# Fashion-Guided Adversarial Attack on Person Segmentation

Marc Treu Equal contributions. This work was done when Marc Treu interned at
NII, Japan. Contact email<EMAIL_ADDRESS>TEHTRIS, France  Trung-Nghia
Le∗ National Institute of Informatics, Japan  Huy H. Nguyen∗ National
Institute of Informatics, Japan  Junichi Yamagishi  National Institute of
Informatics, Japan  The Graduate University for Advanced Studies, SOKENDAI,
Japan  Isao Echizen  National Institute of Informatics, Japan  The Graduate
University for Advanced Studies, SOKENDAI, Japan  University of Tokyo, Japan

###### Abstract

This paper presents the first adversarial example based method for attacking
human instance segmentation networks, namely person segmentation networks in
short, which are harder to fool than classification networks. We propose a
novel Fashion-Guided Adversarial Attack (FashionAdv) framework to
automatically identify attackable regions in the target image to minimize the
effect on image quality. It generates adversarial textures learned from
fashion style images and then overlays them on the clothing regions in the
original image to make all persons in the image invisible to person
segmentation networks. The synthesized adversarial textures are inconspicuous
and appear natural to the human eye. The effectiveness of the proposed method
is enhanced by robustness training and by jointly attacking multiple
components of the target network. Extensive experiments demonstrated the
effectiveness of FashionAdv in terms of robustness to image manipulations and
storage in cyberspace as well as appearing natural to the human eye. The code
and data are publicly released on our project page111https://github.com/nii-
yamagishilab/fashion_adv.

##  1 Introduction

Powerful computer vision methods have been applied to object classification
[14, 15], object detection [21, 35], semantic segmentation [19, 25], and
instance segmentation [13, 20], enabling machines to perceive the world. With
incremental learning using a massive amount of data obtained from the Internet
and surveillance cameras, vision-based intelligent systems (i.e., face
recognition [39], and gait recognition [41]) can track and learn the behaviors
of a large population. Such systems are typically trained using images and
videos crawled from social networks without authorization, which raises a
serious privacy issue requiring governments and companies to establish
policies to prevent unauthorized surveillance and tracking on the basis of
user data [39]. Moreover, social network users need a tool to protect their
privacy. The tool should be robust against the transformations and
compressions that occur during the uploading, sharing, and storing images and
videos.

Figure 1: Overview of our proposed Fashion-Guided Adversarial Attack
(FashionAdv). Top row: person is segmented successfully. Bottom row: given a
target image and a guided-fashion style image, FashionAdv synthesizes natural
clothing texture that can nevertheless fool a person segmentation network by
making the person invisible to the network. Figure 2: Effectiveness of our
proposed FashionAdv, compared with conventional digital-level adversarial
attacks. From left to right: adversarial noise attack [11], adversarial color
attack [36], adversarial texture attack [3], and our FashionAdv. Bottom row:
corresponding adversarial perturbations. Changes made by FashionAdv are
inconspicuous to the human eye.

Several attack methods using adversarial examples have been developed to
degrade the performance of deep neural networks in the digital world. Most
such methods effectively fool object classification by directly attacking the
digital image or video files [3, 36]. Adversarial noise-based attack methods
were developed first and became well-established [11, 18, 28, 30]).
Subsequently, attacks based on color [36] and texture [3, 8], which also
target human perception, have been developed. A few attack methods have been
developed to target object detection and semantic segmentation [46]. To the
best of our knowledge, a method for attacking instance segmentation, which is
a combination of object detection and semantic segmentation, has not been
developed. In this work, we develop a method for targeted adversarial attacks
against human instance segmentation, namely person segmentation.

Naturalness and robustness are two essential properties of adversarial
examples [3, 49]. Naturalness means that adversarial examples are unlikely to
be noticed by people, while robustness means that they are not paralyzed by
data compression, transformation, or image filter effects (_e.g_., beauty
applications). There is a trade-off between these properties. Adversarial
examples created using traditional approaches can deal with naturalness [3,
36], but they are easily negated by image transformation [12] or compression
[11]. This work aims to balance this trade-off.

To this end, we propose an attack method for use against person segmentation
network (_i.e_., YOLACT [4], one of the first networks attempting real-time
instance segmentation). Our proposed Fashion-Guided Adversarial Attack
(FashionAdv) is designed to synthesize adversarial textures by blending
generated adversarial noise transferred from customizable fashion style images
into the original clothing regions. The new image with adversarial textures,
an adversarial image, is used to spoof the target person segmentation network
by making the persons invisible to the network (_c.f_. Fig. 1). Directly
optimizing the adversarial texture through infusion of texture from the
fashion style image helps make the synthesized adversarial texture
inconspicuous and appear natural to the human eye despite their large
perturbations. Indeed, a quick visual comparison of the results with
FashionAdv with those of conventional adversarial attacks in Fig. 2 indicates
that FashionAdv is capable of generating highly inconspicuous adversarial
textures. Unlike conventional adversarial attacks [3, 11, 36], which attack
the entire image, FashionAdv automatically detects the attackable regions
(_i.e_., clothing regions) to minimize the impact of adversarial examples on
image quality. Only clothing regions are identified as attackable regions
because (1) these regions are suitable for embedding adversarial noise while
maintaining image quality, and (2) human perception is less sensitive to these
regions compared with other regions such as faces [22]. FashionAdv effectively
works on all persons in the image, hiding them from deep instance segmentation
networks. Moreover, we propose jointly attacking two network components, the
classification and the segmentation sub-networks. Multiple cues are integrated
into the loss function, making the adversarial attack robust against image
manipulations and storage in cyberspace.

Extensive experiments on the MS-COCO dataset [24] demonstrated that the
changes made by FashionAdv are not only robust against image manipulations and
storage in cyberspace (_e.g_., image filters and JPEG compression) but are
also inconspicuous and appear natural to the human eye despite having large
perturbations (_c.f_. Fig. 3). The code and data are made available on our
project page222https://github.com/nii-yamagishilab/fashion_adv.

Figure 3: Naturalness (_i.e_., SSIM [42]) v.s. robustness (_i.e_., AP [24]) on
MS-COCO dataset. FashionAdv significantly outperformed conventional
adversarial example methods in terms of robustness against JPEG compression
(quality factors 10, 40, and, 80) while maintaining naturalness competitive
with that of the conventional methods. Hence, FashionAdv successfully spoofed
the target person segmentation network (_i.e_., YOLACT [4]), and the changes
made were inconspicuous to the human eye.

Our contributions are as follows.

  * •

We have developed a novel adversarial attack method for use against person
segmentation networks that achieves both robustness and naturalness. Our
Fashion-Guided Adversarial Attack (FashionAdv) is the first reported attack
method for use against instance segmentation.

  * •

FashionAdv flexibly synthesizes clothing textures from guided-fashion style
images that are inconspicuous and appear natural to the human eye despite
their large perturbations.

  * •

FashionAdv focuses on only the clothing regions in images, which minimizes the
effect on image quality. It is also robust against image manipulations and
storage in cyberspace, such as image filtering and JPEG compression,
respectively.

  * •

Extensive experiments demonstrated that FashionAdv significantly outperforms
conventional methods in term of robustness while still maintaining
naturalness.

##  2 Related Work

###  2.1 Adversarial Attacks

There are two types of adversarial attacks, including digital-level and
physical-level. The former target object classification, while the latter
target both object classification and object detection. In digital-level
attacks, adversarial perturbations are added to digital images or videos [1].
In physical-level attacks, real adversarial objects are crafted [18]. For both
levels, the adversarial perturbations can be noise [26], patterns [8, 16, 48],
colors [36, 3], or patches [5, 40, 49].

Most digital-level adversarial attacks target object classification [1].
Adversarial noise-based attacks (_e.g_., gradient-based attacks) were
developed first and became well-known, including FGSM [11], BIM [18], DeepFool
[30], and PGD [28]). FGSM [11] uses gradients of the target neural network to
craft adversarial examples. BIM [18] performs multiple FGSM attacks with small
step size. DeepFool [30] estimates the minimal adversarial perturbation by
using a simple iterative method. PGD [28] treats adversarial attacks as a
constrained optimization problem.

Furthermore, attacks based on color and texture (_e.g_., unrestricted
attacks), which also target human perception, have been developed. Shamsabadi
_et al_. [36] devised ColorFool attack in which colors within a certain range
are modified rather than adversarial noise or patches being crafted. Duan _et
al_. [8] used both colors and patterns to generate photorealistic adversarial
examples. Bhattad _et al_. [3] introduced two attacks that use realistic color
perturbation (cAdv) and texture extracted from a source image (tAdv).

Most physical adversarial attacks target object detection. The Expectation
Over Transformation (EOT) framework [2] was originally developed for object
classification, and then was extended to attack object detection. Thys _et
al_. [40] used adversarial patches to attack a human detection system using
YOLO-v2 [33]. Zhao et-al. [49] proposed two types of adversarial patches
(_i.e_., hiding attack and appearing attack) to attack Faster RCNN [35] and
YOLO-v3 [34]. Zhang _et al_. [48] learned camouflaged adversarial patterns to
attack Faster RCNN [35] and YOLO [32]. Following this, Huang _et al_. [16]
made camouflage adversarial patterns universal. On the other hand, few
adversarial patch-based methods were proposed for attacking object recognition
in the real-world, especially road objects, which is important for autonomous
driving systems [5, 8, 26]. In addition, few methods have been recently
developed to attack person detectors in the real-world by printing adversarial
patches on t-shirts [45, 47]. However, these methods look extremely unnatural
to the human eye and adversarial patches must be manually attached to other
objects (_i.e_. t-shirts).

In this work, we focus on attacks based on adversarial examples in cyberspace
(digital level). According to the best of our knowledge, there has been no
work on attacking instance segmentation. Therefore, in this work, we target
adversarial attacks for use against person segmentation. Particularly, we
target YOLACT [4], one of the first networks attempting real-time instance
segmentation. YOLACT breaks instance segmentation into two parallel subtasks
(_i.e_., generating a set of prototype masks and predicting per-instance mask
coefficients) and then linearly combines the prototypes with the mask
coefficients. We note that we target only persons segmented from YOLACT.

###  2.2 Improvements on Robustness and Naturalness

Easily created adversarial examples can fool several kinds of deep neural
networks, including ones for object detection and semantic segmentation [1].
However, adversarial perturbations created using traditional approaches can be
negated by image transformations [12, 27], or compression [11]. Recent work
has been carried out to improve the robustness of adversarial perturbations,
especially in the physical world. Physical adversarial objects crafted based
on the basis of the EOT framework [2] are robust to a combination of noise,
distortion, and affine transformation. The algorithm has thus been integrated
into different attacks to improve robustness [5, 31, 44].

A comprehensive benchmark recently performed by Dong _et al_. [7] provides an
overview of the robustness of several adversarial attacks. By considering the
limitations of pixel-wise and global adversarial attack methods, Dong _et al_.
[6] developed an attention-based attack that focuses only on salient objects
to improve robustness. Luo _et al_. [26] introduced a human-perception-based
metric for estimating the distance between pixels and a greedy optimization
algorithm to maximize the noise tolerance of adversarial examples. Zhao _et
al_. [49] used feature-interference reinforcement and enhanced realistic
constraints generation to enhance the robustness of their proposed hiding
attack.

Although naturalness is essential for human perception, this property has not
been well explored in the literature. There has been little work dealing with
the naturalness of adversarial attacks. Shamsabadi _et al_. [36] simply
modified colors in the target image within ranges that are perceived as
natural by humans. Bhattad _et al_. [3] searched texture sources in feature
space to find the one most similar to the target image and used it to generate
more natural-looking images. Duan _et al_. [8] transferred adversarial
perturbations into natural-looking styles, namely camouflage styles that
appear natural to human observers. Wu _et al_. [45] trained adversarial
patterns from real images and printed them on posters and T-shirts for
physical-level attacks.

Figure 4: Workflow of proposed FashionAdv framework. Given a target image, our
FashionAdv identifies attackable regions in the image and generates an
adversarial texture from a guided-fashion style image, which is the image
closest to the target image automatically obtained by searching our
constructed fashion corpus. The optimized adversarial image is used to spoof a
person segmentation network. Blue flow (_i.e_., blue arrows and blue blocks)
illustrates the learning process only.

##  3 Proposed Method

###  3.1 Overview

We overview our proposed FashionAdv method by describing how it can be used to
attack a state-of-the-art instance segmentation network (_i.e_., YOLACT [4]),
particularly targeting person segmentation (_i.e_., human instance
segmentation). By generating adversarial textures and painting them on
clothing regions, FashionAdv should cause YOLACT to fail in segmenting
individual persons under diverse perturbation transformation conditions
(_i.e_., image compression, image blurring, noise addition, color variation,
and perspective transformation).

Given an image $X$ of size $(w,h)$ consisting of $K$ persons, FashionAdv
decomposes the image into person regions $P$ and non-person regions $\bar{P}$.
It focuses on only the person regions:

$P=\\{P_{k}:P_{k}=X\cdot M_{k}+X\cdot\bar{M}_{k}\\}_{k=1}^{K},$ (1)

where $P_{k}$ indicates the $k$-th person, and
$M_{k},\bar{M}_{k}\in\\{0,1\\}^{w,h}$ are binary masks of the attackable
regions (_e.g_., clothing) and unattackable regions (_e.g_., face, hair, hand,
and leg) of person $P_{k}$, respectively. These binary masks specify the
locations to which the pixels of image $X$ belong, and ”$\cdot$” denotes
pixel-wise multiplication.

FashionAdv manipulates only the attackable regions (_e.g_., clothing),
corresponding to masks $M_{k}$ instead of the entire image, resulting in an
adversarial image $\tilde{X}$. That is, it creates an adversarial texture for
the attackable regions of each person $\tilde{P}_{k}$:

$\tilde{P}=\\{\tilde{P}_{k}:\tilde{P}_{k}=\tilde{X}\cdot
M_{k}+X\cdot\bar{M}_{k}\\}_{k=1}^{K}.$ (2)

Our goal is to generate adversarial image $\tilde{X}$ with both robustness and
naturalness. For naturalness, FashionAdv synthesizes adversarial textures
$\tilde{P}_{k}$ from fashion style image $S$ and minimizes the distance
between $\tilde{P}_{K}$ with both $P_{K}$ and $S$. This learning criterion
should yield adversarial textures that look inconspicuous to the human eye and
look natural as new fashion clothing:

$\mathrm{argmin}_{\tilde{X}}\sum_{k=1}^{K}(D_{1}(\tilde{P}_{k},P_{k})+D_{2}(\tilde{P}_{k},S)).$
(3)

For robustness, FashionAdv uses the expectation over transformation (EOT)
framework to formalize the adversarial attack problem [2]. In particular, it
optimizes the adversarial image $\tilde{X}$ to minimize the outputs
$\Psi_{t}(\tilde{P}_{k})$ of the attacked person segmentation network (_i.e_.,
classification score and segmentation mask) in expectation:

$\mathrm{argmin}_{\tilde{X}}\mathbb{E}_{t\sim
T}\sum_{k=1}^{K}\Psi_{t}(\tilde{P}_{k}),$ (4)

where $t$ denotes a perturbation transformation, $T$ is the distribution over
all possible transformations $\\{t\\}$, and $\Psi_{t}(\cdot)$ are the outputs
of the attacked person segmentation network (_i.e_., classification score and
segmentation mask) over the transformed image.

###  3.2 Fashion-Guided Adversarial Attack Framework

Figure 4 depicts the FashionAdv workflow. Given an original target image,
FashionAdv performs four basic steps: 1) segment the clothing regions to
identify attackable regions in the image, 2) search for and select a fashion
style image in a fashion corpus for use in generating an adversarial texture,
3) use the adversarial texture to create an adversarial image that is then
optimized for use in an adversarial attack, and 4) use the image to spoof a
person segmentation network.

FashionAdv first identifies regions in the target image in which the textures
can be modified within an arbitrary range and still look natural to the human
eye. The effect on image quality is minimized by focusing on only the clothing
regions. These regions are segmented by using the Self-Correction for Human
Parsing (SCHP) [23], which exhibited superior performance on the Look into
Person (LIP) challenge [10]. We used the off-the-shelf model pre-trained on
the LIP dataset [10], which was provided by the authors. FashionAdv combines
semantic maps of the ”upper-clothes, dress, coat, pants, skirt, and jumpsuits”
labels, outputting a binary mask of the clothing regions. This mask is used to
protect unattackable regions in the target image.

Next, FashionAdv automatically selects a fashion style image from a fashion
style corpus we assembled. To improve the naturalness of the target image’s
texture, the fashion style image closest in texture to the target image is
selected by minimizing the texture transfer cost in the feature space for the
target image [3]. We assembled the fashion style corpus by manually selecting
different raw images in the DeepFashion2 dataset [9]. We initially selected
images of only clothing, without a person in the image. Then, we manually
discarded images with patterns or materials similar to those of other images.
We ended up with 140 style images in our corpus, each with a distinct style.

FashionAdv then initializes adversarial noise and overlays it on the mask-
covered target image, outputting an adversarial texture. Using the adversarial
texture and the fashion style image, FashionAdv performs robustness training
(_c.f_. Section 3.4) to optimize the adversarial texture directly. In this
training process, the adversarial texture is gradually modified to minimize
both the classification score and segmentation mask produced by the attacked
network while maintaining the texture’s naturalness. The adversarial image
following mask removal should be robust against various transformations in
cyberspace. Finally, the optimized adversarial image is directly fed into the
person segmentation network to be attacked.

###  3.3 Loss Function

The total loss is a combination of adversarial loss $\mathcal{L}_{adv}$ and
naturalness loss $\mathcal{L}_{nat}$ in the adversarial image:

$\mathcal{L}=\alpha\mathcal{L}_{adv}+\mathcal{L}_{nat}.$ (5)

Adversarial loss $\mathcal{L}_{adv}$ is directly obtained from the target
person segmentation network (_i.e_., YOLACT) and is defined as the combination
of classification loss $\mathcal{L}_{cls}$ (_i.e_., softmax loss) and
segmentation loss $\mathcal{L}_{mask}$ (_i.e_., pixel-wise binary cross
entropy). This is described in detail elsewhere [4].

Naturalness loss $\mathcal{L}_{nat}$ as introduced here consists of
inconspicuous loss $\mathcal{L}_{inc}$ and texture transfer loss
$\mathcal{L}_{tex}$. Inconspicuous loss $\mathcal{L}_{inc}$ helps make the
adversarial texture inconspicuous to the human eye while texture loss
$\mathcal{L}_{tex}$ helps create a new fashion texture for clothing.

$\mathcal{L}_{nat}=\mathcal{L}_{inc}+\beta\mathcal{L}_{tex},$ (6)

Inconspicuous loss is used to make the adversarial image $\tilde{X}$ similar
to the original image $X$ so that the changes are inconspicuous to the human
eye:

$\mathcal{L}_{inc}=\lambda_{1}\mathcal{L}_{sim}(X,\tilde{X})+\lambda_{2}\mathcal{L}_{tv}(\tilde{X}),$
(7)

where $\mathcal{L}_{sim}$ is computed as the multi-scale structural similarity
index measure (MS-SSIM) between $\tilde{X}$ and $X$ [43], and
$\mathcal{L}_{tv}$ stands for the total variation loss, which is helpful for
reducing noise in the adversarial texture [29].

Inspired by the efficient performance of style transfer [3, 8], we use texture
loss to generate a new clothing texture with large perturbations that still
looks natural to the human eye. It consists of content loss $\mathcal{L}_{c}$,
which helps preserve the content of the original image $X$, and style loss
$\mathcal{L}_{s}$, which helps to generate a new style from the fashion style
image $S$:

$\mathcal{L}_{tex}=\sum_{l\in
L_{c}}w_{l}\mathcal{L}_{c}^{l}(\tilde{X},X)+\sum_{l\in
L_{s}}w_{l}\mathcal{L}_{s}^{l}(\tilde{X},S),$ (8)

where $l$ is the $l$-th feature (_e.g_., the $l$-th layer of the network) in
the sets of content layers $L_{c}$ and style layers $L_{s}$, and
$w_{l}=1/C_{l+1}^{2}$ indicates normalized weights used to configure the layer
preferences, with $C_{l}$ being the number of filter maps in layer $l$.

The content of the adversarial image $\tilde{X}$ may appear different from
that of the original image $X$. The content loss is used to ensure that the
adversarial image can preserve the content of the original image in the deep
representation space through mean squared error minimization:

$\mathcal{L}_{c}^{l}(\tilde{X},X)=\left|\left|\phi_{l}(\tilde{X})-\phi_{l}(X)\right|\right|_{2}^{2},$
(9)

where $\phi_{l}(\cdot)$ denotes the feature extracted from the $l$-th layer in
a set of content layers $L_{c}$ of feature extractor $\phi$.

The style of the fashion style image is transferred to the adversarial image
by using the style loss, which is defined by the difference in their style
representations:

$\mathcal{L}_{s}^{l}(\tilde{X},S)=\frac{\left|\left|\mathcal{G}(\phi_{l}(\tilde{X}),\phi_{l+1}(\tilde{X}))-\mathcal{G}(\phi_{l}(S),\phi_{l+1}(S))\right|\right|_{2}^{2}}{std(\mathcal{G}(\phi_{l}(\tilde{X}),\phi_{l+1}(\tilde{X})))},$
(10)

where $\mathcal{G}$ is the Gram matrix of features extracted from a set of
style layers $L_{s}$ of feature extractor $\phi$.

###  3.4 Robustness Training

The performance of a person segmentation network is affected by fluctuations
such as a shift in the viewpoint and by other transformations in the real
world. In early work [2], the EOT framework was used to conduct adversarial
attacks on classifiers by adding random distortions in the optimization to
make the perturbations more robust. In this work, we adapt the EOT framework
to train a robust adversarial attack for use against a target person
segmentation network. The training was done by simulating realistic situations
with a series of random image transformations in cyberspace. We included
camera-related transformations for two reasons: (1) they have been proven to
be effective in making adversarial perturbations robust [2], and (2) they make
our method extendable to the physical domain. From Eqs. (3), (4), and (5), our
EOT-based training is defined as:

$\mathrm{argmin}_{\tilde{X}}\mathbb{E}_{t\sim
T}\alpha\mathcal{L}_{adv}+\mathcal{L}_{nat}.$ (11)

Minimizing Eq. 11 results in the optimized adversarial image substantially
degrading the performance of the detector, thereby resulting in a high
spoofing rate. To improve the generation of adversarial images under various
conditions, we used a series of perturbation transformations to simulate the
cyberspace condition fluctuations. Figure 5 depicts the image perturbation
pipeline.

Figure 5: Image perturbation pipeline.

First, we simulated perspective transformations of different camera views by
generating a random homography matrix in the range $[-0.2,0.2]$ to transform
the original image. Next, we simulated image blurring by using a Gaussian blur
with kernel size and standard deviation randomly sampled in
$\\{1,3,5,7,9,11\\}$ and $[0.1,3]$, respectively. We then approximated color
variation by shifting the color values of each channel in terms of hue,
saturation, brightness, and contrast in the range $[-0.02,0.02]$ for hue and
$[-0.2,0.2]$ for the others. We also took into account image noise by using a
uniform noise model in the range $[-0.02,0.02]$. Finally, we applied an
approximation of JPEG compression [37] with a quality factor (QF) generated
uniformly in the range $[18,22]$. We note that the original image color values
were normalized in the range $[0,1]$, and then the color values after
transformations were clipped to $[0,1]$.

###  3.5 Implementation Details

This section describes the implementation details of our approach. We
implemented FashionAdv in PyTorch and conducted experiments on a computer with
32-GB RAM and a Tesla P100 GPU. We employed the ImageNet pre-trained VGG-19
network [38] as the feature extractor. We used
$L_{c}=\\{\textit{conv4\\_2}\\}$ to present the content, and
$L_{s}=\\{\textit{conv1\\_1, conv2\\_1, conv3\\_1, conv4\\_1, conv5\\_1}\\}$
to present the style, similar to previous usage [3].

We set the weights of the loss function empirically:
$\alpha=0.2,\beta=5*10^{3},\lambda_{1}=0.75,$ and $\lambda_{2}=10^{-6}$. Each
target image was trained using the EOT framework for 200 iterations, with the
Adam optimization [17] and a learning rate of 0.02.

As our attack target, we selected the YOLACT, one of the first networks aimed
at real-time instance segmentation. We used the pre-trained model on the MS-
COCO dataset [24], which was provided by the authors.

Table 1: Comparison of performance between FashionAdv and conventional methods in terms of robustness as represented by average precision (AP) against JPEG compression for various quality factors (QFs). The two best results are shown in blue and red, respectively. FashionAdv significantly outperformed the conventional methods. Method | Conference/Year | No | JPEG Compression
---|---|---|---
Compression | QF 100 | QF 80 | QF 60 | QF 40 | QF 20 | QF 10
Random Noise | - | 58.37 | 58.36 | 57.89 | 57.62 | 56.96 | 54.32 | 40.65
FGSM [11] | ICLR 2014 | 49.71 | 49.93 | 51.33 | 52.63 | 52.90 | 51.97 | 43.30
BIM [18] | ICLRW 2016 | 40.87 | 41.63 | 50.11 | 54.82 | 58.13 | 59.16 | 46.65
DeepFool [30] | CVPR 2016 | 42.23 | 49.99 | 63.33 | 64.00 | 63.34 | 60.00 | 46.35
PGD [28] | ICLR 2018 | 3.74 | 4.70 | 56.05 | 61.12 | 61.66 | 45.65 | 45.65
ColorFool [36] | CVPR 2020 | 46.14 | 48.66 | 50.65 | 50.92 | 50.41 | 47.27 | 33.77
cAdv [3] | ICLR 2020 | 26.16 | 29.70 | 44.74 | 48.05 | 49.24 | 46.66 | 33.14
tAdv [3] | ICLR 2020 | 29.05 | 30.77 | 49.62 | 55.27 | 58.07 | 56.98 | 45.44
FashionAdv (rnd) | CVPRW 2021 | 21.30 | 21.83 | 24.36 | 25.70 | 26.05 | 25.63 | 22.20
FashionAdv | CVPRW 2021 | 18.40 | 18.52 | 19.90 | 20.36 | 20.49 | 20.59 | 20.82

##  4 Experiments

###  4.1 Benchmark Dataset and Evaluation Criteria

To evaluate the proposed method, we selected images containing at least one
person from the MS-COCO dataset [24] and ended up with 1000 images. We
evaluated robustness using Average Precision (AP) [24] and naturalness using
Structural Similarity Index Measure (SSIM) [42]. To evaluate the effectiveness
of methods, we computed AP by comparing the results of person segmentation
before and after an attack.

###  4.2 Comparison with State-of-the-Arts

We compared the performance of FashionAdv with those of state-of-the-art
adversarial example methods: FGSM [11], BIM [18], PGD [28], DeepFool [30],
ColorFool [36], cAdv [3], and tAdv [3]. These methods were originally
developed to attack classifiers; we thus adapted them to attack the
classification sub-network in the person segmentation network (_i.e_.,
YOLACT). Instance segmentation networks are harder to fool than classifiers
[45], and our empirical experiments revealed that the conventional methods
with their default parameter settings are even weaker than a random noise
attack, which is supposedly the weakest type of attack. We thus determined
that it was pointless to use the default parameter settings to attack person
segmentation networks. Therefore, we adjusted their parameter settings by
using a gird search to make the compared methods more reliable than random
noise methods in terms of AP score. The parameter settings and source codes
are publicly released on our project page.

Figure 6: Comparison of the resulting images of different methods. From left
to right: the original image, FGSM [11], ColorFool [36], cAdv [3], tAdv [3],
and our FashionAdv. Changes in image with FashionAdv are inconspicuous. (Best
viewed online in color with zoom-in.)

Figure 3 illustrates the trade-off between naturalness (_i.e_., SSIM) and
robustness (_i.e_., AP) for the compared methods. FashionAdv significantly
outperformed the other methods on robustness against JPEG compression with
different QFs (_i.e_., 10, 40, and 80): the AP scores of FashionAdv were
around 20 while those of the other methods were higher than 30. FashionAdv
also achieved competitive naturalness and was a top method in achieving the
highest SSIM scores. As shown in Fig. 6, the adversarial images generated by
FashionAdv looked the most natural.

Table 1 compares the results for robustness in detail. FashionAdv (rnd) is our
proposed method using fashion style random selection strategy (see section 4.3
for more detail). Our method significantly outperformed state-of-the-art
methods and achieved the highest robustness against image compression. The
conventional methods were not robust even for uncompressed images (except for
PGD) and JPEG compressed images. Their AP scores were higher than 30 and
rapidly increased for the JPEG compressed images. In contrast, the scores for
FashionAdv were lower than 20 on uncompressed images and remained stable at
around 20 for the JPEG compressed images.

Table 2: Contributions of loss components to final result. $\mathcal{L}_{adv}$ | $\mathcal{L}_{tex}$ | $\mathcal{L}_{sim}$ | $\mathcal{L}_{tv}$ | AP | SSIM
---|---|---|---|---|---
✓ |  |  |  | 18.68 | 0.954
✓ | ✓ |  |  | 18.62 | 0.954
✓ | ✓ | ✓ |  | 18.60 | 0.955
✓ | ✓ |  | ✓ | 18.63 | 0.956
✓ | ✓ | ✓ | ✓ | 18.40 | 0.958

###  4.3 Ablation Study

We investigated the effect of different components of our proposed FashionAdv,
such as targeted attack, components of loss function, fashion style selection,
and robustness analysis.

Importance of Attacked Targets.  Previous attack methods target only the
classification module in deep networks, so they work only on image
classification. For person segmentation, both the classification and
segmentation modules must be targeted. Indeed, an experiment we conducted on
attacked targets revealed that targeting both the classification and
segmentation modules significantly reduced AP by 18.35, from 36.75
(corresponding to target only classification module by setting
$\mathcal{L}_{mask}=0$) to 18.40.

Contributions of Loss Components.  Table 2 shows the contributions of the loss
components to the final result. $\mathcal{L}_{tex}$ helps to generate strong
adversarial textures while $\mathcal{L}_{sim}$ and $\mathcal{L}_{tv}$ improve
the naturalness and inconspicuousness of the generated textures. Integrating
these loss components is thus useful in synthesizing robust and natural
adversarial textures.

Figure 7: Robustness against JPEG compression for different quality factors
QFs.

Fashion Style Selection.  We employed two strategies for fashion style
selection. In the first one, a fashion style image is randomly selected from
our style corpus for each target image, denoted by FashionAdv (rnd). In the
second one, denoted by FashionAdv, fashion style image that minimized the
texture transfer cost in the feature space is selected for each target image,
similar to Bhattad et al. [3]. Using the optimal selection strategy
effectively reduced AP by 3 to 5 compared with using the random selection
strategy (_c.f_. Table 1). With this optimized strategy, the fashion style
image closest to the target image is selected, resulting in more natural
adversarial examples. This result also indicates the crucial role of using
guided-fashion style images for synthesizing adversarial textures.

Robustness Against Image Storage.  To evaluate the robustness of FashionAdv
against image storage, _i.e_., against compression and saving in JPEG format,
we investigated using JPEG cues in the robustness training. We compared
training with and without JPEG cue for different JPEG quality factors (QFs).
As shown in Fig. 7, training adversarial examples with JPEG cues kept the AP
score around 20 for all QFs. In contrast, the AP score of training without
JPEG cues increased to 33 at small QFs. Hence, integrating JPEG cues into the
robustness training effectively defends against JPEG compression for various
QFs.

Robustness Against Image Manipulations.  To further exhibit the robustness of
FashionAdv against image manipulations, we investigated the performance of
person segmentation (in terms of AP) on several image editing operations:
scaling, blurring, color jitter, and noise addition. We conducted manipulation
attacks in two modes, easy and hard. In easy mode, we used randomly scaled
images (0.8 to 1.2 of original size), Gaussian blur with a $5\times 5$ kernel,
histogram equalization for color jitter, and uniform noise of 0.05. In hard
mode, we used randomly scaled images (0.5 to 1.5 of original size), Gaussian
blur with a $9\times 9$ kernel, randomly changing values of each color channel
in the range [-0.2, 0.2], and uniform noise of 0.15. We remark that image
color values were normalized and clipped to $[0,1]$.

The effectiveness of the robustness training, which included perspective
transform, image blurring, color variation, and image noise (Section 3.4) was
demonstrated for each attack mode. Table 3 shows that the robustness training
significantly outperformed the standard training (_i.e_., non-robustness
training) for both attack modes, reducing the AP scores by 30. Utilizing our
image perturbation pipeline in the robustness training process was effective
against all image editing operations.

Table 3 also shows that the completed FashionAdv (with robustness training)
was significantly robust against color jitter and noise addition even in hard
mode, in which the AP scores increased by less than 5. We remark that the AP
for the original images was 18.04 (_c.f_. Table 1). FashionAdv also well
defended against two more difficult image editing operations (_i.e_., scaling
and blurring). Image scaling eliminates small details (including generated
adversarial noise) for downscaled images or highlights adversarial noise for
upscaled images. Image blurring can wash away adversarial noise in the images.
For these two image editing operators, AP was smaller than 24, indicating that
FashionAdv also well defends against these difficult attacks.

Table 3: Robustness against image manipulations in terms of AP score.

| Attack
---
Mode
| Robustness
---
Training
Scaling | Blurring | Color Jitter |  | Noise
---
Addition
Easy | $\checkmark$ | 19.93 | 20.75 | 19.12 | 18.04
$\times$ | 44.94 | 50.45 | 21.88 | 23.72
Hard | $\checkmark$ | 23.50 | 23.66 | 22.93 | 19.23
$\times$ | 48.10 | 51.86 | 29.35 | 49.06

##  5 Conclusion

Our proposed adversarial example based method is aimed at spoofing person
segmentation networks. FashionAdv automatically detects and attacks the
clothing regions by synthesizing robust yet natural adversarial textures from
guided-fashion style images, resulting in all persons in the image being
invisible to the networks. Extensive testing showed that FashionAdv is not
only robust against digital image filtering and compression but also produces
images that appear natural to the human eye.

FashionAdv relies on SCHP for generating binary masks of the clothing regions.
If the clothing regions cannot be segmented, the generated adversarial images
will be unable to spoof person segmentation networks. If the binary masks are
over-segmented, manipulations can be easily perceived. Future work includes
investigating better clothing segmentation approaches. It also includes
further exploration of adversarial attacks on general instance segmentation.

Acknowledgements.  This work was partially supported by JSPS KAKENHI Grants
JP16H06302, JP18H04120, JP21H04907, JP20K23355, and JP21K18023, and by JST
CREST Grants JPMJCR18A6 and JPMJCR20D3, including the AIP challenge program,
Japan.

## References

  * [1] Naveed Akhtar and Ajmal Mian.  Threat of adversarial attacks on deep learning in computer vision: A survey.  IEEE Access, 6:14410–14430, 2018.
  * [2] Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok.  Synthesizing robust adversarial examples.  In ICML, pages 284–293, 2018.
  * [3] Anand Bhattad, Min Jin Chong, Kaizhao Liang, Bo Li, and D. A. Forsyth.  Unrestricted adversarial examples via semantic manipulation.  In ICLR, 2020.
  * [4] Daniel Bolya, Chong Zhou, Fanyi Xiao, and Yong Jae Lee.  Yolact: Real-time instance segmentation.  In ICCV, 2019.
  * [5] Tom B Brown, Dandelion Mané, Aurko Roy, Martín Abadi, and Justin Gilmer.  Adversarial patch.  In NeurIPS Workshop, 2017.
  * [6] Xiaoyi Dong, Jiangfan Han, Dongdong Chen, Jiayang Liu, Huanyu Bian, Zehua Ma, Hongsheng Li, Xiaogang Wang, Weiming Zhang, and Nenghai Yu.  Robust superpixel-guided attentional adversarial attack.  In CVPR, pages 12895–12904, 2020.
  * [7] Yinpeng Dong, Qi-An Fu, Xiao Yang, Tianyu Pang, Hang Su, Zihao Xiao, and Jun Zhu.  Benchmarking adversarial robustness on image classification.  In CVPR, pages 321–331, 2020.
  * [8] Ranjie Duan, Xingjun Ma, Yisen Wang, James Bailey, A. K. Qin, and Yun Yang.  Adversarial camouflage: Hiding physical-world attacks with natural styles.  In CVPR, June 2020.
  * [9] Yuying Ge, Ruimao Zhang, Lingyun Wu, Xiaogang Wang, Xiaoou Tang, and Ping Luo.  A versatile benchmark for detection, pose estimation, segmentation and re-identification of clothing images.  CVPR, 2019.
  * [10] Ke Gong, Xiaodan Liang, Dongyu Zhang, Xiaohui Shen, and Liang Lin.  Look into person: Self-supervised structure-sensitive learning and a new benchmark for human parsing.  In CVPR, pages 932–940, 2017.
  * [11] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy.  Explaining and harnessing adversarial examples.  In ICLR, 2014.
  * [12] Chuan Guo, Mayank Rana, Moustapha Cisse, and Laurens van der Maaten.  Countering adversarial images using input transformations.  In ICLR, 2018.
  * [13] Kaiming He, Georgia Gkioxari, Piotr Dollár, and Ross Girshick.  Mask r-cnn.  In ICCV, pages 2980–2988, 2017.
  * [14] K. He, X. Zhang, S. Ren, and J. Sun.  Deep residual learning for image recognition.  In CVPR, pages 770–778, June 2016.
  * [15] Gao Huang, Zhuang Liu, Laurens van der Maaten, and Kilian Q Weinberger.  Densely connected convolutional networks.  In CVPR, 2017.
  * [16] Lifeng Huang, Chengying Gao, Yuyin Zhou, Cihang Xie, Alan L Yuille, Changqing Zou, and Ning Liu.  Universal physical camouflage attacks on object detectors.  In CVPR, pages 720–729, 2020.
  * [17] Diederik P. Kingma and Jimmy Ba.  Adam: A method for stochastic optimization.  In ICLR, 2015.
  * [18] Alexey Kurakin, Ian Goodfellow, and Samy Bengio.  Adversarial examples in the physical world.  In ICLR Workshop, 2016.
  * [19] Trung-Nghia Le, Tam V. Nguyen, Zhongliang Nie, Minh-Triet Tran, and Akihiro Sugimoto.  Anabranch network for camouflaged object segmentation.  CVIU, 184:45–56, 2019.
  * [20] Trung-Nghia Le and Akihiro Sugimoto.  Semantic instance meets salient object: Study on video semantic salient instance segmentation.  In WACV, pages 1779–1788, 2019.
  * [21] Trung-Nghia Le, Akihiro Sugimoto, Shintaro Ono, and Hiroshi Kawasaki.  Toward interactive self-annotation for video object bounding box: Recurrent self-learning and hierarchical annotation based framework.  In WACV, 2020.
  * [22] David A. Leopold and Gillian Rhodes.  A comparative view of face perception.  Journal of Comparative Psychology, 124(3):233–251, 2010.
  * [23] Peike Li, Yunqiu Xu, Yunchao Wei, and Yi Yang.  Self-correction for human parsing.  arXiv preprint arXiv:1910.09777, 2019.
  * [24] Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C. Lawrence Zitnick.  Microsoft coco: Common objects in context.  In ECCV, pages 740–755, 2014.
  * [25] J. Long, E. Shelhamer, and T. Darrell.  Fully convolutional networks for semantic segmentation.  In CVPR, pages 3431–3440, June 2015.
  * [26] Bo Luo, Yannan Liu, Lingxiao Wei, and Qiang Xu.  Towards imperceptible and robust adversarial example attacks against neural networks.  In AAAI, 2018.
  * [27] Yan Luo, Xavier Boix, Gemma Roig, Tomaso Poggio, and Qi Zhao.  Foveation-based mechanisms alleviate adversarial examples.  arXiv preprint arXiv:1511.06292, 2015.
  * [28] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu.  Towards deep learning models resistant to adversarial attacks.  In ICLR, 2018.
  * [29] Aravindh Mahendran and Andrea Vedaldi.  Understanding deep image representations by inverting them.  In CVPR, pages 5188–5196, 2015.
  * [30] Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard.  Deepfool: a simple and accurate method to fool deep neural networks.  In CVPR, pages 2574–2582, 2016.
  * [31] Yao Qin, Nicholas Carlini, Garrison Cottrell, Ian Goodfellow, and Colin Raffel.  Imperceptible, robust, and targeted adversarial examples for automatic speech recognition.  In ICML, pages 5231–5240, 2019.
  * [32] Joseph Redmon, Santosh Divvala, Ross Girshick, and Ali Farhadi.  You only look once: Unified, real-time object detection.  In CVPR, pages 779–788, 2016.
  * [33] Joseph Redmon and Ali Farhadi.  Yolo9000: better, faster, stronger.  In CVPR, pages 7263–7271, 2017.
  * [34] Joseph Redmon and Ali Farhadi.  Yolov3: An incremental improvement.  arXiv preprint arXiv:1804.02767, 2018.
  * [35] Shaoqing Ren, Kaiming He, Ross Girshick, and Jian Sun.  Faster r-cnn: Towards real-time object detection with region proposal networks.  In NeurIPS, pages 91–99, 2015.
  * [36] Ali Shahin Shamsabadi, Ricardo Sanchez-Matilla, and Andrea Cavallaro.  Colorfool: Semantic adversarial colorization.  In CVPR, pages 1151–1160, 2020.
  * [37] Richard Shin and Dawn Song.  Jpeg-resistant adversarial images.  In NIPS Workshops, volume 1, 2017.
  * [38] Karen Simonyan and Andrew Zisserman.  Very deep convolutional networks for large-scale image recognition.  ILSVRC, 2014.
  * [39] Benjamin Sobel.  Hiq v. linkedin, clearview ai, and a new common law of web scraping.  LinkedIn, Clearview AI, and a New Common Law of Web Scraping, April 21, 2020.
  * [40] Simen Thys, Wiebe Van Ranst, and Toon Goedemé.  Fooling automated surveillance cameras: adversarial patches to attack person detection.  In CVPR Workshops, pages 0–0, 2019.
  * [41] Changsheng Wan, Li Wang, and Vir V Phoha.  A survey on gait recognition.  ACM Computing Surveys, 51(5):1–35, 2018.
  * [42] Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero P Simoncelli.  Image quality assessment: from error visibility to structural similarity.  IEEE T-IP, 13(4):600–612, 2004.
  * [43] Zhou Wang, Eero P Simoncelli, and Alan C Bovik.  Multiscale structural similarity for image quality assessment.  In ACSSC, volume 2, pages 1398–1402, 2003.
  * [44] Rey Reza Wiyatno and Anqi Xu.  Physical adversarial textures that fool visual object tracking.  In ICCV, pages 4822–4831, 2019.
  * [45] Zuxuan Wu, Ser-Nam Lim, Larry Davis, and Tom Goldstein.  Making an invisibility cloak: Real world adversarial attacks on object detectors.  In ECCV, 2020.
  * [46] Cihang Xie, Jianyu Wang, Zhishuai Zhang, Yuyin Zhou, Lingxi Xie, and Alan Yuille.  Adversarial examples for semantic segmentation and object detection.  In ICCV, 2017.
  * [47] Kaidi Xu, Gaoyuan Zhang, Sijia Liu, Quanfu Fan, Mengshu Sun, Hongge Chen, Pin-Yu Chen, Yanzhi Wang, and Xue Lin.  Adversarial t-shirt! evading person detectors in a physical world.  In ECCV, 2020.
  * [48] Yang Zhang, Hassan Foroosh, Philip David, and Boqing Gong.  CAMOU: Learning physical vehicle camouflages to adversarially attack detectors in the wild.  In ICLR, 2019.
  * [49] Yue Zhao, Hong Zhu, Ruigang Liang, Qintao Shen, Shengzhi Zhang, and Kai Chen.  Seeing isn’t believing: Towards more robust adversarial attack against real world object detectors.  In ACM CCS, pages 1989–2004, 2019.


# Robust Superconductivity in Quasi-One-Dimensional Multiband Materials

T. T. Saraiva  HSE University, 101000, Moscow, Russia  L. I. Baturina  RTU
MIREA, Lomonosov Institute of fine chemical technologies, 119454, Moscow,
Russia  A. A. Shanenko  HSE University, 101000, Moscow, Russia

###### Abstract

Recently it has been demonstrated that the pair-exchange coupling of quasi-
one-dimensional (Q1D) bands with conventional higher-dimensional bands in one
multiband superconducting material can result in the formation of robust
aggregate pair condensate. In particular, it has been found that the Q1D
thermal pair fluctuations are suppressed in the presence of deep conventional
band(s), where the Fermi level is much larger than the characteristic cut-off
energy. Here we report that impact of the Q1D fluctuations is significantly
weakened even in the presence of nearly shallow higher-dimensional band(s),
which shed new light on robust superconducting state observed in emerging
chain-like-structured superconducting materials A2Cr3As3 (A = K, Rb, Cs).

Understanding new physics in emerging superconducting functional materials is
the key condition for their possible future technological applications.
Coexistence of superconductivity with ferromagnetism Stolyarov2018 ;
Stolyarov2020 , the formation of vortex clusters and vortex patterns,
Shanenko2018 ; Shanenko2021  the interplay between superconductivity and
dimensionality as a matter of searching for superconductors with a high
transition temperature Yan2019 ; Bianconi2019 ; Yan2021 , the strain-driven
enhancement of superconductivity Lu2021  are just few examples of rich related
phenomena.

It is well known that superconductivity suffers at lower dimensions due to
pronounced fluctuations of the order parameter. However, recently it has been
demonstrated that such pair fluctuations are weakened due to interference of
multiple condensates that coexist in one multiband superconducting material
and have different dimensions. Salasnich2019 ; Saraiva2020 . In particular, it
has been demonstrated Saraiva2020  that severe Q1D thermal fluctuations are
suppressed due to the Cooper-pair transfer between Q1D and 3D bands when the
latter is deep enough. In this case the Fermi level of the 3D band is much
larger than the characteristic cut-off energy and the pair fluctuations of the
corresponding 3D condensate are negligible. In the present work, motivated by
these theoretical results and on-going studies of multiband Q1D
superconductors A2Cr3As3 (A = K, Rb, Cs) Jiang2015 ; Bao2015 ; Zhi2015 ;
Tang2015 ; Wu2019 ; Xu2020 , we continue investigations of the two-band model
with the coupled Q1D and 3D bands. Our present study is focused on the pair
fluctuations in the Q1D+3D two-band system beyond the regime of a deep 3D
band.

We consider the two-band generalization of the BCS model, where $s$-wave pair
condensates in both bands are coupled via the Cooper-pair transfer Suhl1959 ;
Moskalenko1959 . The coupling matrix $g_{\nu\nu^{\prime}}$
($\nu,\nu^{\prime}=1,2$) is symmetric, with $\nu=1$ for the 3D band and
$\nu=2$ for the Q1D band. We employ the effective mass approximation so that
the single-particle energies (absorbing the chemical potential $\mu$) are
given by

$\xi_{{\bf k}1}=\varepsilon_{0}+\sum\limits_{i}\frac{\hbar^{2}{\bf
k}^{2}}{2m_{1}}-\mu,\;\,\xi_{{\bf k}2}=\frac{\hbar^{2}k_{x}^{2}}{2m_{2}}-\mu,$
(1)

where $m_{1,2}$ are the effective carrier masses for bands $1$ and $2$, and
${\bf k}=\\{k_{x},k_{y},k_{z}\\}$. The Q1D energy dispersion is degenerate in
the $y$ and $z$ directions and we assume finite contributions to the density
of states (DOS) from these directions. All the energies are measured from the
lower edge of the Q1D band. We adopt $\varepsilon_{0}<0$ and assume that the
standard BCS approximations are applied for band $1$. For illustration, below
we consider the domain $|\mu|<\hbar\omega_{c}$, with $\hbar\omega_{c}$ the
cut-off energy, where the Q1D Feshbach-like resonance determines the system
properties. The role of impurities is neglected and we set $k_{B}=1$ for the
Boltzmann constant.

To investigate impact of the Q1D thermal pair fluctuations, we utilize the
Gibbs distribution $e^{-F/T}$ with $F$ the free energy. For the model of
interest it is given by

$F=\int d^{3}{\bf
r}\Big{[}\sum_{\nu=1,2}f_{\nu}+\langle\vec{\Delta},\check{L},\vec{\Delta}\rangle\Big{]},$
(2)

where $f_{\nu}$ are the band contributions depending on the gap function
$\Delta_{\nu}=\Delta_{\nu}({\bf r})$ and its spatial gradients while the
second term controls the Cooper-pair transfer between the bands. In Eq. (2) we
use a vector notation $\vec{\Delta}=(\Delta_{1},\Delta_{2})$, with
$\langle.,.\rangle$ the scalar product in the band vector space, and the
matrix $\check{L}$ is defined as

$\displaystyle\check{L}=\check{g}^{-1}-\left(\begin{array}[]{cc}{\cal
A}_{1}&0\\\ 0&{\cal A}_{2}\end{array}\right).$ (5)

with $\mathcal{A}_{\nu}$ given by

$\displaystyle\mathcal{A}_{1}=N_{1}\ln\left(\frac{2e^{\Gamma}}{\pi\tilde{T}_{c0}}\right),\,\mathcal{A}_{2}=N_{2}\int\limits_{-\tilde{\mu}}^{1}d\varepsilon\frac{\tanh(\varepsilon/2\tilde{T}_{c0})}{\varepsilon\sqrt{\varepsilon+\tilde{\mu}}}.$
(6)

Here the density of states (DOS) for band $1$ is given by
$N_{1}=m_{1}k_{F}/2\pi^{2}\hbar^{2}$, with the Fermi wavenumber
$k_{F}=\sqrt{2m_{1}(\mu+|\varepsilon_{0}|)}/\hbar$, and for the Q1D band we
have $N_{2}=\sigma_{y}\sigma_{z}\sqrt{m_{2}/32\pi^{2}\hbar^{3}\omega_{c}}$
($\sigma_{y}$ and $\sigma_{z}$ account for the contributions from the $y$ and
$z$ directions), which is the Q1D DOS at the cut-off energy $\hbar\omega_{c}$.
In addition, $T_{c0}$ is the mean-field critical temperature, the quantities
marked by a tilde are given in units of the cut-off energy $\hbar\omega_{c}$,
and $\Gamma\approx 0.577$.

In the vicinity of $T_{c0}$ the contribution $f_{\nu}$ can be expanded in
powers of $\Delta_{\nu}$ and its spatial gradients as

$f_{\nu}=a_{\nu}\left|\Delta_{\nu}\right|^{2}+\frac{b_{\nu}}{2}\left|\Delta_{\nu}\right|^{4}+\sum\limits_{i=x,y,z}{\cal
K}^{(i)}_{\nu}\left|\partial_{i}\Delta_{\nu}\right|^{2}.$ (7)

For the 3D band ($\nu=1$) the coefficients in Eq. (7) are given by the
standard expressions

$\displaystyle a_{1}=-\tau
N_{1},\,b_{1}=\frac{7\zeta(3)}{8\pi^{2}}\frac{N_{1}}{T^{2}_{c0}},$
$\displaystyle{\cal K}^{(x)}_{1}={\cal K}^{(y)}_{1}={\cal
K}^{(z)}_{1}=\frac{\hbar^{2}v_{1}^{2}}{6}b_{1},$ (8)

with $\tau=1-T/T_{c0}$ and the band Fermi velocity $v_{1}=\hbar k_{F}/m_{1}$.
For the Q1D band ($\nu=2$) we obtain ($|\mu|<\hbar\omega_{c}$)

$\displaystyle a_{2}=$
$\displaystyle-\tau\frac{N_{2}}{2\tilde{T}_{c0}}\int\limits_{-\tilde{\mu}}^{1}d\varepsilon\,\frac{\text{sech}^{2}\big{(}\varepsilon/2\tilde{T}_{c0}\big{)}}{\sqrt{\varepsilon+\tilde{\mu}}},$
$\displaystyle b_{2}=$
$\displaystyle\frac{N_{2}}{4\hbar^{2}\omega_{c}^{2}}\int\limits_{-\tilde{\mu}}^{1}d\varepsilon\,\frac{\text{sech}^{2}\big{(}\varepsilon/2\tilde{T}_{c0}\big{)}}{\varepsilon^{3}\sqrt{\varepsilon+\tilde{\mu}}}\left[\sinh\Big{(}\frac{\varepsilon}{\tilde{T}_{c0}}\Big{)}-\frac{\varepsilon}{\tilde{T}_{c0}}\right],$
$\displaystyle\mathcal{K}^{(x)}_{2}=$
$\displaystyle\hbar^{2}v_{2}^{2}\frac{N_{2}}{8\,\hbar^{2}\omega_{c}^{2}}\int\limits_{-\tilde{\mu}}^{1}d\varepsilon\,\frac{\sqrt{\varepsilon+\tilde{\mu}}}{\varepsilon^{3}}\,\text{sech}^{2}\big{(}\varepsilon/2\tilde{T}_{c0}\big{)}$
$\displaystyle\times\left[\sinh\left(\frac{\varepsilon}{\tilde{T}_{c0}}\right)-\frac{\varepsilon}{\tilde{T}_{c0}}\right],\quad{\cal
K}^{(y,z)}_{2}=0,$ (9)

where the characteristic velocity $v_{2}$ for the Q1D band is given by
$v_{2}=\sqrt{2\hbar\omega_{c}/m_{2}}$.

To proceed further, we need to specify the mean-field critical temperature,
which is obtained from the linearized gap equation. For the free energy
functional (2) this equation reads

$\displaystyle\breve{L}\vec{\Delta}=0.$ (10)

A nontrivial solution for $\Delta$ exists only when the determinant of the
matrix $\breve{L}$ is zero so that

$\left(g_{22}-G\mathcal{A}_{1}\right)\left(g_{11}-G\mathcal{A}_{2}\right)-g_{12}^{2}=0,$
(11)

where $G=g_{11}g_{22}-g_{12}^{2}$. As ${\cal A}_{\nu}\propto N_{\nu}$, one
concludes that the couplings $g_{\nu\nu^{\prime}}$ and the DOSs $N_{\nu}$ can
be combined in a smaller set of parameters so that $T_{c0}$ depends only on
the three dimensionless couplings

$\lambda_{11}=g_{11}N_{1},\;\lambda_{22}=g_{22}N_{2},\;\lambda_{12}=g_{12}\sqrt{N_{1}N_{2}}.$
(12)

Equation (11) has two solutions for $T_{c0}$, and the highest one should be
chosen among them as it corresponds to a lower free energy of the system.

One can significantly simplify the expression for the free energy (2) by
representing $\vec{\Delta}$ as a linear combination of the eigenvectors of the
matrix $\breve{L}$ in the form Salasnich2019 ; Saraiva2020

$\vec{\eta}_{+}=\left(\begin{array}[]{c}S\\\
1\end{array}\right),\;\vec{\eta}_{-}=\left(\begin{array}[]{c}1\\\
-S\end{array}\right),$ (13)

with $S$ ($S\geq 0$ for the $s$-wave pairing) defined as

$\displaystyle S=\frac{g_{11}-G\mathcal{A}_{2}}{g_{12}}.$ (14)

Then we have

$\displaystyle\vec{\Delta}({\bf r})=\psi({\bf r})\vec{\eta}_{+}+\varphi({\bf
r})\vec{\eta}_{-},$ (15)

where $\psi({\bf r})$ and $\varphi({\bf r})$ are the condensate modes
associated with $\vec{\eta}_{+}$ and $\vec{\eta}_{-}$. One can check
Salasnich2019 ; Saraiva2020  that only $\psi$ is the critical mode with the
divergent characteristic length and fluctuation het capacity at $T\to T_{c0}$.
The fluctuations controlled by the mode $\varphi$ produce noncritical
corrections and can be safely neglected. Thus, removing all the terms
including $\varphi$, we arrive at the single-component Ginzburg-Landau
functional

$F=\int d^{3}{\bf
r}\Big{(}a_{\psi}|\psi|^{2}+\frac{b_{\psi}}{2}|\psi|^{4}+\sum\limits_{i=x,y,z}{\cal
K}^{(i)}_{\psi}|\partial_{i}\psi|^{2}\Big{)},$ (16)

with

$\displaystyle a_{\psi}=S^{2}a_{1}+a_{2},\;b_{\psi}=S^{4}b_{1}+b_{2},$
$\displaystyle{\cal K}^{(i)}_{\psi}=S^{2}{\cal K}^{(i)}_{1}+{\cal
K}^{(i)}_{2},$ (17)

where the presence of the two bands is reflected in that the coefficients
$a_{\psi},b_{\psi}$, and ${\cal K}^{(i)}_{\psi}$ are the averages over the
available bands, see Eq. (17).

Impact of the thermal pair fluctuations is measured by the Ginzburg number
$Gi$ (also the Ginzburg-Levanyuk parameter). We recall that
$Gi=1-T_{Gi}/T_{c0}$, where $T_{Gi}$ is the temperature at which the mean-
field heat capacity is equal to the fluctuation-driven heat capacity Larkin
and at $T>T_{Gi}$ the fluctuations contribution predominates. The Ginzburg
number for the free energy functional (16) is expressed as Larkin ;
Saraiva2020

$Gi=\frac{1}{32\pi^{2}}\frac{T_{c0}b_{\psi}^{2}}{a^{\prime}_{\psi}{\cal
K}^{(x)}_{\psi}{\cal K}^{(y)}_{\psi}{\cal K}^{(z)}_{\psi}}.$ (18)

where $a^{\prime}_{\psi}=da_{\psi}/dT$. Utilizing Eq. (17), we obtain

$Gi=Gi_{1}\frac{(b_{2}/b_{1}+S^{4})^{2}}{S^{4}(a^{\prime}_{2}/a^{\prime}_{1}+S^{2})\big{(}\mathcal{K}^{(x)}_{2}/\mathcal{K}^{(x)}_{1}+S^{2}\big{)}},$
(19)

where $a^{\prime}_{\nu}=da_{\nu}/dT$ and

$Gi_{1}=\frac{1}{32\pi^{2}}\frac{T_{c0}b_{1}^{2}}{a^{\prime}_{1}\mathcal{K}^{(x)}_{1}\mathcal{K}^{(y)}_{1}\mathcal{K}^{(z)}_{1}}=\frac{27\pi^{4}}{14\zeta(3)}\left(\frac{\tilde{T}_{c0}}{\tilde{\mu}+|\tilde{\varepsilon}_{0}|}\right)^{4}$
(20)

is the Ginzburg number of band $1$.

It is of importance to examine the limiting values of the Ginzburg number,
using Eqs. (19). As is mentioned above, when $S\to\infty$, band $2$ does not
contribute [see Eq. (13)] so that the superconducting properties are
determined by band $1$. In this case Eq. (19) is naturally reduced to
$Gi=Gi_{1}$. For $S\to\infty$ the contribution of band $1$ becomes negligible
(the unstable Q1D condensate predominates) and $Gi\to\infty$. This is not
consistent with the definition of the Ginzburg number, according to which
$Gi\leq 1$. In fact, the origin of this deviation is not surprising since in
the Q1D case we deal with the situation when two stiffness GL coefficients
${\cal K}^{(y)}_{1}$ and ${\cal K}^{(z)}_{2}$ go to zero. Indeed, for
$S\to\infty$ one gets ${\cal K}^{(y)}_{\psi}=S^{2}{\cal K}^{(y)}_{1}\to 0$ and
${\cal K}^{(z)}_{\psi}=S^{2}{\cal K}^{(z)}_{1}\to 0$. It means that for the
two spatial directions the integral over the momentum in the fluctuation-
driven heat capacity becomes divergent, see details of the calculations of the
fluctuation contribution to the heat capacity in Ref. Larkin, . To avoid such
an artificial divergence, the momentum cut-off should be introduced in the
integration (i.e., the boundary of the Brillouin zone). Since we are
interested in the regime when $Gi$ is significantly smaller than $1$ (the pair
fluctuations are not pronounced), we can simply ignore this cut-off and
related technical complications. It is enough to keep in mind that Eqs. (18)
and (19) are not applicable when the Ginzburg number approaches $1$.

Though the Ginzburg number is an important характеристика of the pair thermal
fluctuations, it is not an observable. Then, it is more convenient to employ
the fluctuation-shifted critical temperature $T_{c}$ that is a function of
$Gi$. We can utilize the 3D renormalization group result in the form Larkin

$\frac{T_{c}-T_{c0}}{T_{c}}=\frac{8}{\pi}\sqrt{Gi},$ (21)

which is used below together with Eq. (19).

Figure 0: The mean-field $T_{c0}$ and fluctuation-shifted $T_{c}$ critical
temperatures as functions of the chemical potential $\mu$ calculated for
$|\varepsilon_{0}|/\hbar\omega_{c}=50,70$, and $110$ at $\lambda_{12}=0.005$
and $m_{2}/m_{1}=1$. Other microscopic parameters are given in the text.

As is discussed above, the relative mean-field critical temperature
$\tilde{T}_{c0}$ (in units of $\hbar\omega_{c}$) is determined by the three
dimensionless coupling constants $\lambda_{11},\lambda_{22}$, $\lambda_{12}$
and the chemical potential $\tilde{\mu}$. The fluctuation-shifted critical
temperature $\tilde{T}_{c}$ involves additional microscopic parameters. From
Eq. (19) we find that the Ginzburg number of the two-band system depends on
$Gi_{1}$, $S$ and the ratios $N_{2}/N_{1}$ and $v_{2}/v_{1}$. As is seen from
Eq. (14), $S$ is determined by $\tilde{T}_{c0}$ and $N_{2}/N_{1}$ and, keeping
in mind our results for $\tilde{T}_{c0}$, we find that $S$ depends on
$\lambda_{\nu\nu^{\prime}}$, $\tilde{\mu}$, and $N_{2}/N_{1}$. In turn,
$Gi_{1}$ is determined by $\tilde{T}_{c0}$, $\tilde{\mu}$ and
$\tilde{\varepsilon}_{0}$, see Eq. (20). Finally, the ratio
$v_{2}/v_{1}=\sqrt{m_{1}/\big{(}m_{2}(\tilde{\mu}+|\tilde{\varepsilon}_{0}|)\big{)}}$
is controlled by $\tilde{\mu}$, $\tilde{\varepsilon}_{0}$, and the ratio of
the band masses $m_{2}/m_{1}$. Thus, Eqs. (21) and (19) prescribe that
$\tilde{T}_{c}$ is determined by the following set of the dimensionless
parameters: $\lambda_{\nu\nu^{\prime}}$, $\tilde{\mu}$,
$\tilde{\varepsilon}_{0}$, $N_{2}/N_{1}$, and $m_{2}/m_{1}$.

For illustration we choose $\lambda_{22}=0.18$ and $\lambda_{11}=0.2$ which
correspond to dimensionless couplings of conventional $s$-wave superconductors
Fetter . Usually in two-band systems we have Vagov2016
$\lambda_{12}\ll\lambda_{11},\lambda_{22}$. Here we consider
$\lambda_{12}=0.005,0.01$ and $0.02$. The ratio of the band DOSs $N_{2}/N_{1}$
is close to $1$ in most cases Salasnich2019 , and below we set
$N_{2}/N_{1}=1$. Finally, $\tilde{\mu}$, $\tilde{\varepsilon}$, and
$m_{2}/m_{1}$ can change significantly from one material to another, depending
on fabrication details and doping, and we treat these quantities as free
parameters.

Figure  ‣ 0 The mean-field $T_{c0}$ and fluctuation-shifted $T_{c}$ critical
temperatures as functions of the chemical potential $\mu$ calculated for
$|\varepsilon_{0}|/\hbar\omega_{c}=50,70$, and $110$ at $\lambda_{12}=0.005$
and $m_{2}/m_{1}=1$. Other microscopic parameters are given in the text.
presents $\tilde{T}_{c0}$ and $\tilde{T}_{c}$ versus $\tilde{\mu}$, as
calculated for $|\tilde{\varepsilon}_{0}|=50,70$, and $110$ at
$\lambda_{12}=0.005$ and $m_{2}/m_{1}=1$. One can see that the mean-field
critical temperature exhibits a significant increase when the chemical
potential approaches the lower edge of the Q1D band and the Q1D Feshbach-like
resonance develops. However, this increase can be compromised by the pair
fluctuations. In particular, our results demonstrate that the fluctuation-
shifted critical temperature approaches the mean-field one only when band $1$
becomes deep enough, which is in agreement with the previous results
Saraiva2020 . The reasons for this are as follows. First, $Gi_{1}$ decreases
with increasing $\tilde{\varepsilon}_{0}$, as is seen from Eq. (20). Second,
the ratio $v_{2}/v_{1}$ becomes larger and so does the ratio ${\cal
K}^{(x)}_{2}/{\cal K}^{(x)}_{1}$. The latter appears in the denominator of Eq.
(19) so that an increase of ${\cal K}^{(x)}_{2}/{\cal K}^{(x)}_{1}$ leads to a
decrease of $Gi$. As a result, the pair fluctuations are eventually suppressed
and $\tilde{T}_{c}$ approaches $\tilde{T}_{c0}$, as follows from Eq. (21).

Figure 1: The mean-field $T_{c0}$ and fluctuation-shifted $T_{c}$ critical
temperatures as functions of $|\varepsilon_{0}|$ calculated for
$\mu=0.3\hbar\omega_{c}$ and $\lambda_{12}=0.005,0.01,0.02$ at
$m_{2}/m_{1}=1$. Other microscopic parameters are discussed in the text.

In the opposite regime of decreasing $|\tilde{\varepsilon}_{0}|$, the 3D
condensate tends to lose its robustness and then, at sufficiently small
$|\tilde{\varepsilon}_{0}|$, it cannot stabilize the aggregate condensate of
the two-band system compromised by the Q1D pair fluctuations. The resulting
critical temperature drops, deviating significantly from the mean-field one,
and we arrive at the regime of strong pair fluctuations suppressing the
superconducting correlations. This raises the question of how small
$|\tilde{\varepsilon}_{0}|$ can be to still have moderate thermal fluctuations
in the two-band system.

Figure 2: The same as in Fig. 1 but now for $m_{2}/m_{1}=2$.

To answer this question, we investigate $\tilde{T}_{c}$ as a function of
$|\tilde{\varepsilon}_{0}|$ at the fixed chemical potential $\tilde{\mu}=0.3$
(near the maximum of $\tilde{T}_{c0}$). In particular, Fig. 1 presents
$\tilde{T}_{c}$ versus $|\tilde{\varepsilon}_{0}|$ for the three different
values of the pair-exchange coupling $\lambda_{12}=0.005,0.01$, and $0.02$ at
$m_{2}/m_{1}=1$. In agreement with Fig.  ‣ 0 The mean-field $T_{c0}$ and
fluctuation-shifted $T_{c}$ critical temperatures as functions of the chemical
potential $\mu$ calculated for $|\varepsilon_{0}|/\hbar\omega_{c}=50,70$, and
$110$ at $\lambda_{12}=0.005$ and $m_{2}/m_{1}=1$. Other microscopic
parameters are given in the text., $\tilde{T}_{c}$ increases with
$|\tilde{\varepsilon}_{0}|$ and at sufficiently large values of
$|\tilde{\varepsilon}_{0}|$ the fluctuation-shifted critical temperature
approaches the mean-field superconducting temperature $\tilde{T}_{c0}\approx
0.155$. The latter is almost independent of $\lambda_{12}$ as the mean-field
temperature is mainly governed by the Q1D Feshbach-like resonance Saraiva2020
. At small $|\tilde{\varepsilon}_{0}|$ we find that $\tilde{T}_{c}$ deviates
significantly from $\tilde{T}_{c0}$. However, surprisingly, a sharp drop of
$\tilde{T}_{c}$ occurs only in the region $|\tilde{\varepsilon}_{0}|\lesssim
10$. In particular, one finds that the fluctuation-shifted critical
temperature can still be significant (e.g., larger than a half of
$\tilde{T}_{c0}$) for a nearly shallow band $1$, where
$|\tilde{\varepsilon}_{0}|\approx 0.5$-$1.0$, as is seen for
$\lambda_{12}=0.02$. Notice that in this case the relative Fermi energy
$\tilde{E}_{F}=|\tilde{\varepsilon}_{0}|+\tilde{\mu}$ (in units of
$\hbar\omega_{c}$) is about $1$-$2$ and thus, we arrive at the estimate
$E_{F}/T_{c}\approx 10$-$20$, which is orders of magnitude smaller than the
corresponding values in conventional superconductors.

This surprising feature of our results becomes even more pronounced when we
adopt larger values of $m_{2}/m_{1}$. In particular, Fig. 2 demonstrates the
same as Fig. 1 but now for $m_{2}/m_{1}=2$. Here we find for
$\lambda_{12}=0.02$ that $\tilde{T}_{c}$ is larger than a half of
$\tilde{T}_{c0}$ for $|\tilde{\varepsilon}_{0}|>0.3$. For this case
$E_{F}/T_{c}\approx 7$, which is very close to the BCS-BEC crossover regime in
band $1$. Notice that in this case the critical temperature enhancement due to
the Q1D Feshbach-like resonance is still by an order of magnitude. Indeed,
$\tilde{T}_{c}$ is about $0.007$ when $\tilde{\mu}$ is below $-0.2$.

Concluding, our results for the two-band model with Q1D and 3D bands
demonstrate that severe thermal fluctuations at the Q1D Feshbach-like
resonance are notably weakened even in the presence of a nearly shallow 3D
band with the band Fermi level of about $7$-$10T_{c}$. This shed new light on
robust superconducting state observed in recent chain-like-structured
superconducting materials A2Cr3As3 (A = K, Rb, Cs) and can encourage further
experiments aimed at reaching larger critical temperatures in such materials
due to utilizing the Q1D Feshbach-like resonance.

Acknowledgements. The work at HSE University (A.A.S.) was supported by the
project 21-04-041 “Self-organized structures in microscopic quantum systems”
in the framework of Program “Scientific Funding of the National Research
University “Higher School of Economics” (HSE)” in 2021.

## References

  * (1) Liu, Y.; Liu, Y.-B.; Tang, Z.-T.; Jiang, H.; Wang, Z.-C.; Ablimit, A.; Jiao, W.-H.; Tao, Q.; Feng, C.-M.; Xu, Z.-A.; Cao, G.-H. Phys. Rev. B 2016, 93, 214503.
  * (2) Jiao, W.-H.; Tao, Q.; Ren, Z.; Liu, Y.; Cao, G.-H. Evidence of spontaneous vortex ground state in an iron-based ferromagnetic superconductor. npj Quantum Materials 2017, 2, 50.
  * (3) Stolyarov, V. S.; Casano, A.; Belyanchikov, M. A.; Astrakhantseva, A. S.; S. Yu. Grebenchuk, S. Yu.; Baranov, D. S.; Golovchanskiy, I. A.; Voloshenko, I.; Zhukova, E. S.; Gorshunov, B. P.; Muratov, A. V.; Dremov, V. V.; Vinnikov, L. Ya.; Roditchev, D.; Liu, Y.; Cao, G.-H.; Dressel, M.; Uykur, E. Unique interplay between superconducting and ferromagnetic orders in EuRbFe4As4. Phys. Rev. B 2018, 98, 140506(R).
  * (4) Stolyarov, V. S.; Pervakov, K. S.; Astrakhantseva, A. S.; Golovchanskiy, I. A.; Vyalikh, D. V.; Kim, T. K.; Eremeev, S. V.; Vlasenko, V. A.; Pudalov, V. M.; Golubov, A. A.; Chulkov, E. V.; Roditchev D. Electronic Structures and Surface Reconstructions in Magnetic Superconductor RbEuFe4As4. J. Phys. Chem. Lett. 2020, 11, 9393.
  * (5) Córdoba-Camacho, W. Y.; da Silva, R. M.; Vagov, A.; Shanenko, A. A.; Aguiar, J. A. Quasi-one-dimensional vortex matter in superconducting nanowires. Phys. Rev. B 2018, 98, 174511.
  * (6) Córdoba-Camacho, W. Y.; Vagov, A.; Shanenko, A. A.; Aguiar, J. A.; Vasenko, A. S.; Stolyarov, V. S. Vortex Interactions and Clustering in Thin Superconductors. J. Phys. Chem. Lett. 2021, 12, 4172.
  * (7) Perali, A.; Bianconi, A.; Lanzara, A.; Sainib, N. L. The Gap Amplification at a Shape Resonance in a Superlattice of Quantum Stripes: a Mechanism for High $T_{c}$. Solid State Comm. 1996, 100, 181.
  * (8) Shanenko, A. A.; Croitoru, M. D. Phys. Rev. B 2006, 73, 012510.
  * (9) Bianconi, A. Shape resonances in superstripes. Nat. Phys. 2013, 9, 536.
  * (10) Yan, J.-F.; Zhong, G.-H.; Wang, R.-S.; Zhang, K.; Lin, H.-Q.; Chen, X.-J. Superconductivity and Phase Stability of Potassium-Intercalated p‑Quaterphenyl. J. Phys. Chem. Lett. 2019, 10, 40.
  * (11) Gavrichkov, V. A.; Shan’ko, Y.; Zamkova, N. G.; Bianconi, A. Is There Any Hidden Symmetry in the Stripe Structure of Perovskite High-Temperature Superconductors. J. Phys. Chem. Lett. 2019, 10, 1840.
  * (12) Yan, L.; Bo, T.; Wang, B.-T.; Tretiak, S.; Zhou, L. Single-Layer Dititanium Oxide Ti2O MOene: Multifunctional Promises for Electride, Anode Materials, and Superconductor. J. Phys. Chem. Lett. 2021, 12, 494.
  * (13) Lu, W.; Zhai, H.; Li, Q.; Chen, C. Pronounced Enhancement of Superconductivity in ZrN via Strain Engineering. J. Phys. Chem. Lett. 2021, 12, 1985.
  * (14) Salasnich, L.; Shanenko, A. A.; Vagov, A.; Aguiar, J. A.; Perali, A. Screening of pair fluctuations in superconductors with coupled shallow and deep bands: A route to higher-temperature superconductivity. Phys. Rev. B 2019, 100, 064510.
  * (15) Saraiva, T. T.; Cavalcanti, P. J. F.; Vagov, A.; Vasenko, A. S.; Perali, A.; Dell’Anna, L.; Shanenko, A. A. Multiband Material with a Quasi-1D Band as a Robust High-Temperature Superconductor. Phys. Rev. Lett. 2020, 125, 217003.
  * (16) Jiang, H.; Cao, G.; Cao, C. Electronic structure of quasi-one-dimensional superconductor K2Cr3As3 from first-principles calculations. Sci. Rep. 2015, 5, 16054.
  * (17) Bao, J.-K.; Liu, J.-Y.; Ma, C.-W.; Meng, Z.-H.; Tang, Z.-T.; Sun, Y.-L.; Zhai, H.-F.; Jiang, H.; Bai, H.; Feng, C.-M.; Xu, Z.-A.; Cao, G.-H. Superconductivity in quasi-one-dimensional K2Cr3As3 with significant electron correlations. Phys. Rev. X 2015, 5, 011013.
  * (18) Zhi, H. Z.; Imai, T.; Ning, F. L.; Bao, J.-K.; Cao, G.-H. NMR investigation of the quasi-one-dimensional superconductor K2Cr3As3. Phys. Rev. Lett.114, 147004(2015).
  * (19) Tang, Z.-T.; Bao, Z.; Wang, J.-K.; Bai, H.; Jiang, H.; Liu, Y.; Zhai, H.-F.; Feng, C.-M.; Xu, Z.-A.; Cao, G.-H. Superconductivity in quasi-one-dimensional Cs2Cr3As3 with large interchain distance. Sci. China Mater. 2015, 58, 16.
  * (20) Wu, S.-Q.; Cao, C.; Cao, G.-H. Lifshitz transition and nontrivial h-doping effect in the Cr-based superconductor KCr3As3Hx. Phys. Rev. B 2019, 100, 155108.
  * (21) Xu, C.; Wu, N.; Zhi, G.; Lei, B.-H.; Duan, X.; Ning, F.; Cao, C.; Chen, Q. Coexistence of nontrivial topological properties and strong ferromagnetic fluctuations in A2Cr3As3. npj Comput. Mater. 2020, 6, 30.
  * (22) Suhl, H.; Matthias, B. T.; Walker, L. R. Bardeen-Cooper-Schrieffer Theory of Superconductivity in the Case of Overlapping Bands. Phys. Rev. Lett. 1959, 3, 552.
  * (23) Moskalenko, V. A. Superconductivity of Metals, Taking into Account the Overlapping of Energy Bands. Phys. Met. Metallogr. 1959, 8, 25.
  * (24) Larkin, A.; Varlamov, A. Theory of Fluctuations in Superconductors. Oxford University Press: Oxford, UK, 2005.
  * (25) Fetter, A. L.; Walecka, J. D. Quantum Theory of Many-Particle Systems. Dover: New York, USA, 2003.
  * (26) Vagov, A.; Shanenko, A. A.; Milošević, M. V.; Axt, V. M.; Vinokur, V. M.; Aguiar, J. A.; Peeters, F. M. Superconductivity Between Standard Types: Multiband Versus Single-Band Materials. Phys. Rev. B 2016, 93, 174503.