# Proposal for THz lasing from a topological quantum dot

Marie Rider<EMAIL_ADDRESS>The Blackett Laboratory, Imperial College
London, SW7 2AZ  Vincenzo Giannini www.GianniniLab.com Instituto de Estructura
de la Materia (IEM-CSIC), Consejo Superior de Investigaciones Científicas,
Serrano 121, 28006 Madrid, Spain  Technology Innovation Institute, Building
B04C, Abu Dhabi P.O. Box 9639, United Arab Emirates

###### Abstract

Topological quantum dots (TQDs) are 3D topological insulator nanoparticles
with radius below 100 nm, which display symmetry-protected surface states with
discretized energies. We propose a scheme which harnesses these energy levels
in a closed lasing scheme, in which a single TQD, when pumped with incoherent
THz light, lases from its surface states in the THz regime. The time scales
associated with the system are unusually slow, and lasing occurs with a very
low threshold. Due to the low threshold, we predict that blackbody radiation
at room-temperature provides enough photons to pump the system, providing a
route to room-temperature THz lasing with blackbody radiation as the pump.

##  I Introduction

The creation of robust, low threshold sources in the terahertz (THz) gap
($\sim$ 0.1-10 THz) is an important frontier in modern applied physics and
this rapidly expanding field has recently received much attention. With much
needed applications in bio-medicine yang2016biomedical , wireless
communications kleine2011review  and security technologies federici2005thz ,
THz waves penetrate materials opaque to other wavelengths, while posing only
minimal risks due to their non-ionizing behaviour (unlike for example,
x-rays). Academic applications range from molecular spectroscopy
baxter2011terahertz  to sub-millimetre astronomy pilbratt2010herschel ,
influencing physics on vast length scales.

Topological quantum dots (TQDs) are 3D topological insulator nanoparticles
with radius $\leq 100$ nm, whose topological surface states undergo quantum
confinement resulting in a discretised Dirac cone, with energy levels which
increase in degeneracy away from the Dirac point. We avoid the acronym TIQD
which is generally used for non-equiaxial TI quantum dots cho2012topological ;
huang2019thz ; wu2017spin ; zhang2021interference ; PhysRevLett.121.256804 .
This work focuses on equiaxial 3D TI nanoparticles, which is a small but
steadily expanding field rider2019perspective ; rider2020experimental ;
siroki2016single ; gioia2019spherical ; imura2012spherical ; paudel2013three ;
castro2020optical ; PhysRevB.101.165410 . Much like other types of quantum
dots and atomic systems, the discrete energy levels of the TQD make it a
natural system for controlled interactions with light. TQDs have energy levels
separated by THz frequencies, making them a potential route to THz lasing.

Success has been found in other THz systems, such as solid-state and molecular
systems gousev1999widely ; del2011terahertz ; kumar20111 ; pagies2016low ;
chestnov2017terahertz ; zeng2020photonic ; chevalier2019widely , metasurfaces
keren2019generation , quantum gases chevalier2019widely  and more recently air
plasma koulouklidis2020observation . The use of topological systems as a
robust platform for lasing is also developing as an exciting field, most
notably in the mid-infrared st2017lasing ; bahari2017nonreciprocal ;
klembt2018exciton ; malzard2018nonlinear ; harari2018topological ;
bandres2018topological ; parto2018edge ; zhao2018topological ;
ota2018topological ; kartashov2019two ; ozawa2019topological , although work
has been done on THz lasers using 2D topological insulator quantum dots
(TIQDs), requiring electron injection and an IR pump huang2019thz .

In this work we use Monte Carlo (MC) simulations to demonstrate that for a
model system of a single TQD in an open cavity at zero temperature, the TQD
states can be pumped and act as an active gain medium, emitting coherent light
in the THz. We show that lasing from a single TQD is possible with very low
threshold. One of the major technological distinctions between the TQD laser
and other THz lasers is that we do not pump between bulk bands (as done in
molecular THz lasers and TIQD lasers), but instead we employ transitions
within the Dirac cone to both pump and lase. This is possible due to the
energy level configuration and selection rules of the TQD paudel2013three ;
gioia2019spherical . An important consequence of THz pumping is that the
density of thermal, room temperature photons at this frequency (as opposed to
those present at optical and IR frequencies) would be high enough that, in
principle, an external pumping source beyond blackbody radiation may not be
needed. This feature, alongside the unusual time scales in the system and the
robustness of the TQD states make for a novel implementation. Experimental
progress in producing TI nanostructures such as nanowires peng2010aharonov ;
kong2010topological ; tian2013dual ; hong2014one ; liu2020development  and
finite thickness nanodisks and nanoplates min2012quick ; li2012controlled ;
veldhorst2012experimental ; vargas2014changing ; liu2015one ;
dubrovkin2017visible  has been very successful, and there has been recent
progress with equiaxial 3D TI nanoparticles rider2020experimental . As well as
adding another tool to the tool-box of THz lasing, TQDs could also find use in
other technological applications, such as quantum memory and quantum computing
paudel2013three , and as components of hybrid systems, such as coupled to
semiconductor quantum dots castro2020optical  and quantum emitters
PhysRevB.101.165410 .

This paper is structured as follows: In Section II we will briefly review the
theory of spherical topological insulator nanoparticles and in Section III
discuss their optical properties. In Section IV we will describe how higher
order corrections to the Dirac cone become important when a TI nanoparticle is
placed in a high quality cavity, and how this can be utilised to create a
closed scheme of energy levels. We will then describe in Section V how Monte
Carlo simulations are used to capture the dynamics of the system when pumped
and in Section VI give results demonstrating that a single TI nanoparticle can
be used as a THz laser at zero temperature. We discuss how the low threshold
of this system could allow for the utilisation of room temperature thermal
photons as the pumping source, and conclude in Section VII with an outlook.

##  II 3D topological insulator quantum dots (TQDs)

Figure 1: Lasing topological quantum dots: (a) Schematic of topological
quantum dot, showing bulk and surface states. (b) Discretization of Dirac cone
for small nanoparticles, with energy level separation near the Dirac point
inversely proportional to particle radius, $R$. Transitions between energy
levels are facilitated by the absorption or emission of THz light. (c) The
discrete energy levels are labelled by three quantum numbers
$|\mathrm{s,n,m}\rangle$. We present the labels for the four energy levels
closest to the Dirac point. (d) Example lasing scheme with interband pumping
and bottom-most transition as the lasing transition. Fermi level
$E_{\mathrm{F}}=0$. (e) Schematic of TQD in cavity of length
$a\lambda_{\mathrm{las}}/2$ with $a$ an integer, lasing frequency
$\nu_{\mathrm{las}}$, and the $c$-axis of the material aligned with the cavity
axis. Spatial dependence of cavity electric field gives spatial dependence of
DOS and consequently transition rates. TQD placed at centre of cavity for
maximal interaction with the cavity field, meaning that only modes with $a$
odd will have non-zero transition rates in the cavity axis.

Topological insulator (TI) nanoparticles of radius $5\leq R/\mathrm{nm}\leq
100$ support symmetry-protected surface states with quantised energy levels.
For spherical nanoparticles imura2012spherical ; gioia2019spherical ;
paudel2013three ; siroki2016single  (presented schematically in FIG. 1a),
close to the $\Gamma$-point the wavefunctions for these surface states are
given by

$\displaystyle\begin{split}\Psi_{s,n,m}(\xi,\varphi)&=\langle\xi,\varphi|\Psi_{s,n,m}\rangle\\\
&=\frac{e^{im\varphi}}{2\sqrt{\pi}R}N_{n,m}\chi_{s,n,m}(\xi),\end{split}$ (1)

where

$\displaystyle\chi_{s,n,m}(\xi)$
$\displaystyle=\begin{pmatrix}(1-\xi)^{\frac{1}{2}\sigma^{-}}(1+\xi)^{\frac{1}{2}\sigma^{+}}J_{n}^{\sigma^{-}\sigma^{+}}(\xi)\\\
-\frac{sm}{|m|}(1-\xi)^{\frac{1}{2}\sigma^{+}}(1+\xi)^{\frac{1}{2}\sigma^{-}}J_{n}^{\sigma^{+}\sigma^{-}}(\xi)\end{pmatrix},$
(2)

and $\sigma^{\pm}=|m\pm\frac{1}{2}|$, $\xi=\mathrm{cos}\vartheta$, $s=\pm$,
$n=0,1,2,...$, $m=\pm 1/2,3/2,5/2,...$ and $J_{n}^{\sigma^{\pm}\sigma^{\mp}}$
are Jacobi polynomials imura2012spherical . $N_{n,m}$ is a normalisation
factor (given in Supplementary Material A.1). The corresponding discretized
energy levels of these states are given by

$\displaystyle E_{s,n,m}$
$\displaystyle=\frac{sA}{R}\left(n+|m|+\frac{1}{2}\right),$ (3)

where $A$ is a material-dependent constant found from ab initio calculations
liu2010model . $A$ relates to the strength of spin-orbit coupling (SOC) in the
material, averaged over the three Cartesian axes. This approximation of
isotropic SOC allows for the analytical description of the topological surface
states and their energy levels. Close to the $\Gamma$-point the energy levels
are linearly spaced, and increase in degeneracy away from the Dirac point
(i.e. $2,4,6,8,...$) as illustrated in FIG. 1b. The energy values are
inversely proportional to $R$, and for large $R$ we recover the expected
continuum Dirac cone. Examples of the energy levels associated with quantum
numbers $(s,n,m)$ are given in FIG. 1c. The system of discrete energy levels
can be tuned with particle size (much like the energy levels of a
semiconductor quantum dot or topological insulator quantum dot), encouraging
us to refer to this system as a topological quantum dot (TQD). The key
differences between TQDs and semiconductor quantum dots are (i) the
delocalization of states for TQDs vs the relatively localized states of the
semiconductor counterpart, (ii) the quantisation of surface states rather than
bulk states, which in turn affects (iii) the frequency-range of operation,
which for semiconductor quantum dots is usually in the visible range and near
infrared, but for TQDs is in the THz, e.g. for a Bi2Se3 TQD of
$5<R/\mathrm{nm}<100$, $A=3.0$ eVÅ liu2010model  and the spacing between two
energy levels is $0.72\mbox{-}14.4$ THz, contrasting with a band gap of $220$
meV $\sim 53.2$ THz.

The high tunability of this system, combined with the unusual degeneracy and
spacing of the energy levels suggests an interesting nanophotonic system
siroki2016single ; rider2019perspective ; rider2020experimental . The goal of
this paper will be to demonstrate that by pumping the electrons of the surface
states between discrete energy levels while placed in a cavity (described
schematically in Figures 1d and e), we can use a TQD as a THz laser. With this
in mind, we will now discuss the TQD optical properties.

##  III Optical properties of TQDs

For a TQD with material $c$-axis aligned along the $z$-axis, the electric
dipole (E1) selection rules for allowed optical transitions between TQD energy
levels such that
$|\Psi_{\mathrm{i}}\rangle\rightarrow|\Psi_{\mathrm{f}}\rangle$, where
$\mathrm{i}=(s,n,m)$ and $\mathrm{f}=(s^{\prime},n^{\prime},m^{\prime})$ can
be found by examining the E1 matrix element (with some explicit examples given
in Supplementary Material A.2),

$\displaystyle
V_{\mathrm{i,f}}(\omega_{\mathrm{i,f}})=\langle\Psi_{\mathrm{f}}|\mathbf{r}\cdot\bm{\epsilon}|\Psi_{\mathrm{i}}\rangle,$
(4)

where $\bm{\epsilon}$ is the polarisation vector of the incoming light. For
stimulated processes, the selection rules for incoming right-hand (RH)
polarised light along the $z$-axis are given by

$\displaystyle\Delta s=0,\quad\Delta(n+|m|)=\pm 1,\quad\Delta m=1,$ (5)
$\displaystyle\Delta s\neq 0,\quad\Delta(n+|m|)=0,\quad\Delta m=1.$ (6)

For incoming left-hand (LH) polarised light along the $z$-axis, the selection
rules are

$\displaystyle\Delta s=0,\quad\Delta(n+|m|)=\pm 1,\quad\Delta m=-1,$ (7)
$\displaystyle\Delta s\neq 0,\quad\Delta(n+|m|)=0,\quad\Delta m=-1.$ (8)

FIG. 2 illustrates the allowed stimulated transitions for a surface state with
energy $E_{s,n,m}=-2A/R$ when excited with either LH or RH polarized light.
Note that there are two distinct types of transitions: (i) interband
transitions which couple the upper and lower halves of the Dirac cone
requiring energy $\Delta E=2E_{s,n,m}$ (green arrows), and (ii) intraband
transitions which couple nearest energy levels, requiring $\Delta E=A/R$
(purple arrows). The transition rates of allowed stimulated E1 transitions are
given by

$\displaystyle\Gamma_{\mathrm{i\rightarrow
f}}^{\mathrm{stim}}=2\pi^{2}\alpha\frac{c}{\hbar}\bar{u}(\omega_{\mathrm{i,f}})|V_{\mathrm{i,f}}|^{2},$
(9)

where
$\bar{u}(\omega_{\mathrm{i,f}})=\hbar\omega_{\mathrm{i,f}}\bar{n}(\omega_{\mathrm{i,f}})\rho(\omega_{\mathrm{i,f}})$,
is the energy density at frequency
$\omega_{\mathrm{i,f}}=2\pi\nu_{\mathrm{i,f}}$ and
$\bar{n}(\omega_{\mathrm{i,f}})$ is the average number of photons in mode
$\omega_{\mathrm{i,f}}$. We have assumed symmetry in photon polarisation such
that
$n_{\mathrm{LH}}(\omega_{\mathrm{i,f}})=n_{\mathrm{RH}}(\omega_{\mathrm{i,f}})=\bar{n}(\omega_{\mathrm{i,f}})/2$.
$V_{\mathrm{i,f}}$ is the matrix element given in Equation 4. The density of
states in free space is
$\rho_{\mathrm{free}}(\omega_{\mathrm{i,f}})=\omega_{\mathrm{i,f}}^{2}/\pi^{2}c^{3}$,
and in the cavity-axis of an open cavity of quality factor $Q$, formed of two
parallel mirrors separated by a distance $L$,

$\displaystyle\rho_{\mathrm{cav}}(\omega_{\mathrm{i,f}})=\frac{2}{\pi
L}\frac{Q\omega_{\mathrm{cav}}}{\omega_{\mathrm{cav}}^{2}+4Q^{2}(\omega_{\mathrm{i,f}}-\omega_{\mathrm{cav}})^{2}}.$
(10)

The rate of spontaneous emission is given in free space by

$\displaystyle\Gamma^{\mathrm{spon}}_{\mathrm{i}\rightarrow\mathrm{f}}=\frac{4\alpha\omega_{\mathrm{f,i}}^{3}}{3c^{2}}|\langle\Psi_{\mathrm{f}}|\mathbf{r}|\Psi_{\mathrm{i}}\rangle|^{2},$
(11)

and in the open cavity by

$\displaystyle\Gamma^{\mathrm{spon}}_{\mathrm{i}\rightarrow\mathrm{f}}$
$\displaystyle=\frac{8\pi\alpha
c}{L}\frac{Q\omega_{\mathrm{i,f}}\omega_{\mathrm{cav}}}{\omega_{\mathrm{cav}}^{2}+4Q^{2}(\omega_{\mathrm{i,f}}-\omega_{\mathrm{cav}})^{2}}|\langle\Psi_{\mathrm{f}}|\mathbf{r}|\Psi_{\mathrm{i}}\rangle|^{2}.$
(12)

Equations 11 and 12 are polarisation independent. For a Bi2Se3 nanoparticle of
radius $R=50$ nm in the linear approximation, the smallest frequency coupling
states within the quantised Dirac cone is $\nu=1.44$ THz and the spontaneous
emission rate in free space for the intraband transition between levels
$|+,1,-1/2\rangle$ and $|+,0,1/2\rangle$ is $7.0\cdot 10^{3}$ s-1. Interband
transitions are typically much faster, with the spontaneous transition in free
space from $|+,1,-1/2\rangle$ to $|-,1,1/2\rangle$ given by $1.4\cdot 10^{5}$
s-1, with transition frequency $5.76$ THz. These rates are much slower than
comparable processes in semiconductor dots, whose spontaneous emission rates
are typically in the range $10^{6}$–$10^{9}$ s-1 depending on their structure
bera2010quantum ; jacak2013quantum . This is due to the frequency dependence
of the transition rates, with typical energy level separation in semiconductor
dots much greater than in TQDs.

Figure 2: TQD selection rules: E1 selection rules for TQD state
$|-,1,1/2\rangle$. Interband (green) transitions couple energy levels above
and below the Dirac point. Intraband (purple) transitions couple levels within
the same section of the Dirac cone.

##  IV Higher order corrections

Close to the $\Gamma$-point the surface state dispersion relation is described
well by linear $\mathbf{k}\cdot\mathbf{p}$ theory and taken to be linear, and
so the energy levels of the TQD surface states can be considered equally
spaced. When higher order terms are to be taken into account, we return to the
continuum model and use the dispersion relation

$\displaystyle E_{\mathrm{c},\mathrm{v}}=\pm
A|\mathbf{k}|+A_{1}|\mathbf{k}|^{2},$ (13)

where $E_{\mathrm{c,v}}$ give the energies of the conduction and valence bands
respectively. For Bi2Se3, $A=3.0$ eVÅ, $A_{1}=22.2$ eVÅ2, and for Bi2Te3,
$A=2.0$ eVÅ, $A_{1}=35.3$ eVÅ2 liu2010model . More details on these values are
given in Supplementary Material A.3. On confinement of the surface states,
$|\mathbf{k}|\sim 1/R$ and so the correction is proportional to $1/R^{2}$,
demonstrated in FIG. 3a. For a Bi2Se3 TQD of $R=50$ nm, without the correction
all nearest-level transitions occur with frequency $\nu^{(0)}=1.44$ THz
(asides from the transition coupling levels directly above and below the
$\Gamma$-point, which couples at frequency $2\nu^{(0)}$), as illustrated in
FIG. 3b. When taking the correction into account, transition frequencies in
both the valence and conduction bands rapidly become off-resonant with the
first transition in each band. The first and second transition frequencies in
the upper Dirac cone show a disparity of 3$\%$. The first and third transition
frequencies differ by 6$\%$, as shown in FIG. 3b. The first transition
frequencies in the valence and conduction bands differ by $\sim 9\%$.
Variation in frequency is more rapid in smaller particles, and in materials
for which $A_{1}$ is large. This disparity can thus be increased by
considering a TQD of smaller radius, or by using a different material such as
Bi2Te3. It should be noted that interband transitions are unaffected due to
the cancellation of the second-order correction.

When placed in a cavity, higher-order corrections to the TQD Hamiltonian must
clearly be considered as transitions between energy levels will rapidly become
off-resonant with the cavity frequency if tuned to a single transition
frequency. For a cavity with lifetime greater than the timescale of free space
spontaneous emission due to intraband transitions,
$Q=\omega_{\mathrm{las}}>\tau_{\mathrm{spon}}\omega_{\mathrm{las}}$,
$\tau_{\mathrm{spon}}\approx 10^{-4}$ s for a $R=50$ nm particle, so
$Q>10^{8}$. This exceedingly high $Q$ factor is due to the unusual combination
of a high transition frequency and long timescale. It is clear that for a
cavity of such high $Q$ factor, the line-width is much smaller than the energy
level separation, and the only mode coupled to the cavity will be the single
resonant transition, such that
$\rho_{\mathrm{cav}}(\omega)=2Q/\pi\omega_{\mathrm{i,f}}L$. All other
transitions within the Dirac cone and in the direction of the cavity axis will
be drastically suppressed and considered negligible. However, for an open
cavity these transitions may still occur in all directions not directly
parallel to the cavity axis.

##  V Surface state dynamics using Monte Carlo (MC)

We now explain how a Monte Carlo method is used to study the time-evolving
surface state dynamics of a TQD interacting with the electromagnetic field in
a cavity.

We move to a Fock basis, in which the quantum state of the TQD can be
described by

$\displaystyle|\Psi\rangle=\prod_{\alpha=1}^{2M}\otimes|N_{\alpha}\rangle,$
(14)

where we take a product state of the $M$ states above and below the Dirac
point, with $2M$ states in total forming a closed system of energy levels.
Each state $\alpha=(s,n,m)$ obeys fermionic occupation rules such that
$N_{\alpha}$ = 0 or 1. The photon density for the pump
$\bar{n}_{\mathrm{pump}}$ is kept constant, and the photon density for modes
not resonant with the cavity are zero. Stimulated emission will only be
triggered by photons in the cavity axis and thus coherent with the lasing
mode, $\nu_{\mathrm{las}}$, which is defined by the first spontaneous emission
of frequency $\nu_{\mathrm{las}}$. The cavity (with quality factor $Q$)
enforces feedback of coherent $\nu_{\mathrm{las}}$ photons.

For a given time step $dt$, the transition rates given in Equations 9, 11 and
12 are converted to probabilities
$p_{\mathrm{i},\mathrm{f}}=\Gamma_{\mathrm{i\rightarrow f}}dt\ll 1$, where for
stimulated processes $\Gamma_{\mathrm{i\rightarrow f}}$ will dynamically
change as $\bar{n}_{\mathrm{i,f}}$ evolves via the dynamics. The TQD couples
to the cavity mode with a rate proportional to the spatially-dependent
probability density of the standing wave cavity mode shown in FIG. 1e. For
simplicity we consider a TQD at the centre of the cavity.

The initial conditions are set by occupying states up to the desired Fermi
level $E_{\mathrm{F}}$. For a given time step, all electrons may transition
between states with the probabilities calculated from the relations given. At
the end of the time step, it is checked that the transitions have obeyed
fermionic occupation rules (such that there is maximum one electron in any
given state). If the transitions have resulted in multiple occupancy of any
state, the time step is reset and the system required to undertake the step
again. When a physically allowed time step has been undertaken, the entire
system updates and progresses to the next time step. In this way, the system
evolves whilst observing fermionic occupation rules. A single evolution of the
system gives a single quantum trajectory, while averaging the simulation over
many iterations gives the average expected results of a single TQD, or if
multiplied by $N$, gives the result of $N$ uncorrelated TQDs kalos2009monte .

Figure 3: k.p breakdown: (a) Continuum band structure for Bi2Se3 with Dirac
cone seen in the band gap (=220 meV martinez2017determination ). Band
structure up to and including $k^{2}$ terms (sold black line) deviates from
the linear $k\cdot p$ approximation (dotted black line) away from the Gamma
point. (b) For a $R=50$ nm nanoparticle, discretised energy levels are
expected. In the linear approximation, transition frequency $\nu^{(0)}=1.44$
THz, whereas when taking into account the $k^{2}$ term, sequential transitions
away from the $\Gamma$-point deviate increasingly.

##  VI THz Lasing from a single TQD

Figure 4: TQD lasing: (a) Schematic of all lasing scheme transitions. Solid
lines denote stimulated processes (and downwards spontaneous processes) and
dashed lines denote spontaneous processes only. (b) Evolution of normalised
state occupation for $E_{\mathrm{F}}=0$, $\bar{n}_{\mathrm{pump}}=1$.
Population inversion between energy levels $E_{-}^{1}$ and $E_{-}^{2}$ is
demonstrated and (c) gain above threshold for this transition is demonstrated.
(d) Steady-state lasing rate (coherent photons emitted from cavity per second)
for varying $\bar{n}_{\mathrm{pump}}$ with inset showing low pumping regime
$0\leq\bar{n}_{\mathrm{pump}}\leq 0.6$, with a lasing threshold of $\sim
0.35$. (e) shows number of coherent photons inside the cavity and emitted from
the cavity as a function of $t$ for $\bar{n}_{\mathrm{pump}}=0.1$, which is
below the lasing threshold and (f) $\bar{n}_{\mathrm{pump}}=1$ which is above
the lasing threshold.

We now describe a specific closed lasing scheme using discrete surface states
of the TQD at T=0. We start with a single Bi2Te3 TQD in a Fabry-Perot cavity
with the material $c$-axis aligned with the cavity axis and Fermi level at
$E_{\mathrm{F}}=0$. The TQD is pumped using an interband transition, and the
cavity is tuned to the lowest intraband transition in the scheme, as
illustrated in FIG. 1d. The arguments in section IV show that all other
transitions will be suppressed in the cavity axis.

We pump the system with photons of energy $E_{+}^{2}-E_{-}^{2}$, away from the
cavity axis as shown in FIG. 1d and tune the cavity to the transition
$\nu_{\mathrm{las}}=(E_{-}^{1}-E_{-}^{2})/h$ by using an open Fabry-Perot
cavity of length $L=a\lambda_{\mathrm{las}}/2$. For a $R=50$ nm particle, this
requires pumping with photons of frequency 5.76 THz and the lasing frequency
will be 1.38 THz. We choose a cavity length $L=100.5\lambda_{las}\approx 1.1$
cm. All processes not directly in the cavity axis will occur with the rate
given in Equation 11, while in the cavity the stimulated rates will be given
by Equation 9 with density of states

$\displaystyle\rho(\omega_{\mathrm{i,j}})=\frac{Q}{2\pi
L\omega_{\mathrm{i,f}}}\delta(\omega_{\mathrm{i,j}}-2\pi\nu_{\mathrm{las}}),$
(15)

and the spontaneous rates in the cavity by Equation 12. We place the TQD in
the centre of the cavity at the peak of electric field density as displayed in
FIG. 1e. All transitions in frequencies other than $\nu_{\mathrm{las}}$ are
suppressed in the cavity axis. Only four energy levels are considered in the
simulation as all other levels are decoupled, and all processes involved are
depicted in FIG. 4a, with bold arrows indicating stimulated processes and
dotted arrows indications spontaneous processes. For fixed $Q\sim 10^{9}$, the
dynamics of the system are tuned only with the pumping rate, which in turn is
controlled by
$\bar{n}_{\mathrm{pump}}=\bar{n}\left(\omega_{\mathrm{pump}}\right)$ of the
pumping light. For $\bar{n}_{\mathrm{pump}}$ = 1, the evolution of the
normalised occupation of energy levels, $\bar{N}/N_{\max}$, is given in FIG.
4b. Steady state is quickly achieved, with clear population inversion between
levels $E_{-}^{2}$ and $E_{-}^{1}$. Gain for the lasing transition is given by

$\displaystyle\bar{G}=\sum_{\mathrm{i<j}}\sigma_{\mathrm{j}\rightarrow\mathrm{i}}\left(\bar{N}_{\mathrm{j}}-\bar{N}_{\mathrm{i}}\right)\delta(\omega_{\mathrm{i,j}}-2\pi\nu_{\mathrm{las}}),$
(16)

where
$\sigma_{\mathrm{j}\rightarrow\mathrm{i}}=\Gamma_{\mathrm{j}\rightarrow\mathrm{i}}/c\bar{n}_{\mathrm{i,j}}$
is the transition cross-section and $\bar{N}_{\mathrm{i}}$ is the average
occupation of surface state $\mathrm{i}$. $\bar{G}$ for
$\bar{n}_{\mathrm{pump}}=1$ is plotted in FIG. 4c. A maximum is achieved
nearly instantaneously as electrons are excited from states with energy
$E_{-}^{2}$ to $E_{+}^{2}$, creating population inversion in the lasing
transition. Steady state is quickly achieved, with gain above the threshold
value. Threshold gain is given by $G_{\mathrm{th}}=1/\tau_{\mathrm{las}}c$, as
internal losses are taken to be negligible in this simulation.

Displayed in FIG. 4d is the dependence of the lasing rate with varying
$\bar{n}_{\mathrm{pump}}$. Lasing is found to occur for
$\bar{n}_{\mathrm{pump}}\geq 0.35$ (see inset of FIG. 4d). Below threshold,
such as for $\bar{n}_{\mathrm{pump}}=0.1$ as demonstrated in FIG. 4e, coherent
photons in the cavity (teal line) do not build up rapidly enough to compensate
for photons being absorbed by the TQD or emitted from the cavity and so the
number of cavity photons decays to 0. Lasing does not occur. Above threshold,
such as for $\bar{n}_{\mathrm{pump}}=1$ displayed in FIG. 4f, a critical
number of coherent photons build up in the cavity such that lasing can occur.
The number of coherent photons in the cavity (teal line) slowly increases from
0 until a steady state is achieved. Coherent photons are emitted from the
cavity (purple line), at a constant rate. The slope of this line gives the
photon emission rate, $\Gamma\sim 6.6\cdot 10^{2}~{}\mathrm{s}^{-1}$. The
power of this lasing can be calculated by assuming photons are emitted over an
area commensurate with the cross-section of the nanoparticle, such that
$P=\Gamma h\nu_{\mathrm{las}}/\pi R^{2}\sim 7.7\cdot
10^{-5}~{}\mathrm{W}/\mathrm{m}^{2}$. The incoming power is approximately
$1.0~{}$W$/$m2. The power conversion (power in vs power out) is roughly
0.0075% efficiency. This is very low, but it should be remembered that we are
considering a single TQD. The power output and thus efficiency should increase
dramatically with increased number of TQDs.

Above the threshold value of $\bar{n}_{\mathrm{pump}}$ there is a small range
in which the lasing rate exponentially increases, and then the lasing rate
increases approximately linearly with increased $\bar{n}_{\mathrm{pump}}$.
Competition between processes of different time-scales in the system (cavity
emission rate, spontaneous emission rate and stimulated emission rate at the
cavity frequency) eventually results in a slowing of the increase in lasing
rate, and a maximum lasing rate of $\sim 10^{3.5}$ s-1. The lasing rates of
this system have a very low threshold, but also occur at very slow times
scales. This is due to the interesting interplay of length and energy scales
in this system. While the lasing rates can be increased by the addition of
more TQDs in the system, the system of a single TQD could offer interesting
technological applications where the slow production of coherent photons is
coveted.

The simulations at $T=0$ described in this section were conducted for a $R=50$
nm Bi2Se3 TQD requiring a pump with frequency 5.76 THz. At room temperature,
the number of thermal photons in the pumping mode is
$\bar{n}_{\mathrm{pump}}=0.66$, which is above the lasing threshold found for
the proof-of-principle case. For $35\leq R/\mathrm{nm}\leq 100$, lasing
frequency for the described setup is 0.70-1.93 THz, with a required pumping
frequency of 2.88-8.23 THz. At room temperature, the number of photons in the
pumping mode is $0.37\leq n_{\mathrm{pump}}\leq 1.72$, which is above
threshold for all cases. For the same lasing scheme but using Bi2Te3, with
$35\leq R/\mathrm{nm}\leq 100$, the lasing frequencies achieved are $0.46-1.2$
THz, the pumping frequencies required are $1.94-5.54$ THz, and the number of
photons per mode at room temperature at the pumping frequency is in the range
$0.70-2.76$, which again is well above lasing threshold.

All results presented so far have been for a single TQD. For multiple TQDs
interacting via a single cavity mode (i.e. multiple TQDs aligned along the
cavity axis), coherent photons emitted from one TQD will be available to
trigger stimulated emission events in other TQDs. It is expected that the
lasing rate will be amplified exponentially with increasing number of TQDs.

##  VII Outlook

By considering higher-order corrections to the surface state Hamiltonian of a
TQD, we have shown that a closed lasing scheme can be created such that a
single TQD will produce coherent THz frequency light. Lasing occurs at a very
low threshold, but also with an unusually slow time scale. We have
demonstrated that population inversion can be achieved and that lasing can
occur with a very low threshold - so low in fact, that the number of photons
present in blackbody radiation at room-temperature is in theory enough to
provide the pumping mechanism with no additional, external pumping source
needed. This is only possible due to employing a THz pump. This concept
deserves future investigation due to the important technological
repercussions. To realistically demonstrate that lasing will occur at room
temperature, we expect a 3D, closed cavity with a frequency-modulated Q factor
will be required to control photon density and avoid thermal equilibrium.
There is much work yet to be done to explore this system, but this scheme
paves the way towards a novel room-temperature THz lasing source, with no
external pump additional to blackbody radiation.

## References

  * [1] Xiang Yang, Xiang Zhao, Ke Yang, Yueping Liu, Yu Liu, Weiling Fu, and Yang Luo.  Biomedical applications of terahertz spectroscopy and imaging.  Trends in biotechnology, 34(10):810–824, 2016.
  * [2] Thomas Kleine-Ostmann and Tadao Nagatsuma.  A review on terahertz communications research.  Journal of Infrared, Millimeter, and Terahertz Waves, 32(2):143–171, 2011.
  * [3] John F Federici, Brian Schulkin, Feng Huang, Dale Gary, Robert Barat, Filipe Oliveira, and David Zimdars.  THz imaging and sensing for security applications - explosives, weapons and drugs.  Semiconductor Science and Technology, 20(7):S266, 2005.
  * [4] Jason B Baxter and Glenn W Guglietta.  Terahertz spectroscopy.  Analytical chemistry, 83(12):4342–4368, 2011.
  * [5] GL Pilbratt, JR Riedinger, T Passvogel, G Crone, D Doyle, U Gageur, AM Heras, C Jewell, L Metcalfe, S Ott, et al.  Herschel Space Observatory - An ESA facility for far-infrared and submillimetre astronomy.  Astronomy & Astrophysics, 518:L1, 2010.
  * [6] Sungjae Cho, Dohun Kim, Paul Syers, Nicholas P Butch, Johnpierre Paglione, and Michael S Fuhrer.  Topological insulator quantum dot with tunable barriers.  Nano letters, 12(1):469–472, 2012.
  * [7] Yongwei Huang, Wenkai Lou, Fang Cheng, Wen Yang, and Kai Chang.  THz emission by frequency down-conversion in topological insulator quantum dots.  Physical Review Applied, 12(3):034003, 2019.
  * [8] Zhenhua Wu, Liangzhong Lin, Wen Yang, D Zhang, C Shen, W Lou, H Yin, and Kai Chang.  Spin-polarized charge trapping cell based on a topological insulator quantum dot.  RSC advances, 7(49):30963–30969, 2017.
  * [9] Shu-feng Zhang and Wei-jiang Gong.  Interference effect in the electronic transport of a topological insulator quantum dot.  Journal of Physics: Condensed Matter, 33(13):135301, 2021.
  * [10] Denis R. Candido, Michael E. Flatté, and J. Carlos Egues.  Blurring the boundaries between topological and nontopological phenomena in dots.  Phys. Rev. Lett., 121:256804, Dec 2018.
  * [11] Marie S Rider, Samuel J Palmer, Simon R Pocock, Xiaofei Xiao, Paloma Arroyo Huidobro, and Vincenzo Giannini.  A perspective on topological nanophotonics: Current status and future challenges.  Journal of Applied Physics, 125(12):120901, 2019.
  * [12] Marie S Rider, Maria Sokolikova, Stephen M Hanham, Miguel Navarro-Cía, Peter D Haynes, Derek KK Lee, Maddalena Daniele, Mariangela Cestelli Guidi, Cecilia Mattevi, Stefano Lupi, et al.  Experimental signature of a topological quantum dot.  Nanoscale, 12(44):22817–22825, 2020.
  * [13] G Siroki, DKK Lee, PD Haynes, and V Giannini.  Single-electron induced surface plasmons on a topological nanoparticle.  Nature communications, 7(1):1–6, 2016.
  * [14] L Gioia, MG Christie, U Zülicke, M Governale, and AJ Sneyd.  Spherical topological insulator nanoparticles: Quantum size effects and optical transitions.  Physical Review B, 100(20):205417, 2019.
  * [15] Ken-Ichiro Imura, Yukinori Yoshimura, Yositake Takane, and Takahiro Fukui.  Spherical topological insulator.  Physical Review B, 86(23):235119, 2012.
  * [16] Hari P Paudel and Michael N Leuenberger.  Three-dimensional topological insulator quantum dot for optically controlled quantum memory and quantum computing.  Physical Review B, 88(8):085316, 2013.
  * [17] LA Castro-Enriquez, LF Quezada, and A Martín-Ruiz.  Optical response of a topological-insulator–quantum-dot hybrid interacting with a probe electric field.  Physical Review A, 102(1):013720, 2020.
  * [18] G. D. Chatzidakis and V. Yannopapas.  Strong electromagnetic coupling in dimers of topological-insulator nanoparticles and quantum emitters.  Phys. Rev. B, 101:165410, Apr 2020.
  * [19] Yu P Gousev, IV Altukhov, KA Korolev, VP Sinis, MS Kagan, EE Haller, MA Odnoblyudov, IN Yassievich, and K-A Chao.  Widely tunable continuous-wave THz laser.  Applied physics letters, 75(6):757–759, 1999.
  * [20] Elena Del Valle and Alexey Kavokin.  Terahertz lasing in a polariton system: Quantum theory.  Physical Review B, 83(19):193303, 2011.
  * [21] Sushil Kumar, Chun Wang I Chan, Qing Hu, and John L Reno.  A 1.8-THz quantum cascade laser operating significantly above the temperature of $\hbar\omega k_{b}$.  Nature Physics, 7(2):166–171, 2011.
  * [22] Antoine Pagies, Guillaume Ducournau, and J-F Lampin.  Low-threshold terahertz molecular laser optically pumped by a quantum cascade laser.  Apl Photonics, 1(3):031302, 2016.
  * [23] Igor Yu Chestnov, Vanik A Shahnazaryan, Alexander P Alodjants, and Ivan A Shelykh.  Terahertz lasing in ensemble of asymmetric quantum dots.  Acs Photonics, 4(11):2726–2737, 2017.
  * [24] Yongquan Zeng, Bo Qiang, and Qi Jie Wang.  Photonic engineering technology for the development of terahertz quantum cascade lasers.  Advanced Optical Materials, 8(3):1900573, 2020.
  * [25] Paul Chevalier, Arman Amirzhan, Fan Wang, Marco Piccardo, Steven G Johnson, Federico Capasso, and Henry O Everitt.  Widely tunable compact terahertz gas lasers.  Science, 366(6467):856–860, 2019.
  * [26] Shay Keren-Zur, Mai Tal, Sharly Fleischer, Daniel M Mittleman, and Tal Ellenbogen.  Generation of spatiotemporally tailored terahertz wavepackets by nonlinear metasurfaces.  Nature communications, 10(1):1–6, 2019.
  * [27] Anastasios D Koulouklidis, Claudia Gollner, Valentina Shumakova, Vladimir Yu Fedorov, Audrius Pugžlys, Andrius Baltuška, and Stelios Tzortzakis.  Observation of extremely efficient terahertz generation from mid-infrared two-color laser filaments.  Nature communications, 11(1):1–8, 2020.
  * [28] P St-Jean, V Goblot, E Galopin, A Lemaître, T Ozawa, L Le Gratiet, I Sagnes, J Bloch, and A Amo.  Lasing in topological edge states of a one-dimensional lattice.  Nature Photonics, 11(10):651–656, 2017.
  * [29] Babak Bahari, Abdoulaye Ndao, Felipe Vallini, Abdelkrim El Amili, Yeshaiahu Fainman, and Boubacar Kanté.  Nonreciprocal lasing in topological cavities of arbitrary geometries.  Science, 358(6363):636–640, 2017.
  * [30] S Klembt, TH Harder, OA Egorov, K Winkler, R Ge, MA Bandres, M Emmerling, L Worschech, TCH Liew, M Segev, et al.  Exciton-polariton topological insulator.  Nature, 562(7728):552–556, 2018.
  * [31] Simon Malzard and Henning Schomerus.  Nonlinear mode competition and symmetry-protected power oscillations in topological lasers.  New Journal of Physics, 20(6):063044, 2018.
  * [32] Gal Harari, Miguel A Bandres, Yaakov Lumer, Mikael C Rechtsman, Yi Dong Chong, Mercedeh Khajavikhan, Demetrios N Christodoulides, and Mordechai Segev.  Topological insulator laser: Theory.  Science, 359(6381), 2018.
  * [33] Miguel A Bandres, Steffen Wittek, Gal Harari, Midya Parto, Jinhan Ren, Mordechai Segev, Demetrios N Christodoulides, and Mercedeh Khajavikhan.  Topological insulator laser: Experiments.  Science, 359(6381), 2018.
  * [34] Midya Parto, Steffen Wittek, Hossein Hodaei, Gal Harari, Miguel A Bandres, Jinhan Ren, Mikael C Rechtsman, Mordechai Segev, Demetrios N Christodoulides, and Mercedeh Khajavikhan.  Edge-mode lasing in 1D topological active arrays.  Physical review letters, 120(11):113901, 2018.
  * [35] Han Zhao, Pei Miao, Mohammad H Teimourpour, Simon Malzard, Ramy El-Ganainy, Henning Schomerus, and Liang Feng.  Topological hybrid silicon microlasers.  Nature communications, 9(1):1–6, 2018.
  * [36] Yasutomo Ota, Ryota Katsumi, Katsuyuki Watanabe, Satoshi Iwamoto, and Yasuhiko Arakawa.  Topological photonic crystal nanocavity laser.  Communications Physics, 1(1):1–8, 2018.
  * [37] Yaroslav V Kartashov and Dmitry V Skryabin.  Two-dimensional topological polariton laser.  Physical review letters, 122(8):083902, 2019.
  * [38] Tomoki Ozawa, Hannah M Price, Alberto Amo, Nathan Goldman, Mohammad Hafezi, Ling Lu, Mikael C Rechtsman, David Schuster, Jonathan Simon, Oded Zilberberg, et al.  Topological photonics.  Reviews of Modern Physics, 91(1):015006, 2019.
  * [39] Hailin Peng, Keji Lai, Desheng Kong, Stefan Meister, Yulin Chen, Xiao-Liang Qi, Shou-Cheng Zhang, Zhi-Xun Shen, and Yi Cui.  Aharonov–bohm interference in topological insulator nanoribbons.  Nature materials, 9(3):225–229, 2010.
  * [40] Desheng Kong, Jason C Randel, Hailin Peng, Judy J Cha, Stefan Meister, Keji Lai, Yulin Chen, Zhi-Xun Shen, Hari C Manoharan, and Yi Cui.  Topological insulator nanowires and nanoribbons.  Nano letters, 10(1):329–333, 2010.
  * [41] Mingliang Tian, Wei Ning, Zhe Qu, Haifeng Du, Jian Wang, and Yuheng Zhang.  Dual evidence of surface Dirac states in thin cylindrical topological insulator Bi2Te3 nanowires.  Scientific reports, 3(1):1–7, 2013.
  * [42] Seung Sae Hong, Yi Zhang, Judy J Cha, Xiao-Liang Qi, and Yi Cui.  One-dimensional helical transport in topological insulator nanowire interferometers.  Nano letters, 14(5):2815–2821, 2014.
  * [43] Chieh-Wen Liu, Zhenhua Wang, Richard LJ Qiu, and Xuan PA Gao.  Development of topological insulator and topological crystalline insulator nanostructures.  Nanotechnology, 31(19):192001, 2020.
  * [44] Yuho Min, Geon Dae Moon, Bong Soo Kim, Byungkwon Lim, Jin-Sang Kim, Chong Yun Kang, and Unyong Jeong.  Quick, controlled synthesis of ultrathin bi2se3 nanodiscs and nanosheets.  Journal of the American Chemical Society, 134(6):2872–2875, 2012\.
  * [45] Hui Li, Jie Cao, Wenshan Zheng, Yulin Chen, Di Wu, Wenhui Dang, Kai Wang, Hailin Peng, and Zhongfan Liu.  Controlled synthesis of topological insulator nanoplate arrays on mica.  Journal of the American Chemical Society, 134(14):6132–6135, 2012\.
  * [46] M Veldhorst, CG Molenaar, XL Wang, H Hilgenkamp, and Alexander Brinkman.  Experimental realization of superconducting quantum interference devices with topological insulator junctions.  Applied physics letters, 100(7):072602, 2012.
  * [47] Anthony Vargas, Susmita Basak, Fangze Liu, Baokai Wang, Eugen Panaitescu, Hsin Lin, Robert Markiewicz, Arun Bansil, and Swastik Kar.  The changing colors of a quantum-confined topological insulator.  Acs Nano, 8(2):1222–1230, 2014.
  * [48] Xianli Liu, Jinwei Xu, Zhicheng Fang, Lin Lin, Yu Qian, Youcheng Wang, Chunmiao Ye, Chao Ma, and Jie Zeng.  One-pot synthesis of Bi2Se3 nanostructures with rationally tunable morphologies.  Nano Research, 8(11):3612–3620, 2015.
  * [49] Alexander M Dubrovkin, Giorgio Adamo, Jun Yin, Lan Wang, Cesare Soci, Qi Jie Wang, and Nikolay I Zheludev.  Visible range plasmonic modes on topological insulator nanostructures.  Advanced Optical Materials, 5(3), 2017.
  * [50] Chao-Xing Liu, Xiao-Liang Qi, HaiJun Zhang, Xi Dai, Zhong Fang, and Shou-Cheng Zhang.  Model hamiltonian for topological insulators.  Physical Review B, 82(4):045122, 2010.
  * [51] Debasis Bera, Lei Qian, Teng-Kuan Tseng, and Paul H Holloway.  Quantum dots and their multimodal applications: A review.  Materials, 3(4):2260–2345, 2010.
  * [52] Lucjan Jacak, Pawel Hawrylak, and Arkadiusz Wojs.  Quantum dots.  Springer Science & Business Media, 2013.
  * [53] Malvin H Kalos and Paula A Whitlock.  Monte Carlo methods.  John Wiley & Sons, 2009.
  * [54] G Martinez, BA Piot, M Hakl, M Potemski, YS Hor, A Materna, SG Strzelecka, A Hruban, Ondřej Caha, Jiří Novák, et al.  Determination of the energy band gap of Bi2Se3.  Scientific reports, 7(1):1–5, 2017.

##  Appendix A Supplementary material

###  A.1 Jacobi polynomials

Class of orthogonal polynomials $J_{n}^{\alpha,\beta}(x)$, orthogonal w.r.t
the weight $\left(1-x\right)^{\alpha}\left(1+x\right)^{\beta}$ on the interval
$x\in[-1,1]$, where $\alpha,\beta>-1$, such that

$\displaystyle\int_{-1}^{1}\left(1-x\right)^{\alpha}\left(1+x\right)^{\beta}J_{n}^{\alpha\beta}(x)J_{n^{\prime}}^{\alpha\beta}(x)dx=\frac{\delta_{nn^{\prime}}}{N_{n\alpha\beta}^{2}}$
(17)

where

$\displaystyle
N_{n\alpha\beta}^{2}=\frac{(2n+\alpha+\beta+1)!(n+\alpha+\beta)!n!}{2^{\alpha+\beta+1}\Gamma(n+\alpha)!(n+\beta)!}.$
(18)

###  A.2 Matrix element

Some explicit values of the E1 matrix element $V_{\mathrm{i,f}}/R^{2}$ for LH
polarized light (such that $\epsilon=(1,-i,0)/\sqrt{2}$) are given below.
$|\mathrm{i}\rangle\rightarrow|\mathrm{f}\rangle$ $V_{\mathrm{i,f}}/R^{2}$
$|+,0,-1/2\rangle\rightarrow|+,1,1/2\rangle$ 1/9
$|+,0,-1/2\rangle\rightarrow|-,0,1/2\rangle$ 2/9
$|+,0,-3/2\rangle\rightarrow|+,0,-1/2\rangle$ 1/3
$|+,0,-3/2\rangle\rightarrow|-,1,-1/2\rangle$ 2/75

###  A.3 Surface state dispersion relation including higher order correction

The four-band bulk Hamiltonian for a topological insulator, given in Reference
[50] is given by

$\displaystyle\begin{split}\mathbf{H}(\mathbf{k})=&~{}\epsilon_{0}(\mathbf{k})\mathbbm{1}_{2}\otimes\mathbbm{1}_{2}+M(\mathbf{k})\mathbbm{1}_{2}\otimes\bm{\sigma}_{\bm{3}}\\\
&+A_{0}k_{x}\bm{\sigma}_{\bm{1}}\otimes\bm{\sigma}_{\bm{1}}+A_{0}k_{y}\bm{\sigma}_{\bm{2}}\otimes\bm{\sigma}_{\bm{1}}\\\
&+B_{0}k_{z}\bm{\sigma}_{\bm{3}}\otimes\bm{\sigma}_{\bm{1}},\end{split}$ (19)

where $M(\mathbf{k})=M_{0}+M_{1}k_{z}^{2}+M_{2}(k_{x}^{2}+k_{y}^{2})$ and
$\epsilon_{0}(\mathbf{k})=C_{0}+C_{1}k_{z}^{2}+C_{2}(k_{x}^{2}+k_{y}^{2})$.
For Bi2Se3, $A_{0}=3.33$ eVÅ, $B_{0}=2.26$ eVÅ, $C_{0}=-0.0083$ eV,
$C_{1}=5.74$ eVÅ2, $C_{2}=30.4$ eVÅ2, $M_{0}=-0.28$ eVÅ2, $M_{1}=6.86$ eVÅ2
and $M_{2}=44.5$ eVÅ2. The linear terms may be simplified by approximating
spin-orbit coupling to be isotropic, such that $A=(A_{0}+2B_{0})/3$ as used in
the main text. The term $\epsilon_{0}(\mathbf{k})$ is often neglected to make
the solution for the surface more tractable, however if this term is
reintroduced then the leading $k^{2}$ terms in the surface state energies are
given by $C_{1}k_{z}^{2}+C_{2}(k_{x}^{2}+k_{y}^{2})$. Averaging over the three
Cartesian coordinates, for Bi2Se3 we arrive at the value
$A_{1}=(C_{1}+2C_{2})/3=22.18$ eVÅ2 used in this work.


# Semantic Image Attack for Visual Model Diagnosis

Jinqi Luo Zhaoning Wang Chen Henry Wu Dong Huang Fernando De la Torre
Robotics Institute, Carnegie Mellon University, Pittsburgh, PA, USA
{jinqil, zhaoning, chenwu2, dghuang<EMAIL_ADDRESS>
###### Abstract

In practice, metric analysis on a specific train and test dataset does not
guarantee reliable or fair ML models. This is partially due to the fact that
obtaining a balanced, diverse, and perfectly labeled dataset is typically
expensive, time-consuming, and error-prone. Rather than relying on a carefully
designed test set to assess ML models’ failures, fairness, or robustness, this
paper proposes Semantic Image Attack (SIA), a method based on the adversarial
attack that provides semantic adversarial images to allow model diagnosis,
interpretability, and robustness. Traditional adversarial training is a
popular methodology for robustifying ML models against attacks. However,
existing adversarial methods do not combine the two aspects that enable the
interpretation and analysis of the model’s flaws: semantic traceability and
perceptual quality. SIA combines the two features via iterative gradient
ascent on a predefined semantic attribute space and the image space. We
illustrate the validity of our approach in three scenarios for keypoint
detection and classification. (1) Model diagnosis: SIA generates a histogram
of attributes that highlights the semantic vulnerability of the ML model
(i.e., attributes that make the model fail). (2) Stronger attacks: SIA
generates adversarial examples with visually interpretable attributes that
lead to higher attack success rates than baseline methods. The adversarial
training on SIA improves the transferable robustness across different
gradient-based attacks. (3) Robustness to imbalanced datasets: we use SIA to
augment the underrepresented classes, which outperforms strong augmentation
and re-balancing baselines. 111This paper was first submitted to NeurIPS on
May 9, 2022.

Figure 1: Model diagnosis by SIA. The models to be diagnosed are an eyeglasses
classifier (top two rows) and a keypoint detector (bottom two rows). SIA
reveals that the eyeglasses classifier is more sensitive to lipstick and age,
whereas the keypoint detection tends to fail on people with moustache and pale
skin. See text for an explanation of the figure.

##  1 Introduction

In Machine Learning (ML), error analysis of train and test data is a critical
stage in model assessment and debugging. However, the conclusions extracted
from the metric analysis on the train or test data do not guarantee
reliability nor fairness, partially due to the fact that datasets are
imperfect [20, 18]. Even with careful collection and filtering, data naturally
contain biases. Furthermore, in the case of computer vision learning systems,
having a uniform distribution over all conceivable variability of an object in
an image (e.g., position, lighting, background) is typically impractical
(i.e., exponential) and labels are prone to errors. The issue only grows more
severe with large-scale datasets. ML models trained on these datasets
inevitably inherit these imbalances and biases. These limitations also apply
to test sets that are typically used for model evaluation. Such a
vulnerability is a landmine that must be recognized and processed in order for
ML applications to succeed. The question we strive to address in this study is
whether there are alternative/better methods for discovering biases and
performing model diagnostics in computer vision models instead of only relying
on a test set.

Fig. 1 illustrates the problems that this paper tries to address. Given an
eyeglasses classifier (top two rows) or a keypoint detector (bottom two rows),
which kind of face images will lead to misclassification or misdetection? How
can we automatically discover these failure cases and robustify the model? How
can we perform visual model diagnosis in a semantic attribute space? To
accomplish these, we propose Semantic Image Attack (SIA), a new adversarial
attack in a generative model of faces parameterized by attributes. In top left
in Fig. 1, we see two images of faces without eyeglasses, and the model
classifies them correctly. After several iterations of SIA (right column), our
model is able to modify facial attributes (e.g., smile, eye color, facial
hair) to mislead the eyeglass classifier. Also, our model builds a histogram
of the sensitivity across attributes (i.e., visual model diagnosis). While
evaluating the model resilience on a single attribute can be relatively
straightforward, evaluating the model robustness for combinations of
attributes can be quite challenging (due to the exponential nature of
attribute combinations). SIA is able to jointly search over the space of
attributes, and hence performs a multi-attribute attack for model diagnosis.
Similarly, in Fig. 1, the bottom two rows illustrate the model diagnosis
results for keypoint detection.

Figure 2: The SIA framework uses an encoder-decoder GAN
$\mathcal{G}_{\phi}=\\{E_{\phi_{1}}$, $D_{\phi_{2}}\\}$ to attack a target
model $f_{\theta}$. In each iteration $i$, we update the image
$\mathbf{x}_{i}$ and the attribute vector $\mathbf{a}_{i}$ using the gradients
from the loss $\mathcal{L}$ (see Eq. (1)). Finally, the encoder-decoder GAN
projects the attacked image $\mathbf{x}_{T}$ and attributes $\mathbf{a}_{T}$
in the last iteration back to the image manifold to produce adversary
$\mathbf{\hat{x}}=\mathcal{G}_{\phi}(\mathbf{x}_{T},\mathbf{a}_{T})$. Solid
lines stand for forward passes, and dashed lines stand for backpropagation.

In addition to model diagnosis, SIA is able to robustify the target model by
re-training the model on adversarial examples (see Fig. 1 middle columns). In
our experiments, we also show the robustness from SIA is more transferable to
other types of attacks than other competing attack methods. Finally, we show
that SIA outperforms popular image augmentation techniques [4, 27] and re-
balancing baselines when learning from imbalanced datasets.

##  2 Related Work

###  2.1 Adversarial Attacks

Gradient-guided image space perturbation attacks have been popular in
robustifying ML models [8, 16]. The image perturbations generated by such
attacks are small image changes typically imperceptible to humans. [29, 26]
adopted such attacks on keypoint detectors to robustify detectors against
adversarial perturbations. [25] was pioneering in using Generative Adversarial
Networks (GANs) [7] to generate adversarial attacks. However, [25] only
allowed a limited perturbation bound and required individually trained GANs
for every target ML model. A major issue of previous methods is the lack of
interpretability of the attack. To address this issue, [17] used the
interpolation of semantic feature maps to generate attacks, and showed the
effectiveness in terms of the attack’s success rate in classification and
detection problems. [6] also modeled the perturbations in the attribute space,
and showed that the attribute space can improve model robustness. However,
this work aims to find perturbations in samples that do not change labels, and
their model is not robust to small perturbation attacks in the image space.
Moreover, [6] did not provide interpretability into the failures of the
computer vision model. Similarly, [14] sampled images in the latent space of a
GAN to generate strong attacks, but their attacks are not interpretable in the
attribute space. [11] conducted model attacks only in the attribute space
using the attribute-assisted GAN (AttGAN) [10]. This approach does not attack
the image space and does not constrain the scale of parametric gradients,
which leads to generating unrealistic images.

Unlike previous work in the adversarial attack literature, SIA performs
gradient-guided attack simultaneously in the image and a pre-defined attribute
space. As we will show in the experimental section, performing gradient ascent
only in the attribute space leads to unstable results. In addition, our
approach only uses one GAN backbone [10] to attack all target models (i.e.,
AttGAN can be used to evaluate any computer vision model). Finally, our method
provides a histogram of the sensitivity of the target models across attributes
of interest. This information can be critical to gather insights into the
fairness and robustness of the model.

###  2.2 Bias and Fairness Analysis

[2, 5] showed that by traversing images in the GAN latent space, one can
visualize the attribute-wise sensitivity of a target classifier. But such a
process requires manual annotation of the generated images, which is expensive
and infeasible for large attribute spaces. Recently, [13] used StyleGAN [12]
to learn a target-model-dependent style/attribute space, which allows a human
to interpret the target models’ behavior in terms of attributes. Furthermore,
several previous works proposed fairness metrics to evaluate a model without a
fair test set [9, 18, 28]. While previous fairness metrics focus on a model’s
statistical behavior across attributes, SIA focuses on the model’s decision
for each instance (though individual sensitivities can be further aggregated
to get sub-population sensitivity, see Fig. 1). Moreover, SIA is able to
search over attribute combinations.

##  3 Semantic Image Attack (SIA)

This section describes our SIA algorithm starting with the notation.

Target model ($f_{\theta}$): Let $f_{\theta}$, parameterized by $\theta$, be
the target model that we want to improve or perform model diagnosis on. In
this paper, we cover two types of neural network models $f_{\theta}$: an
attribute classifier and a keypoint detector.

An attribute classifier takes an image $\mathbf{x}$ as input and outputs
$f_{\theta}(\mathbf{a}|\mathbf{x})$, the conditional probability of attribute
$\mathbf{a}\in\mathcal{A}$ given $\mathbf{x}$, where $\mathcal{A}$ is the
attribute space. Without loss of generality, we consider binary classifiers.
Given the ground truth class label $c$ of the image $\mathbf{x}$, the
classification loss is defined as the binary cross-entropy
$\mathcal{L_{\theta}}=-(c\log{f_{\theta}(c|\mathbf{x})}+(1-c)(\log{(1-f_{\theta}(c|\mathbf{x}))}))$.

The keypoint detector takes an image $\mathbf{x}$ as input and outputs
$f_{\theta}(\mathbf{p}|\mathbf{x})$, the probability heatmap of the keypoints
$\mathbf{p}\in\mathcal{P}$, where $\mathcal{P}$ is the 2D pixel coordinate
space. Given a training image $\mathbf{x}$ with ground truth facial keypoints
$\mathbf{c}$, the loss $\mathcal{L_{\theta}}$ is defined as the mean squared
error between the predicted heatmap and the ground-truth heatmap corresponding
to $\mathbf{c}$, see [21] for details.

Adversary ($\mathbf{\hat{x}}$): For each input image $\mathbf{x}$, an
adversarial example $\mathbf{\hat{x}}$ is a synthesized image that misleads
the target model $f_{\theta}$ to produce outputs that are far away from the
ground truth $\mathbf{c}$ or changes the label of the classifier. Different
from traditional adversarial attack methods, SIA generates adversarial
examples under a combination of perturbations in the attribute and image
spaces.

SIA consists of two main components: (1) an AttGAN
$\mathcal{G}_{\phi}=\\{E_{\phi_{1}}$, $D_{\phi_{2}}\\}$,
$\mathcal{G}_{\phi}(\mathbf{x},\mathbf{a})=D_{\phi_{2}}([E_{\phi_{1}}(\mathbf{x});\mathbf{a}])$,
where the encoder $E_{\phi_{1}}$ maps an input image $\mathbf{x}$ to a latent
vector, the decoder $D_{\phi_{2}}$ takes as an input the concatenation of
$E_{\phi_{1}}(\mathbf{x})$ and the attribute vector $\mathbf{a}$ to generate
an image; (2) a pretrained target model $f_{\theta}$ to be diagnosed.

###  3.1 Generating Iterative Adversaries

Our framework uses both the attribute space and the image space to iteratively
generate adversarial images $\mathbf{\hat{x}}$. We iteratively compute
gradient ascent in the attribute space and the image space. An advantage of
optimizing over the attribute and image space is an improved adversarial
space, that leads to a better generation of adversarial examples (see
experiment section).

The procedure to jointly update the attribute vectors and images is as
follows:

$\displaystyle\mathbf{a}_{i}$
$\displaystyle=\Pi_{\mathcal{B}(\epsilon_{\mathbf{a}})}(\mathbf{a}_{i-1}+\eta\operatorname{sign}[\nabla_{\mathbf{a}}(\mathcal{L_{\theta}}(f_{\theta}(\mathcal{G}_{\phi}(\mathbf{x}_{i-1},\mathbf{a}_{i-1}))))]),$
(1) $\displaystyle\mathbf{x}_{i}$
$\displaystyle=\Pi_{\mathcal{B}(\epsilon_{\mathbf{x}})}(\mathbf{x}_{i-1}+\eta\operatorname{sign}[\nabla_{\mathbf{x}}(\mathcal{L_{\theta}}(f_{\theta}(\mathcal{G}_{\phi}(\mathbf{x}_{i-1},\mathbf{a}_{i-1}))))]).$

The adversarial example $\mathbf{\hat{x}}$ is an image space projection of a
fine-grained perturbation of the original input image $\mathbf{x}$ at both
pixel and attribute levels. During the process, our SIA framework manipulates
the attribute vector in a predefined attribute space such that the target
model is compromised. Note that each iteration of the updates will be clipped
with a radius $\epsilon$ to make sure that the perturbation is bounded and
valid. The pixel-level perturbed image is fed into $\mathcal{G}_{\phi}$ to
encode the adversarial information into the latent vector, which is
concatenated with the perturbed attribute vector. Specifically, instead of
directly perturbing the output image, which may significantly harm the
perceptual quality, we perturb the input attribute and the image and let
$\mathcal{G}_{\phi}$ project the perturbed image and attribute back to the
image manifold. To prevent synthesis collapse, we adopt the projection $\Pi$
onto the $\ell_{\infty}$ ball $\mathcal{B}$ of radius $\epsilon$ to constrain
the optimization. The projection to generate the final adversarial example is
formulated as
$\mathbf{\hat{x}}=\mathcal{G}_{\phi}(\mathbf{x}_{T},\mathbf{a}_{T})$. An
overview of our SIA framework is shown in Figure 2.

At this point, it is important to notice that perturbing in both the image
space and attribute space produces higher attack success rate and finer visual
adversarial images. Also, we do it for a fair comparison with traditional
methods. Recall that directly perturbing the semantic space limits the
attacking capability. Our hybrid attack gives us the flexibility to analyze
both the semantic and pixel-level robustness of the model. In fact, SIA’s
pixel-level perturbation helps to avoid exaggerated semantic variation that
makes the image generation collapse. An ablation study that illustrates the
advantages of perturbing in both the image and attribute space is included in
the experimental section.

###  3.2 Interpreting and Improving the Target Model

Given a set of image-attribute pairs $(\mathbf{x}^{(p)},\mathbf{a}^{(p)})$
($p=1,\dots,N$), we run $T$ iterations of Eq. 1 and store all the generated
adversaries. By calculating the absolute variation of attributes during the
generation of adversaries $\hat{\mathbf{x}}^{(p)}$, we can discover the most
sensitive attribute(s) to the target model $f_{\theta}(\cdot)$ in the
$\mathcal{G}_{\phi}$’s attribute space. We define the sensitivity vector
containing sensitivities (in the range of $[0,1]$) of the target model on each
attribute as follows:

$\displaystyle\mathbf{s}=\frac{1}{N}\sum_{p=1}^{N}(|\mathbf{a}_{T}^{(p)}-\mathbf{a}_{1}^{(p)}|),$
(2)

Each value in $\mathbf{s}$ will represent the average perturbation of the
corresponding attribute across all sampled images. Note that this method can
be extended to select top-k attributes that have a greater influence on the
prediction of the target model. The generated adversaries
$\hat{\mathbf{x}}^{(p)}$ are associated with more diverse attribute vectors
$\hat{\mathbf{a}}$, which can be considered as an augmented dataset for
adversarial training. See Algorithm 1 for more details on how to generate
adversaries and sensitivity analysis.

Algorithm 1 SIA to generate adversarial examples and sensitivity analysis.

Input:  A set of image-attribute pairs
$\\{(\mathbf{x}_{0}^{(p)},\mathbf{a}_{0}^{(p)})\\}_{p=1}^{N}$; target model
$f_{\theta}(\cdot)$

Output:  Model sensitivity $\mathbf{s}$; a set of adversaries
$\\{\hat{\mathbf{x}}^{(p)}\\}_{p=1}^{N}$

for $p\in\\{1,\ldots,N\\}$ do

for $i\in\\{1,\ldots,T\\}$ do

$\mathbf{a}_{i}^{(p)}\leftarrow\mathbf{a}_{i-1}^{(p)}+\eta\operatorname{sign}[\nabla_{\mathbf{a}}(\mathcal{L_{\theta}}(f_{\theta}(\mathcal{G}_{\phi}(\mathbf{x}_{i-1}^{(p)},\mathbf{a}_{i-1}^{(p)}))))]$

$\mathbf{a}_{i}^{(p)}\leftarrow\Pi_{\mathcal{B}(\epsilon_{\mathbf{a}})}(\mathbf{a}_{i}^{(p)})$

$\mathbf{x}_{i}^{(p)}\leftarrow\mathbf{x}_{i-1}^{(p)}+\eta\operatorname{sign}[\nabla_{\mathbf{x}}(\mathcal{L_{\theta}}(f_{\theta}(\mathcal{G}_{\phi}(\mathbf{x}_{i-1}^{(p)},\mathbf{a}_{i-1}^{(p)}))))]$

$\mathbf{x}_{i}^{(p)}\leftarrow\Pi_{\mathcal{B}(\epsilon_{\mathbf{x}})}(\mathbf{x}_{i}^{(p)})$

end for

$\mathbf{\hat{x}}^{(p)}\leftarrow\mathcal{G}_{\phi}(\mathbf{x}_{T}^{(p)},\mathbf{a}_{T}^{(p)})$

end for

$\mathbf{s}=\frac{1}{N}\sum_{p=1}^{N}(|\mathbf{a}_{T}^{(p)}-\mathbf{a}_{1}^{(p)}|)$

##  4 Experiments

This section explains the experimental validation to demonstrate the benefits
of SIA for visual model diagnostics, improved robustness against visual
attacks, and imbalanced robustness.

###  4.1 Experimental Setups

Attribute-assisted GAN: Our backbone of AttGAN $\mathcal{G}_{\phi}$ is trained
on the whole CelebA dataset [15], using $15$ attributes222we used Bald, Bangs,
Black_Hair, Blond_Hair, Brown_Hair, Bushy_Eyebrows, Eyeglasses, Male,
Mouth_Slightly_Open, Mustache, No_Beard, Pale_Skin, Young, Smiling,
Wearing_Lipstick. Images are center cropped, resized to $(224,224)$, and
normalized using the ImageNet normalization. $\mathcal{G}_{\phi}$’s encoding
and decoding dimensions are both 64. Shortcuts and inject layers are
activated, and the Wasserstein loss [1] is used. We used the codes provided by
[10]333https://github.com/elvisyjlin/AttGAN-PyTorch.

Attribute Classifier: Our classifiers are fine-tuned from TorchVision’s pre-
trained ResNet50. Unless otherwise stated, we trained binary classifiers on
the CelebA training set [15]. For training, we used the Adam optimizer with a
learning rate of 0.001 and batch size of 128. The seed for random number
generation is 42 for Numpy and PyTorch.

Keypoint Detector: We used the HR-Net architecture [21]. We trained two
models, one trained on the Wilder Facial Landmark in the Wild (WFLW) dataset
[24] and the other on the Microsoft (Fake-it) synthetic dataset [23]. To train
the two keypoint detectors, we used all images ($10,000$) from the WFLW
dataset and the first $10,000$ images from the Fake-it dataset, respectively.
We trained with $98$ keypoints on the WFLW dataset and $68$ keypoints on the
Fake-it dataset.

Figure 3: Attribute sensitivity analysis generated by SIA for different
classifiers (top) and keypoint detectors (bottom). Perceived gender and
eyeglasses classifiers are sensitive to different attributes. However, the
keypoint detectors trained on synthetic (left) and real (right) data are
sensitive to similar attributes, but the one trained on synthetic data is
slightly more sensitive than the one trained on real data.

(a) Examples of SIA on perceived-gender classifier

(b) Examples of SIA on Fake-it [23] keypoint detector

Figure 4:  SIA adversarial examples on different target models.

(a) Examples of SIA on eyeglass classifier

(b) Examples of SIA on WFLW [24] keypoint detector

Figure 5: (Cont.) SIA adversarial examples on different target models.

###  4.2 Visual Model Diagnosis

After training a deep learning model and tuning hyper-parameters of the model
on a validation set, an important step is error analysis. The error analysis
includes analyzing where the model fails on test data and making systematic
changes based on the insights. However, in some scenarios, it is difficult to
collect test data across all possible attributes of interest in a uniform
manner. Instead of collecting test data, this section describes how SIA can be
used for model diagnosis and provides insights into the image attributes that
make the model fail.

####  4.2.1 Diagnosis visualization

We trained $8$ binary classifiers on the following attributes from CelebA:
Attractive, Arched_Eyebrows, Blurry, Chubby, Eyeglasses, Male, No_Beard,
Sideburns with the setup mentioned in Section 4.1. In addition, we trained two
keypoint detection algorithms, one on real images and another one on synthetic
images, using the same architecture HR-Net [21]. SIA reports the sensitivity
of the target model w.r.t. different attributes, which is formalized in Eq. 2.
We selected the first $10,000$ images in CelebA to evaluate the sensitivities.
Fig. 3 illustrates the histogram for the classifier (first row) and keypoint
detector (second row) towards different attributes, according to Eq. 2. For
clearer visualization, we have normalized the sensitivity for each attribute
by the sum of sensitivities. We can see that for the perceived-gender
classifier, lipstick and beard are the most sensitive attributes. Similarly,
we discovered that changing specific attributes can largely affect the outcome
of a well-trained keypoint detection model. Interestingly, both keypoint
detectors are very sensitive to mustache and eyeglasses, and not very
sensitive to hair color or perceived gender. This is expected, since keypoints
have a higher density around the eyes and mouth region, and modification of
these regions can be critical to the accuracy.

Fig. 4 shows example images of SIA attacking the two target models. For the
perceived-gender classifier in Fig. 4 (a), we can see from the first four
columns that mutating the lipstick and beard attributes will influence the
model’s prediction. The last three columns show that mutating other attributes
including hair color, skin color, and bangs can also affect the model
decision. Fig. 4 (b) shows that SIA changes attribute such as eyeglasses, pale
skin, or mustache to cause keypoints misdetection in facial images. This
sensitivity analysis and adversarial examples can provide insights into the
kind of images where the keypoint detector or classifier fails, and generate
adversaries to improve performance. More adversarial examples and histograms
for the remaining attributes are shown in Appendix A and B.

|  PSNR ($\uparrow$) |  SSIM ($\uparrow$)
---|---|---
| SPT-50 |  SIA-50 (Attr) |  SIA-50 (Full) | SPT-200 |  SIA-200 (Attr) |  SIA-200 (Full) | SPT-50 |  SIA-50 (Attr) |  SIA-50 (Full) | SPT-200 |  SIA-200 (Attr) |  SIA-200 (Full)
$\displaystyle\eta=\frac{0.25}{255}$ | 26.63 | 41.98 | 42.24 | 19.43 | 31.21 | 33.94 | 0.9083 | 0.9929 | 0.9930 | 0.7732 | 0.9602 | 0.9718
$\displaystyle\eta=\frac{4}{255}$ | 14.18 | 22.36 | 28.25 | 13.59 | 20.16 | 25.75 | 0.6385 | 0.8573 | 0.9285 | 0.6230 | 0.8037 | 0.8926
Table 1:  Image quality evaluation for SIA and SPT.

####  4.2.2 Image quality evaluation

We evaluated the image perceptual quality for adversarial examples generated
by SPT [11] and SIA. To interpret Table 1, SPT-50 ($\eta=\frac{0.25}{255}$)
stands for the adversarial examples generated by SPT with 200 iterations and
step size of $\frac{0.25}{255}$. The tables show that SIA’s image quality is
better than SPT under both PSNR (Peak Signal to Noise Ratio) and SSIM
(Structured Similarity Indexing Method) [22] metrics. We can see that
perturbing in both image space and attribute space produces visually finer
adversarial images. In fact, SIA’s pixel-level perturbation helps to avoid
exaggerated semantic variation that makes the image generation collapse.

####  4.2.3 Sensitivity by single-attribute optimization

We can also perform SIA independently for every single attribute and organize
the sensitivities as the histogram on the right in Fig. 6. We can see that
SIA’s histograms, no matter multi-attribute or single-attribute, support
consistent analysis of most sensitive attributes. However, it is worth noting
that a greedy single attribute perturbation can be computationally expensive
for a large attribute space (e.g., 15 attributes). It is very time-consuming
to adversarially traverse a single attribute over the dataset and repeat 15
times (i.e., repeat for each attribute) in a grid-search manner. Jointly
optimizing all attributes is more time-effective and comprehensive (i.e.,
exploring a continuous space across all attributes) as the histogram on the
left.

Figure 6: Histogram for attribute sensitivities (under multi- and single-
attribute optimization) for the perceived-gender classifier.

###  4.3 Attack Effectiveness

This section compares SIA to popular gradient-based adversarial attacks in a
white-box setting for the attribute classifiers. Then an ablation study is
conducted to demonstrate the effectiveness of various components in SIA,
including the use of attribute and image perturbations.

####  4.3.1 Attack success rate

SIA constrains the perturbation bounds of attribute space ($\mathbf{a}$) and
image space ($\mathbf{x}$) separately. The attributes that do not overlap with
the target model range between $[0,1]$ with a step size
$\eta=\frac{0.25}{255}$. The attribute that is equivalent to the target
classifier is constrained to be a small constant depending on the attribute
being classified. We iteratively perturbed the input image bounded by
$\epsilon=\frac{1.5}{255}$ with $\eta=\frac{0.25}{255}$. The number of steps
for both the attribute space and image space will be $200$. The evaluated
subset in CelebA corresponds to the first $10,000$ images.

We used the FGSM [8] and PGD [16] under $l_{\infty}$ norm of different
perturbation bounds as baseline methods. For PGD, the iteration step size
$\eta=\frac{0.25}{255}$ with 200 steps in total. For FGSM, the attack will
iterate once within a bounded perturbation. In the adversarial training
experiment, we additionally compared with SPT [11] using the same attribute
space as SIA. However, we did not compare with [14] since their method samples
adversarial examples from StyleGAN, which does not support attacking existing
images. We also did not compare with [13] because their method requires
training a separate model on StyleGAN’s original training data for each target
model.

Table 2 shows the attack success rates for different perturbation-based
attacks on multiple target classifiers. Notably, we can see that SIA achieves
performance comparable to traditional attacks with smaller perturbations.

$\epsilon$ | Classifier | FGSM | PGD | SIA
---|---|---|---|---
1.5/255 | Eyeglasses | 28.01 | 49.85 | 68.20
Perceived Gender | 56.31 | 65.32 | 88.19
2/255 | Eyeglasses | 42.83 | 87.79 | 94.82
Perceived Gender | 75.27 | 87.19 | 92.44
4/255 | Eyeglasses | 78.90 | 99.94 | 99.99
Perceived Gender | 97.33 | 97.41 | 98.53
Table 2:  Success rate (%) for different adversarial attack methods with
different perturbation bounds.

####  4.3.2 Ablation for image v.s. attribute space

This experiment analyzes the attack success rate when attacking the image
and/or the attribute space (see Table 3). Original reconstruction refers to
the images reconstructed by $\mathcal{G}_{\phi}$ without any perturbations.
I/A refers to only updating the image/attribute space during the attack. PI/PA
refers to partially updating the image/attribute space in the first $20$
iterations of the total $200$ iterations. Note that the Attr-space setting is
different from SPT [11] since SIA uses $\operatorname{sign}$ linearization to
constrain the gradient updates to stabilize the attack. As expected, the
attack effectiveness is much higher regardless of using attribute space alone
or in combination.

| Eyeglasses |  Goatee | Age | Sideburns
---|---|---|---|---
OR | 0.02 | 3.49 | 0.15 | 3.32
I | 1.83 | 13.58 | 6.10 | 12.51
I + PA | 18.25 | 26.54 | 30.16 | 22.46
A | 32.67 | 83.59 | 90.90 | 67.97
A + PI | 44.26 | 79.82 | 85.98 | 70.65
Full | 68.20 | 90.51 | 90.38 | 87.08
Table 3:  Ablation study on the success rate (%) of attacks.

####  4.3.3 Extending attribute space

We experimented with an alternative attribute space of $20$ attributes for
$\mathcal{G}_{\phi}$. We removed Black_Hair, Brown_Hair, Bushy_Eyebrows,
Eyeglasses, Male(perceived), No_Beard, Young(perceived), Wearing_Lipstick
which are either attribute of target classifier or attributes with overlapped
concepts. Then we added Narrow_Eyes, Oval_Face, Pale_Skin, Pointy_Nose,
Receding_Hairline, Rosy_Cheeks, Sideburns, Straight_Hair, Big_Lips, Big_Nose,
Chubby, Goatee, Heavy_Makeup, High_Cheekbones. Compared with the attribute
space used in our main experiment, this alternative attribute space covers
more semantic variations in facial data. Fig. 7(a) shows the success rate for
the attractive classifier. PGD refers to the implemented PGD attack [16]. The
larger the attribute space, the higher the success rate, and the attack
converges in fewer iterations. This is not surprising because the larger
semantic space helps $\mathcal{G}_{\phi}$ to search the combination of
adversarial attributes more effectively. Fig. 7(b) shows that with the same
perturbation bound setting, the extended $\mathcal{G}_{\phi}$ will give a
stronger attack on the target classifier.

(a) Ablation for attack iterations

(b) Ablation for attack bound

Figure 7: The effect of different attribute spaces used in SIA. We compare
$15$ and $20$ attributes and show that a larger space of attributes leads to
faster attack convergence (left) and a higher success rate with various bounds
(right).

###  4.4 Adversarial Training

In this experiment, we evaluated the effectiveness of SIA to improve
adversarial robustness. We adopted the setting such that the target model is
fine-tuned with adversarial examples for one epoch. Table 4 shows how SIA can
be used effectively for re-fitting adversarial examples generated by Algorithm
1. SIA-Adv, PGD-Adv, SPT-Adv are eyeglasses classifiers adversarially trained
with $30,000$ adversarial examples generated by the corresponding attack
method from the first $30,000$ images of CelebA. The perturbation bound is
$\epsilon=1.5/255$. Non-adversarial training means the regular classifier
trained in Section 4.2. All models are evaluated on the first $10,000$ images
from the CelebA test set that the models have never seen before. Results show
that the robustness of SIA adversarial training is transferable to other
attack methods, but not vice versa (i.e., see how the column SIA-Adv works
well across all the attacks). This is because our adversarial example
constructs both conceptual shifts in the semantic space and noise shift in the
image space, which introduces richer information during the adversarial
training compared to traditional perturbation attacks. Fig. 8 shows the visual
comparison of SIA and SPT adversaries on the eyeglasses classifier. SPT
generates less fine-controlled semantic changes because updating only the
attribute space results in large changes across many attributes. More visual
comparisons of different baselines for adversarial training are reported in
Appendix C.

| Non-Adv |  PGD-Adv [16] |  SPT-Adv [11] | SIA-Adv
---|---|---|---|---
Clean Test Set | 99.63 | 99.54 | 99.51 | 99.52
FGSM ($1.5/255$) | 73.97 | 86.55 | 77.76 | 94.01
PGD ($1.5/255$) | 50.63 | 81.98 | 16.52 | 86.90
SIA ($1.5/255$) | 12.59 | 27.90 | 74.01 | 67.07
FGSM ($4/255$) | 22.47 | 22.09 | 41.78 | 45.51
SIA ($4/255$) | 4.56 | 10.85 | 10.55 | 12.57
Table 4:  Adversarial training. The reported numbers represent the accuracy
(%) for adversaries.

####  4.4.1 Standard deviation of attribute robustness

We established a measure named Standard Deviation of Attribute Robustness
(SDAR) to understand the final variance of our model across attributes. For a
given classifier $f_{\theta}$, SIA generates the sensitivity histogram based
on the attribute perturbation vector $\mathbf{s}$ of length $L$. The SDAR
metric $\sigma_{\bm{s}}$ is defined as the standard deviation of the
sensitivity values
$\sigma_{\bm{s}}=\sqrt{\frac{1}{L}\sum_{i=1}^{L}\left(s_{i}-\bar{\mathbf{s}}\right)^{2}}$.

Ideally, an unbiased model should have equal sensitivity across all
attributes, hence a decrease in the standard deviation will indicate that the
model is less biased. To validate the method, we calculated SDARs after
evaluating different models from adversarial training. The test data was the
first $10,000$ images of CelebA test set. We evaluated the SDAR metric under
two bounds ($\epsilon$) of SIA. Table 5 shows the results. We can see that the
non-adv classifiers will have larger $\sigma$ and the adversarially-trained
models have smaller $\sigma$ since the model generalization is improved by the
adversarial training process. By optimizing both the attribute and the image
space, SIA-Adv better generalizes over attributes than regular classifiers.

| Non-Adv |  PGD-Adv [16] |  SPT-Adv [11] |  SIA-Adv (Ours)
---|---|---|---|---
$\displaystyle\epsilon=\frac{1.5}{255}$ | 0.1145 | 0.0917 | 0.0852 | 0.0781
$\displaystyle\epsilon=\frac{4}{255}$ | 0.1419 | 0.1270 | 0.1253 | 0.1056
Table 5:  SDAR metric on different adversarially-trained models from Section
4.4. A lower value indicates a less biased model. Figure 8:  Demonstration of
SIA and SPT [11] adversarial examples on the eyeglasses classifier. Results
show that SPT generates unrealistic images, while SIA generates realistic
images with small but semantic modifications of the original image.

###  4.5 Robustness to Imbalanced Datasets

This section reports experiments to evaluate the robustness of SIA in learning
from imbalanced datasets. In these situations, it is vital to develop
algorithms that are not biased toward the majority class. While data
augmentation and re-weighting are commonly used techniques, we show how SIA
provides an alternative that generates semantically meaningful augmentation
with high visual quality.

We trained two attribute classifiers, for eyeglasses and bangs, using the
ResNet50 architecture. We generated a synthetically unbalanced dataset to
produce a controlled imbalanced environment. For training, we randomly sampled
$30,000$ images from CelebA training set such that $1\%$ are positive and
$99\%$ are negative. We trained the classifiers from random initialization.
For testing, we use balanced test data including random $2,500$ positive-label
images and $2,500$ negative-label images from CelebA test set.

Table 6 shows the precision, recall, and accuracy for several imbalanced
learning strategies. We compared SIA to five data augmentation and re-
balancing approaches. The Non-Adv attribute classifiers are trained on the
synthetic data with 1:99 CelebA training set. The CutMix [27] baselines are
augmented with action probability $p=0.5$ and learning rate $\alpha=0.001$. We
followed PyTorch’s implementation on AutoAugment [4]. We also included two
commonly used baselines to deal with imbalanced data: Reweighting and
Resampling. Reweighting means upweighting the under-represented samples based
on the proportion of class samples. Resampling means duplicating the under-
represented samples until different classes have the same number of samples.
SIA refers to classifiers augmented by randomly sampling $30,000$ our
adversarial images. SIA + Reweight is the scheme where the reweighting is
performed on our SIA-augmented dataset. Results show that SIA can effectively
be used to augment imbalanced datasets, outperforming other widely used
augmentation methods. One possible reason is that SIA generates semantically
meaningful augmentations, different from CutMix and AutoAugment. Finally, we
conduct a similar experiment with pre-trained classifiers in Appendix D. We
show that the difference in accuracy between the methods narrows down
considerably if we pre-train the classifiers. This is not surprising, since
pre-training with sufficient data provides robust features that are less prone
to imbalance.

| Strategy |  Prec. $\uparrow$ |  Recall $\uparrow$ |  Acc. (%) $\uparrow$
---|---|---|---|---
Eyeglasses | Non-adv classifier | 0.9985 | 0.8052 | 90.20
Reweighting | 0.9995 | 0.8368 | 91.82
Resample | 0.9984 | 0.7700 | 88.44
CutMix | 0.9963 | 0.3236 | 66.12
AutoAugment | 0.9975 | 0.8004 | 89.92
SIA-Adv (ours) | 0.9991 | 0.8864 | 94.28
SIA-Adv + Reweight (ours) | 0.9991 | 0.8856 | 94.24
Bangs | Non-adv classifier | 0.9847 | 0.2576 | 62.68
Reweighting | 0.9912 | 0.2708 | 63.42
Resample | 0.9935 | 0.1840 | 59.14
CutMix | 1.0000 | 0.0000 | 50.00
AutoAugment | 0.9701 | 0.0260 | 51.26
SIA-Adv (ours) | 0.9791 | 0.4116 | 70.14
SIA-Adv + Reweight (ours) | 0.9854 | 0.5960 | 79.36
Table 6:  Comparison of different strategies for learning from imbalanced
datasets. See text.

##  5 Conclusions and Future Work

This paper introduced SIA, an attribute-assisted adversarial method with
applications in model diagnosis, improving target model robustness, and
increasing the success of visual attacks. A major appeal of our technique is
the capacity of analyzing a deep learning model without a carefully designed
test set. SIA reveals the dependencies between attributes and model outputs,
which helps interpret the biases learned by models during prediction. We hope
our results pave the way for new tools to analyze models and inspire future
work on mitigating such biases.

While we showed the benefits of our technique in two computer vision problems,
our approach is applicable to any end-to-end differentiable target deep
learning model. It is unclear how to extend this approach to non-
differentiable ML models, and more research needs to be done. Our method works
with white-box attacks since our primary motivation is to diagnose a known
model. More research needs to be done to address black-box attacks.
Furthermore, we have illustrated the power of SIA only in the context of
faces, but our method can extend to generative models that have been trained
with other attributes of interest and can be applied to other visual domains.

## References

  * [1] Martin Arjovsky, Soumith Chintala, and Léon Bottou.  Wasserstein Generative Adversarial Networks.  In ICML, 2017.
  * [2] Guha Balakrishnan, Yuanjun Xiong, Wei Xia, and Pietro Perona.  Towards Causal Benchmarking of Bias in Face Analysis Algorithms.  In ECCV, 2020.
  * [3] Nicholas Carlini and David Wagner.  Towards Evaluating the Robustness of Neural Networks.  In IEEE SP, 2017.
  * [4] Ekin D. Cubuk, Barret Zoph, Dandelion Mane, Vijay Vasudevan, and Quoc V. Le.  AutoAugment: Learning Augmentation Strategies From Data.  In CVPR, 2019.
  * [5] Emily L. Denton, Ben Hutchinson, Margaret Mitchell, Timnit Gebru, and Andrew Zaldivar.  Image Counterfactual Sensitivity Analysis for Detecting Unintended Bias.  In CVPR, 2019.
  * [6] Tejas Gokhale, Rushil Anirudh, Bhavya Kailkhura, Jayaraman J. Thiagarajan, Chitta Baral, and Yezhou Yang.  Attribute-Guided Adversarial Training for Robustness to Natural Perturbations.  In AAAI, 2021.
  * [7] Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio.  Generative Adversarial Nets.  In Z. Ghahramani, M. Welling, C. Cortes, N. Lawrence, and K.Q. Weinberger, editors, NeurIPS, 2014.
  * [8] Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy.  Explaining and Harnessing Adversarial Examples.  In Yoshua Bengio and Yann LeCun, editors, ICLR, 2015.
  * [9] Moritz Hardt, Eric Price, and Nathan Srebro.  Equality of Opportunity in Supervised Learning.  arXiv preprint arXiv:1610.02413, 2016.
  * [10] Z. He, W. Zuo, M. Kan, S. Shan, and X. Chen.  AttGAN: Facial Attribute Editing by Only Changing What You Want.  In IEEE TIP, 2019.
  * [11] Ameya Joshi, Amitangshu Mukherjee, Soumik Sarkar, and Chinmay Hegde.  Semantic Adversarial Attacks: Parametric Transformations That Fool Deep Classifiers.  In ICCV, 2019.
  * [12] Tero Karras, Samuli Laine, and Timo Aila.  A Style-Based Generator Architecture for Generative Adversarial Networks.  In CVPR, 2019.
  * [13] Oran Lang, Yossi Gandelsman, Michal Yarom, Yoav Wald, Gal Elidan, Avinatan Hassidim, William T. Freeman, Phillip Isola, Amir Globerson, Michal Irani, and Inbar Mosseri.  Explaining in Style: Training a GAN To Explain a Classifier in StyleSpace.  In ICCV, 2021.
  * [14] Dongze Li, Wei Wang, Hongxing Fan, and Jing Dong.  Exploring Adversarial Fake Images on Face Manifold.  In CVPR, 2021.
  * [15] Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang.  Deep Learning Face Attributes in the Wild.  In ICCV, 2015.
  * [16] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu.  Towards Deep Learning Models Resistant to Adversarial Attacks.  In ICLR, 2018.
  * [17] Haonan Qiu, Chaowei Xiao, Lei Yang, Xinchen Yan, Honglak Lee, and Bo Li.  SemanticAdv: Generating Adversarial Examples via Attribute-conditioned Image Editing.  In ECCV, 2020.
  * [18] Vikram V. Ramaswamy, Sunnis S. Y. Kim, and Olga Russakovsky.  Fair Attribute Classification through Latent Space De-biasing.  In CVPR, 2021.
  * [19] Olaf Ronneberger, Philipp Fischer, and Thomas Brox.  U-Net: Convolutional Networks for Biomedical Image Segmentation.  In MICCAI, 2015.
  * [20] Prasanna Sattigeri, Samuel C. Hoffman, Vijil Chenthamarakshan, and Kush R. Varshney.  Fairness GAN.  arXiv preprint arXiv:1805.09910, 2018.
  * [21] Jingdong Wang, Ke Sun, Tianheng Cheng, Borui Jiang, Chaorui Deng, Yang Zhao, Dong Liu, Yadong Mu, Mingkui Tan, Xinggang Wang, Wenyu Liu, and Bin Xiao.  Deep High-Resolution Representation Learning for Visual Recognition.  In IEEE TPAMI, 2019.
  * [22] Zhou Wang, A.C. Bovik, H.R. Sheikh, and E.P. Simoncelli.  Image Quality Assessment: from Error Visibility to Structural Similarity.  In IEEE TIP, 2004.
  * [23] Erroll Wood, Tadas Baltrušaitis, Charlie Hewitt, Sebastian Dziadzio, Matthew Johnson, Virginia Estellers, Thomas J. Cashman, and Jamie Shotton.  Fake It Till You Make It: Face Analysis in the Wild Using Synthetic Data Alone.  arXiv preprint arXiv:2109.15102, 2021.
  * [24] Wayne Wu, Chen Qian, Shuo Yang, Quan Wang, Yici Cai, and Qiang Zhou.  Look at Boundary: A Boundary-Aware Face Alignment Algorithm.  In CVPR, 2018.
  * [25] Chaowei Xiao, Bo Li, Jun yan Zhu, Warren He, Mingyan Liu, and Dawn Song.  Generating Adversarial Examples with Adversarial Networks.  In IJCAI, 2018.
  * [26] Qingsong Yao, Zecheng He, Hu Han, and S. Kevin Zhou.  Miss the Point: Targeted Adversarial Attack on Multiple Landmark Detection.  In MICCAI, 2020.
  * [27] Sangdoo Yun, Dongyoon Han, Sanghyuk Chun, Seong Joon Oh, Youngjoon Yoo, and Junsuk Choe.  CutMix: Regularization Strategy to Train Strong Classifiers With Localizable Features.  In ICCV, 2019.
  * [28] Brian Hu Zhang, Blake Lemoine, and Margaret Mitchell.  Mitigating Unwanted Biases with Adversarial Learning.  In AAAI, 2018.
  * [29] Congcong Zhu, Xiaoqiang Li, Jide Li, and Songmin Dai.  Improving Robustness of Facial Landmark Detection by Defending Against Adversarial Attacks.  In ICCV, 2021.

## Supplementary Material

##  Appendix A SIA Adversarial Images

Fig. 9 and Fig. 10 show additional examples of adversarial images generated by
SIA for different target models. We find the adversarial semantic shifts on
keypoint detectors are visually greater than that on classifiers. These
results show that detectors are more robust to semantic shifts than
classifiers.

Figure 9: SIA adversarial examples for the eyeglasses classifier.

Figure 10: SIA adversarial examples for the keypoint detector trained on
Microsoft Fake-it [23].

##  Appendix B Histograms for Model Interpretation

Fig. 11 shows the histograms of the sensitivity across attributes generated
for additional attribute classifiers in Section 4.2.

Figure 11: Attribute sensitivity analysis generated by SIA for more target
classifiers.

##  Appendix C Image Synthesis Analysis

###  C.1 Visual Comparison of Adversarial Examples

Fig. 12 shows more visual comparisons of the adversarial examples generated by
different methods. As we can see, SIA adds perturbation in the image space and
the attribute space, generating photo-realistic fine-grained adversarial
examples. Perturbing in both image space and attribute space produces finer
visual adversarial images. In fact, SIA ’s pixel-level perturbation helps to
avoid exaggerated semantic variation that makes the image generation collapse.

Ori. Recon.

FGSM [8]

SPT [11]

SIA (Ours)

Ori. Recon.

FGSM [8]

SPT [11]

SIA (Ours)

Figure 12: Adversarial examples by FGSM [8], SPT [11], and SIA (Ours) on the
eyeglasses classifier.

###  C.2 AttGAN’s Reconstruction and Semantic Editing

AttGAN ($\mathcal{G}_{\phi}$) is capable of editing both fine-level semantics
(e.g., beard) and complex concepts (e.g., age). The reconstruction loss during
the training of $\mathcal{G}_{\phi}$ guarantees the preservation of facial
details. As stated in [10], the use of shortcut layers [19] improves the
quality of image translation. During the SPT and SIA attack, we constrained
all mutated attributes in the range of [0,1] to make sure that the transformed
attribute vector for $\mathcal{G}_{\phi}$ is valid. The style intensity hyper-
parameter is set to $1$, and the number of encoder layers and decoder layers
are both $5$.

Additionally, Fig. 13 illustrates the non-adv image projection by our AttGAN
backbone $\mathcal{G}_{\phi}$. We can see from the images that the inverse
(flipping) attribute manipulation for most attributes is visually correct.
Note that there are naturally hard cases (e.g., modifying images of people
with long hair to be bold), and this can be potentially improved in future
work.

Figure 13:  $\mathcal{G}_{\phi}$’s reconstruction and attribute manipulation.
The columns are Reconstruction, Bald, Bangs, Black_Hair, Blond_Hair,
Brown_Hair, Bushy_Eyebrows, Eyeglasses, Gender, Mouth_Slightly_Open, Mustache,
No_Beard, Pale_Skin, Age, Smiling, Wearing_Lipstick.

##  Appendix D Imbalanced Datasets

In this section, we ran data augmentation experiments using pre-trained models
on a ResNet50 architecture. The pre-trained models are described in Section
4.1. Recall that the CelebA is highly imbalanced for some classes. For
instance, the CelebA training set in the case of eyeglasses has $6.46\%$
Positive and $93.54\%$ Negative samples. For the bangs classifier, the
imbalance in training data is $15.17\%$ Positive and $84.83\%$ Negative. As in
Section 4.5, we used a balanced test data including random $2500$ positive-
label images and $2500$ negative-label images from the CelebA test set. Table
7 shows the augmentation results on these two attributes. While SIA still
beats conventional techniques in this scenario, it does so by a significantly
lesser margin. Fig. 14 summarizes the label proportion of each attribute in
the CelebA dataset. As we can notice, there are many attributes that are
significantly unbalanced, and therefore the challenge of generating a balanced
dataset across attributes.

|  Eyeglasses (Pre-trained) |  Bangs (Pre-trained)
---|---|---
| F1 $\uparrow$ | Accuracy $\uparrow$ | F1 $\uparrow$ | Accuracy $\uparrow$
Non-adv classifier | 0.9789 | 97.93% | 0.9218 | 92.50%
Reweighting | 0.9831 | 98.33% | 0.9169 | 92.04%
Resample | 0.9811 | 98.15% | 0.9100 | 91.51%
CutMix | 0.9813 | 98.16% | 0.8993 | 90.63%
AutoAugment | 0.9840 | 98.42% | 0.9052 | 91.11%
SIA (ours) | 0.9846 | 98.48% | 0.8956 | 90.31%
SIA + Reweight (ours) | 0.9872 | 98.73% | 0.9285 | 93.04%
Table 7:  Data augmentation for image classification in imbalanced datasets.
Figure 14:  Label proportions of the whole CelebA dataset ($202599$ facial
images).

##  Appendix E Attribute Sensitivity on Different Data Amount

We use SIA to evaluate the gender classifier and heavy-makeup classifiers
trained with the setup in section 4.1. We take the first $17,000$ images from
the CelebA test set and divide them into three sets of $10,000$ images,
$5,000$ images, and $2,000$ images by data index. Note that classifiers and
$\mathcal{G}_{\phi}$ have never been trained on these images before. Table 8,
9, 10, 11 show the results. We can see that the sensitivities are empirically
consistent over different amounts of evaluation data. To take Table 8, 9
(gender classifier) as an example, we can see that with different amounts of
data the shape of the histogram (Fig. 15) remains consistent. Note that the
most sensitive attribute for attacking the gender classifier is consistently
the lipstick. In the open-source version, we will release the code and
instructions for running SIA on multiple setups of data.

|  Bald | Bangs |  Black Hair |  Blond Hair |  Brown Hair | Bushy | Eyeglasses |  Mouth Open
---|---|---|---|---|---|---|---|---
$2000$ | 0.0434 | 0.0605 | 0.0405 | 0.0434 | 0.0545 | 0.0887 | 0.0803 | 0.0584
$5000$ | 0.0426 | 0.0580 | 0.0417 | 0.0445 | 0.0528 | 0.0879 | 0.0839 | 0.0551
$10000$ | 0.0427 | 0.0595 | 0.0409 | 0.0424 | 0.0532 | 0.0879 | 0.0838 | 0.0548
Table 8:  Detailed numerical values of each attribute sensitivity for the gender classifier using different amounts of data. |  Mustache |  No Beard |  Pale Skin | Young | Smiling |  Lipstick
---|---|---|---|---|---|---
$2000$ | 0.0755 | 0.1495 | 0.0452 | 0.0647 | 0.0370 | 0.1585
$5000$ | 0.0775 | 0.1493 | 0.0449 | 0.0656 | 0.0375 | 0.1586
$10000$ | 0.0775 | 0.1499 | 0.0458 | 0.0652 | 0.0359 | 0.1606
Table 9:  (Cont.) Detailed numerical values of each attribute sensitivity for the gender classifier using different amounts of data. |  Bald | Bangs |  Black Hair |  Blond Hair |  Brown Hair | Bushy | Eyeglasses | Gender |  Mouth Open
---|---|---|---|---|---|---|---|---|---
$2000$ | 0.0269 | 0.0772 | 0.0438 | 0.0540 | 0.0650 | 0.0742 | 0.1296 | 0.0446 | 0.0494
$5000$ | 0.0268 | 0.0774 | 0.0400 | 0.0528 | 0.0631 | 0.0792 | 0.1278 | 0.0446 | 0.0525
$10000$ | 0.0265 | 0.0783 | 0.0419 | 0.0563 | 0.0645 | 0.0740 | 0.1294 | 0.0419 | 0.0494
Table 10:  (Cont.) Detailed numerical values of each attribute sensitivity for the heavy-makeup classifier using different amounts of data. |  Mustache |  No Beard |  Pale Skin | Young | Smiling |  Lipstick
---|---|---|---|---|---|---
$2000$ | 0.0740 | 0.1244 | 0.0291 | 0.0691 | 0.0371 | 0.1016
$5000$ | 0.0772 | 0.1213 | 0.0298 | 0.0651 | 0.0408 | 0.1015
$10000$ | 0.0790 | 0.1218 | 0.0288 | 0.0679 | 0.0368 | 0.1037
Table 11:  (Cont.) Detailed numerical values of each attribute sensitivity for
the heavy-makeup classifier using different amounts of data. Figure 15:
Histogram visualization of attribute sensitivities (under different SIA data
amount) for the gender classifier.

##  Appendix F Attack Effectiveness

We implement SPT [11], CW [3], and Face-Manifold (FM) [14] attacks and
evaluate the attack success rates (ASR) on our facial eyeglass classifier. The
classifier is trained with the setup mentioned in section 4.1. For all listed
setups (unless otherwise stated), the images for evaluation is the first
$2,000$ images from CelebA test set.

In SPT attack, we use the attribute space consisting the same $15$ attributes
as SIA. The optimizer is RMSProp with two learning rates $\eta={0.25}/{255}$
and $\eta={4}/{255}$. Table 12 shows the ASR with different attack iterations.
Under the same setup of $200$ iterations with $\eta={0.25}/{255}$, our SIA
attribute-only ASR (in section 4.3 ablation study table) is 32.67% which
outperforms SPT. This shows that the use of signed gradient to update the
attribute space, which stabilizes the optimization, can improve the attack
effectiveness.

Iterations |  2 |  5 |  10 |  15 |  20 |  50 |  100 |  150 |  200
---|---|---|---|---|---|---|---|---|---
$\eta=\frac{0.25}{255}$ | 0.3% | 0.3% | 0.4% | 0.7% | 0.9% | 3.1% | 12.3% | 19.4% | 22.9%
$\eta=\frac{4}{255}$ | 1.2% | 5.0% | 14.6% | 21.7% | 25.4% | 28.3% | 29.6% | 30.3% | 29.7%
Table 12:  ASR for SPT attack with different step size $\eta$ on eyeglasses
classifier

In CW attack, we fix the attack iteration same as SIA’s $200$ and evaluate the
ASR under different box-constrain parameters. Table 13 shows that by relaxing
the box-constrain, the ASR can hit to 52.6% which is higher than our PGD
baseline of 49.85%. The default setting of SIA where image and attribute
spaces are co-updated has an ASR of 68.20% which are much more effective than
CW and PGD. Note that during SIA’s adversarial optimization, we can obtain
attribute sensitivity which provides intuitive model interpretation to users.
Pure image space attacks cannot support such features.

Box Contrain |  0.10 |  0.25 |  0.50 |  0.75 |  1.0 |  1.5 |  2.0 |  5.0 |  10.0
---|---|---|---|---|---|---|---|---|---
ASR | 9.1% | 16.8% | 25.0% | 29.4% | 31.9% | 35.1% | 37.2% | 45.4% | 52.6%
Table 13:  ASR for CW attack with different box-constrains setup on eyeglasses
classifier

In FM attack, we follow the setup as specified in the original paper to make
sure that we can re-implement the high ASR reported in their paper. We sample
$2,000$ images from the style space to experiment on different settings of
$\epsilon_{1}$ (style step size) and $\epsilon_{2}$ (noise step size). Table
14 shows the ASR of different $\epsilon_{1}$ and $\epsilon_{2}$ settings. We
find out that noise vectors have a superior effect on flipping the prediction
of our eyeglasses ResNet classifier. With increasing the strength of injected
noises during the generation, the image quality will significantly decrease.
Note that SIA and PGD can also achieve similar ASR (99.99% and 99.94%
correspondingly) by relaxing the image space constraint.

|  $\epsilon_{2}$ = 0 (no noise) |  $\epsilon_{2}$ = 0.01 |  $\epsilon_{2}$ = 0.02 |  $\epsilon_{2}$ = 0.03 |  $\epsilon_{2}$ = 0.04 |  $\epsilon_{2}$ = 0.05
---|---|---|---|---|---|---
$\epsilon_{1}$ = 0.004 | 2.5% | 70.8% | 96.6% | 99.7% | 100.0% | 99.9%
$\epsilon_{1}$ = 0.01 | 2.2% | 19.3% | 55.9% | 78.8% | 91.9% | 97.3%
$\epsilon_{1}$ = 0.05 | 0.3% | 1.9% | 3.95% | 8.2% | 19.3% | 20.5%
$\epsilon_{1}$ = 0.1 | 0.2% | 0.8% | 1.3% | 2.9% | 7.0% | 12.1%
Table 14:  ASR for FM attack on eyeglasses classifier

In the open source version, we will release the code and instructions on how
to set up hyperparameters, schedule baseline experiments, and run code for
comparisons.