[a,b]Robert Ziegler

#  Flavor Probes of Axion Dark Matter

###### Abstract

Standard Model extensions with light axions are well-motivated by the observed
Dark Matter abundance and the Peccei-Quinn solution to the Strong CP Problem.
In general such axions can have large flavor-violating couplings to SM
fermions, which naturally arise in scenarios where the Peccei-Quinn symmetry
also explains the hierarchical pattern of fermion masses and mixings. I will
discuss how these couplings allow for efficient axion production from the
decays of SM particles, giving the opportunity to probe flavored axion Dark
Matter with precision flavor experiments, astrophysics and cosmology.

##  1 Introduction

Axions are excellent Dark Matter (DM) candidates, since they are pseudo-
Goldstone bosons of a Peccei-Quinn (PQ) symmetry that is spontaneously broken
at high energies. Being approximate Goldstone bosons implies that axions are
very light, with masses much below the electroweak scale, while the PQ
breaking scale is typically much larger than the electroweak scale, and
suppresses all interactions of the axion with Standard Model (SM) particles.
For sufficiently small axion masses and sufficiently large PQ breaking scales,
axions can therefore easily be stable on cosmological scales, with a lifetime
roughly given by

$\displaystyle 1/\Gamma(a\to\gamma\gamma)\simeq
10^{12}{\rm\,yrs}\left(\frac{f_{a}}{10^{9}\rm GeV}\right)^{2}\left(\frac{\rm
keV}{m_{a}}\right)^{3}\,,$ (1)

where $m_{a}$ is the axion mass and $f_{a}$ the axion decay constant, which is
of the order of the PQ breaking scale. The required hierarchy between $m_{a}$
and $f_{a}$ is naturally realized for the QCD axion, which also solves the
Strong CP Problem, as the mass is inversely proportional to the PQ breaking
scale

$\displaystyle m_{a}=5.7{\rm\,meV}\left(\frac{10^{9}\rm GeV}{f_{a}}\right)\,.$
(2)

At scales much below the PQ breaking scale, the most general axion couplings
to the SM can be described by an effective field theory (EFT) that includes
anomalous couplings to gauge bosons and derivative couplings to fermions [1]:

$\displaystyle{\cal L}_{\rm
eff}=\frac{a}{f_{a}}\frac{\alpha_{s}}{8\pi}G\tilde{G}+C_{a\gamma}\frac{a}{f_{a}}\frac{\alpha_{\rm
em}}{8\pi}F\tilde{F}+\frac{\partial_{\mu}a}{2f_{a}}\sum_{i}C_{i}\overline{f}_{i}\gamma^{\mu}\gamma_{5}f_{i}+\frac{\partial_{\mu}a}{2f_{a}}\sum_{i\neq
j}\overline{f}_{i}\gamma^{\mu}\left(C_{ij}^{V}+C_{ij}^{A}\gamma_{5}\right)f_{j}\,,$
(3)

where I omitted axion couplings to electroweak gauge bosons, which are not
phenomenologically relevant for DM axions. Usually only flavor-diagonal
couplings $C_{i}$ are considered, but flavor-violating couplings111These are
hermitian matrices in flavor space, cf. also Eq. (4). $C_{ij}^{V,A}$ are part
of the most general axion EFT. They are naturally present in well-motivated UV
scenarios and allow for a plethora of new axion couplings to SM particles.
While the inclusion of these couplings proliferates the axion parameter space,
it also enriches axion phenomenology, as it allows to produce axions via the
decay of SM leptons, mesons and baryons such as $\mu\to ea,K\to\pi a,B\to
Ka,\Lambda\to na$. These processes allow to probe axions with precision flavor
factories, extreme astrophysical environments such as core-collapse supernovae
and the early universe. Before I discuss these possibilities in detail, I
briefly review the UV origin of flavor-violating axion couplings, and discuss
UV scenarios where these couplings naturally arise by identifying the PQ
symmetry with a subgroup of a flavor symmetry that addresses Yukawa
hierarchies.

##  2  Motivation

In general axion couplings to SM fermions arise by rotating the PQ charge
matrices to the fermion mass basis, e.g.

$\displaystyle C^{V,A}_{d_{i}d_{j}}\propto\left(V_{d_{L}}^{\dagger}{\rm
PQ}_{q}V_{d_{L}}\right)_{ij}\pm\left(V_{d_{R}}^{\dagger}{\rm
PQ}_{d}V_{d_{R}}\right)_{ij}\,,$ (4)

where $PQ_{q,d}$ denote the PQ charges of SM down quarks and $V_{d_{L,R}}$ are
the unitary matrixes that diagonalizes the down-quark mass matrix as
$V_{d_{L}}^{\dagger}M_{d}V_{d_{R}}=M_{d}^{\rm diag}$. This structure implies
that flavor-violating couplings arise whenever SM fermions carry PQ charges
that are not aligned to SM Yukawas, i.e. they are not diagonal in the same
basis

$\displaystyle[{\rm PQ}_{q},Y_{d}Y_{d}^{\dagger}]\neq 0\,,\qquad{\rm
or}\qquad[{\rm PQ}_{d},Y_{d}^{\dagger}Y_{d}]\neq 0\,.$ (5)

In the most common QCD axion benchmark models flavor alignment is realized, as
PQ charges of SM fermions either vanish (KSVZ models [2, 3]) or are taken to
be flavor-universal (standard DFSZ models [4, 5]). However, in a generic
situation where PQ charges constitute a new source of flavor violation not
aligned to SM Yukawas, flavor-violating axion couplings do arise, for example
in variant DFSZ models with flavor non-universal charges [6, 7]. The size of
flavor-violating axion couplings depends on the corresponding misalignment,
i.e. on the unitary matrices that diagonalize SM Yukawas. Thus in the absence
of a theory of flavor, these rotations are just described by a bunch of new
free parameters, which essentially can be chosen suitably to realize an
arbitrary pattern of flavor structures $C^{V,A}_{ij}$. Particular flavor
patterns have been employed to e.g. suppress the axion couplings to nuclei [8,
9] and address stellar cooling anomalies [10], possibly correlated with low-
energy signals from the extra DFSZ Higgs doublet [11].

Particularly motivated and predictive scenarios arise when the PQ symmetry is
identified with a flavor symmetry that addresses the SM flavor puzzle, i.e.
the hierarchical structure of SM Yukawas [12]. For example in the simplest
realization the PQ symmetry is identified with a $U(1)_{F}$ Froggatt-Nielsen
symmetry [13], which necessarily has a QCD anomaly [14, 15]. This allows to
predict flavor-violating axion couplings up to model-dependent ${\cal O}(1)$
coefficients [16, 17], and determines the phenomenologically most relevant
coupling $C^{V}_{sd}$ to be of the order of the Cabibbo angle, $C^{V}_{sd}\sim
V_{us}\sim 0.1$. Stronger suppression of light quark transitions arise in
models with non-abelian flavor symmetries, for example $U(2)$ models, where
$C^{V}_{sd}\sim V_{td}V_{ts}\sim 10^{-4}$ [18].

Finally, even in scenarios with flavor alignment, renormalization group
running induces flavor violation [19, 20, 21] proportional to CKM angles. This
leads to strongly suppressed couplings, e.g. $C^{V}_{sd}\sim
y_{t}^{2}/(16\pi^{2})V_{td}V_{ts}C_{tt}\log{\Lambda_{UV}/\Lambda_{IR}}\sim
10^{-5}$, which are phenomenologically irrelevant for light axions with masses
$m_{a}\lesssim 100\,\rm MeV$, since astrophysical constraints on flavor-
diagonal couplings yield much stronger constraints [22].

##  3 Precision Flavor Experiments

Flavor-violating couplings of light DM axions are probed by decays of hadrons
and leptons with missing energy. These signals are very similar to the
corresponding SM decays with a final state neutrino pair, which gives an
irreducible background that is small in the quark sector, e.g. ${\rm
BR}(K\to\pi\nu\overline{\nu})_{\rm SM}\sim 10^{-10}$, and large in the lepton
sector, e.g. ${\rm BR}(\mu\to e\nu\overline{\nu})_{\rm SM}=1$. While baryon
and lepton decays are sensitive to both vector and axial vector couplings,
parity conservation of strong interactions imply that pseudoscalar meson
decays to pseudoscalar (vector) mesons are sensitive only to $C^{V}$
($C^{A}$). In the case of polarized lepton decays one can use the angular
distribution of the final lepton to distinguish between vector and axial
vector couplings [23] and to effectively suppress SM background, provided that
the axion signal is not aligned to it, i.e. $C^{A}_{ij}\neq-C^{V}_{ij}$.The
axion signal is monochromatic, with an energy of the visible particle close to
the kinematic edge of the SM three-body for a light axion222As discussed
above, DM axions must typically be much lighter than an MeV in order to be
cosmologically stable. , i.e. half of the mother particles’s mass in the rest
frame. While in the lepton sector experiments have been explicitly searching
for axionic LFV decays, in the quark sector dedicated searches have been
carried out only in the Kaon sector (apart from searches for some flavor-
violating $B$-meson decays at CLEO), and there is no published bound on
$D\to\pi a$, $B\to K^{*}a$ and $B\to\rho a$ decays (which are sensitive to
$C^{V}_{cu},C^{A}_{bs},C^{A}_{bd}$, respectively). However, available
information from searches for the SM three-body decays can often be recast to
derive bounds on the 2-body decay [20]. For example, bounds on $D\to\pi a$ can
be obtained from a recast of CLEO data on $D\to(\tau\to\pi\nu)\overline{\nu}$
(as proposed in Ref. [24]), while bounds on $B\to K^{*}a$ can be obtained by
recasting BaBar data on $B\to K^{*}\nu\overline{\nu}$.

Figure 1:  Present (solid) and future (transparent) constraints on flavor-
violating axion couplings. For details on experiments and observables see
Refs. [20, 23]. Also shown is the naive axion DM range, where the axion
lifetime exceeds the age of the universe for axion-photon couplings of order
unity. The grey vertical lines show the astrophysical bounds on flavor-
diagonal couplings $F_{i}=2f_{a}/C_{i}$, where
$C_{i}=\\{C^{A}_{ee},C^{A}_{NN},C^{A}_{\mu\mu}\\}$ and
$F_{\gamma}=f_{a}/C_{a\gamma}=\alpha/(2\pi g_{a\gamma})$ in the notation of
Ref. [25]. Not shown are haloscope limits that can exclude QCD axions in a
small range close to $F_{\gamma}\approx 10^{12}\rm GeV$ [26].

A systematic analysis of present and future constraints both in the quark and
lepton sector has been carried out in Refs. [20] and [23] for a light axion,
which is summarized in Fig. 1. The x-axis shows the excluded range of the
effective axion coupling $F_{i}=2f_{a}/C_{i}$, where $C_{i}$ is the model-
dependent axion coupling shown on the y-axis. The strongest constraints arise
from NA62 [27], which is able to probe scales of the order of $10^{12}\rm
GeV$! Remarkably, also bounds on $\mu\to ea$ are very strong, reaching
effective coupling scales of order ${\rm few}\times 10^{9}\rm GeV$, which are
obtained from experiments at TRIUMF in the mid 80’s [28]. In the future these
bounds are expected to be pushed beyond $10^{12}\rm GeV$ at Mu3e [29], but
there are also recent ideas how to reach similar sensitivities at MEG-II [23,
30], which requires precise determination of the SM background close to the
endpoint of the Michel spectrum [31]. Present bounds on all other flavor
transitions are weaker, but Belle II has the potential to improve bounds on
$B$-meson and $\tau$-decay by orders of magnitudes, reaching scales up to
$10^{9}\rm GeV$.

Finally in the charm sector BES III can perform dedicated searches to
establish a bound on $D\to\pi a$, while LHCb will improve bounds on neutral
$D$-meson mixing, which at present provides the strongest bound on axial
vector couplings to $cu$. Note that in all other flavor transitions
constraints from meson mixing are much weaker than the ones from meson decays.
This is in contrast to heavy new physics, where constraints on dimension-6
operators from mixing are usually much stronger than constraints from decays,
e.g. the bound on the operators
$1/\Lambda_{bsbs}^{2}(\overline{b}\gamma^{\mu}s)^{2}$ and
$1/\Lambda_{bs\nu\nu}^{2}(\overline{b}\gamma^{\mu}s)(\overline{\nu}\gamma^{\mu}\nu)$
are $\Lambda_{bsbs}\gtrsim 10^{6}\rm GeV$ from $B_{s}$-mixing and
$\Lambda_{bs\nu\nu}\gtrsim 10^{4}\rm GeV$ from $B\to K\nu\overline{\nu}$,
while the bounds on the dimension-5 operator
$1/F_{bs}\partial_{\mu}a\overline{b}\gamma^{\mu}s$ are $F_{bs}\gtrsim
10^{8}\rm GeV$ from the 2-body region of $B\to K\nu\overline{\nu}$ searches.
Therefore dedicated searches for 2-body decays with missing energy are
extremely interesting, as one can probe much higher scales than by looking for
deviations from the SM 3-body decay caused by dimension-6 SMEFT operators,
simply because the 2-body decay comes from a dimension-5 operator.

##  4 Astrophysics

While ordinary stars are not hot enough to thermally excite heavy SM flavors,
the extreme environment of core-collapse supernovae (SN) features nuclear
densities and temperatures of order $40\,\rm MeV$, which is sufficient to
feature a sizable population of muons and hyperons333The hyperon-neutron mass
difference is $\sim 180\,\rm MeV$, resulting in a Boltzmann factor of 1%, see
e.g. Ref. [32] for a review. The decay of muons and hyperons to axions (and
electrons/neutrons) then allows for a new source of energy loss in the form of
long-lived axions, which is limited by the usual star-cooling constraints on
SN1987A, giving a rough upper bound on the energy loss rate per unit mass of
$\epsilon_{a}\lesssim 10^{19}{\rm erg/(g\,sec)}$. This rate can be readily
calculated, and a back-of-the-envelope estimate gives for the energy loss rate
per unit volume [20]

$\displaystyle\rho\epsilon_{a}\sim
n_{n}e^{-(m_{\Lambda}-m_{n})/T}(m_{\Lambda}-m_{n})\Gamma(\Lambda\to na)\,,$
(6)

where $n_{n}$ is the number density of neutrons and $\rho$ is the mass density
of the proto-neutron star. Taking nuclear densities for simplicity, this leads
to a upper bound on the branching fraction ${\rm BR}(\Lambda\to na)$ of order
$10^{-8}$, which is about 6 orders of magnitude better than the bound one can
infer from observed hyperon decays and the total hyperon width [20]. This very
rough estimate is confirmed by a more refined calculation carried out in Ref.
[33], using the full radial profiles from state-of-the-art SN simulations
combined with a hyperonic equation of state. Also including medium effects in
the decay rate, one obtains a bound ${\rm BR}(\Lambda\to na)\lesssim 8.0\times
10^{-9}$, which is valid for any sufficiently long-lived and free-streaming
particle $a$. This bound can readily converted to the strongest constraint on
the axial vector coupling $2f_{a}/C^{A}_{sd}\gtrsim{\rm few}\times 10^{9}\rm
GeV$, which is of the same order as the bound on electron couplings from white
dwarf cooling.

In a similar way one can calculate the SN1987A constraint on axion production
from muon decays [23], giving a bound on the branching ratio of order ${\rm
BR}(\mu\to ea)\lesssim{\rm few}\times 10^{-3}$, which is however more than two
orders of magnitude below the laboratory bound, even for $V-A$ axion couplings
aligned to the SM weak decay [34].

##  5 Cosmology

Flavor-violating meson or lepton decays can produce axions also in the early
universe. If these axions are very light, such as the QCD axion, this would
give rise to a thermal population of axions that is strongly constrained by
CMB bounds on Dark Radiation, usually formulated as a bound on the effective
number of new neutrino species $\Delta N_{\rm eff}$. These constraints have
been studied in detail in Ref. [35], finding that future cosmological bounds
from CMB-S4 surveys will often be comparable or even stronger than the ones
obtained in laboratories, which gives additional motivation to devise and
optimize dedicated axion searches at Belle II and BES III444For $d-s$ and
$\mu-e$ transitions present laboratory bounds are much stronger than
prospective CMB-S4 bounds..

For heavy axions the $\Delta N_{\rm eff}$ bounds can be avoided, and one can
consider scenarios where the flavor-violating decays are in fact the dominant
production of axion DM [36], reproducing the observed DM abundance via thermal
freeze-in [37]. Since in this case the relic abundance is set by the product
of axion mass and flavor-violating decay rate, $\Omega_{a}h^{2}\propto
m_{a}\Gamma(f_{i}\to f_{j}a)\propto m_{a}(C_{ij}/f_{a})^{2}$, this gives a
prediction for the decay as a function of the axion mass, which otherwise
requires extensive flavor model-building. It is clear that this can work only
for axion masses in a suitable range, which is bounded from above by requiring
that the decay is kinematically allowed, and a lower bound because there is an
experimental upper bound on the decay rate, besides constraints from warm Dark
Matter (WDM).

The main challenge of this scenario is DM stability, as the axion can always
decay into two photons, with a decay rate set by

$\displaystyle\Gamma_{a\to\gamma\gamma}$
$\displaystyle\approx\frac{\alpha_{\rm
em}^{2}}{64\pi^{3}}\frac{m_{a}^{3}}{f_{a}^{2}}\left|E-1.92N+\sum_{i}C^{A}_{ii}\frac{m_{a}^{2}}{12m_{i}^{2}}\right|^{2}\,,$
(7)

up to higher powers of $m_{a}^{2}/m_{i}^{2}$, and the sum runs over all SM
fermions and $N$ ($E$) is the color (electromagnetic) anomaly coefficient.
While it is relatively easy to make the axion lifetime larger than the age of
the universe, $1/H_{0}\sim 10^{17}{\rm sec}$, it turns out that in the
relevant axion mass range much stronger constraints on the decay rate arise
from X-ray telescopes, requiring $\Gamma_{a\to\gamma\gamma}\gtrsim 10^{28}{\rm
sec}$ [36]. This implies that the underlying PQ symmetry must be anomaly-free,
and one needs $m_{a}\ll m_{i}$ and/or $C_{ii}\ll C_{ij}$. Note in fact that DM
production is controlled by $C_{i\neq j}$ while DM stability is governed by
$C_{ii}$, so in principle these are independent parameters, although a strong
hierarchy $C_{ii}\ll C_{ij}$ seems somewhat unnatural.

Simple realizations of this idea have been constructed for the lepton sector
in Ref. [36]. Restricting to an effective 2-flavor scenario, where two right-
handed SM leptons are oppositely charged under PQ and a single angle
parametrizes the rotation to mass basis, one has just three parameters: the
axion mass $m_{a}$, the axion decay constant $f_{a}$, and a single angle
$0\leq\alpha\leq\pi/2$, which controls the couplings to leptons, e.g. for the
$\mu e$ scenario $C_{ee}=-C_{\mu\mu}=\sin\alpha$, $C_{\mu
e}=C_{e\mu}=\cos\alpha$. One of these parameters is fixed by requiring that
$\mu\to ea$ decays gives the dominant contribution to the axion relic
abundance via freeze-in, which one can choose to be $f_{a}$. Contributions
from other thermal processes such as $h\mu\to ea$ are UV-sensitive [37], and
are sub-dominant for sufficiently low reheating temperatures $T_{R}\lesssim
10^{7}\rm GeV$. A non-thermal contribution to the abundance comes from
misalignment, which is however not the usual one for the QCD axion, as the
relevant axion masses of interest ($m_{a}\gg{\rm keV}$ from the WDM bound) and
the lower bound on the reheating temperature imply that coherent axion
oscillations start prior to reheating. For an initial period of matter
domination, the present day axion abundance from misalignment is then
suppressed by the dilution which occurred between the onset of oscillations
and the begin of radiation domination, given by a factor $T_{R}/T_{\rm
osc}^{\rm std}$, where $T_{\rm osc}^{\rm std}\propto\sqrt{m_{a}M_{\rm Pl}}$ is
the standard oscillation temperature.

Figure 2:  Allowed parameter space for DM freeze-in through LFV decays for the
$\mu e$\- (left panel) and $\tau\mu$\- (right panel) scenarios. The decay
constant $f_{a}$ (top x-axis) is determined by requiring that the DM abundance
today is produced through freeze-in, once the ALP mass $m_{a}$ (bottom x-axis)
and the mixing angle $\alpha$ (y-axis) is fixed to the reference value
$\alpha=0$. The dark blue shaded, blue shaded and gray shaded regions are
excluded by the DM lifetime, CMB and X-ray constraints on decaying DM,
respectively, while the reach of future X-rays searches is shown by dashed
orange lines. Conservative (stringent) constraints on WDM are shown as dotted-
dashed (dashed) gray lines. The present bound from searches for $\mu\to ea$
are shown as green shaded regions, while the prospects for future proposed
searches at MEG II and Mu3e are shown as dashed green lines. For $\tau\to\mu
a$ experimental prospects are limited to $f_{a}\lesssim 10^{8}\rm GeV$, and
thus not visible in the figure.

Numerical results for the $\mu e$-Scenario and the $\tau\mu$-Scenario (the
$\tau e$-Scenario is very similar to this) are shown in Fig. 2. After fixing
the axion decay constant to reproduce the observed abundance, one is left with
a two-dimensional parameter space, where constraints on decaying DM (age of
the universe, CMB and X-ray telescopes), Warm DM and direct laboratory
searches (see Section 3) are imposed. For the $\mu e$-Scenario the stringent
bounds from X-ray searches require a sizable hierarchy between off-diagonal
and diagonal axion couplings of at least 1%, in particular ruling out the
limit of exact flavor conservation $\alpha=\pi/2$. Present limits from
laboratory searches are roughly at the same level as WDM constraints, but
proposed searches at MEG II and Mu3e will probe almost the entire allowed
parameter space. In contrast experimental prospects for Belle 2 are not
sensitive to test the viable parameter space of the $\mu e$-Scenario, which is
constrained from below by the WDM bound and from above by X-ray searches.
Constraints on decaying DM are weaker than in the $\mu e$-Scenario, because of
the suppression of $\Gamma_{a\to\gamma\gamma}$ by the muon instead of the
electron mass, resulting in an additional suppression factor
$(m_{e}/m_{\mu})^{4}$ in the decay rate. This ensures DM stability even for an
${\cal O}(1)$ hierarchy between flavor diagonal and off-diagonal couplings,
allowing a large viable parameter region that will be probed by future X-ray
telescopes.

##  6 Summary and Conclusions

To summarize, I have argued that invisible axions with flavor-violating
couplings can be efficiently produced from decays of SM particles, which is
relevant for precision flavor experiments, astrophysics and cosmology.

  * •

First, flavor-violating decays with final states axions can be searched for at
colliders, where they mimic the corresponding SM 3-body decay with a neutrino
pair, but with a visible monochromatic daughter particle. Explicitly looking
for such decays allows to probe enormously large scales, since in contrast to
NP contributions to the SM 3-body decay, the axionic 2-body decay is
controlled by dimension-5 operators. Specifically, NA62 will probe scales of
order $10^{12}\rm GeV$, LFV experiments such as Mu3e or MEG II scales of order
$10^{10}\rm GeV$, and Belle II can substantially improve existing constraints
for $b$-quark transitions, testing scales of order $10^{9}\rm GeV$ (see Fig. 3
for a comparison with the usual axion plane).

Figure 3:  Selected prospects from precision flavor experiments in the
$m_{a}-g_{a\gamma\gamma}$ plane., probing $K^{+}\to\pi^{+}a$ (NA62),
$\mu^{+}\to e^{+}a$ (PSI = Mu3e/MEG II) and $B^{+}\to K^{+}/\pi^{+}a$ (Belle
II). The bounds have been obtained using the results of Ref. [20] with unit
flavor-violating couplings $C_{ij}=1$, and converted to an upper bound on
$m_{a}$ using the QCD axion relation. Non-flavor bounds are taken from
https://cajohare.github.io/AxionLimits.

  * •

In the extreme environments of core-collapse Supernovae moderately heavy
flavors are thermally excited, and a sizable population of muons and hyperons
are present in the dense proto-neutron star formed few seconds after core-
collapse. Their decays to invisible axions provides an efficient contribution
to energy loss in form of axions, which is bounded from above by the observed
neutrinos in the burst of SN1987A. While the constraint on muon decays is
weaker than the laboratory bound, the constraint on the $\Lambda\to na$
branching ratio is of order $10^{-8}$, which exceeds terrestrial limits by
many orders of magnitude.

  * •

Flavor-violating decays will take place in the early universe, providing an
important source of axion production. While the decays of light DM axions are
bounded from their contribution to the effective number of relativistic
degrees of freedom, heavy axions in the keV - MeV range can be produced in the
right amount to fully account for the observed DM abundance. For the case of
production from LFV decays, this gives rise to very simple DM models, which
are mainly constrained by X-ray searches for decaying DM. For the case of muon
decays, much of the allowed parameter space will be probed by searching for
$\mu\to ea$ at PSI, probing the very same decay that could have been
responsible for DM production in the early universe.

## Acknowledgements

I would like to thank my collaborators Lorenzo Calibbi, Jorge Martin Camalich,
Paolo Panci, Maxim Pospelov, Diego Redigolo, Thomas Schwetz, Jorge Terol-
Calvo, Laura Tolos, Pham Ngoc Hoa Vuong and Jure Zupan.

## References

  * [1] H. Georgi, D. B. Kaplan, and L. Randall, Manifesting the Invisible Axion at Low-energies, Phys. Lett. B 169 (1986) 73–78.
  * [2] J. E. Kim, Weak Interaction Singlet and Strong CP Invariance, Phys. Rev. Lett. 43 (1979) 103.
  * [3] M. A. Shifman, A. I. Vainshtein, and V. I. Zakharov, Can Confinement Ensure Natural CP Invariance of Strong Interactions?, Nucl. Phys. B166 (1980) 493.
  * [4] M. Dine, W. Fischler, and M. Srednicki, A Simple Solution to the Strong CP Problem with a Harmless Axion, Phys. Lett. B104 (1981) 199–202.
  * [5] A. R. Zhitnitsky, On Possible Suppression of the Axion Hadron Interactions. (In Russian), Sov. J. Nucl. Phys. 31 (1980) 260. [Yad. Fiz.31,497(1980)].
  * [6] C. Q. Geng and J. N. Ng, Flavor Connections and Neutrino Mass Hierarchy Invariant Invisible Axion Models Without Domain Wall Problem, Phys. Rev. D 39 (1989) 1449.
  * [7] M. Hindmarsh and P. Moulatsiotis, Constraints on variant axion models, Phys. Rev. D 56 (1997) 8074–8081, [hep-ph/9708281].
  * [8] L. Di Luzio, F. Mescia, E. Nardi, P. Panci, and R. Ziegler, Astrophobic Axions, Phys. Rev. Lett. 120 (2018), no. 26 261803, [arXiv:1712.04940].
  * [9] F. Björkeroth, L. Di Luzio, F. Mescia, E. Nardi, P. Panci, and R. Ziegler, Axion-electron decoupling in nucleophobic axion models, Phys. Rev. D 101 (2020), no. 3 035027, [arXiv:1907.06575].
  * [10] K. Saikawa and T. T. Yanagida, Stellar cooling anomalies and variant axion models, JCAP 03 (2020) 007, [arXiv:1907.07662].
  * [11] M. Badziak, G. Grilli di Cortona, M. Tabet, and R. Ziegler, Flavor-violating Higgs decays and stellar cooling anomalies in axion models, JHEP 10 (2021) 181, [arXiv:2107.09708].
  * [12] F. Wilczek, Axions and Family Symmetry Breaking, Phys. Rev. Lett. 49 (1982) 1549–1552.
  * [13] C. D. Froggatt and H. B. Nielsen, Hierarchy of Quark Masses, Cabibbo Angles and CP Violation, Nucl. Phys. B 147 (1979) 277–298.
  * [14] L. E. Ibanez and G. G. Ross, Fermion masses and mixing angles from gauge symmetries, Phys. Lett. B 332 (1994) 100–110, [hep-ph/9403338].
  * [15] P. Binetruy and P. Ramond, Yukawa textures and anomalies, Phys. Lett. B 350 (1995) 49–57, [hep-ph/9412385].
  * [16] L. Calibbi, F. Goertz, D. Redigolo, R. Ziegler, and J. Zupan, Minimal axion model from flavor, Phys. Rev. D95 (2017), no. 9 095009, [arXiv:1612.08040].
  * [17] Y. Ema, K. Hamaguchi, T. Moroi, and K. Nakayama, Flaxion: a minimal extension to solve puzzles in the standard model, JHEP 01 (2017) 096, [arXiv:1612.05492].
  * [18] M. Linster and R. Ziegler, A Realistic $U(2)$ Model of Flavor, JHEP 08 (2018) 058, [arXiv:1805.07341].
  * [19] K. Choi, S. H. Im, C. B. Park, and S. Yun, Minimal Flavor Violation with Axion-like Particles, JHEP 11 (2017) 070, [arXiv:1708.00021].
  * [20] J. Martin Camalich, M. Pospelov, P. N. H. Vuong, R. Ziegler, and J. Zupan, Quark Flavor Phenomenology of the QCD Axion, Phys. Rev. D 102 (2020), no. 1 015023, [arXiv:2002.04623].
  * [21] M. Bauer, M. Neubert, S. Renner, M. Schnubel, and A. Thamm, Flavor probes of axion-like particles, JHEP 09 (2022) 056, [arXiv:2110.10698].
  * [22] E. Goudzovski et al., New physics searches at kaon and hyperon factories, Rept. Prog. Phys. 86 (2023), no. 1 016201, [arXiv:2201.07805].
  * [23] L. Calibbi, D. Redigolo, R. Ziegler, and J. Zupan, Looking forward to lepton-flavor-violating ALPs, JHEP 09 (2021) 173, [arXiv:2006.04795].
  * [24] J. F. Kamenik and C. Smith, FCNC portals to the dark sector, JHEP 03 (2012) 090, [arXiv:1111.6402].
  * [25] L. Di Luzio, M. Giannotti, E. Nardi, and L. Visinelli, The landscape of QCD axion models, Phys. Rept. 870 (2020) 1–117, [arXiv:2003.01100].
  * [26] ADMX Collaboration, C. Bartram et al., Search for Invisible Axion Dark Matter in the 3.3–4.2 $\mu$eV Mass Range, Phys. Rev. Lett. 127 (2021), no. 26 261803, [arXiv:2110.06096].
  * [27] NA62 Collaboration, E. Cortina Gil et al., Measurement of the very rare K+→${\pi}^{+}\nu\overline{\nu}$ decay, JHEP 06 (2021) 093, [arXiv:2103.15389].
  * [28] A. Jodidio et al., Search for Right-Handed Currents in Muon Decay, Phys. Rev. D 34 (1986) 1967. [Erratum: Phys.Rev.D 37, 237 (1988)].
  * [29] Mu3e Collaboration, A.-K. Perrevoort, The Rare and Forbidden: Testing Physics Beyond the Standard Model with Mu3e, SciPost Phys. Proc. 1 (2019) 052, [arXiv:1812.00741].
  * [30] Y. Jho, S. Knapen, and D. Redigolo, Lepton-flavor violating axions at MEG II, JHEP 10 (2022) 029, [arXiv:2203.11222].
  * [31] P. Banerjee, A. M. Coutinho, T. Engel, A. Gurgone, A. Signer, and Y. Ulrich, High-precision muon decay predictions for ALP searches, arXiv:2211.01040.
  * [32] I. Vidaña, Hyperons: the strange ingredients of the nuclear equation of state, Proc. Roy. Soc. Lond. A 474 (2018) 0145, [arXiv:1803.00504].
  * [33] J. M. Camalich, J. Terol-Calvo, L. Tolos, and R. Ziegler, Supernova Constraints on Dark Flavored Sectors, Phys. Rev. D 103 (2021), no. 12 L121301, [arXiv:2012.11632].
  * [34] TWIST Collaboration, R. Bayes et al., Search for two body muon decay signals, Phys. Rev. D 91 (2015), no. 5 052020, [arXiv:1409.0638].
  * [35] F. D’Eramo and S. Yun, Flavor violating axions in the early Universe, Phys. Rev. D 105 (2022), no. 7 075002, [arXiv:2111.12108].
  * [36] P. Panci, D. Redigolo, T. Schwetz, and R. Ziegler, Axion Dark Matter from Lepton flavor-violating Decays, arXiv:2209.03371.
  * [37] L. J. Hall, K. Jedamzik, J. March-Russell, and S. M. West, Freeze-In Production of FIMP Dark Matter, JHEP 03 (2010) 080, [arXiv:0911.1120].


# Attacks, defenses, and tools: a framework to facilitate robust AI/ML systems

Mohamad Fazelnia, Igor Khokhlov, Mehdi Mirakhorli
Rochester Institute of Technology
Rochester, NY 14623, USA
<EMAIL_ADDRESS>
###### Abstract

Software systems are increasingly relying on Artificial Intelligence (AI) and
Machine Learning (ML) components. The emerging popularity of AI techniques in
various application domains attracts malicious actors and adversaries.
Therefore, the developers of AI-enabled software systems need to take into
account various novel cyber-attacks and vulnerabilities that these systems may
be susceptible to. This paper presents a framework to characterize attacks and
weaknesses associated with AI-enabled systems and provide mitigation
techniques and defense strategies. This framework aims to support software
designers in taking proactive measures in developing AI-enabled software,
understanding the attack surface of such systems, and developing products that
are resilient to various emerging attacks associated with ML. The developed
framework covers a broad spectrum of attacks, mitigation techniques, and
defensive and offensive tools. In this paper, we demonstrate the framework
architecture and its major components, describe their attributes, and discuss
the long-term goals of this research.

##  1 Introduction

Today’s software systems increasingly rely on various artificial intelligence
(AI) and machine learning (ML) components. For instance, flight control
software of commercial airlines rely on AI-enabled autopilot components,
medical diagnostic software products rely on AI for image analysis, autonomous
driving vehicles heavily rely on object detection and recognition, and modern
intrusion detection systems rely on various ML-based classification models and
anomaly detection. This increase in AI and ML (AI/ML) deployment in software
products can be explained by various reasons, such as availability of the data
needed for AI/ML models training, more powerful computers capable of much
faster model training, drastic advances in the AI/ML algorithms, etc.

Followed by this popularity of AI/ML-based systems, attack and defense
strategies on AI/ML systems have been widely studied (Szegedy et al., 2014;
Goodfellow et al., 2015; Moosavi-Dezfooli et al., 2016; Papernot et al.,
2016). Also, several works have done surveys on this domain (Liu et al., 2018;
Xu et al., 2020; Pitropakis et al., 2019; Yuan et al., 2019) and tried to
categorize attacks and defenses based on their attributes and assumptions.
However, we still lack a comprehensive analysis of the techniques and tactics
used in this domain.

During software design and development, designers have to understand all
potential threats related to the AI/ML algorithms deployment and leverage
mitigation techniques in order to address them. While there have been
extensive resources for weaknesses (MITRE, 2021) and attacks (ATT&CK, 2021) on
software systems, there are not many organized knowledge bases for attacks,
weaknesses, and mitigation techniques for AI-enabled systems.

To this end, we present an online
framework111www.design.se.rit.edu/programs/ai-ml-framework that aims to
enumerate possible attacks to the AI-enabled systems, identifies appropriate
mitigation techniques, tools and toolchains used by adversaries, and
characterizes attackers. This framework provides a structured and scalable
comprehensive knowledge base that can help researchers, practitioners, and AI
capability builders be better informed of attacks, toolchains, and mitigation
techniques and guide them to perform attack modeling of their AI-enabled
software systems and reason about adversaries, identify them, and respond
intelligently.

While this paper presents the framework’s architecture, the long-term goal is
to develop a framework that enables cyber-risk analysis of AI-enabled Software
systems. To the best of our knowledge, this is the first work that provides a
comprehensive framework based on a systematic literature review that
categorizes adversarial actors and explains their behavior, techniques and
tactics used by them, their appropriate mitigation techniques, and the
offensive and defensive tools used in AI/ML systems. The proposed project is a
fundamental step toward developing a knowledge base for various offensive and
defensive measurements, representations, and other mechanisms for securing AI-
enabled software systems.

##  2 Methodology

This work aims to provide a comprehensive framework that contains all the
attacks, mitigation techniques, and tools in AI/ML domain. To this end, we
conducted a systematic literature review of articles published in the two of
the most popular digital libraries, IEEE Xplore 222www.ieeexplore.ieee.org and
ACM Digital Library. 333www.dl.acm.org We explored all peer-reviewed papers
published between 2000 and 2020 years. The first step includes searching in
papers’ abstract using such keywords (and their variations) as “artificial
intelligence,” “machine learning,” “deep learning,” “neural networks,”
“mitigation,” “threat,” and “adversarial.”

As the initial result, we gathered around 14500 papers in total. Then, two
experts in the area filtered out irrelevant papers based on their titles,
which resulted in 2500 filtered papers. The next step included paper
filtration based on their abstracts. Next, we performed a detailed literature
review. During reviewing each paper, we also employed a snowballing process to
review other related works mentioned in the literature that have not been
published in the two aforementioned digital libraries. After we analyzed the
first random 10% of the selected papers, we were able to develop a primary
skeleton of the proposed framework. Based on this review, we identified the
attributes that could characterize different attacks, as well as the
techniques and tactics they use to violate the systems.

In order to build the proposed framework, we perform the following steps:

  1. 1.

Conduct a systematic literature review to gather information representing
attacks on AI/ML algorithms, mitigation strategies, and tools related to
attacks or mitigation techniques.

  2. 2.

Analyze and identify emerging attacks on AI/ML algorithms.

  3. 3.

Classify attacks, tools, and mitigation strategies from various perspectives
and develop appropriate components of the framework. This step resulted in a
set of attributes for each component of the framework, which are presented in
Section 3.

  4. 4.

Develop a bi-directional mapping between all components and implement the
developed framework in a form that can be used by security practitioners and
system developers.

  5. 5.

Finally, the framework has to be validated by gathering feedback from system
designers that used our framework, which is out of this paper’s scope.

This paper briefly discusses the first two steps and focuses on the third
step, and briefly touches on the fourth step. The fifth step will be presented
in future work.

##  3 Framework to Describe AI/ML ATT&CK

Based on the conducted systematic literature review and the analysis of the
selected papers, we developed the framework with three major components:
_attacks_ , _mitigation techniques_ , and _tools_ , and a set of attributes
for each component. Each component provides a comprehensive review of its
area. The framework’s mindmap is presented in figure 1.

Figure 1: An overview of the meta model

###  3.1 Attacks

This section expands the _attacks_ component and describes its characteristics
briefly, as well as its relationship to the _mitigation_ and _tools_
components.

####  3.1.1 Types

Attacks on AI/ML-enabled systems are categorized into three types, _Poisoning
attacks, Exploratory attacks, and Evasion attacks_. In Poisoning Attacks the
attacker tries to undermine the learning process during model training via two
approaches, _injection_ and _modification_ , in which the attacker injects
malicious samples into the training process (Muñoz González et al., 2017) and
the attacker directly changes the training data (Biggio et al., 2011),
respectively. Exploratory Attacks aim to extract private information from the
system, which can be categorized to the following groups: _Membership
inference_ , in which the attacker aims to determine whether a particular data
exists in the training dataset (Shokri et al., 2017). In _property inference_
the attacker tries to extract information about the model and the training
data, like data distribution, or the model hyper-parameters. Finally, in
_model extraction_ , the attacker tries steal the ML model and architecture
(Tramèr et al., 2016). Evasion Attacks refer to those attacks that try to
create a malicious sample that the model classifies mistakenly. The attacker
could reduce the confidence level of the predicted output which is called
(_confidence reduction_), or based on the input and target class, the attacks
are categorized to _misclassification_ , _target misclassification_ and
_source-target misclassification_ (Papernot et al., 2016).

####  3.1.2 Attributes

To better characterize the attacks on AI/ML systems, understanding the
attack’s attributes is extremely important. To this end, we considered the
following attributes for attacks: Approach explains the mechanism of the
attack. Effect shows the consequences of the attack.Awareness illustrates the
level of information that is available to the attacker._White-box_ (Carlini &
Wagner, 2017) denotes full access to the model’s architecture, data and the
parameters, while in a _black-box_ setting, neither data nor the model is
available to the attacker. The _gray-box_ setting refers to the attacks with
limited knowledge about the target model and its data (Xiang et al., 2021).
Severity indicates the level of the violation. Mitigation presents appropriate
mitigation strategies and maps the attack to the related part of the
“mitigation” component of the framework. Affected Models shows the models that
are vulnerable to the attack. Affected Applications mentions some of the
datasets, systems, and real-world applications that are susceptible to the
attack.

####  3.1.3 Adversary’s Model

In addition to the attack attributes, we include adversary model to capture a
threat agent that has the power to, exploit a vulnerability or conduct other
damaging activities in AI-enabled software. To model the adversary, the
following characteristics are considered: Goal expresses the specific attack
goal and motivation. Security Violation illustrates the type of violation,
which could be one or a combination of these types: _integrity violation_ , in
which the adversary undermines the normal system’s behavior, in _availability
violation_ , the attacker compromises the normal performance of the model, and
in _privacy violation_ the attacker obtains private information about the
model or the data (Muñoz González et al., 2017). Attack specificity shows if
the attacker aims to affect only a specific subset of the samples, which is
called _targeted_ , or any sample in the system, which is called
_indiscriminate_. Error specificity shows whether the attacker wants to
misclassify the samples into the desired class or any classes other than the
true class, which is called _error specific_ and _error generic_ ,
respectively (Muñoz González et al., 2017). Assumption explains the
adversary’s access over the model and its resources. Capabilities indicates
the abilities and the malicious potentials of the attack. Weaknesses
represents the adversary’s weaknesses and its blind-spots. Finally, Level of
Expertise shows the required skill level to perform the attack.

###  3.2 Mitigation Techniques

The “mitigation” component presents available techniques and approaches that
can be used to mitigate or defend from the attacks. Each entry in this
component is mapped to the entries of the “attacks” component and has the
following attributes: Approach briefly describes the mitigation method. Effect
explains how utilizing the mitigation technique makes the system more robust
against attacks. Type indicates if the technique is defending the model before
the attack happens (_proactive_) (Papernot et al., 2016), or the technique is
responding to the attack after the attack happened (_reactive_) (Grosse et
al., 2017). Advantage & Disadvantage assesses the benefits and drawbacks of
utilizing the mitigation technique, considering its efficiency, cost, and side
effects.

###  3.3 Tools

This component provides information about tools that enable users to deploy
attacks on AI/ML algorithms, assess the model robustness, and provide
mitigation techniques to make their model more robust against the attacks.
Similar to the two previous components, entries of this component are mapped
to entries of “attacks” and “mitigation” components. For each tool, the
following attributes are considered: Input and Output indicate the type and
format of the inputs and outputs of the tool. Offensive/Defensive indicates
whether a tool is called to carry out an attack or is designed to defend
against the attacks. Availability Status describes the tool’s availability,
whether it is available to the public, open-source, commercial, revised from a
prior toolchain, or it is entirely new.

###  3.4 Implementation

We collect the information we obtained from our systematic literature review
in online knowledge base captured as tables. The tables’ rows correspond to
the techniques discussed in the paper, and the columns represent different
attributes discussed earlier in this section. Then we used this information to
develop the online framework444www.design.se.rit.edu/programs/ai-ml-framework.
The framework is provided with several filters, which allows users to focus on
a specific problem and get into details as necessitated, evaluate the problem
from different viewpoints, and find an appropriate solution with respect to
the advantages, disadvantages, and side effects of the solution.

##  4 Conclusion

In this work, we presented a framework to establish a comprehensive knowledge
base of attacks on AI/ML systems with appropriate mitigation techniques and
defensive and offensive tools. To develop the presented meta model of the
framework, we performed a systematic literature review and analyzed selected
papers from various perspectives. The presented meta model (framework’s
skeleton) thoroughly describes all information required to know about various
attacks, mitigation techniques, and tools and describes the relationship
between them. The paper presents initial attributes for each component, which
will be extended in the immediate future. Even though the presented framework
is in its initial phase, it is capable of covering a broad spectrum of attacks
on AI/ML algorithms in various applications and domains.

## References

  * ATT&CK (2021) MITRE ATT&CK.  MITRE ATT&CK.  https://attack.mitre.org/, 2021.
  * Biggio et al. (2011) Battista Biggio, Blaine Nelson, and Pavel Laskov.  Support vector machines under adversarial label noise.  In _Asian conference on machine learning_ , pp. 97–112. PMLR, 2011\.
  * Carlini & Wagner (2017) Nicholas Carlini and David Wagner.  Towards evaluating the robustness of neural networks, 2017.
  * Goodfellow et al. (2015) Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy.  Explaining and harnessing adversarial examples, 2015.
  * Grosse et al. (2017) Kathrin Grosse, Praveen Manoharan, Nicolas Papernot, Michael Backes, and Patrick McDaniel.  On the (statistical) detection of adversarial examples, 2017.
  * Liu et al. (2018) Q. Liu, P. Li, W. Zhao, W. Cai, S. Yu, and V. C. M. Leung.  A survey on security threats and defensive techniques of machine learning: A data driven view.  _IEEE Access_ , 6:12103–12117, 2018.  doi: 10.1109/ACCESS.2018.2805680.
  * MITRE (2021) MITRE.  Common weakness enumeration.  https://cwe.mitre.org/, 2021.
  * Moosavi-Dezfooli et al. (2016) S. Moosavi-Dezfooli, A. Fawzi, and P. Frossard.  Deepfool: A simple and accurate method to fool deep neural networks.  In _2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR)_ , pp. 2574–2582, 2016.  doi: 10.1109/CVPR.2016.282.
  * Muñoz González et al. (2017) Luis Muñoz González, Battista Biggio, Ambra Demontis, Andrea Paudice, Vasin Wongrassamee, Emil C. Lupu, and Fabio Roli.  Towards poisoning of deep learning algorithms with back-gradient optimization.  In _Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security_ , AISec ’17, pp. 27–38, New York, NY, USA, 2017\. Association for Computing Machinery.  ISBN 9781450352024.  doi: 10.1145/3128572.3140451.  URL https://doi.org/10.1145/3128572.3140451.
  * Papernot et al. (2016) N. Papernot, P. McDaniel, X. Wu, S. Jha, and A. Swami.  Distillation as a defense to adversarial perturbations against deep neural networks.  In _2016 IEEE Symposium on Security and Privacy (SP)_ , pp. 582–597, 2016.  doi: 10.1109/SP.2016.41.
  * Papernot et al. (2016) Nicolas Papernot, Patrick McDaniel, Somesh Jha, Matt Fredrikson, Z. Berkay Celik, and Ananthram Swami.  The limitations of deep learning in adversarial settings.  In _2016 IEEE European Symposium on Security and Privacy (EuroS P)_ , pp. 372–387, 2016.  doi: 10.1109/EuroSP.2016.36.
  * Pitropakis et al. (2019) Nikolaos Pitropakis, Emmanouil Panaousis, Thanassis Giannetsos, Eleftherios Anastasiadis, and George Loukas.  A taxonomy and survey of attacks against machine learning.  _Computer Science Review_ , 34:100199, 2019.
  * Shokri et al. (2017) R. Shokri, M. Stronati, C. Song, and V. Shmatikov.  Membership inference attacks against machine learning models.  In _2017 IEEE Symposium on Security and Privacy (SP)_ , pp. 3–18, 2017.  doi: 10.1109/SP.2017.41.
  * Szegedy et al. (2014) Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus.  Intriguing properties of neural networks, 2014.
  * Tramèr et al. (2016) Florian Tramèr, Fan Zhang, Ari Juels, Michael K. Reiter, and Thomas Ristenpart.  Stealing machine learning models via prediction apis.  In _25th USENIX Security Symposium (USENIX Security 16)_ , pp. 601–618, Austin, TX, August 2016. USENIX Association.  ISBN 978-1-931971-32-4.  URL https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/tramer.
  * Xiang et al. (2021) Y. Xiang, Y. Xu, Y. Li, W. Ma, Q. Xuan, and Y. Liu.  Side-channel gray-box attack for dnns.  _IEEE Transactions on Circuits and Systems II: Express Briefs_ , 68(1):501–505, 2021.  doi: 10.1109/TCSII.2020.3012005.
  * Xu et al. (2020) Han Xu, Yao Ma, Hao-Chen Liu, Debayan Deb, Hui Liu, Ji-Liang Tang, and Anil K Jain.  Adversarial attacks and defenses in images, graphs and text: A review.  _International Journal of Automation and Computing_ , 17(2):151–178, 2020.
  * Yuan et al. (2019) Xiaoyong Yuan, Pan He, Qile Zhu, and Xiaolin Li.  Adversarial examples: Attacks and defenses for deep learning.  _IEEE transactions on neural networks and learning systems_ , 30(9):2805–2824, 2019.