# Adversarial Robustness Assessment of NeuroEvolution Approaches

Inês Valentim, Nuno Lourenço, Nuno Antunes  University of Coimbra, CISUC, DEI
Coimbra, Portugal
<EMAIL_ADDRESS><EMAIL_ADDRESS><EMAIL_ADDRESS>Nuno Lourenço  University
of Coimbra
Coimbra, Portugal
<EMAIL_ADDRESS>Nuno Antunes  University of Coimbra
Coimbra, Portugal
<EMAIL_ADDRESS>
###### Abstract

NeuroEvolution automates the generation of Artificial Neural Networks through
the application of techniques from Evolutionary Computation. The main goal of
these approaches is to build models that maximize predictive performance,
sometimes with an additional objective of minimizing computational complexity.
Although the evolved models achieve competitive results performance-wise,
their robustness to adversarial examples, which becomes a concern in security-
critical scenarios, has received limited attention. In this paper, we evaluate
the adversarial robustness of models found by two prominent NeuroEvolution
approaches on the CIFAR-10 image classification task: DENSER and NSGA-Net.
Since the models are publicly available, we consider white-box untargeted
attacks, where the perturbations are bounded by either the $L_{2}$ or the
$L_{\infty}$-norm. Similarly to manually-designed networks, our results show
that when the evolved models are attacked with iterative methods, their
accuracy usually drops to, or close to, zero under both distance metrics. The
DENSER model is an exception to this trend, showing some resistance under the
$L_{2}$ threat model, where its accuracy only drops from 93.70% to 18.10% even
with iterative attacks. Additionally, we analyzed the impact of pre-processing
applied to the data before the first layer of the network. Our observations
suggest that some of these techniques can exacerbate the perturbations added
to the original inputs, potentially harming robustness. Thus, this choice
should not be neglected when automatically designing networks for applications
where adversarial attacks are prone to occur.

###### Index Terms:

Adversarial Examples, Convolutional Neural Networks, NeuroEvolution,
Robustness.

##  I Introduction

The design of Artificial Neural Networks (ANNs) is a time-consuming trial-and-
error process that requires domain expertise. The design choices affect one
another and this interdependence must be considered when dealing with
increasingly complex models which often reach thousands or millions of
parameters. To alleviate these issues, NeuroEvolution (NE) uses evolutionary
approaches to automate the search for better topologies and parametrization of
ANNs.

Models designed through NE achieve competitive results in comparison with
manually-designed ANNs, sometimes even surpassing their performance [1, 2, 3,
4, 5]. Thus, it is reasonable to consider that these models can be applied in
real-world scenarios. However, their adoption in such cases means that
concerns other than predictive performance must be addressed. In the
particular case of security-critical systems, such as autonomous vehicles or
malware detectors, one of such concerns is the models’ vulnerability to
adversarial examples [6, 7]. These malicious examples are usually crafted by
adding small perturbations to the original inputs causing the attacked model
to produce an incorrect output [8, 9]. Restrictions are often imposed on the
maximum perturbation that can be added so as to try to keep the adversarial
example and the original input indistinguishable [8, 9]. In the image domain,
the perturbations are often bounded by some $L_{p}$-norm [8, 10]. ANNs
designed by humans have been widely studied and are known to be vulnerable to
these attacks, but it is still unclear the extent to which ANNs obtained
through the application of NE suffer from this vulnerability.

Our goal is to empirically evaluate the resistance of ANNs designed by NE to
adversarial examples, with a focus on image classification tasks and
Convolutional Neural Networks (CNNs). We consider threat models where the
attacker’s goal is simply to cause a misclassification of a given instance,
i.e., we perform untargeted attacks, and has full access to the models, i.e.,
we perform white-box attacks. Similar to previous work in adversarial machine
learning, we consider $L_{2}$ and $L_{\infty}$-bounded perturbations [11], and
white-box attacks that maximize the loss function while constraining the
perturbations to a pre-defined budget under each distance metric.

Our analysis is performed by attacking pre-trained models for the CIFAR-10
dataset [12], made publicly available by the authors of the corresponding NE
approaches. We consider DENSER [1] and two variants of NSGA-Net models [3],
all of which achieving an accuracy above 93% on clean images. These models,
and their training, do not incorporate any defense mechanism against
adversarial examples. Thus, any robustness that is shown can be likely
attributed to architectural aspects of the ANNs. Moreover, the NE approaches
only seek to maximize predictive performance, while directly or indirectly
minimizing computational complexity.

Our results show that these evolved models are susceptible to adversarial
attacks, similar to hand-designed ANNs. Using iterative methods, like the
basic iterative method (BIM) [13] and the projected gradient descent (PGD)
attack [14], their accuracy drops dramatically, to values below 0.25% under
both distance metrics. DENSER deviates from this behavior and shows some
resistance to $L_{2}$ perturbations, keeping its accuracy at 21.76% under a
BIM attack with 100 iterations. When reducing the iterations to 50 but
incorporating 10 random restarts, the accuracy falls further to 18.10%. On the
other hand, the models that use the architectures found by NSGA-Net,
especially when applied to the NASNet search space, are more robust to the
single-step attacks of our experiments. We could also identify distinct
patterns in the misclassifications produced by the models, even under the same
attack and when the accuracy of all of them is zero. For instance, some
misclassify the adversarial examples of a class into a small subset of
classes, while the misclassifications of other models are much more spread
out.

Furthermore, we warn about the choice of data pre-processing procedures and
the effect of such transformations on the perturbations added to the clean
inputs. Certain techniques can exacerbate these perturbations before the data
reaches the first layer of the network, which in a way makes it easier for the
attacker to succeed in generating an adversarial example under a certain
perturbation budget. For this reason, it might be worth including this
component in the search process of NE approaches. Moreover, all training
conditions, including any model-specific pre-processing step, should be
clearly specified when evaluating adversarial robustness, especially when
comparing models from different sources.

The remainder of this paper is structured as follows. Section II provides an
overview of NE approaches and adversarial machine learning, and presents
relevant work on the intersection of the two fields. Section III describes our
experimental setup in terms of datasets, models, adversarial attacks, and
evaluation metrics. Section IV presents the results of the experimental
campaign and discusses our main findings. Section V concludes the paper.

##  II Background and Related Work

In this section, we overview key concepts and methods from the fields of
NeuroEvolution (NE) and adversarial machine learning, after which we present
relevant work on the intersection of these two areas of research. We mainly
focus on image classification and Convolutional Neural Networks (CNNs).

###  II-A NeuroEvolution

Neural Architecture Search (NAS) is the field which deals with designing the
optimal architecture of an ANN in an automated way. Different search
strategies have been proposed, including Reinforcement Learning [15, 16, 17],
Evolutionary Computation [1, 2, 3, 4, 5, 18], as well as gradient-based
methods [19].

NeuroEvolution (NE) approaches, which are the main focus of this work, refer
to those which apply techniques from Evolutionary Computation. Especially
since 2017, remarkable results have been achieved by several NE approaches
that automate the search for CNNs [1, 2, 3, 4, 5, 18]. Two of such proposals,
DENSER [1] and NSGA-Net [3], are described in more detail in what follows.

In DENSER [1], each candidate solution is represented at two levels, the
genetic algorithm (GA) level and the dynamic structured grammatical evolution
(DSGE) [20] level. The GA level encodes the macro structure of the ANN (layers
and order in which they are connected) and any additional hyperparameters
(learning strategy and data augmentation procedures, for instance) as a
sequence of evolutionary units. Each evolutionary unit stores a non-terminal
symbol later used at the DSGE level, as well as the minimum and maximum number
of times the unit can be used. At the DSGE level, the parameters of the
evolutionary units (e.g., layer type, number of filters, filter size,
activation functions) are encoded through a context-free grammar. DENSER uses
crossover and mutation operators at both levels.

NSGA-Net [3] is explicitly designed to solve a multi-objective optimization
problem. It uses the NSGA-II algorithm [21] to maintain a trade-off frontier
between candidate solutions that maximize classification performance but
minimize computational complexity (defined by the number of floating-point
operations in the forward pass). Each candidate solution is represented by a
bit string that encodes computational blocks (referred to as phases). In turn,
each computational block can be regarded as a directed acyclic graph of
several nodes, with each node representing a single operation (e.g.,
convolution, pooling, batch-normalization) or a sequence of operations. This
representation follows the method from [18] with a minor modification. Similar
to DENSER, NSGA-Net also makes use of crossover and mutation operators.
Additionally, at the end of the evolutionary process, ANNs are designed by
sampling phases from a Bayesian Network which models the relationship between
these computational blocks as seen in the architectures found during the
search procedure.

In practice, NSGA-Net constrains the search space based on prior knowledge of
successful architectures. Namely, the number of phases and the maximum number
of nodes on each phase are set to 3 and 6, respectively, and the changes in
spatial resolution between phases are also fixed. Moreover, each node
encompasses the same sequence of operations. When it comes to DENSER, the main
restriction is at the GA level in how the different layers can be connected
(i.e., layers are connected sequentially without skip-connections). In the
original work, the search space includes CNNs of up to 40 hidden-layers (30
convolution or pooling layers, at most, followed by a maximum of 10 fully-
connected layers).

###  II-B Adversarial Machine Learning

Adversarial examples are maliciously crafted so as to make an attacked model
produce incorrect outputs [9, 22]. Throughout the years, several methods have
been proposed in the literature to craft such attacks, under different threat
models. These threat models can be defined based on the goals, knowledge, and
capabilities of the adversary [10].

A distinction can be made based on the adversary’s knowledge about the model:
architecture and parameters, training algorithm and training data, randomness
at test-time, and allowed level of query access [23]. In this work, we focus
on white-box attacks, where the adversary has full access to the model.

A further distinction can be made between untargeted and targeted attacks. In
the particular case of image classification tasks, the goal of untargeted
attacks is simply to make the model predict a class different from the true
label of a given instance, while the goal of targeted attacks is to make the
model produce a misclassification into some desired class [8]. Formally, $x$
is an input with correct label $y$ and $C$ is the classifier under attack. In
the untargeted setting, an adversarial example $x^{adv}$ is such that
$C(x^{adv})\neq y$. On the other hand, a targeted attack would aim at crafting
$x^{adv}$ given a target $t\neq y$ such that $C(x^{adv})=t$.

An adversarial example is usually obtained by adding some perturbation
$\delta$ to a benign image [22]. Constraints are usually imposed on the
capabilities of the adversary in terms of the maximum perturbation that can be
added, so that $x^{adv}$ remains close to the original input and its true
label remains unchanged [10]. In the image domain, a common approach is to use
$L_{p}$-norms for those bounds such that
$\left\|x-x^{adv}\right\|_{p}\leq\epsilon$, where $\epsilon$ is the
perturbation budget and usually $p\in\left\\{0,1,2,\infty\right\\}$ [10, 24].

Optimization-based methods are an important category of white-box attacks.
Some of such methods try to minimize the perturbation, while others try to
maximize some loss function (typically the cross-entropy loss) [23, 24]. We
present some of the latter methods assuming an untargeted setting.

The fast gradient sign method (FGSM) [6] is a one-step gradient-based attack
optimized for the $L_{\infty}$-norm which generates an adversarial example as:

$x^{adv}=x+\epsilon\cdot\operatorname{sign}\left(\nabla_{x}L(x,y)\right)$

where $\nabla_{x}L(x,y)$ is the gradient of the cross-entropy loss with
respect to the input image. When this method is optimized for the
$L_{2}$-norm, we obtain the fast gradient method (FGM) which generates an
adversarial example as:

$x^{adv}=x+\epsilon\cdot\frac{\nabla_{x}L(x,y)}{\left\|\nabla_{x}L(x,y)\right\|_{2}}$

In both cases, the perturbed image should be clipped in order to maintain a
valid data range.

We present the methods that follow for $L_{\infty}$ adversaries, but these
definitions can be easily adapted to the case where $L_{2}$ bounds are
imposed, similar to what is done with FGM.

A straightforward extension of the FGSM attack is to take multiple small steps
(with step size $\alpha$) and clip the result by $\epsilon$ at each iteration.
The clipping operation also takes into account the valid range of data values.
This results in the basic iterative method (BIM) [13] which can be defined as:

$x^{adv}_{0}=x,$
$x^{adv}_{i+1}=\operatorname{clip}_{\epsilon}\left\\{x^{adv}_{i}+\alpha\cdot\operatorname{sign}\left(\nabla_{x}L(x^{adv}_{i},y)\right)\right\\}$

The projected gradient descent (PGD) method [14] is another iterative attack
which only differs from BIM on how $x^{adv}_{0}$ is set. In the case of PGD,
instead of starting from the original input, a random perturbation bounded by
$\epsilon$ is generated and added to $x$.

In an attempt to stabilize the update directions and escape from local optima,
the momentum iterative fast gradient sign method (MI-FGSM) [24] incorporates
momentum [25] into the BIM method. The Auto-PGD (APGD) method [26] is a
variation of the PGD attack which adjusts the step size in an automated way.
The authors of APGD also proposed an alternative to the cross-entropy loss
called difference of logits ratio (DLR) loss. In addition to being invariant
to shifts of the logits, the DLR loss is rescaling invariant [26].

Adversarial robustness evaluations typically consist of performing adversarial
attacks to obtain an upper bound of the robustness of a model [11]. One
resorts to this approximation since computing it exactly is usually
intractable [10, 11].

Several defenses against adversarial examples have been proposed in the
literature. Such defenses tend to be designed to be robust to one specific
threat model [10]. Adversarial training [14], and variants like ensemble
adversarial training [27], have shown the most promising results when it comes
to increasing the robustness of models. The main idea behind these methods is
to incorporate adversarial examples in the training procedure of a model. Many
of the other methods were circumvented shortly after their proposal [23, 28].

###  II-C Related Work

RobustBench [11] aims at benchmarking adversarial robustness under different
threat models, namely $L_{p}$-robustness with $p\in\left\\{2,\infty\right\\}$
and common image corruptions [29]. In addition to a leaderboard aggregating
the evaluations of several robustness-enhancing proposals, a Model Zoo
containing pre-trained models from top entries of the leaderboard is also
available. While the primary goal of RobustBench is to assess defenses against
adversarial attacks, we focus on the general robustness of a model from an
architectural point-of-view.

In [30], a comparison is made between CNNs and more recent architectures, such
as the Vision Transformer [31] and the MLP-Mixer [32], which have achieved
promising results in computer vision tasks. This work relates to ours in that
architectural differences are at the core of the analysis, but we solely focus
on CNNs and try to establish a comparison between hand-crafted models and
models that result from an evolutionary search.

The experiments conducted by [33] are closer to our approach since the authors
also look at adversarial robustness from an architectural perspective and
include both manually-designed architectures and architectures found by NAS
approaches (such as an NSGA-Net model) in their analysis. In contrast to this
work, we focus only on NeuroEvolution methods. Moreover, we consider not only
$L_{\infty}$-robustness but also $L_{2}$-robustness, and we try to perform
attacks that bring the accuracy of at least one of the target models to zero
under each threat model.

There is also a growing body of work that uses NAS approaches, including NE,
to find robust models [34, 35, 36]. However, and as pointed out by [33],
adversarial training is often incorporated in these studies. Thus, it is
difficult to assess the role of architectural aspects on the robustness
exhibited by the models. In the case of [36], robustness is explicitly
included in the objective function, once again making it difficult to
understand if the models found by NE are inherently more robust than the ones
crafted by humans.

##  III Experimental Setup

In this section, we detail the methodology followed to evaluate the
adversarial robustness of the models. We conduct all the experiments on the
CIFAR-10 dataset [12], which consists of $32\times 32$ RGB images divided into
10 classes. The training set has 50000 images while the test set has 10000,
with an equal number of examples from each class. The original pixel values
are in $\left[0,255\right]$, but we always operate on pixels modeled as real
numbers by applying a pre-processing step to normalize the values to the
interval $\left[0,1\right]$.

###  III-A Target Models

We evaluate models designed by two NE approaches: DENSER [1] and NSGA-Net [3].
This choice was mainly based on two criteria: firstly, models had to be
directly trained on the CIFAR-10 dataset, and secondly, pre-trained models
(i.e., network weights) had to be publicly available, so as to introduce as
little bias as possible from our end. In fact, all the attacked models are
pre-trained and publicly available. We use these models directly, without re-
training them, but describe some relevant differences in the training
procedures.

The WRN-28-10 architecture [37], a manually-designed wide residual network, is
used as the baseline model in our experiments for a variety of reasons: its
performance on CIFAR-10 is similar to that of the models from the two NE
approaches, the work which proposes NSGA-Net [3] also uses it as a baseline,
and some of the defenses from the RobustBench leaderboard [11] are based on
this architecture. In particular, we use the pre-trained model from the Model
Zoo of RobustBench 111https://github.com/RobustBench/robustbench, which was
trained with the 50000 training images of CIFAR-10, without any data
augmentation. Besides converting the pixel values to $\left[0,1\right]$ as
previously described, no further pre-processing is applied to the data.

In what concerns DENSER [1], we select the network that achieved the best
accuracy on the CIFAR-10 test set over 10 evolutionary runs. The models
resulting from 5 independent training runs of this network are publicly
available 222https://github.com/fillassuncao/denser-models, but, again, we
solely attack the one with the highest test accuracy. In these training runs,
the original work used the complete training set of CIFAR-10 and applied a
data augmentation method which includes padding, horizontal flipping, and
random crops (similar to what is done in [5]). In addition to converting the
pixel values to real numbers, the data is expected to be centered around zero
before being fed to the first layer of the network. Following [1], this is
accomplished through the removal of the mean pixel value per location and
color channel (calculated on the entire training set).

As far as the NSGA-Net approach [3] is concerned, we conduct experiments with
a pre-trained model from the macro search space described in Section II-A
(NSGA-M), as well as three variants of the architecture obtained by using the
cells found by NSGA-Net on the NASNet micro search space [38] (NSGA-mA, NSGA-
mB, and NSGA-mC with an increasingly higher number of model parameters, as
shown in Table I). In the original work, cutout [39] was used to train these
models, together with a data augmentation strategy similar to the one adopted
by DENSER, which includes padding, random crops, and horizontal flipping. For
the three models from the micro search space, the scheduled path dropout
technique [38] was also adopted, together with an auxiliary head classifier,
whose loss is aggregated with the loss from the main network [3]. After
converting the pixel values to real numbers, the data is expected to be
normalized using pre-calculated means and standard deviations for each color
channel. Further details about these architectures and training procedure can
be found in the original paper [3] and the source code repository
333https://github.com/ianwhale/nsga-net.

An overview of the size of the models used in our experiments, as given by the
number of trainable parameters, is presented in Table I.

TABLE I: Overview of the models in terms of number of parameters and accuracy on the clean examples of the CIFAR-10 test set. Model | Number of Parameters | Clean Accuracy
---|---|---
WRN-28-10 | 36.48M | 94.78%
DENSER | 10.81M | 93.70%
NSGA-M | 3.37M | 96.27%
NSGA-mA | 1.97M | 97.57%
NSGA-mB | 2.20M | 97.78%
NSGA-mC | 4.05M | 97.98%

###  III-B Threat Models and Attacks

Since all models are publicly available, we consider the scenario in which the
attacker has full access to the target model, i.e., we perform white-box
attacks. Furthermore, we consider untargeted attacks, where the adversarial
perturbations are bounded by $\epsilon=8/255$ under the $L_{\infty}$-norm or,
in the case of the $L_{2}$-norm, by $\epsilon=0.5$. The perturbation budgets
$\epsilon$ were chosen based on threat models used in previous works, namely
in the RobustBench benchmark [11].

We focus on attacks that craft adversarial examples by solving a constrained
optimization problem instead of attacks that aim at finding minimal
adversarial perturbations. Therefore, we attack the chosen models using
different configurations (number of iterations and number of random
initializations) of FGSM / FGM, BIM, and PGD. For the iterative attacks (i.e.,
BIM and PGD), we set the step size to $\alpha=\epsilon/4$. We use the Python
implementations of the attacks by the Adversarial Robustness Toolbox (ART)
library [40].

###  III-C Baseline Performance

The accuracy of the models on the clean examples of the test set is shown in
Table I. For a fair comparison, we only generate adversarial examples on
samples that initially receive a correct classification by the model under
evaluation. Nevertheless, when reporting the models’ accuracy of adversarially
generated samples, we consider the complete test set of CIFAR-10. It is
important to mention that an untargeted attack is considered to be successful
if the model produces a misclassification, regardless of the predicted class.
For this reason, no perturbation needs to be added to a sample that is already
incorrectly classified.

While the DENSER models are implemented in Keras / TensorFlow 2, the baseline
and the NSGA-Net models are in PyTorch. We reiterate that all models were
trained using a standard procedure and no defensive method was applied.

##  IV Results and Discussion

The accuracy of the models on the adversarial examples generated under the
threat model that considers $L_{\infty}$-robustness is shown in Table II. We
present the results for the FGSM attack, for FGSM with 10 random
initializations (FGSM-10), and for the BIM attack with 10 and 50 iterations
(BIM-10 and BIM-50, respectively). In this case, the attacks operate in
$\left[0,1\right]$ and any additional model-specific pre-processing is applied
to the images after the adversarial perturbations are added.

A brief perusal of the results reveals that the DENSER model is the most
susceptible to $L_{\infty}$ attacks. Even in the case of single-step attacks
like FGSM, the accuracy falls below 10% when random restarts are incorporated.
On the other hand, the models that result from the application of NSGA-Net to
the NASNet search space are the most resistant to single-step attacks. In
fact, they achieve higher accuracy on the adversarially perturbed images than
the baseline model. Nevertheless, given enough iterations, the accuracy of all
models drops to zero under this threat model. This suggests that these NE
approaches do not seem to find $L_{\infty}$-robust models, at least if that
objective is not explicitly included in the evolutionary process.

Table II also shows the adversarial accuracy of the models under the threat
model that considers $L_{2}$-bounded perturbations. We present the results for
the FGM attack, for the BIM attack with 10, 50, and 100 steps (BIM-10, BIM-50,
and BIM-100, respectively), as well as for the PGD attack with 10 random
restarts and 50 iterations (PGD-50-10). We again report the results when the
attacks operate in $\left[0,1\right]$ and any additional model-specific pre-
processing is applied after the adversarial perturbations are added to the
images.

TABLE II: Accuracy on the CIFAR-10 test set when the attacks operate in $\left[0,1\right]$. The highest reported accuracy under each attack is in bold. | WRN-28-10 | DENSER | NSGA-M | NSGA-mA | NSGA-mB | NSGA-mC
---|---|---|---|---|---|---
$L_{\infty}$ $\epsilon=8/255$ | FGSM | 28.85% | 16.37% | 35.08% | 52.09% | 51.86% | 55.06%
FGSM-10 | 11.03% | 6.19% | 9.28% | 25.02% | 22.49% | 26.92%
BIM-10 | 0.02% | 0.00% | 0.00% | 0.16% | 0.00% | 0.02%
BIM-50 | 0.00% | 0.00% | 0.00% | 0.00% | 0.00% | 0.00%
$L_{2}$ $\epsilon=0.5$ | FGM | 47.61% | 44.76% | 48.51% | 61.34% | 60.61% | 64.06%
BIM-10 | 2.01% | 30.76% | 0.23% | 3.04% | 0.73% | 2.57%
BIM-50 | 0.16% | 24.13% | 0.00% | 0.26% | 0.01% | 0.35%
BIM-100 | 0.09% | 21.76% | 0.00% | 0.12% | 0.00% | 0.23%
PGD-50-10 | 0.08% | 18.10% | 0.00% | 0.11% | 0.00% | 0.21%
TABLE III: Accuracy on the CIFAR-10 test set when all model-specific pre-processing is applied to the original inputs before performing the attacks. The highest reported accuracy for each attack is in bold. | DENSER | NSGA-M | NSGA-mA | NSGA-mB | NSGA-mC
---|---|---|---|---|---
$L_{\infty}$ $\epsilon=8/255$ | FGSM | 16.37% | 46.65% | 60.61% | 61.57% | 63.64%
FGSM-10 | 6.16% | 40.82% | 58.41% | 58.88% | 60.97%
BIM-10 | 0.00% | 2.70% | 12.22% | 8.36% | 12.70%
BIM-50 | 0.00% | 0.81% | 6.87% | 3.86% | 6.96%
$L_{2}$ $\epsilon=0.5$ | FGM | 44.75% | 67.96% | 78.11% | 77.70% | 80.12%
BIM-10 | 30.77% | 25.98% | 48.60% | 44.80% | 49.61%
BIM-50 | 24.13% | 17.57% | 41.63% | 37.43% | 42.04%
BIM-100 | 21.76% | 16.86% | 40.72% | 36.46% | 41.09%
PGD-50-10 | 18.10% | 15.99% | 40.10% | 35.38% | 40.05%
TABLE IV: Accuracy on the CIFAR-10 test set when the attacks operate in $\left[0,1\right]$, but the generated images are post-processed. The highest reported accuracy for each attack is in bold. | WRN-28-10 | DENSER | NSGA-M | NSGA-mA | NSGA-mB | NSGA-mC
---|---|---|---|---|---|---
$L_{\infty}$ $\epsilon=8/255$ | FGSM | 28.85% | 16.38% | 35.08% | 52.09% | 51.86% | 55.06%
FGSM-10 | 11.15% | 6.28% | 9.45% | 25.19% | 22.70% | 27.13%
BIM-10 | 0.02% | 0.00% | 0.00% | 0.16% | 0.00% | 0.02%
BIM-50 | 0.00% | 0.00% | 0.00% | 0.00% | 0.00% | 0.00%
$L_{2}$ $\epsilon=0.5$ | FGM | 47.69% | 44.86% | 48.62% | 61.46% | 60.82% | 64.24%
BIM-10 | 2.02% | 30.77% | 0.23% | 3.10% | 0.75% | 2.67%
BIM-50 | 0.16% | 24.13% | 0.00% | 0.26% | 0.01% | 0.38%
BIM-100 | 0.09% | 21.76% | 0.00% | 0.12% | 0.00% | 0.24%
PGD-50-10 | 0.08% | 18.10% | 0.00% | 0.14% | 0.01% | 0.23%

The strongest $L_{2}$ attacks in our analysis (BIM-100 and PGD-50-10) bring
the accuracy of the models to below 1% and, in the case of NSGA-M and NSGA-mB,
to zero. Surprisingly, and contrary to what was observed with the $L_{\infty}$
attacks, this does not hold true for the DENSER model whose accuracy just
drops to around 20% under this threat model. However, the DENSER model remains
the most susceptible under the single-step FGM attack, while the NSGA-Net
models from the search space of NASNet remain the most robust.

Moreover, a comparison between the three NSGA-Net models from the micro search
space reveals that NSGA-mB is the least robust of the three, even though it is
more complex (i.e., it has a higher number of parameters) than NSGA-mA. This
is observed under both distance metrics, but the susceptibility of NSGA-mB is
particularly higher than that of NSGA-mA and NSGA-mC under the BIM-10 attack
with $L_{2}$ perturbations. Unlike NSGA-mA and NSGA-mC, NSGA-mB does not use
Squeeze-and-Excitation blocks. Thus, it seems that Squeeze-and-Excitation may
help improve the robustness of an ANN, an hypothesis worth investigating in
future work. The discrepancies in the relative robustness of the models
between the two distance metrics demands further analysis. Namely, it would be
of interest to understand what aspect of the DENSER model makes it more
$L_{2}$-robust and why it does not seem to help the model against $L_{\infty}$
attacks.

###  IV-A Impact of Data Pre-Processing

In Section III, we described the different pre-processing steps applied to the
images before they reach the first layer of each model. Contrary to WRN-28-10
and DENSER, the pre-processing for the NSGA-Net models changes the scale of
the data (i.e., the difference between the maximum and the minimum values of a
feature is larger than 1). Therefore, the NSGA-Net models perceive the
adversarial perturbations as approximately 4 times larger than the
perturbation budget of the threat model. To show this effect, we craft
adversarial examples after all the pre-processing steps have been applied to
the data, instead of operating in the $\left[0,1\right]$ range. By doing so,
the perturbation budget refers to the distance in the space in which the first
layer of a network expects the data to be.

The results of this experiment are shown in Table III for both the
$L_{\infty}$ and the $L_{2}$ attacks. The baseline model is excluded from this
analysis since it only requires the data to be in $\left[0,1\right]$, without
centering or standardizing it. We can see that, as expected, there is no
significant difference between these results and those from Table II regarding
the DENSER model. On the other hand, the robustness of the NSGA-Net models
appears to be much higher, especially in the case of $L_{2}$-bounded
perturbations. This shows that the choice of data pre-processing should not be
neglected when designing networks under scenarios where adversarial attacks
may be of concern. In the particular case of NE approaches, one might even
consider including this design choice in the evolutionary process.
Additionally, works that focus on robustness evaluations should clearly
specify the conditions under which the models were trained, including any
model-specific pre-processing step.

We also evaluate the impact of converting the pixel values back to integers,
such that each value is between 0 and 255. We just consider the case in which
the attacks operate in the range $\left[0,1\right]$ and any additional pre-
processing is applied after the perturbations have been added to the images.
Therefore, we multiply each pixel value by 255 and round to the nearest even
integer. We then re-apply all pre-processing steps required by the model and
report the accuracy on the post-processed examples. Table IV shows the results
for the attacks under both distance metrics.

For the $L_{\infty}$ attacks, differences are mainly detected when random
restarts are incorporated (FGSM-10). The attack success rate slightly
deteriorates, but the differences are of less than 0.25% and seem negligible.
As far as the $L_{2}$-bounded attacks are concerned, the largest differences
occur with FGM but also seem negligible (always of less than 0.25%). The
success of the attacks is mostly affected by this post-processing procedure
when their target is an NSGA-Net model from the NASNet search space.

(a) BIM-50, $L_{\infty}$-constrained

(b) BIM-100, $L_{2}$-constrained

Figure 1: Confusion matrices for the WRN-28-10 model under two attacks.

###  IV-B Analyzing Misclassifications through Confusion Matrices

To complement our analysis, we looked into the confusion matrices of each
model under different attacks. Even when an attack brings the accuracy of all
models to zero (e.g., the $L_{\infty}$-constrained BIM-50 attack), different
patterns in their misclassifications can be observed.

As shown in Fig. 1a, under an $L_{\infty}$-bounded BIM-50 attack, WRN-28-10
produces misclassifications for each class that are spread out across the
remaining classes. Moreover, it seems to favor mainly two classes, bird and
cat, with most examples being misclassified as such. Under the
$L_{2}$-constrained BIM-100 attack (Fig. 1b), the misclassifications of
classes that represent a means of transportation (airplane, automobile, ship,
and truck) are more clustered together.

(a) BIM-50, $L_{\infty}$-constrained

(b) BIM-100, $L_{2}$-constrained

Figure 2: Confusion matrices for the DENSER model under two attacks.

Fig. 2a shows that, under the $L_{\infty}$-constrained BIM-50 attack, the
predictions of the DENSER model can be clearly grouped into clusters, with
most examples from one class being misclassified into a smaller subset of the
other classes than with the baseline model. Images that represent an animal
are mainly misclassified as another animal, while images of a means of
transportation are misclassified as another vehicle. The confusion matrix of
DENSER under the BIM-100 attack constrained by the $L_{2}$-norm is shown in
Fig. 2b. Contrary to the $L_{\infty}$ attack, the BIM-100 attack is unable to
decrease the accuracy to zero, and so, some images are correctly classified.
Notwithstanding, the misclassifications follow a pattern similar to that shown
in Fig. 2a. The automobile and the truck classes are the most difficult to
attack under this threat model, while it is easier to cause a
misclassification of airplane instances.

(a) NSGA-M

(b) NSGA-mA

(c) NSGA-mB

(d) NSGA-mC

Figure 3: Confusion matrices for the NSGA-Net models under the BIM-50 attack
with $L_{\infty}$-bounded perturbations. The results under BIM-100 with
$L_{2}$-bounded perturbations revealed similar patterns.

According to Fig. 3a, and similar to the baseline model, most examples are
also misclassified as bird and cat with NSGA-M. However, misclassifications of
a single class are less spread out between the remaining classes, especially
in the case of bird, cat, ship, and truck. The three NSGA-Net models from the
NASNet search space show similar patterns in their misclassifications. The
main distinguishing factor is the spread of the misclassifications of each
class: NSGA-mB misclassifies the majority of the examples from one class into
fewer classes than NSGA-mC (check, for instance, the ship class), and NSGA-mA
is in the middle of the spectrum. Similar to NSGA-M, most misclassifications
of these three models also fall into the cat class (especially with NSGA-mA).
However, the second most predicted class is dog and not bird.

The confusion matrices for the BIM-100 attack with $L_{2}$-bounded
perturbations exhibit similar patterns. In comparison with the BIM-50 attack
with $L_{\infty}$ constraints, less examples are misclassified by the three
models from the micro search space as belonging to the cat class, especially
in the case of NSGA-mB. With NSGA-M and NSGA-mB, some changes are also
observed with the misclassification of examples that originally belong to the
ship class.

##  V Conclusion and Future Work

Artificial Neural Networks designed through evolution achieve competitive
results with respect to predictive performance, but the study of their
adversarial robustness is limited. In this work, we assessed the $L_{\infty}$
and $L_{2}$-robustness of models found by NeuroEvolution approaches for the
CIFAR-10 classification task, under white-box untargeted attacks. No defense
against adversarial examples was incorporated in the models or in their
training.

Our results show that, similar to human-designed networks, the accuracy of
these evolved models usually drops to zero (or close to zero). The main
exception occurs with the DENSER model, which shows some resistance to $L_{2}$
attacks, with the accuracy dropping to 18.10% under a PGD attack. We
identified distinct patterns in the misclassifications produced by the models:
in some cases, the adversarial examples from one class are misclassified into
a small subset of classes, while with other models the misclassifications are
much more spread out between classes. Furthermore, the choice of data pre-
processing techniques must not be neglected when automatically designing CNNs.
We have shown that certain procedures can exacerbate the adversarial
perturbations before they reach the first layer of the network, this way
potentially jeopardizing robustness. However, extending current NE approaches
so as to include this design choice in their search is not always
straightforward (i.e., NSGA-Net).

We plan on studying the $L_{2}$-robustness of the DENSER model so as to
understand if it can be attributed to some architectural feature. That
invaluable knowledge could be leveraged to build robust models. We tried to be
as faithful as possible to the original works under analysis, which came with
some disadvantages. Namely, each model was trained under slightly different
configurations, including distinct data pre-processing approaches. It would be
interesting to re-train all the models under the exact same conditions so as
to make sure that the observed differences truly arise from architectural
aspects. Although previous work suggests that higher network capacity allows
for robustness improvements, analyzing the relationship between the
adversarial robustness and the computational complexity of a model still needs
further investigation.

Since we solely analyzed pre-trained models for CIFAR-10, a clear extension to
our work would be to consider other, more complex, datasets. Future work also
comprises assessing the adversarial robustness of models found by NE
approaches under additional threat models, such as transfer and universal
attacks.

## Acknowledgments

This work is partially funded by national funds through the FCT - Foundation
for Science and Technology, I.P., within the scope of the project CISUC -
UID/CEC/00326/2020 and by European Social Fund, through the Regional
Operational Program Centro 2020. It is also partially supported by the project
METRICS (POCI-01-0145-FEDER-032504), co-funded by FCT and by the Fundo Europeu
de Desenvolvimento Regional (FEDER) through Portugal 2020 - Programa
Operacional Competitividade e Internacionalização (POCI). The first author is
partially funded by FCT under the individual grant UI/BD/151047/2021.

## References

  * [1] F. Assunçao, N. Lourenço, P. Machado, and B. Ribeiro, “DENSER: Deep evolutionary network structured representation,” _arXiv preprint arXiv:1801.01563_ , 2018.
  * [2] H. Liu, K. Simonyan, O. Vinyals, C. Fernando, and K. Kavukcuoglu, “Hierarchical representations for efficient architecture search,” in _International Conference on Learning Representations_ , 2018.
  * [3] Z. Lu, I. Whalen, V. Boddeti, Y. Dhebar, K. Deb, E. Goodman, and W. Banzhaf, “NSGA-Net: Neural architecture search using multi-objective genetic algorithm,” in _Proceedings of the Genetic and Evolutionary Computation Conference_ , 2019, p. 419–427.
  * [4] E. Real, A. Aggarwal, Y. Huang, and Q. V. Le, “Regularized evolution for image classifier architecture search,” in _Proceedings of the AAAI Conference on Artificial Intelligence_ , vol. 33, no. 01, 2019, pp. 4780–4789.
  * [5] M. Suganuma, S. Shirakawa, and T. Nagao, “A genetic programming approach to designing convolutional neural network architectures,” in _Proceedings of the Genetic and Evolutionary Computation Conference_ , 2017, p. 497–504.
  * [6] I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” in _International Conference on Learning Representations_ , 2015. [Online]. Available: http://arxiv.org/abs/1412.6572
  * [7] C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. J. Goodfellow, and R. Fergus, “Intriguing properties of neural networks,” in _International Conference on Learning Representations_ , 2014. [Online]. Available: http://arxiv.org/abs/1312.6199
  * [8] N. Carlini and D. A. Wagner, “Towards evaluating the robustness of neural networks,” in _2017 IEEE Symposium on Security and Privacy (SP)_. IEEE Computer Society, 2017, pp. 39–57.
  * [9] Y. Dong, Q. Fu, X. Yang, T. Pang, H. Su, Z. Xiao, and J. Zhu, “Benchmarking adversarial robustness on image classification,” in _2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition CVPR_ , 2020, pp. 318–328.
  * [10] N. Carlini, A. Athalye, N. Papernot, W. Brendel, J. Rauber, D. Tsipras, I. Goodfellow, A. Madry, and A. Kurakin, “On evaluating adversarial robustness,” _arXiv preprint arXiv:1902.06705_ , 2019.
  * [11] F. Croce, M. Andriushchenko, V. Sehwag, E. Debenedetti, N. Flammarion, M. Chiang, P. Mittal, and M. Hein, “RobustBench: a standardized adversarial robustness benchmark,” _arXiv preprint arXiv:2010.09670_ , 2020\.
  * [12] A. Krizhevsky, “Learning multiple layers of features from tiny images,” University of Toronto, Tech. Rep., 2009.
  * [13] A. Kurakin, I. Goodfellow, and S. Bengio, “Adversarial examples in the physical world,” _arXiv preprint arXiv:1607.02533_ , 2016.
  * [14] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” in _International Conference on Learning Representations_ , 2018.
  * [15] H. Pham, M. Guan, B. Zoph, Q. Le, and J. Dean, “Efficient neural architecture search via parameters sharing,” in _International Conference on Machine Learning_ , 2018.
  * [16] Z. Zhong, J. Yan, W. Wu, J. Shao, and C. Liu, “Practical block-wise neural network architecture generation,” in _2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)_ , 2018, pp. 2423–2432.
  * [17] B. Zoph and Q. V. Le, “Neural architecture search with reinforcement learning,” _arXiv preprint arXiv:1611.01578_ , 2016.
  * [18] L. Xie and A. Yuille, “Genetic CNN,” in _2017 IEEE International Conference on Computer Vision (ICCV)_ , 2017, pp. 1388–1397.
  * [19] H. Liu, K. Simonyan, and Y. Yang, “DARTS: Differentiable architecture search,” in _International Conference on Learning Representations_ , 2019\.
  * [20] N. Lourenço, F. Assunção, F. B. Pereira, E. Costa, and P. Machado, “Structured grammatical evolution: A dynamic approach,” in _Handbook of Grammatical Evolution_ , C. Ryan, M. O’Neill, and J. J. Collins, Eds. Springer, 2018, pp. 137–161.
  * [21] K. Deb, S. Agrawal, A. Pratap, and T. Meyarivan, “A fast elitist non-dominated sorting genetic algorithm for multi-objective optimisation: NSGA-II,” in _Parallel Problem Solving from Nature - PPSN VI_ , ser. Lecture Notes in Computer Science, M. Schoenauer, K. Deb, G. Rudolph, X. Yao, E. Lutton, J. J. M. Guervós, and H. Schwefel, Eds., vol. 1917. Springer, 2000, pp. 849–858.
  * [22] J. Jacobsen, J. Behrmann, N. Carlini, F. Tramèr, and N. Papernot, “Exploiting excessive invariance caused by norm-bounded adversarial robustness,” _arXiv preprint arXiv:1903.10484_ , 2019.
  * [23] A. Athalye, N. Carlini, and D. Wagner, “Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples,” in _International Conference on Machine Learning_ , 2018.
  * [24] Y. Dong, F. Liao, T. Pang, H. Su, J. Zhu, X. Hu, and J. Li, “Boosting adversarial attacks with momentum,” in _2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)_ , 2018, pp. 9185–9193.
  * [25] I. Sutskever, J. Martens, G. Dahl, and G. Hinton, “On the importance of initialization and momentum in deep learning,” in _International Conference on Machine Learning_ , 2013.
  * [26] F. Croce and M. Hein, “Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks,” in _International Conference on Machine Learning_ , 2020.
  * [27] F. Tramèr, A. Kurakin, N. Papernot, I. Goodfellow, D. Boneh, and P. McDaniel, “Ensemble adversarial training: Attacks and defenses,” in _International Conference on Learning Representations_ , 2018.
  * [28] F. Tramèr, N. Carlini, W. Brendel, and A. Madry, “On adaptive attacks to adversarial example defenses,” in _Conference on Neural Information Processing Systems (NeurIPS)_ , 2020.
  * [29] D. Hendrycks and T. Dietterich, “Benchmarking neural network robustness to common corruptions and perturbations,” in _International Conference on Learning Representations_ , 2019.
  * [30] P. Benz, C. Zhang, S. Ham, A. Karjauv, and I. S. Kweon, “Robustness comparison of Vision Transformer and MLP-Mixer to CNNs,” _CVPR 2021 Workshop on Adversarial Machine Learning in Real-World Computer Vision Systems and Online Challenges (AML-CV)_ , 2021.
  * [31] A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly, J. Uszkoreit, and N. Houlsby, “An image is worth 16x16 words: Transformers for image recognition at scale,” in _International Conference on Learning Representations_ , 2021.
  * [32] I. O. Tolstikhin, N. Houlsby, A. Kolesnikov, L. Beyer, X. Zhai, T. Unterthiner, J. Yung, A. Steiner, D. Keysers, J. Uszkoreit, M. Lucic, and A. Dosovitskiy, “MLP-Mixer: An all-MLP architecture for vision,” _arXiv preprint arXiv: 2105.01601_ , 2021.
  * [33] C. Devaguptapu, D. Agarwal, G. Mittal, P. Gopalani, and V. N. Balasubramanian, “On adversarial robustness: A neural architecture search perspective,” in _Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV) Workshops_ , 2021, pp. 152–161.
  * [34] M. Guo, Y. Yang, R. Xu, Z. Liu, and D. Lin, “When NAS meets robustness: In search of robust architectures against adversarial attacks,” in _2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition CVPR_ , 2020, pp. 628–637.
  * [35] M. Sinn, M. Wistuba, B. Buesser, M.-I. Nicolae, and M. Tran, “Evolutionary search for adversarially robust neural networks,” _Safe Machine Learning workshop at ICLR_ , 2019.
  * [36] D. V. Vargas and S. Kotyan, “Evolving robust neural architectures to defend from adversarial attacks,” _arXiv preprint arXiv:1906.11667_ , 2019.
  * [37] S. Zagoruyko and N. Komodakis, “Wide residual networks,” in _BMVC_ , 2016\. [Online]. Available: http://arxiv.org/abs/1605.07146
  * [38] B. Zoph, V. Vasudevan, J. Shlens, and Q. V. Le, “Learning transferable architectures for scalable image recognition,” in _2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)_ , 2018, pp. 8697–8710.
  * [39] T. DeVries and G. W. Taylor, “Improved regularization of convolutional neural networks with cutout,” _arXiv preprint arXiv:1708.04552_ , 2017.
  * [40] M.-I. Nicolae, M. Sinn, M. N. Tran, B. Buesser, A. Rawat, M. Wistuba, V. Zantedeschi, N. Baracaldo, B. Chen, H. Ludwig, I. Molloy, and B. Edwards, “Adversarial robustness toolbox v1.2.0,” _arXiv preprint arXiv:1807.01069_ , 2018.


Yutaka Hosotani

# Holography in anomaly flow in orbifold gauge theory

###### Abstract

In orbifold gauge theory and gauge-Higgs unification models, gauge anomaly
flows with an Aharonov-Bohm phase $\theta_{H}$ in the fifth dimension. We
analyze $SU(2)$ gauge theory with doublet fermions in the flat
$M^{4}\times(S^{1}/Z_{2})$ spacetime and in the Randall-Sundrum (RS) warped
space. With orbifold boundary conditions the $U(1)$ part of gauge symmetry
remains unbroken at $\theta_{H}=0$ and $\pi$. Chiral anomalies smoothly vary
with $\theta_{H}$ in the RS space. Anomaly coefficients associated with this
anomaly flow are expressed in terms of the values of the wave functions of
gauge fields at the UV and IR branes in the RS space and parity conditions of
fermion fields. Holography in anomaly flow is observed. Conditions for the
anomaly cancellation turn out independent of $\theta_{H}$.

##  1 Introduction

Chiral fermions generally induce chiral anomaly.[1, 2, 3] Even for massive
fermions chiral anomaly can be generated if gauge couplings are not purely
vector-like. Something special happens in gauge-Higgs unification (GHU), in
which gauge symmetry is dynamically broken by an Aharonov-Bohm (AB) phase
$\theta_{H}$ in the fifth dimension.[4, 5, 6] It has been noticed in the GUT
inspired $SO(5)\times U(1)_{X}\times SU(3)_{C}$ GHU in the Randall-Sundrum
(RS) warped space [7] that quarks and leptons are massless and purely chiral
at $\theta_{H}=0$, become massive at $\theta_{H}\not=0$, and smoothly become
vector-like at $\theta_{H}=\pi$. Gauge bosons such as $W$ and $Z$ bosons are
massless gauge bosons of $SU(2)_{L}\times U(1)_{Y}$ at $\theta_{H}=0$, become
massive at $\theta_{H}\not=0$, and smoothly converted to massless gauge bosons
of $SU(2)_{R}\times U(1)_{Y^{\prime}}$ at $\theta_{H}=\pi$. This prompts the
following question. What happens to the anomaly generated by chiral quarks and
leptons at $\theta_{H}=0$? Does it disappear at $\theta_{H}=\pi$? What is the
fate of chiral anomaly?

To pin down what is going on in GHU formulated on orbifolds, the dependence of
chiral anomaly on the AB phase $\theta_{H}$ in $SU(2)$ gauge theory with
doublet fermions in the flat $M^{4}\times(S^{1}/Z_{2})$ space and in the RS
warped space has been investigated in Refs. [8, 9]. In the flat
$M^{4}\times(S^{1}/Z_{2})$ space the mass spectrum of the Kaluza-Klein (KK)
modes of gauge bosons and fermions changes linearly in $\theta_{H}$, namely as
$m_{n}=|n+(\theta_{H}/\pi)|/R$ or $|n+(\theta_{H}/2\pi)|/R$, so that the level
crossing takes place where $\theta_{H}$ is a multiple of
$\hbox{$\frac{1}{2}$}\pi$ or $\pi$. In the RS space there occurs no level
crossing in the mass spectrum. The spectrum varies smoothly as $\theta_{H}$
changes from 0 to $2\pi$. The lowest mode remains as the lowest mode for any
$\theta_{H}$. Gauge couplings of right- and left-handed modes of fermions vary
smoothly as $\theta_{H}$, and the magnitude of chiral anomaly also changes as
$\theta_{H}$. The anomaly coefficient (defined below) coming from one doublet
fermion changes from $2$ at $\theta_{H}=0$ to $0$ at $\theta_{H}=\pi$. The
anomaly flows with the AB phase $\theta_{H}$.

Furthermore it was shown that the magnitude of the total anomaly evaluated by
summing contributions coming from all KK modes of fermions running along
internal loops is expressed in terms of the values of the wave functions of
the gauge fields at the two branes (the UV and IR branes in the RS space) and
the parity conditions of fermion fields at the two branes. Each fermion field
in the RS space is characterized by its own bulk mass parameter $c$ which
controls its mass and wave function at general $\theta_{H}$. Although the
anomaly coming from each KK mode depends on the bulk mass parameter $c$, the
total anomaly does not depend on $c$. There emerges a holographic formula for
the total anomaly. This holography becomes crucial to have the cancellation of
gauge anomalies in GHU.

##  2 $SU(2)$ GHU in $M^{4}\times(S^{1}/Z_{2})$

Let us first consider $SU(2)$ GHU in the flat $M^{4}\times(S^{1}/Z_{2})$
spacetime with coordinate $x^{M}$ ($M=0,1,2,3,5$, $x^{5}=y$) whose action is
given by

$\displaystyle I_{\rm flat}$ $\displaystyle=\int d^{4}x\int_{0}^{L}dy\,{\cal
L}_{\rm flat}~{},~{}~{}{\cal L}_{\rm flat}=-\frac{1}{2}{\rm
Tr}\,F_{MN}F^{MN}+\overline{\Psi}\gamma^{M}(\partial_{M}-ig_{A}A_{M})\Psi~{},$
(2.1)

where ${\cal L}_{\rm flat}(x^{\mu},y)={\cal L}_{\rm flat}(x^{\mu},y+2L)={\cal
L}_{\rm flat}(x^{\mu},-y)$.
$A_{M}=\hbox{$\frac{1}{2}$}\sum_{a=1}^{3}A^{a}_{M}\tau^{a}$ and
$F_{MN}=\partial_{M}A_{N}-\partial_{N}A_{N}-ig_{A}[A_{M},A_{N}]$ where
$\tau^{a}$’s are Pauli matrices. Orbifold boundary conditions are given, with
$(y_{0},y_{1})=(0,L)$ and $P_{0}=P_{1}=\tau^{3}$, by

$\displaystyle\begin{pmatrix}A_{\mu}\cr
A_{y}\end{pmatrix}(x,y_{j}-y)=P_{j}\begin{pmatrix}A_{\mu}\cr-
A_{y}\end{pmatrix}(x,y_{j}+y)P_{j}^{-1}~{},$ (2.2)
$\displaystyle\Psi(x,y_{j}-y)=\begin{cases}+P_{j}\gamma^{5}\Psi(x,y_{j}+y)&\hbox{type
1A}\cr\kern 1.0pt\cr-P_{j}\gamma^{5}\Psi(x,y_{j}+y)&\hbox{type 1B}\cr\kern
1.0pt\cr(-1)^{j}P_{j}\gamma^{5}\Psi(x,y_{j}+y)&\hbox{type 2A}\cr\kern
1.0pt\cr(-1)^{j+1}P_{j}\gamma^{5}\Psi(x,y_{j}+y)&\hbox{type
2B}\end{cases}~{}.$ (2.3)

The $SU(2)$ symmetry is broken to $U(1)$. $A^{3}_{\mu}$ and $A^{1,2}_{y}$ are
parity even at both $y_{0}$ and $y_{1}$. The zero mode of $A^{3}_{\mu}$ is the
4D $U(1)$ gauge field. The 4D gauge coupling is given by
$g_{4}=g_{A}/\sqrt{L}$. The zero modes of $A_{y}^{1,2}$ may develop
nonvanishing expectation values. Without loss of generality we assume $\langle
A_{y}^{1}\rangle=0$. An AB phase $\theta_{H}$ along the fifth dimension is
then given by

$\displaystyle P\exp\bigg{\\{}ig_{A}\int_{0}^{2L}dy\,\langle
A_{y}\rangle\bigg{\\}}=e^{i\theta_{H}\tau^{2}}~{},~{}~{}\theta_{H}=g_{4}L\,\langle
A_{y}^{2}\rangle~{}.$ (2.4)

When $\theta_{H}\not=0$, $A_{\mu}^{1}$ and $A_{\mu}^{3}$ intertwine with each
other. It is straightforward to find mass eigenstates. The KK expansion is
given by

$\displaystyle\begin{pmatrix}A_{\mu}^{1}(x,y)\cr\kern 2.0pt\cr
A_{\mu}^{3}(x,y)\end{pmatrix}$
$\displaystyle=\sum_{n=-\infty}^{\infty}B_{\mu}^{(n)}(x)\frac{1}{\sqrt{\pi
R}}\begin{pmatrix}\sin(ny/R)\cr\cos(ny/R)\end{pmatrix}$ (2.5)

where $R=L/\pi$. The mass of the $B_{\mu}^{(n)}(x)$ mode is
$m_{n}(\theta_{H})=R^{-1}\big{|}n+\frac{\theta_{H}}{\pi}\big{|}$. The spectrum
is periodic in $\theta_{H}$ with a period $\pi$. The KK expansion of a doublet
fermion $\Psi=(u,d)^{t}$ of type 1A is given by

$\displaystyle\begin{pmatrix}u_{R}(x,y)\cr\kern 2.0pt\cr
d_{R}(x,y)\end{pmatrix}$
$\displaystyle=\sum_{n=-\infty}^{\infty}\psi_{R}^{(n)}(x)\frac{1}{\sqrt{\pi
R}}\begin{pmatrix}\cos(ny/R)\cr\sin(ny/R)\end{pmatrix},$ (2.6)
$\displaystyle\begin{pmatrix}u_{L}(x,y)\cr\kern 2.0pt\cr
d_{L}(x,y)\end{pmatrix}$
$\displaystyle=\sum_{n=-\infty}^{\infty}\psi_{L}^{(n)}(x)\frac{1}{\sqrt{\pi
R}}\begin{pmatrix}-\sin(ny/R)\cr\cos(ny/R)\end{pmatrix}.$ (2.7)

$\psi_{R}^{(n)}$ and $\psi_{L}^{(n)}$ combine to form the $\psi^{(n)}(x)$ mode
with a mass given by
$m_{n}(\theta_{H})=R^{-1}\big{|}n+\frac{\theta_{H}}{2\pi}\big{|}$. The
spectrum is periodic in $\theta_{H}$ with a period $2\pi$. Note that the KK
mass scale in the flat space is $m_{\rm KK}^{\rm flat}=1/R$.

##  3 $SU(2)$ GHU in the Randall-Sundrum warped space

The metric of the RS warped space is given by [10]

$\displaystyle ds^{2}=e^{-2\sigma(y)}\eta_{\mu\nu}dx^{\mu}dx^{\nu}+dy^{2}$
(3.1)

where $\eta_{\mu\nu}=\mbox{diag}(-1,+1,+1,+1)$,
$\sigma(y)=\sigma(y+2L)=\sigma(-y)$ and $\sigma(y)=ky$ for $0\leq y\leq L$. It
has the same topology as $M^{4}\times(S^{1}/Z_{2})$. In the region $0\leq
y\leq L$ the metric can be written, in terms of the conformal coordinate
$z=e^{ky}$, as

$\displaystyle
ds^{2}=\frac{1}{z^{2}}\bigg{(}\eta_{\mu\nu}dx^{\mu}dx^{\nu}+\frac{dz^{2}}{k^{2}}\bigg{)}\quad(1\leq
z\leq z_{L}=e^{kL})~{}.$ (3.2)

$z_{L}$ is called the warp factor of the RS space. The RS space is an anti-de
Sitter (AdS) space sandwiched by the UV brane at $y=0~{}(z=1)$ and the IR
brane at $y=L~{}(z=z_{L})$. The AdS curvature is given by $\Lambda=-6k^{2}$.

The action in the RS space is given by

$\displaystyle I_{\rm RS}=\int d^{5}x\sqrt{-\det G}\,{\cal L}_{\rm
RS}~{},~{}~{}{\cal L}_{\rm RS}=-\frac{1}{2}{\rm
Tr}\,F_{MN}F^{MN}+\overline{\Psi}{\cal D}(c)\Psi~{},$ (3.3)
$\displaystyle{\cal
D}(c)=\gamma^{A}{e_{A}}^{M}\Big{(}\partial_{M}-ig_{A}A_{M}+\frac{1}{8}\omega_{MBC}[\gamma^{B},\gamma^{C}]\Big{)}-c\,\sigma^{\prime}~{}.$
(3.4)

$c$ is a dimensionless bulk mass parameter. Note ${\cal L}_{\rm
RS}(x^{\mu},y)={\cal L}_{\rm RS}(x^{\mu},-y)={\cal L}_{\rm RS}(x^{\mu},y+2L)$.
Fields $A_{M}$ and $\Psi$ satisfy the same boundary conditions (2.3) as in the
flat spacetime. The AB phase $\theta_{H}$ and the KK mass scale $m_{\rm KK}$
are given by

$\displaystyle\theta_{H}$ $\displaystyle=\frac{\langle
A_{z}^{2(0)}\rangle}{f_{H}}~{},~{}~{}f_{H}=\frac{1}{g_{4}}\sqrt{\frac{2k}{L(z_{L}^{2}-1)}}~{},~{}~{}m_{\rm
KK}=\frac{\pi k}{z_{L}-1}~{},$ (3.5)

where $A_{z}^{a}(x,z)=k^{-1/2}\sum A_{z}^{a(n)}(x)v_{n}(z)$ and
$v_{0}(z)=\sqrt{2/(z_{L}^{2}-1)}\,z$.

The KK expansion of the gauge fields $A_{\mu}^{1}$ and $A_{\mu}^{3}$ is given
by

$\displaystyle\begin{pmatrix}A_{\mu}^{1}(x,y)\cr\kern 1.0pt\cr
A_{\mu}^{3}(x,y)\end{pmatrix}=\frac{1}{\sqrt{L}}\sum_{n=0}^{\infty}Z_{\mu}^{(n)}(x)\,\begin{pmatrix}h_{n}(y)\cr
k_{n}(y)\end{pmatrix},$ (3.6) $\displaystyle\begin{pmatrix}h_{n}(y)\cr
k_{n}(y)\end{pmatrix}=\begin{pmatrix}-h_{n}(-y)\cr
k_{n}(-y)\end{pmatrix}=\begin{pmatrix}h_{n}(y+2L)\cr k_{n}(y+2L)\end{pmatrix}$
(3.7)
$\displaystyle=\begin{pmatrix}\cos\theta(z)&\sin\theta(z)\cr-\sin\theta(z)&\cos\theta(z)\end{pmatrix}\begin{pmatrix}\tilde{h}_{n}(z)\cr\tilde{k}_{n}(z)\end{pmatrix},~{}~{}\theta(z)=\theta_{H}\,\frac{z_{L}^{2}-z^{2}}{z_{L}^{2}-1}\quad{\rm
for~{}}0\leq y\leq L~{}.$ (3.8)

The mass spectrum
$\\{m_{n}=k\lambda_{n};~{}\lambda_{0}<\lambda_{1}<\lambda_{2}<\cdots\\}$ of
the KK modes $\big{\\{}Z_{\mu}^{(n)}(x)\big{\\}}$ is determined by the zeros
of

$\displaystyle
Z_{\mu}^{(n)}:~{}SC^{\prime}(1;\lambda_{n})+\lambda_{n}\sin^{2}\theta_{H}=0$
(3.9)

where $S(z;\lambda)$ and $C(z;\lambda)$ are expressed in terms of Bessel
functions and are given by (A.5). The wave functions $\tilde{\bf
h}_{n}(z)\equiv(\tilde{h}_{n}(z),\tilde{k}_{n}(z))^{t}$ are given by (B.6).

For fermion fields we define $\check{\Psi}(x,z)=z^{-2}\,\Psi(x,z)$ for $1\leq
z\leq z_{L}$. The KK expansion of $\check{\Psi}=(\check{u},\check{d})^{t}$ of
type 1A is given by

$\displaystyle\begin{pmatrix}{\check{u}}_{R}(x,y)\cr\kern
2.0pt\cr{\check{d}}_{R}(x,y)\end{pmatrix}$
$\displaystyle=\sqrt{k}\sum_{n=0}^{\infty}\chi_{R}^{(n)}(x)\begin{pmatrix}f_{Rn}(y)\cr
g_{Rn}(y)\end{pmatrix},$ (3.10)
$\displaystyle\begin{pmatrix}{\check{u}}_{L}(x,y)\cr\kern
2.0pt\cr{\check{d}}_{L}(x,y)\end{pmatrix}$
$\displaystyle=\sqrt{k}\sum_{n=0}^{\infty}\chi_{L}^{(n)}(x)\begin{pmatrix}f_{Ln}(y)\cr
g_{Ln}(y)\end{pmatrix},$ (3.11)

where

$\displaystyle\begin{pmatrix}f_{Rn}(y)\cr
g_{Rn}(y)\end{pmatrix}=\begin{pmatrix}f_{Rn}(-y)\cr-
g_{Rn}(-y)\end{pmatrix}=\begin{pmatrix}f_{Rn}(y+2L)\cr
g_{Rn}(y+2L)\end{pmatrix}$ (3.12)
$\displaystyle\quad=\begin{pmatrix}\cos\hbox{$\frac{1}{2}$}\theta(z)&-\sin\hbox{$\frac{1}{2}$}\theta(z)\cr\kern
1.0pt\cr\sin\hbox{$\frac{1}{2}$}\theta(z)&\cos\hbox{$\frac{1}{2}$}\theta(z)\end{pmatrix}\begin{pmatrix}\tilde{f}_{Rn}(z)\cr\tilde{g}_{Rn}(z)\end{pmatrix}\quad{\rm
for~{}}0\leq y\leq L~{},$ (3.13) $\displaystyle\begin{pmatrix}f_{Ln}(y)\cr
g_{Ln}(y)\end{pmatrix}=\begin{pmatrix}-f_{Ln}(-y)\cr
g_{Ln}(-y)\end{pmatrix}=\begin{pmatrix}f_{Ln}(y+2L)\cr
g_{Ln}(y+2L)\end{pmatrix}$ (3.14)
$\displaystyle\quad=\begin{pmatrix}\cos\hbox{$\frac{1}{2}$}\theta(z)&-\sin\hbox{$\frac{1}{2}$}\theta(z)\cr\kern
1.0pt\cr\sin\hbox{$\frac{1}{2}$}\theta(z)&\cos\hbox{$\frac{1}{2}$}\theta(z)\end{pmatrix}\begin{pmatrix}\tilde{f}_{Ln}(z)\cr\tilde{g}_{Ln}(z)\end{pmatrix}\quad{\rm
for~{}}0\leq y\leq L~{}.$ (3.15)

$\chi_{R}^{(n)}(x)$ and $\chi_{L}^{(n)}(x)$ combine to form a massive mode
$\chi^{(n)}(x)$ for $\theta_{H}\not=0$. The mass spectrum
$\\{m_{n}=k\lambda_{n};~{}\lambda_{0}<\lambda_{1}<\lambda_{2}<\cdots\\}$ of
the KK modes $\\{\chi^{(n)}(x)\\}$ is determined by the zeros of

$\displaystyle\chi^{(n)}:~{}S_{L}S_{R}(1;\lambda_{n},c)+\sin^{2}\hbox{$\frac{1}{2}$}\theta_{H}=0$
(3.16)

where $S_{L}(z;\lambda,c)$ and $S_{R}(z;\lambda,c)$ are given by (A.10). The
wave functions $\tilde{\bf
f}_{Rn}(z)=(\tilde{f}_{Rn}(z),\tilde{g}_{Rn}(z))^{t}$ and $\tilde{\bf
f}_{Ln}(z)=(\tilde{f}_{Ln}(z),\tilde{g}_{Ln}(z))^{t}$ are given by (B.11).

The mass spectra as functions of $\theta_{H}$ in the flat
$M^{4}\times(S^{1}/Z_{2})$ space and in the RS warped space are depicted in
Fig. 1. In the flat space the mass spectrum of each field changes linearly in
$\theta_{H}$ so that the level crossing occurs. In the RS space there is no
level crossing so that physical quantities change smoothly as $\theta_{H}$. It
is expected that in the flat space something singular may occur at
$\theta_{H}=0,\hbox{$\frac{1}{2}$}\pi,\pi,\cdots$. This is exactly what is
going to happen in the anomaly as is seen below.

Figure 1: (Top): The mass spectrum of gauge fields $B_{\mu}^{(n)}$ and fermion
fields $\psi^{(n)}$ (type 1A) in the flat $M^{4}\times(S^{1}/Z_{2})$ space is
displayed. The level crossing occurs at
$\theta_{H}=0,\hbox{$\frac{1}{2}$}\pi,\pi,\cdots$. (Bottom): The mass spectrum
of gauge fields $Z_{\mu}^{(n)}$ and fermion fields $\chi^{(n)}$ (type 1A) in
the RS warped space is displayed. The warp factor is $z_{L}=100$ and the bulk
mass parameter of $\Psi$ is $c=0.25$.

##  4 Gauge couplings and anomaly in flat space

Gauge couplings of fermions in the flat space are easily found by inserting
the KK expansions (2.5) and (2.7) into the action (2.1). One finds that the
$B_{\mu}^{(n)}$ couplings of the fermion fields are given by

$\displaystyle\sum_{n=-\infty}^{\infty}B_{\mu}^{\langle
n\rangle}\,j^{\mu}_{(n)}$ (4.1)
$\displaystyle=\frac{g_{4}}{2}\sum_{n=-\infty}^{\infty}\sum_{m=-\infty}^{\infty}\sum_{\ell=-\infty}^{\infty}B_{\mu}^{\langle
n\rangle}\Big{\\{}s^{R}_{nm\ell}\,\psi_{R}^{\langle
m\rangle\,\dagger}\bar{\sigma}^{\mu}\psi_{R}^{\langle\ell\rangle}+s^{L}_{nm\ell}\,\psi_{L}^{\langle
m\rangle\,\dagger}\sigma^{\mu}\psi_{L}^{\langle\ell\rangle}\Big{\\}}~{},$
(4.2) $\displaystyle\hskip
85.35826pts^{R}_{nm\ell}=s^{L}_{nm\ell}=\delta_{n,m+\ell}~{}.$ (4.3)

Here we have adopted the two-component notation;
$\sigma^{\mu}=(I_{2},\vec{\sigma})$ and
$\bar{\sigma}^{\mu}=(-I_{2},\vec{\sigma})$. Chiral anomaly in
$\partial_{\mu}j^{\mu}_{(n)}$ arises from triangle diagrams in which various
combinations of $\psi_{R/L}^{\langle\ell\rangle}$ run;

$\displaystyle\partial_{\mu}j^{\mu}_{(n)}+\cdots=-\Big{(}\frac{g_{4}}{2}\Big{)}^{3}\sum_{\ell}\sum_{m}\frac{b_{n\ell
m}}{16\pi^{2}}\,B_{\mu\nu}^{(\ell)}\tilde{B}^{(m)\mu\nu}$ (4.4)

where
$B_{\mu\nu}^{(\ell)}=\partial_{\mu}B_{\nu}^{(\ell)}-\partial_{\nu}B_{\mu}^{(\ell)}$.
The anomaly coefficient $b_{n\ell m}$ is found to be

$\displaystyle b_{n_{1}n_{2}n_{3}}$
$\displaystyle=\sum_{m,\ell,p}\Big{\\{}s_{n_{1}m\ell}^{R}s_{n_{2}\ell
p}^{R}s_{n_{3}pm}^{R}+s_{n_{1}m\ell}^{L}s_{n_{2}\ell
p}^{L}s_{n_{3}pm}^{L}\Big{\\}}$ (4.5) $\displaystyle=\begin{cases}2&{\rm
for~{}}n_{1}+n_{2}+n_{3}={\rm even}\cr 0&{\rm for~{}}n_{1}+n_{2}+n_{3}={\rm
odd}\end{cases}~{}.$ (4.6)

Chiral anomalies arise even for $j^{\mu}_{(n\not=0)}$. A few examples are
shown in Fig. 2.

Figure 2: Chiral anomaly in the flat space.

##  5 Gauge couplings and anomaly in RS

Similarly gauge couplings of fermions in the RS space are expressed as

$\displaystyle\sum_{n=0}^{\infty}Z_{\mu}^{\langle n\rangle}\,j^{\mu}_{(n)}$
(5.1)
$\displaystyle=\frac{g_{4}}{2}\sum_{n=0}^{\infty}\sum_{\ell=0}^{\infty}\sum_{m=0}^{\infty}Z_{\mu}^{(n)}\Big{\\{}t^{R}_{n\ell
m}\,\chi_{R}^{(\ell)\dagger}\bar{\sigma}^{\mu}\chi_{R}^{(m)}+t^{L}_{n\ell
m}\,\chi_{L}^{(\ell)\dagger}\sigma^{\mu}\chi_{L}^{(m)}\Big{\\}}~{}.$ (5.2)

The couplings $t^{R}_{n\ell m}$ and $t^{L}_{n\ell m}$ are more involved. They
are given, in terms of the wave functions in (3.8) and (3.15), by

$\displaystyle t^{R}_{n\ell
m}=\frac{k}{2}\int_{-L}^{L}dy\,e^{k|y|}\Big{\\{}h_{n}\big{(}f_{R\ell}^{*}g_{Rm}+g_{R\ell}^{*}f_{Rm}\big{)}+k_{n}\big{(}f_{R\ell}^{*}f_{Rm}-g_{R\ell}^{*}g_{Rm}\big{)}\Big{\\}},$
(5.3) $\displaystyle t^{L}_{n\ell
m}=-\frac{k}{2}\int_{-L}^{L}dy\,e^{k|y|}\Big{\\{}h_{n}\big{(}f_{L\ell}^{*}g_{Lm}+g_{L\ell}^{*}f_{Lm}\big{)}+k_{n}\big{(}f_{L\ell}^{*}f_{Lm}-g_{L\ell}^{*}g_{Lm}\big{)}\Big{\\}}.$
(5.4)

Note that $t^{R/L}_{n\ell m}$ depends on $\theta_{H}$, $z_{L}$ and $c$. (It
does not depend on $k$ or $m_{\rm KK}$.)

Chiral anomaly in $\partial_{\mu}j^{\mu}_{(n)}$ is written as

$\displaystyle\partial_{\mu}j^{\mu}_{(n)}+\cdots=-\Big{(}\frac{g_{4}}{2}\Big{)}^{3}\sum_{\ell,m=0}^{\infty}\frac{a_{n\ell
m}}{16\pi^{2}}\,Z_{\mu\nu}^{(\ell)}\tilde{Z}^{(m)\mu\nu}$ (5.5)

where
$Z_{\mu\nu}^{(\ell)}=\partial_{\mu}Z_{\nu}^{(\ell)}-\partial_{\nu}Z_{\mu}^{(\ell)}$.
The anomaly coefficient $a_{n\ell m}$ is found to be

$\displaystyle a_{n_{1}n_{2}n_{3}}$
$\displaystyle=a_{n_{1}n_{2}n_{3}}^{R}+a_{n_{1}n_{2}n_{3}}^{L}~{},$ (5.6)
$\displaystyle a_{n_{1}n_{2}n_{3}}^{R/L}$
$\displaystyle=\sum_{m,\ell,p=0}^{\infty}t_{n_{1}m\ell}^{R/L}\,t_{n_{2}\ell
p}^{R/L}\,t_{n_{3}pm}^{R/L}~{}.$ (5.7)

As the couplings $t^{R}_{n\ell m}$ and $t^{L}_{n\ell m}$ depend on
$\theta_{H}$, $a^{R}_{n\ell m}$ and $a^{L}_{n\ell m}$ also do depend on
$\theta_{H}$. In the RS space the dependence is smooth. For instance,
$t^{R}_{000}$, $t^{L}_{000}$, $a^{R}_{000}$, $a^{L}_{000}$ and $a_{000}$ for
$z_{L}=10$ and $c=0.25$ are depicted in Fig. 3. It is seen that $a_{000}$
changes from 2 to 0 as $\theta_{H}$ varies from 0 to $\pi$.

Figure 3: Gauge couplings $t^{R/L}_{000}$and anomaly coefficients
$a^{R/L}_{000}$ and $a_{000}$ for $z_{L}=10$ and $c=0.25$ are shown as
functions of $\theta_{H}$. $a^{R/L}_{000}$ and $a_{000}$ are evaluated by
taking account of $t^{R/L}_{0m\ell}$ ($0\leq m,\ell\leq 14$).

##  6 Anomaly flow

In the flat space the anomaly coefficients $b_{nm\ell}$ in (4.6) are constant,
whereas the anomaly coefficients $a_{nm\ell}$ in (5.7) in the RS space depend
on $\theta_{H}$. There is no contradiction between these two facts. Look at
the mass spectrum in Fig. 1. In the RS space the lowest mode of the gauge
field is always $Z_{\mu}^{(0)}$ irrespective of the value of $\theta_{H}$. In
the flat space the lowest mode is $B_{\mu}^{(0)}$ for
$0<\theta_{H}<\hbox{$\frac{1}{2}$}\pi$, $B_{\mu}^{(-1)}$ for
$\hbox{$\frac{1}{2}$}\pi<\theta_{H}<\frac{3}{2}\pi$, and $B_{\mu}^{(-2)}$ for
$\frac{3}{2}\pi<\theta_{H}<2\pi$. The anomaly coefficient $b_{nnn}$ is $+2$
for $n=0$ and $-2$, but is 0 for $n=-1$. As the AdS curvature approaches 0,
that is, as $k\rightarrow 0$, the RS space becomes the flat
$M^{4}\times(S^{1}/Z_{2})$ space. In other words, $a_{000}$ must flow from 2
to 0 to 2 as $\theta_{H}$ changes from 0 to $\pi$ to $2\pi$. The anomaly flows
as the AB phase $\theta_{H}$ varies. In the flat space the behavior of the
anomaly becomes singular at the points of the level crossing, namely at
$\theta_{H}=\hbox{$\frac{1}{2}$}\pi$ and $\frac{3}{2}\pi$.

The phenomenon of the anomaly flow is seen in all anomaly coefficients
$a_{nm\ell}$. In Fig. 4 the anomaly coefficients $a^{R/L}_{012}$, $a_{012}$,
$a^{R/L}_{222}$ and $a_{222}$ are plotted for $z_{L}=10$ and $c=0.25$. The
anomaly flow is smooth.

Figure 4: Anomaly coefficients $a^{R/L}_{012}$, $a_{012}$, $a^{R/L}_{222}$ and
$a_{222}$ $a^{R/L}_{012}$, $a_{012}$, $a^{R/L}_{222}$ and $a_{222}$ for
$z_{L}=10$ and $c=0.25$ are shown as functions of $\theta_{H}$. The
coefficients are evaluated by taking account of $t^{R/L}_{jm\ell}$ ($j=0,1,2$,
$0\leq m,\ell\leq 14$).

One might wonder how the anomaly flow in the RS space reduces to the anomaly
flow in the flat space which seems singular at
$\theta_{H}=\hbox{$\frac{1}{2}$}\pi$ and $\frac{3}{2}\pi$. The flat space
limit is obtained by taking the $k\rightarrow 0$ limit in the RS space. As
$k\rightarrow 0$ with $L=\pi R$ kept fixed, $z_{L}\rightarrow 1$. In Fig. 5
the behavior of $a_{000}(\theta_{H};z_{L})$ is shown.

Figure 5: The $z_{L}$-dependence of the anomaly coefficient
$a_{000}(\theta_{H};z_{L})$ is displayed for $c=0.25$.

One sees that $a_{000}(\theta_{H};z_{L})$ varies smoothly as $z_{L}$ changes.
The $z_{L}\rightarrow 1$ limit is singular at
$\theta_{H}=\hbox{$\frac{1}{2}$}\pi$ and $\frac{3}{2}\pi$, however.

$\displaystyle\lim_{z_{L}\rightarrow
1}a_{000}(\theta_{H};z_{L})=\begin{cases}2&{\rm
for~{}}0\leq\theta_{H}<\hbox{$\frac{1}{2}$}\pi\cr 2\sqrt{2}&{\rm
for~{}}\theta_{H}=\hbox{$\frac{1}{2}$}\pi\cr 0&{\rm
for~{}}\hbox{$\frac{1}{2}$}\pi\leq\theta_{H}<\frac{3}{2}\pi\cr 2\sqrt{2}&{\rm
for~{}}\theta_{H}=\frac{3}{2}\pi\cr 2&{\rm
for~{}}\frac{3}{2}\pi\leq\theta_{H}\leq 2\pi\end{cases}~{}.$ (6.1)

This is precisely the behavior in the flat space as

$\displaystyle\lim_{z_{L}\rightarrow
1}Z_{\mu}^{(0)}=\begin{cases}B_{\mu}^{(0)}&{\rm
for~{}}0\leq\theta_{H}<\hbox{$\frac{1}{2}$}\pi\cr\frac{1}{\sqrt{2}}(B_{\mu}^{(0)}+B_{\mu}^{(-1)})&{\rm
for~{}}\theta_{H}=\hbox{$\frac{1}{2}$}\pi\cr B_{\mu}^{(-1)}&{\rm
for~{}}\hbox{$\frac{1}{2}$}\pi<\theta_{H}<\frac{3}{2}\pi\cr\frac{1}{\sqrt{2}}(B_{\mu}^{(-1)}+B_{\mu}^{(-2)})&{\rm
for~{}}\theta_{H}=\frac{3}{2}\pi\cr B_{\mu}^{(-2)}&{\rm
for~{}}\frac{3}{2}\pi<\theta_{H}\leq 2\pi\end{cases}~{}.$ (6.2)

As a function of $\theta_{H}$, the anomaly coefficient $a_{000}(\theta_{H})$
becomes singular in the flat space limit at the points where level crossing
occurs.

##  7 Holography in anomaly flow

In Figs. 3, 4 and 5, the anomaly coefficients coming from a fermion doublet of
type 1A with the bulk mass parameter $c=0.25$ have been shown. A surprise
comes when one investigates the $c$-dependence of the anomaly coefficients
$a_{nm\ell}(\theta_{H};z_{L},c)$. In the realistic GHU models of electroweak
interactions, namely in the $SO(5)\times U(1)_{X}\times SU(3)_{C}$ GHU in the
RS space, [11] the top quark multiplet has $c\sim 0.3$ whereas the multiplets
of other quarks and leptons have $c=0.6\sim 1$.

In Fig. 6 gauge couplings $t^{R/L}_{000}$and anomaly coefficients
$a^{R/L}_{000}$ and $a_{000}$ for $z_{L}=10$ and $c=0.8$ are shown. The
behavior in Fig. 6 should be compared with that in in Fig. 3 for $c=0.25$.
Although the gauge couplings for $c=0.8$ are significantly different from
those for $c=0.25$, the total anomaly coefficient $a_{000}(\theta_{H})$ turns
out universal, being independent of the value of $c$. There must be a reason
for this fact.

Figure 6: Gauge couplings $t^{R/L}_{000}$and anomaly coefficients
$a^{R/L}_{000}$ and $a_{000}$ for $z_{L}=10$ and $c=0.8$ are shown as
functions of $\theta_{H}$. The anomaly coefficient $a_{000}$ for $c=0.8$ has
the same behavior as $a_{000}$ for $c=0.25$ in Fig. 3.

Let us go back to the expression for $a_{n_{1}n_{2}n_{3}}$ in (5.7) with
(5.4).

$\displaystyle
a_{n_{1}n_{2}n_{3}}=\sum_{m,\ell,p}\Big{\\{}t_{n_{1}m\ell}^{R}\,t_{n_{2}\ell
p}^{R}\,t_{n_{3}pm}^{R}+t_{n_{1}m\ell}^{L}\,t_{n_{2}\ell
p}^{L}\,t_{n_{3}pm}^{L}\Big{\\}}~{}.$ (7.1)

There are two ways to evaluate $a_{n_{1}n_{2}n_{3}}$.

Method 1 (i) First evaluate the couplings $t_{nm\ell}^{R/L}\,$. (ii) Then do
the summation $\sum_{m\ell p}$.

Method 2 (i) First do the summation $\sum_{m\ell p}$. (ii) Then do the
integration $\int dy_{1}dy_{2}dy_{3}$.

So far we have adopted Method 1 to evaluate $a_{n_{1}n_{2}n_{3}}$.

In Method 2 the first step of the summation $\sum_{m\ell p}$ leads to

$\displaystyle
a_{n_{1}n_{2}n_{3}}=\Big{(}\frac{k}{2}\Big{)}^{3}\int\int\int_{-\beta}^{2L-\beta}dy_{1}dy_{2}dy_{3}\,e^{\sigma(y_{1})+\sigma(y_{2})+\sigma(y_{3})}$
(7.2)
$\displaystyle\quad\times\Big{[}~{}k_{1}k_{2}k_{3}\big{\\{}A_{R}(1,2)A_{R}(2,3)A_{R}(3,1)-B_{R}(1,2)B_{R}(2,3)B_{R}(3,1)$
(7.3) $\displaystyle\hskip
62.59596pt+B_{L}(1,2)B_{L}(2,3)B_{L}(3,1)-A_{L}(1,2)A_{L}(2,3)A_{L}(3,1)\big{\\}}$
(7.4)
$\displaystyle\qquad+k_{1}h_{2}h_{3}\\{\cdots\\}+h_{1}k_{2}h_{3}\\{\cdots\\}+h_{1}h_{2}k_{3}\\{\cdots\\}\Big{]}~{},$
(7.5) $\displaystyle\quad
k_{j}=k_{n_{j}}(y_{j})~{},~{}~{}h_{j}=h_{n_{j}}(y_{j})~{},$ (7.6)
$\displaystyle\quad\begin{pmatrix}A_{R/L}(j,k)\cr
B_{R/L}(j,k)\end{pmatrix}=\begin{pmatrix}A_{R/L}\cr
B_{R/L}\end{pmatrix}(y_{j},y_{k})=\sum_{n=0}^{\infty}\begin{pmatrix}f_{R/Ln}(y_{j})f_{R/Ln}^{*}(y_{k})\cr
g_{R/Ln}(y_{j})g_{R/Ln}^{*}(y_{k})\end{pmatrix}.$ (7.7)

Here we have made use of
$\sum_{n=0}^{\infty}f_{R/Ln}(y)g_{R/Ln}^{*}(y^{\prime})=0$. $\beta$ appearing
in the integration range in $y_{j}$ is arbitrary. Finding the explicit form of
$A_{R/L}$ and $B_{R/L}$ for general $c$ is a difficult task, however.

It is possible to determine $A_{R/L}$ and $B_{R/L}$ for $c=0$. One finds, with
$\delta_{L}(x)=\sum_{n}\delta(x-nL)$, that

$\displaystyle\underline{\hbox{type 1A},~{}c=0}$ (7.8) $\displaystyle
A_{R}(y,y^{\prime})=B_{L}(y,y^{\prime})=\frac{e^{-\sigma(y)}}{k}\big{\\{}\delta_{2L}(y-y^{\prime})+\delta_{2L}(y+y^{\prime})\big{\\}}~{},$
(7.9) $\displaystyle
B_{R}(y,y^{\prime})=A_{L}(y,y^{\prime})=\frac{e^{-\sigma(y)}}{k}\big{\\{}\delta_{2L}(y-y^{\prime})-\delta_{2L}(y+y^{\prime})\big{\\}}~{},$
(7.10)

Formulas for type 1B are obtained by interchanging $R$ and $L$. Similarly

$\displaystyle\underline{\hbox{type 2A},~{}c=0}$ (7.11) $\displaystyle
A_{R}(y,y^{\prime})=B_{L}(y,y^{\prime})=\frac{e^{-\sigma(y)}}{k}\big{\\{}\hat{\delta}_{2L}(y-y^{\prime})+\hat{\delta}_{2L}(y+y^{\prime})\big{\\}}~{},$
(7.12) $\displaystyle
B_{R}(y,y^{\prime})=A_{L}(y,y^{\prime})=\frac{e^{-\sigma(y)}}{k}\big{\\{}\hat{\delta}_{2L}(y-y^{\prime})-\hat{\delta}_{2L}(y+y^{\prime})\big{\\}}~{},$
(7.13)
$\displaystyle\hat{\delta}_{2L}(y)=\delta_{4L}(y)-\delta_{4L}(y-2L)~{}.$
(7.14)

Formulas for type 2B are obtained by interchanging $R$ and $L$. When one
inserts (7.10) and (7.14) into (7.7), there appear the products of three delta
functions in the integrand. With $0<\beta<L$ the products of delta functions
reduce to

$\displaystyle\begin{matrix}\delta_{2L}(y_{1}-y_{2})\delta_{2L}(y_{2}-y_{3})\delta_{2L}(y_{3}+y_{1})\cr\kern
3.0pt\cr\delta_{2L}(y_{1}+y_{2})\delta_{2L}(y_{2}+y_{3})\delta_{2L}(y_{3}+y_{1})\end{matrix}~{}\bigg{\\}}$
(7.15)
$\displaystyle\quad\Rightarrow\frac{1}{2}\Big{\\{}\delta(y_{1})\delta(y_{2})\delta(y_{3})+\delta(y_{1}-L)\delta(y_{2}-L)\delta(y_{3}-L)\Big{\\}}~{},$
(7.16)
$\displaystyle\begin{matrix}\hat{\delta}_{2L}(y_{1}-y_{2})\hat{\delta}_{2L}(y_{2}-y_{3})\hat{\delta}_{2L}(y_{3}+y_{1})\cr\kern
3.0pt\cr\hat{\delta}_{2L}(y_{1}+y_{2})\hat{\delta}_{2L}(y_{2}+y_{3})\hat{\delta}_{2L}(y_{3}+y_{1})\end{matrix}~{}\bigg{\\}}$
(7.17)
$\displaystyle\quad\Rightarrow\frac{1}{2}\Big{\\{}\delta(y_{1})\delta(y_{2})\delta(y_{3})-\delta(y_{1}-L)\delta(y_{2}-L)\delta(y_{3}-L)\Big{\\}}~{}.$
(7.18)

Furthermore, as $h_{n}(0)=h_{n}(L)=0$, only the terms proportional to
$k_{1}k_{2}k_{3}$ in (7.7) survive.

We have arrived at the following formula for the anomaly coefficients;

$\displaystyle a_{n\ell m}(\theta_{H},z_{L})$
$\displaystyle=Q_{0}k_{n}(0)k_{\ell}(0)k_{m}(0)+Q_{1}k_{n}(L)k_{\ell}(L)k_{m}(L)~{},$
(7.19)

where

$\displaystyle(Q_{0},Q_{1})$ $\displaystyle=\begin{cases}(+1,+1)&\hbox{for
type 1A}\cr(-1,-1)&\hbox{for type 1B}\cr(+1,-1)&\hbox{for type
2A}\cr(-1,+1)&\hbox{for type 2B}\end{cases}~{}.$ (7.20)

The anomaly coefficients are determined by the values of the wave functions of
the gauge fields, $k_{n}(y)$, at the UV and IR branes and the parity, $Q_{j}$,
of the right-handed mode of the fermion field.

As observed at the beginning of this section, the anomaly coefficients
$a_{n\ell m}(\theta_{H})$ do not depend on the bulk mass parameter $c$ of the
fermion field. The anomaly formula (7.19) derived for $c=0$ should apply for
other values of $c$. Indeed one can confirm it explicitly. In Fig. 7 $a_{n\ell
m}$’s given by the formula (7.19) and those determined by Method 1 for
$c=0.25$ are displayed in the case $z_{L}=10$. Blue curves represent the
formula (7.19), whereas red dots represent the values determined from the
gauge couplings $t_{nm\ell}^{R/L}$ for $c=0.25$. It is seen that the red dots
are on the blue curves.

Figure 7: Anomaly coefficients $a_{000}(\theta_{H})$, $a_{111}(\theta_{H})$ ,
$a_{222}(\theta_{H})$ , $a_{012}(\theta_{H})$ are shown for type 1A fermions
with $z_{L}=10$. Blue curves represent the formula (7.19), whereas red dots
represent the values determined from the gauge couplings $t_{nm\ell}^{R/L}$
for $c=0.25$ by Method 1.

We stress that the anomaly coefficients depend solely on $k_{n}(0)$,
$k_{n}(L)$, $Q_{0}$ and $Q_{1}$. They depend neither on the behavior of the
wave functions of gauge fields and fermion field in the bulk region $0<y<L$,
nor on the bulk mass parameter $c$ of the fermion field. The formula (7.19)
represents holography in anomaly flow. Although each anomaly generated by
specific fermion modes running along the internal triangle loop does depend on
the detailed behavior of the wave functions of both gauge and fermion fields
in the bulk, the total anomaly coefficients, after summing up all possible
loop contributions, are determined by the information of the gauge fields at
the UV and IR branes and of the parity conditions for the fermion field there.

The formula for the anomaly coefficients $b_{nm\ell}$ in the flat
$M^{4}\times(S^{1}/Z_{2})$ spacetime simplifies. As in the RS space, one finds
that

$\displaystyle b_{n\ell m}$ $\displaystyle=Q_{0}k^{\rm flat}_{n}(0)k^{\rm
flat}_{\ell}(0)k^{\rm flat}_{m}(0)+Q_{1}k^{\rm flat}_{n}(L)k^{\rm
flat}_{\ell}(L)k^{\rm flat}_{m}(L)~{}.$ (7.21)

In the flat space $k_{n}^{\rm flat}(y)=\cos(n\pi y/L)$ so that

$\displaystyle b_{n\ell m}$ $\displaystyle=Q_{0}+(-1)^{n+\ell+m}\,Q_{1}~{},$
(7.22)

which agrees with (4.6) with $Q_{0}=Q_{1}=1$ for a doublet fermion of type 1A.

##  8 Anomaly cancellation

In gauge theory in four dimensions gauge anomalies have to be cancelled for
the consistency of the theory. In GHU the holography in anomaly flow becomes
crucial to guarantee the cancellation of gauge anomalies. In the SM all gauge
anomalies are cancelled among quarks and leptons in each generation.[12, 13]

In the $SU(2)$ GHU under consideration one may introduce several fermion
doublets, each of which has its own bulk mass parameter $c$. Let the numbers
of doublet fermions of type 1A, 1B, 2A and 2B be $n_{1A}$, $n_{1B}$, $n_{2A}$
and $n_{2B}$, respectively. It follows from (7.19) that the anomalies are
cancelled if

$\displaystyle n_{1A}=n_{1B}~{},~{}~{}n_{2A}=n_{2B}~{},$ (8.1)

as the anomaly coefficients do not dependon $c$. The condition is generalized
in the presence of brane fermions, namely fermions living only on the UV or IR
brane. Suppose that there are $\hat{n}_{R}$ right-handed and $\hat{n}_{L}$
left-handed doublet brane fermions on the UV brane at $y=0$. As the
$Z_{\mu}^{(n)}$ coupling of each brane fermion is given by
$(g_{4}/2)\,k_{n}(0)$, the anomaly cancellation conditions become

$\displaystyle n_{1A}-n_{1B}+n_{2A}-n_{2B}+\hat{n}_{R}-\hat{n}_{L}=0~{},$
(8.2) $\displaystyle n_{1A}-n_{1B}-n_{2A}+n_{2B}=0~{},$ (8.3)

It is important that the conditions (8.1) and (8.3) do not depend on
$\theta_{H}$ and $z_{L}$. The conditions guarantee that not only the zero mode
anomaly $a_{000}$ but also all other anomalies $a_{n\ell m}$ are cancelled at
once. In GHU in the RS space the gauge couplings vary as $\theta_{H}$, which
further depends on $c$, or on the fermion species, but the anomaly
cancellation conditions do not depend on $\theta_{H}$.

##  9 Summary

We have shown that the anomaly flows with the AB phase $\theta_{H}$. In the RS
space everything changes smoothly with $\theta_{H}$. In the $SU(2)$ GHU model
in the RS space a chiral fermion at $\theta_{H}=0$ is transformed to a vector-
like fermion at $\theta_{H}=\pi$. The magnitude of the anomaly coming from one
fermion doublet varies with $\theta_{H}$. The total anomaly coefficients
$a_{nm\ell}(\theta_{H})$ are given by thec formula (7.19), which represents
holography in anomaly flow.

The anomalies can be cancelled among several fermion doublets. The
cancellation conditions are given by (8.1) or (8.3). They are independent of
$\theta_{H}$ and $z_{L}$, which is important to achieve the anomaly
cancellation in the realistic GHU models in the RS space. The examination of
anomaly cancellation in the $SO(5)\times U(1)_{X}\times SU(3)_{C}$ GHU in the
RS space is necessary.

In this connection one may worry about the fact that the gauge couplings vary
with $\theta_{H}$, and the couplings of quarks and leptons are not purely
chiral at $\theta_{H}\not=0$. In the SM only left-handed quark-lepton doublets
couple to $W$. In GHU models in the RS space right-handed components also have
small couplings to $W$ at $\theta_{H}\not=0$. The detailed study of the GUT
inspired $SO(5)\times U(1)_{X}\times SU(3)_{C}$ GHU has been done
recently.[14]. In the realistic model $\theta_{H}\sim 0.1$, $m_{\rm KK}\sim
13\,$TeV and $z_{L}\sim 4\times 10^{11}$. The $W$ couplings of right-handed
quarks in units of $g_{w}$ are $O(10^{-12})$, $O(10^{-9})$, and $O(10^{-5})$
for $(u,d)$, $(c,s)$ and $(t,b)$, respectively. The $W$ couplings of right-
handed leptons are much smaller.

Anomaly flow by an Aharonov-Bohm phase is a new phenomenon, which is different
from the phenomenon of anomaly inflow.[15, 16, 17] Further investigation is
desired.

## Acknowledgement

This work was supported in part by Japan Society for the Promotion of Science,
Grants-in-Aid for Scientific Research, Grant No. JP19K03873.

##  Appendix A Basis functions

Wave functions of gauge fields and fermions in the RS space are expressed in
terms of the Bessel functions. For gauge fields we introduce

$\displaystyle C(z;\lambda)$ $\displaystyle=\frac{\pi}{2}\lambda
zz_{L}F_{1,0}(\lambda z,\lambda z_{L})~{},$ (A.1) $\displaystyle S(z;\lambda)$
$\displaystyle=-\frac{\pi}{2}\lambda zF_{1,1}(\lambda z,\lambda z_{L})~{},$
(A.2) $\displaystyle C^{\prime}(z;\lambda)$
$\displaystyle=\frac{\pi}{2}\lambda^{2}zz_{L}F_{0,0}(\lambda z,\lambda
z_{L})~{},$ (A.3) $\displaystyle S^{\prime}(z;\lambda)$
$\displaystyle=-\frac{\pi}{2}\lambda^{2}zF_{0,1}(\lambda z,\lambda z_{L})~{},$
(A.4) $\displaystyle F_{\alpha,\beta}(u,v)$ $\displaystyle\equiv
J_{\alpha}(u)Y_{\beta}(v)-Y_{\alpha}(u)J_{\beta}(v)~{},$ (A.5)

where $J_{\alpha}(u)$ and $Y_{\alpha}(u)$ are Bessel functions of the first
and second kind. These functions satisfy

$\displaystyle-z\frac{d}{dz}\frac{1}{z}\frac{d}{dz}\begin{pmatrix}C\cr
S\end{pmatrix}=\lambda^{2}\begin{pmatrix}C\cr
S\end{pmatrix}~{},~{}~{}-\frac{d}{dz}z\frac{d}{dz}\frac{1}{z}\begin{pmatrix}C^{\prime}\cr
S^{\prime}\end{pmatrix}=\lambda^{2}\begin{pmatrix}C^{\prime}\cr
S^{\prime}\end{pmatrix}~{},$ (A.6) $\displaystyle
C(z_{L};\lambda)=z_{L}~{},~{}~{}C^{\prime}(z_{L};\lambda)=0~{},~{}~{}S(z_{L};\lambda)=0~{},~{}~{}S^{\prime}(z_{L};\lambda)=\lambda~{},$
(A.7) $\displaystyle CS^{\prime}-SC^{\prime}=\lambda z~{}.$ (A.8)

For fermion fields with a bulk mass parameter $c$, we define

$\displaystyle\begin{pmatrix}C_{L}\cr S_{L}\end{pmatrix}(z;\lambda,c)$
$\displaystyle=\pm\frac{\pi}{2}\lambda\sqrt{zz_{L}}F_{c+\frac{1}{2},c\mp\frac{1}{2}}(\lambda
z,\lambda z_{L})~{},$ (A.9) $\displaystyle\begin{pmatrix}C_{R}\cr
S_{R}\end{pmatrix}(z;\lambda,c)$
$\displaystyle=\mp\frac{\pi}{2}\lambda\sqrt{zz_{L}}F_{c-\frac{1}{2},c\pm\frac{1}{2}}(\lambda
z,\lambda z_{L})~{}.$ (A.10)

These functions satisfy

$\displaystyle D_{+}(c)\begin{pmatrix}C_{L}\cr
S_{L}\end{pmatrix}=\lambda\begin{pmatrix}S_{R}\cr C_{R}\end{pmatrix},$ (A.11)
$\displaystyle D_{-}(c)\begin{pmatrix}C_{R}\cr
S_{R}\end{pmatrix}=\lambda\begin{pmatrix}S_{L}\cr
C_{L}\end{pmatrix},~{}~{}D_{\pm}(c)=\pm\frac{d}{dz}+\frac{c}{z}~{},$ (A.12)
$\displaystyle C_{R}=C_{L}=1~{},~{}~{}S_{R}=S_{L}=0\quad{\rm
at~{}}z=z_{L}~{},$ (A.13) $\displaystyle C_{L}C_{R}-S_{L}S_{R}=1~{}.$ (A.14)

##  Appendix B Wave functions in RS

The wave functions $\tilde{\bf
h}_{n}(z)\equiv(\tilde{h}_{n}(z),\tilde{k}_{n}(z))^{t}$ in (3.8) for gauge
fields are given by

$\displaystyle\tilde{\bf h}_{0}(z)=\bar{\bf h}_{0}^{a}(z)~{},$ (B.1)
$\displaystyle[\tilde{\bf h}_{2\ell-1}(z),\tilde{\bf
h}_{2\ell}(z)]=(-1)^{\ell}\begin{cases}[\bar{\bf h}_{2\ell-1}^{a}(z),\bar{\bf
h}_{2\ell}^{b}(z)]&{\rm
for}-\frac{1}{2}\pi<\theta_{H}<\frac{1}{2}\pi\cr[\bar{\bf
h}_{2\ell-1}^{b}(z),-\bar{\bf h}_{2\ell}^{a}(z)]&{\rm
for~{}}0<\theta_{H}<\pi\cr[-\bar{\bf h}_{2\ell-1}^{a}(z),-\bar{\bf
h}_{2\ell}^{b}(z)]&{\rm
for~{}}\frac{1}{2}\pi<\theta_{H}<\frac{3}{2}\pi\cr[-\bar{\bf
h}_{2\ell-1}^{b}(z),\bar{\bf h}_{2\ell}^{a}(z)]&{\rm
for~{}}\pi<\theta_{H}<2\pi\cr[\bar{\bf h}_{2\ell-1}^{a}(z),\bar{\bf
h}_{2\ell}^{b}(z)]&{\rm
for~{}}\frac{3}{2}\pi<\theta_{H}<\frac{5}{2}\pi\end{cases}$ (B.2)
$\displaystyle\hskip 99.58464pt(\ell=1,2,3,\cdots)~{},$ (B.3)
$\displaystyle\bar{\bf
h}_{n}^{a}(z)=\frac{1}{\sqrt{r^{a}_{n}}}\begin{pmatrix}-\sin\theta_{H}\hat{S}(z;\lambda_{n})\cr\cos\theta_{H}C(z;\lambda_{n})\end{pmatrix},~{}~{}\bar{\bf
h}_{n}^{b}(z)=\frac{1}{\sqrt{r^{b}_{n}}}\begin{pmatrix}\cos\theta_{H}S(z;\lambda_{n})\cr\sin\theta_{H}\check{C}(z;\lambda_{n})\end{pmatrix},$
(B.4) $\displaystyle\hskip
28.45274pt\hat{S}(z;\lambda)=\frac{C(1;\lambda)}{S(1;\lambda)}\,S(z;\lambda)~{},~{}~{}\check{C}(z;\lambda)=\frac{S^{\prime}(1;\lambda)}{C^{\prime}(1;\lambda)}\,C(z;\lambda)~{},$
(B.5) $\displaystyle\hskip
28.45274ptr_{n}=\frac{1}{kL}\int_{1}^{z_{L}}\frac{dz}{z}\big{\\{}|\hat{h}_{n}(z)|^{2}+|\hat{k}_{n}(z)|^{2}\big{\\}}\quad{\rm
for}~{}\begin{pmatrix}\hat{h}_{n}(z)\cr\hat{k}_{n}(z)\end{pmatrix}.$ (B.6)

In (B.6) two expressions in an overlapping region in $\theta_{H}$ are the
same.

The wave functions $\tilde{\bf
f}_{Rn}(z)=(\tilde{f}_{Rn}(z),\tilde{g}_{Rn}(z))^{t}$ and $\tilde{\bf
f}_{Ln}(z)=(\tilde{f}_{Ln}(z),\tilde{g}_{Ln}(z))^{t}$ in (3.15) for fermion
fields of type 1A with $c\geq 0$ are given by

$\displaystyle[\tilde{\bf f}_{R,2\ell}(z),\tilde{\bf f}_{R,2\ell+1}(z)]$
$\displaystyle=\begin{cases}[\bar{\bf f}_{R,2\ell}^{a}(z),\bar{\bf
f}_{R,2\ell+1}^{c}(z)]&{\rm for~{}}-\pi<\theta_{H}<\pi\cr[\bar{\bf
f}_{R,2\ell}^{b}(z),\bar{\bf f}_{R,2\ell+1}^{d}(z)]&{\rm
for~{}}0<\theta_{H}<2\pi\cr[-\bar{\bf f}_{R,2\ell}^{a}(z),-\bar{\bf
f}_{R,2\ell+1}^{c}(z)]&{\rm for~{}}\pi<\theta_{H}<3\pi\cr[-\bar{\bf
f}_{R,2\ell}^{b}(z),-\bar{\bf f}_{R,2\ell+1}^{d}(z)]&{\rm
for~{}}2\pi<\theta_{H}<4\pi\cr[\bar{\bf f}_{R,2\ell}^{a}(z),\bar{\bf
f}_{R,2\ell+1}^{c}(z)]&{\rm for~{}}3\pi<\theta_{H}<5\pi\cr\end{cases}$ (B.7)
$\displaystyle\hskip 28.45274pt(\ell=0,1,2,\cdots)~{},$ (B.8)
$\displaystyle\tilde{\bf f}_{L0}(z)$ $\displaystyle=\bar{\bf f}_{L0}^{a}(z),$
(B.9) $\displaystyle[\tilde{\bf f}_{L,2\ell-1}(z),\tilde{\bf f}_{L,2\ell}(z)]$
$\displaystyle=\begin{cases}[\bar{\bf f}_{L,2\ell-1}^{a}(z),\bar{\bf
f}_{L,2\ell}^{c}(z)]&{\rm for~{}}-\pi<\theta_{H}<\pi\cr[\bar{\bf
f}_{L,2\ell-1}^{b}(z),\bar{\bf f}_{L,2\ell}^{d}(z)]&{\rm
for~{}}0<\theta_{H}<2\pi\cr[-\bar{\bf f}_{L,2\ell-1}^{a}(z),-\bar{\bf
f}_{L,2\ell}^{c}(z)]&{\rm for~{}}\pi<\theta_{H}<3\pi\cr[-\bar{\bf
f}_{L,2\ell-1}^{b}(z),-\bar{\bf f}_{L,2\ell}^{d}(z)]&{\rm
for~{}}2\pi<\theta_{H}<4\pi\cr[\bar{\bf f}_{L,2\ell-1}^{a}(z),\bar{\bf
f}_{L,2\ell}^{c}(z)]&{\rm for~{}}3\pi<\theta_{H}<5\pi\cr\end{cases}$ (B.10)
$\displaystyle\hskip 28.45274pt(\ell=1,2,3,\cdots)~{}.$ (B.11)

Here

$\displaystyle\bar{\bf
f}_{Rn}^{a}(z)=\frac{1}{\sqrt{r^{a}_{n}}}\begin{pmatrix}\cos\hbox{$\frac{1}{2}$}\theta_{H}C_{R}(z;\lambda_{n},c)\cr-\sin\hbox{$\frac{1}{2}$}\theta_{H}\hat{S}_{R}(z;\lambda_{n},c)\end{pmatrix},~{}~{}\bar{\bf
f}_{Rn}^{b}(z)=\frac{1}{\sqrt{r^{b}_{n}}}\begin{pmatrix}\sin\hbox{$\frac{1}{2}$}\theta_{H}C_{R}(z;\lambda_{n},c)\cr\cos\hbox{$\frac{1}{2}$}\theta_{H}\check{S}_{R}(z;\lambda_{n},c)\end{pmatrix},$
(B.12) $\displaystyle\bar{\bf
f}_{Rn}^{c}(z)=\frac{1}{\sqrt{r^{c}_{n}}}\begin{pmatrix}\sin\hbox{$\frac{1}{2}$}\theta_{H}\hat{C}_{R}(z;\lambda_{n},c)\cr\cos\hbox{$\frac{1}{2}$}\theta_{H}S_{R}(z;\lambda_{n},c)\end{pmatrix},~{}~{}\bar{\bf
f}_{Rn}^{d}(z)=\frac{1}{\sqrt{r^{d}_{n}}}\begin{pmatrix}-\cos\hbox{$\frac{1}{2}$}\theta_{H}\check{C}_{R}(z;\lambda_{n},c)\cr\sin\hbox{$\frac{1}{2}$}\theta_{H}S_{R}(z;\lambda_{n},c)\end{pmatrix},$
(B.13) $\displaystyle\bar{\bf
f}_{Ln}^{a}(z)=\frac{1}{\sqrt{r^{a}_{n}}}\begin{pmatrix}\sin\hbox{$\frac{1}{2}$}\theta_{H}\hat{S}_{L}(z;\lambda_{n},c)\cr\cos\hbox{$\frac{1}{2}$}\theta_{H}C_{L}(z;\lambda_{n},c)\end{pmatrix},~{}~{}\bar{\bf
f}_{Ln}^{b}(z)=\frac{1}{\sqrt{r^{b}_{n}}}\begin{pmatrix}-\cos\hbox{$\frac{1}{2}$}\theta_{H}\check{S}_{L}(z;\lambda_{n},c)\cr\sin\hbox{$\frac{1}{2}$}\theta_{H}C_{L}(z;\lambda_{n},c)\end{pmatrix},$
(B.14) $\displaystyle\bar{\bf
f}_{Ln}^{c}(z)=\frac{1}{\sqrt{r^{c}_{n}}}\begin{pmatrix}\cos\hbox{$\frac{1}{2}$}\theta_{H}S_{L}(z;\lambda_{n},c)\cr-\sin\hbox{$\frac{1}{2}$}\theta_{H}\hat{C}_{L}(z;\lambda_{n},c)\end{pmatrix},~{}~{}\bar{\bf
f}_{Ln}^{d}(z)=\frac{1}{\sqrt{r^{d}_{n}}}\begin{pmatrix}\sin\hbox{$\frac{1}{2}$}\theta_{H}S_{L}(z;\lambda_{n},c)\cr\cos\hbox{$\frac{1}{2}$}\theta_{H}\check{C}_{L}(z;\lambda_{n},c)\end{pmatrix},$
(B.15) $\displaystyle\qquad
r_{n}=\int_{1}^{z_{L}}dz\big{\\{}|\hat{f}_{n}(z)|^{2}+|\hat{g}_{n}(z)|^{2}\big{\\}}\quad{\rm
for}~{}\begin{pmatrix}\hat{f}_{n}(z)\cr\hat{g}_{n}(z)\end{pmatrix},$ (B.16)

and

$\displaystyle\begin{pmatrix}\hat{S}_{L}\cr\hat{C}_{R}\end{pmatrix}(z;\lambda,c)=\frac{C_{L}(1;\lambda,c)}{S_{L}(1;\lambda,c)}\begin{pmatrix}S_{L}\cr
C_{R}\end{pmatrix}(z;\lambda,c),~{}~{}\begin{pmatrix}\hat{C}_{L}\cr\hat{S}_{R}\end{pmatrix}(z;\lambda,c)=\frac{C_{R}(1;\lambda,c)}{S_{R}(1;\lambda,c)}\begin{pmatrix}C_{L}\cr
S_{R}\end{pmatrix}(z;\lambda,c),$ (B.17)
$\displaystyle\begin{pmatrix}\check{S}_{L}\cr\check{C}_{R}\end{pmatrix}(z;\lambda,c)=\frac{S_{R}(1;\lambda,c)}{C_{R}(1;\lambda,c)}\begin{pmatrix}S_{L}\cr
C_{R}\end{pmatrix}(z;\lambda,c),~{}~{}\begin{pmatrix}\check{C}_{L}\cr\check{S}_{R}\end{pmatrix}(z;\lambda,c)=\frac{S_{L}(1;\lambda,c)}{C_{L}(1;\lambda,c)}\begin{pmatrix}C_{L}\cr
S_{R}\end{pmatrix}(z;\lambda,c).$ (B.18)

In (B.11) two expressions in an overlapping region in $\theta_{H}$ are the
same.

References

## References

  * [1] S.L. Adler, “Axial vector vertex in spinor electrodynamics”, Phys. Rev. 177, 2426 (1969).
  * [2] J.S. Bell and R. Jackiw, “A PCAC puzzle: $\pi^{0}\rightarrow\gamma\gamma$ in the $\sigma$ model”, Nuovo Cim. A60, 47 (1969).
  * [3] K. Fujikawa, “Path-integral measure for gauge-invariant fermion theories”, Phys. Rev. Lett. 42, 1195 (1979); “Path integral for gauge theories with fermions”, Phys. Rev. D21, 2848 (1980).
  * [4] Y. Hosotani, “Dynamical mass generation by compact extra dimensions”, Phys. Lett. B126, 309 (1983); “Dynamics of nonintegrable phases and gauge symmetry breaking”, Ann. Phys. (N.Y.) 190, 233 (1989).
  * [5] A. T. Davies and A. McLachlan, “Gauge group breaking by Wilson loops”, Phys. Lett. B200, 305 (1988); “Congruency class effects in the Hosotani model”, Nucl. Phys. B317, 237 (1989).
  * [6] H. Hatanaka, T. Inami and C.S. Lim, “The gauge hierarchy problem and higher dimensional gauge theories”, Mod. Phys. Lett. A13, 2601 (1998).
  * [7] S. Funatsu, H. Hatanaka, Y. Hosotani, Y. Orikasa and N. Yamatsu, “Electroweak and left-right phase transitions in $SO(5)\times U(1)\times SU(3)$ gauge-Higgs unification”, Phys. Rev. D104, 115018 (2021).
  * [8] S. Funatsu, H. Hatanaka, Y. Hosotani, Y. Orikasa and N. Yamatsu, “Anomaly flow by an Aharonov-Bohm phase”, Prog. Theoret. Exp. Phys. 2022, 043B04 (2022).
  * [9] Y. Hosotani, “Universality in anomaly flow”, Prog. Theoret. Exp. Phys. 2022, 073B01 (2022).
  * [10] L. Randall and R. Sundrum, “A large mass hierarchy from a small extra dimension”, Phys. Rev. Lett. 83, 3370 (1999).
  * [11] S. Funatsu, H. Hatanaka, Y. Hosotani, Y. Orikasa and N. Yamatsu, “GUT inspired $SO(5)\times U(1)\times SU(3)$ gauge-Higgs unification”, Phys. Rev. D99, 095010 (2019).
  * [12] C. Bouchiat, J. Iliopoulos and Ph. Meyer, “An anomaly-free version of Weinberg’s model”, Phys. Lett. B38, 519 (1972).
  * [13] D.J. Gross and R. Jackiw, “Effects of anomalies on quasi-renormalizable theories”, Phys. Rev. D6, 477 (1972).
  * [14] Y. Hosotani, S. Funatsu, H. Hatanaka, Y. Orikasa and N. Yamatsu, “Coupling sum rules and oblique corrections in gauge-Higgs unification”, arXiv:2303.16418.
  * [15] C.G. Callan, Jr. and J.A. Harvey, “Anomalies and fermion zero modes on strings and domail walls”, Nucl. Phys. B250, 427 (1985).
  * [16] H. Fukaya, T. Onogi and S. Yamaguchi, “Atiyah-Patodi-Singer index from the domain-wall fermion Dirac operator”, Phys. Rev. D96, 125004 (2017).
  * [17] E. Witten and K. Yonekura, “Anomaly inflow and the $\eta$-invariant”, arXiv:1909.08775.


Wirtschaftsmathematik ITWM
<https://www.itwm.fraunhofer.de/de/suche.html?_charset_=UTF-8   numberResults=10   page=1   scope=ITWM   lang=de   queryString=Mohring+prognosemodelle>.

Nogrady, Bianca. 2020.
“What the data sy about asymptomatic Covid infections.” Nature (587):534–535.

[Radon, Saathoff  Pritschl]Radon, Saathoff
Radon, Katja, Elmar Saathoff  Michael Pritschl. 2020.
“Protocol of a population-based prospective COVID-19 cohort study
Munich, Germany.” BMC Public Health .

[Reese et al.]Reese, Iuliano, Patei  Garg et
Reese, Heather, Danielle Iuliano, Neha Patei  Shika Garg et al.
“Estimated incidence of COVID-19 illness and hospitalization –
United States, February– September, 2020.” Clinical Infectious
Diseases .

Robert Koch Institut2020aRKI:Steckbrief
Robert Koch Institut, RKI. 2020a.
“Epidemiologischer Steckbrief zu SARS-CoV-2 und COVID-19.”

Robert Koch Institut2020bRKI:2020Erlaeuterung
Robert Koch Institut, RKI. 2020b.
“Erläuterung der Schätzung der zeitlich variierenden
Reproduktionszahl $R$.”.

Robert Koch Institut2020cRKI:2020SerologischeStudie
Robert Koch Institut, RKI. 2020c.
“Serologische Untersuchungen von Blutspenden auf Antikörper gegen
SARS-CoV-2 (SeBluCo-Studie). Zwischenauswertung Datenstand 05.11.2020.”.

Schaback, Robert. 2020.
“On COVID-19 modeling.” Jahresbericht der Deutschen
Mathematiker-Vereinigung (122):167–â€“205.

[Wölfel, Corman  Guggemos et al]Wölfel, Corman
Guggemos et al2020Woelfel_ea:2020
Wölfel, R., V.M. Corman  W. Guggemos et al. 2020.
“Virological assessment of hospitalized patients with COVID-2019.”
Nature (581):465–469.

Example discussion: USA?  – Phases of rapid increase followed by long phases of slow decrease

India?  Long phase of increase with turn of the tide in the same constancy interval

Xmas ff. in Germany – fake decrease 10 days before X-mas, increase between Xmas and new year, difficult to disentangle effect of Xmas contacts and  two more stable effects: less discipline in contact reduction than in March + possibly new virus mutant – tendency of early January only to be read off from constancy interval for $\hat{\eta}$ fully in January  ?