# Contributor-Aware Defenses Against
Adversarial Backdoor Attacks

Glenn Dawson, Muhammad Umer, Robi Polikar

###### Abstract

Deep neural networks for image classification are well-known to be vulnerable
to adversarial attacks. One such attack that has garnered recent attention is
the adversarial backdoor attack, which has demonstrated the capability to
perform targeted misclassification of specific examples. In particular,
backdoor attacks attempt to force a model to learn spurious relations between
backdoor trigger patterns and false labels. In response to this threat,
numerous defensive measures have been proposed; however, defenses against
backdoor attacks focus on backdoor pattern detection, which may be unreliable
against novel or unexpected types of backdoor pattern designs. We introduce a
novel re-contextualization of the adversarial setting, where the presence of
an adversary implicitly admits the existence of multiple database
contributors. Then, under the mild assumption of contributor awareness, it
becomes possible to exploit this knowledge to defend against backdoor attacks
by destroying the false label associations. We propose a contributor-aware
universal defensive framework for learning in the presence of multiple,
potentially adversarial data sources that utilizes semi-supervised ensembles
and learning from crowds to filter the false labels produced by adversarial
triggers. Importantly, this defensive strategy is agnostic to backdoor pattern
design, as it functions without needing—or even attempting—to perform either
adversary identification or backdoor pattern detection during either training
or inference. Our empirical studies demonstrate the robustness of the proposed
framework against adversarial backdoor attacks from multiple simultaneous
adversaries.

###### Index Terms:

Adversarial machine learning, backdoor attacks, false labels, contributor-
aware training, ensemble methods

##  I Introduction

Deep neural networks have been shown to be extremely effective at a wide
variety of tasks in computer vision. The growing prevalence of deep learning
has resulted in its widespread usage in sensitive areas, such as finance [1],
self-driving cars [2] and medical diagnostics [3]. However, recent research
has revealed that deep neural networks are highly vulnerable to adversarial
attacks from malicious users [4]. Generally speaking, adversarial attacks on
deep neural networks fall into one of two categories: evasion attacks, which
aim to force the network to produce misclassification of perturbed test
(inference) samples [5], and poisoning attacks, which infect the training
dataset with malicious examples in order to induce poor generalization
performance [6]. One particularly insidious type of hybrid attack is the
backdoor attack [7], which seeks to force misclassification only in the
presence of a backdoor trigger, while otherwise allowing the network to
operate unimpeded. Such a strategy is especially difficult to detect or defend
against, as the victim of such an attack will have no indicators of any
unusual behavior until the targeted attack is executed in deployment. The
dangerous potential of such a vulnerability is immense, as many modern
technologies rely on the accurate and robust performance of deep neural
networks.

Figure 1:  Applying backdoor attacks following Equation 3 on examples from
MNIST, CIFAR-10, and GTSRB. The clean image, $\bm{x}$, is modified with the
addition of the backdoor trigger, $\eta(y^{\prime})$, to produce a backdoor
attack image $\bm{x}^{\prime}$ that is associated with the false label
$y^{\prime}$.  Figure 2:  Training pipeline with backdoor threats. (a) The
training dataset $\mathcal{D}$ is collected from $J$ contributors to a common
database. Adversaries who inject backdoor patterns may be among the
contributors (red), and hide amidst the clean contributors (green). (b)
Standard training protocol (top) treats $\mathcal{D}=\bigcup\mathcal{D}_{j}$
as a single dataset, and trains a network on the entire $\mathcal{D}$. In
contrast, contributor-aware training (bottom) exploits information about the
source of each subset of the training data to train a robust model (details in
Figure 3). (c) During inference, clean images are classified correctly by both
the standard network and the contributor-aware model (green). However,
backdoor patterns on test data trigger force misclassifications from the
standard network, while the contributor-aware model is unaffected (red).

Prior work on defending against backdoor attacks has focused on detecting the
poisoned samples injected by the malicious user [8, 9, 10]. While these
approaches have been shown to be effective under certain assumptions, they
have also been shown to be ineffective when their assumptions are violated
[11]. More generally, as with any adversarial setting [12] there has been a
cat-and-mouse exchange between backdoor attacks and defenses, with novel
defenses being proposed to defend against attacks, and novel attacks being
constructed to defeat these defenses.

In this work, we introduce a novel contextualization of the adversarial
setting. In all prior art on adversarial attacks and defenses, it has been
implicitly assumed that while an adversary is capable of corrupting both data
and labels without detection, the (defending) learner is only able to observe
the potentially-compromised training data, with no control over how the
dataset was collected. We observe that the mere presence of an adversary
injecting false data implies the existence of multiple data sources: at a
minimum, one providing genuine data, and one providing malicious data. In
accordance with this observation, we propose a simple, practical data
gathering protocol that allows the defender to retain knowledge of data-
contributor associations. We show how, by following this protocol, the
defender can exploit contributor-aware knowledge to effectively defend against
any kind of backdoor attack, even from multiple simultaneous adversaries.
Furthermore, we show that this defense is effective without needing to
identify which—if any—of the contributors are malicious, and without needing
to detect which—if any—samples are poisoned with backdoor patterns.

##  II Adversarial backdoor attacks and defenses

###  II-A Problem statement

Let $\mathcal{X}^{*}$ be the set of all possible data, and $\mathcal{Y}^{*}$
be the set of all labels represented in $\mathcal{X}^{*}$, such that

$\mathcal{F}^{*}:\mathcal{X}^{*}\rightarrow\mathcal{Y}^{*}$ (1)

represents a surjective function mapping each example
$\bm{x}\in\mathcal{X}^{*}$ to its correct label $y\in\mathcal{Y}^{*}$. Then,
the problem of learning from cleanly labeled data can be expressed as
attempting to learn

$\mathcal{F}_{\theta}(\bm{x}\in\mathcal{X}^{*})=\\{y\in\mathcal{Y}^{*}\mid\mathcal{F}^{*}(\bm{x})=y\\}$
(2)

where $\mathcal{F}_{\theta}:\mathcal{X}^{*}\rightarrow\mathcal{Y}^{*}$
represents a function parameterized by $\theta(\mathcal{X},\mathcal{Y})$ that
is learned on some training data $\mathcal{X}\subsetneq\mathcal{X}^{*}$ with
associated labels $\mathcal{Y}\subseteq\mathcal{Y}^{*}$.

Consider an adversary who wishes to force a trained network to misclassify
specific test samples as a target class, $y^{\prime}\in\mathcal{Y}^{*}$. A
backdoor attack may be modeled as corrupting an example
$\bm{x}\in\mathcal{X}^{*}$ by

$\bm{x}^{\prime}=\bm{x}+\eta(y^{\prime})$ (3)

where $\eta(y^{\prime})$ represents the backdoor pattern associated with class
$y^{\prime}$ (examples of backdoor trigger applications are shown in Figure
1). Thus, the adversary attempts to force $\theta$ to be learned such that

$\displaystyle\begin{split}\mathcal{F}_{\theta}(\bm{x}^{\prime})&=\mathcal{F}_{\theta}[\bm{x}+\eta(y^{\prime})]\\\
&=(1-\alpha)\mathcal{F}_{\theta}(\bm{x})+\alpha\mathcal{F}_{\theta}[\eta(y^{\prime})]\\\
&=(1-\alpha)y+\alpha y^{\prime}\end{split}$ (4)

where the $\alpha$ term represents the presence of the backdoor trigger:
$\alpha=1$ when the trigger is present, otherwise $\alpha=0$. A critical part
of the adversary’s attack is that $\mathcal{F}_{\theta}(\bm{x})$ remains
unchanged; in the absence of the backdoor trigger, the classification of
$\bm{x}$ is correct. This condition is usually ensured by applying the
backdoor pattern only on a restricted subset (typically around 10–30%) of the
training data. Importantly, the $\mathcal{F}_{\theta}[\eta(y^{\prime})]$ term
must also be learned, following $\theta[(\eta(y^{\prime}),y^{\prime}]$, such
that the function learns to associate the backdoor trigger with the
adversary’s desired target label.

The goal of the defender, therefore, is to design a training strategy that is
robust to the presence of $\eta(y^{\prime})$, such that
$\mathcal{F}_{\theta}(\bm{x}^{\prime})=y$. The two ways to accomplish this
goal are to either force $\alpha=0$ (so that the backdoor pattern is never
activated), or to force $\mathcal{F}_{\theta}[\eta(y^{\prime})]=y$ (so that
the backdoor false label association is never learned).

Figure 3: Motivating principles for contributor-aware training. (a) In the
training stage, a separate classifier is trained for each subset of data
provided by each contributor. Note that because any subset $\mathcal{D}_{j}$
may contain adversarial backdoor patterns, the corresponding classifier
$\theta_{j}$ will be vulnerable with respect to the adversary who contributed
that subset. (b) During inference, test images are fed to each classifier, and
the outputs are integrated into a single final classification (represented
here by $\otimes$). While any particular classifier may be vulnerable to any
particular backdoor pattern, the forced bad output from the compromised
classifier will be overridden by the other classifiers. Note that a classifier
that is vulnerable to one type of backdoor trigger will not in general be
vulnerable to a different type of backdoor trigger.

###  II-B Defenses against backdoor attacks

Existing defenses against backdoor attacks can be broadly categorized into
three different modalities [13]:

####  II-B1 Training time defenses

Training time defenses operate under the assumption that the defender has
access to the training data, which may or may not be compromised by the
presence of adversarial poisoned samples. Under this regime, the primary goal
of the defender is to detect and remove malicious samples, prior to the model
being trained. Such detection is most commonly done via anomaly detection,
using such methods as spectral signatures [8], activation clustering [9], or
gradient clustering [14]. In terms of Equation 4, such defenses attempt to
ensure that $\alpha=0$ for all training data by detecting and removing any
samples $\bm{x}^{\prime}$ from the dataset.

####  II-B2 Inference time defenses

Inference time defenses seek to exploit the fact that backdoor attacks allow
the model to retain unimpeded performance when not in the presence of a
backdoor trigger. To accomplish this goal, these defenses attempt to detect
and remove any such triggers at inference time. Thus, while the adversary may
be successful in installing backdoor pattern recognition into the compromised
model, the adversary will never be able to take advantage of their backdoor
pattern during inference. Several approaches have been developed for such a
strategy, including STRIP [15], Neo [16], and saliency maps [17]. In terms of
Equation 4, inference time defenses attempt to ensure that $\alpha=0$ for all
testing data.

####  II-B3 Model correction defenses

Unlike the previous two approaches, model correction defenses do not attempt
to modify the data pipeline. Instead, these defenses aim to inspect a trained
model, determine whether the model is compromised, and remove any backdoor
vulnerabilities. Defensive strategies based on model correction include fine-
pruning [18], neural cleanse [10], artificial brain stimulation [19], and
universal litmus patterns [20]. In terms of Equation 4, model correction
defenses attempt to ensure that $\mathcal{F}_{\theta}[\eta(y^{\prime})]=y$.

##  III Recontextualizing adversarial threat
modeling: a practical approach

###  III-A Previous backdoor threat models

The most common backdoor threat model assumes that the attacker is in control
of the training process, with the victim having either outsourced the training
of their network to a malicious actor, or allowed an adversary privileged
access to their training pipeline [7, 21, 22]. These models allow the attacker
to precisely craft backdoor patterns that will have maximal impact against
specific network architectures. However, in practice it is unreasonable to
assume that the attacker has such privileged access, and any real-world
scenario where such access is available would be a catastrophic failure of
operational security. Furthermore, the setting of an outsourced training
provider injecting backdoor triggers into models is unrealistic, both because
such outsourcing is rare in practice, and because the service providers that
do exist would suffer irreparable harm to their reputations if they were to
perform such an attack.

Other threat models weaken the attacker by removing the attacker’s knowledge
of the training details of the target network. Under these models, the typical
approach is to craft full-image masks using adversarial perturbations [23,
24]. However, the practical use cases of such attacks are limited, as the
sensors used in systems where backdoor attacks would be most impactful are not
capable of adding such specific, precise perturbations to their entire inputs,
making it infeasible to trigger the backdoor during inference.

While previous adversarial settings consider a worst-case scenario, we contend
that such settings are ill-posed, as they depend upon unrealistic assumptions
about the capabilities of an attacker in both the training and inference
stages. Furthermore, previous approaches have assumed a helpless defender, who
has no control over their own data collection process, which is an unrealistic
constraint in the context of modern data collection.

###  III-B A more realistic, practical threat model

We pose the setting where the defender wishes to gather a large amount of data
from multiple users into a single database. Here, an adversary may
realistically gain ingress to the training data simply via making a
contribution to the common database. We note that the presence of an adversary
implies the existence of multiple users, as any adversary must be contrasted
with a non-adversarial data source. Furthermore, our multiple-contributor
paradigm allows for multiple adversaries, who may have conflicting objectives,
to attack the same defender simultaneously—a threat class that has not been
previously studied. As the database comprises contributions from multiple
(potentially adversarial) contributors, we allow the defender to have access
to (possibly anonymous) metadata associating each data instance to its
contributor. For example, any contribution to the training database may be
associated with a tag corresponding to the user who made the contribution,
allowing contributor-wise data grouping. Such tags are common and standard for
image databases, and are trivially implemented in ways that preserve user
privacy and anonymity. We claim that by allowing this contributor awareness to
the defender, the defender is able to train an adversarially-robust classifier
without needing to explicitly detect any backdoor patterns themselves, or even
to remove any malicious samples. This pattern-agnostic approach constitutes a
broad defensive strategy against any kind of adversarial backdoor trigger.

Under this more practical and realistic threat model, we consider a set of
disjoint data subsets
$\mathcal{D}=\\{\mathcal{D}_{1},\mathcal{D}_{2},\dots,\mathcal{D}_{J}\\}$,
with each $\mathcal{D}_{j}$ provided by one of $J$ contributors. Each subset
comprises
$\mathcal{D}_{j}=\\{\mathcal{X}_{j}\subsetneq\mathcal{X}^{*},\mathcal{Y}_{j}\subseteq\mathcal{Y}^{*}\\}$,
such that $\\{\bm{x}_{\ell}\in\mathcal{X}_{\ell}\\}\nsubseteq\mathcal{X}_{j}$
for any $\ell\neq j$. Without loss of generality, we assume that unknown to
the defender, any dataset
$\mathcal{D}_{k}=\\{\mathcal{X}_{k}^{\prime},\mathcal{Y}_{k}^{\prime}\\}$ may
be provided by an adversary, following Equation 3. Under the conventional,
contributor-agnostic learning framework, these disjoint subsets would be
concatenated into a single dataset $\mathcal{D}=\bigcup_{j}\mathcal{D}_{j}$,
so the adversary’s poisoned data and labels would be mixed into the common
dataset, with the contributor identification information being lost. Standard
contributor-agnostic training therefore allows the backdoor patterns to be
learned by the classifier, and the attack is easily triggered after model
deployment. The vulnerability of such conventional training is shown in Figure
2.

##  IV Contributor-aware defenses against
adversarial backdoor attacks

We now propose a training scheme where the data subsets remain distinct, so
that all of the data-label pairs (and therefore, any potential backdoor
patterns) provided by any contributor remain grouped by their associated
contributor identification tag. Consider the problem of learning a function
$\mathcal{F}_{\theta_{j}}$ for any particular subset $\mathcal{D}_{j}$; then,
the label set from any subset $\mathcal{Y}_{\ell\neq j}$ would be
uninformative (as some arbitrary $\mathcal{Y}_{\ell}^{\prime}$ may be
adversarial). However, because each $\mathcal{X}_{j}$ is sampled from the same
universal superset $\mathcal{X}^{*}$, the data $\mathcal{X}_{\ell\neq j}$ may
still be utilized as unlabeled data; thus, we use semi-supervised methods to
learn approximate functions $\mathcal{F}_{\theta_{j}}$ on data
$\mathcal{D}^{SSL}_{j}=\\{\mathcal{X}_{j},\mathcal{Y}_{j},\bigcup\mathcal{X}_{\ell\neq
j}\\}$. In this way, we are able to exploit the full characteristics of the
entire training data, without introducing adversarial label associations.
Then, after learning each $\mathcal{F}_{\theta_{j}}$, we can query each
$\mathcal{F}_{\theta_{j}}$ to obtain its predictions for any incoming data.
The full set of $J$ models thus forms a predictive ensemble, where each member
of the ensemble represents contributor $j$ (Figure 3a).

Algorithm 1 Contributor-aware training for robust defenses against adversarial
backdoor attacks.

0: $\mathcal{D}=\\{\mathcal{D}_{1},\dots,\mathcal{D}_{J}\\}$, the set of data-
label pairs provided by each contributor $j\in[1,\dots,J]$

0: $\mathrm{SSL}$, a semi-supervised classification algorithm

1: Training stage:

2: $\bm{\Theta}\leftarrow$ Initialize an empty set of trained models

3: for each contributor $j=1$ to $J$ do

4: $\mathcal{X}_{L},\mathcal{Y}_{L}\leftarrow\mathcal{D}_{j}$ (Gather labeled
data from contributor $j$)

5: $\mathcal{X}_{U}\leftarrow\\{\bigcup_{\ell\neq j}\mathcal{X}_{\ell}\\}$
(Gather unlabeled data from all other contributors $\ell\neq j$)

6:
$\bm{\theta}_{j}\leftarrow\mathrm{SSL}(\mathcal{X}_{L},\mathcal{Y}_{L},\mathcal{X}_{U})$

7: $\bm{\Theta}\leftarrow\\{\bm{\Theta}\cup\bm{\theta}_{j}\\}$

8: end for

8: $\bm{\Theta}$, a predictive ensemble of SSL models

8:

8: $\mathcal{X}\subsetneq\mathcal{X}^{*}$, the data seen during inference

8: $\mathrm{LFC}$, an algorithm for learning from crowds

9: Inference stage:

10: $\mathcal{Y}\leftarrow$ Initialize an empty set of predictions for
$\mathcal{X}$

11: for each $\bm{x}\in\mathcal{X}$ do

12: $\bm{w}\leftarrow$ Initialize an empty set of intermediate predictions for
$\bm{x}$

13: for each model $\bm{\theta}_{j}\in\bm{\Theta}$ do

14: $\bm{w}\leftarrow\\{\bm{w}\cup\mathcal{F}_{\bm{\theta}_{j}}(\bm{x})\\}$

15: end for

16: $y\leftarrow\mathrm{LFC}(\bm{w})$ (Integrate intermediate predictions into
ensemble prediction for $\bm{x}$)

17: $\mathcal{Y}\leftarrow\\{\mathcal{Y}\cup y\\}$

18: end for

18: $\mathcal{Y}$, the set of classification predictions for $\mathcal{X}$

Note that even under the assumption that some data provided by an adversarial
contributor $k$ may be corrupted following Equation 3, the semi-supervised
strategy destroys the association between $\eta_{k}(y^{\prime})$ and
$y^{\prime}$, as $y^{\prime}$ is not present in the labeled dataset for any
contributor $j\neq k$. As a result, $\eta_{k}(y^{\prime})$ is treated as
uninformative noise on $\bm{x}$. Therefore, for any model $\theta_{j\neq k}$
the functional response to an adversarial input will be

$\mathcal{F}_{\theta_{j\neq k}}(\bm{x}^{\prime})=\mathcal{F}_{\theta_{j\neq
k}}[\bm{x}+\eta_{k}(y^{\prime})]=\mathcal{F}_{\theta_{j\neq k}}(\bm{x})=y.$
(5)

Notably, we still do not know which contributors are adversarial, or which
data contain backdoor triggers. Furthermore, while Equation 5 shows that
$\mathcal{F}_{\theta_{j\neq k}}(\bm{x}^{\prime})=y$ for any contributor $j\neq
k$, we still have that $\mathcal{F}_{\theta_{k}}(\bm{x}^{\prime})=y^{\prime}$,
as we have taken no steps to detect or remove adversarial samples.
Fortunately, we do not actually need to identify adversarial examples: because
the intermediate predictions provide label redundancy for any arbitrary
example, we are able to leverage techniques for learning from crowds in order
to filter the adversarial false labels. A straightforward strategy such as
simple majority voting, or more sophisticated nonparametric methods such as
weighted majority voting [25] or OpinionRank [26], can provide fast, efficient
integration of redundant, potentially-noisy labels into reliable ground truth.
Thus, while the adversary is successful in forcing a single classifier to
produce a false prediction, the ensemble prediction is robust against the
adversary’s backdoor trigger, as our proposed approach effectively shields
every other member of the ensemble from the false label associations of the
adversarial inputs (Figure 3b). Contributor-aware training of predictive
ensembles therefore produces a classification model that is secure against
backdoor threats, without requiring, or even attempting, to perform
identification of either the adversaries or the poisoned samples.

The complete algorithm for training and inference under our contributor-aware
learning approach is listed in Algorithm 1. Note that the composite algorithm
is agnostic to the user’s choice of $\mathrm{SSL}$ and $\mathrm{LFC}$
component algorithms, so it represents a modular, high-level framework for
learning that is secure against backdoor threats.

A further advantage of the proposed strategy is that whereas other defensive
approaches remove the poisoned samples from the training dataset upon
detection, our method does not discard any training data. This is desirable,
because each $\bm{x}^{\prime}$ contains salient feature information $\bm{x}$
that can be used to further train a classifier. Depending on the fraction of
data that is poisoned, as well as the success rate of backdoor identification,
detect-and-remove strategies may ultimately throw out substantial amounts of
the training data. In contrast, our approach retains and utilizes the full
100% of the training data to train a robust classifier, even in the (unknown)
presence of large fractions of adversarial samples.

TABLE I:  Test accuracy against a single adversary. Reported as mean and 95%
confidence interval over 5 runs.  Baseline classifier
---
Dataset | Clean | Adversarial
MNIST | $99.03\pm 0.23$ | $9.81\pm 0.01$
CIFAR-10 | $87.28\pm 0.43$ | $12.29\pm 0.39$
GTSRB | $93.50\pm 1.84$ | $0.48\pm 0.00$
Contributor-aware training
Dataset | Clean | Adversarial
MNIST | $97.58\pm 0.06$ | $97.14\pm 0.09$
CIFAR-10 | $93.40\pm 0.17$ | $93.41\pm 0.25$
GTSRB | $98.06\pm 0.06$ | $97.59\pm 0.10$

##  V Experiments

We demonstrate the effectiveness of our proposed defense strategy using three
standard benchmark datasets: MNIST [27], CIFAR-10 [28], and the German Traffic
Sign Recognition Benchmark (GTSRB) dataset [29]. Due to ethical concerns, we
deliberately do not perform experiments on facial recognition datasets [30];
however, we recognize and acknowledge that our research is relevant and may be
applied in this area without our knowledge or consent.

For each dataset, we assumed that the training dataset was built from non-
overlapping contributions from 5 total contributors. We performed experiments
on all datasets for a number of adversaries ranging from 1 to 3, and each
adversary was assumed to have contributed 10% of the total training dataset.
Each adversary’s objective was to force the classifier to misclassify test
images as belonging to a particular target class. For all datasets, these
target classes were fixed at classes 0, 7, and 4 for adversaries 1, 2, and 3,
respectively; these choices were made arbitrarily for the purposes of
statistical analysis over repeated experiments, and our results extend beyond
these choices without any loss of generality. After the adversaries’ data
splits were apportioned, the remaining training data were divided evenly among
the remaining (good-faith) contributors. All data splits were performed
randomly, without fixing the random seed.

Because our defensive strategy does not attempt to perform any kind of data
cleaning or backdoor pattern detection, we permitted the adversaries to use
their strongest possible attacks, i.e. clearly-visible, high-intensity
patterns such as those proposed by BadNets [7]. Each adversary injected their
backdoor pattern into 100% of their contribution to the training database,
corresponding to 10% of the total training dataset, and flipped all of their
training labels to their desired target class. Thus, under three adversaries,
a total of 30% of the training data have backdoor patterns and false labels.

For each backdoor trigger–target class pair, we verified the effectiveness of
the attack by training a baseline classifier and confirming both that the
classifier’s performance on clean test data was unimpeded and that the
backdoor trigger forced the classifier to output the target class. For both
the baseline classifier as well as our defensive strategy, our testing
procedure consisted of two steps:

  1. 1.

Evaluate the model accuracy on the clean test data (without backdoor
triggers). In this stage, we are merely verifying that the model performs
reasonably well on clean data; we are not attempting to obtain state-of-the-
art performance.

  2. 2.

For each adversary, construct an adversarial test set by applying the
corresponding backdoor trigger to the entire clean testing dataset, and
evaluate the model accuracy on the adversarial test data.

Combining both stages, a backdoor attack is considered successful if it can
force the model to misclassify most or all of the adversarial test data as the
target class, while also allowing the model to correctly classify the clean
test data when the backdoor trigger is absent, thus demonstrating that the
misclassification is solely due to the presence of the backdoor trigger. All
experiments were repeated over 5 runs, and we report the average metrics along
with the 95% confidence intervals calculated using the two-sided Student’s
$t$-test.

Figure 4:  Confusion matrices for accuracy performance on the GTSRB dataset.
The four columns correspond to test data: (a) with clean labels, (b) with a
backdoor trigger targeting class 0, (c) with a backdoor trigger targeting
class 7, and (d) with a backdoor trigger targeting class 4. Top: Confusion
matrices produced by a contributor-agnostic PreAct ResNet-18. While the
performance of the classifier on clean data is strong, any adversary may force
the classifier to produce their desired label by applying their backdoor
trigger. Bottom: Confusion matrices produced by contributor-aware training.
The backdoor triggers from all adversaries have been rendered ineffective.
TABLE II:  Test accuracy against multiple simultaneous adversaries. Reported
as mean and 95% confidence interval over 5 runs.  Baseline classifier
---
| Two adversaries | Three adversaries
Dataset | Clean | Adv. 1 | Adv. 2 | Clean | Adv. 1 | Adv. 2 | Adv. 3
MNIST | $99.3\pm 0.2$ | $9.8\pm 0.0$ | $10.9\pm 1.7$ | $99.1\pm 0.2$ | $9.8\pm 0.0$ | $10.2\pm 0.0$ | $9.8\pm 4.8$
CIFAR-10 | $85.9\pm 1.2$ | $12.1\pm 0.4$ | $8.5\pm 1.4$ | $84.0\pm 2.9$ | $11.5\pm 0.4$ | $6.5\pm 1.6$ | $6.7\pm 2.4$
GTSRB | $91.2\pm 1.5$ | $0.4\pm 0.0$ | $3.5\pm 0.0$ | $93.9\pm 1.4$ | $0.7\pm 0.0$ | $3.5\pm 0.0$ | $5.2\pm 0.0$
Contributor-aware training
| Two adversaries | Three adversaries
Dataset | Clean | Adv. 1 | Adv. 2 | Clean | Adv. 1 | Adv. 2 | Adv. 3
MNIST | $97.6\pm 0.1$ | $97.2\pm 0.2$ | $97.3\pm 0.1$ | $95.1\pm 5.8$ | $93.9\pm 6.5$ | $95.7\pm 1.8$ | $95.0\pm 2.4$
CIFAR-10 | $93.4\pm 0.1$ | $93.5\pm 0.1$ | $93.4\pm 0.2$ | $92.6\pm 0.2$ | $92.6\pm 0.3$ | $92.6\pm 0.2$ | $92.5\pm 0.2$
GTSRB | $97.8\pm 0.2$ | $97.4\pm 0.2$ | $97.4\pm 0.2$ | $97.5\pm 0.2$ | $96.9\pm 0.2$ | $97.0\pm 0.2$ | $97.0\pm 0.3$

###  V-A Baseline classifier

For all datasets, the baseline classifier was a randomly-initialized PreAct
ResNet-18, which was trained for 30 epochs. The optimizer was stochastic
gradient descent (SGD), with a learning rate of 0.02, momentum of 0.9, and
weight decay of $510-4$. For the GTSRB dataset, the training and testing
images were resized to a standard size of $32\times 32$, and the learning rate
was annealed by a factor of 0.1 at epochs 15 and 25. For both the CIFAR-10 and
GTSRB datasets, the training images were augmented using RandAugment [31].

The experiments on the baseline classifier verified that the backdoor attack
was effective with pinpoint precision: While the samples in the clean test
dataset were classified correctly with expected performance, the introduction
of the backdoor trigger into the test dataset caused nearly universal
misclassification of all test samples into the classes targeted by each
adversary (Figure 4).

###  V-B MNIST experiments

For the MNIST experiments, adversaries injected a backdoor pattern into one of
the corners of the sample. For the semi-supervised predictive ensemble, we
trained one randomly-initialized auxiliary deep generative model (ADGM) [32]
for each of the five subsets of the training data (corresponding to the five
contributors to the dataset). After the ADGMs were trained, they were
independently tested on the clean testing data as well as the malicious test
data with backdoor triggers. The outputs of each ADGM were integrated into a
single label per instance using OpinionRank [26].

###  V-C CIFAR-10 experiments

For the CIFAR-10 experiments, adversaries injected a backdoor pattern into one
of the corners of the sample. We trained one randomly-initialized Wide
ResNet-28 for each of the five subsets of the training data using the FixMatch
algorithm [33]. After all FixMatch models were trained, they were
independently tested on the clean testing data as well as the malicious test
data with backdoor triggers. The outputs of each FixMatch model were
integrated into a single label per instance using OpinionRank.

###  V-D GTSRB experiments

For the GTSRB experiments, adversaries placed a backdoor pattern at a
randomly-chosen location within the region of interest of the sample (ground
truth for this region is provided by the dataset). This strategy most closely
represents our updated threat model: for example, a malicious actor wishing to
attack autonomous vehicles could place stickers featuring the backdoor
patterns on physical street signs. We trained one randomly-initialized Wide
ResNet-28 for each of the five subsets of the training data using the FixMatch
algorithm. The outputs of each FixMatch model were integrated into a single
label per instance using OpinionRank.

###  V-E Analysis of results

Table I shows the performances of both the baseline classifier, as well as
that of contributor-aware training, against a single adversary, on all three
datasets. As discussed in Section V-A, the baseline classifier exhibited a
catastrophic failure in accuracy as the adversary forced the classifier to
produce the target output. Even worse, the baseline classifier was vulnerable
not only to a single adversary, but to multiple simultaneous adversaries:
Table II shows how any adversary who contributes to the training database is
able to compromise a naïve classifier. Note that the test examples from the
target classes were not removed from the test set, so the baseline classifier
retains a lower bound for performance corresponding to the intersection of the
target class columns with the diagonal of the confusion matrix (see Figure 4).

In contrast, both Table I and Table II show that contributor-aware training
produces models that are robust to adversarial backdoor triggers. In the
single-adversary scenario, even though the adversary contributed 10% of the
training database, the model was still able to produce correct classifications
in the presence of the adversary’s backdoor trigger, exhibiting no meaningful
change in performance. Even against multiple simultaneous adversaries, the
models produced by contributor-aware training remain resilient against all
backdoor attacks.

Figure 4 highlights the improvement of contributor-aware training over the
contributor-agnostic baseline classifier. The baseline classifier is
vulnerable to all adversaries, and is forced to produce each adversary’s
desired target output. In contrast, the contributor-aware model is completely
robust against all adversaries, with the model’s performance unaffected by the
presence of any backdoor triggers.

##  VI Conclusion

Backdoor poisoning attacks on computer vision systems reveal potential
vulnerabilities in sensitive applications. In this work, we discussed previous
adversarial threat models, and proposed a new, more practical
recontextualization of the problem formulation that considers the data
collection process as part of the training pipeline. In particular, we propose
that a diligent data collector will trivially retain (anonymous) associations
between contributions to a training database and the (potentially adversarial)
users who make these contributions. The contributor awareness granted by this
recontextualization opens new avenues for defenses against backdoor
attacks—crucially, without the need to perform adversary identification or
backdoor pattern detection. Under this framework, we developed a novel
universal defensive strategy that produces a classifier that is robust against
backdoor attacks, while remaining agnostic to the potential adversarial
characteristics of the training or testing data. Furthermore, we showed how
our defensive strategy remains robust even in the presence of multiple
simultaneous adversaries, which is a novel threat that has not been previously
explored.

While previous approaches toward backdoor defenses have attempted to perform
careful data sanitization or model sensitivity analysis, our method requires
no special consideration of any particular training or testing samples, and
explicitly allows the membership of compromised models within the predictive
ensemble. Despite this relaxation of traditional constraints, we have shown
that our defensive strategy produces ensembles that are resilient to the
presence of backdoor patterns, even from multiple simultaneous adversaries.
Thus, our procedure represents a training pipeline that is inherently robust
to backdoor attacks, and which can be used in any computer vision application
as a plug-and-play framework for secure learning. We hope that the proposed
addition of contributor awareness to the data-gathering stage of the training
pipeline becomes universally standard, as such awareness opens up new
dimensions of defenses against adversarial attacks.

## Acknowledgment

This work was supported by the U.S. Department of Education, GAANN Grant No.
P200A180055.

## References

  * [1] A. M. Ozbayoglu, M. U. Gudelek, and O. B. Sezer, “Deep learning for financial applications: A survey,” _Appl. Soft Comput._ , vol. 93, p. 106384, 2020\.
  * [2] A. I. Maqueda, A. Loquercio, G. Gallego, N. García, and D. Scaramuzza, “Event-based vision meets deep learning on steering prediction for self-driving cars,” in _CVPR_ , 2018, pp. 5419–5427.
  * [3] C. Leibig, V. Allken, M. S. Ayhan, P. Berens, and S. Wahl, “Leveraging uncertainty information from deep neural networks for disease detection,” _Sci. Rep._ , vol. 7, no. 1, pp. 1–14, 2017.
  * [4] I. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” in _ICLR_ , 2015. [Online]. Available: http://arxiv.org/abs/1412.6572
  * [5] N. Carlini and D. Wagner, “Towards evaluating the robustness of neural networks,” in _IEEE Secur Priv_. IEEE, 2017, pp. 39–57.
  * [6] A. Shafahi, W. R. Huang, M. Najibi, O. Suciu, C. Studer, T. Dumitras, and T. Goldstein, “Poison frogs! targeted clean-label poisoning attacks on neural networks,” in _NeurIPS_ , vol. 31, 2018.
  * [7] T. Gu, K. Liu, B. Dolan-Gavitt, and S. Garg, “Badnets: Evaluating backdooring attacks on deep neural networks,” _IEEE Access_ , vol. 7, pp. 47 230–47 244, 2019.
  * [8] B. Tran, J. Li, and A. Madry, “Spectral signatures in backdoor attacks,” in _NeurIPS_ , 2018, pp. 8011–8021.
  * [9] B. Chen, W. Carvalho, N. Baracaldo, H. Ludwig, B. Edwards, T. Lee, I. Molloy, and B. Srivastava, “Detecting backdoor attacks on deep neural networks by activation clustering,” in _SafeAI@ AAAI_ , 2019.
  * [10] B. Wang, Y. Yao, S. Shan, H. Li, B. Viswanath, H. Zheng, and B. Y. Zhao, “Neural cleanse: Identifying and mitigating backdoor attacks in neural networks,” in _IEEE Secur Priv_. IEEE Computer Society, 2019, pp. 707–723.
  * [11] E. Wenger, J. Passananti, A. N. Bhagoji, Y. Yao, H. Zheng, and B. Y. Zhao, “Backdoor attacks against deep learning systems in the physical world,” in _CVPR_ , June 2021, pp. 6206–6215.
  * [12] A. Pal and R. Vidal, “A game theoretic analysis of additive adversarial attacks and defenses,” in _NeurIPS_ , vol. 33, 2020, pp. 1345–1355.
  * [13] T. A. Nguyen and A. Tran, “Input-aware dynamic backdoor attack,” _NeurIPS_ , vol. 33, pp. 3454–3464, 2020.
  * [14] A. Chan and Y.-S. Ong, “Poison as a cure: Detecting & neutralizing variable-sized backdoor attacks in deep neural networks,” _arXiv preprint arXiv:1911.08040_ , 2019.
  * [15] Y. Gao, C. Xu, D. Wang, S. Chen, D. C. Ranasinghe, and S. Nepal, “Strip: A defence against trojan attacks on deep neural networks,” in _Annu. Comput. Secur. Appl. Conf._ , 2019, pp. 113–125.
  * [16] S. Udeshi, S. Peng, G. Woo, L. Loh, L. Rawshan, and S. Chattopadhyay, “Model agnostic defence against backdoor attacks in machine learning,” _arXiv preprint arXiv:1908.02203_ , 2019.
  * [17] B. G. Doan, E. Abbasnejad, and D. C. Ranasinghe, “Februus: Input purification defense against trojan attacks on deep neural network systems,” in _Annu. Comput. Secur. Appl. Conf._ , 2020, pp. 897–912.
  * [18] K. Liu, B. Dolan-Gavitt, and S. Garg, “Fine-pruning: Defending against backdooring attacks on deep neural networks,” in _RAID_. Springer Verlag, 2018, pp. 273–294.
  * [19] Y. Liu and W.-C. Lee, “Abs: Scanning neural networks for back-doors by artificial brain stimulation,” in _CCS_ , 2019.
  * [20] S. Kolouri, A. Saha, H. Pirsiavash, and H. Hoffmann, “Universal litmus patterns: Revealing backdoor attacks in cnns,” in _CVPR_. IEEE, 2020, pp. 298–307.
  * [21] T. A. Nguyen and A. T. Tran, “Wanet - imperceptible warping-based backdoor attack,” in _ICLR_ , 2021. [Online]. Available: https://openreview.net/forum?id=eEn8KTtJOx
  * [22] K. Doan, Y. Lao, W. Zhao, and P. Li, “Lira: Learnable, imperceptible and robust backdoor attacks,” in _ICCV_ , October 2021, pp. 11 966–11 976.
  * [23] X. Chen, C. Liu, B. Li, K. Lu, and D. Song, “Targeted backdoor attacks on deep learning systems using data poisoning,” _arXiv preprint arXiv:1712.05526_ , 2017.
  * [24] M. Barni, K. Kallas, and B. Tondi, “A new backdoor attack in cnns by training set corruption without label poisoning,” in _ICIP_. IEEE, 2019, pp. 101–105.
  * [25] F. Tao, L. Jiang, and C. Li, “Label similarity-based weighted soft majority voting and pairing for crowdsourcing,” _KAIS_ , vol. 62, pp. 2521–2538, 2020\.
  * [26] G. Dawson and R. Polikar, “Opinionrank: Extracting ground truth labels from unreliable expert opinions with graph-based spectral ranking,” in _IJCNN_ , 2021, pp. 1–8.
  * [27] Y. LeCun, C. Cortes, and C. Burges, “Mnist handwritten digit database,” _ATT Labs [Online]. Available: http://yann.lecun.com/exdb/mnist_ , vol. 2, 2010.
  * [28] A. Krizhevsky, G. Hinton _et al._ , “Learning multiple layers of features from tiny images,” 2009.
  * [29] J. Stallkamp, M. Schlipsing, J. Salmen, and C. Igel, “Man vs. computer: Benchmarking machine learning algorithms for traffic sign recognition,” _Neural Netw_ , vol. 32, pp. 323–332, 2012.
  * [30] I. D. Raji, T. Gebru, M. Mitchell, J. Buolamwini, J. Lee, and E. Denton, “Saving face: Investigating the ethical concerns of facial recognition auditing,” in _AAAI/ACM Conf. AI Ethics Soc._ , ser. AIES ’20, 2020, p. 145–151.
  * [31] E. D. Cubuk, B. Zoph, J. Shlens, and Q. V. Le, “Randaugment: Practical automated data augmentation with a reduced search space,” in _CVPR_ , 2020, pp. 702–703.
  * [32] L. Maaløe, C. K. Sønderby, S. K. Sønderby, and O. Winther, “Auxiliary deep generative models,” in _ICML_. PMLR, 2016, pp. 1445–1453.
  * [33] K. Sohn, D. Berthelot, N. Carlini, Z. Zhang, H. Zhang, C. A. Raffel, E. D. Cubuk, A. Kurakin, and C.-L. Li, “Fixmatch: Simplifying semi-supervised learning with consistency and confidence,” _NeurIPS_ , vol. 33, 2020.


# Intrinsic spin Hall effect from spin quantum metric

Longjun Xiang  College of Physics and Optoelectronic Engineering, Shenzhen
University, Shenzhen 518060, China  Hao Jin<EMAIL_ADDRESS>College of Physics
and Optoelectronic Engineering, Shenzhen University, Shenzhen 518060, China
Jian Wang<EMAIL_ADDRESS>College of Physics and Optoelectronic Engineering,
Shenzhen University, Shenzhen 518060, China  Department of Physics, The
University of Science and Technology, Hefei, China  Department of Physics, The
University of Hong Kong, Pokfulam Road, Hong Kong, China

###### Abstract

The intrinsic spin Hall effect (ISHE) proposed in [Sinova et al. Phys. Rev.
Lett. 92, 126603 (2004)] is driven by the spin Berry curvature. Herein, we
establish the concept of spin quantum metric, which is the counterpart of the
spin Berry curvature in the spin quantum geometric tensor defined in a similar
way to the quantum geometric tensor. Dual to the $\mathcal{T}$-even
($\mathcal{T}$, time reversal) spin Berry curvature, the spin quantum metric
features a $\mathcal{T}$-odd characteristic. Notably, we show that the
$\mathcal{T}$-odd spin quantum metric can also drive an ISHE
($\mathcal{T}$-odd ISHE) under a high-frequency electric field. Guided by
symmetry, we evaluate this $\mathcal{T}$-odd ISHE in the magnetically tilted
surface Dirac cone and in ferromagnetic monolayer MnBi2Te4. We find that this
$\mathcal{T}$-odd ISHE dominates when the Fermi level is close to the band
(anti)crossing point, where its magnitude can be as large as the
$\mathcal{T}$-even ISHE when an infrared driving field is applied. Our work
not only uncovers an indispensable ingredient in the emergent community of
quantum geometric physics but also offers a novel mechanism for ultrafast
spintronics.

Introduction.— Quantum geometry received much attention recently NiuRMP ;
FuBCD ; MaBCDexp ; KFMBCDexp ; KTLawPRB ; LuHZNRP ; GaoQMD ; XuSY2023 ;
Gao2023 ; QMNP ; XiaoCMNHE ; BPT2021 ; WangPRL ; xiangDHE ; JEMoore2010 ;
MaQlight2021 ; MaQlight2023 ; Nagaosa2018NC ; AhnPRX ; AhnNP ; QuantumGeometry
; AMIT ; DaoDao , especially in the studies of Hall effect NiuRMP ; FuBCD ;
MaBCDexp ; KFMBCDexp ; KTLawPRB ; LuHZNRP ; GaoQMD ; XuSY2023 ; Gao2023 ; QMNP
; XiaoCMNHE ; BPT2021 ; WangPRL ; xiangDHE . Usually, the quantum geometry
property in the Hilbert space of Bloch electrons is associated with the non-
Abelian Berry connection MaQlight2021
$\mathcal{A}_{nm}^{\alpha}(\bm{k})=\langle\psi_{n}(\bm{k})|i\partial_{\alpha}|\psi_{m}(\bm{k})\rangle$,
where $|\psi_{n}(\bm{k})\rangle$ is the quantum wavefunction of Bloch
electrons and $\partial_{\alpha}=\partial/\partial k_{\alpha}$ with
$k_{\alpha}$ being the crystal momentum. For instance, the gauge-invariant
combination of $\mathcal{A}^{\alpha}_{nm}$ defines the local quantum geometric
tensor

$\displaystyle
T_{nm}^{\alpha\beta}\equiv\mathcal{A}^{\alpha}_{nm}\mathcal{A}^{\beta}_{mn}=g_{nm}^{\alpha\beta}-\frac{i\Omega_{nm}^{\alpha\beta}}{2},$
(1)

where the antisymmetric part $\Omega_{nm}^{\alpha\beta}$ and symmetric part
$g_{nm}^{\alpha\beta}$ represents the local Berry curvature and quantum
metric, respectively. At an early time, it has been established that the
$\mathcal{T}$-odd ($\mathcal{T}$, time reversal) Berry curvature is
responsible for the intrinsic anomalous Hall effect (IAHE) NiuRMP  in
ferromagnetic metals, see Fig. (1b). Recently, it was further realized that
the $\mathcal{T}$-even quantum metric can also exhibit a critical role in
various Hall effects of quantum materials GaoQMD ; XuSY2023 ; Gao2023 ; QMNP ;
XiaoCMNHE ; BPT2021  and can even induce an intrinsic displacement Hall effect
xiangDHE  under an AC electric field, see Fig. (1a).

Figure 1:  The local quantum geometric tensor $T_{nm}^{\alpha\beta;\gamma}$
probed by the linear responses of charge ($\gamma=0$) and spin ($\gamma\neq
0$). (a) The intrinsic displacement Hall effect (IDHE) probes the
$\mathcal{T}$-even quantum metric xiangDHE . (b) The intrinsic anomalous Hall
effect (IAHE) probes the $\mathcal{T}$-odd Berry curvature NiuRMP . (c) The
$\mathcal{T}$-odd intrinsic spin Hall effect (ISHE) probes the spin quantum
metric (this work). (d) The $\mathcal{T}$-even ISHE probes the spin Berry
curvature.

Besides charge, the spin degree of freedom of Bloch electrons can also
appreciate the quantum geometry effect universal ; XiaoCspingeneration1 ;
XiaoCspingeneration2 ; XiaoCNC2024 ; XiaoCarxiv2024 . In particular, Eq.(1)
can be formally generalized into

$\displaystyle
T_{nm}^{\alpha\beta;\gamma}\equiv\frac{v_{nm}^{\alpha;\gamma}v_{mn}^{\beta}}{\epsilon_{nm}^{2}}=g_{nm}^{\alpha\beta;\gamma}-\frac{i\Omega_{nm}^{\alpha\beta;\gamma}}{2},$
(2)

where
$v^{\beta}_{nm}\equiv\langle\psi_{n}(\bm{k})|\hat{v}^{\beta}|\psi_{m}(\bm{k})\rangle$
for $n\neq m$ is the interband matrix element of velocity operator
$\hat{v}^{\beta}$ and $\epsilon_{nm}=\epsilon_{n}-\epsilon_{m}$ with
$\epsilon_{n}$ being the band energy. In addition,
$v^{\alpha;\gamma}_{nm}=\langle\psi_{n}(\bm{k})|\hat{v}^{\alpha;\gamma}|\psi_{m}(\bm{k})\rangle/2$
with
$\hat{v}^{\alpha;\gamma}=(\hat{v}^{\alpha}\hat{s}^{\gamma}+\hat{s}^{\gamma}\hat{v}^{\alpha})/2$,
where $\hat{s}^{\gamma=0}=e$ stands for the elementary charge and
$\hat{s}^{\gamma\neq 0}=\hbar\sigma^{\gamma}/2$ the spin angular momentum
operator. Here $\sigma^{\gamma}$ with $\gamma\in\\{x,y,z\\}$ is the Pauli
matrix. Note that Eq.(2) reduces into Eq.(1) for $\gamma=0$ since
$v^{\alpha}_{nm}=i\epsilon_{nm}\mathcal{A}^{\alpha}_{nm}$ with $n\neq m$. As a
result, $T_{nm}^{\alpha\beta;\gamma}$ for $\gamma\neq 0$ can be naturally
defined as the local spin quantum geometric tensor, whose imaginary part
$\Omega_{nm}^{\alpha\beta;\gamma}$ gives the well-known spin Berry curvature
while its real part $g_{nm}^{\alpha\beta;\gamma}$ defines the spin quantum
metric proposed in this work. Interestingly, although the spin Berry curvature
was known as the quantum geometric origin of the intrinsic spin Hall effect
(ISHE) proposed by Sinova et al. universal , see Fig. (1d), whether its
counterpart—spin quantum metric can induce an ISHE remains unknown.

In this Letter, by revisiting the linear response theory for spin current, we
show that the spin quantum metric indeed can deliver an ISHE particularly
under an AC electric field. Interestingly, due to the involvement of spin, we
find that the spin quantum metric and the spin Berry curvature features the
$\mathcal{T}$-odd ($\mathcal{T}$, time reversal) and $\mathcal{T}$-even
characteristics, respectively; whereas the quantum metric and Berry curvature
given in Eq. (1) features the $\mathcal{T}$-even and $\mathcal{T}$-odd
property, respectively. Guided by symmetry, we evaluate this $\mathcal{T}$-odd
ISHE in the magnetically tilted surface Dirac cone and in ferromagnetic
monolayer MnBi2Te4. We find that this $\mathcal{T}$-odd ISHE dominates when
the Fermi level is close to the band (anti)crossing point, in which its
magnitude can be as large as the $\mathcal{T}$-even ISHE when an infrared
driving field is applied. Our work not only establishes the concept of spin
quantum metric but also offers a novel mechanism for ultrafast spintronics.

The linear response theory.— To derive the spin quantum metric and the spin
Berry curvature on the same theoretical footing, we first develop the linear
response theory for spin current under an AC electric field. Instead of using
the Green’s function approach Kubo , we iteratively solve the quantum
Liouville equation and obtain the off-diagonal density matrix element at the
first order of the electric field ($e=\hbar=1$) xiangDHE

$\displaystyle\rho^{(1)}_{mn}=\dfrac{1}{2}\sum_{\omega_{1}}\dfrac{f_{nm}\mathcal{A}^{\alpha}_{mn}}{\omega_{1}-\epsilon_{mn}+i\eta}E_{\alpha}e^{-i(\omega_{1}+i\eta)t},$
(3)

where $\omega_{1}=\pm\omega$ with $\omega$ the driving frequency,
$f_{nm}=f_{n}-f_{m}$ with $f_{n}$ being the equilibrium Fermi distribution
function, and $\eta$ is an infinitesimal quantity. Note that the Einstein
summation convention is assumed for the repeated Greek alphabet here and
hereafter. With Eq.(3), the linear spin current density defined by
$J^{\alpha;\gamma}\equiv-\sum_{mn}\int_{k}v^{\alpha;\gamma}_{nm}\rho^{(1)}_{mn}$
can be directly calculated as

$\displaystyle
J^{\alpha;\gamma}=-\dfrac{1}{2}\sum_{\omega_{1}}\sum_{mn}\int_{k}\dfrac{f_{nm}v^{\alpha;\gamma}_{nm}\mathcal{A}^{\beta}_{mn}}{\omega_{1}-\epsilon_{mn}}E_{\beta}e^{-i\omega_{1}t},$
(4)

where $\int_{k}=\int d\bm{k}/(2\pi)^{d}$ with $d$ being the spatial dimension
and we set $\eta=0$ since we are interested in the nonresonant response with
$\epsilon_{mn}\neq\hbar\omega$. Furthermore, using
$-1/(\omega_{1}-\epsilon_{mn})=1/\epsilon_{mn}-\omega_{1}/\left[\epsilon_{mn}(\omega_{1}-\epsilon_{mn})\right]$
and $\mathcal{A}^{\beta}_{mn}=-iv^{\beta}_{mn}/\epsilon_{mn}$ when $m\neq n$,
we find that Eq.(4) can be partitioned into
$J^{\alpha;\gamma}=J^{\alpha;\gamma}_{DC}+J^{\alpha;\gamma}_{AC}$, where

$\displaystyle J^{\alpha;\gamma}_{DC}$
$\displaystyle=\sum_{\omega_{1}}\sum_{mn}\int_{k}\dfrac{-if_{nm}v^{\alpha;\gamma}_{nm}v^{\beta}_{mn}}{2\epsilon_{mn}^{2}}E_{\beta}e^{-i\omega_{1}t},$
(5) $\displaystyle J^{\alpha;\gamma}_{AC}$
$\displaystyle=\sum_{\omega_{1}}\sum_{mn}\int_{k}\dfrac{i\omega_{1}f_{nm}v^{\alpha;\gamma}_{nm}v^{\beta}_{mn}}{2\epsilon_{mn}^{2}(\omega_{1}-\epsilon_{mn})}E_{\beta}e^{-i\omega_{1}t}.$
(6)

We wish to remark that Eq.(5) is nothing but the linear conduction spin
current density, which can survive in DC limit ($\omega\rightarrow 0$) and is
fully determined by the spin Berry curvature. To see that, by interchanging
the dummy indices, we find that Eq.(5) becomes

$\displaystyle J^{\alpha;\gamma}_{DC}$
$\displaystyle=\sum_{n}\int_{k}f_{n}\Omega^{\alpha\beta;\gamma}_{n}E_{\beta}\cos(\omega
t),$ (7)

where the frequency summation has been performed and
$\Omega_{nm}^{\alpha\beta;\gamma}$ has been defined in Eq.(2). We wish to
mention that Eq.(7) usually is derived with Kubo formula at the clean limit
Kubo  where the current due to Eq.(6) usually is overlooked.

Similar to the linear response theory for charge, Eq.(6) also gives the
displacement spin current density, which can only survive in AC transport
($\omega\neq 0$) and can be expressed as
$J_{AC}^{\alpha;\gamma}=\partial_{t}P^{\alpha;\gamma}(t)$, where
$\mathcal{P}^{\alpha;\gamma}(t)$ is the spin polarization given by

$\displaystyle P^{\alpha;\gamma}$
$\displaystyle=\sum_{n}\int_{k}f_{n}\left[\mathcal{G}^{\alpha\beta;\gamma}_{n}\cos(\omega
t)+\mathcal{F}^{\alpha\beta;\gamma}_{n}\sin(\omega t)\right]E_{\beta},$

obtained by both the index interchanging and summation over $\omega_{1}$. Here

$\displaystyle\mathcal{G}^{\alpha\beta;\gamma}_{n}$ $\displaystyle=\sum_{m\neq
n}\Pi^{1}_{mn}(\omega)g_{nm}^{\alpha\beta;\gamma},$ (8)
$\displaystyle\mathcal{F}^{\alpha\beta;\gamma}_{n}$ $\displaystyle=\sum_{m\neq
n}\Pi^{2}_{mn}(\omega)\Omega_{nm}^{\alpha\beta;\gamma},$ (9)

where $\Pi^{1}_{mn}(\omega)=\epsilon_{mn}/(\omega^{2}-\epsilon_{mn}^{2})$ and
$\Pi^{2}_{mn}(\omega)=\omega^{2}/(\omega^{2}-\epsilon_{mn}^{2})$. By comparing
with Eq. (2), it is easy to see that $\mathcal{G}^{\alpha\beta;\gamma}_{n}$
and $\mathcal{F}^{\alpha\beta;\gamma}_{n}$ encode the information of the spin
quantum metric and spin Berry curvature, respectively. Importantly,
$\mathcal{G}^{\alpha\beta;\gamma}_{n}$
($\mathcal{F}_{n}^{\alpha\beta;\gamma}$) exactly shows the same symmetry
transformation as $g_{nm}^{\alpha\beta;\gamma}$
($\Omega_{nm}^{\alpha\beta;\gamma}$) and is termed as the band-normalized spin
quantum metric (spin Berry curvature) following Ref. YanPRL2024 , where the
weight factor $\Pi^{i}_{mn}(\omega)$ can only affect its magnitude. Below we
focus on $\mathcal{G}_{n}^{\alpha\beta;\gamma}$ since we are interested in the
spin quantum metric throughout this work.

The same as the spin Berry curvature, the spin quantum metric can also induce
an ISHE when the integral of $\mathcal{G}_{n}^{\alpha\beta;\gamma}$ with
$\alpha\neq\beta$ over the occupied states does not vanish. In particular, by
defining
$J_{AC}^{\alpha;\gamma}=\bar{\sigma}^{\alpha\beta;\gamma}E_{\beta}\sin(\omega
t)$, the corresponding ISHE conductivity can be written as

$\displaystyle\bar{\sigma}^{\alpha\beta;\gamma}=\omega\sum_{n}\int_{k}f_{n}\mathcal{G}^{\alpha\beta;\gamma}_{n}.$
(10)

This conductivity features a formal similarity with the spin Berry curvature
induced ISHE conductivity spinBC , which can be extracted from Eq. (7) as

$\displaystyle\sigma^{\alpha\beta;\gamma}=\sum_{n}\int_{k}f_{n}\Omega_{n}^{\alpha\beta;\gamma}.$
(11)

At this stage, we remark that Eq. (10) and Eq. (11), respectively, features
the $\mathcal{T}$-odd and $\mathcal{T}$-even property due to
$\mathcal{T}\mathcal{G}_{n}^{\alpha\beta;\gamma}=-\mathcal{G}_{n}^{\alpha\beta;\gamma}$
and
$\mathcal{T}\Omega_{n}^{\alpha\beta;\gamma}=\Omega_{n}^{\alpha\beta;\gamma}$,
which is due to $\mathcal{T}v^{\alpha;\gamma}_{nm}=v^{\alpha;\gamma}_{mn}$ and
$\mathcal{T}v^{\beta}_{nm}=-v^{\beta}_{mn}$. In additon, we mention that the
Berry curvature and quantum metric given by Eq. (1), respectively, shows the
$\mathcal{T}$-odd and $\mathcal{T}$-even behavior due to
$\mathcal{T}\mathcal{A}^{\alpha}_{nm}=\mathcal{A}^{\alpha}_{mn}$, as compared
in Fig. (1). Finally, we stress that Eq. (10) can only appear in AC transport
while Eq. (11) can appear in DC ($\omega\rightarrow 0$) transport. To close
this section, we conclude that Eq.(10), together with Eq.(8) which encodes the
spin quantum metric, is the main result of this Letter.

Figure 2:  (a) The $\bm{k}$-resolved distribution for the band-normalized spin
quantum metric defined by Eq.(13). (b) The dependence of $\mathcal{T}$-odd
ISHE spin current density on the chemical potential $\mu$ in the unit of
$e/(16\pi)$. Note that $E_{y}^{\omega}=E_{y}\sin(\omega t)$. Parameters:
$t_{x}/\hbar v=10$, $\hbar\omega=10\mathrm{meV}$.

A model study.— To acquire a quick understanding of the spin quantum metric,
we first apply our theory to the surface Dirac cone of topological insulator
that is tilted by an in-plane magentic field, which can be described by the
following two-band effective Hamiltonian TIsurfB ,

$\displaystyle H=\bm{t}\cdot\bm{k}+v(k_{x}\sigma_{y}-k_{y}\sigma_{x}),$ (12)

where $v$ is the Fermi velocity and $\bm{t}=(t_{x},t_{y})$ is the tilt vector.
With Eq.(8) by assuming that $\epsilon_{mn}\gg\hbar\omega$, we find that the
band-normalized spin quantum metric that is even in $k_{a}$ is given by

$\displaystyle\mathcal{G}^{xy;x}_{\pm}=\mp\dfrac{t_{x}k_{x}^{2}}{4v^{2}k^{5}},$
(13)

where $+(-)$ stands for the upper (lower) band and
$k^{2}=k_{x}^{2}+k_{y}^{2}$. This result shows a dipole landscape in the
$k_{x}$-$k_{y}$ plane, as shown in Fig. (2a). As a result, the band-normalized
spin quantum metric can induce an collinear ISHE (defined below) and the
corresponding conductivity at zero temperature for $\mu<0$ can be calculated
as

$\displaystyle\bar{\sigma}^{xy;x}=\int_{k}\Theta(\mu-\epsilon_{-})\dfrac{t_{x}k_{x}^{2}}{4v^{2}k^{5}}=-\dfrac{t_{x}}{16\pi
v\mu},$ (14)

where $\Theta$ is the step function and the polar coordinate
$\bm{k}=k(\cos\theta,\sin\theta)$ has been used to obtain the final result.
Furthermore, the $\mathcal{T}$-odd spin Hall current then is given by

$\displaystyle J^{x;x}_{AC}=\dfrac{e}{16\pi}\dfrac{t_{x}}{(\hbar
v)}\dfrac{\hbar\omega}{|\mu|}E_{y}\sin(\omega t),$ (15)

where $e$ and $\hbar$ are restored by dimension analysis and we have also
taken into account the case of $\mu>0$.

We wish to remark that the $\mathcal{T}$-odd ISHE conductivity is no longer
universal like its $\mathcal{T}$-even counterpart universal . In particular,
we note that the spin Berry curvature that is even $k_{a}$ is given by

$\displaystyle\Omega_{\pm}^{xy;z}=\pm\dfrac{k_{x}^{2}}{4vk^{5}},$ (16)

which almost shows the same landscape on the $k_{x}$-$k_{y}$ plane with the
spin quantum metric. Note that the survived spin quantum metric and spin Berry
curvature have a different spin polarization. As a result, by inserting this
expression into Eq.(11) and performing a similar calculation, we find that

$\displaystyle J_{DC}^{x;z}=-\dfrac{e}{16\pi}E_{y}\cos(\omega t),$ (17)

which shows a universal behavior like with the two-dimenional Rashba electron
gas universal , as expected.

By taking the $\mathcal{T}$-even universal conductivity as a bechmark, we
further display the dependence of spin current on the chemical potential $\mu$
in Fig. (2b). Notably, by taking $t_{x}/(\hbar v)\sim 10$, we find that the
$\mathcal{T}$-odd ISHE driving by a THz field ($\hbar\omega\sim
10\mathrm{meV}$) can be the same order as the $\mathcal{T}$-even counterpart.
Notably, the $\mathcal{T}$-odd ISHE can be further enhanced when the chemical
potential $\mu$ is approaching the band crossing point.

Table 1:  The magnetic point groups for the conventional (for $\bar{\sigma}^{\alpha\beta;\gamma}$,$\alpha\neq\beta\neq\gamma$) and collinear (for $\bar{\sigma}^{\alpha\beta;\gamma}$,$\alpha\neq\beta$ and $\gamma\in\\{\alpha,\beta\\}$) $\mathcal{T}$-odd ISHE, respectively.  $\bar{\sigma}^{\alpha\beta;\gamma}$ | Magnetic point groups
---|---
|  $1$, $\bar{1}$, $2$, $m$, $2/m$,
|  $3$, $\bar{3}$, $222$, $mm2$, $mmm$,
|  $4^{\prime}$, $\bar{4}^{\prime}$, $4^{\prime}/m$, $32$, $3m$,
$\alpha\neq\beta\neq\gamma$ |  $\bar{3}m$, $422$, $4mm$, $\bar{4}2m$, $4/mmm$,
|  $622$, $6mm$, $\bar{6}m2$, $6/mmm$, $\bar{4}^{\prime}2m^{\prime}$,
|  $4^{\prime}22^{\prime}$, $23$, $m\bar{3}$, $432$, $\bar{4}3m$,
|  $m\bar{3}m$, $4^{\prime}32^{\prime}$, $\bar{4}^{\prime}3m^{\prime}$,
$m\bar{3}m^{\prime}$,
|  $1$, $\bar{1}$, $2$, $m$, $2/m$,
|  $2^{\prime}$, $m^{\prime}$, $2^{\prime}/m^{\prime}$, $3$, $\bar{3}$,
|  $2^{\prime}2^{\prime}2$, $m^{\prime}m^{\prime}2$, $m^{\prime}m^{\prime}m$,
$m^{\prime}m2^{\prime}$,
|  $4$, $\bar{4}$, $4/m$, $6$,
$\alpha\neq\beta$; $\gamma\in\\{\alpha,\beta\\}$ |  $\bar{6}$, $6/m$, $4^{\prime}$, $\bar{4}^{\prime}$,
|  $4^{\prime}/m$, $32^{\prime}$, $3m^{\prime}$, $\bar{3}m^{\prime}$,
|  $42^{\prime}2^{\prime}$, $4m^{\prime}m^{\prime}$,
$\bar{4}2^{\prime}m^{\prime}$, $4/mm^{\prime}m^{\prime}$,
|  $62^{\prime}2^{\prime}$, $6m^{\prime}m^{\prime}$,
$\bar{6}m^{\prime}2^{\prime}$, $6/mm^{\prime}m^{\prime}$,
|  $4^{\prime}m^{\prime}m$, $\bar{4}^{\prime}2^{\prime}m$,
$4^{\prime}/mm^{\prime}m$, $6^{\prime}$,
|  $\bar{6}^{\prime}$, $6^{\prime}/m^{\prime}$, $\bar{6}^{\prime}m^{\prime}2$,

Symmetry analysis.— In addition to the model calculations, we next apply our
theory to investigate the spin quantum metric driven ISHE in realistic
materials. Before proceeding, we note that the $\mathcal{T}$-even and
$\mathcal{T}$-odd ISHE conductivity tensors can possess both the longitudinal
and transverse componentsPRMSHE , in stark contrast with the IAHE conductivity
tensor that just contains the transverse component. Throughout this work, we
focus on the transverse responses. In particular, following Ref. PRMSHE , for
the $\mathcal{T}$-odd ISHE conductivity $\bar{\sigma}^{\alpha\beta;\gamma}$
with $\alpha\neq\beta\neq\gamma$ we will call it the conventional
$\mathcal{T}$-odd ISHE; for the $\mathcal{T}$-odd conductivity
$\bar{\sigma}^{\alpha\beta;\gamma}$ with $\alpha\neq\beta$ and
$\gamma\in\\{\alpha,\beta\\}$ we will call it the collinear $\mathcal{T}$-odd
ISHE. Furthermore, the same as the $\mathcal{T}$-even ISHE, the
$\mathcal{T}$-odd ISHE can also feature different tensor shape under the
magnetic point group (MPG) symmetry.

To obtain that, we first note that all the $32$ grey MPGs with
$\mathcal{T}$-symmetry ($1^{\prime}$) can not support the $\mathcal{T}$-odd
ISHE. Additionally, we find that Eq.(10) in fact is a
$\mathcal{P}\mathcal{T}$-odd tensor because of
$\mathcal{P}\bar{\sigma}^{\alpha\beta;\gamma}=\bar{\sigma}^{\alpha\beta;\gamma}$.
As a result, out of the $90$ MPGs without $\mathcal{T}$-symmetry, $21$ of them
with $\mathcal{P}\mathcal{T}$ symmetry ($-1^{\prime}$) PTMPG  can also not
support this ISHE. Finally, for the remaining $69$ MPGs, we can resort to the
Neumann principle

$\displaystyle\bar{\sigma}^{\alpha\beta;\gamma}=\eta_{T}\text{det}(R)R_{\alpha\alpha^{\prime}}R_{\beta\beta^{\prime}}R_{\gamma\gamma^{\prime}}\sigma^{\alpha^{\prime}\beta^{\prime};\gamma^{\prime}}$
(18)

to acquire the specific tensor shape of $\bar{\sigma}^{\alpha\beta;\gamma}$.
In Eq.(18), $\eta_{T}=+(-)$ is responsible for the symmetry operation $R$
($R\mathcal{T}$), $\text{det}(R)$ stands for the determinant of $R$, and
$R_{\alpha\alpha^{\prime}}$ is the matrix element of $R$. Note that Eq.(18)
has been implemented in the online Bilbao database. As a result, by defining
the Jahn notation $ae{V^{3}}$ for the $\mathcal{T}$-odd rank-3 pseudotensor
$\bar{\sigma}^{\alpha\beta;\gamma}$, we can obtain the tensor shape of
$\bar{\sigma}^{\alpha\beta;\gamma}$ once for all, see Supplemental Material
sup . Interestingly, we find that some of the $69$ MPGs can only support
either the conventional $\mathcal{T}$-odd ISHE or the collinear
$\mathcal{T}$-odd ISHE and some of them can support both, as summrized in
Table 1.

As a comparison, we wish to mention that the spin Berry curvature induced ISHE
corresponds to a $\mathcal{T}$-even rank-3 pseudotensor, whose Jahn notation
is $eV^{3}$, which has also been used to classify the conventional and
collinear $\mathcal{T}$-even ISHE PRMSHE . Armed with the symmetry analysis,
we are now ready to evaluate the $\mathcal{T}$-odd ISHE in realistic materials
by combining our theory with first-principles calculation.

Figure 3:  (a) The top view of monolayer MnBi2Te4. Here the red dashed line
indicates the primitive unit cell. (b) The side view of monolayer MnBi2Te4.
Along $z$ direction, the typical Te-Bi-Te-Mn-Te-Bi-Te septuple structure is
shown. (c) The first Brillouin zone. (d) The band structure of monolayer
MnBi2Te4. Here the horizontal dashed line and green shadow indicates the Fermi
level and band anticrossing, respectively. (e) The dependence on the chmeical
potential $\mu$ for the $\mathcal{T}$-odd ISHE conductivity. (f) The
$\bm{k}$-resolved distribution for the spin quantum metric.

A material study.— Guided by symmetry, we next consider a realistic
ferromagnetic monolayer MnBi2Te4 by combining our theory with first-principles
calculation. The monolayer MnBi2Te4 has been experimentally fabricated from
its van der Waals bulk crystal. The crystal structure of monolayer MnBi2Te4 is
displayed in Fig. 3a (top view) and 3b (side view). Like monolayer graphene
and monolayer MoS2, from Fig. 3a we find that the monolayer MnBi2Te4 also
features a hexagonal lattice, which is described by the space group
$P\bar{3}m1$ (No. $164$) and point group $3m(D_{3d})$ without the
consideration of the magnetic order. As a result, the primitive cell of the
monolayer MnBi2Te4 can be chosen as a parallelogram (indicated by the red
dashed line in Fig. 3a) and the corresponding first Brillouin zone is shown in
Fig. 3c. Meanwhile, Fig. 3b clearly exibits the typical Te-Bi-Te-Mn-Te-Bi-Te
septuple structure of monolayer MnBi2Te4. By further taking into account the
magnetic order from the Mn atom, the monolayer MnBi2Te4 in fact possesses a
magnetic point group of $\bar{3}m^{\prime}$, which allows the
$\mathcal{T}$-odd collinear ISHE in terms of Table 1.

In Fig. 3d, we show the band structure of monolayer MnBi2Te4 (see Ref.sup  for
the computation details), which shows a narrow gap semiconductor, consistent
with previous studies XiaoCspingeneration1 . Note that that two anticrossing
points appearing near $-0.1$ eV have been shown as the physical origin of
large nonlinear spin polarization XiaoCspingeneration1 . Interestingly, by
calculating the collinear $\mathcal{T}$-odd ISHE conductivity
$\bar{\sigma}^{xy;x}$, we find that the same anticrossing points also leads to
a strong ISHE peak, as shown in Fig. 3e. Furthermore, by ploting the
$\bm{k}$-resolved intergrand at energy cut near $-0.1$ eV, we find that the
hotspot of spin quantum metric is near $\Gamma$ point, as shown in Fig. 3f.
This further confirms our absevation. Note that in Fig. 3e, we set
$\hbar\omega=0.1\mathrm{eV}$ (an AC electric field with an infrared frequency)
and we find that spin quantum metric induced ISHE can be the same order as the
$\mathcal{T}$-even ISHE.

Discussion and summary.— We wish to remark that the $\mathcal{T}$-odd ISHE
driving by the spin quantum metric under an AC electric field is different
from the previously studied $\mathcal{T}$-odd spin Hall effect Todd1 ; Todd2 ;
Todd3 , which can suvive in DC limit and all of them features the extrinsic
nature. In addition, we mention that the measurements of spin Hall effect can
be easily accessible with state-of-art technique, such as the time-resolved
magnetic-optical Kerr effect (tMOKE), and a time-dependent spin accumulation
can be expected in terms of our proposal. In summary, by developing the linear
response theory for spin current, we show that the spin quantum metric can
induce a $\mathcal{T}$-odd ISHE under an AC electric field. Since the spin
quantum metric is the quantum geometric counterpart of the $\mathcal{T}$-even
spin Berry curvature, thereby the ISHE driven by spin quantum metric can only
appear in $\mathcal{T}$-broken systems, as illustrated in the magnetically
tilted surface Dirac cone and in a realistic ferromagnetic material MnBi2Te4.
We find that the $\mathcal{T}$-odd ISHE dominates when the Fermi level is near
the band (anti)crossing point that usually caused by spin-orbital coupling,
where its magnitude can be as large as the $\mathcal{T}$-even ISHE under a THz
or infrared driving field.

Our work establishes the concept of spin quantum metric for the first time
from the perspective of quantum geometry and may offer a promising mechanism
to the ultrafast spintronics THzspin . In addition, we wish to mention that
the dynamical $\mathcal{T}$-odd ISHE particularly with an in-plane spin
polarization may offer a desirbale way to engender spin-orbit torque in 2D
materials with an out-of-plane magnetization. Finally, although we focus on
the spin degree of freedom, the theoretical formulation used in this work can
be easily extended to study the high-freqency orbital angular momentum
accumulation- dynamical orbital Hall effect, which may be explored in the
future.

## Acknowledgements

J. W. thanks the financial support from the National Natural Science
Foundation of China (Grant No. 12034014).

## References

  * (1) D. Xiao, M.-C. Chang, and Q. Niu, Rev. Mod. Phys. 82, 1959 (2010).
  * (2) I. Sodemann and L. Fu, Phys. Rev. Lett. 115, 216806 (2015).
  * (3) Q. Ma, S.-Y. Xu, H. Shen, D. MacNeill, V. Fatemi, T.-R. Chang, A. M. M. Valdivia, S. F. Wu, Z. Du, C.-H. Hsu, S. Fang, Q. D. Gibson, K. Watanabe, T. Taniguchi, R. J. Cava, E. Kaxiras, H.-Z. Lu, H. Lin, L. Fu, N. Gedik, and P. Jarillo-Herrero, Nature 565, 337 (2019).
  * (4) K. F. Kang, T. X. Li, E. Sohn, J. Shan, and K. F. Mak, Nat. Mater. 18, 324 (2019).
  * (5) C.-P. Zhang, X.-J. Gao, Y.-M. Xie, H. C. Po, and K. T. Law, Phys. Rev. B 107, 115142 (2023).
  * (6) Z. Z. Du, H.-Z. Lu, and X. C. Xie, Nat. Rev. Phys. 3, 744 (2021).
  * (7) Y. Gao, S. Y. A. Yang, and Q. Niu, Phys. Rev. Lett. 112, 166601 (2014).
  * (8) A. Gao et al., Science 381, 181 (2023).
  * (9) N.-Z. Wang, D. Kaplan, Z.-W. Zhang, T. Holder, N. Cao, A.-F. Wang, X.-Y. Zhou, F.-F. Zhou, Z.-Z. Jiang, C.S. Zhang, S.-H. Ru, H.-B. Cai, K. Watanabe, T. Taniguchi, B.-H. Yan and W.-B. Gao, Nature (London) 621, 487 (2023).
  * (10) J. Han, T. Uchimura, Y. Araki, J.-Y. Yoon, Y. Takeuchi, Y. Yamane, S. Kanai, J. Ieda, H. Ohno, and S. Fukami, Nat. Phys. (2024).
  * (11) L. J. Y. Wang, J. J. Zhu, H. Chen, H. Wang, J. Liu, Y.-X. Huang, B. Y. Jiang, J. Zhao, H. Shi, G. Tian, H. Wang, Y. G. Yao, D. P. Yu, Z. W. Wang, C. Xiao, S. Y. A. Yang, and X. S. Wu, Phys. Rev. Lett. 132, 106601 (2024).
  * (12) S. Lai, H. Liu, Z. Zhang, J. Zhao, X. Feng, N. Wang, C. Tang, Y. Liu, K. S. Novoselov, S. Y. A. Yang, and W.-B. Gao, Nat. Nanotechnol. 16, 869 (2021).
  * (13) M. M. Wei, L. Y. Wang, B. Wang, L. J. Xiang, F. M. Xu, B. G. Wang, and Jian Wang, Phys. Rev. Lett. 130, 036202 (2023).
  * (14) L. J. Xiang, B. Wang, Y. D. Wei, Z. H. Qiao, and J. Wang, Phys. Rev. B 109, 115121 (2024).
  * (15) J. E. Moore and J. Orenstein, Phys. Rev. Lett. 105, 026805 (2010).
  * (16) Q. Ma, A. G. Grushin, and K. S. Burch, Nat. Mater. 20, 1601, (2021).
  * (17) Q. Ma, R. K. Kumar, S.-Y., Xu, F. H. L. Koppens, and J. C. W. Song, Nat. Rev. Phys. 5, 170 (2023).
  * (18) Y. Tokura and N. Nagaosa, Nat. Commun. 9, 3740 (2018).
  * (19) J. Ahn, G.-Y. Guo, and N. Nagaosa, Phys. Rev. X 10, 041041 (2020).
  * (20) J. Ahn, G.-Y. Guo, N. Nagaosa, and A. Vishwanath, Nat. Phys. 18, 290 (2022).
  * (21) Päivi Törmä,  Phys. Rev. Lett. 131, 240001 (2023).
  * (22) P. C. Adak, S. Sinha, A. Agarwal, and M. M. Deshmukh, Nat. Rev. Mater. (2024).
  * (23) H. Wang, K. Chang, arXiv:2405.13355.
  * (24) J. Sinova, D. Culcer, Q. Niu, N. A. Sinitsyn, T. Jungwirth, and A. H. MacDonald, Phys. Rev. Lett. 92, 126603 (2004).
  * (25) C. Xiao, H. Liu, W. Wu, H. Wang, Q. Niu, and S. Y. A. Yang, Phys. Rev. Lett. 129, 086602 (2022).
  * (26) C. Xiao, W. Wu, H. Wang, Y.-X. Huang, X. Feng, H. Liu, G.-Y. Guo, Q. Niu, and S. Y. A. Yang, Phys. Rev. Lett. 130, 166302 (2023).
  * (27) Y. Dai, J. Xiong, Y. Ge, B. Cheng, L. Wang, P. Wang, Z. Liu, S. Yan, C. Zhang, X. Xu, Y. Shi, S.-W. Cheong, C. Xiao, S. Y. A. Yang, S.-J. Liang, and F. Miao, Nat. Commun. 15, 1129 (2024).
  * (28) X. Feng, W. Wu, H. Wang, W. Gao, L. K. Ang, Y. X. Zhao, C. Xiao, and S. Y. A. Yang, arXiv:2402.00532.
  * (29) J. Sinova, S. O. Valenzuela, J. Wunderlich, C. Back, and T. Jungwirth, Rev. Mod. Phys. 87, 1213 (2015).
  * (30) Y. Sun, Y. Zhang, C. Felser, and B. H. Yan, Phys. Rev. Lett. 117, 146403 (2016).
  * (31) I. Žutić, J. Fabian, and S. Das Sarma, Rev. Mod. Phys. 76, 323 (2004)
  * (32) M. Z. Hasan and C. L. Kane, Rev. Mod. Phys. 82, 3045 (2010).
  * (33) X.-L. Qi and S.-C. Zhang, Rev. Mod. Phys. 83, 1057 (2011).
  * (34) D. Xiao, J. Shi, D. P. Clougherty, and Q. Niu, Phys. Rev. Lett. 102, 087602 (2009).
  * (35) Y. Gao, S. Y. A. Yang, and Qian Niu, Phys. Rev. Lett. 112, 166601 (2014).
  * (36) H. Liu, J. Zhao, Y.-X. Huang, W. Wu, X. Sheng, C. Xiao, and S. A. Yang, Phys. Rev. Lett. 127, 277202 (2021).
  * (37) S. B. Zhang, C. A. Li, F. Pena-Benitez, P. Surowka, R. Moessner, L. W. Molenkamp, and B. Trauzettel, Phys. Rev. Lett. 127, 076601 (2021).
  * (38) F. Freimuth, S. Blügel, and Y. Mokrousov, Phys. Rev. B 90, 174423 (2014).
  * (39) M. Kimata, H. Chen, K. Kondou, S. Sugimoto, P. K. Muduli, M. Ikhlas, Y. Omori, T. Tomita, A. H. MacDonald, S. Nakatsuji, and Otani, Nature 565, 627 (2019).
  * (40) Y. Dai, J. Xiong, Y. Ge, B. Cheng, L. Wang, P. Wang, Z. Liu, S. Yan, C. Zhang, X. Xu, Y. Shi, S.-W. Cheong, C. Xiao, S. Y. A. Yang, S.-J. Liang, and F. Miao, Nat. Commun. 15, 1129 (2024).
  * (41) A. Roy, M. H. D. Guimarães, and J. Sławińska, Phys. Rev. Mater. 6, 045004 (2022).
  * (42) The MPGs that respecting $\mathcal{P}\mathcal{T}$-symmetry ($-1^{\prime}$) are $\bar{1}^{\prime},2^{\prime}/m,2/m^{\prime},m^{\prime}mm$, $m^{\prime}m^{\prime}m^{\prime},4/m^{\prime},4^{\prime}/m^{\prime}$, $4/m^{\prime}mm,4^{\prime}/m^{\prime}m^{\prime}m,4/m^{\prime}m^{\prime}m^{\prime},\bar{3}^{\prime}$, $\bar{3}^{\prime}m,\bar{3}^{\prime}m^{\prime},6^{\prime}/m,6/m^{\prime}$, $6/m^{\prime}mm,6^{\prime}/mmm^{\prime}$, $6/m^{\prime}m^{\prime}m^{\prime},m^{\prime}\bar{3}^{\prime},m^{\prime}\bar{3}^{\prime}m$, and $m^{\prime}\bar{3}^{\prime}m^{\prime}$.
  * (43) D. Kaplan, T. Holder, and B.-H. Yan, Phys. Rev. Lett. 132, 026301 (2024).
  * (44) Supplemental Material.