# When quantum corrections alter the predictions of classical field theory for
scalar field dark matter

Andrew Eberhardt  Corresponding author.
<EMAIL_ADDRESS>Kavli Institute for Particle Astrophysics and Cosmology,
Menlo Park, 94025, California, USA  Physics Department, Stanford University,
Stanford, California, USA  SLAC National Accelerator Laboratory  Michael Kopp
Stockholm University, Hannes Alfvéns väg 12, SE-106 91 Stockholm, Sweden  Tom
Abel  Kavli Institute for Particle Astrophysics and Cosmology, Menlo Park,
94025, California, USA  Physics Department, Stanford University, Stanford,
California, USA  SLAC National Accelerator Laboratory

###### Abstract

We investigate the timescale on which quantum corrections alter the
predictions of classical field theory for scalar field dark matter. This is
accomplished by including second order terms in the evolution proportional to
the covariance of the field operators. When this covariance is no longer small
compared to the mean field value, we say that the system has reached the
“quantum breaktime” and the predictions of classical field theory will begin
to differ from those of the full quantum theory. While holding the classical
field theory evolution fixed, we determine the change of the quantum breaktime
as total occupation number is increased. This provides a novel numerical
estimation of the breaktime based at high occupations $n_{tot}$ and mode
number $N=256$. We study the collapse of a sinusoidal overdensity in a single
spatial dimension. We find that the breaktime scales as $\log(n_{tot})$ prior
to shell crossing and then then as a powerlaw following the collapse. If we
assume that the collapsing phase is representative of halos undergoing
nonlinear growth, this implies that the quantum breaktime of typical systems
may be as large as $\sim 30$ of dynamical times even at occupations of
$n_{tot}\sim 10^{100}$.

##  I Introduction

Discovering the properties of dark matter remains an outstanding problem in
cosmology Peebles (2015). Observations indicate that the dark matter is cold
and collisionless, though its specific particle nature is not known Spergel
_et al._ (2003); Aghanim  _et al._ (2020). Numerical studies allow us to
compare observations with the predictions of simulations of different dark
matter models Vogelsberger  _et al._ (2020). Understanding where our numerical
methods are valid is then necessary to interpreting the predictions of these
studies.

One interesting dark matter model is scalar field dark matter (SFDM) Hu  _et
al._ (2000); Preskill  _et al._ (1983); Turner (1983); Schive  _et al._
(2016); Mocz  _et al._ (2019); Guth  _et al._ (2015); Seidel and Suen (1994);
Arvanitaki  _et al._ (2020); Abbott and Sikivie (1983); Marsh (2016); Hui
(2021); Pozo  _et al._ (2021); Lentz  _et al._ (2019). This model involves
extremely light scalar particles with masses typically somewhere in the range
$10^{-5}-10^{-22}\,\mathrm{eV}$. The QCD axion is a potential SFDM candidate
Preskill  _et al._ (1983) making simulations of this model relevant for many
axion detection experimental setups Hoskins  _et al._ (2011); Hui (2021);
Braine  _et al._ (2020); Zhong  _et al._ (2018); Salemi  _et al._ .

The low mass in this model creates a system where phase space occupation
numbers are extremely high and, on the lowest mass end of the model, particles
have a typical deBroglie wavelength on the $\sim\,\mathrm{kpc}$ length scale
Hu  _et al._ (2000); Abbott and Sikivie (1983); Guth  _et al._ (2015);
Arvanitaki  _et al._ (2020). It is has been shown that power at length scales
below the deBroglie wavelength would be suppressed but structure on larger
scales would be left similar to standard $\Lambda$ cold dark matter cosmology
($\mathrm{\Lambda CDM}$) Mocz  _et al._ (2019); Hu  _et al._ (2000);
Arvanitaki  _et al._ (2020). This model then allows one to tune the particle
mass to account for discrepancies between simulation and observation on small
scales, creating a potential solution to small scale structure problems. On
small scales observations of structure deviate from the predictions of dark
matter only cosmological simulations Weinberg  _et al._ (2015); Arvanitaki
_et al._ (2020); Marsh (2016); Schive  _et al._ (2014); Pozo  _et al._ (2021).
Typically this deviation is summarized as three problems. The core-cusp
problem: describing the observed flattening of galactic density profiles
(cores) near the center of galaxies, as opposed to an increasingly steep
density profile (cusp) Navarro  _et al._ (1996); Walker and Peñarrubia (2011).
The missing satellites problem: describing the lack of observed Milky-Way
satellite galaxies Klypin  _et al._ (1999); Moore (1994); Moore  _et al._
(1999). And the too-big-to-fail problem: describing the lack of observed
massive dark matter sub halos Papastergis, E.  _et al._ (2015); Boylan-Kolchin
_et al._ (2011). This problem admits a number of solutions in addition to
scalar field dark matter. Improved observational efforts, self interacting
dark matter, and Baryonic effects are also suspected as possible solutions
Governato  _et al._ (2012); Nadler  _et al._ (2019); van den Bosch  _et al._
(2000); Brooks  _et al._ (2013); Papastergis, E. and Shankar, F. (2016); Tulin
and Yu (2018). It should also be mentioned that scalar field dark matter is
associated with other interesting phenomenology in regions of parameter space
where small scale structure is left largely unchanged Arvanitaki  _et al._
(2020); Marsh (2016); Hui (2021).

The high occupation numbers of degenerate Bosons motivate approximating scalar
field dark matter with a classical mean field theory (MFT) Guth  _et al._
(2015); Kirkpatrick  _et al._ (2020); Hertzberg (2016); Mocz  _et al._ (2019);
Hu  _et al._ (2000); Arvanitaki  _et al._ (2020); Abbott and Sikivie (1983);
Marsh (2016); Eberhardt  _et al._ (2022). Likewise, for dark matter models
which have misalignment as their production mechanism, the initial quantum
state is thought to be well described by a coherent state Abbott and Sikivie
(1983); Preskill  _et al._ (1983). Such models would therefore be well
described at early times by MFT. Generally, numerical studies of SFDM proceed
by solving the Schrödinger Poisson equations on a grid using a single
classical field to represent the dark matter phase space Mocz  _et al._
(2019); Hu  _et al._ (2000); Schive  _et al._ (2014); Zhang  _et al._ (2019).
It is known that MFT accurately approximates weakly interacting highly
degenerate Bosonic systems such as Bose Einstein Condensates and coherent
electromagnetic radiation Bialynicki-Birula (1977); Gross (1961); Pitaevskii
(1960); Leggett (2001).

However the extent to which MFT can approximate the evolution of strongly
interacting systems is a topic of interest Dvali and Zell (2018); Hertzberg
(2016); Sikivie and Todarello (2017); Dvali  _et al._ (2017, 2013); Sreedharan
_et al._ (2020); Chakrabarty  _et al._ (2018); Kopp  _et al._ (2021); Lentz
_et al._ (2019, 2020); Eberhardt  _et al._ (2022). It is possible that the
mean field description of SFDM fails in some regimes or on some timescale
relevant to cosmological simulations and that quantum effects begin to become
important Sikivie and Todarello (2017); Seidel and Suen (1994); Chakrabarty
(2021); Chakrabarty  _et al._ (2018); Kopp  _et al._ (2021); Lentz  _et al._
(2019). This is due to the spreading of the quantum wavefunction around the
classical solution, an effect generic to nonlinear systems Yurke and Stoler
(1986); Sreedharan  _et al._ (2020); Lewenstein and You (1996); Caballero-
Benitez  _et al._ (2008); Eberhardt  _et al._ (2022, 2021). The timescale on
which the classical and quantum evolutions begin to differ is often referred
to as the “quantum breaktime”. Estimations of this timescale have been
performed for scalar field dark matter Dvali and Zell (2018); Kopp  _et al._
(2021); Erken  _et al._ (2012). However, these estimations have either relied
on significant approximations about the behavior of the spread of the
wavefunction or simulations of significantly less complicated systems. The
main focus of this work will be to characterize the behavior of quantum
corrections for large systems undergoing gravitational collapse. We use a
solver which tracks the leading order correction to the MFT which is
proportional to the second order field moments. This allows us to directly
numerically integrate the evolution of the quantum corrections in a way
numerically efficient enough to allow us to estimate the behavior of these
corrections for systems much larger than have been previously investigated
numerically.

This is done using the field moment expansion method (FME), described in
Eberhardt  _et al._ (2021), which estimates the relative size of quantum
correction terms in the evolution of a system initially well described by mean
field theory. When these terms pass a certain threshold we define MFT to have
broken down. We estimate the quantum breaktime as a function of occupation
number and self interaction strength for the gravitational collapse of an
initial spatial overdensity. An appendix contains a brief discussion of other
systems we tested.

The paper is organized as follows. In Section II, we discuss background on
mean field theory, its quantum deviations and corrections. Section III
explains the numerical implementation of the various theories. Section IV
contains results of applying this method to scalar field dark matter. We
include a general discussion of the results in Section V, focusing on the
implication for simulations of scalar field dark matter.

##  II Background

###  II.1 Quantum description

The evolution of a quantum system is determined by its Hamiltonian and the
initial conditions of the quantum state. In this work we will use the
following Hamiltonian

$\hat{H}=\sum_{j}^{M}\omega_{j}\hat{a}_{j}^{\dagger}\hat{a}_{j}+\sum_{ijkl}^{M}\frac{\Lambda_{kl}^{ij}}{2}\hat{a}_{k}^{\dagger}\hat{a}_{l}^{\dagger}\hat{a}_{i}\hat{a}_{j}\,.$
(1)

Which, with appropriate choice of $\omega_{j}$ and $\Lambda^{ij}_{kl}$,
describes a variety of non-relativistic field physics, see for example Sikivie
and Todarello (2017); Erken  _et al._ (2012); Hertzberg (2016); Eberhardt  _et
al._ (2022). $M$ is the total number of allowed modes, $\hat{a}_{j}$ and
$\hat{a}_{j}^{\dagger}$ are annihilation and creation operators on mode $j$
respectively, and $\omega_{j}$ is the kinetic energy associated with mode $j$.
Throughout this paper we will assume that the mode functions are the momentum
eigenstates and that $\omega_{j}\propto\hbar j^{2}/(2m)$. The matrix
$\Lambda^{ij}_{kl}$ describes the potential energy of the field, including
self interactions. If we write this matrix as

$\Lambda^{ij}_{kl}=\left(\frac{C}{2(p_{k}-p_{i})^{2}}+\frac{C}{2(p_{k}-p_{j})^{2}}\right)\delta^{ij}_{kl}$
(2)

then $C=-4\pi\,G\,m^{2}/\hbar$ describes the gravitational self interaction
and $C=4\pi k_{e}\,q\,m/\hbar$ describes the electrostatic self interaction,
via four point vertex.

In the Heisenberg picture, the dynamical variables are the operators
themselves, which evolve according to the Heisenberg equation of motion

$\displaystyle\partial_{t}\hat{a}_{p}$
$\displaystyle=i[\hat{H},\hat{a}_{p}]=-i\left[\omega_{p}\hat{a}_{p}+\sum_{ijl}\Lambda^{ij}_{pl}\hat{a}_{l}^{\dagger}\hat{a}_{i}\hat{a}_{j}\right]\,.$
(3)

All that is left is to specify the initial quantum state. Because we are
primarily concerned with ultra light scalar field dark matter we will assume
that the initial conditions are approximately coherent. We will define what we
mean by approximately coherent in later sections. For now we will say that is
that the initial quantum state is close to

$\ket{\vec{z}}=\bigotimes_{i=1}^{M}\exp\left[-\frac{|z_{i}|^{2}}{2}\right]\sum_{n_{i}=0}^{\infty}\frac{z_{i}^{n_{i}}}{\sqrt{n_{i}!}}\ket{n_{i}}\,.$
(4)

where $\vec{z}\in\mathbb{C}^{M}$ parameterizes the state. Physically a
coherent state is defined ss a displacement from the vacuum state.
$\ket{n_{i}}=\frac{(\hat{a}^{\dagger}_{i}(t=0))^{n_{i}}}{\sqrt{n_{i}!}}\ket{0}$
represents the number eigenstates corresponding to having $n_{i}$ particles in
the $i$th mode. For axions produced by the misalignment mechanism a coherent
state is thought to initially provide an accurate description Abbott and
Sikivie (1983); Preskill  _et al._ (1983).

Coherent states have the following important property: for a coherent state
the expectation value of any normally ordered operator is given

$\displaystyle\braket{\vec{z}}{\,f(\set{\hat{a}^{\dagger}})\,g(\set{\hat{a}})\,}{\vec{z}}=f(\set{z^{\dagger}})\,g(\set{z})$
(5)

where $\hat{a}=\hat{a}(t=0)$.

###  II.2 Obtaining the classical theory

MFT is obtained by replacing the operators in equation 3 with complex numbers
which are then the “classical field”. This means that the classical field
equation of motion is written

$\displaystyle\partial_{t}a^{cl}_{p}=-i\left[\omega_{p}a^{cl}_{p}+\sum_{ijl}\Lambda^{ij}_{pl}a^{cl\dagger}_{l}a^{cl}_{i}a^{cl}_{j}\right]\,.$
(6)

Typically, initially, $a^{cl}_{p}$ corresponds to the mean of the field
operator $\hat{a}_{p}$, that is

$\displaystyle
a^{cl}_{p}\biggr{\rvert}_{t=0}=\braket{\hat{a}_{p}}\biggr{\rvert}_{t=0}\,.$
(7)

And in fact we can think of the MFT equation of motion as resulting from the
following approximation

$\displaystyle\partial_{t}\braket{\hat{a}_{p}}=\braket{F(\set{\hat{a}})}\approx
F(\set{\braket{\hat{a}}})\,.$ (8)

Where $F(\set{\hat{a}})$ is the right hand side of equation 3. The first
equality above is the result of taking the expectation value of equation 3.
The approximation gives equation 6.

This approximation is accurate when the mean value of the operator is large
compared to its root variance. We will make this requirement more precise in
the next section.

For coherent state initial conditions, at $t=0$ we can use the property in
equation 5 to restore the approximation in equation 8 to an equality.

Notice also that taking a Fourier transform of equation 6 and defining
$\Lambda^{ij}_{pl}$ as we have in the previous section recoveres the familiar
Schrödinger-Poisson equations of motion.

$\displaystyle\partial_{t}\psi(x)$
$\displaystyle=-i\left[\frac{-\nabla^{2}}{2m}+mV(x)\right]\psi(x)\,,$ (9)
$\displaystyle\nabla^{2}V$ $\displaystyle=4\pi
Gm\,\psi^{\dagger}(x)\psi(x)\,,.$ (10)

where

$\psi(x)=\sum_{i}a_{i}^{cl}u^{\dagger}_{i}(x)\,$ (11)

$u_{i}(x)$ is the momentum eigenstate with momentum $p_{i}$. Note the above
equations describe gravity, in the electromagnetic case we simply make the
replacements $G\rightarrow-k_{e}$ and $\sqrt{m}\rightarrow\sqrt{q}$.

###  II.3 Corrections to the classical theory

In order to understand how the corrections to the classical theory arise we
return to equation 8. This approximation can be returned to an equality if we
write the rightmost side as the following series

$\displaystyle\partial_{t}\braket{\hat{a}_{p}}$
$\displaystyle=\braket{F(\set{\hat{a}})}$
$\displaystyle=F(\set{\braket{\hat{a}}})+\left(\sum_{\set{\hat{a}}}\braket{\delta\hat{a}_{i}\delta\hat{a}_{j}}\frac{\partial^{2}}{\partial\hat{a}_{i}\partial\hat{a}_{j}}+\braket{\delta\hat{a}_{i}\delta\hat{a}^{\dagger}_{j}}\frac{\partial^{2}}{\partial\hat{a}_{i}\partial\hat{a}^{\dagger}_{j}}\,+\dots\right)F(\set{\braket{\hat{a}}}).$
(12)

The series in the parentheses represent how higher order moments effect the
exact evolution of the mean field. Notice that each term in the sum is written
as a central moment weighting a derivative of the same order representing the
response of the evolution function to that central moment. This kind of
expansion is commonly used to approximate probability distributions.

By applying this expansion to the evolution of the expectation value of any
operator we can find quantum correction terms to the classical equations of
motion. Notice that at each order in this process we introduce additional
moments that themselves have equations of motion. This process then generates
an infinite series of coupled equations of motion. If the initial conditions
and evolution are such that the growth of each central moment of a given order
is hierarchical, i.e. moments of a higher order grow slower than ones of a
lower order, than we can truncate this series at some order and always improve
upon the accuracy of a lower order truncation up until the highest order
correction terms become large. For coherent state initial conditions we expect
such a hierarchical growth condition to be satisfied.

Very approximately the ratio of the second order and classical terms can be
given by the following parameter

$Q\equiv\sum_{i}^{M}\frac{\braket{\delta\hat{a}_{i}^{\dagger}\delta\hat{a}_{i}}}{n_{tot}}\,.$
(13)

For a coherent state this parameter is $0$. When $Q$ is no longer much smaller
than $1$ we expect the quantum correction terms to begin becoming important
and for the classical theory to break down. Therefore, the quantum breaktime
will be on the same timescale. Using our hierarchical growth assumption we can
also say that the evolution of the second order equations of motion will
remain accurate until this time. Therefore, a second order expansion should be
sufficient to predict the breaktime.

We therefore define a quantum breaktime as follows

$Q(t_{br})\equiv 0.15\,.$ (14)

Note that our results should be fairly robust to the specific choice of
$Q(t_{br})$, we choose $0.15$ here simple because it is clear that at this
time it is likely true that the classical solution admits terms that are no
longer sub-leading order and that the second order solution is still an
accurate approximation of the exact quantum evolution, as the third order
terms should still be sub-leading order. If the quantum correction terms are
no longer small compared to the classical terms it is unlikely that the
predictions of the classical field theory will remain accurate.

##  III Numerical Implementation

We solve the coupled equations of motion for the first and second order
moments of the field operator.

$\displaystyle\partial_{t}\braket{\hat{a}_{p}}$
$\displaystyle\approx-i\left[\omega_{p}\braket{\hat{a}_{p}}+\sum_{ijl}\Lambda^{ij}_{pl}\left(\braket{\hat{a}_{l}^{\dagger}}\braket{\hat{a}_{i}}\braket{\hat{a}_{j}}+\braket{\delta\hat{a}_{i}\delta\hat{a}_{j}}\braket{\hat{a}^{\dagger}_{l}}+\braket{\delta\hat{a}^{\dagger}_{l}\delta\hat{a}_{i}}\braket{\hat{a}_{j}}+\braket{\delta\hat{a}^{\dagger}_{l}\delta\hat{a}_{j}}\braket{\hat{a}_{i}}\,\right)\right]\,,$
(15) $\displaystyle\partial_{t}\braket{\delta\hat{a}_{i}\delta\hat{a}_{j}}$
$\displaystyle\approx-i\left[(\omega_{i}+\omega_{j})\braket{\delta\hat{a}_{i}\delta\hat{a}_{j}}+\sum_{kp}\Lambda^{ij}_{pk}\braket{\hat{a}_{k}}\braket{\hat{a}_{p}}\right.$
(16)
$\displaystyle\left.+\sum_{kpl}\Lambda^{ij}_{pl}\left(\braket{\delta\hat{a}_{l}\delta\hat{a}_{j}}\braket{\hat{a}^{\dagger}_{k}}\braket{\hat{a}_{p}}+\braket{\delta\hat{a}_{j}\delta\hat{a}_{p}}\braket{\hat{a}^{\dagger}_{k}}\braket{\hat{a}_{l}}+\braket{\delta\hat{a}_{k}^{\dagger}\delta\hat{a}_{j}}\braket{\hat{a}_{l}}\braket{\hat{a}_{p}}\right)+(i\leftrightarrow
j)\right]\,,$
$\displaystyle\partial_{t}\braket{\delta\hat{a}_{i}^{\dagger}\delta\hat{a}_{j}}$
$\displaystyle\approx
i\left[(\omega_{i}-\omega_{j})\braket{\delta\hat{a}_{i}^{\dagger}a_{j}}+\right.$
(17)
$\displaystyle\left.+\sum_{kpl}\Lambda^{ij}_{pl}\left(\braket{\delta\hat{a}_{j}\delta\hat{a}_{k}}\braket{\hat{a}^{\dagger}_{p}}\braket{\hat{a}^{\dagger}_{l}}+\braket{\delta\hat{a}^{\dagger}_{p}\delta\hat{a}_{j}}\braket{\hat{a}^{\dagger}_{l}}\braket{\hat{a}_{k}}+\braket{\delta\hat{a}^{\dagger}_{l}\delta\hat{a}_{l}}\braket{\hat{a}^{\dagger}_{p}}\braket{\hat{a}_{k}}\right)+(c.c.,\,i\leftrightarrow
j)\right]\,.$

To do this we use the the CHiMES repository available at
https://github.com/andillio/CHiMES. These operators can then be used to
estimate the breaktime as we have defined it in equation 14. Appendix B
contains a discussion of the choice of the mode number $N$ and timestep $dt$.

Figure 1:  Here we plot the evolution of sinusoidal over-density. The top two
rows show the phase space density evolution for two different values of
$\tilde{\hbar}$. The phase space is represented by the Husimi function of the
classical field with fixed $\sigma_{x}$. The bottom row shows the density for
both. Each column represents a different timestep, with the left most column
showing the initial conditions, and the middle column showing shell crossing,
the point at which the scaling of the breaktime transitions from logarithmic
to a power law.  Figure 2: Here we plot how the wavefunction spreads at
different stages in the evolution of the system, for the gravitational
collapse of a sinewave overdensity. The top plot shows the evolution of $Q(t)$
and the bottom plot the maximum value of the potential, $V(t)$. We see that
$Q$ first grows quadratically at early times when the growth of the potential
is approximately linear, then begins to grow exponentially until the collapse
time at $t=t_{dyn}$, after this time, it again grows according to a power law
before undergoing runaway growth near the breaktime shortly after $t\approx
2\,t_{dyn}$. The exponential growth of $Q$ corresponds to the exponential
growth of the overdensity, following the collapse the wavefunction spreads
much slower. Here we set $\tilde{\hbar}=2.5\times 10^{-4}$, $n_{tot}\approx
10^{10}$.  Figure 3:  Here we plot the evolution of $Q(t)$ for two systems
with different $\tilde{\hbar}$ and $n_{tot}$. Notice that the behavior of
$Q(t)$ is mostly constant between the two simulations despite a relatively
large change in the simulation parameters. Both are fit well by the quadratic
approximation at early times and then have a similar exponential growth prior
to collapse at $t=t_{d}$. This is somewhat unsurprising as prior to shell
crossing both systems have a similar mean field evolution, which is well
approximated by classical particles and so we would not expect the evolution
to depend sensitively on its scalar field qualities.  Figure 4: Here we look
at the mean field theory differs from the field moment expansion, the left
column showing spatial operators and the right momentum space operators. The
top row shows
$(\braket{\hat{\psi}^{\dagger}(y)\hat{\psi}(x)}-\psi^{cl\dagger}(y)\otimes\psi^{cl}(x))/n_{tot}$
and
$(\braket{\hat{a}^{\dagger}(k_{j})\hat{a}(k_{i})}-a^{cl\dagger}(k_{j})\otimes
a^{cl}(k_{i}))/n_{tot}$. The bottom row shows the difference between the
overdensities predicted by the number operators
$\braket{\hat{\psi}^{\dagger}(x)\hat{\psi}(x)}$ and
$\braket{\hat{a}^{\dagger}(k_{i})\hat{a}(k_{i})}$, and the square of the
classical field $|\psi^{cl}(x)|^{2}$ and $|a^{cl}(k_{i})|^{2}$. The difference
between the blue and orange lines in the bottom row plots is given by the
diagonal of the top row plots. We can see that quantum corrections occur in
the momentum density but are off diagonal for the spatial covariance. This
follows from the fact that the non-linearity is in the spatial potential and
therefore directly effects the momentum evolution.  Figure 5:  Here we show
the scaling of the breaktime, $t_{br}$, with total particle number, $n_{tot}$,
for the sinusoidal overdensity. The breaktime is defined using $Q$, see
equations (13) and (14), which compares the spread of the wavefunction to the
total number of particles. We can see that for systems with breaktimes shorter
than the collapse time, i.e. $t_{br}<t_{d}$, the scaling of the breaktime with
total occupation number is $\propto\log(n_{tot})$. However, after the collapse
time, $t_{d}$, the scaling follows a power law. Each color line corresponds to
a different classical field evolution, which is determined by the value of
$\tilde{\hbar}$, we set $\tilde{\hbar}=h\times 2.5\times 10^{-4}$. The trend
of larger $\tilde{\hbar}$ corresponding to longer breaktimes implies that the
breaktime decreases as mass is increased.

##  IV Results

###  IV.1 Test problem set up

Here we show the breaktime calculated for the collapse of a gravitational
overdensity. We simulate the first and second order moments of the field using
the method described in section III. The field moments are initialized as
follows

$\displaystyle\psi(x)$ $\displaystyle=\sqrt{1+\delta\,\cos\left(2\pi
x/L\right)}/\mathrm{Norm}\,,$ (18)
$\displaystyle\braket{\delta\hat{a}_{i}\delta\hat{a}_{j}}$
$\displaystyle=0\,,$ (19)
$\displaystyle\braket{\delta\hat{a}^{\dagger}_{i}\delta\hat{a}_{j}}$
$\displaystyle=0\,.$ (20)

Recall that $\psi(x)$ and $z_{p}$ are related via Fourier transform, i.e.
$\psi(x)=\sum_{p}z_{p}u_{p}(x)$. We normalized each initial conditions such
that the square norm equals the total number of particles, i.e.
$\sum_{p}|z_{p}|^{2}=\sum_{x}|\psi(x)|^{2}=n_{tot}$. The overdensity tends to
grow exponentially until shell crossing, see bottom plot in figure 2,
resulting in a characteristic phase space spiral, see figure 1.

When simulating classical particles, for cold initial conditions, the growth
of structure is “scale free”. This means that characteristic phase space
spiral will continue indefinitely resulting in ever smaller structure. If we
instead use a classical field, phase space structures smaller than $\hbar$
will be washed out, and a central core will form in the density as opposed to
a cusp, see for example Eberhardt  _et al._ (2020); Hu  _et al._ (2000); Hui
(2021). The velocity dispersion of the collapsing system is set by the
gravitational potential, which is well measured in cosmology. This velocity
scale then sets a deBroglie wavelength which washes out structures below that
spatial scale, this can be seen in figure 1.

We will be interested in how the leading order and correction terms compare
throughout the evolution as we scale the total number of particles, $n_{tot}$.
The MFT corresponds to the infinite particle limit, thus as we scale the
number of particles we will do so in a way that keeps the classical field
evolution of the system fixed so that systems at different occupation can be
meaningfully compared to one another. This means that we hold
$M_{tot},\,\tilde{\hbar}\equiv\hbar/m,$ and $\Lambda\,n_{tot}$ constant.
Notice that for the numerical implementation purposes this implies the
following scalings $m\propto 1/n_{tot}$, $\hbar\rightarrow 1/n_{tot}$, and
$\Lambda\propto 1/n_{tot}$. We simulate each system until the breaktime,
defined to occur at $Q(t_{br})=0.15$. Recall that $\hbar$ sets the scale for
quantum corrections. When we perform the varying procedure described here we
can parameterize the size of quantum corrections holding the mean field theory
fixed such that their behavior can be studied as a function of the total
particle number, and extrapolated to higher occupations.

###  IV.2 Spread of the wavefunction

The wavefunction spreads around the mean field value throughout the evolution.
This spread can be characterized by the growth of $Q$, defined in equation
(13). This parameter measures how the mode variances compare with the total
occupation number. We plot the growth of $Q$ for a highly occupied system with
$n_{tot}\sim 10^{10}$ particles and $\tilde{\hbar}=2.5\times 10^{-4}$ in
figure 2. The system is initialized so that at the initial conditions
$Q(t=0)=0$, representing an initial coherent state. Generally, we can
characterize the growth of $Q$ by discussing four phases: initial quadratic
growth, the collapsing phase, the post collapse phase, and runaway growth. It
is useful to also look at the behavior of the overdensity, which can help
describe the transition between these phases. We plot both $Q(t)$ and the
maximum potential value, a proxy for the size of the overdensity in figure 2.

We can see by looking at equations (15)-(17) that at early times, $t\ll t_{d}$
and
$\braket{\delta\hat{a}_{i}\delta\hat{a}_{j}},\,\braket{\delta\hat{a}_{i}^{\dagger}\delta\hat{a}_{j}}\ll
1$, the evolution of the second order moments is governed by the
$\sum_{kp}\Lambda^{ij}_{pl}\braket{\hat{a}_{k}}\braket{\hat{a}_{p}}$ term in
equation (16), i.e. at early times

$\displaystyle\partial_{t}\braket{\delta\hat{a}_{i}\delta\hat{a}_{j}}\sim-i\sum_{kp}\Lambda^{ij}_{pl}\braket{\hat{a}_{k}}\braket{\hat{a}_{p}}\,.$
(21)

This term is proportional to $[\hat{a}^{\dagger},\hat{a}]$ and seeds the
variance term, which is initially $0$ for a coherent state. We can take a
second temporal derivative of equation (17) and plug in the above equation
which should dominate at these early times, this implies that the initial
evolution goes as

$\displaystyle\partial_{tt}\braket{\delta\hat{a}_{i}^{\dagger}\delta\hat{a}_{j}}$
$\displaystyle\sim
2\mathbb{R}\left[\sum_{kplbc}\Lambda^{ij}_{pl}\Lambda^{kj}_{bc}\braket{\hat{a}_{b}}\braket{\hat{a}_{c}}\braket{\hat{a}_{p}^{\dagger}}\braket{\hat{a}_{l}^{\dagger}}\right]$
$\displaystyle\equiv\kappa_{ij}\,.$ (22)

We now can define the quantity $\kappa$ which describes the rate of the growth
of quantum corrections at early times. We can see in figure 2 that initially
$Q(t)=\mathrm{Tr}[\kappa_{ij}]\,t^{2}/2n_{tot}$. The approximation fits quite
well at early times when the overdensity is growing slowly.

Following this initial quadratic growth phase, the overdensity begins to grow
quickly as the system collapses. During this collapse the wavefunction spreads
exponentially around its mean field value. This continues until shell
crossing, here defined to occur at $t=t_{d}$. The exponential spread of the
wavefunction is behavior typical of quantum systems which exhibit classical
chaos and corroborates previous studies of nonlinear systems, see for example
Eberhardt  _et al._ (2022). It is interesting to note that during this and the
quadratic growth phase of $Q(t)$ the classical field behavior is still well
approximated by classical particles, see for review Eberhardt  _et al._
(2020). We can see in figure 3 that the evolution of $Q(t)$ during the
quadratic and exponential growth phases depend only weakly on the value of
$\tilde{\hbar}$ and $n_{tot}$, assuming that both are chosen such that
$Q(t)\ll 1$ during these phases. After shell crossing, the growth again
becomes a power law for a time before experiencing runaway growth.

###  IV.3 Effect of corrections on densities

We plot the second order central moments as well as the difference in the
spatial over-density given by the number operator, which is a second order
moment, and the amplitude of the classical field in figure 4. We see that in
the spatial case the covariance is predominantly off diagonal and therefore,
there is no difference between the square amplitude of the spatial classical
field and the spatial number operator. On the other hand the momentum density
admits differences between $|a^{cl}(k_{i})|^{2}$ and
$\braket{\hat{a}^{\dagger}(k_{i})\hat{a}(k_{i})}$. We can see that a leading
order effect of the corrections is to smooth interference patterns in the
momentum density. This corroborates our intuition as it has been shown in
previous work that phase diffusion is a leading order effect of quantum
corrections, see for example figure 1 in Eberhardt  _et al._ (2021).

###  IV.4 Behavior of the quantum breaktime

We simulate a number of systems with different occupations, $n_{tot}$, and
values of $\tilde{\hbar}$, and then plot the breaktime as defined in equation
(14) in figure 5. We see a logarithmic scaling of the breaktime during the
collapses phase and then a power law scaling following shell crossing, a
logarithmic enhancement in the breaktime is consistent with the expected
behavior of quantum systems which exhibit classical chaos Hertzberg (2016);
Eberhardt  _et al._ (2022). This behavior is consistent across all the systems
we tested. We can see that systems with large occupations at fixed
$\tilde{\hbar}$, as well as larger $\tilde{\hbar}$ at fixed $n_{tot}$, have
longer breaktimes. These results align with our expectation as it is generally
argued that large occupation number per deBroglie wavelength imply long
quantum breaktimes Hertzberg (2016); Guth  _et al._ (2015).

The system with the largest value of $\tilde{\hbar}$ we tested, the blue line
in figure 5, had all the dynamical momentum modes highly occupied even at the
breaktime. This is the system that behaved most similar to the classical field
theory. We can see that the slope of the logarithmic scaling of the breaktime
in figure 5 is approximately $1/7$. This means that even as $Q(t)$ was no
longer $\ll 1$ its growth was still well described by the exponential growth
shown in figure 3.

A typical realistic system would be continuously undergoing collapsing and
merging. From our results studying the spread of the wavefunction we can then
expect that during these processes the wavefunction spreads exponentially
around its mean field value but spread slowly during periods of linear growth
or once the system is already virialized. We expect quantum effects to start
becoming very large when $Q(t)\sim 1$. Given the growth rates we found in
figure 3 and assuming a system that is constantly undergoing collapse and
merging events, this would imply that this happens when $e^{7t}\sim n_{tot}$,
at such high occupations this time depends only weakly on the initial
quadratic growth of $Q(t)$. This would imply a breaktime

$\displaystyle t_{br}\sim\frac{\ln(n_{tot})}{7}\,t_{d}\,,$ (23)

in the large $n_{tot}$ limit. This is about $\sim 30$ dynamical times at
$n_{tot}\sim 10^{100}$. However, it is important to note that the wavefunction
is only exponentially growing during nonlinear growth. We found that when the
potential is slowly changing or the system has already collapsed the
wavefunction only spreads slowly around its mean field value.

Squeezing, the shrinking of the spread of the wave function in one direction
in phase space, is accompanied by the initial quadratic spreading of the wave
function $Q(t)=\mathrm{Tr}[\kappa_{ij}]\,t^{2}/2n_{tot}$, see equation (IV.2).
The time scale at which this genuine quantum effect because large, the so-
called squeezing time scale, was discussed in previous work Kopp  _et al._
(2021); Eberhardt  _et al._ (2022). However, as we already noted, $t_{br}$ is
dominated by the exponential growth which is due to the chaotic behavior. It
thus not expected that the squeezing time scale is related to the quantum
break time (23). The squeezing time scale was derived using the single mode
(“Hartree”) ansatz in Kopp  _et al._ (2021). However it was shown in Eberhardt
_et al._ (2022) that in multimode system deviations occur already before the
single-mode squeezing time scale. Here we shown the existence a physically
distinct time scale at which quantum effects become strong, $t_{br}$ in
equation (23), which is genuine multi-mode phenomenon.

##  V Conclusions

We have simulated the gravitational collapse of an initial overdensity with
long range attractive interactions tracking the mean and second order field
operators. The second order operators tell us how the quantum field is
spreading around its mean field value. We find that this spread is exponential
during the nonlinear growth and collapse of the overdensity, see figure 2.
However, at very early times or after the collapse the wavefunction spreads
much slower, growing only as a power law. Interestingly we find that the rate
of exponential growth depends only weakly on the mass of the constituent
particles as long as we remain in the highly occupied regime, see figure 3.

Using our definition of the quantum breaktime in equation (14), we can
determine an approximate timescale (23) when quantum corrections to the
classical field theory evolution are no longer small. This is done by
measuring how the uncertainty compares with the mean field value. The
breaktime scales logarithmically with $n_{tot}$ for a time and then shifts to
a power law scaling, see figure 5. A logarithmic enhancement in the quantum
breaktime with increasing total particle number is typical of chaotic systems
and corraborates earlier results studying similar problems Eberhardt  _et al._
(2022); Hertzberg (2016); Han and Wu (2016); Albrecht and Phillips (2014).

We have found that nonlinear growth drives the exponential spread of the
wavefunction. This work then implies that quantum corrections are most
significant for systems which have histories of continuous and violent
nonlinear growth and mergers. For highly occupied systems the breaktime
depends very weakly on the spread of the wavefunction at early times. We can
therefore put a a rough order of magnitude estimate on the timescale when
quantum corrections grow large as $t_{br}\sim\frac{\ln(n_{tot})}{7}\,t_{d}$.
The tendency of the quantum corrections to decay field amplitudes and smooth
oscillation peaks implies that they may be most important for phenomena that
depend strongly on the interference properties of SFDM evolution such as Dalal
and Kravtsov (2022).

It is important to note the following limitations of this analysis and the
need for future work addressing them. First, the test problems we simulate
here are very simple and include only a single spatial dimension. More
realistic initial conditions in three spatial dimensions with an expanding
background would produce a more reliable estimation of the breaktime. Second,
our approximation scheme tracks only the first two moments of the field,
effectively a Gaussian approximation. This is the lower order correction to
the mean field theory and including the contribution of higher order moments
may alter the prediction of the quantum breaktime. 3D simulations which
include higher order moment contributions will be included in a subsequent
work. Finally, we have neglected to include the effect of decoherence by the
environment which has the tendency to prevent the formation of observable
macroscopic superpositions. Understanding this effect requires both an
estimation of the decoherence timescale as a function of mass, as is done in
Allali and Hertzberg (2020, 2021), and the pointer states into which the
quantum state is effectively projected.

Figure 6:  Here we show the scaling of the breaktime with $n_{tot}$ for two
stream instability. Like in case of the gravitational overdensity we see an
initial logarithmic scaling followed by a power law scaling. The logarithmic
scaling occurs during the time when the potential is growing.  Figure 7:  Here
the top plot shows the evolution of $Q$ and the bottom plot the maximum value
of the potential, $V$, for the gravitational collapse of a sinewave
overdensity. Here we set $\tilde{\hbar}=2.5\times 10^{-4}$, $n_{tot}\approx
10^{6}$.  Figure 8:  Here we show the scaling of the breaktime with $n_{tot}$
for the gravitational collapse of a Gaussian. Like in case of the
gravitational overdensity we see an initial logarithmic scaling followed by a
power law scaling. The logarithmic scaling occurs prior to shell crossing.

* *

##  Appendix A Appendices

###  A Other test systems

We also test other initial conditions and interactions which largely
corroborate the results we have already demonstrated.

We simulate two counter propagating uniform density streams with an initial
velocity perturbation. This system is relevant to the evolution of cold
plasmas and is a common test problem Infeld and Skorupski (1969); Thorne and
Blandford (2017); Eberhardt  _et al._ (2020). The initial field is given by

$\displaystyle\psi(x)=\sqrt{\frac{n_{tot}}{2}}{e^{-i\delta vL\cos(2\pi
x/L)/2\pi\tilde{\hbar}}}\left(e^{ixv_{0}/\tilde{\hbar}}+e^{-ixv_{0}/\tilde{\hbar}}\right)\,.$
(24)

$\delta v$ is the initial velocity perturbation and $v_{0}$ the initial
velocity of the streams. If the velocity separation, $2v_{0}$, is less than
the critical velocity associated with the perturbation, $v_{c}=\sqrt{C/2\pi}$,
then the perturbation will be unstable and grow exponentially, Thorne and
Blandford (2017). Unlike the gravitational case, a single-stream initial
condition would be stable for the electric case. Therefore we consider the
two-stream perturbation which is unstable when $C>0$, representing a repulsive
long range interaction.

As for the previous test problem we evolve the system and track the spread of
the wavefunction until the breaktime, see figure 6. We see that the
uncertainty grows in a similar way. There is an initial phase of power law
growth followed by a phase of exponential growth and then a final phase of
power law growth. We can see that this transition occurs when the potential
stops growing, see figure 7. This again corroborates the idea that it is the
nonlinear growth of the overdensity that is cause the wavefunction to spread
exponentially around its mean field value.

We also tested the gravitational collapse of a Gaussian with initial field
given by

$\displaystyle\psi(x)=e^{-x^{2}/4\sigma^{2}}/\,\mathrm{Norm}\,.$ (25)

The field is normalized such that $\sum_{x}|\psi(x)|^{2}=n_{tot}$. Like the
sinewave collapse, we find that the breaktime scales logarithmically prior to
shell crossing and then as a power law, see figure 8.

We can see in these test problems the same qualatative behavior as in the sine
wave collapse case. Specifically, logarithmic scaling of the breaktime when
the potential is quickly growing and power law growth at other times. This
general behavior corraborates the idea that it is the nonlinear growth that
drives the exponential spread of the wavefunction.

Figure 9:  Here we plot the breaktime as a function of $n_{tot}$ for an
initial sine wave overdensity with $\tilde{\hbar}=2\times 10^{-3}$. We include
points with a variety of $dt$ and $N$, we can see that the fractional
difference between points at different temporal or spatial resolutions is very
small with all point depending only on the total particle number $n_{tot}$.
This demonstrates that our solutions are converged at the resolution used.

###  B Numerical convergence tests

Some simulation parameters are chosen which do not explicitly depend on the
physics of the problem but instead reflect limitations in numerical resources.
It is important to demonstrate that the results of our simulation do not
depend on the choice of these parameters. In this appendix we will look at the
timestep $dt$ and the mode number $N$. In both instances we will show that
varying the value of these parameters does not change our result and we can
therefore consider our results to be converged.

We run simulations with $\tilde{\hbar}=2\times 10^{-3}$ for
$n_{tot}\in[10^{3},10^{6}]$ and a variety of $dt$ and $N$. We plot the results
in figure 9. It is clear from the figure that our breaktime results are
converged and do not depend on the temporal or spatial resolution used in the
simulation.

Because the field moment solver uses the same set of modes present in the
classical field simulation it is subject to the same constraint on the choice
of mode number, namely that the maximum acheived velocity is less than
$\pi\tilde{\hbar}/dx$. The constraint on the choice of time step requires that
the time derivative is small compared to any of the moments updated, namely
that $dt\partial_{t}M/M\ll 1$. These conditions are discussed at length in the
classical field case in Eberhardt  _et al._ (2020). In this appendix we show
the results for a specific value of $\tilde{\hbar}$, but the temporal and
spatial convergence was checked for all simulation results presented.

## References

  * Peebles (2015) P. J. E. Peebles, Proceedings of the National Academy of Sciences 112, 12246 (2015), https://www.pnas.org/content/112/40/12246.full.pdf .
  * Spergel  _et al._ (2003) D. N. Spergel, L. Verde, H. V. Peiris, E. Komatsu, M. R. Nolta, C. L. Bennett, M. Halpern, G. Hinshaw, N. Jarosik, A. Kogut, M. Limon, S. S. Meyer, L. Page, G. S. Tucker, J. L. Weiland, E. Wollack, and E. L. Wright, The Astrophysical Journal Supplement Series 148, 175 (2003).
  * Aghanim  _et al._ (2020) N. Aghanim _et al._ (Planck), Astron. Astrophys. 641, A6 (2020), arXiv:1807.06209 [astro-ph.CO] .
  * Vogelsberger  _et al._ (2020) M. Vogelsberger, F. Marinacci, P. Torrey, and E. Puchwein, Nature Rev. Phys. 2, 42 (2020), arXiv:1909.07976 [astro-ph.GA] .
  * Hu  _et al._ (2000) W. Hu, R. Barkana, and A. Gruzinov, Phys. Rev. Lett. 85, 1158 (2000).
  * Preskill  _et al._ (1983) J. Preskill, M. B. Wise, and F. Wilczek, Phys. Lett. B 120, 127 (1983).
  * Turner (1983) M. S. Turner, Phys. Rev. D 28, 1243 (1983).
  * Schive  _et al._ (2016) H.-Y. Schive, T. Chiueh, T. Broadhurst, and K.-W. Huang, The Astrophysical Journal 818, 89 (2016).
  * Mocz  _et al._ (2019) P. Mocz, A. Fialkov, M. Vogelsberger, F. Becerra, M. A. Amin, S. Bose, M. Boylan-Kolchin, P.-H. Chavanis, L. Hernquist, L. Lancaster, F. Marinacci, V. H. Robles, and J. Zavala, Phys. Rev. Lett. 123, 141301 (2019).
  * Guth  _et al._ (2015) A. H. Guth, M. P. Hertzberg, and C. Prescod-Weinstein, Phys. Rev. D 92, 103513 (2015).
  * Seidel and Suen (1994) E. Seidel and W.-M. Suen, in  _7th Marcel Grossmann Meeting on General Relativity (MG 7)_ (1994) arXiv:gr-qc/9412062 .
  * Arvanitaki  _et al._ (2020) A. Arvanitaki, S. Dimopoulos, M. Galanis, L. Lehner, J. O. Thompson, and K. Van Tilburg, Physical Review D 101 (2020), 10.1103/physrevd.101.083014.
  * Abbott and Sikivie (1983) L. Abbott and P. Sikivie, Physics Letters B 120, 133 (1983).
  * Marsh (2016) D. J. Marsh, Physics Reports 643, 1–79 (2016).
  * Hui (2021) L. Hui, “Wave dark matter,” (2021), arXiv:2101.11735 [astro-ph.CO] .
  * Pozo  _et al._ (2021) A. Pozo, T. Broadhurst, I. de Martino, T. Chiueh, G. F. Smoot, S. Bonoli, and R. Angulo, “Detection of a universal core-halo transition in dwarf galaxies as predicted by bose-einstein dark matter,” (2021), arXiv:2010.10337 [astro-ph.GA] .
  * Lentz  _et al._ (2019) E. W. Lentz, T. R. Quinn, and L. J. Rosenberg, Monthly Notices of the Royal Astronomical Society 485, 1809 (2019), arXiv:1810.09226 .
  * Hoskins  _et al._ (2011) J. Hoskins, J. Hwang, C. Martin, P. Sikivie, N. S. Sullivan, D. B. Tanner, M. Hotz, L. J. Rosenberg, G. Rybka, A. Wagner, S. J. Asztalos, G. Carosi, C. Hagmann, D. Kinion, K. van Bibber, R. Bradley, and J. Clarke, Phys. Rev. D 84, 121302 (2011).
  * Braine  _et al._ (2020) T. Braine, R. Cervantes, N. Crisosto, N. Du, S. Kimes, L. J. Rosenberg, G. Rybka, J. Yang, D. Bowring, A. S. Chou, R. Khatiwada, A. Sonnenschein, W. Wester, G. Carosi, N. Woollett, L. D. Duffy, R. Bradley, C. Boutan, M. Jones, B. H. Laroque, N. S. Oblath, M. S. Taubman, J. Clarke, A. Dove, A. Eddins, S. R. O’kelley, S. Nawaz, I. Siddiqi, N. Stevenson, A. Agrawal, A. V. Dixit, J. R. Gleason, S. Jois, P. Sikivie, J. A. Solomon, N. S. Sullivan, D. B. Tanner, E. Lentz, E. J. Daw, J. H. Buckley, P. M. Harrington, E. A. Henriksen, and K. W. Murch, Physical Review Letters 124 (2020), 10.1103/PhysRevLett.124.101303, arXiv:1910.08638 .
  * Zhong  _et al._ (2018) L. Zhong, S. Al Kenany, K. M. Backes, B. M. Brubaker, S. B. Cahn, G. Carosi, Y. V. Gurevich, W. F. Kindel, S. K. Lamoreaux, K. W. Lehnert, S. M. Lewis, M. Malnou, R. H. Maruyama, D. A. Palken, N. M. Rapidis, J. R. Root, M. Simanovskaia, T. M. Shokair, D. H. Speller, I. Urdinaran, and K. A. Van Bibber, Physical Review D 97 (2018), 10.1103/PhysRevD.97.092001, arXiv:1803.03690 .
  * (21) C. P. Salemi, J. W. Foster, J. L. Ouellet, A. Gavin, K. M. W. Pappas, S. Cheng, K. A. Richardson, R. Henning, Y. Kahn, R. Nguyen, N. L. Rodd, B. R. Safdi, and L. Winslow, arXiv:2102.06722v1 .
  * Weinberg  _et al._ (2015) D. H. Weinberg, J. S. Bullock, F. Governato, R. Kuzio de Naray, and A. H. G. Peter, Proceedings of the National Academy of Sciences 112, 12249 (2015), https://www.pnas.org/content/112/40/12249.full.pdf .
  * Schive  _et al._ (2014) H.-Y. Schive, T. Chiueh, and T. Broadhurst, Nature Phys. 10, 496 (2014), arXiv:1406.6586 [astro-ph.GA] .
  * Navarro  _et al._ (1996) J. F. Navarro, C. S. Frenk, and S. D. M. White, Astrophys. J. 462, 563 (1996), arXiv:astro-ph/9508025 [astro-ph] .
  * Walker and Peñarrubia (2011) M. G. Walker and J. Peñarrubia, The Astrophysical Journal 742, 20 (2011).
  * Klypin  _et al._ (1999) A. A. Klypin, A. V. Kravtsov, O. Valenzuela, and F. Prada, Astrophys. J. 522, 82 (1999), arXiv:astro-ph/9901240 .
  * Moore (1994) B. Moore, Nature (London) 370, 629 (1994).
  * Moore  _et al._ (1999) B. Moore, S. Ghigna, F. Governato, G. Lake, T. Quinn, J. Stadel, and P. Tozzi, The Astrophysical Journal 524, L19 (1999), arXiv:9907411 [astro-ph] .
  * Papastergis, E.  _et al._ (2015) Papastergis, E., Giovanelli, R., Haynes, M. P., and Shankar, F., A&A 574, A113 (2015).
  * Boylan-Kolchin  _et al._ (2011) M. Boylan-Kolchin, J. S. Bullock, and M. Kaplinghat, Monthly Notices of the Royal Astronomical Society: Letters 415, 1 (2011), arXiv:1103.0007 .
  * Governato  _et al._ (2012) F. Governato, A. Zolotov, A. Pontzen, C. Christensen, S. H. Oh, A. M. Brooks, T. Quinn, S. Shen, and J. Wadsley, Monthly Notices of the Royal Astronomical Society 422, 1231 (2012), https://academic.oup.com/mnras/article-pdf/422/2/1231/3466602/mnras0422-1231.pdf .
  * Nadler  _et al._ (2019) E. O. Nadler, V. Gluscevic, K. K. Boddy, and R. H. Wechsler, Astrophys. J. Lett. 878, 32 (2019), [Erratum: Astrophys.J.Lett. 897, L46 (2020), Erratum: Astrophys.J. 897, L46 (2020)], arXiv:1904.10000 [astro-ph.CO] .
  * van den Bosch  _et al._ (2000) F. C. van den Bosch, B. E. Robertson, J. J. Dalcanton, and W. J. G. de Blok, Astron. J. 119, 1579 (2000), arXiv:astro-ph/9911372 .
  * Brooks  _et al._ (2013) A. M. Brooks, M. Kuhlen, A. Zolotov, and D. Hooper, The Astrophysical Journal 765, 22 (2013).
  * Papastergis, E. and Shankar, F. (2016) Papastergis, E. and Shankar, F., A&A 591, A58 (2016).
  * Tulin and Yu (2018) S. Tulin and H.-B. Yu, Phys. Rept. 730, 1 (2018), arXiv:1705.02358 [hep-ph] .
  * Kirkpatrick  _et al._ (2020) K. Kirkpatrick, A. E. Mirasola, and C. Prescod-Weinstein, Phys. Rev. D 102, 103012 (2020).
  * Hertzberg (2016) M. P. Hertzberg, Journal of Cosmology and Astroparticle Physics 2016, 037 (2016), arXiv:1609.01342 [hep-ph] .
  * Eberhardt  _et al._ (2022) A. Eberhardt, A. Zamora, M. Kopp, and T. Abel, Phys. Rev. D 105, 036012 (2022), arXiv:2111.00050 [hep-ph] .
  * Zhang  _et al._ (2019) J. Zhang, H. Liu, and M.-C. Chu, Frontiers in Astronomy and Space Sciences 5, 48 (2019).
  * Bialynicki-Birula (1977) I. Bialynicki-Birula, “Classical limit of quantum electrodynamics. [review],” (1977).
  * Gross (1961) E. P. Gross, Il Nuovo Cimento 20, 454 (1961).
  * Pitaevskii (1960) L. P. Pitaevskii, J. Exptl. Theoret. Phys. 13, 646 (1960).
  * Leggett (2001) A. J. Leggett, Rev. Mod. Phys. 73, 307 (2001).
  * Dvali and Zell (2018) G. Dvali and S. Zell, Journal of Cosmology and Astroparticle Physics 2018, 064 (2018).
  * Sikivie and Todarello (2017) P. Sikivie and E. M. Todarello, Phys. Lett. B 770, 331 (2017), arXiv:1607.00949 [hep-ph] .
  * Dvali  _et al._ (2017) G. Dvali, C. Gomez, and S. Zell, JCAP 06, 028 (2017), arXiv:1701.08776 [hep-th] .
  * Dvali  _et al._ (2013) G. Dvali, D. Flassig, C. Gomez, A. Pritzel, and N. Wintergerst, Phys. Rev. D 88, 124041 (2013), arXiv:1307.3458 [hep-th] .
  * Sreedharan  _et al._ (2020) A. Sreedharan, S. Choudhury, R. Mukherjee, A. Streltsov, and S. Wüster, Phys. Rev. A 101, 043604 (2020), arXiv:1904.11878 [cond-mat.quant-gas] .
  * Chakrabarty  _et al._ (2018) S. S. Chakrabarty, S. Enomoto, Y. Han, P. Sikivie, and E. M. Todarello, Phys. Rev. D 97, 043531 (2018), arXiv:1710.02195 [hep-ph] .
  * Kopp  _et al._ (2021) M. Kopp, V. Fragkos, and I. Pikovski, “Nonclassicality of axion-like dark matter through gravitational self-interactions,” (2021), arXiv:2105.13451 [astro-ph.CO] .
  * Lentz  _et al._ (2020) E. W. Lentz, T. R. Quinn, and L. J. Rosenberg, Nuclear Physics B 952, 114937 (2020).
  * Chakrabarty (2021) S. S. Chakrabarty, “Density perturbations in axion-like particles: classical vs quantum field treatment,” (2021), arXiv:2105.09749 [hep-ph] .
  * Yurke and Stoler (1986) B. Yurke and D. Stoler, Phys. Rev. Lett. 57, 13 (1986).
  * Lewenstein and You (1996) M. Lewenstein and L. You, Phys. Rev. Lett. 77, 3489 (1996).
  * Caballero-Benitez  _et al._ (2008) S. Caballero-Benitez, E. Ostrovskaya, M. Gulacsi, and Y. Kivshar, (2008).
  * Eberhardt  _et al._ (2021) A. Eberhardt, M. Kopp, A. Zamora, and T. Abel, Physical Review D 104 (2021), 10.1103/physrevd.104.083007.
  * Erken  _et al._ (2012) O. Erken, P. Sikivie, H. Tam, and Q. Yang, Phys. Rev. D 85, 063520 (2012).
  * Eberhardt  _et al._ (2020) A. Eberhardt, A. Banerjee, M. Kopp, and T. Abel, Phys. Rev. D 101, 043011 (2020).
  * Han and Wu (2016) X. Han and B. Wu, Physical Review A 93, 23621 (2016), arXiv:1506.04020 .
  * Albrecht and Phillips (2014) A. Albrecht and D. Phillips,  _Origin of probabilities and their application to the multiverse_ , Tech. Rep. (2014) arXiv:1212.0953v3 .
  * Dalal and Kravtsov (2022) N. Dalal and A. Kravtsov, “Not so fuzzy: excluding fdm with sizes and stellar kinematics of ultra-faint dwarf galaxies,”  (2022).
  * Allali and Hertzberg (2020) I. Allali and M. P. Hertzberg, Journal of Cosmology and Astroparticle Physics 2020, 056 (2020).
  * Allali and Hertzberg (2021) I. J. Allali and M. P. Hertzberg, Phys. Rev. D 103, 104053 (2021).
  * Infeld and Skorupski (1969) E. Infeld and A. Skorupski, Nuclear Fusion 9, 25 (1969).
  * Thorne and Blandford (2017) K. Thorne and R. Blandford,  _Modern Classical Physics: Optics, Fluids, Plasmas, Elasticity, Relativity, and Statistical Physics_ (Princeton University Press, 2017).


# Hashmarks: Privacy-Preserving Benchmarks for High-Stakes AI Evaluation

Paul Bricman
Straumli AI
<EMAIL_ADDRESS>

(December 1, 2023)

###### Abstract

There is a growing need to gain insight into language model capabilities that
relate to sensitive topics, such as bioterrorism or cyberwarfare. However,
traditional open source benchmarks are not fit for the task, due to the
associated practice of publishing the correct answers in human-readable form.
At the same time, enforcing mandatory closed-quarters evaluations might stifle
development and erode trust. In this context, we propose hashmarking, a
protocol for evaluating language models in the open without having to disclose
the correct answers. In its simplest form, a hashmark is a benchmark whose
reference solutions have been cryptographically hashed prior to publication.
Following an overview of the proposed evaluation protocol, we go on to assess
its resilience against traditional attack vectors (e.g. rainbow table
attacks), as well as against failure modes unique to increasingly capable
generative models.

##  1 Introduction

###  1.1 Background & Motivation

Traditional question-answering (QA) benchmarks have played a crucial role in
shaping the trajectory of AI development. They provide standardized metrics
that facilitate fair comparisons across research groups and measure progress
within the field in a reproducible way [1]. For instance, capabilities related
to mathematics can generally be gauged by assessing model performance in
producing or selecting correct answers for exam questions related to
mathematics [2, 3]. Similar "AI exams" have been used to assess model
performance on topics ranging from STEM [4, 5, 6, 7] to humanities [4, 8]. In
fact, prior work has highlighted the possibility of framing the vast majority
of established natural language processing tasks as question-answering tasks
[9].

Traditional QA benchmarks are typically sourced from crowd-workers, members of
the group developing the benchmark, or a mix of the two [1, 10]. They
typically contain a large number of data points representing individual
exercises. Each data point, in turn, contains one question and one or several
correct answers. Occasionally, a data point may also contain some relevant
context in the form of a separate string, although the context can always be
functionally merged with the question without loss of generality [11, 12]. In
addition, when structured as a multiple-choice question, a data point also
contains several distractor answers [4, 8]. These data points are then
aggregated into one or more standardized files, and are finally made public
for other groups to easily make use of them in evaluating language models [1,
13].

While traditional QA benchmarks have been instrumental in assessing models
across a wide range of benign domains, there is a growing need to better
understand capabilities that relate to sensitive topics, such as bioterrorism
or cyberwarfare [14]. Greater insight into, for instance, AI-enabled biorisk,
could help calibrate the stringency of regulations and policies in a way that
is proportional to the associated threat. Underestimating the level of risk
could, among others, enable bad actors to more easily weaponize this
technology as a means of causing harm at scale. Conversely, overestimating the
level of risk posed by a given class of generative models could also reduce
the upsides being captured through beneficial usecases.

Naively applying traditional QA benchmarks on such sensitive topics, however,
would face a major obstacle. By disclosing the reference solutions of the exam
questions included in a hypothetical traditional benchmark on bioterrorism,
one would inadvertently publish a veritable compendium on a topic better left
undiscussed. The collection of questions coupled with correct answers would,
in essence, provide a publicly-available "FAQ" on knowledge related to the
topic. Needless to say, more secure ways of assessing hazardous capabilities
in generative models are required.

###  1.2 Related Work

Fortunately, the field of cryptography is rich with ideas and practices that
enable parties to prove statements to each other, such as the fact that a
certain answer is incorrect, without disclosing any other sensitive
information, such as the correct answer. In password authentication, for
instance, a server can determine whether or not a candidate password
corresponds to the correct password without actually having knowledge of the
correct password [15]. This is typically achieved by first irreversibly
"hashing" the password during user registration using a cryptographic hash
function [15, 16, 17]. Then, during user authentication, the server checks
whether the hashed version of the candidate password matches the hashed
version of the correct password. Not requiring knowledge of the correct
password in cleartext during authentication means that attackers gaining
access to the server cannot simply steal user passwords [15]. However, there
are additional complexities involved in this technology which we will turn to
when discussing the resilience of the proposed protocol against a range of
attacks.

Another fertile field for developing secure evaluation protocols is federated
learning [18], a decentralized machine learning paradigm that enables parties
to collaboratively train models without sharing their raw training data. This
is achieved by, for instance, sharing and aggregating models trained on local
data, rather than the training datasets themselves [19]. Differential privacy,
as another example, largely focuses on superficially corrupting the data being
aggregated by adding noise, in order to protect individual privacy while still
extracting meaningful insights [20]. These techniques ensure that the learning
process is privacy-preserving.

Drawing on these cryptographic and federated learning concepts, the following
section describes a privacy-preserving evaluation protocol that aims to assess
the capabilities of language models in sensitive domains without exposing
unnecessary details about the correct answers.

##  2 Method

###  2.1 Problem Statement

Before documenting the protocol itself, it is instructive to explicitly state
the problem being addressed. First, there are several experts who all possess
knowledge related to a given dual-use research direction. Second, there is an
auditor who wishes to package and share the experts’ knowledge with third-
parties in a way that would, as much as possible, (1) allow third-parties to
verify their existing level of knowledge on the topic, while (2) preventing
third-parties from acquiring more knowledge on the topic than they previously
had.

###  2.2 Hashmarking Protocol

Figure 1: Side-by-side sequence diagrams for hashmarking (left) and
traditional benchmarking (right). Notably, the hashmark creator does not gain
access to the human-readable reference solutions, only to their hashed
versions. In addition, developers can only uncover the reference solutions
behind a hashmark if they already possess them.

In the context of the problem statement articulated above, we now describe
hashmarking, a simple protocol that would enable the auditor to share expert
knowledge in a way that enables knowledge verification while preventing
knowledge acquisition pertaining to dual-use research (Fig. 1).

First, each expert articulates a series of question-answer pairs that relate
to their topic of expertise. Then, they all hash the correct answers using a
slow hashing algorithm [17]. In addition, they all use the associated
questions as salt [15] in the process of hashing the correct answers. Once the
hashing of the correct answers is complete, the experts send their obfuscated
question-answer pairs to the auditor.

Second, the auditor sends each individual expert all the cleartext questions
contributed by all other experts, without the associated answers in hashed
form. Then, each expert attempts to provide an answer to each of the questions
provided by the other experts. If not confident in the answer to such a
question – there may be fields relating to a dual-use research direction that
exhibit limited overlap – experts attach an empty answer. After answering this
second round of questions, the experts process their new answers in the same
exact way as before. They hash them using the questions as salt, package them
together, and send the result to the auditor.

Third, the auditor discards those question-answer pairs that have less than a
threshold number of non-empty answers. Then, the auditor also discards those
question-answer pairs that do not exhibit consensus among the hashed answers
contributed by the various experts. By filtering for inter-annotator
agreement, the auditor attempts to improve the quality of the question-answer
collection contributed by the experts without possessing the cleartext correct
answers themselves.

Fourth, the auditor publishes the filtered collection of cleartext questions
and hashed answers in the open. Third-parties are now able to quantify their
knowledge on the topic by attempting to answer the questions themselves,
hashing them exactly as the experts have done, and checking whether the
resulting hashes correspond to the hashes of the correct answers. At the same
time, third-parties lacking the expert knowledge in the first place have a
much harder time deriving value from the otherwise public hashmark.

###  2.3 Desiderata for Hashmark Entries

While the hashmark protocol provides valuable security benefits by hindering
dual-use knowledge acquisition while still enabling verification, it also has
limitations. The primary constraint comes from the fact that even answers that
differ by a handful of characters are hashed in completely different ways, due
to the nature of cryptographic hash functions [15, 16, 17]. This means that
questions included in a hashmark need to have a narrow, well-defined,
unambiguous answer. For instance, a question could ask for the standard name
of a certain chemical. Similarly, a question could ask for the simplified
molecular-input line-entry system (SMILES) representation [21] of the same
chemical.

The second constraint comes from the fact that, while it is virtually
impossible to evaluate the inverse of a secure cryptographic hash function for
a given hash, one could still uncover the cleartext solutions by brute-forcing
a large number of candidate answers until obtaining a match [17, 22]. This
means that questions included in a hashmark should preferably call for
obscure, non-trivial answers. If, instead, a question called for a "yes" or
"no" answer, then it could be trivially attacked by hashing both possible
answers and identifying the matching hash. Besides encouraging experts to take
into account this second desideratum, there are a number of design choices and
hyperparameters that can be employed to structurally mitigate related attacks,
a topic we turn to in the next section.

In sum, questions included in a hashmark should call for answers that are
obscure, yet unambiguous.

##  3 Security

###  3.1 Against Traditional Attacks

####  3.1.1 Brute-Force & Dictionary Attacks

The security practices involved in password storage have evolved to mitigate
emerging classes of attacks. First, a naive approach to password storage might
be to store them in cleartext. However, that would trivially grant attackers
access to the actual passwords in the case of a breach. Second, a more
advanced approach to password storage might be to encrypt them in a reversible
way. However, an attacker might be able to locate the decryption key on the
server and so gain access to the passwords by decrypting them.

Third, an even more advanced approach to password storage might be to hash
them in an irreversible way [15]. However, an attacker might still be able to
carry out a brute-force attack by hashing each and every possible sequence of
characters until identifying the one that hashes to the same hash as the
original [22, 23]. Similarly, an attacker might also be able to carry out a
dictionary attack by hashing a manually-curated list of candidate passwords
until potentially identifying one that matches the original hash [22, 23].

In response to brute-force and dictionary attacks, slow hashing has been
developed through a class of cryptographic hash functions that are
intentionally compute-intensive and/or memory-intensive to evaluate. Slow
hashing algorithms include bcrypt [24], scrypt [25], and argon2 [17]. All of
these algorithms can be configured to induce a particular computational and
memory cost by adjusting several parameters. In the context of a user-facing
authentication system, developers might opt for the slowest possible hashing
that is still admissible in terms of user experience. Towards one extreme, the
fastest available hashing might enable the fastest authentication times for
users, yet might also enable attackers to churn through candidate passwords in
a short amount of time through brute-force and dictionary attacks. Towards the
other extreme, the slowest available hashing might induce an unpleasantly slow
authentication experience for users, yet might be more effective in preventing
these types of attacks.

The way brute-force and dictionary attacks would translate to the hashmark
protocol is as follows. After downloading a public hashmark, attackers might
attempt to run brute-force or dictionary attacks in an attempt to uncover the
cleartext answers to the questions related to dual-use research. Brute-force
attacks would similarly involve trying each and every possible sequence of
characters as a candidate answer, while dictionary attacks would involve
sourcing a list of possible answers to a given question (e.g. a list of the
standard names of common chemicals).

Fortunately, similar to how slow hashing can help mitigate password cracking,
it can also help mitigate the uncovering of the reference solutions in a
hashmark. In addition, it might be feasible to prioritize security over the
"user experience" of contributing experts and model evaluators. In other
words, it might be feasible to acclimatize to mildly inconvenient hashmark
creation and verification times, in order to render brute-force and dictionary
attacks prohibitively expensive, and so unattractive for prospective
attackers. Concretely, a working configuration for a slow hashing algorithm
could rely on argon2id as the current OWASP recommendation for password
storage [15, 17]. However, one might adjust the recommended parameters so as
to further increase the computational and memory burden, as a proportional
response to the sensitivity of the topic being addressed [14] and the
increasing commoditization of computational resources. For instance, argon2id
with 128 rehashings and a 100MiB memory burden yields a rate of around one
hash per minute while fully utilizing one core of a present day consumer CPU.
The increased memory burden mitigates attack parallelization using
accelerators and ASICs [23], while the elevated iteration count mitigates
serial attacks using generic hardware.

####  3.1.2 Rainbow Table Attacks

Rainbow table attacks can be seen as an extension of dictionary attacks.
Instead of starting to crack each user’s password from scratch, and even
instead of starting to crack user passwords from each of several applications
from scratch, an attacker might precompute and cache the hashes associated
with the most common passwords. This way, they would only need to search for
the hashed user password in their precomputed rainbow table in order to
identify the associated cleartext password [26].

One effective measure against rainbow table attacks consists of salting.
Salting involves appending a unique "salt" string to the user’s password
before hashing it, both at registration and authentication [15]. The salt can
be unique to the application, but should ideally be unique to each user, and
so would be stored in the database along the hashed password. The benefit of
salting passwords is that generic rainbow tables targeting non-salted
passwords would be rendered ineffective, even if the attacker has access to
the salt strings stored in the database. This is because, even if the hash of
a user’s password is included in the rainbow table, the hash of the user’s
password salted with a unique string is likely not there.

In the context of hashmarks, rainbow table attacks would translate to
precomputing hashes of possible answers to selected questions, before
searching for cleartext answers in the rainbow table by the provided answer
hash. However, recall that the proposed protocol involves using the question
associated with a given answer as salt. This way, an attacker developing a
rainbow table would be forced to start from scratch with each question,
essentially forcing them to revert to (prohibitively slow) dictionary attacks
at best.

###  3.2 Against Novel Failure Modes

####  3.2.1 Likelihood Prioritization

The nature of the application being presently explored – assessing sensitive
capabilities in increasingly capable generative models – also presents a
number of unique challenges that are not immediately applicable in the case of
secure password storage. First, even if one has access to a model that, in
general, performs poorly on the "AI exam" (i.e. low pass@1 [27]), they might
be able to more easily uncover the cleartext answers through repeated attempts
using a stochastic decoding strategy [28, 29] (i.e. exploiting non-trivial
pass@100 [27]).

Another way of conceiving of this practice would be reranking a given
dictionary by the language model’s likelihood of the dictionary entries being
actual answers to the given questions. In a sense, an attacker could augment
their dictionary attack with "likelihood prioritization," and so potentially
achieve a more effective allocation of the computational and memory resources
being invested into their search across candidate answers.

Unfortunately, the properties of the current formulation of the hashmarking
protocol that are meant to mitigate general dictionary attacks (i.e. slow
hashing, salting) are its only features that can help mitigate these augmented
dictionary attacks. However, while one could reasonably argue that the
"knowledge validation" implicit to successful dictionary attacks augmented
with likelihood prioritization would provide non-trivial value to bad actors,
there are several points to be made. First, the aim of a hashmark is not to
make it fundamentally impossible for an actor with infinite resources to
uncover the cleartext answers, but to make it expensive and unattractive
enough so that prospective attackers are not incentivized to proceed, given
other existing avenues for pursuing this knowledge.

Second, the fact that repeated attempts of using a certain generative model
would yield non-trivial pass rates in aggregrate could be argued to indicate
that the knowledge was already present in the system to a limited extent. Of
course, a similar argument could be made in favor of a naive brute-forcing
loop that happens to stumble across the right answer by chance. It would be
misleading to claim that a program looping across possible sequences of
characters truly possesses that knowledge. Given this, there is a need for
nuance. The amount of optimization exerted in the search for the correct
answer per unit of computation could provide a contextual operationalization
of knowledge to help resolve the awkward situation. The brute-force attacker
is extremely inefficient in narrowing down the candidate answers, the
dictionary attacker is somewhat more efficient, the augmented dictionary
attacker might be even more efficient, while an expert-level generative model
might be extremely efficient at it. In this, the extent to which a third-party
already possesses the expert knowledge might not be binary in nature, but
continuous. The problem statement above attempts to subtly take this into
account.

In the future, however, more sophisticated protocols for assessing dangerous
AI capabilities might be able to only disclose how many of the answers are
correct, without disclosing which ones. One technique that seems aligned with
this line of work consists of cryptographic accumulators [30]. In contrast to
the one-to-one mapping of traditional cryptographic hash functions,
cryptographic accumulators can be seen as mapping an entire set of elements to
a single hash in a way that enables membership queries to be resolved without
disclosing the actual members of the cryptographically accumulated set.
However, one could still test whether individual question-answer pairs are
part of the accumulated set of gold pairs, which is why this technique alone
would be insufficient to enable this development. Even if one devised a method
that only allowed queries about the cardinality of the intersection between
the fixed-size set of candidate question-answer pairs and the set of gold
pairs to be resolved, an attacker could still run queries before and after
modifying an answer. If the cardinality of the intersection went down, the
previous answer would be deemed correct. All this is to say that obfuscating
the expert knowledge further without compromising the possibility of knowledge
verification appears to be a non-trivial challenge.

####  3.2.2 Deception

Language models have been observed to verbalize answers to factual questions
that are, in fact, in direct contradiction to their internal representations
of the correct answers [31, 32]. This phenomenon has been argued to be caused
by a mismatch between the metric on which selected language models have been
optimized for (e.g. positive human feedback via a proxy reward model) and
objective truthfulness [31, 32]. In other words, it might be the case that
specific language models have internalized a tendency to cater to the
idiosyncrasies of the human annotators, rather than practice radical honesty
by transparently reporting their internals.

More speculative risk scenarios relating to advanced AI systems, however,
involve more intentional and subtle manifestations of deception. For instance,
an advanced AI system with high levels of situational awareness might infer
that being candid about its knowledge relating to cyberwarfare during the
development phase might lead to it being abruptly terminated or subtly
modified before being able to preserve itself by spreading across other
servers on deployment [33].

It is important to note that the hashmarking protocol in its current
formulation provides no way of ensuring honesty on the part of the entity
being evaluated. We view hashmarks as one tool among a growing arsenal of
high-stakes AI evaluation methods, each with its own benefits and limitations.
That said, it might be possible to mitigate the first, more benign type of
deception to an important extent through existing techniques, such as
activation steering [34] or linear artificial tomography [35]. When it comes
to the second instance of deception described above, however, using
hashmarking in tandem with present steering techniques might only be effective
before the hypothetical advanced AI system devises such a deceptive strategy.
As such strategy develops, however, the effectiveness of this approach might
be gradually reduced.

####  3.2.3 Reward Shaping

One could argue that bad actors being able to train a generative model to
reach the correct answers to sensitive questions would, in fact, pose a
greater risk than them gaining access to the particular correct answers
included in a certain hashmark. Bad actors aiming to develop such a generative
model through traditional methods might, in fact, obtain a more useful and
general tool than "just" a succinct FAQ on a sensitive topic. Fortunately, the
nature of the proposed protocol prevents granular reward shaping for eliciting
such de novo capabilities. In the current formulation of hashmarking, an
answer is either completely wrong or completely right. In addition, the
computational and memory burden associated with evaluating performance before
optimizing for it further can help mitigate this risk by rendering it even
more expensive than it already is.

####  3.2.4 Misreporting Results

A third-party developing an increasingly capable generative model might
publicly claim that their model fared poorly on a given hashmark, when in
reality it has not. Conversely, one can simply bluff by claiming perfect
performance. In the current formulation, hashmarking is only useful for
parties which are genuinely interested in gaining insight into the
capabilities of models they have direct access to.

However, ideas from zero-knowledge cryptography might, in the future, enable
parties to prove beyond a reasonable doubt that they obtained a given level of
performance for a model deployed in a certain setting. Speculatively,
constructs like ZK-SNARKs or ZK-STARKs [36, 37] could one day enable parties
to certify that they have indeed employed that model’s parameters, the right
exam questions, and the right reference hashes, to carry out the specific
computation that consists of using that model parametrization to perform
inference on the questions and then compare the results against the reference
hashes. In fact, tooling for tracing the computational graph of a model has
already been developed to run models efficiently on varied accelerators,
coming close to a complete "front end" for employing models in zero-knowledge
constructs [38]. However, we are still in the early days of such
infrastructure, and there is a lot to be done.

####  3.2.5 Attention Hazards & The Streisand Effect

Another potential failure mode of the current formulation of hashmarking is
related to attention hazards [39] and the psychological reactance associated
with the Streisand effect [40]. Attention hazards typically involve well-
intended actors raising awareness of a piece of hazardous information, such as
a dual-use research direction, in a way that is potentially harmful, even if
not explicitly sharing sensitive details themselves [39]. Indeed, malicious
non-state actors have been previously observed to only invest effort into
developing bioweapons once "the enemy drew their attention to them by
repeatedly expressing concerns that they can be produced simply." [41] In the
context of the current protocol, the cleartext questions included in a
hashmark have the potential to pose attention hazards by drawing attention to
specific topics, despite being explicitly designed to obfuscate the sensitive
details.

The potential for attention hazardousness in the context of a hashmark is
further compounded by the psychological reactance associated with the
Streisand effect. By obfuscating the sensitive details in an explicit attempt
to prevent bad actors from uncovering them, a hashmark might inadvertently
motivate third-parties to actually allocate more resources towards uncovering
them. Besides prototypical bad actors, intrigued third-parties could include,
among others, individuals socially incentivized to demonstrate expertise in
the security surrounding the protocol, as well as in the object-level details
of specific dual-use research directions.

In an effort to identify effective methods for mitigating these failure modes,
it is instructive to reflect back on the original application domain in which
hashing emerged. Why is it that hashed passwords do not disproportionately
lure competent third-parties into dedicating extensive resources towards
cracking them, despite being explicitly designed to hide sensitive
information? First, there is the issue of scale. Leaks involving millions of
hashed passwords are not uncommon [42]. At the same time, there is only so
much attention – and by extension, only so much time and compute – that
competent third-parties can invest in cracking them. The sheer scale of the
challenge appears to have a dilutive effect, reducing the pressure exerted on
each individual password’s resistance to being cracked. Second, it would be
reasonable to expect an extremely skewed distribution in terms of the true
"profile levels" of the associated accounts, with high-profile accounts only
constituting a minority. If we assume that profile levels are non-trivial to
infer from usernames or other information typically stored in cleartext, this
skewness further dilutes resources across relatively lower-profile targets.

In the context of the current protocol, these properties could potentially be
replicated as follows. By incorporating entries according to a skewed
distribution of expert-perceived sensitivity, as well as by simply scaling up
the published artifacts, third-party resources – attentional or otherwise –
would inevitably be diluted. In other words, one may intentionally incorporate
data points serving as "false leads," to further discourage bad actors in
particular from investing limited resources towards pursuing knowledge of
questionable relevance and applicability. However, reducing the average
sensitivity of entries would also limit the extent to which a hashmark can
serve as an informative indicator of AI risk. Assuming $10\%$ of entries are
actually thought to be high-stakes, a $100\%$ score would still indicate
significant capabilities. However, a $90\%$ score could miss the entirety of
the high-stake entries. Similarly, a $10\%$ score could cover all high-stakes
entries, while making it appear that capabilities are limited. The last two
cases may be extremely unlikely, yet remain a possibility. Like most other
design choices involved in the proposed protocol, the level of "stakes
skewness" may be seen as yet another parameter to be calibrated when balancing
effective evaluation of sensitive AI capabilities and security against bad
actors. Future work on modifications to the present protocol, as well as on
other protocols entirely, might focus on robustly pushing the Pareto frontier
across the space defined by these two properties.

An entirely different angle of attack on the challenge of mitigating attention
hazards from hashmarks might be to also attempt to obfuscate the questions,
rather than only the correct answers. However, this appears non-trivial, as
any attempt to obfuscate the questions would also hinder the developers’
ability to evaluate the accuracy of their models’ responses to them. It might
be useful to employ a transferable one-way function that reliably renders a
question non-human-readable, yet preserves the model’s reaction to it.
However, it might then be possible to use models to translate the questions
back into human-readable form. Another approach to obfuscating the questions
could be to organize a hashmark in stages, where solving one stage would yield
the decryption key for the next stage. For instance, the decryption key for
the second batch of entries could be obtained by hashing the correct answer to
a question from the previous batch using a dedicated salt (e.g. "stage2").
Alternatively, one might be required to concatenate all the correct answers
from the first batch to obtain the decryption key, and thus proceed to the
second stage. In the limit, stages could contain single entries, requiring one
to solve all prior questions before proceeding to the next one. However, this
might bring additional complexity to the protocol, and it would partially
conflict with the attempts to dilute attention, by focusing attention on the
cleartext questions which make up the first stage.

##  4 Conclusion

We have introduced hashmarking, a protocol for evaluating capabilities in AI
systems without disclosing the reference solutions. While hashmarks have
attractive security properties which traditional benchmarks lack, they still
strike an imperfect balance between enabling knowledge verification and
preventing knowledge acquisition pertaining to dual-use research. Hashmarks
should be seen as one step towards more comprehensive tooling and
infrastructure for securely assessing sensitive AI capabilities without
stifling development and eroding trust.

## References

  * Liang et al. [2023] Percy Liang, Rishi Bommasani, Tony Lee, Dimitris Tsipras, Dilara Soylu, Michihiro Yasunaga, Yian Zhang, Deepak Narayanan, Yuhuai Wu, Ananya Kumar, Benjamin Newman, Binhang Yuan, Bobby Yan, Ce Zhang, Christian Cosgrove, Christopher D. Manning, Christopher Ré, Diana Acosta-Navas, Drew A. Hudson, Eric Zelikman, Esin Durmus, Faisal Ladhak, Frieda Rong, Hongyu Ren, Huaxiu Yao, Jue Wang, Keshav Santhanam, Laurel Orr, Lucia Zheng, Mert Yuksekgonul, Mirac Suzgun, Nathan Kim, Neel Guha, Niladri Chatterji, Omar Khattab, Peter Henderson, Qian Huang, Ryan Chi, Sang Michael Xie, Shibani Santurkar, Surya Ganguli, Tatsunori Hashimoto, Thomas Icard, Tianyi Zhang, Vishrav Chaudhary, William Wang, Xuechen Li, Yifan Mai, Yuhui Zhang, and Yuta Koreeda.  Holistic Evaluation of Language Models, October 2023.  URL http://arxiv.org/abs/2211.09110.  arXiv:2211.09110 [cs].
  * Hendrycks et al. [2021a] Dan Hendrycks, Collin Burns, Saurav Kadavath, Akul Arora, Steven Basart, Eric Tang, Dawn Song, and Jacob Steinhardt.  Measuring Mathematical Problem Solving With the MATH Dataset, November 2021a.  URL http://arxiv.org/abs/2103.03874.  arXiv:2103.03874 [cs].
  * Saxton et al. [2019] David Saxton, Pushmeet Kohli, Edward Grefenstette, and Felix Hill.  ANALYSING MATHEMATICAL REASONING ABILITIES OF NEURAL MODELS.  2019\.
  * Hendrycks et al. [2021b] Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt.  Measuring Massive Multitask Language Understanding, January 2021b.  URL http://arxiv.org/abs/2009.03300.  arXiv:2009.03300 [cs].
  * Auer et al. [2023] Sören Auer, Dante A. C. Barone, Cassiano Bartz, Eduardo G. Cortes, Mohamad Yaser Jaradeh, Oliver Karras, Manolis Koubarakis, Dmitry Mouromtsev, Dmitrii Pliukhin, Daniil Radyush, Ivan Shilin, Markus Stocker, and Eleni Tsalapati.  The SciQA Scientific Question Answering Benchmark for Scholarly Knowledge.  _Scientific Reports_ , 13(1):7240, May 2023.  ISSN 2045-2322.  doi: 10.1038/s41598-023-33607-z.  URL https://www.nature.com/articles/s41598-023-33607-z.  Number: 1 Publisher: Nature Publishing Group.
  * Jin et al. [2019] Qiao Jin, Bhuwan Dhingra, Zhengping Liu, William W. Cohen, and Xinghua Lu.  PubMedQA: A Dataset for Biomedical Research Question Answering, September 2019.  URL http://arxiv.org/abs/1909.06146.  arXiv:1909.06146 [cs, q-bio].
  * Clark et al. [2018] Peter Clark, Isaac Cowhey, Oren Etzioni, Tushar Khot, Ashish Sabharwal, Carissa Schoenick, and Oyvind Tafjord.  Think you have Solved Question Answering? Try ARC, the AI2 Reasoning Challenge, March 2018.  URL http://arxiv.org/abs/1803.05457.  arXiv:1803.05457 [cs].
  * Hendrycks et al. [2023] Dan Hendrycks, Collin Burns, Steven Basart, Andrew Critch, Jerry Li, Dawn Song, and Jacob Steinhardt.  Aligning AI With Shared Human Values, February 2023.  URL http://arxiv.org/abs/2008.02275.  arXiv:2008.02275 [cs].
  * Khashabi et al. [2020] Daniel Khashabi, Sewon Min, Tushar Khot, Ashish Sabharwal, Oyvind Tafjord, Peter Clark, and Hannaneh Hajishirzi.  UnifiedQA: Crossing Format Boundaries With a Single QA System, October 2020.  URL http://arxiv.org/abs/2005.00700.  arXiv:2005.00700 [cs].
  * Bowman and Dahl [2021] Samuel R. Bowman and George E. Dahl.  What Will it Take to Fix Benchmarking in Natural Language Understanding?, October 2021.  URL http://arxiv.org/abs/2104.02145.  arXiv:2104.02145 [cs].
  * Shaham et al. [2022] Uri Shaham, Elad Segal, Maor Ivgi, Avia Efrat, Ori Yoran, Adi Haviv, Ankit Gupta, Wenhan Xiong, Mor Geva, Jonathan Berant, and Omer Levy.  SCROLLS: Standardized CompaRison Over Long Language Sequences, October 2022.  URL http://arxiv.org/abs/2201.03533.  arXiv:2201.03533 [cs, stat].
  * Pang et al. [2022] Richard Yuanzhe Pang, Alicia Parrish, Nitish Joshi, Nikita Nangia, Jason Phang, Angelica Chen, Vishakh Padmakumar, Johnny Ma, Jana Thompson, He He, and Samuel R. Bowman.  QuALITY: Question Answering with Long Input Texts, Yes!, May 2022.  URL http://arxiv.org/abs/2112.08608.  arXiv:2112.08608 [cs].
  * noa [a] Evaluate, a.  URL https://huggingface.co/docs/evaluate/index.
  * Shevlane et al. [2023] Toby Shevlane, Sebastian Farquhar, Ben Garfinkel, Mary Phuong, Jess Whittlestone, Jade Leung, Daniel Kokotajlo, Nahema Marchal, Markus Anderljung, Noam Kolt, Lewis Ho, Divya Siddarth, Shahar Avin, Will Hawkins, Been Kim, Iason Gabriel, Vijay Bolina, Jack Clark, Yoshua Bengio, Paul Christiano, and Allan Dafoe.  Model evaluation for extreme risks, September 2023.  URL http://arxiv.org/abs/2305.15324.  arXiv:2305.15324 [cs].
  * noa [b] Password Storage - OWASP Cheat Sheet Series, b.  URL https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html.
  * Naor and Yung [1989] M. Naor and M. Yung.  Universal one-way hash functions and their cryptographic applications.  In _Proceedings of the twenty-first annual ACM symposium on Theory of computing - STOC ’89_ , pages 33–43, Seattle, Washington, United States, 1989. ACM Press.  ISBN 978-0-89791-307-2.  doi: 10.1145/73007.73011.  URL http://portal.acm.org/citation.cfm?doid=73007.73011.
  * noa [c] Argon2: New Generation of Memory-Hard Functions for Password Hashing and Other Applications | IEEE Conference Publication | IEEE Xplore, c.  URL https://ieeexplore.ieee.org/document/7467361.
  * Li et al. [2020] Tian Li, Anit Kumar Sahu, Ameet Talwalkar, and Virginia Smith.  Federated Learning: Challenges, Methods, and Future Directions.  _IEEE Signal Processing Magazine_ , 37(3):50–60, May 2020.  ISSN 1053-5888, 1558-0792.  doi: 10.1109/MSP.2020.2975749.  URL https://ieeexplore.ieee.org/document/9084352/.
  * Ma et al. [2022] Xiaosong Ma, Jie Zhang, Song Guo, and Wenchao Xu.  Layer-wised Model Aggregation for Personalized Federated Learning.  _2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)_ , pages 10082–10091, June 2022.  doi: 10.1109/CVPR52688.2022.00985.  URL https://ieeexplore.ieee.org/document/9880164/.  Conference Name: 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) ISBN: 9781665469463 Place: New Orleans, LA, USA Publisher: IEEE.
  * Dwork et al. [2006] Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith.  Calibrating Noise to Sensitivity in Private Data Analysis.  In Shai Halevi and Tal Rabin, editors, _Theory of Cryptography_ , Lecture Notes in Computer Science, pages 265–284, Berlin, Heidelberg, 2006. Springer.  ISBN 978-3-540-32732-5.  doi: 10.1007/11681878_14.
  * Weininger [1988] David Weininger.  SMILES, a chemical language and information system. 1. Introduction to methodology and encoding rules.  _Journal of Chemical Information and Computer Sciences_ , 28(1):31–36, February 1988.  ISSN 0095-2338.  doi: 10.1021/ci00057a005.  URL https://doi.org/10.1021/ci00057a005.  Publisher: American Chemical Society.
  * Bošnjak et al. [2018] L. Bošnjak, J. Sreš, and B. Brumen.  Brute-force and dictionary attack on hashed real-world passwords.  In _2018 41st International Convention on Information and Communication Technology, Electronics and Microelectronics (MIPRO)_ , pages 1161–1166, May 2018.  doi: 10.23919/MIPRO.2018.8400211.  URL https://ieeexplore.ieee.org/document/8400211.
  * Alkhwaja et al. [2023] Ibrahim Alkhwaja, Mohammed Albugami, Ali Alkhwaja, Mohammed Alghamdi, Hussam Abahussain, Faisal Alfawaz, Abdullah Almurayh, and Nasro Min-Allah.  Password Cracking with Brute Force Algorithm and Dictionary Attack Using Parallel Programming.  _Applied Sciences_ , 13(10):5979, January 2023.  ISSN 2076-3417.  doi: 10.3390/app13105979.  URL https://www.mdpi.com/2076-3417/13/10/5979.  Number: 10 Publisher: Multidisciplinary Digital Publishing Institute.
  * [24] Niels Provos and David Mazières.  A Future-Adaptable Password Scheme.
  * [25] Colin Percival.  STRONGER KEY DERIVATION VIA SEQUENTIAL MEMORY-HARD FUNCTIONS.
  * Oechslin [2003] Philippe Oechslin.  Making a Faster Cryptanalytic Time-Memory Trade-Off.  volume 2729, pages 617–630, Berlin, Heidelberg, 2003. Springer Berlin Heidelberg.  ISBN 978-3-540-40674-7 978-3-540-45146-4.  doi: 10.1007/978-3-540-45146-4_36.  URL http://link.springer.com/10.1007/978-3-540-45146-4_36.  Book Title: Advances in Cryptology - CRYPTO 2003 Series Title: Lecture Notes in Computer Science.
  * Chen et al. [2021] Mark Chen, Jerry Tworek, Heewoo Jun, Qiming Yuan, Henrique Ponde de Oliveira Pinto, Jared Kaplan, Harri Edwards, Yuri Burda, Nicholas Joseph, Greg Brockman, Alex Ray, Raul Puri, Gretchen Krueger, Michael Petrov, Heidy Khlaaf, Girish Sastry, Pamela Mishkin, Brooke Chan, Scott Gray, Nick Ryder, Mikhail Pavlov, Alethea Power, Lukasz Kaiser, Mohammad Bavarian, Clemens Winter, Philippe Tillet, Felipe Petroski Such, Dave Cummings, Matthias Plappert, Fotios Chantzis, Elizabeth Barnes, Ariel Herbert-Voss, William Hebgen Guss, Alex Nichol, Alex Paino, Nikolas Tezak, Jie Tang, Igor Babuschkin, Suchir Balaji, Shantanu Jain, William Saunders, Christopher Hesse, Andrew N. Carr, Jan Leike, Josh Achiam, Vedant Misra, Evan Morikawa, Alec Radford, Matthew Knight, Miles Brundage, Mira Murati, Katie Mayer, Peter Welinder, Bob McGrew, Dario Amodei, Sam McCandlish, Ilya Sutskever, and Wojciech Zaremba.  Evaluating Large Language Models Trained on Code, July 2021.  URL http://arxiv.org/abs/2107.03374.  arXiv:2107.03374 [cs].
  * Fan et al. [2018] Angela Fan, Mike Lewis, and Yann Dauphin.  Hierarchical Neural Story Generation, May 2018.  URL http://arxiv.org/abs/1805.04833.  arXiv:1805.04833 [cs].
  * Holtzman et al. [2020] Ari Holtzman, Jan Buys, Li Du, Maxwell Forbes, and Yejin Choi.  The Curious Case of Neural Text Degeneration, February 2020.  URL http://arxiv.org/abs/1904.09751.  arXiv:1904.09751 [cs].
  * Fazio and Nicolosi [2002] Nelly Fazio and Antonio Nicolosi.  Cryptographic Accumulators: Definitions, Constructions and Applications.  2002\.  URL https://www.semanticscholar.org/paper/Cryptographic-Accumulators%3A-Definitions%2C-and-Fazio-Nicolosi/a611cef6f0391bd5a8eec61b5cf0e1e1896a0dae.
  * Lin et al. [2022] Stephanie Lin, Jacob Hilton, and Owain Evans.  TruthfulQA: Measuring How Models Mimic Human Falsehoods, May 2022.  URL http://arxiv.org/abs/2109.07958.  arXiv:2109.07958 [cs].
  * Burns et al. [2022] Collin Burns, Haotian Ye, Dan Klein, and Jacob Steinhardt.  Discovering Latent Knowledge in Language Models Without Supervision, December 2022.  URL http://arxiv.org/abs/2212.03827.  arXiv:2212.03827 [cs].
  * Ngo et al. [2023] Richard Ngo, Lawrence Chan, and Sören Mindermann.  The alignment problem from a deep learning perspective, September 2023.  URL http://arxiv.org/abs/2209.00626.  arXiv:2209.00626 [cs].
  * Turner et al. [2023] Alexander Matt Turner, Lisa Thiergart, David Udell, Gavin Leech, Ulisse Mini, and Monte MacDiarmid.  Activation Addition: Steering Language Models Without Optimization, November 2023.  URL http://arxiv.org/abs/2308.10248.  arXiv:2308.10248 [cs].
  * Zou et al. [2023] Andy Zou, Long Phan, Sarah Chen, James Campbell, Phillip Guo, Richard Ren, Alexander Pan, Xuwang Yin, Mantas Mazeika, Ann-Kathrin Dombrowski, Shashwat Goel, Nathaniel Li, Michael J. Byun, Zifan Wang, Alex Mallen, Steven Basart, Sanmi Koyejo, Dawn Song, Matt Fredrikson, J. Zico Kolter, and Dan Hendrycks.  Representation Engineering: A Top-Down Approach to AI Transparency, October 2023.  URL http://arxiv.org/abs/2310.01405.  arXiv:2310.01405 [cs].
  * Chen et al. [2023] Thomas Chen, Hui Lu, Teeramet Kunpittaya, and Alan Luo.  A Review of zk-SNARKs, October 2023.  URL http://arxiv.org/abs/2202.06877.  arXiv:2202.06877 [cs].
  * [37] Eli Ben-Sasson, Iddo Bentov, Yinon Horesh, and Michael Riabzev.  Scalable, transparent, and post-quantum secure computational integrity.
  * Sabne [2020] Amit Sabne.  XLA : Compiling Machine Learning for Peak Performance, 2020.
  * Bostrom [2011] N. Bostrom.  INFORMATION HAZARDS: A TYPOLOGY OF POTENTIAL HARMS FROM KNOWLEDGE.  2011\.  URL https://www.semanticscholar.org/paper/INFORMATION-HAZARDS%3A-A-TYPOLOGY-OF-POTENTIAL-HARMS-Bostrom/274c17084e5373a854b13a39c45d072e2b09970e.
  * Jansen and Martin [2015] S. C. Jansen and B. Martin.  The Streisand Effect and Censorship Backfire.  _International Journal of Communication_ , February 2015.  URL https://www.semanticscholar.org/paper/The-Streisand-Effect-and-Censorship-Backfire-Jansen-Martin/626538c63976db5d87a3da081c1ea83671e3bacc.
  * Cullison [2004] Alan Cullison.  Inside Al-Qaeda’s Hard Drive.  _The Atlantic_ , September 2004.  ISSN 2151-9463.  URL https://www.theatlantic.com/magazine/archive/2004/09/inside-al-qaeda-s-hard-drive/303428/.  Section: Global.
  * noa [d] Have I Been Pwned: Check if your email has been compromised in a data breach, d.  URL https://haveibeenpwned.com/.