# Single-Shot Black-Box Adversarial Attacks Against Malware Detectors: A
Causal Language Model Approach
††thanks: *: Corresponding author Acknowledgments: This material is based upon
work supported by the National Science Foundation (NSF) under Secure and
Trustworthy Cyberspace (1936370), Cybersecurity Innovation for
Cyberinfrastructure (1917117), and Cybersecurity Scholarship-for-Service
(1921485) programs.

James Lee Hu  Department of Management Information Systems
University of Arizona
Tucson, USA
<EMAIL_ADDRESS>Mohammadreza Ebrahimi*  Hsinchun Chen  School of
Information Systems and Management
University of South Florida
Tampa, USA
<EMAIL_ADDRESS>Department of Management Information Systems
University of Arizona
Tucson, USA
<EMAIL_ADDRESS>
###### Abstract

Deep Learning (DL)-based malware detectors are increasingly adopted for early
detection of malicious behavior in cybersecurity. However, their sensitivity
to adversarial malware variants has raised immense security concerns.
Generating such adversarial variants by the defender is crucial to improving
the resistance of DL-based malware detectors against them. This necessity has
given rise to an emerging stream of machine learning research, Adversarial
Malware example Generation (AMG), which aims to generate evasive adversarial
malware variants that preserve the malicious functionality of a given malware.
Within AMG research, black-box method has gained more attention than white-box
methods. However, most black-box AMG methods require numerous interactions
with the malware detectors to generate adversarial malware examples. Given
that most malware detectors enforce a query limit, this could result in
generating non-realistic adversarial examples that are likely to be detected
in practice due to lack of stealth. In this study, we show that a novel DL-
based causal language model enables single-shot evasion (i.e., with only one
query to malware detector) by treating the content of the malware executable
as a byte sequence and training a Generative Pre-Trained Transformer (GPT).
Our proposed method, MalGPT, significantly outperformed the leading benchmark
methods on a real-world malware dataset obtained from VirusTotal, achieving
over 24.51% evasion rate. MalGPT enables cybersecurity researchers to develop
advanced defense capabilities by emulating large-scale realistic AMG.

###### Index Terms:

Adversarial malware variants, single-shot black-box evasion, deep learning-
based language models, generative pre-trained transformers

TABLE I: Selected Major Append-based AMG Studies

Year | Author(s) | Data Source | Attack Method | # of Queries per Malware File
---|---|---|---|---
2021 | Demetrio et al.[1] | VirusTotal | Genetic Programming | Unlimited
2020 | Ebrahimi et al.[2] | VirusTotal | Generative RNN | Unlimited
2019 | Castro, Biggio et al.[3] | VirusTotal | Gradient descent attack | Unlimited
2019 | Castro, Schmitt et al.[4] | VirusTotal | Random perturbations | Unlimited
2019 | B. et al.[5] | VirusShare, Malwarebenchmark | Enhanced random perturbations | Multiple
2019 | Dey S. et al.[6] | Contagio PDF malware dump | Genetic programming | Multiple
2019 | Park et al.[7] | Malmig & MMBig | Dynamic Programming | Multiple
2019 | Rosenberg et al.[8] | VirusTotal | GAN | Multiple
2019 | Suciu et al.[9] | VirusTotal, Reversing Labs, FireEye | Append Attack | Single
2018 | Anderson et al.[10] | VirusTotal | Deep RL | Multiple
2018 | Hu & Tan[11] | Malwr dataset | Generative RNN | Multiple

Note: RNN: Recurrent Neural Network; NN: Neural Network; GAN: Generative
Adversarial Network; RL: Reinforcement Learning

##  I Introduction

DL-based malware detectors have recently gained attention in the field of
cybersecurity due to their ability to identify unseen malware variants without
manual feature engineering and expensive dynamic analysis of the behavior of
malware instances in a sandbox [12]. However, DL-based malware detectors have
been shown to be vulnerable to small perturbations in their input, known as
adversarial examples [13]. The automated generation of such inputs is known as
Adversarial Malware example Generation (AMG), which aims to generate
functionality-preserving malware variants that mislead these malware
detectors. Emulating AMG attacks against malware detectors can help strengthen
their malware detection performance [14].

AMG methods can generally be classified into white-box and black-box settings
[15]. Many AMG methods fall under the white-box classification, where the
attackers know the model parameters and architecture of the targeted malware
detector. Contrarily, black-box methods assume no attacker knowledge of the
model parameters and architecture of the targeted malware detector. Since
practical AMG scenarios aligns more with the black-box setting, black-box
methods have drawn more attention.

Most widely-used black-box AMG techniques rely on emulating append attack, an
additive approach that injects bytes at non-executable locations in the
malware binary. The popularity of append attacks is due to the fact that they
are less likely to affect the malware functionality [9]. To generate
adversarial malware variants, these methods require detector feedback, often a
Boolean value indicating whether the variant has evaded the malware detector
or not. Specifically, current append-based AMG methods require a considerable
amount of detector feedback to operate effectively [16] [9]. Given that real-
life malware detectors enforce a query limit, these AMG methods are rendered
ineffective due to their query inefficiency.

The evasion of detectors via only one query, known as single-shot evasion, has
been well studied in image applications [17]. However, it is understudied in
the AMG context. Because the goal of AMG research is to emulate real attacks
and improve the performance of malware detectors, there is a vital need for
single-shot AMG methods that can emulate realistic adversarial attacks. We
expect that well-designed DL-based AMG methods can result in such performance
by automatically extracting salient features from the malware sample [18].
Recently, DL-based language models have been shown to effectively extract
salient features from sequential data [19]. To this end, by viewing a malware
executable as a byte sequence, DL-based language models can be utilized to
generate evasive malware content [18]. Using DL-based language models’ ability
to effectively extract salient features for AMG, we seek to increase the
likelihood of single-shot evasion using DL-based language models.

Nevertheless, traditional language models are inefficient at byte sequence
generation due to long-range dependencies present in lengthy byte sequences
[12]. To address this, recent Natural Language Processing (NLP) research has
shown DL-based causal language models (CLM) as a viable solution [20].
Specifically, a recent Causal Deep Language model, Generative Pre-trained
Transformer (GPT), has yielded state-of-the-art performance in processing long
sequences and high-quality text generation [20]. Inspired by GPT’s success, we
propose a novel AMG framework using a GPT-based language model learned from
raw malware content to conduct AMG under a query-efficient threat model that
increases the chance of single-shot evasion.

The rest of this paper is organized as follows. First, we review AMG, CLMs,
and GPT. Subsequently, we detail the components of our proposed framework.
Lastly, we compare the performance of our proposed method with other state-of-
the-art AMG methods and highlight promising future directions.

##  II Literature Review

Three areas of research are examined. First, we review extant AMG studies as
the overarching area for our study. Second, we examine CLM as an effective
language model that can facilitate learning patterns in long byte sequences
from malware executables. Third, we review GPT as a state-of-the-art causal
language model.

###  II-A Adversarial Malware Generation (AMG)

AMG aims to perturb malware samples and generate variants that evade malware
detectors. Among the prevailing AMG methods, append attacks are the most
practical due to their high chance of preserving the functionality of the
original malware executable [9]. We summarize selected significant append-
based prior work based on their data source, attack method used, and presence
of a query limit in Table I.

Three major observation are made from Table I. First, the majority of studies
use VirusTotal, an open-source online malware database, as a source of their
malware samples [1][3][4][5][8][9][10]. Second, regarding selected attack
methods, a few notable attack methods include simple append attack [9],
attacking using randomly generated perturbation [4], and attacking using
specific perturbations that lowers a malware detector’s score [5]. More
advanced methods incorporate machine learning techniques (Genetic Programming
[1] [6], Gradient Descent [3], and Dynamic Programming [7]) and implement
advanced DL-based techniques (Generative Adversarial Networks [8], Deep
Reinforcement Learning [10], and Generative Recurrent Neural Networks
[2][11]). Third, and most importantly, while a sizable amount of AMG research
either do not limit the number of queries to the malware detector or allow
conducting multiple queries, few studies (Suciu et al. [9]) operate in a
single-shot AMG evasion setting. However, the proposed method in [9] does not
use potentially more effective machine learning approaches. Furthermore, more
advanced attack methods, such as DL-based ones, require multiple queries per
malware file to evade. This is due to the fact that, if not properly designed,
DL-based methods require multiple interactions with the detector to receive
feedback and learn generating evasive samples through back-propagation. Thus,
they are less likely to perform single-shot AMG evasion.

Overall, we observe that most AMG studies either do not limit the number of
queries to the detector or they require multiple queries per malware sample to
evade the malware detector. This highlights the inefficiency of their attack
methods at extracting salient features and generating evasive samples.

###  II-B Causal Language Models (CLMs)

DL-based language models have been shown to effectively extract salient
features from sequential data [19]. Recently, DL-based language models have
been successfully utilized in malware analysis [2][11]. Recent AMG research
demonstrated the viability of treating malware binaries as a language and
generating byte sequences, allowing for automatic perturbation generation in
the AMG context [2]. However, due to long-range dependencies in the byte
sequences from malware executables, traditional language models become
ineffective at learning the patterns present in malware binaries [12]. Current
NLP research has shown CLM as a promising alternative that can learn patterns
in long sequential data. CLMs are characterized by using outputs from previous
time steps as inputs in future time steps as it generates bytes. This allows
CLMs to reference past information when generating current sequences. Compared
to other state-of-the-art language models like BERT [21] and XLNet [22], CLMs
tend to be less computationally intensive. This allows them to process larger
input sequences, making them more suitable for long-range language generation
in an AMG context.

###  II-C Generative Pre-trained Transformer

While CLMs have proved promising in processing sequential data, recent studies
have further improved their performance. Specifically, GPT, a recent CLM, has
yielded breakthrough performances on NLP tasks [12]. GPT is composed of 12
interconnected decoder blocks, each consisting of a self attention layer and a
feed-forward neural network as shown in Figure 1.

Figure 1: GPT Architecture Utilized in Byte Generation

The first layer in each decoder block, known as self attention layer,
generates a representation that determines each token’s importance in relation
to the current token [23]. From self attention layer, a feed-forward neural
network acts as a gateway to pass the obtained representation to the next
decoder block [24]. The same structure holds for each of the 12 decoder
blocks, where the last generated sequence is the final output of the $12^{th}$
decoder block.

GPT’s causal nature and its built-in self-attention mechanism allows it to
better learn longer-range patterns when compared to traditional language
models [25].

##  III Research Gaps and Questions

Based on our literature review, two research gaps are identified. First,
within the AMG domain, most methods cannot evade malware detectors in a
single-shot fashion, causing them to be query inefficient. Second, regarding
the methodology, while GPT has shown promising performance in NLP tasks, it is
unclear how it could be applied in malware analysis and specifically AMG
context.

To address the identified gaps, the following research question is posed:

  * •

How can an adversarial causal language model be developed to evade malware
detectors with minimal number of queries to maximize the chance of single-shot
evasion?

Motivated by this question, we propose MalGPT, a novel framework to
automatically construct adversaries for evading malware detectors in one query
utilizing the causal language model GPT2 (a publicly available implementation
of GPT).

##  IV Research Design

Following previous AMG studies, we first introduce the threat model under
which our proposed MalGPT operates [26]. Then, we examine the architecture of
MalGPT and its training process. Finally, we introduce our testbed and the
targeted malware detector used in MalGPT’s training and evaluation.

###  IV-A Threat Model

A threat model is a systematic representation of cyber attacks [27][26]. Since
the goal of our study is evading DL-based detectors with only one query and
without accessing the internal model parameters of the malware detector, our
threat model focuses on a single-shot, black-box setting. Accordingly, three
major components of our threat model are:

  * •

Adversary’s Goal: Evade DL-based malware detectors in a single shot. That is,
the evasive adversarial malware variants that are generated after one
interaction with the detector do not count towards model’s success.

  * •

Adversary’s Knowledge:

    * –

Structure and parameters of malware detector model are unknown to the
attacker.

    * –

Attacker does not have access to the confidence score produced by malware
detector (fully black-box attack).

  * •

Adversary’s Capability: The adversary applies functionality-preserving append
modifications on malware binaries.

    * –

Consistent with past AMG studies [2] [16], the size of the modifications must
stay under 10 KB to maintain the stealth of the generated malware variant.

Figure 2: Abstract View of MalGPT Malware Evasion Framework

###  IV-B MalGPT Architecture

To realize this threat model, MalGPT employs a GPT2 language model that is
trained to generate benign-looking byte sequences. The trained language model
is utilized to generate evasive and functionality-preserving variants of
existing known malware executables as depicted in Figure 2. This process is
detailed in 5 steps:

  * •

Step 1: The binary content of a malware sample is fed into the trained GPT2
model.

  * •

Step 2: The model generates a file-specific byte sequence.

  * •

Step 3: The generated sequence is added to the original malware sample,
resulting in a new malware variant.

  * •

Step 4: The new malware variant is examined for functionality using the
VirusTotal API.

  * •

Step 5: After confirming its functionality, the generated variant attempts to
evade a malware detector in a single query.

###  IV-C MalGPT Model Training

In order to generate benign-looking sequences, MalGPT’s GPT2 model is trained
on a set of benign files. Figure 3 provides an illustration of this process,
with the final trained model being incorporated into Figure 2 as the Binary-
Trained MalGPT Generation.

Figure 3: Illustration of MalGPT’s Model Training Process

The model is trained in a two-step process. In Step 1, benign files are first
converted to a single hex string delimited by sets of four characters (e.g.,
‘AA04 FF44 …’) and fed into the GPT2 model. Step 2 has the model automatically
extracting salient features from the hex string and learning how to generate
benign-looking byte sequences. After repeating Step 2 for 1,000 training
iterations, the process results in a trained model that takes malware byte
sequences as input to generate benign-looking, file-specific perturbations.

###  IV-D Testbed and Targeted Malware Detector

As stated in prior sections, MalGPT requires both benign and malicious files
to be trained and to evade malware detectors. To this end, following the
approach in [12], we collected 13,554 benign Microsoft Windows system files
for MalGPT to learn from. Additionally, we obtained 6,307 malicious samples
from VirusTotal in eight major malware categories. Table II summarizes the
distribution of these categories along with their description and examples.

TABLE II: Malware Samples in our Testbed Malware Category |  Description |  Examples |  # of Files
---|---|---|---
Adware |  Shows unwanted ads and force internet traffic to sites |  eldorado, razy, gator |  1,947
Backdoor |  Negates normal authentications to access the host |  lunam, rahack, symmi |  678
Botnet |  A network of bots connected through the internet |  virut, salicode, sality |  526
Dropper |  Secretly installs other malwares on the host |  dinwod, gepys, doboc |  904
Ransom- ware |  Encrypts data and files, restricting access and usage until decrypted by malware authors |  vtflooder, msil, bitman |  900
Rootkit |  Grants admin privilege to malware author |  onjar, dqqd, shipup |  53
Spyware |  Allows malware authors to steal personal information covertly |  mikey, qqpass, scar |  640
Virus |  Corrupts files on the host system |  nimda, shodi, hematite |  659
Total |  - |  - |  6,037

##  V Evaluation

###  V-A Experiment Design

Through consulting with two malware analysis experts as well as the popularity
in malware analysis community, we selected MalConv as one of the most highly
reputable DL-based malware detectors [12]. To evaluate performance, consistent
with [28], we adopted evasion rate as the most common performance metric in
AMG research. The evasion rate is defined via the following equation [2]:

$Evasion\ Rate=\frac{|E\cap F|}{N}$ (1)

where $E$ and $F$ denote the sets of evasive and functional modified malware
samples generated from the AMG method, respectively. $N$ represents the total
number of malware samples given as input to the AMG method. To evaluate
MalGPT’s performance, we conducted several benchmark experiments under the
constraints of our threat model (i.e., single-shot evasion, black-box setting,
and 10 KB maximum append size). Table III presents the description for each
selected benchmark method.

TABLE III: Overview of Benchmark Experiment Methods Method |  Description |  Reference(s)
---|---|---
Random Append |  Randomly appends bytes to malware sample. |  Suciu et al., 2019 [9]; Castro, Schmitt et al., 2019 [3]
Benign Append |  Appends sections of bytes from benign files to malware sample. |  Castro, Biggio et al., 2019 [4]
Enhanced Benign Append |  Appends bytes that lower the confidence score the most. |  Chen B. et al., 2019 [5]
MalRNN |  Appends a byte sequence generated by an RNN model trained on benign files |  Ebrahimi et al., 2020 [2]

Each AMG method was performed on the eight individual malware categories in
the testbed as well as the entire testbed (i.e., all 6,037 malware
executables) to gauge its efficacy at single-shot AMG evasion based on evasion
rate.

###  V-B Experiment Results

Table IV shows MalGPT’s performance compared to state-of-the-art AMG
benchmarks against MalConv under the constraints of the defined threat model.
The row denoted by ‘Total’ corresponds to the performance on the entire
testbed.

TABLE IV: Experiment Results

Category |  Random Append |  Benign Append |  Enhanced Benign Append |  MalRNN |  MalGPT
---|---|---|---|---|---
Adware |  2% |  0.87% |  15.51% |  4.16% |  25.89%*
Backdoor |  2.06% |  0.74% |  21.98% |  0.44% |  18.86%
Botnet |  2.47% |  1.14% |  21.86% |  6.08% |  25.86%*
Dropper |  3.32% |  2.32% |  16.48% |  4.2% |  27.43%*
Ransom- ware |  3.78% |  0.11% |  14.44% |  0.89% |  20.33%*
Rootkit |  1.89% |  3.77% |  3.77% |  5.66% |  24.53%*
Spyware |  2.5% |  1.88% |  11.25% |  4.38% |  22.97%*
Virus |  4.4% |  2.43% |  12.29% |  10.17% |  28.38%*
Total |  2.79% |  1.27% |  15.86% |  4.12% |  24.51%*

Note: P-Values are significant at 0.05.

The asterisks in Table IV denote the statistical significance obtained from
paired $t$-test at P-value equal to or less than 0.05 between the results of
MalGPT and the second-best performing benchmark method in each respective
category. The results show approximately a 20% performance improvement over
the recently proposed state-of-the-art malware language model, MalRNN (4.12%
vs. 24.51%). Moreover, MalGPT shows an approximately 7% performance
improvement at single-shot evasion over the second-best method, Enhanced
Benign Append. Overall, from Table IV it is shown that MalGPT attains the best
performance on the entire dataset (24.51%) and outperforms other benchmark
methods in almost all categories (except backdoor). The significantly high
performance of MalGPT compared to the benchmark methods suggests that, as
expected, the high-quality representations obtained by the GPT2 component in
our model effectively increase the chance of single-shot evasion.

In addition to comparison with other AMG benchmark methods, it is useful to
compare MalGPT’s performance across all eight malware categories. Figure 4
depicts the evasion rate of MalGPT for each malware category a long with the
evasion rate across the entire 6,307 malware executables (denoted by ‘Total’).

Figure 4: MalGPT’s Evasion Rate for each Malware Category and entire dataset

From Figure 4, we have a few observations. While MalGPT attains an evasion
rate of 24.51% across all 6,307 malware samples in our testbed, several
categories noticeably deviate from this trend. On the upper end, both Dropper
and Virus have a high evasion rate at 27.43% and 28.38%, respectively.
Conversely, both Backdoor and Ransomware have a lower evasion rate at 18.86%
and 20.33%, respectively. These results suggest that Dropper and Virus are
more sensitive to AMG append attacks while Backdoor and Ransomware may be less
sensitive to such attacks. One possible explanation could be because of the
malware file size. Droppers are usually small files that download other
malicious files through a link after gaining access to a host machine.
Likewise, Viruses are often small scripts that seek to corrupt a host machine.
As such, both categories feature smaller file size allowing a 10 KB
perturbation generated by MalGPT to have a larger effect and thus a higher
evasion chance. Conversely, both Backdoor and Ransomware often need large,
complex programs (e.g., encryption procedures) to achieve their malicious
goals. As such, MalGPT’s 10 KB perturbation could be less effective in larger
files, thus making evasion more difficult. This aligns with the intuition that
DL-based malware detectors are more likely to be evaded with proportionally
larger AMG perturbations with respect to the original file size.

Overall, the experiment results suggest that our proposed approach of
implementing GPT into an AMG framework significantly improves the chance of
single-shot evasion. Additionally, our results show the deficiency of current
AMG methods to operate effectively in a single-shot threat model. This
highlights their excessive reliance on querying a malware detector multiple
times, which renders them ineffective in practice when realistic restrictions
are applied to the number of allowed queries.

##  VI Conclusion and Future Directions

AMG research has gained popularity as a way to better understand and combat
malware attacks. However, current AMG methods are rendered ineffective in
real-world settings due to their reliance on multiple malware detector queries
and the frequent implementation of query limits on malware detectors in
practice. Leveraging GPT, we propose a novel framework for evading DL-based
malware detectors that operationalizes a single-shot black-box evasion threat
model. The proposed MalGPT framework utilizes GPT’s ability to extract salient
features from long-range dependencies in byte sequences extracted from malware
executable content and generate benign-looking byte sequences for single-shot
AMG evasion. Our MalGPT was evaluated on eight major malware categories.
MalGPT significantly outperformed all benchmark methods, demonstrating its
ability to operate effectively in a single-shot setting where other AMG
methods cannot.

Our proposed research could be further extended by incorporating other views
of sequential malware data such as malware source code (in addition to raw
binary content). Multi-view deep learning methods that can utilize information
from both executable’s raw content and source code are anticipated to yield
better evasion performance.

## References

  * [1] L. Demetrio, B. Biggio, G. Lagorio, F. Roli, and A. Armando, “Functionality-preserving black-box optimization of adversarial windows malware,” _IEEE Transactions on Information Forensics and Security_ , vol. 16, pp. 3469–3478, 2021.
  * [2] M. Ebrahimi, N. Zhang, J. Hu, M. T. Raza, and H. Chen, “Binary black-box evasion attacks against deep learning-based static malware detectors with adversarial byte-level language model,” _arXiv preprint arXiv:2012.07994_ , 2020.
  * [3] R. L. Castro, C. Schmitt, and G. D. Rodosek, “Armed: How automatic malware modifications can evade static detection?” in _2019 5th International Conference on Information Management (ICIM)_. IEEE, 2019, pp. 20–27.
  * [4] R. Labaca-Castro, B. Biggio, and G. Dreo Rodosek, “Poster: Attacking malware classifiers by crafting gradient-attacks that preserve functionality,” in _Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security_ , 2019, pp. 2565–2567.
  * [5] B. Chen, Z. Ren, C. Yu, I. Hussain, and J. Liu, “Adversarial examples for cnn-based malware detectors,” _IEEE Access_ , vol. 7, pp. 54 360–54 371, 2019.
  * [6] S. Dey, A. Kumar, M. Sawarkar, P. K. Singh, and S. Nandi, “Evadepdf: Towards evading machine learning based pdf malware classifiers,” in _International Conference on Security & Privacy_. Springer, 2019, pp. 140–150.
  * [7] D. Park, H. Khan, and B. Yener, “Generation & evaluation of adversarial examples for malware obfuscation,” in _2019 18th IEEE International Conference On Machine Learning And Applications (ICMLA)_. IEEE, 2019, pp. 1283–1290.
  * [8] I. Rosenberg, A. Shabtai, Y. Elovici, and L. Rokach, “Defense methods against adversarial examples for recurrent neural networks,” _arXiv preprint arXiv:1901.09963_ , 2019.
  * [9] O. Suciu, S. E. Coull, and J. Johns, “Exploring adversarial examples in malware detection,” in _2019 IEEE Security and Privacy Workshops (SPW)_. IEEE, 2019, pp. 8–14.
  * [10] H. S. Anderson, A. Kharkar, B. Filar, D. Evans, and P. Roth, “Learning to evade static pe machine learning malware models via reinforcement learning,” _arXiv preprint arXiv:1801.08917_ , 2018.
  * [11] W. Hu and Y. Tan, “Black-box attacks against rnn based malware detection algorithms,” in _Workshops at the Thirty-Second AAAI Conference on Artificial Intelligence_ , 2018.
  * [12] E. Raff, J. Barker, J. Sylvester, R. Brandon, B. Catanzaro, and C. K. Nicholas, “Malware detection by eating a whole exe,” in _Workshops at the Thirty-Second AAAI Conference on Artificial Intelligence_ , 2018.
  * [13] D. Luca, B. Biggio, L. Giovanni, F. Roli, and A. Alessandro, “Explaining vulnerabilities of deep learning to adversarial malware binaries,” in _ITASEC19_ , vol. 2315, 2019.
  * [14] I. Goodfellow, P. McDaniel, and N. Papernot, “Making machine learning robust against adversarial inputs,” _Communications of the ACM_ , vol. 61, no. 7, pp. 56–66, 2018.
  * [15] S. Qiu, Q. Liu, S. Zhou, and C. Wu, “Review of artificial intelligence adversarial attack and defense technologies,” _Applied Sciences_ , vol. 9, no. 5, p. 909, 2019.
  * [16] B. Kolosnjaji, A. Demontis, B. Biggio, D. Maiorca, G. Giacinto, C. Eckert, and F. Roli, “Adversarial malware binaries: Evading deep learning for malware detection in executables,” in _2018 26th European signal processing conference (EUSIPCO)_. IEEE, 2018, pp. 533–537.
  * [17] A. Ilyas, L. Engstrom, A. Athalye, and J. Lin, “Black-box adversarial attacks with limited queries and information,” in _International Conference on Machine Learning_. PMLR, 2018, pp. 2137–2146.
  * [18] Y. Awad, M. Nassar, and H. Safa, “Modeling malware as a language,” in _2018 IEEE International Conference on Communications (ICC)_. IEEE, 2018, pp. 1–6.
  * [19] F. Belletti, M. Chen, and E. H. Chi, “Quantifying long range dependence in language and user behavior to improve rnns,” in _Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining_, 2019, pp. 1317–1327.
  * [20] E. Hosseini-Asl, B. McCann, C.-S. Wu, S. Yavuz, and R. Socher, “A simple language model for task-oriented dialogue,” _arXiv preprint arXiv:2005.00796_ , 2020.
  * [21] J. Devlin, M.-W. Chang, K. Lee, and K. Toutanova, “Bert: Pre-training of deep bidirectional transformers for language understanding,” _arXiv preprint arXiv:1810.04805_ , 2018.
  * [22] Z. Yang, Z. Dai, Y. Yang, J. Carbonell, R. R. Salakhutdinov, and Q. V. Le, “Xlnet: Generalized autoregressive pretraining for language understanding,” _Advances in neural information processing systems_ , vol. 32, 2019.
  * [23] A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, Ł. Kaiser, and I. Polosukhin, “Attention is all you need,” in _Advances in neural information processing systems_ , 2017, pp. 5998–6008.
  * [24] A. Radford, J. Wu, R. Child, D. Luan, D. Amodei, I. Sutskever _et al._ , “Language models are unsupervised multitask learners,” _OpenAI blog_ , vol. 1, no. 8, p. 9, 2019.
  * [25] M. Chen, A. Radford, R. Child, J. Wu, H. Jun, D. Luan, and I. Sutskever, “Generative pretraining from pixels,” in _International Conference on Machine Learning_. PMLR, 2020, pp. 1691–1703.
  * [26] B. Biggio, G. Fumera, and F. Roli, “Security evaluation of pattern classifiers under attack,” _IEEE transactions on knowledge and data engineering_ , vol. 26, no. 4, pp. 984–996, 2013.
  * [27] N. Carlini, A. Athalye, N. Papernot, W. Brendel, J. Rauber, D. Tsipras, I. Goodfellow, A. Madry, and A. Kurakin, “On evaluating adversarial robustness,” _arXiv preprint arXiv:1902.06705_ , 2019.
  * [28] W. Fleshman, E. Raff, J. Sylvester, S. Forsyth, and M. McLean, “Non-negative networks against adversarial attacks,” _arXiv preprint arXiv:1806.06108_ , 2018.


# Discrete global symmetries and dynamics of emergent fermions

Fan Yang  Institute for Advanced Study, Tsinghua University, Beijing, China
100084  Fei Zhou  Department of Physics and Astronomy, University of British
Columbia, Vancouver, BC, Canada, V6T 1Z1

(August 27, 2024)

###### Abstract

Global symmetries that define the number of low energy degrees of freedom have
profound consequences on universal properties near topological quantum
critical points and in other gapless or nearly gapless states of emergent
fermions. We take a $Z_{2}$ global symmetry (such as the time-reversal one) as
an example to study its effect on thermodynamic and transport properties.
Although the density of thermal entropy of $Z_{2}$ symmetric systems is simply
twice of their counterparts without any global symmetries or $Z_{1}$ case, the
temperature dependence of thermal conductivity $\kappa$ is distinctly and
drastically different for different symmetries. In the $Z_{2}$ symmetric case,
we have $\kappa\propto T^{-(d-1)}$ in the quantum critical regime near weakly
interacting fixed points, while for systems with no global symmetries or
$Z_{1}$ case, $\kappa\propto T^{-(d+3)}$ with $d$ the spatial dimension. Only
near strong coupling fixed points, both cases with or without $Z_{2}$ global
symmetries follow the single scaling function, $\kappa\propto T^{d-1}$. These
distinct scalings of thermal conductivity can also appear in other gapless
fermion systems, such as surface states and Majorana wires at
superconductor–topological-insulator–superconductor junctions that are
experimentally accessible.

Tremendous efforts have been made to understand emergent Majorana fermions in
electronic systems [1, 2, 3]. Many previous studies on Majorana fermions in
condensed matter have mainly focused on Majorana zero modes localized in
vortices or on the edge of topological superconductors [4, 5, 6, 7, 9, 8, 10,
11, 12, 13, 14]. One major motivation of those efforts was to trap and
manipulate these decoherence free states as a fundamental building block for
topological quantum computers [15, 16]. On the other hand, propagating
Majorana fermions as low energy emergent particles have received relatively
less attention, partly because they are hard to separate experimentally. The
main purpose of this Letter is to reveal some surprising collective dynamics
of Majorana fermions that are distinct from complex fermions and can be
potentially studied in experiments.

There are at least three different classes of phenomena where the dynamics can
be characterized by the theoretical results presented in this Letter. Some of
them are very much relevant to previous experimental efforts. The first class
of phenomena are boundary or surface dynamics in a topological state. Around a
typical topological bulk, surface fermions are gapless and protected by
symmetries [17, 18, 19]. Many aspects of interaction dynamics on gapless
surfaces can be related to quantum critical phenomena [20], as was discussed
in Ref. [21]. For instance, surface transport of a three-dimensional (3D)
topological superfluid or superconductor shall resemble those in a quantum
critical regime in 2D. Consequently, surface thermal conductivity should scale
in a way similar to that in quantum critical regimes in $d=2$ ($d$ being the
spatial dimension) studied below, after a proper symmetry identification.

The second applicable class is the celebrated examples of
superconductor–topological-insulator–superconductor (STIS) junctions with a
$\pi$-phase shift between superconducting regions [6]. Just like surface
states discussed above, STIS junctions host gapless Majorana fermions confined
along one spatial direction. Thermal conductivity of a 1D channel in this case
can also be directly related to dynamics near 1D quantum critical points.

The last class is related to quantum critical regimes where universality
classes are defined by emergent gapless real fermions, which also turn out to
be topological in nature. Generally, between quantum phases with same local
ordering but different topologies, there shall always be topological quantum
critical points (TQCPs). These TQCPs are not induced by usual spontaneous
symmetry breaking, and are beyond the standard Landau paradigm of order-
disorder phase transitions. Instead, they appear to signify a change of global
topologies. A particularly interesting subset is the TQCPs in fermionic
superfluids and superconductors [22, 21, 23]. One unique aspect of
superconductors is that particle and hole excitations are indistinguishable
due to the presence of the condensate of Cooper pairs. Thus, TQCPs in
superconductors are naturally characterized by dynamics of Majorana fermions.

Below we will carry out our discussions in the context TQCPs although one
shall keep in mind that their main practical applications are to gapless or
nearly gapless Majorana fermions in superconductors or superfluids that are
experimentally more accessible. In a few previous papers by the authors and
collaborators [22, 21, 23], we have developed effective field theories of real
fermions interacting with massive real scalar fields to describe TQCPs in
fermionic superfluids and superconductors. These TQCPs separate topological
and non-topological states that are both superfuids or superconducting.
Topological phase transitions between these states happen only at zero
temperature; at finite temperatures, states crossover into each other. In this
Letter, we first investigate interacting gapless real fermions in this
particular context and focus on how discrete global symmetries such as a
$Z_{2}$ time-reversal symmetry (TRS) affect thermodynamic and transport
properties near TQCPs in superfluids and superconductors. We will discuss
applications to other gapless systems afterwards.

The motivation to study the effect of global symmetries is at least two-fold.
First, the classification of (weakly interacting) topological superfluids and
superconductors depends on global symmetries such as TRS [24, 25, 26, 27]. For
example, in two dimensions superconductors with no global symmetry (i.e.
breaking TRS) are classified by the integer group $Z$, while superconductors
with TRS are classified by the $Z_{2}$ group. Thus, one should expect that
TQCPs with different global symmetries to be assigned to quantum phase
transitions between topological states and topologically trivial states.
Second, at more conventional quantum critical points involving order-disorder
transitions, global symmetries play a central role in determining their
universality [20]. Therefore, it is also natural to investigate the roles of
global symmetries at TQCPs beyond the standard Landau paradigm.

The key concept here is that it is global symmetries at TQCPs that define the
degrees of freedom at low energies [23]. For example, if apart from the
particle-hole symmetry no other symmetries are present, generically the low
energy effective field theory should only consist of a minimum $n=2$ or two-
component real fermion fields in its fundamental representation. This case of
no global symmetries can also be named as the case of $Z_{1}$.

If there do exist discrete global symmetries, the effective field theory
should consist of $n=2N$-component Majorana fermions with $N>1$. In
particular, if only a $Z_{2}$ global symmetry such as TRS is present, we have
an $n=2N=4$ real-fermion field representation for TQCPs. The differences in
$2N$, the degrees of freedom near TQCPs, dictate the structure of effective
interactions, which in turn determines the universal behavior of thermodynamic
and transport quantities in the quantum critical regime.

For strongly interacting TQCPs, the effect of global symmetries has been
analyzed before. The presence of global symmetries does change the
universality of these TQCPs as suggested in Ref. [23]. On the other hand, for
weakly interacting TQCPs between gapped superfluid or superconducting phases,
$Z_{2}$ global symmetries, such as TRS, are found not to change the universal
scaling of thermodynamic quantities near TQCPs or the order of phase
transitions [22] in high dimensions $d=2,3$. However, as to be elaborated in
this Letter, the entropy density and scaling of dynamics such as thermal
conductivity are distinct in quantum critical regimes with and without any
global symmetries. Practically, they can be robust smoking guns for detecting
underlying global symmetries and their impact on relevant degrees of freedom
in emergent real fermion dynamics.

Before discussing details, we would like to emphasize again that although the
following scaling of thermal conductivity is obtained in the context of TQCPs,
it can be applied to other gapless or nearly gapless Majorana systems that are
experimentally accessible, such as surface Majorana states of topological
superconductors and gapless states in 1D Majorana wire built of STIS
junctions.

For concreteness, we use a $Z_{2}$ symmetry of TRS as an example to
demonstrate the effect of global symmetries. We compare TQCPs with no symmetry
(referred as time-reversal breaking or TRB for short) and those with only TRS
(referred as time-reversal invariant or TRI). The generic low energy effective
Hamiltonian for TQCPs between fully gapped superfluid or superconducting
phases has the following emergent relativistic form

$\mathcal{H}=\frac{1}{2}\psi^{T}\Bigg{[}c_{\psi}\sum_{j=1}^{d}(-i\partial_{j})\Gamma_{j}+\Gamma_{0}m\Bigg{]}\psi+\mathcal{H}_{\text{int}}$
(1)

where

$\mathcal{H}_{\text{int}}=\frac{1}{2}\big{[}\pi^{2}+c_{\phi}^{2}(\nabla\phi)^{2}+M^{2}\phi^{2}\big{]}+g\psi^{T}\Gamma_{0}\psi\phi,$
(2)

$\psi$ is a $n=2$ two-component real field for $Z_{1}$ or TRB case, and a
$n=4$ four component real fermion field for $Z_{2}$ symmetric case or TRI
case. $\phi$ is a massive real scalar field, $\pi$ is the canonical conjugate
field of $\phi$, and $d$ is the spatial dimension. Here, we focus on a generic
model where Majorana fermions only couple to one single most relevant scalar
field.

TRB topological superconductors only exist in 2D and are comprised of spinless
fermions, with $\psi=(\chi_{+},\chi_{-})^{T}$ and

$\displaystyle\Gamma_{1}=\tau_{z},$ $\displaystyle\Gamma_{2}=\tau_{x},$
$\displaystyle\Gamma_{0}=\tau_{y}.$ (3)

TRI topological superconductors comprised of spin-$1/2$ fermions exist in both
2D and 3D, with
$\psi=(\chi_{+\uparrow},\chi_{+\downarrow},\chi_{-\uparrow},\chi_{-\downarrow})^{T}$
and

$\displaystyle\Gamma_{1}=-\tau_{z}\sigma_{z},$
$\displaystyle\Gamma_{2}=\tau_{x}\sigma_{0},$
$\displaystyle\Gamma_{3}=\tau_{z}\sigma_{x},$
$\displaystyle\Gamma_{0}=\tau_{y}\sigma_{0}.$ (4)

$\tau_{\alpha}$ and $\sigma_{\alpha}$ ($\alpha=x,y,z$) are Pauli matrices in
the $(\chi_{+},\chi_{-})$ and spin subspaces, respectively, with $\sigma_{0}$
being the identity matrix.

The effective Hamiltonian is valid in the vicinity of the TQCP where real
fermions are almost massless but $\phi$ field is always massive [22] unless
further fine tuned so that the TQCP falls into a conformal fixed point.
Generically, near TQCPs, we can have $m\ll\Lambda_{0}\ll M$, with
$\Lambda_{0}$ being the ultraviolet momentum cutoff of the effective theory.

Let us first focus on the weakly interacting case. A direct consequence of
different degrees of freedom near TQCPs due to different symmetries is
different amounts of thermal entropy in the quantum critical regime. The
degrees of freedom near a TRI TQCP is twice that of a TQCP with no symmetries.
Thus, thermal entropy in the quantum critical regime should also be twice for
systems with only TRS compare with those without any symmetries. Near a weakly
interacting TQCP, interactions always flow to zero. Therefore, we can
approximate the thermal entropy density $S$ in the quantum critical regime
using simple thermodynamic relations for noninteracting systems and find for
$T\gg m$,

$S\approx(2s+1)(d+1)\alpha_{d}c_{\psi}^{-d}T^{d},$ (5)

where $s$ is the total spin, and $\alpha_{d}=(2\pi)^{-d}\Omega_{d-1}\int
dxx^{d-1}\ln(1+e^{-x})$, with $\Omega_{d-1}$ the solid angle for a
$(d-1)$-sphere. Note that a TRI system has $s=1/2$, while a TRB system has
$s=0$. Thus, although the entropy always scales as $T^{d}$ regardless of
global symmetries, the value of entropy density measured in units of
$(T/c_{\psi})^{d}$ is doubled when a $Z_{2}$ symmetry is present; so is the
specific heat $C_{V}$ that directly measures the entropy.

Another aspect of different symmetries is the scaling of transport properties
such as thermal conductivity. For the weakly interacting case, since the
scalar field $\phi$ is too massive to be excited, it is the elastic scattering
between fermions that enters thermal conductivity. TRS plays an important role
in determining the scaling of the scattering amplitude. In the following, we
consider scattering between two-component Majorana fermions with given spin
$(\chi_{+,s_{i}},\chi_{-,s_{i}})^{T}$ (Fig.1).

The scattering amplitude has the following form

$a(1,2;3,4)\propto
g^{2}\Bigg{[}\frac{\delta_{s_{1},-s_{2}}\delta_{s_{1},s_{3}}\delta_{s_{2},s_{4}}}{(\epsilon_{1}-\epsilon_{3})^{2}-c_{\phi}^{2}({\bf
k_{1}-k_{3}})^{2}-M^{2}+i\delta}\\\
+\frac{\delta_{s_{1},s_{2}}\delta_{s_{1}s_{3}}\delta_{s_{2}s_{4}}}{(\epsilon_{1}-\epsilon_{3})^{2}-c_{\phi}^{2}({\bf
k_{1}-k_{3}})^{2}-M^{2}+i\delta}\\\
-\frac{\delta_{s_{1},s_{2}}\delta_{s_{1}s_{4}}\delta_{s_{2}s_{3}}}{(\epsilon_{1}-\epsilon_{4})^{2}-c_{\phi}^{2}({\bf
k_{1}-k_{4}})^{2}-M^{2}+i\delta}\Bigg{]},$ (6)

where the index $i$ denotes two-component Majorana fermions with energy
$\epsilon_{i}$, momentum ${\bf k_{i}}$, and spin $s_{i}$.

For the TRB case of spinless fermions, the first term in the summation
vanishes identically. The second (direct) and third (exchange) terms cancel in
the leading order $O(\frac{1}{M^{2}})$ resulting in a subleading term of
$O(\frac{1}{M^{4}})$ in the limit $M\gg\Lambda_{0}$,

$\begin{split}a(1,2;3,4)\propto&\frac{g^{2}}{M^{4}}\Big{[}(\epsilon_{1}-\epsilon_{4})^{2}-c_{\phi}^{2}({\bf
k_{1}-k_{4}})^{2}\\\ &-(\epsilon_{1}-\epsilon_{3})^{2}+c_{\phi}^{2}({\bf
k_{1}-k_{3}})^{2}\Big{]}.\end{split}$ (7)

Thus, for the $Z_{1}$ case without any symmetry, $a$ vanishes in the infrared
limit when the frequency and momentum approach zero with a scaling dimension
$D_{s}=2$.

In contrast, for the TRI case of spin-$1/2$ fermions, the first term in the
summation of $O(\frac{1}{M^{2}})$ is dominating in the same limit, and we have

$a(1,2;3,4)\propto\frac{g^{2}}{M^{2}}\delta_{s_{1},-s_{2}}\delta_{s_{3},-s_{4}}\delta_{s_{1},s_{3}}.$
(8)

$a$ in the presence of a $Z_{2}$ global symmetry remains a constant in the
infrared limit, in stark contrast to the $Z_{1}$ case without global
symmetries.

Figure 1:  Effective fermion-fermion scattering in the massive scalar field
limit. Solid lines represent two-component Majorana fermions with given spin,
and wavy lines represent massive scalar fields.

The scattering amplitude between Majorana fermions sets the scattering rate
between quasiparticles. This scattering rate can be obtained from Fermi’s
Golden rule [28]

$\frac{1}{\tau_{sc}}=\frac{2\pi}{\hbar}\sum_{\begin{subarray}{c}{\bf
k_{2},k_{3},k_{4}}\\\
s_{2},s_{3},s_{4}\end{subarray}}\Big{\\{}|\tilde{a}(1,2;3,4)|^{2}\delta(\epsilon_{1}+\epsilon_{2}-\epsilon_{3}-\epsilon_{4})\\\
(2\pi\hbar)^{d}\delta({\bf k_{1}+k_{2}-k_{3}-k_{4}})\\\
[f_{2}(1-f_{3})(1-f_{4})+(1-f_{2})f_{3}f_{4}]\Big{\\}},$ (9)

where $f_{i}=1/(e^{\epsilon_{i}}+1)$ and $\epsilon_{i}=\sqrt{c_{\psi}^{2}{\bf
k_{i}}^{2}+m^{2}}$ are the quasiparticle distribution function and energy, and
$\tilde{a}(1,2;3,4)$ is the scattering amplitude between quasiparticles with
coherence factors further included [29, 30].

Accordingly, the scattering rate has the following scaling behaviors for low
energy quasiparticles with $\epsilon_{1}\sim O(T)$. For the TRB case, we have

$\frac{1}{\tau_{sc}}\propto\frac{g^{4}}{M^{8}}T^{2d+3}.$ (10)

In contrast, for the TRI case we have

$\frac{1}{\tau_{sc}}\propto\frac{g^{4}}{M^{4}}T^{2d-1}.$ (11)

As a result, thermal conductivity in the quantum critical regime should scale
differently for systems with and without TRS. This can be seen by solving the
Boltzmann equation

$\partial_{t}f^{\prime}+(\nabla_{\bf k}\epsilon_{\bf k})\cdot({\nabla_{\bf
r}}f^{\prime})-(\nabla_{\bf r}\epsilon_{\bf k})\cdot(\nabla_{\bf
k}f^{\prime})=-\frac{f^{\prime}-f}{\tau_{sc}},$ (12)

where $\nabla_{\bf r}$ and $\nabla_{\bf k}$ are gradients in spatial and
momentum spaces, and $f^{\prime}$ and $f$ are quasiparticle distribution
functions away and at equilibrium. In the limit $m\to 0$, we have

$\kappa=(2s+1)\tau_{sc}T^{d}c_{\psi}^{2-d}I_{d},$ (13)

where $I_{d}=\int\frac{d\Omega_{d-1}}{(2\pi)^{d}}\cos^{2}\theta\int
dxx^{d+1}\frac{e^{x}}{(1+e^{x})^{2}}$.

Therefore, the thermal conductivity scales differently with temperature in the
quantum critical regime for different symmetries. For the $Z_{1}$ or TRB case
with no global symmetries, we have

$\kappa\propto T^{-(d+3)},\quad d=1,2,3.$ (14)

While for the $Z_{2}$ TRI case, it becomes

$\kappa\propto T^{-(d-1)},\quad d=1,2,3.$ (15)

This is one of the main results of this Letter. When applying these results,
especially Eq.(15) to $d=1$, we have assumed weak interactions do not result
in a gap and fermions still remain gapless.

Without fine tuning, a topological superconductor typically is not gapless or
quantum critical. However, practically the results above can be easily applied
to other gapless Majorana systems. For example, the surface Majorana states of
3D topological superconductors are always gapless and can be viewed as quantum
critical from a surface point of view [21]. Therefore, it might be more
plausible to examine the role of global symmetries by studying thermal
conductivity of surface states. There is a subtle difference between bulk and
surface states. Since the degrees of freedom of surface states are half of
those in the bulk, surface states with only one $Z_{2}$ global symmetry of TRS
are described by two-component real fermions rather than four-component real
fermions in the bulk, mapping the dynamics into the $Z_{1}$ case.

For instance, consider a 3D topological superconductor with a global $Z_{2}$
TRS described by Hamiltonian (1) and $\Gamma$ matrices (4). The effective
Hamiltonian on the $xz$-surface can be written as

$\mathcal{H}_{\text{surf}}=\frac{1}{2}\tilde{\psi}^{T}c_{\psi}[\sigma_{z}(i\partial_{x})-\sigma_{x}(i\partial_{z})]\tilde{\psi}+\mathcal{H}_{\text{int}},$
(16)

where $\tilde{\psi}=(\chi_{+\uparrow},\chi_{+\downarrow})^{T}$ is a two-
component real fermion on the surface and $\mathcal{H}_{\text{int}}$ is the
same as Eq. (2). This effectively describes a two-dimensional weakly-
interacting massless real system, which can be mapped into a 2D TQCP without
any global symmetry, i.e. the $Z_{1}$ case. Thus, the surface transport
properties of 3D topological superconductors should resemble the transport
properties of a 2D TRB topological superconductor in the quantum critical
regime. Consequently, the surface thermal conductivity should scale as Eq.
(14) with $d=2$. Since the surface states remain gapless as long as the bulk
gap remains open, no fine-tuning is required to observe such dynamics.

As mentioned before, another interesting applicable system is a STIS junction
with a $\pi$-phase shift between superconducting regions. Just like the
surface states discussed above, STIS junctions respect TRS and has a global
$Z_{2}$ symmetry; being on the edge, they also host minimum $n=2$ or two-
component gapless real fermions confined to a 1D quantum wire. The thermal
conductivity of such a 1D wire should scale as Eq. (14) with $d=1$ for the
$Z_{1}$ case or without global symmetries.

We would like to emphasize that different scalings of transport quantities and
mass renormalization are unique to gapless Majorana fermions [31]. This
difference arises from the fact that when no symmetry is present, TQCP
dynamics are determined by minimum two-component Majorana fields. Two Majorana
fermions cannot interact locally and there can be no four-fermion interactions
without involving gradient operators. This is in stark contrast to complex
fermions, where four-fermion local interactions (without gradient operators)
typically dominate in the long wavelength limit.

Finally, let us briefly comment on strongly interacting cases. Details of
thermal transport in this limit remain a challenging topic. Here we focus on
transport properties dictated by strong coupling fixed points. The strong
coupling limit corresponds to massless scalar fields or $M=0$ limit. The one-
loop renormalization group equation for $g$ has the following form

$\frac{d\tilde{g}^{2}}{d\ln(\Lambda/\Lambda_{0})}=-\epsilon\tilde{g}^{2}+c_{d}\tilde{g}^{4},$
(17)

where $\Lambda$ and $\Lambda_{0}$ are the running and ultraviolet momentum
cutoff, $\epsilon=3-d$, $\tilde{g}^{2}=g^{2}/\Lambda^{\epsilon}$, and $c_{d}$
is a numerical factor [23]. This suggests an infrared stable strong coupling
fixed point at $M=0$, $\tilde{g}_{c}^{2}=c_{d}^{-1}\epsilon$ for dimensions
$d=3-\epsilon<3$. These strong coupling fixed points belong to the Gross-Neveu
type and are represented by conformal field theories. The fixed point of the
TRB case further exhibits supersymmetry in addition to the standard scale-
conformal symmetry [23]. Nevertheless, in both TRB and TRI cases, dynamics are
manifestly scale invariant, differing from the weakly coupling cases as the
scalar field is now massless.

At finite $T$, the scalar fields shall develop a mass gap of order of
$f(\tilde{g}_{c}^{2})T$ where $f(\tilde{g}_{c}^{2}=c_{d}^{-1}\epsilon)$ is a
universal function that only depends on $\epsilon$. In the standard
$\epsilon$-expansion, one obtains that $f(\epsilon)\propto\epsilon$ [30].
Following general considerations, the scattering rate has the following
generic scaling form, for either TRI or TRB strong coupling fixed points,
$\frac{\hbar}{\tau_{sc}}\propto\Lambda^{z}h(\tilde{g}(\Lambda),\frac{\Lambda^{z}}{T})$,
where $\Lambda$ is the ultraviolet scale of an effective field theory,
$\tilde{g}(\Lambda)$ is the dimensionless coupling constant for a running
scale $\Lambda$ and $h(x,y)$ is a dimensionless function. $z=1$ is the dynamic
scaling exponent in our case.

The key idea here is that at strong coupling fixed points,
$\tilde{g}(\Lambda)=\tilde{g}_{c}\sim\epsilon$ is independent of the running
scale $\Lambda$. So by simply setting the running scale so that
$\Lambda^{z}=T$, we find that the scattering rate $1/\tau_{sc}$ is naturally
related to the Planckian time scale $\hbar/T$ at fixed points, regardless of
TRS. Indeed, we find that in $d=3-\epsilon$ (i.e. slightly below 3D) [30]

$\displaystyle\frac{\hbar}{\tau_{sc}}=Th(\tilde{g}_{c},1)\propto\epsilon T.$
(18)

Consequently, unlike in the weakly coupling limit where we have found
distinctly different scaling properties, thermal conductivity at strong
coupling fixed points shall always scale as, in both TRB and TRI cases,

$\displaystyle\kappa\propto T^{d-1}.$ (19)

So in this limit, scaling behaviors of thermal transport $\kappa$ turn out to
be the same with or without $Z_{2}$ global symmetries.

In conclusion, we have examined the effect of discrete global symmetries on
interacting gapless Majorana fermions in superfluids and superconductors. We
find that discrete global symmetries can set the values of entropy density and
scaling properties of transport quantities such as thermal conductivity.
Global symmetries determine degrees of freedom at low energies, which not only
directly affect entropy but also put stringent constraints on effective
fermion-fermion interactions. In this Letter, we have used TRS as an example
to discuss these effects, but the results can be generalized to other global
symmetries such as parity and to crystalline symmetries as well. We also note
that scalings of thermal conductivity are applicable to many gapless Majorana
systems that are quite accessible in experiments.

One of the applications of the results obtained in this Letter is to utilize
them as an approach to detect Majorana fermions in the presence or absence of
global symmetries as thermal transport properties are distinctly different.
Generally, global symmetries such as TRS cannot be easily detected directly in
experiments. The measurement on thermal conductivity can offer information
about possible global symmetries present in interacting Majorana fermions.

###### Acknowledgements.

F.Y. is supported by Chinese International Postdoctoral Exchange Fellowship
Program (Talent-introduction Program) and Shuimu Tsinghua Scholar Program at
Tsinghua University. F.Z. is supported by an NSERC (Canada) Discovery Grant
under the contract RGPIN-2020-07070 and a grant from the University of British
Columbia.

## References

  * [1] J. Alicea, Rep. Prog. Phys. 75, 076051 (2012)
  * [2] C. W. J. Beenakker, Annu. Rev. Condens. Matter Phys. 4 113 (2013).
  * [3] S. R. Elliott and M. Franz, Rev. Mod. Phys. 87, 137 (2015).
  * [4] N. Read and D. Green, Phys. Rev. B, 61, 10267 (2000).
  * [5] A. Kitaev, Phys.-Uspekhi 44, 131 (2001).
  * [6] L. Fu and C. L. Kane, Phys. Rev. Lett. 100, 096407 (2008).
  * [7] X.-L. Qi, T. L. Hughes, and S.-C. Zhang, Phys. Rev B 82, 184516 (2010).
  * [8] J. D. Sau, R. M. Lutchyn, S. Tewari, and S. Das Sarma, Phys. Rev. Lett. 104, 040502 (2010).
  * [9] R. M. Lutchyn, J. D. Sau, and S. Das Sarma, Phys. Rev. Lett. 105, 077001 (2010).
  * [10] J. Alicea, Phys. Rev. B 81, 125318 (2010).
  * [11] S. B. Chung, H.-J. Zhang, X.-L. Qi, and S.-C. Zhang, Phys. Rev. B 84, 060510(R) (2011).
  * [12] A. Cook and M. Franz, Phys. Rev. B 84, 201105(R) (2011)
  * [13] S. Gangadharaiah, B. Braunecker, P. Simon, and D. Loss, Phys. Rev. Lett. 107, 036801 (2011).
  * [14] T.-P. Choy, J. M. Edge, A. R. Akhmerov, and C. W. J. Beenakker, Phys. Rev. B 84, 195442 (2011).
  * [15] A. Yu. Kitaev, Ann. Phys. 303 2 (2003).
  * [16] C. Nayak, S. H Simon, A. Stern, M. Freedman, and S. Das Sarma, Rev. Mod. Phys. 80, 1083 (2008).
  * [17] M. Z. Hasan and C. L. Kane, Rev. Mod. Phys. 82, 3045 (2010).
  * [18] X.-L. Qi and S.-C. Zhang, Rev. Mod. Phys. 83, 1057 (2011).
  * [19] B. A. Bernevig and T. Hughes, Topological insulators and topological superconductors (Princeton University Press 2013).
  * [20] S. Sachdev, Quantum Phase Transitions 2nd Edition, (Cambridge University Press, 2011).
  * [21] F. Yang and F. Zhou, Phys. Rev. B 103, 205126 (2021).
  * [22] F. Yang, S.-J. Jiang, and F. Zhou, Phys. Rev. B 100, 054508 (2019).
  * [23] F. Zhou, Phys. Rev. B 105, 014503 (2022).
  * [24] A. P. Schnyder, S. Ryu, A. Furusaki, and A. W. W. Ludwig, Phys. Rev. B 78, 195125 (2008).
  * [25] A. Kitaev, AIP Conference Proceedings 1134, 22 (2009).
  * [26] X.-L. Qi, T. L. Hughes, and S.-C. Zhang, Phys. Rev. B 81, 134508 (2010).
  * [27] J. C. Y. Teo and C. L. Kane, Phys. Rev. B 82, 115120 (2010).
  * [28] P. Coleman, Introduction to Many-body Physics, (Cambridge University Press, 2015).
  * [29] J. R. Schrieffer, Theory of Superconductivity (Addison-Wesley Publishing Company, 1964).
  * [30] See Supplementary Material for details about coherence factors, mass renormalization of Majorana fermions, and scattering rate in strong coupling limit.
  * [31] Global symmetries also affect the Majorana mass renormalization. For TRB systems with $s=0$, in the large mass limit the Majorana mass renormalization is given by $\delta m\approx\frac{g^{2}c_{\psi}\Lambda_{0}^{3}}{18\pi^{2}M^{4}}\left(1+\frac{2c_{\phi}^{2}}{c_{\psi}^{2}}\right)m$. However, for TRI systems with spin $s=1/2$, the Majorana mass renormalization becomes $\delta m\approx(2s)\frac{g^{2}\Lambda_{0}}{2\pi^{2}M^{2}c_{\psi}}m$. See Supplementary for detail. The expression for $\delta\mu$ below Eq. (30) in Ref. [22] is only valid for TRI cases.

##  Appendix A Supplementary Material

###  A.1 Quasiparticle scattering amplitude

The scattering amplitude of quasiparticles $\tilde{a}(1,2;3,4)$ differs from
that of Majorana fermions $a(1,2;3,4)$ due to the presence of coherence
factors. For the TRB case, $\tilde{a}$ is

$\begin{split}\tilde{a}(1,2;3,4)\propto&\frac{g^{2}}{M^{4}}\Big{\\{}\big{[}(\epsilon_{1}-\epsilon_{4})^{2}-c_{\phi}^{2}({\bf
k_{1}-k_{4}})^{2}\big{]}2(u^{*}_{\bf k_{1}}u_{\bf k_{4}}-v_{\bf k_{1}}v_{\bf
k_{4}}^{*})2(u^{*}_{\bf k_{2}}u_{\bf k_{3}}-v_{\bf k_{2}}v_{\bf k_{3}}^{*})\\\
&-\big{[}(\epsilon_{1}-\epsilon_{3})^{2}+c_{\phi}^{2}({\bf
k_{1}-k_{3}})^{2}\big{]}2(u^{*}_{\bf k_{1}}u_{\bf k_{3}}-v_{\bf k_{1}}v_{\bf
k_{3}}^{*})2(u^{*}_{\bf k_{2}}u_{\bf k_{4}}-v_{\bf k_{2}}v_{\bf
k_{4}}^{*})\Big{\\}}.\end{split}$ (S.1)

At TQCP, we have $u_{\bf k}=1/\sqrt{2}$ and $v_{\bf k}=\Delta_{\bf
k}/(\sqrt{2}|\Delta_{\bf k}|)$, where we have chosen $u_{\bf k}$ to be real
and positive by convention. $\Delta_{\bf k}$ is the superconducting order
parameter. For the TRB example considered in this Letter, we have $\Delta_{\bf
k}=c_{\psi}(k_{x}+ik_{y})$.

For the TRI case, we have

$\tilde{a}(1,2;3,4)\propto\frac{g^{2}}{M^{2}}2(u_{\bf k_{1}}^{\dagger}u_{\bf
k_{3}}-v_{\bf k_{1}}v^{\dagger}_{\bf k_{3}})_{s_{1}s_{3}}2(u_{\bf
k_{2}}^{\dagger}u_{\bf k_{4}}-v_{\bf k_{2}}v^{\dagger}_{\bf
k_{4}})_{s_{2}s_{4}}\delta_{s_{1},-s_{2}}\delta_{s_{1},s_{3}}\delta_{s_{2},s_{4}}.$
(S.2)

Here $u_{\bf k}$, $v_{\bf k}$ are $2\times 2$ matrices. At the TQCP, we have
$u_{{\bf k}\sigma\sigma^{\prime}}=\delta_{\sigma\sigma^{\prime}}/\sqrt{2}$,
and $v_{{\bf k}\sigma\sigma^{\prime}}=\Delta_{{\bf
k}\sigma\sigma^{\prime}}/\sqrt{2(\Delta_{{\bf k}}\Delta_{{\bf
k}}^{\dagger})_{\sigma\sigma}}$. For the TRI examples considered in this
Letter, $\Delta_{\bf k}=c_{\psi}i{\bm{\sigma}}\cdot{\bf k}\sigma_{y}$.

###  A.2 Majorana mass renormalization in the weak coupling limit

Global symmetries affect the Majorana mass renormalization in the weak
coupling limit, which is given by the diagrams in Fig. S.1. The two diagrams
differ by a factor of $-(2s+1)$ as a result of the fermion loop in the second
one. For TRB systems with $s=0$, the two diagrams exactly cancel each other in
the order of $1/M^{2}$ in the large mass limit $M\gg\Lambda_{0}$. Thus, the
Majorana mass renormalization is given by

$\delta
m^{(B)}\approx\frac{g^{2}c_{\psi}\Lambda_{0}^{3}}{18\pi^{2}M^{4}}\left(1+\frac{2c_{\phi}^{2}}{c_{\psi}^{2}}\right)m.$
(S.3)

However, for TRI systems with spin $s=1/2$, these two diagrams no longer
cancel in the order of $1/M^{2}$, and the Majorana mass renormalization
becomes

$\delta m^{(I)}\approx(2s)\frac{g^{2}\Lambda_{0}}{2\pi^{2}M^{2}c_{\psi}}m.$
(S.4)

Figure S.1:  One-loop diagram for the fermion propagator.

###  A.3 Strong coupling limit

We discuss the detailed structure of the imaginary part of self-energy near
strong coupling fixed point. For simplicity, we focus on the case where
$c_{\phi}=c_{\psi}=1$. The scalar field acquires a finite mass at $T>0$ and
$d<3$. Let $\epsilon=3-d$, we have

$M^{2}=(2s+1)g^{2}T^{d-1}\int\frac{d^{d}x}{(2\pi)^{d}}\frac{1}{x(e^{x}+1)}.$
(S.5)

As $g_{c}^{2}\sim\epsilon T^{3-d}$, we have $M^{2}\sim\epsilon T^{2}$.

The imaginary part of the on-shell retarded self-energy can be written as

$\text{Im}\Sigma^{R}(\epsilon_{\bf k},{\bf
k})=\text{Im}\Sigma_{I}^{R}(\epsilon_{\bf k},{\bf
k})I+\text{Im}\Sigma_{j}^{R}(\epsilon_{\bf k},{\bf k})\Gamma_{j},$ (S.6)

where $I$ is the identity matrix, the repeated index $j$ is summed over from 1
to $d$.

We have

$\begin{split}\text{Im}\Sigma_{0}^{R}(\epsilon_{\bf k},{\bf k})=&-\pi
g^{2}\int\frac{d^{d}q}{(2\pi)^{d}}\frac{1}{4\xi_{\bf q}}\Big{\\{}(1-f_{\bf
k-q}+n_{\bf q})\big{[}\delta(\epsilon_{\bf k}-\xi_{\bf q}-\epsilon_{\bf
k-q})+\delta(\epsilon_{\bf k}+\xi_{\bf q}+\epsilon_{\bf k-q})\big{]}\\\
&+(f_{\bf k-q}+n_{\bf q})\big{[}\delta(\epsilon_{\bf k}-\xi_{\bf
q}+\epsilon_{\bf k-q})+\delta(\epsilon_{\bf k}+\xi_{\bf q}-\epsilon_{\bf
k-q})\big{]}\Big{\\}},\end{split}$ (S.7)

and

$\begin{split}\text{Im}\Sigma_{j}^{R}(\epsilon_{\bf k},{\bf k})=&\pi
g^{2}\int\frac{d^{d}q}{(2\pi)^{d}}\frac{k_{j}-q_{j}}{4\xi_{\bf q}\epsilon_{\bf
k-q}}\Big{[}(1-f_{\bf k-q}+n_{\bf q})\big{(}\delta(\epsilon_{\bf k}-\xi_{\bf
q}-\epsilon_{\bf k-q})-\delta(\epsilon_{\bf k}+\xi_{\bf q}+\epsilon_{\bf
k-q})\big{)}\\\ &+(f_{\bf k-q}+n_{\bf q})\big{(}-\delta(\epsilon_{\bf
k}-\xi_{\bf q}+\epsilon_{\bf k-q})+\delta(\epsilon_{\bf k}+\xi_{\bf
q}-\epsilon_{\bf k-q})\big{)}\Big{]}.\end{split}$ (S.8)

Here $\epsilon_{\bf k-q}=|{\bf k-q}|$, $\xi_{\bf q}=\sqrt{q^{2}+M^{2}}$,
$f_{\bf k-q}=1/(e^{\epsilon_{\bf k-q}}+1)$, and $n_{\bf q}=1/(e^{\xi_{\bf
q}}-1)$. For $M>0$, only $\delta(\epsilon_{\bf k}-\xi_{\bf q}+\epsilon_{\bf
k-q})$ can be satisfied. This puts a constraint on the angle between ${\bf k}$
and ${\bf q}$ for each given $\xi_{\bf q}$.

The $\delta$-function can be rewritten as

$\delta(\epsilon_{\bf k}-\xi_{\bf q}+\epsilon_{\bf
k-q})=\delta(\cos\theta-\cos\theta_{0})\Bigg{(}\frac{\sqrt{1+M^{2}/q^{2}}}{k}-\frac{1}{q}\Bigg{)}\Theta_{1}\Theta_{2}\Theta_{3},$
(S.9)

where $\theta$ is the angle between ${\bf k}$ and ${\bf q}$,

$\cos\theta_{0}=\sqrt{1+\frac{M^{2}}{q^{2}}}-\frac{M^{2}}{2kq},$ (S.10)
$\Theta_{1}=\Theta(\sqrt{q^{2}+M^{2}}-k),$ (S.11)
$\Theta_{2}=\Theta\left(q-k+\frac{M^{2}}{4k}\right),$ (S.12)
$\Theta_{3}=\Theta\left(k^{2}-\frac{M^{4}}{8q^{2}+4M^{2}+8q\sqrt{q^{2}+M^{2}}}\right),$
(S.13)

and $\Theta(\cdot)$ is the Heaviside step function.

Thus, we have

$\text{Im}\Sigma^{R}(\epsilon_{\bf k},{\bf k})=-\pi
g^{2}\int\frac{d^{d}q}{(2\pi)^{d}}\Bigg{[}(f_{\bf k-q}+n_{\bf
q})\Bigg{(}\frac{\sqrt{1+M^{2}/q^{2}}}{k}-\frac{1}{q}\Bigg{)}\delta(\cos\theta-\cos\theta_{0})\Theta_{1}\Theta_{2}\Theta_{3}\Bigg{]}\Bigg{(}\frac{1}{4\xi_{\bf
q}}I+\frac{k_{j}-q_{j}}{4\xi_{\bf q}\epsilon_{\bf k-q}}\Gamma_{j}\Bigg{)},$
(S.14)

where the summation over index $j$ is assumed. For $d=3-\epsilon$, we can
first perform the angular integration, this restricts the direction of ${\bf
q}$ for each given ${\bf k}$. The step functions puts a constraint on the
minimum value of $q$. Although $\text{Im}\Sigma^{R}(\epsilon_{\bf k},{\bf k})$
is anisotropic, all its entries have the same scaling in $T$. For
$\epsilon_{\bf k}\approx M/2$, the step functions can be satisfied for
$q_{\text{min}}\to 0$. In this case, each entry of
$\text{Im}\Sigma^{R}(\epsilon_{\bf k},{\bf k})$ is proportional to

$g^{2}T^{d-2}\ln\epsilon\propto T\epsilon\ln\epsilon,\qquad\epsilon_{\bf
k}\approx\frac{M}{2}.$ (S.15)

For $\epsilon_{\bf k}\gg M/2$, the step functions require that
$q_{\text{min}}\gtrsim k\gg M$. For $\epsilon_{\bf k}\ll M/2$, the step
functions require $q_{\text{min}}\gg M^{2}/k\gg M$. In both cases, each entry
of $\text{Im}\Sigma^{R}(\epsilon_{\bf k},{\bf k})$ is proportional to

$g^{2}T^{d-2}\propto\epsilon T,\qquad\epsilon_{\bf
k}\ll\frac{M}{2}\quad\text{or}\quad\epsilon_{\bf k}\gg\frac{M}{2}.$ (S.16)

For the typical case, the fermion energy $\epsilon_{\bf k}$ is of the order
$O(T)$, which is much larger than $M/2\sim O(\epsilon T)$. Only a negligibly
small fraction (much smaller than $\epsilon$) of fermions have energy
$\epsilon_{\bf k}\approx M/2$. The scattering rate between quasiparticles is
determined by $\text{Im}\Sigma^{R}(\epsilon_{\bf k},{\bf k})$. The coherence
factors only contribute coefficients of order one and do not change the
scaling. Thus, the scattering rate has the following scaling

$\frac{1}{\tau_{sc}}\propto\epsilon T.$ (S.17)