# Cross-Task Attack: A Self-Supervision Generative Framework Based on
Attention Shift

1st Qingyuan Zeng  Institute of Artificial Intelligence
Xiamen University
Fujian, China
<EMAIL_ADDRESS>2nd Yunpeng Gong  School of Informatics
Xiamen University
Fujian, China
<EMAIL_ADDRESS>3rd Min Jiang The corresponding author: Min Jiang,
<EMAIL_ADDRESS>School of Informatics
Xiamen University
Fujian, China
<EMAIL_ADDRESS>
###### Abstract

Studying adversarial attacks on artificial intelligence (AI) systems helps
discover model shortcomings, enabling the construction of a more robust
system. Most existing adversarial attack methods only concentrate on single-
task single-model or single-task cross-model scenarios, overlooking the multi-
task characteristic of artificial intelligence systems. As a result, most of
the existing attacks do not pose a practical threat to a comprehensive and
collaborative AI system. However, implementing cross-task attacks is highly
demanding and challenging due to the difficulty in obtaining the real labels
of different tasks for the same picture and harmonizing the loss functions
across different tasks. To address this issue, we propose a self-supervised
Cross-Task Attack framework (CTA), which utilizes co-attention and anti-
attention maps to generate cross-task adversarial perturbation. Specifically,
the co-attention map reflects the area to which different visual task models
pay attention, while the anti-attention map reflects the area that different
visual task models neglect. CTA generates cross-task perturbations by shifting
the attention area of samples away from the co-attention map and closer to the
anti-attention map. We conduct extensive experiments on multiple vision tasks
and the experimental results confirm the effectiveness of the proposed design
for adversarial attacks.

###### Index Terms:

adversarial attack, cross-task, attention

##  I Introduction

In recent years, the widespread application of artificial intelligence (AI)
systems has brought dramatic changes in various fields. As AI technologies
become more pervasive in our daily lives, people start to worry about their
robustness and safety. Adversarial attacks [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11,
12] are techniques that use small perturbations imperceptible to humans to
deceive AI systems, and have become an important research topic. The goal is
to reveal model weaknesses and help developers build more robust systems. To
provide a strong baseline for deep learning robustness research, many studies
have proposed various effective attack methods to generate adversarial
samples.

Figure 1: Schematic illustration of the proposed idea for cross-task attacks.
In the schematic diagram, $R_{1}$, $R_{2}$ and $R_{3}$ represent the attention
regions of the input image for three different visual tasks, respectively, and
$R_{4}$ represents all regions of the image. Co-attention represents the union
of $R_{1}$, $R_{2}$, and $R_{3}$, while anti-attention represents the
complement of co-attention in $R_{4}$. $A$ represents the attention point of
the original sample, located within the co-attention area, so the original
image can be accurately recognized by all visual tasks. Conversely,
$A^{\prime}$ represents the attention point of the adversarial sample, located
within the anti-attention area, so the adversarial sample can effectively
evade recognition of all visual tasks.

Existing adversarial attack methods can be classified according to three
criteria: 1. sample-specific or cross-sample, 2. model-specific or cross-
model, 3. task-specific or cross-task. Extensive research has been conducted
on the first two criteria. Some researchers conducted pioneering research on
cross-sample attacks, aiming to obtain a perturbation that can disturb
multiple samples simultaneously [13, 14, 15, 16, 17]. On the other hand, some
researchers conducted research on cross-model attacks, aiming to improve the
transferability of adversarial perturbations by adding additional randomness
[18, 19, 20, 21, 22, 23]. Cross-sample attacks can speed up the production of
adversarial example sets, while cross-model attacks can increase the
possibility of black-box attacks under specific tasks.

Most existing research on adversarial attacks mainly focuses on single-task
scenarios, ignoring the multi-task characteristics of AI systems. In practical
applications, AI systems need to cooperate with multiple tasks for decision-
making [24, 25, 26]. Neither cross-sample nor cross-model attacks can
effectively threaten AI systems in practical applications.

Unlike cross-sample and cross-model attacks, the core of the cross-task
adversarial attack methods is to find and destroy the common characteristics
of different vision tasks. DR [27] first proposed a cross-task attack method
called Dispersion Reduction. DR considers that the common characteristics of
different vision tasks is the feature extractor. However, the attack
performance of DR is weak because the feature extractors vary greatly among
different tasks and models.

In this paper, we propose a self-supervision generative framework based on
attention shift to enable cross-task attack. Our approach, called Cross-Task
Attack (CTA) and illustrated in Figure 3, is inspired by previous explorations
around the principles of adversarial attacks [28, 29]. Adversarial samples can
fool neural networks because the perturbations make the models’ attention move
to unimportant areas [29]. So we presume that cross-task attack can be
achieved by directing the attention of the models to areas that all visual
tasks neglect.

We use co-attention map to represent the regions that multiple visual tasks
focus on, while anti-attention map to represent the regions that all visual
tasks neglect. As shown in Figure 1, co-attention is the union of attention
regions from different visual tasks, while anti-attention is the complement of
co-attention. By using perturbation $\delta$ to shift the attention of
adversarial sample from point $A$ in co-attention region to point $A^{\prime}$
in anti-attention region, cross-task attack can be achieved. It is worth
noting that co-attention and anti-attention maps are obtained using ready-made
pre-trained models, so CTA does not require any ground truth labels for
training.

Based on the experimental conclusions of previous work [28], attention heatmap
is a model-agnostic shared feature in specific task. As shown in Figure 2, we
can see that the attention heatmaps of different tasks are very different,
which means that attention heatmap is shared in a specific task, but not
shared in different tasks. This explains why adversarial examples based on
single-task attacks fail on other tasks, because single-task attacks only
divert the attention of adversarial examples from the attention area of a
specific task, but may be moved to attention area of other tasks.

Contributions. The main contributions of this paper are as follows:

  * •

We conduct an intuitive principle analysis of existing single-task and cross-
task attack methods, explaining their weaker performance in cross-task
scenarios from the perspective of attention.

  * •

We are the first to apply common attention from different visual tasks in
adversarial attacks. We propose a self-supervised generative framework CTA to
shift the attention of images to regions that are overlooked by variable
visual task models, enabling cross-task attack.

Figure 2: Grad-CAM heatmaps for different visual tasks are displayed. The
first row presents the heatmaps, while the second row overlays these heatmaps
onto the original image. The column (a) is the classification task based on
ResNet50, the column (b) is the semantic segmentation task based on DeepLabv3,
the column (c) is the object detection task based on Faster-RCNN, and the
column (d) is the co-attention heatmap that all visual tasks focus on. Figure
3: The framework diagram about our proposed self-supervised cross-task attack
method. We use existing pre-trained models to extract the anti-attention map
of the input image as the ground-true label of the framework. We use the
generator to generate adversarial perturbation to change the mapping of image
in feature space. By shortening the MSE distance between the adversarial
attention map and the anti-attention map, the attention area of the
adversarial image falls in the area that is ignored by all visual tasks.

##  II Related Works

###  II-A Single-task Single-model Attack

Single-task single-model attack means that the attacker designs an adversarial
example that can deceive the target model while knowing the parameters and
structure of the target model. The basic idea of single-task single-model
attack can be divided into two categories, one is to use gradient ascent in
the image pixel space to maximize the loss function [1, 30, 31, 2], and the
other is to use complex optimization process to find the optimal solution
leading to wrong prediction [3, 32].

###  II-B Single-task Cross-model Attack

In order to enable adversarial samples to attack different models under
specific tasks, many studies have investigated how to improve the
transferability of adversarial samples. DIM [18] incorporated random
transformations in the gradient iteration process to increase the diversity of
adversarial perturbations. TI-FGSM [19] added a translational data
augmentation method to increase the translational invariance of the
adversarial examples. SI-FGSM [33] utilized the scalability invariance of deep
learning models and proposes adding random scaling in the gradient iteration
process. DAS [28] achieved single-task attack by suppressing Grad-CAM heatmaps
[34]. $\text{S}^{2}$I-FGSM [23] applies spectral transformation in the
frequency domain to enhance the mobility of adversarial samples. These works
all rely on the loss function of a specific task and they cannot guide the
movement direction of the attention area of the adversarial example, which
makes them unable to attack other visual tasks.

###  II-C Cross-task Attack

DR [27] introduced a method for generating adversarial examples without
relying on specific-task loss functions. By utilizing VGG [35] to extract
image feature maps and reducing the standard deviation, they obtained
adversarial examples that can disrupt feature extraction, thus achieving
cross-task attacks. RB [22] proposed random blur (RB) during iterative
optimization against perturbations, which improves the diversity of
adversarial perturbations. RB can slightly improve the performance of DR in
scenarios of cross-task attacks. These works are cross-task attack methods
that do not depend on task-specific loss functions, but their cross-task
attack performance is weak because they cannot guide the attention shift
direction of adversarial samples.

Different from the idea of perturbing feature extractors in the existing
cross-task attack methods, we solve the problem of cross-task attack from a
novel perspective. We pioneered the concepts of co-attention and anti-
attention maps, and utilized them to guide the direction of attention-shift
for adversarial samples. The attention of the adversarial examples is shifted
to regions that are not concerned by various vision tasks to enable cross-task
attacks.

##  III The proposed method

Algorithm 1 Cross-Task Attack Method

Input: Clean image $x$, classification model $f_{cls}$, detection model
$f_{det}$, segmentation model $f_{seg}$, generator $G$, feature extractor $D$

1: Initialize generator $G$ with random weights.

2: for $i$=1 to $T$ do

3: Calculate the Grad-CAM maps $\mathcal{A}_{c}$, $\mathcal{A}_{d}$, and
$\mathcal{A}_{s}$ of $f_{cls}$, $f_{det}$, and $f_{seg}$ for clean samples
through Eq.(1).

4: The co-attention map is obtained by merging the features of
$\mathcal{A}_{c}$, $\mathcal{A}_{d}$, and $\mathcal{A}_{s}$ through Eq.(2).

5: The anti-attention map is obtained by inverting the co-attention through
Eq. (3).

6: Use generator $G$ to change the mapping of input image $x$ in the feature
space and obtain the unbounded adversarial image $x^{\prime}$. The calculation
process is as in Eq.(4).

7: Restrict the distribution of $x^{\prime}$ to the range of [$x-\epsilon$,
$x+\epsilon$] and obtain the bounded adversarial image $x_{adv}$ through
Eq.(5).

8: Use the pre-trained feature extractor $D$ to extract the features of
$x_{adv}$ and obtain the category $y^{c}$ with the highest confidence.
Substitute Eq.(1) to calculate the $\mathcal{A}_{adv}$ of $x_{adv}$.

9: Update parameters of $G$ using Adam optimizer to minimize the loss function
Eq.(6).

10: end for

11: Return generator $G$.

In this section, we introduce how our proposed Cross-Task Attack (CTA) shifts
the attention of adversarial samples from important areas to areas that are
overlooked by various visual tasks.

###  III-A Overview of the Framework

In order to obtain cross-task adversarial samples, we first need to identify
the regions of the samples that are not of interest to various visual tasks,
and then use adversarial perturbations to shift attention to these regions. We
propose a self-supervised cross-task attack method named CTA, as shown in
Figure 3. CTA consists of two stages: attention extraction stage and attention
shift stage. The attention extraction stage is to obtain the co-attention and
anti-attention maps of clean samples. The former reflects the important areas
that different vision task models need to pay attention to, while the latter
reflects the unimportant areas that are ignored. The attention shift stage is
to shift the adversarial samples’ attention from the co-attention area to the
anti-attention area by adding adversarial perturbations, thus enabling cross-
task attacks.

###  III-B Attention Extraction Stage

The process of attention extraction stage is the bottom part of Figure 3.
First, we use ready-made pre-trained models and Grad-CAM to obtain attention
maps of clean samples in different vision tasks. Because the attention of
different models of the same task is similar, it is enough to choose one model
for each vision task [28]. Specifically, the formula for calculating the Grad-
CAM attention heatmap $\mathcal{A}$ is

$\mathcal{A}(i,j)=\operatorname{max}\left(0,\frac{1}{Z}\sum_{k}\sum_{i}\sum_{j}\cdot\frac{\partial
y^{c}}{\partial\mathcal{F}_{k}(i,j)}\cdot\mathcal{F}_{k}(i,j)\right),$ (1)

where $Z$ is the total number of pixels in the feature map, $y^{c}$ is the
probability that classifier $f_{cls}$ predicts that the input image $x$
belongs to class $c$, and $\mathcal{F}_{k}(i,j)$ is the value of the $k$-th
feature map of the last convolutional layer at position $(i,j)$.

After obtaining the attention map $\mathcal{A}$ for each vision task, we need
to find which regions of the picture are the focus of all vision tasks.
Therefore, we fuse the attention heatmaps of different visual tasks to obtain
the co-attention map, which represents the common focus area of different
visual tasks. We used a simple and effective method for feature fusion,
calculated as follows:

$\text{co-
attention}(i,j)=\operatorname{Scale}\left(\frac{1}{K}\sum_{k}\mathcal{A}_{k}(i,j)\right),$
(2)

where $Scale$ means to normalize the value range of the heatmap to [0,1], $K$
represents the number of visual tasks, and $\mathcal{A}_{k}(i,j)$ represents
the value of attention heatmap of the $k$-th visual task at position $(i,j)$.
The high-value pixel area of co-attention map is the area that different
visual tasks all focus on.

At last, we invert the co-attention map to get the anti-attention map as
follow:

$\text{anti-attention}(i,j)=1-\text{ co-attention }(i,j),$ (3)

anti-attention represents regions that are not attended to by all vision
tasks, which can be used as labels for self-supervised training in attention
shift stage.

###  III-C Attention Shift Stage

The process of attention shift stage is the upper part of Figure 3. To shift
the attention of input image, we use a generator to generate adversarial
perturbations and add them to the image to change its mapping in the feature
space. The calculation process for adversarial sample is as follows:

$x^{\prime}=x+G(x),$ (4)

where $x$ represents the input clean sample, $x^{\prime}$ represents the
adversarial sample without range constraints, $G$ represents the generator. To
increase the invisibility of adversarial samples, we need to crop the
adversarial sample at the pixel level:

$x_{adv}(i,j)=\operatorname{min}(x(i,j)+\epsilon,\operatorname{max}(x^{\prime}(i,j),x(i,j)-\epsilon)),$
(5)

where $x_{adv}(i,j)$ and $x(i,j)$ represents the value of adversarial sample
and clean sample at position $(i,j)$, $\epsilon$ represents disturbance range
threshold. Each pixel of the adversarial sample $x_{adv}$ is cropped to the
range of [$x-\epsilon$, $x+\epsilon$].

In order to obtain the attention heatmaps of adversarial samples, we used the
parameter-frozen feature extractor (ResNet50) to calculate $y^{c}$. By
substituting $y^{c}$ into Equation 4, the attention map $\mathcal{A}_{adv}$ of
the adversarial sample can be obtained. We use the distance between anti-
attention map and $\mathcal{A}_{adv}$ as the loss function to update the
parameters of generator $G$. More precisely, the loss function is

$\mathcal{L}=\frac{1}{N}\sum_{i,j}(\text{anti-
attention}(i,j)-\mathcal{A}_{adv}(i,j))^{2},$ (6)

where $\mathcal{L}$ is the loss function and $N$ is the total number of pixels
in the image.

By updating the parameters of generator $G$ through minimizing $\mathcal{L}$,
CTA can generate more effective cross-task perturbations. These perturbations
guide the attention of adversarial samples towards regions of high numerical
value in the anti-attention maps, which are typically ignored by all visual
tasks. The detailed process of our method CTA is outlined in Algorithm 1.

TABLE I: Performance comparison (%) of different models for different visual
tasks on clean and adversarial samples.

Attack Methods | Classification Results | Detection Results | Segmentation Results
---|---|---|---
VGG19 | IncResv2 | YOLOv3 | Faster-RCNN | DeepLabv3 | FCN
Accuracy | mAP | mAR | mAP | mAR | GCR | mIoU | GCR | mIoU
$\epsilon$=10 / $\epsilon$=16 |  $\epsilon$=10 / $\epsilon$=16 |  $\epsilon$=10 / $\epsilon$=16 |  $\epsilon$=10 / $\epsilon$=16 |  $\epsilon$=10 / $\epsilon$=16 |  $\epsilon$=10 / $\epsilon$=16 |  $\epsilon$=10 / $\epsilon$=16 |  $\epsilon$=10 / $\epsilon$=16 |  $\epsilon$=10 / $\epsilon$=16 |  $\epsilon$=10 / $\epsilon$=16
Clean Sample | 72.9 | 80.8 | 59.4 | 70.9 | 51.2 | 62.8 | 94.2 | 76.3 | 93.3 | 70.3
Gaussian Noise | 70.1 / 65.7 | 76.62 / 72.11 | 56.9 / 53.7 | 67.1 / 65.5 | 47.3 / 44.7 | 60.1 / 56.5 | 93.5 / 92.4 | 74.7 / 71.2 | 92.1 / 90.7 | 66.8 / 64.2
DR | 67.4 / 46.17 | 73.74 / 64.38 | 45.8 / 38 | 58.7 / 51.1 | 38.5 / 30.9 | 50.8 / 44.3 | 91 / 88.7 | 66.1 / 59.1 | 89.5 / 87.3 | 57 / 50
RB-DR | 65.8 / 45.11 | 71.96 / 63.18 | 44.5 / 36.4 | 58.1 / 49.9 | 37.5 / 29.5 | 50.1 / 43.6 | 90.2 / 88.1 | 64.7 / 58.7 | 89.2 / 86.5 | 56.3 / 48.9
$\text{S}^{2}$I-FGSM | 0.8 / 0.71 | 0.58 / 0.56 | 42.8 / 33.1 | 56.6 / 47.2 | 34.7 / 26.7 | 49 / 41.2 | 89 / 82.4 | 60 / 50.2 | 86.5 / 82 | 49.5/ 38.5
$\text{S}^{2}$I-SI-TI-FGSM |  0.75 / 0.68 |  0.54 / 0.53 | 37.7 / 27.1 | 51.5 / 40.4 | 31.4 / 18.9 | 45.6 / 32.1 | 88.3 / 80.4 | 59.2 / 38.1 | 85.9 / 80.3 | 46.4 / 29.5
CTA(ours) | 26.52 / 7.47 | 0.68 / 0.52 |  31.1 / 19.5 |  46.7 / 32.4 |  31.1 / 16.5 |  44.9 / 28.5 |  88.1 / 77.8 |  58.7 / 32.1 |  85.3 / 78.4 |  43.2 / 22.7

Figure 4: The mAP of Faster-RCNN on the adversarial samples generated by different adversarial attack methods. The abscissa is the 20 categories of the VOC 2012 validation dataset, and the ordinate is mean Average Precision. Under the condition of $\epsilon$ = 16, we compared the performance differences between our proposed CTA method and existing adversarial attack methods DR, RB-DR, $\text{S}^{2}$I-FGSM and $\text{S}^{2}$I-SI-TI-DIM.  Figure 5: The mIoU of DeepLabv3 on the adversarial samples generated by different adversarial attack methods. The abscissa is the 21 categories of the VOC 2012 validation dataset including the background category, and the ordinate is mean Intersection over Union. Under the condition of $\epsilon$ = 16, we compared the performance differences between our proposed CTA method and existing adversarial attack methods DR, RB-DR, $\text{S}^{2}$I-FGSM and $\text{S}^{2}$I-SI-TI-DIM.  TABLE II: Performance comparison (%) of different attack methods on various visual tasks in adversarial training defense models. Attack Methods | adv-IncResv2 | adv-Faster-RCNN | adv-FCN
---|---|---|---
Accuracy | mAP | mAR | GCR | mIoU
$\epsilon$=10 / $\epsilon$=16 |  $\epsilon$=10 / $\epsilon$=16 |  $\epsilon$=10 / $\epsilon$=16 |  $\epsilon$=10 / $\epsilon$=16 |  $\epsilon$=10 / $\epsilon$=16
Clean Sample | 80.06 | 45.9 | 58.2 | 90.6 | 59.7
Gaussian Noise | 76.6 / 75.1 | 42.4 / 40.8 | 56.7 / 54.4 | 89.5 / 89.1 | 57.9 / 56.5
DR | 75.85 / 69.05 | 36.8 / 34 | 50 / 52.6 | 89.9 / 88.5 | 58.7 / 52.1
RB-DR | 74.66 / 67.64 | 35.7 / 32.4 | 49.2 / 47.9 | 89.4 / 87.9 | 57.8 / 50.4
$\text{S}^{2}$I-FGSM | 0.97 / 1.01 | 34.1 / 27.9 | 48.1 / 41.6 | 88 / 86 | 51.4 / 45.5
$\text{S}^{2}$I-SI-TI-FGSM |  0.88 / 0.91 | 33.6 / 25.5 | 47.7 / 37.8 | 87.4 / 85.4 | 50.5 / 43.2
CTA | 1.04 / 0.93 |  32.6 / 19.4 |  46.3 / 31 |  85.9 / 79.3 |  46.7 / 24.1

##  IV Experiments

In this section, we conduct extensive quantitative experiments on three
classic visual tasks: image classification, object detection, and semantic
segmentation, to evaluate the effectiveness and robustness of our proposed
method CTA for cross-task attack. We also perform qualitative experiments to
observe the trend of Grad-CAM attention heatmaps across the training
iterations.

###  IV-A Experimental Setup

####  IV-A1 Evaluation datasets.

Following the experimental settings of previous work [36, 27, 22], we randomly
select 10 samples from 1000 classes in the ImageNet validation set, totaling
10000 samples, as the validation set for the classification task. We use the
complete validation set of PASCAL VOC 2012 as the validation set for object
detection and semantic segmentation tasks.

####  IV-A2 Generator training.

We use a ResNet architecture composed of downsampling blocks and upsampling
blocks as generator $G$ [37]. We use the images in the VOC 2012 training set
to train the generator $G$. It is worth noting that the training of CTA does
not require any ground true labels, as we use ready-made models to extract
anti-attention graphs for self-supervised training. The pretrained model for
each visual task adopts classic and ready-made models, with ResNet50 as
classification model $f_{cls}$, SSD as detection model $f_{det}$, and U-nets
as segmentation model $f_{s}$. The feature extractor $D$ for adversarial
samples adopts ResNet50. We use Adam optimizer for training, learning rate is
set to 1e-3, first and second moment exponential decay rates are set to 0.5
and 0.99. We train two versions of perturbation generator $G$ based on
different perturbation range thresholds, corresponding to epsilon 10 and 16
respectively. Our experimental device uses three GPU of RTX2080ti with 11GB
memory and a CPU of Intel(R) Core(TM) i5-10400F.

####  IV-A3 Comparison attack algorithms.

We choose five adversarial attack methods for comparison: 1. DR, a cross-task
adversarial attack method that does not rely on any specific task loss
function, it reduces the feature map standard deviation to create adversarial
examples that fool multiple visual tasks; 2. RB-DR, which adds a random blur
(RB) data augmentation method on the basis of DR to increase the success rate
of attack. 3. $\text{S}^{2}$I-FGSM, a single-task cross-model attack algorithm
that belongs to the FGSM adversarial attack family, it relies on a specific
task loss function, and uses frequency domain transformation to enhance the
transferability of adversarial examples and improve the cross-model attack
effect. To the best of our knowledge, $\text{S}^{2}$I-FGSM has been proven to
be the state-of-the-art method for single-task cross-model attack. 4.
$\text{S}^{2}$I-SI-TI-DIM, where we have aggregated existing popular single-
task attack methods, including $\text{S}^{2}$I-FGSM, TI-FGSM, SI-FGSM and DIM,
to achieve the strongest single-task cross-model attack for comparison. 5.
Gaussian noise, the performance baseline for adversarial attacks. The
hyperparameter settings for $\text{S}^{2}$I-FGSM and $\text{S}^{2}$I-SI-TI-DIM
are set according to the default settings in $\text{S}^{2}$I-FGSM [23]. The
hyperparameter settings for DR and RB-DR are set according to the default
settings in DR [27].

####  IV-A4 Evaluation metric.

For the classification task of Imagenet, we use Top-1 accuracy as the
evaluation metric. For the obeject detection task of PASCAL VOC 2012, we use
mean Average Precision (mAP) and mean Average Recall (mAR) as evaluation
metrics. For the semantic segmentation task of PASCAL VOC 2012, we use Global
Correct Rate (GCR) and mean Intersection over Union (mIoU) as evaluation
metrics.

###  IV-B Attack Normally Trained Models

####  IV-B1 Image classification task results.

In the image classification task, we choose VGG19 [35] and IncResv2 [38]
pretrained on ImageNet as the attack target models. Table I shows the
classification accuracy of our proposed CTA attack method and the compared
attack methods on the ImageNet validation set. It can be observed that the
cross-task attack method DR performs very weakly in classification tasks, only
reducing the accuracy rate by average 13.92% compared to clean samples. After
applying random blur (RB) on the basis of DR, RB-DR has an about 2%
improvement in attack performance. $\text{S}^{2}$I-FGSM and
$\text{S}^{2}$I-SI-TI-DIM are adversarial attack methods designed for
classification, which use the loss function and real labels of the
classification task, thus having very strong attack performance in
classification tasks. We regard $\text{S}^{2}$I-FGSM and $\text{S}^{2}$I-SI-
TI-DIM as the upper bound of attack performance for classification tasks.
Compared to DR, our CTA reduces the accuracy rate by 54.08% and is close to
the upper bound of classification attack performance, demonstrating its
effectiveness in classification scenarios.

Figure 6: Grad-CAM heatmap of adversarial samples with different training
iterations in CTA method.

####  IV-B2 Object detection task results.

In the object detection task, we choose YOLOv3 [39] and Faster-RCNN [40]
pretrained on PASCAL VOC 2012 as the attack target models. Table I shows the
mAP and mAR of our proposed CTA attack method and the compared attack methods
on PASCAL VOC 2012 validation set. Figure 4 shows the mAP of 20 categories of
Faster-RCNN on different adversarial samples. As shown in Table I, DR can
reduce the mAP and mAR by an average of 20.6% and 15.6% compared to clean
image. Random blur (RB-DR) can slightly improve DR’s attack performance. The
attack performance of $\text{S}^{2}$I-FGSM is similar to RB-DR, but the
performance of $\text{S}^{2}$I-SI-TI-DIM is significantly better compared to
$\text{S}^{2}$I-FGSM. The reason is that $\text{S}^{2}$I-FGSM, TI-FGSM, SI-
FGSM and DIM are designed to improve transfer ability, so their combined
method $\text{S}^{2}$I-SI-TI-DIM has stronger transfer ability than any single
component, making it perform well in cross-task scenarios. Compared to
existing attack methods, our CTA achieves the lowest mAP and mAR in all cases.
As shown in Figure 4, CTA has the lowest mAP in 14 out of 20 categories. Our
experiments demonstrate CTA’s effectiveness in object detection scenarios.

####  IV-B3 Semantic segmentation task results.

In semantic segmentation, we choose DeepLabv3 [41] and FCN [42] pretrained on
PASCAL VOC 2012 as the attack target models. Table I shows the GCR and mIoU of
our proposed CTA attack method and the compared attack methods on PASCAL VOC
2012 validation set. Figure 5 show the mIoU of 21 categories of deeplabv3 on
different adversarial samples. As shown in Table I, DR can reduce the GCR and
mIoU by an average of 4.62% and 15.25% compared to clean image. Random blur
(RB-DR) can slightly improve DR’s attack performance. $\text{S}^{2}$I-FGSM and
$\text{S}^{2}$I-SI-TI-DIM exhibit greater attack performance than DR and RB-DR
due to their strong transfer ability. Compared to existing attack methods, our
CTA achieves the lowest GCR and mIoU in all cases. As shown in Figure 5, CTA
has the lowest mIoU in 15 out of 21 categories. Our experiments demonstrate
CTA’s effectiveness in semantic segmentation scenarios.

###  IV-C Attack Adversarially Trained Defense Models

A deep learning model trained on adversarial examples can weaken the
effectiveness of adversarial attacks. To further demonstrate the effectiveness
of our adversarial attack method, we conducted experiments on attacking
defense models in classification, detection, and segmentation tasks. Referring
to the work [43], we conduct ensemble adversarial training on IncResv2,
Faster-RCNN and FCN to obtained dense models adv-incResv2, adv-Faster-RCNN and
adv-FCN for different tasks. As shown in Table II, it can be seen that DR and
RB-DR have lost their ability to attack defense models for classification and
segmentation tasks under the condition of $\epsilon$=10. Compared with
existing attack methods, our proposed CTA method is still the best in object
detection and semantic segmentation scenarios, and is also very close to
$\text{S}^{2}$I-FGSM and $\text{S}^{2}$I-SI-TI-DIM in classification tasks.

###  IV-D Attention Visualization

We visualized the Grad-CAM heatmap of the adversarial samples corresponding to
each epoch of the training iteration. As shown in Figure 6, as the number of
training iterations increases, the attention of non-important regions (i. e.,
backgrounds) that should be ignored becomes high, while the attention of
important regions (i. e., cow) that should be paid attention to becomes low.
This experiment intuitively demonstrates the attention movement process of
adversarial samples using our CTA.

##  V Conclusion

In this paper, we propose a novel cross-task adversarial attack method CTA,
which can generate adversarial examples that can fool multiple visual tasks
simultaneously. Unlike existing attack methods, CTA can directionally guide
the attention shift of adversarial samples. CTA utilizes Grad-CAM to extract
common attention regions from different visual task models, and uses a
generator to generate adversarial samples that can shift attention to areas
overlooked by all visual tasks, thereby achieving cross-task attacks. CTA does
not rely on any specific task loss function or ground true label, making it a
general and flexible method for cross-task attack. Our extensive experiments
have shown that our method outperforms the comparative methods in object
detection and semantic segmentation tasks. In image classification task, our
method outperforms existing cross-task attack methods and approaches the
single-task attack methods designed for classification task. We also visualize
the Grad-CAM attention heatmaps of our method CTA, and intuitively
demonstrates the attention movement process of adversarial samples with
increasing training iterations.

## Acknowledgments

Supported in part by the National Natural Science Foundation of China under
Grant 62276222.

## References

  * [1] I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” _arXiv preprint arXiv:1412.6572_ , 2014.
  * [2] A. Kurakin, I. Goodfellow, and S. Bengio, “Adversarial machine learning at scale,” _arXiv preprint arXiv:1611.01236_ , 2016.
  * [3] S.-M. M. Dezfooli, A. Fawzi, and P. Frossard, “Deepfool: a simple and accurate method to fool deep neural networks,” in _Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR)_. IEEE, 2016, pp. 2574–2582.
  * [4] Y. Gong, L. Huang, and L. Chen, “Eliminate deviation with deviation for data augmentation and a general multi-modal data learning method,” _arXiv preprint arXiv:2101.08533_ , 2021.
  * [5] Y. Gong, H. Liqing, and L. Chen, “Person re-identification method based on color attack and joint defence,” in _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) Workshops_. IEEE, June 2022, pp. 4313–4322.
  * [6] Y. Gong, Z. Zhong, Z. Luo, Y. Qu, R. Ji, and M. Jiang, “Cross-modality perturbation synergy attack for person re-identification,” _arXiv preprint arXiv:2401.10090_ , 2024.
  * [7] Y. Gong, J. Li, L. Chen, and M. Jiang, “Exploring color invariance through image-level ensemble learning,” _arXiv preprint arXiv:2401.10512_ , 2024.
  * [8] M. Jiang, W. Huang, Z. Huang, and G. G. Yen, “Integration of global and local metrics for domain adaptation learning via dimensionality reduction,” _IEEE Transactions on Cybernetics_ , vol. 47, no. 1, pp. 38–51, 2015.
  * [9] M. Jiang, Z. Wang, S. Guo, X. Gao, and K. C. Tan, “Individual-based transfer learning for dynamic multiobjective optimization,” _IEEE Transactions on Cybernetics_ , vol. 51, no. 10, pp. 4968–4981, 2020.
  * [10] M. Jiang, Z. Wang, H. Hong, and G. G. Yen, “Knee point-based imbalanced transfer learning for dynamic multiobjective optimization,” _IEEE Transactions on Evolutionary Computation_ , vol. 25, no. 1, pp. 117–129, 2020.
  * [11] Z. Wang, L. Cao, L. Feng, M. Jiang, and K. C. Tan, “Evolutionary multitask optimization with lower confidence bound-based solution selection strategy,” _IEEE Transactions on Evolutionary Computation_ , 2024.
  * [12] M. Jiang, Z. Huang, L. Qiu, W. Huang, and G. G. Yen, “Transfer learning-based dynamic multiobjective optimization algorithms,” _IEEE Transactions on Evolutionary Computation_ , vol. 22, no. 4, pp. 501–514, 2017.
  * [13] S.-M. Moosavi-Dezfooli, A. Fawzi, O. Fawzi, and P. Frossard, “Universal adversarial perturbations,” in _Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR)_. IEEE, 2017.
  * [14] K. R. Mopuri, U. Garg, and R. V. Babu, “Fast feature fool: A data independent approach to universal adversarial perturbations,” in _Proceedings of the British Machine Vision Conference (BMVC)_ , 2017.
  * [15] K. R. Mopuri, P. K. Uppala, and R. V. Babu, “Ask, acquire, and attack: Data-free uap generation using class impressions,” in _Proceedings of the European Conference on Computer Vision (ECCV)_. Springer, 2018.
  * [16] C. Zhang, P. Benz, A. Karjauv, and I. S. Kweon, “Data-free universal adversarial perturbation and black-box attack,” in _Proceedings of the IEEE International Conference on Computer Vision (ICCV)_. IEEE, October 2021, pp. 7868–7877.
  * [17] Z. Peng, S. Li, G. Chen, C. Zhang, H. Zhu, and M. Xue, “Fingerprinting deep neural networks globally via universal adversarial perturbations,” in _Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR)_. IEEE, June 2022, pp. 7868–7877.
  * [18] C. Xie, Z. Zhang, Y. Zhou, S. Bai, J. Wang, Z. Ren, and A. Yuille, “Improving transferability of adversarial examples with input diversity,” _arXiv preprint arXiv:1803.06978_ , 2018.
  * [19] Y. Dong, T. Pang, H. Su, and J. Zhu, “Evading defenses to transferable adversarial examples by translation-invariant attacks,” _arXiv preprint arXiv:1904.02884_ , 2019.
  * [20] G. Wang, H. Yan, Y. Guo, and X. Wei, “Improving adversarial transferability with gradient refining,” _arXiv preprint arXiv:2105.04834_ , 2021.
  * [21] X. Wang and K. He, “Enhancing the transferability of adversarial attacks through variance tuning,” in _Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR)_. IEEE, 2021.
  * [22] M. L. T. C. Y. L. Q. Z. Yaoyuan Zhang, Yu-an Tan, “Boosting cross-task adversarial attack with random blur,” _International Journal of Intelligent Systems_ , vol. 37, no. 10, pp. 8139–8154, 2021.
  * [23] Y. Long, Q. Zhang, B. Zeng, L. Gao, X. Liu, J. Zhang, and J. Song, “Frequency domain model augmentation for adversarial attack,” in _Proceedings of the European Conference on Computer Vision (ECCV)_. Springer, 2022.
  * [24] I. Kim, H. Lee, J. Lee, E. Lee, and D. Kim, “Multi-task learning with future states for vision-based autonomous driving,” in _Proceedings of the Asian Conference on Computer Vision (ACCV)_. Springer, 2020.
  * [25] D.-G. Lee, “Fast drivable areas estimation with multi-task learning for real-time autonomous driving assistant,” _Applied Sciences_ , vol. 11, no. 22, p. 10713, 2021.
  * [26] D. Feng, Y. Zhou, C. Xu, M. Tomizuka, and W. Zhan, “A simple and efficient multi-task network for 3d object detection and road understanding,” in _Proceedings of the IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS)_. IEEE, 2021.
  * [27] J. W. B. L. W. C. L. C. S. V. Yantao Lu, Yunhan Jia, “Enhancing cross-task black-box transferability of adversarial examples with dispersion reduction,” in _Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR)_. IEEE, 2020.
  * [28] Z. Y. S. L. S. T. X. L. Jiakai Wang, Aishan Liu, “Dual attention suppression attack: Generate adversarial camouflage in physical world,” in _Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR)_. IEEE, 2021, pp. 8565–8574.
  * [29] T. Chakraborty, U. Trehan, K. Mallat, and J.-L. Dugelay, “Generalizing adversarial explanations with grad-cam,” in _Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition Workshops (CVPRW)_. IEEE, 2022.
  * [30] A. Fawzi, O. Fawzi, and P. Frossard, “Analysis of classifiers’ robustness to adversarial perturbations,” _arXiv preprint arXiv:1502.02590_ , 2015.
  * [31] A. Fawzi, S.-M. M. Dezfooli, and P. Frossard, “Robustness of classifiers: from adversarial to random noise,” in _Advances in Neural Information Processing Systems_ , 2016, pp. 1632–1640.
  * [32] J. Su, D. V. Vargas, and K. Sakurai, “One pixel attack for fooling deep neural networks,” _IEEE Transactions on Evolutionary Computation_ , vol. 23, no. 5, pp. 828–841, 2019.
  * [33] J. Lin, C. Song, L. W. Kun He and, and J. E. Hopcroft, “Nesterov accelerated gradient and scale invariance for adversarial attacks,” _arXiv preprint arXiv:1908.06281_ , 2019.
  * [34] R. R. Selvaraju, M. Cogswell, A. Das, R. Vedantam, D. Parikh, and D. Batra, “Grad-cam: Visual explanations from deep networks via gradient-based localization,” in _Proceedings of the IEEE International Conference on Computer Vision (ICCV)_. IEEE, Oct 2017.
  * [35] K. Simonyan and A. Zisserman, “Very deep convolutional networks for large-scale image recognition,” _arXiv preprint arXiv:1409.1556_ , 2014.
  * [36] Y. Dong, F. Liao, T. Pang, H. Su, J. Zhu, X. Hu, and J. Li, “Boosting adversarial attacks with momentum,” in _Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR)_. IEEE, 2018.
  * [37] J. Justin, A. Alexandre, and F. Li, “Perceptual losses for real-time style transfer and super-resolution,” in _Proceedings of the European Conference on Computer Vision (ECCV)_. Springer, 2016, pp. 694–711.
  * [38] C. Szegedy, S. Ioffe, V. Vanhoucke, and A. Alemi, “Inception-v4, inception-resnet and the impact of residual connections on learning,” in _Proceedings of the Association for the Advancement of Artificial Intelligence (AAAI)_ , vol. 31, no. 1, 2017.
  * [39] J. Redmon and A. Farhadi, “Yolov3: An incremental improvement,” _arXiv preprint arXiv:1804.02767_ , 2018.
  * [40] S. Ren, K. He, R. Girshick, and J. Sun, “Faster r-cnn: Towards real-time object detection with region proposal networks,” in _Advances in Neural Information Processing Systems_ , vol. 28, 2015.
  * [41] L.-C. Chen, Y. Zhu, G. Papandreou, F. Schroff, and H. Adam, “Encoder-decoder with atrous separable convolution for semantic image segmentation,” in _Proceedings of the European Conference on Computer Vision (ECCV)_ , 2018, pp. 801–818.
  * [42] J. Long, E. Shelhamer, and T. Darrell, “Fully convolutional networks for semantic segmentation,” in _Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR)_ , 2015, pp. 3431–3440.
  * [43] F. Tramern, A. Kurakin, N. Papernot, I. Goodfellow, D. Boneh, and P. McDaniel, “Ensemble adversarial training: Attacks and defenses,” in _Proceedings of the International Conference on Learning Representations (ICLR)_ , 2018.


k}_{1})(\mu_{2}^{2}k_{2}^{2}+\mu_{3}^{2}k_{3}^{2})$ (D.11)
$\displaystyle+{\color[rgb]{.75,0,.25}S_{6}}Z_{1}({\bf
k}_{1})\mu_{1}^{2}(\mu_{2}^{2}k_{2}^{2}+\mu_{3}^{2}k_{3}^{2})+{\color[rgb]{.75,0,.25}S_{7}}Z_{1}({\bf
k}_{1})\frac{k_{1z}}{k_{1}^{2}}(k_{2z}^{3}+k_{3z}^{3})\Bigg{]}\frac{P_{L}(k_{1})}{k_{\rm
NL}^{2}\bar{n}}+\text{cyc.}\,,$

which involves additional nuisance coefficients shown in color.

In addition, there are purely stochastic terms that generate the bispectrum of
the order $k^{2}\bar{n}^{-2}$. These arise from the following combinations:

$\begin{split}&\langle\epsilon_{{\bf k}_{1}}\epsilon_{{\bf
k}_{2}}k_{3z}^{2}\epsilon_{{\bf
k}_{3}}\rangle^{\prime}=\frac{k_{3z}^{2}+\text{cyc.}}{\bar{n}^{2}}\,,\end{split}$
(D.12)

giving the bispectrum contribution

$\begin{split}&B^{(k^{2}\bar{n}^{-2})}_{\rm stoch}({\bf k}_{1},{\bf
k}_{2},{\bf
k}_{3})={\color[rgb]{.75,0,.25}A_{\text{shot},2}}\frac{k_{3z}^{2}+k_{1z}^{2}+k_{2z}^{2}}{\bar{n}^{2}}\,.\end{split}$
(D.13)

After performing angular integration (in the absence of coordinate-distortion
effects), this term takes the same form as the real-space term $\sim
k^{2}\bar{n}^{-2}$. Thus, it does not produce a new contribution to the
bispectrum monopole, though is important if higher-order multipoles are also
considered.

##  Appendix E Prior volume effects

In this section we study the prior volume effects present in our posteriors
when the one-loop bispectrum likelihood is analyzed with small data cuts, such
as $k_{\rm max}^{B}=0.12h\,\mathrm{Mpc}^{-1}$. At face value, the posterior
distributions from this analysis are several $\sigma$ away from the true
values. However, here we show that as much as half of this shift can be
explained by prior volume (marginalization projection) effects. Indeed, such
effects are expected to be present when the data volume is not sufficient to
tightly constrain model parameters, which is the case for analyses with low
$k_{\rm max}^{B}$.

We performed the following test: rerunning our full analysis on the mock data
generated by our fitting pipeline for the best-fit cosmology at $k_{\rm
max}^{B}=0.15~{}h\,\mathrm{Mpc}^{-1}$. This mock data is simply a theory curve
without any statistical scatter. In the absence of prior volume effects our
pipeline must exactly recover the input parameters. However, when we fit this
mock bispectrum data at $k_{\rm max}^{B}=0.12~{}h\,\mathrm{Mpc}^{-1}$, we find
that the mean values recovered from our pipeline are shifted relative to the
input values at the $(1-1.5)\sigma$ level, as shown in Fig. 5. This is
evidence of prior volume effects. Furthermore, the shifts are in the
directions of the apparent biases observed in the actual data (§6). Thus, if
we subtract these shifts from the actual posteriors at $k_{\rm max}^{B}=0.12$,
the mean posterior values would match the true input parameter values at least
within the $99\%$ CL. Finally, we note that the parameters
$b_{2},b_{\mathcal{G}_{2}}$ and $b_{\Gamma_{3}}$ are highly correlated; this
means that a shift in one would induce a shift in both.

As an additional check, we repeat our mock analysis for $k_{\rm
max}^{B}=0.15h\,\mathrm{Mpc}^{-1}$. Overall, we find much improved agreement
between the mock and actual analyses. The posteriors for $\sigma_{8}$ and
$b_{\Gamma_{3}}$ are still shifted with respect to the ground truth by
$\lesssim 1\sigma$ (which is smaller than $1.5\sigma$ shifts in the $k_{\rm
max}^{B}=0.12h\,\mathrm{Mpc}^{-1}$ case), but all other parameters are
recovered without noticeable bias.

Figure 5:  Posterior distributions of the clustering amplitude and low-order
nuisance parameters from MCMC analyses of the power spectrum and bispectrum
likelihoods from the redshift-space analysis at $k_{\rm
max}^{B}=0.12h\,\mathrm{Mpc}^{-1}$ for the PT Challenge simulation data (in
green) and for the mock bispectrum data vector (in gray) computed with our
pipeline for the bestfit cosmology at $k_{\rm
max}^{B}=0.15h\,\mathrm{Mpc}^{-1}$. Dashed lines show the input values for the
mock data-vector, whose discrepancies with the grey posteriors indicate clear
evidence for prior volume effects. Figure 6: As Fig. 5, but for $k_{\rm
max}^{B}=0.15h\,\mathrm{Mpc}^{-1}$.

## References

  * [1] BOSS collaboration, J. N. Grieb et al., _The clustering of galaxies in the completed SDSS-III Baryon Oscillation Spectroscopic Survey: Cosmological implications of the Fourier space wedges of the final sample_ , _Mon. Not. Roy. Astron. Soc._ 467 (2017) 2085 [1607.03143].
  * [2] BOSS collaboration, S. Alam et al., _The clustering of galaxies in the completed SDSS-III Baryon Oscillation Spectroscopic Survey: cosmological analysis of the DR12 galaxy sample_ , _Mon. Not. Roy. Astron. Soc._ 470 (2017) 2617 [1607.03155].
  * [3] BOSS collaboration, S. Satpathy et al., _The clustering of galaxies in the completed SDSS-III Baryon Oscillation Spectroscopic Survey: On the measurement of growth rate using galaxy correlation functions_ , _Mon. Not. Roy. Astron. Soc._ 469 (2017) 1369 [1607.03148].
  * [4] BOSS collaboration, F. Beutler et al., _The clustering of galaxies in the completed SDSS-III Baryon Oscillation Spectroscopic Survey: baryon acoustic oscillations in the Fourier space_ , _Mon. Not. Roy. Astron. Soc._ 464 (2017) 3409 [1607.03149].
  * [5] BOSS collaboration, F. Beutler et al., _The clustering of galaxies in the completed SDSS-III Baryon Oscillation Spectroscopic Survey: Anisotropic galaxy clustering in Fourier-space_ , _Mon. Not. Roy. Astron. Soc._ 466 (2017) 2242 [1607.03150].
  * [6] A. de Mattia et al., _The Completed SDSS-IV extended Baryon Oscillation Spectroscopic Survey: measurement of the BAO and growth rate of structure of the emission line galaxy sample from the anisotropic power spectrum between redshift 0.6 and 1.1_ , _Mon. Not. Roy. Astron. Soc._ 501 (2021) 5616 [2007.09008].
  * [7] BOSS collaboration, S. Alam et al., _The clustering of galaxies in the completed SDSS-III Baryon Oscillation Spectroscopic Survey: cosmological analysis of the DR12 galaxy sample_ , _Mon. Not. Roy. Astron. Soc._ 470 (2017) 2617 [1607.03155].
  * [8] eBOSS collaboration, S. Alam et al., _Completed SDSS-IV extended Baryon Oscillation Spectroscopic Survey: Cosmological implications from two decades of spectroscopic surveys at the Apache Point Observatory_ , _Phys. Rev. D_ 103 (2021) 083533 [2007.08991].
  * [9] W. J. Percival et al., _The shape of the SDSS DR5 galaxy power spectrum_ , _Astrophys. J._ 657 (2007) 645 [astro-ph/0608636].
  * [10] M. M. Ivanov, M. Simonović and M. Zaldarriaga, _Cosmological Parameters from the BOSS Galaxy Power Spectrum_ , _JCAP_ 05 (2020) 042 [1909.05277].
  * [11] M. M. Ivanov, M. Simonović and M. Zaldarriaga, _Cosmological Parameters and Neutrino Masses from the Final Planck and Full-Shape BOSS Data_ , _Phys. Rev. D_ 101 (2020) 083504 [1912.08208].
  * [12] M. M. Ivanov, _Cosmological constraints from the power spectrum of eBOSS emission line galaxies_ , 2106.12580.
  * [13] M. M. Ivanov, E. McDonough, J. C. Hill, M. Simonović, M. W. Toomey, S. Alexander et al., _Constraining Early Dark Energy with Large-Scale Structure_ , _Phys. Rev. D_ 102 (2020) 103502 [2006.11235].
  * [14] O. H. E. Philcox, M. M. Ivanov, M. Simonović and M. Zaldarriaga, _Combining Full-Shape and BAO Analyses of Galaxy Power Spectra: A 1.6\% CMB-independent constraint on H 0_, _JCAP_ 05 (2020) 032 [2002.04035].
  * [15] O. H. E. Philcox and M. M. Ivanov, _BOSS DR12 full-shape cosmology: $\Lambda$CDM constraints from the large-scale galaxy power spectrum and bispectrum monopole_, _Phys. Rev. D_ 105 (2022) 043517 [2112.04515].
  * [16] A. Chudaykin, K. Dolgikh and M. M. Ivanov, _Constraints on the curvature of the Universe and dynamical dark energy from the Full-shape and BAO data_ , _Phys. Rev. D_ 103 (2021) 023507 [2009.10106].
  * [17] O. H. E. Philcox, B. D. Sherwin, G. S. Farren and E. J. Baxter, _Determining the Hubble Constant without the Sound Horizon: Measurements from Galaxy Surveys_ , _Phys. Rev. D_ 103 (2021) 023538 [2008.08084].
  * [18] O. H. E. Philcox, G. S. Farren, B. D. Sherwin, E. J. Baxter and D. J. Brout, _Determining the Hubble Constant without the Sound Horizon: A $3.6\%$ Constraint on $H_{0}$ from Galaxy Surveys, CMB Lensing and Supernovae_, 2204.02984.
  * [19] G. D’Amico, J. Gleyzes, N. Kokron, D. Markovic, L. Senatore, P. Zhang et al., _The Cosmological Analysis of the SDSS/BOSS data from the Effective Field Theory of Large-Scale Structure_ , 1909.05271.
  * [20] G. D’Amico, Y. Donath, L. Senatore and P. Zhang, _Limits on Clustering and Smooth Quintessence from the EFTofLSS_ , 2012.07554.
  * [21] G. D’Amico, L. Senatore, P. Zhang and H. Zheng, _The Hubble Tension in Light of the Full-Shape Analysis of Large-Scale Structure Data_ , 2006.12420.
  * [22] G. D’Amico, L. Senatore and P. Zhang, _Limits on $w$CDM from the EFTofLSS with the PyBird code_, _JCAP_ 01 (2021) 006 [2003.07956].
  * [23] T. Colas, G. D’amico, L. Senatore, P. Zhang and F. Beutler, _Efficient Cosmological Analysis of the SDSS/BOSS data from the Effective Field Theory of Large-Scale Structure_ , _JCAP_ 06 (2020) 001 [1909.07951].
  * [24] D. Wadekar, M. M. Ivanov and R. Scoccimarro, _Cosmological constraints from BOSS with analytic covariance matrices_ , _Phys. Rev. D_ 102 (2020) 123521 [2009.00622].
  * [25] Y. Kobayashi, T. Nishimichi, M. Takada and H. Miyatake, _Full-shape cosmology analysis of the SDSS-III BOSS galaxy power spectrum using an emulator-based halo model: A 5% determination of $\sigma$8_, _Phys. Rev. D_ 105 (2022) 083517 [2110.06969].
  * [26] S.-F. Chen, Z. Vlah and M. White, _A new analysis of galaxy 2-point functions in the BOSS survey, including full-shape information and post-reconstruction BAO_ , _JCAP_ 02 (2022) 008 [2110.05530].
  * [27] S.-F. Chen, M. White, J. DeRose and N. Kokron, _Cosmological Analysis of Three-Dimensional BOSS Galaxy Clustering and Planck CMB Lensing Cross Correlations via Lagrangian Perturbation Theory_ , 2204.10392.
  * [28] P. J. E. Peebles, _The large-scale structure of the universe_. 1980.
  * [29] P. J. E. Peebles and E. J. Groth, _Statistical analysis of catalogs of extragalactic objects. V. Three-point correlation function for the galaxy distribution in the Zwicky catalog._ , _Astrophys. J._ 196 (1975) 1.
  * [30] E. J. Groth and P. J. E. Peebles, _Statistical analysis of catalogs of extragalactic objects. VII. Two- and three-point correlation functions for the high-resolution Shane-Wirtanen catalog of galaxies._ , _Astrophys. J._ 217 (1977) 385.
  * [31] H. A. Feldman, J. A. Frieman, J. N. Fry and R. Scoccimarro, _Constraints on galaxy bias, matter density, and primordial non-gausianity from the PSCz galaxy redshift survey_ , _Phys. Rev. Lett._ 86 (2001) 1434 [astro-ph/0010205].
  * [32] WiggleZ collaboration, F. A. Marin et al., _The WiggleZ Dark Energy Survey: constraining galaxy bias and cosmic growth with 3-point correlation functions_ , _Mon. Not. Roy. Astron. Soc._ 432 (2013) 2654 [1303.6644].
  * [33] R. Scoccimarro, H. A. Feldman, J. N. Fry and J. A. Frieman, _The Bispectrum of IRAS redshift catalogs_ , _Astrophys. J._ 546 (2001) 652 [astro-ph/0004087].
  * [34] R. Scoccimarro, S. Colombi, J. N. Fry, J. A. Frieman, E. Hivon and A. Melott, _Nonlinear evolution of the bispectrum of cosmological perturbations_ , _Astrophys. J._ 496 (1998) 586 [astro-ph/9704075].
  * [35] E. Sefusatti, M. Crocce, S. Pueblas and R. Scoccimarro, _Cosmology and the Bispectrum_ , _Phys. Rev._ D74 (2006) 023522 [astro-ph/0604505].
  * [36] R. Scoccimarro, _The bispectrum: from theory to observations_ , _Astrophys. J._ 544 (2000) 597 [astro-ph/0004086].
  * [37] R. Scoccimarro, H. M. P. Couchman and J. A. Frieman, _The Bispectrum as a Signature of Gravitational Instability in Redshift-Space_ , _Astrophys. J._ 517 (1999) 531 [astro-ph/9808305].
  * [38] H. Gil-Marín, L. Verde, J. Noreña, A. J. Cuesta, L. Samushia, W. J. Percival et al., _The power spectrum and bispectrum of SDSS DR11 BOSS galaxies – II. Cosmological interpretation_ , _Mon. Not. Roy. Astron. Soc._ 452 (2015) 1914 [1408.0027].
  * [39] H. Gil-Marín, J. Noreña, L. Verde, W. J. Percival, C. Wagner, M. Manera et al., _The power spectrum and bispectrum of SDSS DR11 BOSS galaxies – I. Bias and gravity_ , _Mon. Not. Roy. Astron. Soc._ 451 (2015) 539 [1407.5668].
  * [40] H. Gil-Marín, W. J. Percival, L. Verde, J. R. Brownstein, C.-H. Chuang, F.-S. Kitaura et al., _The clustering of galaxies in the SDSS-III Baryon Oscillation Spectroscopic Survey: RSD measurement from the power spectrum and bispectrum of the DR12 BOSS galaxies_ , _Mon. Not. Roy. Astron. Soc._ 465 (2017) 1757 [1606.00439].
  * [41] R. Scoccimarro, _Fast Estimators for Redshift-Space Clustering_ , _Phys. Rev. D_ 92 (2015) 083532 [1506.02729].
  * [42] O. H. E. Philcox and D. J. Eisenstein, _Computing the Small-Scale Galaxy Power Spectrum and Bispectrum in Configuration-Space_ , _Mon. Not. Roy. Astron. Soc._ 492 (2020) 1214 [1912.01010].
  * [43] O. H. E. Philcox, _A faster Fourier transform? Computing small-scale power spectra and bispectra for cosmological simulations in $\mathcal{O}(N^{2})$ time_, _Mon. Not. Roy. Astron. Soc._ 501 (2021) 4004 [2005.01739].
  * [44] T. Baldauf, M. Mirbabayi, M. Simonović and M. Zaldarriaga, _LSS constraints with controlled theoretical uncertainties_ , 1602.00674.
  * [45] C. Hahn, F. Villaescusa-Navarro, E. Castorina and R. Scoccimarro, _Constraining $M_{\nu}$ with the bispectrum. Part I. Breaking parameter degeneracies_, _JCAP_ 03 (2020) 040 [1909.11107].
  * [46] Y. Welling, D. van der Woude and E. Pajer, _Lifting Primordial Non-Gaussianity Above the Noise_ , _JCAP_ 08 (2016) 044 [1605.06426].
  * [47] A. Moradinezhad Dizgah, H. Lee, J. B. Muñoz and C. Dvorkin, _Galaxy Bispectrum from Massive Spinning Particles_ , _JCAP_ 05 (2018) 013 [1801.07265].
  * [48] C. Hahn and F. Villaescusa-Navarro, _Constraining $M_{\nu}$ with the bispectrum. Part II. The information content of the galaxy bispectrum monopole_, _JCAP_ 04 (2021) 029 [2012.02200].
  * [49] A. Moradinezhad Dizgah, M. Biagetti, E. Sefusatti, V. Desjacques and J. Noreña, _Primordial Non-Gaussianity from Biased Tracers: Likelihood Analysis of Real-Space Power Spectrum and Bispectrum_ , _JCAP_ 05 (2021) 015 [2010.14523].
  * [50] R. Ruggeri, E. Castorina, C. Carbone and E. Sefusatti, _DEMNUni: Massive neutrinos and the bispectrum of large scale structures_ , _JCAP_ 1803 (2018) 003 [1712.02334].
  * [51] Y.-S. Song, A. Taruya and A. Oka, _Cosmology with anisotropic galaxy clustering from the combination of power spectrum and bispectrum_ , _JCAP_ 1508 (2015) 007 [1502.03099].
  * [52] D. Karagiannis, A. Lazanu, M. Liguori, A. Raccanelli, N. Bartolo and L. Verde, _Constraining primordial non-Gaussianity with bispectrum and power spectrum from upcoming optical and radio surveys_ , _Mon. Not. Roy. Astron. Soc._ 478 (2018) 1341 [1801.09280].
  * [53] M. Peloso and M. Pietroni, _Galilean invariance and the consistency relation for the nonlinear squeezed bispectrum of large scale structure_ , _JCAP_ 05 (2013) 031 [1302.0223].
  * [54] A. Kehagias and A. Riotto, _Symmetries and Consistency Relations in the Large Scale Structure of the Universe_ , _Nucl. Phys. B_ 873 (2013) 514 [1302.0130].
  * [55] P. Valageas, _Kinematic consistency relations of large-scale structures_ , _Phys. Rev. D_ 89 (2014) 083534 [1311.1236].
  * [56] P. Creminelli, J. Noreña, M. Simonović and F. Vernizzi, _Single-Field Consistency Relations of Large Scale Structure_ , _JCAP_ 12 (2013) 025 [1309.3557].
  * [57] P. Creminelli, J. Gleyzes, M. Simonović and F. Vernizzi, _Single-Field Consistency Relations of Large Scale Structure. Part II: Resummation and Redshift Space_ , _JCAP_ 02 (2014) 051 [1311.0290].
  * [58] P. Creminelli, J. Gleyzes, L. Hui, M. Simonović and F. Vernizzi, _Single-Field Consistency Relations of Large Scale Structure. Part III: Test of the Equivalence Principle_ , _JCAP_ 06 (2014) 009 [1312.6074].
  * [59] M. Lewandowski, _Violation of the consistency relations for large-scale structure with dark energy_ , _JCAP_ 08 (2020) 044 [1912.12292].
  * [60] V. Yankelevich and C. Porciani, _Cosmological information in the redshift-space bispectrum_ , _Mon. Not. Roy. Astron. Soc._ 483 (2019) 2078 [1807.07076].
  * [61] M. Crisostomi, M. Lewandowski and F. Vernizzi, _Consistency relations for large-scale structure in modified gravity and the matter bispectrum_ , _Phys. Rev. D_ 101 (2020) 123501 [1909.07366].
  * [62] A. Oddo, E. Sefusatti, C. Porciani, P. Monaco and A. G. Sánchez, _Toward a robust inference method for the galaxy bispectrum: likelihood function and model selection_ , _JCAP_ 03 (2020) 056 [1908.01774].
  * [63] A. Oddo, F. Rizzo, E. Sefusatti, C. Porciani and P. Monaco, _Cosmological parameters from the likelihood analysis of the galaxy power spectrum and bispectrum in real space_ , 2108.03204.
  * [64] A. Chudaykin and M. M. Ivanov, _Measuring neutrino masses with large-scale structure: Euclid forecast with controlled theoretical error_ , _JCAP_ 11 (2019) 034 [1907.06666].
  * [65] F. Rizzo, C. Moretti, K. Pardede, A. Eggemeier, A. Oddo, E. Sefusatti et al., _The Halo Bispectrum Multipoles in Redshift Space_ , 2204.13628.
  * [66] T. Baldauf, L. Mercolli, M. Mirbabayi and E. Pajer, _The Bispectrum in the Effective Field Theory of Large Scale Structure_ , _JCAP_ 1505 (2015) 007 [1406.4135].
  * [67] R. E. Angulo, S. Foreman, M. Schmittfull and L. Senatore, _The One-Loop Matter Bispectrum in the Effective Field Theory of Large Scale Structures_ , _JCAP_ 1510 (2015) 039 [1406.4143].
  * [68] A. Lazanu and M. Liguori, _The two and three-loop matter bispectrum in perturbation theories_ , _JCAP_ 1804 (2018) 055 [1803.03184].
  * [69] D. Alkhanishvili, C. Porciani, E. Sefusatti, M. Biagetti, A. Lazanu, A. Oddo et al., _The reach of next-to-leading-order perturbation theory for the matter bispectrum_ , 2107.08054.
  * [70] E. Sefusatti, M. Crocce and V. Desjacques, _The matter bispectrum in N-body simulations with non-Gaussian initial conditions_ , _MNRAS_ 406 (2010) 1014 [1003.0007].
  * [71] P. Valageas and T. Nishimichi, _Combining perturbation theories with halo models for the matter bispectrum_ , _Astronomy & Astrophysics_ 532 (2011) A4 [1102.0641].
  * [72] R. Takahashi, T. Nishimichi, T. Namikawa, A. Taruya, I. Kayo, K. Osato et al., _Fitting the Nonlinear Matter Bispectrum by the Halofit Approach_ , _The Astrophysical Journal_ 895 (2020) 113 [1911.07886].
  * [73] R. de Belsunce and L. Senatore, _Tree-Level Bispectrum in the Effective Field Theory of Large-Scale Structure extended to Massive Neutrinos_ , _JCAP_ 1902 (2019) 038 [1804.06849].
  * [74] E. Di Dio, R. Durrer, R. Maartens, F. Montanari and O. Umeh, _The Full-Sky Angular Bispectrum in Redshift Space_ , _JCAP_ 1904 (2019) 053 [1812.09297].
  * [75] H. Gil-Marín, C. Wagner, J. Noreña, L. Verde and W. Percival, _Dark matter and halo bispectrum in redshift space: theory and applications_ , _JCAP_ 1412 (2014) 029 [1407.1836].
  * [76] V. Desjacques, D. Jeong and F. Schmidt, _The Galaxy Power Spectrum and Bispectrum in Redshift Space_ , _JCAP_ 1812 (2018) 035 [1806.04015].
  * [77] R. E. Smith, R. K. Sheth and R. Scoccimarro, _An analytic model for the bispectrum of galaxies in redshift space_ , _Phys. Rev. D_ 78 (2008) 023523 [0712.0017].
  * [78] E. O. Nadler, A. Perko and L. Senatore, _On the Bispectra of Very Massive Tracers in the Effective Field Theory of Large-Scale Structure_ , _JCAP_ 02 (2018) 058 [1710.10308].
  * [79] A. Eggemeier, R. Scoccimarro and R. E. Smith, _Bias Loop Corrections to the Galaxy Bispectrum_ , 1812.03208.
  * [80] M. M. Ivanov, O. H. E. Philcox, T. Nishimichi, M. Simonović, M. Takada and M. Zaldarriaga, _Precision analysis of the redshift-space galaxy bispectrum_ , _Phys. Rev. D_ 105 (2022) 063512 [2110.10161].
  * [81] A. Eggemeier, R. Scoccimarro, R. E. Smith, M. Crocce, A. Pezzotta and A. G. Sánchez, _Testing one-loop galaxy bias: joint analysis of power spectrum and bispectrum_ , 2102.06902.
  * [82] J. J. M. Carrasco, M. P. Hertzberg and L. Senatore, _The Effective Field Theory of Cosmological Large Scale Structures_ , _JHEP_ 09 (2012) 082 [1206.2926].
  * [83] D. Baumann, A. Nicolis, L. Senatore and M. Zaldarriaga, _Cosmological Non-Linearities as an Effective Fluid_ , _JCAP_ 1207 (2012) 051 [1004.2488].
  * [84] G. Cabass, M. M. Ivanov, M. Lewandowski, M. Mirbabayi and M. Simonović, _Snowmass White Paper: Effective Field Theories in Cosmology_ , in _2022 Snowmass Summer Study_ , 3, 2022, 2203.08232.
  * [85] T. Steele and T. Baldauf, _Precise Calibration of the One-Loop Bispectrum in the Effective Field Theory of Large Scale Structure_ , _Phys. Rev. D_ 103 (2021) 023520 [2009.01200].
  * [86] M. M. Ivanov and S. Sibiryakov, _Infrared Resummation for Biased Tracers in Redshift Space_ , _JCAP_ 1807 (2018) 053 [1804.05080].
  * [87] D. Blas, M. Garny, M. M. Ivanov and S. Sibiryakov, _Time-Sliced Perturbation Theory II: Baryon Acoustic Oscillations and Infrared Resummation_ , _JCAP_ 1607 (2016) 028 [1605.02149].
  * [88] L. Senatore and G. Trevisan, _On the IR-Resummation in the EFTofLSS_ , _JCAP_ 1805 (2018) 019 [1710.02178].
  * [89] M. Lewandowski and L. Senatore, _An analytic implementation of the IR-resummation for the BAO peak_ , _JCAP_ 03 (2020) 018 [1810.11855].
  * [90] L. Senatore and M. Zaldarriaga, _The IR-resummed Effective Field Theory of Large Scale Structures_ , _JCAP_ 1502 (2015) 013 [1404.5954].
  * [91] A. Vasudevan, M. M. Ivanov, S. Sibiryakov and J. Lesgourgues, _Time-sliced perturbation theory with primordial non-Gaussianity and effects of large bulk flows on inflationary oscillating features_ , _JCAP_ 09 (2019) 037 [1906.08697].
  * [92] T. Baldauf, M. Mirbabayi, M. Simonović and M. Zaldarriaga, _Equivalence Principle and the Baryon Acoustic Peak_ , _Phys. Rev._ D92 (2015) 043514 [1504.04366].
  * [93] Z. Vlah, U. Seljak, M. Y. Chu and Y. Feng, _Perturbation theory, effective field theory, and oscillations in the power spectrum_ , _JCAP_ 1603 (2016) 057 [1509.02120].
  * [94] O. H. E. Philcox, _Cosmology Without Window Functions: Cubic Estimators for the Galaxy Bispectrum_ , 2107.06287.
  * [95] K. Pardede, F. Rizzo, M. Biagetti, E. Castorina, E. Sefusatti and P. Monaco, _Bispectrum-window convolution via Hankel transform_ , 2203.04174.
  * [96] G. Cabass, M. M. Ivanov, O. H. E. Philcox, M. Simonović and M. Zaldarriaga, _Constraints on Single-Field Inflation from the BOSS Galaxy Survey_ , 2201.07238.
  * [97] G. Cabass, M. M. Ivanov, O. H. E. Philcox, M. Simonović and M. Zaldarriaga, _Constraints on Multi-Field Inflation from the BOSS Galaxy Survey_ , 2204.01781.
  * [98] G. D’Amico, M. Lewandowski, L. Senatore and P. Zhang, _Limits on primordial non-Gaussianities from BOSS galaxy-clustering data_ , 2201.11518.
  * [99] M. Simonović, T. Baldauf, M. Zaldarriaga, J. J. Carrasco and J. A. Kollmeier, _Cosmological perturbation theory using the FFTLog: formalism and connection to QFT loop integrals_ , _JCAP_ 1804 (2018) 030 [1708.08130].
  * [100] T. Nishimichi, G. D’Amico, M. M. Ivanov, L. Senatore, M. Simonović, M. Takada et al., _Blinded challenge for precision cosmology with large-scale structure: results from effective field theory for the redshift-space galaxy power spectrum_ , _Phys. Rev. D_ 102 (2020) 123541 [2003.08277].
  * [101] D. Gualdi and L. Verde, _Galaxy redshift-space bispectrum: the Importance of Being Anisotropic_ , _JCAP_ 06 (2020) 041 [2003.12075].
  * [102] O. H. E. Philcox, J. Hou and Z. Slepian, _A First Detection of the Connected 4-Point Correlation Function of Galaxies Using the BOSS CMASS Sample_ , 2108.01670.
  * [103] D. Gualdi and L. Verde, _Integrated trispectrum detection from BOSS DR12 NGC CMASS_ , 2201.06932.
  * [104] F. Bernardeau, S. Colombi, E. Gaztanaga and R. Scoccimarro, _Large scale structure of the universe and cosmological perturbation theory_ , _Phys. Rept._ 367 (2002) 1 [astro-ph/0112551].
  * [105] P. McDonald and A. Roy, _Clustering of dark matter tracers: generalizing bias for the coming era of precision LSS_ , _JCAP_ 0908 (2009) 020 [0902.0991].
  * [106] V. Assassi, D. Baumann, D. Green and M. Zaldarriaga, _Renormalized Halo Bias_ , _JCAP_ 1408 (2014) 056 [1402.5916].
  * [107] R. Angulo, M. Fasiello, L. Senatore and Z. Vlah, _On the Statistics of Biased Tracers in the Effective Field Theory of Large Scale Structures_ , _JCAP_ 1509 (2015) 029 [1503.08826].
  * [108] L. Senatore, _Bias in the Effective Field Theory of Large Scale Structures_ , _JCAP_ 1511 (2015) 007 [1406.7843].
  * [109] M. Mirbabayi, F. Schmidt and M. Zaldarriaga, _Biased Tracers and Time Evolution_ , _JCAP_ 1507 (2015) 030 [1412.5169].
  * [110] V. Desjacques, D. Jeong and F. Schmidt, _Large-Scale Galaxy Bias_ , _Phys. Rept._ 733 (2018) 1 [1611.09787].
  * [111] N. Kaiser, _Clustering in real space and in redshift space_ , _Mon. Not. Roy. Astron. Soc._ 227 (1987) 1.
  * [112] A. Chudaykin, M. M. Ivanov, O. H. E. Philcox and M. Simonović, _Nonlinear perturbation theory extension of the Boltzmann code CLASS_ , _Phys. Rev. D_ 102 (2020) 063533 [2004.10607].
  * [113] A. Chudaykin, M. M. Ivanov and M. Simonović, _Optimizing large-scale structure data analysis with the theoretical error likelihood_ , _Phys. Rev. D_ 103 (2021) 043525 [2009.10724].
  * [114] C. Alcock and B. Paczynski, _An evolution free test for non-zero cosmological constant_ , _Nature_ 281 (1979) 358.
  * [115] D. Blas, M. Garny, M. M. Ivanov and S. Sibiryakov, _Time-Sliced Perturbation Theory for Large Scale Structure I: General Formalism_ , _JCAP_ 1607 (2016) 052 [1512.05807].
  * [116] M. M. Ivanov, O. H. E. Philcox, M. Simonović, M. Zaldarriaga, T. Nischimichi and M. Takada, _Cosmological constraints without nonlinear redshift-space distortions_ , _Phys. Rev. D_ 105 (2022) 043531 [2110.00006].
  * [117] O. H. E. Philcox, M. M. Ivanov, M. Zaldarriaga, M. Simonovic and M. Schmittfull, _Fewer Mocks and Less Noise: Reducing the Dimensionality of Cosmological Observables with Subspace Projections_ , _Phys. Rev. D_ 103 (2021) 043508 [2009.03311].
  * [118] J. C. Jackson, _Fingers of God: A critique of Rees’ theory of primoridal gravitational radiation_ , _Mon. Not. Roy. Astron. Soc._ 156 (1972) 1P [0810.3908].
  * [119] A. Eggemeier, R. Scoccimarro, M. Crocce, A. Pezzotta and A. G. Sánchez, _Testing one-loop galaxy bias: Power spectrum_ , _Phys. Rev. D_ 102 (2020) 103530 [2006.09729].
  * [120] B. Audren, J. Lesgourgues, S. Bird, M. G. Haehnelt and M. Viel, _Neutrino masses and cosmological parameters from a Euclid-like survey: Markov Chain Monte Carlo forecasts including theoretical errors_ , _JCAP_ 1301 (2013) 026 [1210.2194].
  * [121] T. Brinckmann and J. Lesgourgues, _MontePython 3: boosted MCMC sampler and other features_ , _Phys. Dark Univ._ 24 (2019) 100260 [1804.07261].
  * [122] V. Assassi, D. Baumann, E. Pajer, Y. Welling and D. van der Woude, _Effective theory of large-scale structure with primordial non-Gaussianity_ , _JCAP_ 11 (2015) 024 [1505.06668].
  * [123] D. Bertolini, K. Schutz, M. P. Solon and K. M. Zurek, _The Trispectrum in the Effective Field Theory of Large Scale Structure_ , _JCAP_ 06 (2016) 052 [1604.01770].
  * [124] T. Baldauf, E. Schaan and M. Zaldarriaga, _On the reach of perturbative methods for dark matter density fields_ , _JCAP_ 03 (2016) 007 [1507.02255].
  * [125] T. Lazeyras, C. Wagner, T. Baldauf and F. Schmidt, _Precision measurement of the local bias of dark matter halos_ , _JCAP_ 1602 (2016) 018 [1511.01096].
  * [126] M. Schmittfull, M. Simonović, V. Assassi and M. Zaldarriaga, _Modeling Biased Tracers at the Field Level_ , _Phys. Rev. D_ 100 (2019) 043514 [1811.10640].
  * [127] M. M. Abidi and T. Baldauf, _Cubic Halo Bias in Eulerian and Lagrangian Space_ , _JCAP_ 1807 (2018) 029 [1802.07622].
  * [128] F. Schmidt, G. Cabass, J. Jasche and G. Lavaux, _Unbiased Cosmology Inference from Biased Tracers using the EFT Likelihood_ , _JCAP_ 11 (2020) 008 [2004.06707].
  * [129] M. Schmittfull, M. Simonović, M. M. Ivanov, O. H. E. Philcox and M. Zaldarriaga, _Modeling Galaxies in Redshift Space at the Field Level_ , _JCAP_ 05 (2021) 059 [2012.03334].
  * [130] T. Lazeyras, A. Barreira and F. Schmidt, _Assembly bias in quadratic bias parameters of dark matter halos from forward modeling_ , _JCAP_ 10 (2021) 063 [2106.14713].
  * [131] A. Barreira, T. Lazeyras and F. Schmidt, _Galaxy bias from forward models: linear and second-order bias of IllustrisTNG galaxies_ , 2105.02876.
  * [132] T. Steele and T. Baldauf, _Precise Calibration of the One-Loop Trispectrum in the Effective Field Theory of Large Scale Structure_ , 2101.10289.
  * [133] D. Blas, M. M. Ivanov and S. Sibiryakov, _Testing Lorentz invariance of dark matter_ , _JCAP_ 10 (2012) 057 [1209.0464].
  * [134] B. Audren, D. Blas, M. M. Ivanov, J. Lesgourgues and S. Sibiryakov, _Cosmological constraints on deviations from Lorentz invariance in gravity and dark matter_ , _JCAP_ 03 (2015) 016 [1410.6514].
  * [135] L. Senatore and M. Zaldarriaga, _Redshift Space Distortions in the Effective Field Theory of Large Scale Structures_ , 1409.1225.
  * [136] M. Lewandowski, L. Senatore, F. Prada, C. Zhao and C.-H. Chuang, _EFT of large scale structures in redshift space_ , _Phys. Rev. D_ 97 (2018) 063526 [1512.06831].
  * [137] A. Perko, L. Senatore, E. Jennings and R. H. Wechsler, _Biased Tracers in Redshift Space in the EFT of Large-Scale Structure_ , 1610.09321.