Kilohertz Quasi-periodic Oscillation: A Gravitationally Lensed Vertical Oscillation. 2004, ApJ, 617, L45, DOI: 10.1086/427167
  * Carpano & Jin (2018) Carpano, S. & Jin, C., Discovery of a 23.8 h QPO in the Swift light curve of XMMU J134736.6+173403. 2018, MNRAS, 477, 3178, DOI: 10.1093/mnras/sty841
  * Costa et al. (2001) Costa, E., Soffitta, P., Bellazzini, R., et al., An efficient photoelectric X-ray polarimeter for the study of black holes and neutron stars. 2001, Nature, 411, 662, DOI: 10.1038/35079508
  * Czerny et al. (2016) Czerny, B., You, B., Kurcz, A., et al., The mass of the black hole in RE J1034+396. 2016, A&A, 594, A102, DOI: 10.1051/0004-6361/201628103
  * De Rosa et al. (2019) De Rosa, A., Uttley, P., Gou, L., et al., Accretion in strong field gravity with eXTP. 2019, Science China Physics, Mechanics, and Astronomy, 62, 29504, DOI: 10.1007/s11433-018-9297-0
  * Dovčiak et al. (2008) Dovčiak, M., Karas, V., Matt, G., & Goosmann, R. W., Variation in the primary and reprocessed radiation from an orbiting spot around a black hole. 2008, MNRAS, 384, 361, DOI: 10.1111/j.1365-2966.2007.12713.x
  * Dovčiak et al. (2004) Dovčiak, M., Karas, V., & Yaqoob, T., An Extended Scheme for Fitting X-Ray Data with Accretion Disk Spectra in the Strong Gravity Regime. 2004, ApJS, 153, 205, DOI: 10.1086/421115
  * Feroci et al. (2022) Feroci, M., Ambrosi, G., Ambrosino, F., et al., The large area detector onboard the eXTP mission. 2022, in Society of Photo-Optical Instrumentation Engineers (SPIE) Conference Series, Vol. 12181, Space Telescopes and Instrumentation 2022: Ultraviolet to Gamma Ray, ed. J.-W. A. den Herder, S. Nikzad, & K. Nakazawa, 121811X
  * Feroci et al. (2016) Feroci, M., Bozzo, E., Brandt, S., et al., The LOFT mission concept: a status update. 2016, in Society of Photo-Optical Instrumentation Engineers (SPIE) Conference Series, Vol. 9905, Space Telescopes and Instrumentation 2016: Ultraviolet to Gamma Ray, ed. J.-W. A. den Herder, T. Takahashi, & M. Bautz, 99051R
  * Feroci et al. (2012) Feroci, M., Stella, L., van der Klis, M., et al., The Large Observatory for X-ray Timing (LOFT). 2012, Experimental Astronomy, 34, 415, DOI: 10.1007/s10686-011-9237-2
  * Gezari (2021) Gezari, S., Tidal Disruption Events. 2021, ARA&A, 59, 21, DOI: 10.1146/annurev-astro-111720-030029
  * Gierliński et al. (2008) Gierliński, M., Middleton, M., Ward, M., & Done, C., A periodicity of ~1hour in X-ray emission from the active galaxy RE J1034+396. 2008, Nature, 455, 369, DOI: 10.1038/nature07277
  * Goluchová et al. (2019) Goluchová, K., Török, G., Šrámková, E., et al., Mass of the active galactic nucleus black hole XMMUJ134736.6+173403. 2019, A&A, 622, L8, DOI: 10.1051/0004-6361/201834774
  * Greene et al. (2001) Greene, J., Bailyn, C. D., & Orosz, J. A., Optical and Infrared Photometry of the Microquasar GRO J1655-40 in Quiescence. 2001, ApJ, 554, 1290, DOI: 10.1086/321411
  * Greiner et al. (2001) Greiner, J., Cuby, J. G., & McCaughrean, M. J., An unusually massive stellar black hole in the Galaxy. 2001, Nature, 414, 522, DOI: 10.1038/35107019
  * Gupta et al. (2018) Gupta, A. C., Tripathi, A., Wiita, P. J., et al., Possible 1 hour quasi-periodic oscillation in narrow-line Seyfert 1 galaxy MCG-06-30-15. 2018, A&A, 616, L6, DOI: 10.1051/0004-6361/201833629
  * Hu et al. (2016) Hu, C., Wang, J.-M., Ho, L. C., et al., Improving the Flux Calibration in Reverberation Mapping by Spectral Fitting:Application to the Seyfert Galaxy MCG-6-30-15. 2016, ApJ, 832, 197, DOI: 10.3847/0004-637X/832/2/197
  * Ingram & Motta (2019) Ingram, A. R. & Motta, S. E., A review of quasi-periodic oscillations from black hole X-ray binaries: Observation and theory. 2019, New A Rev., 85, 101524, DOI: 10.1016/j.newar.2020.101524
  * in’t Zand et al. (2019) in’t Zand, J. J. M., Bozzo, E., Qu, J., et al., Observatory science with eXTP. 2019, Science China Physics, Mechanics, and Astronomy, 62, 29506, DOI: 10.1007/s11433-017-9186-1
  * Karas (1999) Karas, V., Twin Peak Separation in Sources with Kilohertz Quasi-periodic Oscillations Caused by Orbital Motion. 1999, ApJ, 526, 953, DOI: 10.1086/308015
  * Karas et al. (2014) Karas, V., Bakala, P., Torok, G., et al., Distinguishing between Spot and Torus Models of High-Frequency Quasiperiodic Oscillations. 2014, Acta Polytechnica, 54, 191, DOI: 10.14311/AP.2014.54.0191
  * Karas et al. (1992) Karas, V., Vokrouhlický, D., & Polnarev, A. G., In the vicinity of a rotating black hole: a fast numerical code for computing observational effects. 1992, MNRAS, 259, 569, DOI: 10.1093/mnras/259.3.569
  * Kotrlová et al. (2020) Kotrlová, A., Šrámková, E., Török, G., et al., Models of high-frequency quasi-periodic oscillations and black hole spin estimates in Galactic microquasars. 2020, A&A, 643, A31, DOI: 10.1051/0004-6361/201937097
  * Lančová (2023) Lančová, D., Computer modelling of accretion processes in binary systems with black holes and neutron stars. 2023, Ph.D. Thesis, Institute of Physics (Silesian University in Opava), viii+201 pp.
  * Lattimer & Prakash (2007) Lattimer, J. M. & Prakash, M., Neutron star observations: Prognosis for equation of state constraints. 2007, Phys. Rep., 442, 109, DOI: 10.1016/j.physrep.2007.02.003
  * McClintock & Remillard (2006) McClintock, J. E. & Remillard, R. A., Black hole binaries. 2006, in Compact Stellar X-ray Sources, 39, 157, DOI: 10.48550/arXiv.astro-ph/0306213
  * Mïller & Gültekin (2011) Mïller, J. M. & Gültekin, K., X-Ray and Radio Constraints on the Mass of the Black Hole in Swift J164449.3+573451. 2011, ApJ, 738, L13, DOI: 10.1088/2041-8205/738/1/L13
  * Molla et al. (2017) Molla, A. A., Chakrabarti, S. K., Debnath, D., & Mondal, S., Estimation of Mass of Compact Object in H 1743-322 from 2010 and 2011 Outbursts using TCAF Solution and Spectral Index-QPO Frequency Correlation. 2017, ApJ, 834, 88, DOI: 10.3847/1538-4357/834/1/88
  * Motta (2016) Motta, S. E., Quasi periodic oscillations in black hole binaries. 2016, Astronomische Nachrichten, 337, 398, DOI: 10.1002/asna.201612320
  * Motta et al. (2022) Motta, S. E., Belloni, T., Stella, L., et al., Black hole mass and spin measurements through the relativistic precession model: XTE J1859+226. 2022, MNRAS, 517, 1469, DOI: 10.1093/mnras/stac2142
  * Orosz et al. (2002) Orosz, J. A., Groot, P. J., van der Klis, M., et al., Dynamical Evidence for a Black Hole in the Microquasar XTE J1550-564. 2002, ApJ, 568, 845, DOI: 10.1086/338984
  * Pan et al. (2016) Pan, H.-W., Yuan, W., Yao, S., et al., Detection of a Possible X-Ray Quasi-periodic Oscillation in the Active Galactic Nucleus 1H 0707-495. 2016, ApJ, 819, L19, DOI: 10.3847/2041-8205/819/2/L19
  * Pasham et al. (2015) Pasham, D. R., Cenko, S. B., Zoghbi, A., et al., Evidence for High-frequency QPOs with a 3:2 Frequency Ratio from a 5000 Solar Mass Black Hole. 2015, ApJ, 811, L11, DOI: 10.1088/2041-8205/811/1/L11
  * Pasham et al. (2019) Pasham, D. R., Remillard, R. A., Fragile, P. C., et al., A loud quasi-periodic oscillation after a star is disrupted by a massive black hole. 2019, Science, 363, 531, DOI: 10.1126/science.aar7480
  * Pasham et al. (2014) Pasham, D. R., Strohmayer, T. E., & Mushotzky, R. F., A 400-solar-mass black hole in the galaxy M82. 2014, Nature, 513, 74, DOI: 10.1038/nature13710
  * Reis et al. (2012) Reis, R. C., Miller, J. M., Reynolds, M. T., et al., A 200-Second Quasi-Periodicity After the Tidal Disruption of a Star by a Dormant Black Hole. 2012, Science, 337, 949, DOI: 10.1126/science.1223940
  * Remillard et al. (2004) Remillard, R. A., Gazak, J. Z., Lin, D., Morgan, E. H., & Pooley, G. G., The 67 Hz QPO and Other High-Frequenecy Oscillations from the Black Hole Binary GRS1915+105. 2004, in American Astronomical Society Meeting Abstracts, Vol. 205, American Astronomical Society Meeting Abstracts, 104.05
  * Remillard et al. (2002) Remillard, R. A., Muno, M. P., McClintock, J. E., & Orosz, J. A., Evidence for Harmonic Relationships in the High-Frequency Quasi-periodic Oscillations of XTE J1550-564 and GRO J1655-40. 2002, ApJ, 580, 1030, DOI: 10.1086/343791
  * Santangelo et al. (2019) Santangelo, A., Zane, S., Feng, H., et al., Physics and astrophysics of strong magnetic field systems with eXTP. 2019, Science China Physics, Mechanics, and Astronomy, 62, 29505, DOI: 10.1007/s11433-018-9234-3
  * Soffitta et al. (2021) Soffitta, P., Baldini, L., Bellazzini, R., et al., The Instrument of the Imaging X-Ray Polarimetry Explorer. 2021, AJ, 162, 208, DOI: 10.3847/1538-3881/ac19b0
  * Stella & Vietri (1999) Stella, L. & Vietri, M., kHz Quasiperiodic Oscillations in Low-Mass X-Ray Binaries as Probes of General Relativity in the Strong-Field Regime. 1999, Phys. Rev. Lett., 82, 17, DOI: 10.1103/PhysRevLett.82.17
  * Stella et al. (1999) Stella, L., Vietri, M., & Morsink, S. M., Correlations in the Quasi-periodic Oscillation Frequencies of Low-Mass X-Ray Binaries and the Relativistic Precession Model. 1999, ApJ, 524, L63, DOI: 10.1086/312291
  * Strohmayer (2001) Strohmayer, T. E., Discovery of a 450 HZ Quasi-periodic Oscillation from the Microquasar GRO J1655-40 with the Rossi X-Ray Timing Explorer. 2001, ApJ, 552, L49, DOI: 10.1086/320258
  * Török (2005) Török, G., QPOs in microquasars and Sgr A* measuring the black hole spin. 2005, Astronomische Nachrichten, 326, 856, DOI: 10.1002/asna.200510427
  * Török et al. (2012) Török, G., Bakala, P., Šrámková, E., et al., Mass-Angular-momentum Relations Implied by Models of Twin Peak Quasi-periodic Oscillations. 2012, ApJ, 760, 138, DOI: 10.1088/0004-637X/760/2/138
  * Török et al. (2016) Török, G., Goluchová, K., Urbanec, M., et al., Constraining Models of Twin-Peak Quasi-periodic Oscillations with Realistic Neutron Star Equations of State. 2016, ApJ, 833, 273, DOI: 10.3847/1538-4357/833/2/273
  * Török et al. (2019) Török, G., Goluchová, K., Šrámková, E., Urbanec, M., & Straub, O., Time-scale of twin-peak quasi-periodic oscillations and mass of accreting neutron stars. 2019, MNRAS, 488, 3896, DOI: 10.1093/mnras/stz1929
  * Török et al. (2022) Török, G., Kotrlová, A., Matuszková, M., et al., Simple Analytic Formula Relating the Mass and Spin of Accreting Compact Objects to Their Rapid X-Ray Variability. 2022, ApJ, 929, 28, DOI: 10.3847/1538-4357/ac5ab6
  * Turner et al. (2006) Turner, T. J., Miller, L., George, I. M., & Reeves, J. N., Evidence for orbital motion of material close to the central black hole of Mrk 766. 2006, A&A, 445, 59, DOI: 10.1051/0004-6361:20053042
  * Urbancová et al. (2019) Urbancová, G., Urbanec, M., Török, G., et al., Epicyclic Oscillations in the Hartle-Thorne External Geometry. 2019, ApJ, 877, 66, DOI: 10.3847/1538-4357/ab1b4c
  * Urbanec et al. (2010) Urbanec, M., Beták, E., & Stuchlík, Z., Observational Tests of Neutron Star Relativistic Mean Field Equations of State. 2010, Acta Astron., 60, 149, DOI: 10.48550/arXiv.1007.3446
  * Urbanec et al. (2013) Urbanec, M., Miller, J. C., & Stuchlík, Z., Quadrupole moments of rotating neutron stars and strange stars. 2013, MNRAS, 433, 1903, DOI: 10.1093/mnras/stt858
  * Uzdensky et al. (2019) Uzdensky, D., Begelman, M., Beloborodov, A., et al., Extreme Plasma Astrophysics. 2019, BAAS, 51, 362, DOI: 10.48550/arXiv.1903.05328
  * van der Klis (1998) van der Klis, M., Kilohertz quasi-periodic oscillations in low-mass x-ray binaries. 1998, Advances in Space Research, 22, 925, DOI: 10.1016/S0273-1177(98)00125-2
  * Šrámková et al. (2021) Šrámková, E., Goluchová, K., Török, G., et al., Exploring the X-ray universe via timing: mass of the active galactic nucleus black hole XMMUJ134736.6+173403. 2021, in Nuclear Activity in Galaxies Across Cosmic Time, 356, 348, DOI: 10.1017/S1743921320003312
  * Šrámková et al. (2023) Šrámková, E., Matuszková, M., Klimovičová, K., et al., Oscillations of fluid tori around neutron stars. 2023, Astronomische Nachrichten, 344, easna.20220114, DOI: 10.1002/asna.20220114
  * Šrámková et al. (2015) Šrámková, E., Török, G., Kotrlová, A., et al., Black hole spin inferred from 3:2 epicyclic resonance model of high-frequency quasi-periodic oscillations. 2015, A&A, 578, A90, DOI: 10.1051/0004-6361/201425241
  * Watts et al. (2019) Watts, A. L., Yu, W., Poutanen, J., et al., Dense matter with eXTP. 2019, Science China Physics, Mechanics, and Astronomy, 62, 29503, DOI: 10.1007/s11433-017-9188-4
  * Weisskopf et al. (2023) Weisskopf, M. C., Soffitta, P., Ramsey, B. D., et al., A space-borne X-ray imaging polarimeter. 2023, Nature Astronomy, 7, 635, DOI: 10.1038/s41550-023-01950-w
  * Wevers et al. (2017) Wevers, T., van Velzen, S., Jonker, P. G., et al., Black hole masses of tidal disruption event host galaxies. 2017, MNRAS, 471, 1694, DOI: 10.1093/mnras/stx1703
  * Yanes-Rizo et al. (2022) Yanes-Rizo, I. V., Torres, M. A. P., Casares, J., et al., A refined dynamical mass for the black hole in the X-ray transient XTE J1859+226. 2022, MNRAS, 517, 1476, DOI: 10.1093/mnras/stac2719
  * Zhang et al. (2017) Zhang, P., Zhang, P.-f., Yan, J.-z., Fan, Y.-z., & Liu, Q.-z., An X-Ray Periodicity of $\sim$1.8 hr in Narrow-line Seyfert 1 Galaxy Mrk 766. 2017, ApJ, 849, 9, DOI: 10.3847/1538-4357/aa8d6e
  * Zhang et al. (2019) Zhang, S., Santangelo, A., Feroci, M., et al., The enhanced X-ray Timing and Polarimetry mission—eXTP. 2019, Science China Physics, Mechanics, and Astronomy, 62, 29502, DOI: 10.1007/s11433-018-9309-2
  * Zhang et al. (2016) Zhang, S. N., Feroci, M., Santangelo, A., et al., eXTP: Enhanced X-ray Timing and Polarization mission. 2016, in Society of Photo-Optical Instrumentation Engineers (SPIE) Conference Series, Vol. 9905, Space Telescopes and Instrumentation 2016: Ultraviolet to Gamma Ray, ed. J.-W. A. den Herder, T. Takahashi, & M. Bautz, 99051Q
  * Zhou et al. (2015) Zhou, X.-L., Yuan, W., Pan, H.-W., & Liu, Z., Universal Scaling of the 3:2 Twin-peak Quasi-periodic Oscillation Frequencies With Black Hole Mass and Spin Revisited. 2015, ApJ, 798, L5, DOI: 10.1088/2041-8205/798/1/L5