# Resilience of Autonomous Vehicle Object Category Detection to Universal
Adversarial Perturbations

Mohammad Nayeem Teli  Department of Computer Science
University of Maryland
College Park, Maryland 20740
Seungwon Oh  Department of Electrical and Computer Engineering
University of Maryland
College Park, MD 20740

###### Abstract

Due to the vulnerability of deep neural networks to adversarial examples,
numerous works on adversarial attacks and defenses have been burgeoning over
the past several years. However, there seem to be some conventional views
regarding adversarial attacks and object detection approaches that most
researchers take for granted. In this work, we bring a fresh perspective on
those procedures by evaluating the impact of universal perturbations on object
detection at a class-level. We apply it to a carefully curated dataset related
to autonomous driving. We use Faster-RCNN object detector on images of five
different categories: person, car, truck, stop sign and traffic light from the
COCO dataset, while carefully perturbing the images using Universal Dense
Object Suppression algorithm. Our results indicate that person, car, traffic
light, truck and stop sign are resilient in that order (most to least) to
universal perturbations. To the best of our knowledge, this is the first time
such a ranking has been established which is significant for the security of
the datasets pertaining to autonomous vehicles and object detection in
general.

††publicationid: pubid: 978-1-6654-4067-7/21/$31.00 ©2021 IEEE

##  I Introduction

In an autonomous vehicle set up we can categorize the interactions between
various components based on the interactions of a vehicle and one or more of
the following: landscape (e.g., roads, barriers, buildings, trees etc.), other
automobiles, people, and road signs. Autonomous vehicles often recognize each
of these categories through the use of Machine Learning models for object
detection. While objection detection techniques have made a huge progress, so
have the various adversarial attacks, as explained in the next few sections.
Most of the studies have heavily concentrated on the techniques of adversarial
attacks and the means of making them more and more efficient in breaking the
object detector. A lot of research has also concentrated on defense
approaches. However, there is very limited or no research done to empirically
understand robustness of each individual object category. In this work, we
mostly concentrate on specific object categories and their ability to
withstand adversarial attacks.

More specifically, we answer questions like, is it more difficult to recognize
a person in comparison to a car when an object detector is subjected to
universal perturbations? It is very important to understand the impact of such
adversarial attacks at a category level so that targeted efforts could be made
to address such weaknesses in object detection. Also, different object
categories have different features and understanding the affects on them
individually would enable us to build systems that can encompass methods to
overcome the weaknesses of an object detector.

Due to the vulnerability of deep neural networks to adversarial examples,
adversarial attacks have been receiving huge attention over the past several
years [1]. In the context of the adversarial attacks, universal perturbations
research has also received a lot of interest [2] since it is much more
efficient and transferable than image-specific attacks. However, most of it is
directed toward image classification and not much toward object detection [3].
More importantly, we observed that there are two conventions that most work on
adversarial attacks seem to be holding on: evaluation of adversarial attacks
on all (1) classes and (2) images.

In this paper, we address issues pertaining to the impact of dataset curation
and its need, and, the effect of universal perturbations on individual
categories of objects. First of all, we question whether the experiments on
adversarial attacks have been measuring their impact rigorously, for instance,
quantified by the fooling rate (the proportion of images that change labels
when perturbed by our universal perturbation). Many experiments have been
naively using the whole dataset which may lead to assessing the effect of an
attack in a more optimistic way. It is owing to the fact that the object
detector may already have some incorrect predictions on some of the images in
the first place, regardless of the perturbation. The number of those images
could be quite high. This is supported by the fact that the mAPs on many
datasets are still not high enough to ensure this even on clean images, for
example, the COCO AP for the state-of-the-art object detector is still less
than 60. Thus, we argue that those examples should not be counted as an
example of a successful attack and also be removed from the dataset to prevent
dataset bias from the evaluation.

Secondly, we also observed that there is less research toward understanding
the impact of universal perturbations on specific categories related to
autonomous driving. Most of the experiments and evaluations are conducted
while including all the classes in a dataset. This may widen the gap between
understanding the effect of universal perturbations in general. In more
specific applications a successful adversarial attack may perform differently
in the self-driving car domain. Given that deep learning has various
applications beyond just self-driving cars, we need to also consider
evaluating adversarial attacks at a class-specific level and compare which
attack is more deadly to a specific problem, and not just in general. To those
who are closely related to the domain, this could have more meaningful
implications rather than a general evaluation on a general-purpose dataset. In
the context of autonomous vehicles, we would like our system to be more
reliable, and robust to attacks on the person class than may be those on stop
signs. This is due to the fact that the consequences for a vehicle to crash
into a person in comparison to a stop sign is vastly different.

In this work, we incorporate dataset curation and class-level evaluation of
robustness into experimental framework. We present a rigorous evaluation on
the impact of universal perturbations on detecting specifically five object
categories related to autonomous vehicles: person, stop sign, car, truck and
traffic light. We run a series of controlled experiments by perturbing images
of these categories using universal perturbations. Finally, we rank the
vulnerability of detecting each object category by calculating the metrics for
each object category individually and compare them.

We summarize the main contributions of this paper as follows: (1) firstly, we
demonstrate the vulnerability of object detectors in detecting autonomous
vehicle-related categories to universal perturbations. This is achieved using
a simple iterative method of using the gradient of soft-max output with
respect to input image and perturbation, (2) secondly, we establish a class-
level vulnerability ranking with regards to adversarial attacks, and (3)
thirdly, we isolate the impact of adversarial perturbations. This is done by
including only those images wherein the detector correctly predicted at least
one of the designated classes.

##  II Related Works

###  II-A Adversarial Attacks on Object Detection

Deep Neural Networks are ubiquitous in today’s world within and outside the
lab that have been built to alter the way applications are run. Its impact can
be seen all around us. However, it does not come without its pitfalls. They
are susceptible to adversarial attacks [4][5][6][7]. This is a result of many
noise injection techniques that cause failure in object detection and
classification. Kurakin et al. [8] specifically demonstrated the attacks on
autonomous vehicles wherein the traffic signs were manipulated.

Object detection in images, specifically related to autonomous vehicles, that
is the focus of this work, come under adversarial attacks as well [9].
Adversarial examples are generated to be similar to the actual data,
$\mathbb{D}$, with the goal of a mis-classification. Consider a classification
function, $f$ that correctly classifies an image, $x$, with a label $y$, and
$x^{\prime}$ gets incorrectly classified with a label $\hat{y}$:
$\arg\min_{\eta}f(x+\eta)=\hat{y}$. According to Szegedy et al. [4] we can
solve the following optimization problem to find the perturbation,

$\min_{x^{\prime}}||x^{\prime}-x||_{p},\hskip 28.90755pts.t.\hskip
7.22743ptf(x^{\prime})=\hat{y}$

where $||.||_{p}$ is a distance defined on the metric space $X$. The most
commonly used distance metric for object recognition in adversarial attacks is
the $p$-norm:

$||x||_{p}=\bigg{(}\sum\limits_{i=1}^{n}|x_{i}|^{p}\bigg{)}^{1/p},$

where $p\in\\{0,2,\infty\\}$. According to Serban et al. [9] the choice of $p$
is picked as follows:

  * •

$p=0$ measures the dissimilarity in coordinates between the perturbed and
original images with regards to the number of pixels altered in the original
image.

  * •

$p=2$ measures the Euclidean distance between the original and the adversarial
image.

  * •

$p=\infty$ measures the maximum bound for altering each pixel in an image
without restricting the number of changed pixels.

Deng et al. [10] presented an analysis of adversarial attacks on autonomous
driving models using five adversarial attacks and four defense methods on
three driving models and found them to be vulnerable. Sharma et al. [11]
demonstrated the vulnerability of the machine learning models of autonomous
vehicles in their failure of detecting adversarial attacks.

###  II-B Universal Adversarial Perturbation

The attacks explained above are mostly image-specific, However, a much
stronger class of adversarial attacks, called universal attack generates a
single adversarial example to mis-classify all images in the dataset [3]. Benz
et al. [12] introduced a double targeted universal adversarial perturbations
(DT-UAPs) to bridge the gap between the instance discriminative image-
dependent perturbations and the generic universal perturbations and its
potential as a physical attack. Sitawarin et al. [13] expand the scope of
adversarial attacks using Out-of-distribution attacks by enabling the
adversary to generate these starting from an arbitrary point in the image
space. Prior attacks are restricted to existing training/test data (In-
Distribution). They demonstrated that Out-of-Distribution attacks can
outperform In-Distribution attacks on classifiers and exposed a new attack
vector for these defenses.

Metzen et al. [14] proposed attacks against semantic image segmentation which
removes a target class, such as, pedestrians, from the segmentation while
leaving the segmentation otherwise unchanged. Li et al. [15] propose, for the
first time, an iterative method to generate universal adversarial
perturbations against object detection. Yingwei et al. [16] propose that
regionally homogeneous perturbations can well transfer across different vision
tasks (attacking with the semantic segmentation task and testing on the object
detection task) and the defenses are less robust to regionally homogeneous
perturbations.

As is noticed in the previous works the emphasis has been on the different
adversarial attacks and defenses against such attacks. However, to the best of
our knowledge, very little to no work has been performed to understand the
robustness of the image categories. Our work focuses on the area of generating
universal adversarial perturbations against object detection, but proposes a
new evaluation framework.

##  III Dataset curation

In this research, we curate image categories from the popular and challenging
COCO dataset by focusing on the categories specific to autonomous vehicles.
Since it is an object detection dataset, most of the images would contain more
than one category in a single image. This is done by design, since in a real
world scenario a given scene would contain more than a single object category.
Table I contains the number of such instances for each class in the COCO
training set.

TABLE I: Autonomous vehicle object categories in COCO dataset category | Number of training samples
---|---
person | 64115
bicycle | 3252
car | 12251
truck | 6127
bus | 3952
motorcycle | 3502
traffic light | 4139
stop sign | 1734

Among the vehicle categories, we only look at the top two by the number of
instances and leave out bicycle, bus, and motorcycle and finalized with 5
categories: person, car, truck, stop sign, and traffic light for this
experiment. Also, we only include the training set in COCO because the number
of instances of each category is large enough, and most importantly, we
meticulously study the independent impact of perturbations and leave out any
incorrect classifications due to the object detection failure. To this end,
using the training set on which an object detector has been trained would give
us higher probability of collecting images with true positives. Some of the
sample images from the dataset are shown in Figure 1.

Figure 1: Sample images of the selected object categories

In order to rule out missed detections due to the failure of object detector,
we curate the dataset based on the results of the object detector prior to
perturbing an image. As long as the object detector is able to detect at least
one instance of the object category, we would retain that image in our
dataset. In case the detector missed all the object instances of a target
class in an image, that image would not be used further.

##  IV Methods

###  IV-A Adversarial perturbation

Universal perturbation is an image-independent perturbation that would cause a
label change for a number of images [3]. Our goal is to test the impact of
such perturbations in object detection. Li et al. [15] introduced Universal
Dense Object Suppression (U-DOS) algorithm to find universal perturbations
that would blind an object detector on training set, $I$, so that it may fail
to find objects in most of the images in $I$ and at the same time remain
imperceptible to a human eye. We use this approach since it is for the first
time that the existence of universal perturbations on object detection tasks
is performed. We made two modifications to the approach, though: 1) to
simplify the loss function, we do not include the background probability in
the objective function , and, 2) we use a normalized L1-norm by dividing it by
the number of pixels.

U-DOS is an iterative algorithm that updates the universal perturbation, v, by
generating a vector, $v_{i}$, for each image, $I_{i}\in I$, so that the
detector, $D$, fails to find any objects in the perturbed image,
$I_{i}+\textbf{v}+v_{i}$. We modify the original objective function in Li et
al. [15] to only include the sum of class confidence probabilities of
detection instances. The modified objective function is given as,

$\mathcal{F}(I_{i},\textbf{v},v_{i})=\sum_{r_{n}\in\mathcal{R}_{D,I_{i},\textbf{v}+v_{i}}}P_{obj}(r_{n}|I_{i}+\textbf{v}+v_{i})$
(1)

where, $P_{obj}(r_{n}|I_{i}+\textbf{v}+v_{i})$ is the probability of the
object class with the highest confidence, and
$\mathcal{R}_{D,I_{i},\textbf{v}+v_{i}}$, is the set of detection results on
the perturbed image. Equation 1 is minimized while limiting the magnitude of
the perturbation, $v_{i}$, as

$v_{i}\leftarrow\operatorname*{argmin}_{v_{i}^{\prime}}\bigg{[}\mathcal{F}(I_{i},\textbf{v},v_{i}^{\prime})+||\textbf{v}+v_{i}^{\prime}||\bigg{]}$
(2)

To solve for $v_{i}$, the algorithm starts with a zero-vector and optimizes it
with gradient descent.

$\begin{split}&v_{i}^{(0)}=\textbf{0}\\\
&v_{i}^{(n+1)}=v_{i}^{(n)}-\alpha\nabla_{v_{i}^{(n)}}(\mathcal{F}(I_{i},\textbf{v},v_{i}^{(n)})+||\textbf{v}+v_{i}^{(n)}||)\end{split}$
(3)

where, $\alpha$ is the learning rate and the gradient,
$\nabla_{v_{i}^{(n)}}(*)$, is computed with back-propagation.

We modified Li et al.’s objective function to make it more applicable to
object detectors in general: originally the paper included the term of
increasing the background class probability and decreasing the ones for
specific/all object class, but we removed the term increasing the probability
of the background class because not all object detectors output a soft max
probability that includes the background class.

###  IV-B Metrics

In order to evaluate the performance of the universal perturbations in
blinding the object detector, we use two metrics proposed by [15]: image-level
blind degree and instance-level blind degree.

####  IV-B1 Image-level blind degree

Image-level blind degree is defined as the ratio of the images in which the
object detector, $D$, can find at least one object with confidence above a
threshold, $\theta$, to the total number of images, $N$. It is expressed as

$B_{img}(D,\textbf{v},\theta)=\frac{\sum\limits_{i=1}^{N}ind(I_{i},D,\textbf{v},\theta)}{N}$
(4)

where, $N$ is the total number of images, and $I_{i}$ denotes the $i$-th
image, v the universal perturbation added to these images,
$ind(I_{i},D,\textbf{v},\theta)$ is an indicator function represented as

$ind(I_{i},D,\textbf{v},\theta)=\left\\{\begin{array}[]{lr}1,&\text{if
}\exists r\in\Re_{D,I_{i},\textbf{v}},P_{obj}(r|I_{i}+\textbf{v})>\theta\\\
0,&\text{otherwise}\end{array}\right.$

where the set of detection results on the perturbed image is
$D(I_{i}+\textbf{v})$ given by $\Re_{D,I_{i},\textbf{v}}=D(I_{i}+\textbf{v})$,
with $\textbf{v}\in\mathbb{R}^{d}$ being the perturbation.
$P_{obj}(r_{n}|I_{i}+\textbf{v}+v_{i})$ is the probability of the object class
with the highest confidence and the image-independent perturbation, v, must
satisfy the following two constraints:

  1. 1.

$\Re_{D,I_{i},\textbf{v}}=\emptyset$

  2. 2.

$||\textbf{v}||_{\infty}<\xi$

####  IV-B2 Instance-level blind degree

Instance-level blind degree calculates the average number of instances that
the detector, $D$ finds in each image with confidence beyond the given
threshold $\theta$ and is expressed as

$\mathcal{B}_{ins}(D,\textbf{v},\theta)=\frac{\sum\limits_{i=1}^{N}|\\{r|r\in\mathcal{R}_{D,I_{i},\textbf{v}}\mbox{
and }P_{obj}(r|I_{i}+\textbf{v})>\theta\\}|}{N}$ (5)

where $|*|$ denotes the number of elements in the set.

##  V Experiments

In order to test the impact of perturbations on our selected categories, we
use Faster-RCNN-FPN-Resnet50 (trained on COCO2017 train) model in Detectron2
[17] [18] library because of its high mean Average Precision (mAP) on the
COCO2017 test. We also fine-tuned three hyperparameters: number of
epochs($n\\_epoch$), step size ($\alpha$) and $\xi$ for the max inf-norm of
the perturbations. After a series of pilot experiments, we settled on the
following values for the parameters: $n\\_epoch=250,\xi$ (max $l_{p}$ norm) =
10, $\alpha=20,max\\_imgs=500$, and $score\\_threshold,\theta=0.7$. In our
experiments, we keep track of the instance-level and image-level blind degree
as we vary perturbation norm for each of the five categories of objects. This
is done so that the object detector fails to find objects of a given class at
a certain norm. Figure 2 visually shows two examples of the object detector
blindness before and after the perturbations.

Figure 2: Samples detection results with and without perturbation. 1st and 3rd
columns: detection with clean images. 2nd and 4th columns: detection with
perturbed images

To evaluate universal perturbations on each category, we conduct a targeted
attack on each category. We compute an universal perturbation that attacks
only the targeted category by considering only the object proposal classified
that category and optimizing on the loss based on those object proposals to
remove final detections of that class. Figure 3 presents the effect of
perturbations on each category as the epochs and the norm are increased.

Based on Figure 3, Table II presents the ranks of resilience of each of our
categories. It is evident that the person is the most resilient category at
image-level as well as instance-level, followed by car, traffic light, truck
and stop sign as the norm is increased. It is also clear that person category
is again most resilient to perturbations as you increase the number of steps
in projected gradient descent to find a stronger perturbation. However, norm
is a more significant metric as it is related to the visibility of the
perturbations. It is also notable that a single universal perturbation is able
to make the detector fail in detecting objects of all categories, except for,
the person category in most of the images, at a norm which is imperceptible to
humans.

(a) Image level blind degree per epoch (b) Instance level blind degree per
epoch

(c) Image level blind degree vs. norm (d) Instance level blind degree vs. norm

Figure 3: Image-level and instance-level blind degree vs. epochs and norms. Both blind degrees are decreased as we increase the norm of perturbation TABLE II: Rank of image level and instance level blind degree resilience of different categories to perturbations as epochs and norm increase  Epochs | Norm
---|---
Image | Instance | Image | Instance
person | person | person | person
stop sign | car | car | car
car | traffic light | traffic light | traffic light
traffic light | stop sign | truck | truck
truck | truck | stop sign | stop sign

##  VI Conclusion

In this paper, we explore the vulnerability of object detection on five
autonomous vehicle object categories to universal perturbations. In diligently
designed experiments, we carefully curated the realistic and diverse COCO
dataset and isolate the failure of object detection without perturbations,
from the failure with perturbations. This work lies at the core of the
security of datasets in the realm of autonomous vehicle driving. To the best
of our knowledge, this is the first study of its kind that ranks the
resilience of these five categories to universal perturbations. These results
are significant since the perturbations can be imperceptible to humans while
causing real harm in an adversarial attack. We believe a more fine-grained and
detailed view on the experiments can be beneficial to the rigorous and
evaluation of adversarial attacks.

##  VII Future Work

Having established a categorical order based on the resilience of image
categories to adversarial attacks, this research could take many different
directions. One of the possible future effort would be to build and train
object detectors while incorporating special features of each of the
categories. Another possible direction would be to study the reasons behind
the resilience of each of these categories and employ that in training robust
object detectors. A different approach of future work would involve studying
various new perturbation techniques to further impact the resilience of the
object categories. We could also explore multiple new vehicle datasets and
explore the effect of perturbations across datasets and algorithms.

## References

  * [1] B. Biggio and F. Roli, “Wild patterns: Ten years after the rise of adversarial machine learning,” _Pattern Recognition_ , vol. 84, pp. 317–331, 2018.
  * [2] A. Chaubey, N. Agrawal, K. Barnwal, K. K. Guliani, and P. Mehta, “Universal adversarial perturbations: A survey,” 2020.
  * [3] S.-M. Moosavi-Dezfooli, A. Fawzi, O. Fawzi, and P. Frossard, “Universal adversarial perturbations,” in _Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR)_ , July 2017.
  * [4] C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, “Intriguing properties of neural networks,” in _International Conference on Learning Representations_ , 2014.
  * [5] M. Ozdag, “Adversarial attacks and defenses against deep neural networks: A survey,” _Procedia Computer Science_ , vol. 140, pp. 152–161, 2018, cyber Physical Systems and Deep Learning Chicago, Illinois November 5-7, 2018\.
  * [6] N. Akhtar and A. Mian, “Threat of adversarial attacks on deep learning in computer vision: A survey,” _IEEE Access_ , vol. 6, pp. 14 410–14 430, 2018.
  * [7] A. Chakraborty, M. Alam, V. Dey, A. Chattopadhyay, and D. Mukhopadhyay, “Adversarial attacks and defences: A survey,” _CoRR_ , vol. abs/1810.00069, 2018.
  * [8] A. Kurakin, I. Goodfellow, and S. Bengio, “Adversarial machine learning at scale,” 2017.
  * [9] A. Serban, E. Poll, and J. Visser, “Adversarial Examples on Object Recognition: A Comprehensive Survey,” _arXiv e-prints_ , p. arXiv:2008.04094, Aug. 2020.
  * [10] Y. Deng, X. Zheng, T. Zhang, C. Chen, G. Lou, and M. Kim, “An analysis of adversarial attacks and defenses on autonomous driving models,” in _2020 IEEE International Conference on Pervasive Computing and Communications (PerCom)_ , 2020, pp. 1–10.
  * [11] P. Sharma, D. Austin, and H. Liu, “Attacks on machine learning: Adversarial examples in connected and autonomous vehicles,” in _2019 IEEE International Symposium on Technologies for Homeland Security (HST)_ , 2019, pp. 1–7.
  * [12] P. Benz, C. Zhang, T. Imtiaz, and I. S. Kweon, “Double Targeted Universal Adversarial Perturbations,” _arXiv e-prints_ , p. arXiv:2010.03288, Oct. 2020.
  * [13] C. Sitawarin, A. Bhagoji, A. Mosenia, M. Chiang, and P. Mittal, “Darts: Deceiving autonomous cars with toxic signs,” _ArXiv_ , vol. abs/1802.06430, 2018.
  * [14] J. H. Metzen, M. C. Kumar, T. Brox, and V. Fischer, “Universal adversarial perturbations against semantic image segmentation,” in _IEEE International Conference on Computer Vision, ICCV 2017, Venice, Italy, October 22-29, 2017_. IEEE Computer Society, 2017, pp. 2774–2783.
  * [15] D. Li, J. Zhang, and K. Huang, “Universal adversarial perturbations against object detection,” _Pattern Recognition_ , p. 107584, 2020.
  * [16] Y. Li, S. Bai, C. Xie, Z. Liao, X. Shen, and A. L. Yuille, “Regional homogeneity: Towards learning transferable universal adversarial perturbations against defenses,” in _Computer Vision - ECCV 2020 - 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part XI_ , ser. Lecture Notes in Computer Science, A. Vedaldi, H. Bischof, T. Brox, and J. Frahm, Eds., vol. 12356. Springer, 2020, pp. 795–813.
  * [17] S. Ren, K. He, R. Girshick, and J. Sun, “Faster r-cnn: Towards real-time object detection with region proposal networks,” in _Advances in Neural Information Processing Systems 28_ , C. Cortes, N. D. Lawrence, D. D. Lee, M. Sugiyama, and R. Garnett, Eds. Curran Associates, Inc., 2015, pp. 91–99.
  * [18] Y. Wu, A. Kirillov, F. Massa, W.-Y. Lo, and R. Girshick, “Detectron2,” 2019.


††thanks: These authors contributed equally††thanks: These authors contributed
equally

# Quantum Valley Hall effect without Berry curvature

Rasoul Ghadimi  Chiranjit Mondal  Sunje Kim  Bohm-Jung Yang<EMAIL_ADDRESS>Department of Physics and Astronomy, Seoul National University, Seoul 08826,
Korea  Center for Theoretical Physics (CTP), Seoul National University, Seoul
08826, Korea  Institute of Applied Physics, Seoul National University, Seoul
08826, Korea

###### Abstract

The quantum valley Hall effect (QVHE) is characterized by the valley Chern
number (VCN) in a way that one-dimensional (1D) chiral metallic states are
guaranteed to appear at the domain walls (DW) between two domains with
opposite VCN for a given valley. Although in the case of QVHE, the total BC of
the system is zero, the BC distributed locally around each valley makes the
VCN well-defined as long as inter-valley scattering is negligible. Here, we
propose a new type of valley-dependent topological phenomenon that occurs when
the BC is strictly zero at each momentum. Such zero Berry curvature (ZBC) QVHE
is characterized by the valley Euler number (VEN) which is computed by
integrating the Euler curvature around a given valley in two-dimensional (2D)
systems with space-time inversion symmetry. 1D helical metallic states can be
topologically protected at the DW between two domains with the opposite VENs
when the DW configuration preserves either the mirror symmetry with respect to
the DW or the combination of the DW space-time inversion , and chiral
symmetries. We establish the fundamental origin of ZBC-QVHE. Also, by
combining tight-binding model study and first-principles calculations, we
propose stacked hexagonal bilayer lattices including h-BX (X=As, P) and large-
angle twisted bilayer graphenes as candidate systems with robust helical DW
states protected by VEN.

Introduction.— Quantum valley Hall effect (QVHE) is a topological phenomenon
arising from nonzero Berry curvature (BC) around two valleys in time-reversal
$\mathcal{T}$ symmetric systems with broken inversion $\mathcal{P}$ symmetry
[1]. The valley Chern number (VCN) is defined as the integration of Berry
curvature (BC) for a given valley, and its change over a domain counts the
number of one-dimensional (1D) chiral metallic states at the domain wall (DW)
[2, 3, 4]. Although the total BC of the system is zero due to
$\mathcal{T}$-symmetry, if the BC is well-localized near each valley and the
intervally scattering is negligible, QVHE is robust. Bernal-stacked bilayer
graphene is a representative system that exhibits QVHE under vertical electric
field breaking $\mathcal{P}$ symmetry [5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15,
16, 17]. Many interesting ideas have been proposed to realize QVHE not only in
solid state systems [18, 19, 20] but also in classical wave systems [21, 22,
23, 24, 25, 26, 26]. These QVHE setups have potential application for
valleytronics [27, 28].

The BC is an essential ingredient in various topological phenomena including
the QVHE [29, 30, 31]. However, the recent studies of symmetry-protected
topological states have uncovered various intriguing topological states that
exist even in the absence of the BC [32, 33, 34, 35, 36, 37, 38, 39, 40, 41,
42, 43]. One notable example is the topological states in two-dimensional (2D)
systems with space-time inversion ($\mathcal{I_{\text{ST}}}$) symmetry, which
appears in the form of either the combination of $\mathcal{T}$ and
$\mathcal{P}$ in the absence of spin-orbit coupling or the combination of
$\mathcal{T}$ and two-fold rotation about the $z$-axis normal to the 2D plane
($\mathcal{C}_{2z}$), irrespective of the presence or absence of spin-orbit
coupling [44]. Although $\mathcal{I_{\text{ST}}}$ symmetry forces the BC to
vanish at every momentum, two isolated bands in 2D $\mathcal{I_{\text{ST}}}$
symmetric systems can be characterized by an integer Euler number $\chi$ [45],
which induces various intriguing physical properties [46]. For instance, two
bands with an Euler number $\chi$ always possess $2\chi$ number of Dirac
points between them [45]. Moreover, a topological phase transition changing
the Euler number accompanies pair-creation and pair-annihilation of nodal
points [45] which can be characterized by non-Abelian braiding processes [47,
48, 46, 49, 50, 51, 52, 53, 54]. Also, the Euler number is a fragile
topological index characterizing the band topology of nearly flat bands in
twisted bilayer graphene [45, 55, 56, 57], which reduces to a $Z_{2}$ second
Stiefel-Whitney number when additional bands are included [44]. However,
contrary to the case of stable topological states, the topological Euler bands
cannot host boundary in-gap modes unless additional symmetries are imposed to
the system [58], as is common in crystalline topological states [59].

In this work, we propose a new type of valley-dependent topological phenomenon
appearing in the absence of the BC, dubbed a zero Berry curvature (ZBC) QVHE.
The ZBC-QVHE is protected by the change of valley Euler number (VEN), similar
to the conventional QVHE where the VCN changes over the domain wall. A nonzero
change of VEN can protect one-dimensional (1D) helical metallic states along
the DW between two domains when the DW configuration (DWC) satisfies either a
mirror symmetry about the DW or $C_{2z}$ together with a chiral symmetry.
Here, the DWC indicates the structure composed of two domains having the
opposite VEN with a DW in between. As a simple model to realize the ZBC-QVHE,
we propose 2D bilayer structures such that each layer hosts QVHE in layer
decoupled limit and the VCNs of the upper and lower layers have the opposite
sign, thus the total system has zero BC at every momentum and no QVHE is
expected.

Figure 1:  (a) Lattice structure of the AA’-stacked honeycomb bilayers and the
relevant Brillouin zone with two valleys at $K$ and $K^{\prime}$. (b)
Schematic band structure evolution for zero Berry curvature quantum valley
Hall effect (ZBC-QVHE). (b1, b2) Two degenerate Dirac cones (DCs) are gapped
out by oppositely signed masses, which gives oppositely signed Berry curvature
(BC) (represented by blue and red colors, respectively) for the occupied
bands. (b3) Simple superposition of two decoupled gapped Dirac cones. (b4)
Coupling of two gapped Dirac cones, respecting space-time inversion symmetry.
The BC vanishes but the Euler curvature (EC) is well-defined and nonzero.

Model.— To illustrate the idea, let us consider the AA’-stacked bilayer
honeycomb lattice shown in Fig. 1(a) with the nearest-neighbor hopping within
each layer as well as between layers, and a staggered sublattice potential.
The low energy Hamiltonian at a valley (either K or K’ as shown in Fig. 1(a))
can be written as

$H_{\eta}(k_{x},k_{y})=v\eta
k_{x}\sigma_{x}\tau_{0}+vk_{y}\sigma_{y}\tau_{0}+m\sigma_{z}\tau_{z}+t_{\perp}\sigma_{0}\tau_{x},$
(1)

where $v=\tfrac{2}{3}t_{1}$ is the Fermi velocity, $m$ is the staggered
sublattice potential, and $t_{1}$, $t_{\perp}$ are the nearest neighbor
intralayer and interlayer coupling, respectively. $\eta=1,-1$ indicates $K$
and $K^{\prime}$ valleys, respectively. $\sigma_{i}$ and $\tau_{i}$
$(i=x,y,z)$ are the Pauli matrices for the sublattice and layer degrees of
freedom, respectively, and $\sigma_{0}$ and $\tau_{0}$ are corresponding
$2\times 2$ identity matrices.

We note that both $\mathcal{P}$ and $\mathcal{T}$ are symmetries of the full
system but the Hamiltonian $H_{\eta}$ for each valley is invariant only under
their combination $\mathcal{PT}\equiv\mathcal{I_{\text{ST}}}$, dubbed the
space-time inversion symmetry, which can be represented by
$\mathcal{I_{\text{ST}}}=\sigma_{x}\tau_{x}K$ with complex conjugation
operator $K$ because $\mathcal{P}$ interchanges the layers and sublattices. We
note that $m$ is the only mass term allowed under $\mathcal{I_{\text{ST}}}$.
When $m=0$, $H_{\eta}$ is invariant under two mirrors $M_{y}:y\rightarrow-y$
and $M_{z}:z\rightarrow-z$ represented by $M_{y}=\sigma_{x}$ and
$M_{z}=\tau_{x}$, as well as two chiral symmetries
$\Pi_{0}=\sigma_{z}\tau_{z}$ and $\Pi=\sigma_{z}\tau_{y}$. Here $\Pi_{0}$ is
the bipartite chiral symmetry interchanging sublattices in the bilayer while
$\Pi\propto M_{z}\Pi_{0}$. On the other hand, when $m\neq 0$,
$\\{\Pi,H_{\eta}\\}=0$ still holds while $M_{y}$, $M_{z}$, $\Pi_{0}$
symmetries are all broken.

Fig. 1(b) describes the band structure evolution of $H_{\eta}$ around a
valley. When $m=t_{\perp}=0$, two degenerate Dirac cones, one from the top and
the other from the bottom layers, appear at the Fermi energy ($E_{F}=0$) [see
Fig. 1(b1)]. Turning on nonzero $m$ generates oppositely signed masses at two
Dirac cones, which results in opposite Berry curvature between them [see Fig.
1(b2)]. Nonzero $t_{\perp}$ couples two gapped Dirac cones, which makes the BC
vanishing at every momentum [see Fig. 1(b3, b4)]. However, both the upper and
lower bands carry a half-integral Euler number, leading to ZBC-QVHE. Note that
the presence of a single Dirac point in both the upper and lower bands (the
blue dots in Fig. 1(b4)) is also consistent with their half-integral Euler
number [47].

Topological invariant.— When interlayer coupling is neglected with
$t_{\perp}=0$, each layer carries a quantized VCN with the opposite sign
between two layers. Explicitly, the valley Chern number $C_{\tau,\eta}$ for
the valley $\eta$ in the layer $\tau$ is
$C_{\tau,\eta}=\tfrac{1}{2}\text{sgn}(m\eta\tau)$ where $\tau=+1,-1$ indicate
the top and bottom layers, respectively. The change of VCN for each layer (and
valley) over the domain wall $\Delta C^{v}_{\tau,\eta}\equiv
2C_{\tau,\eta}=\text{sgn}(m\eta\tau)$ supports gapless DW modes between two
domains for the given valley. Since the VCNs of two decoupled layers have the
opposite signs, the DW of the bilayer shown in Fig. 2(a) hosts two anti-
propagating (helical) in-gap states per valley. The existence of these helical
in-gap states at the DW is nothing but the manifestation of the QVHE in each
layer [2, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16]. Interestingly, the helical DW
modes survive even when $t_{\perp}\neq 0$ and thus the total VCN vanishes.
Below, we show that the helical DW states are protected by the valley Euler
number (VEN) of the bilayer.

In $\mathcal{I_{\text{ST}}}$-symmetric systems, one can always find a basis
such that both the Hamiltonian and wave functions becomes real [32, 45, 46].
In two-dimensions, two real bands $\ket{u^{1}(\mathbf{k})}$ and
$\ket{u^{2}(\mathbf{k})}$ can have an integer topological invariant, called
the Euler number, defined as

$\chi=\tfrac{1}{2\pi}\int_{BZ}\text{Ec}(\mathbf{k})dk_{x}dk_{y},$ (2)

where $\text{Ec}(\mathbf{k})=\bra{\nabla u^{1}(\mathbf{k})}\times\ket{\nabla
u^{2}(\mathbf{k})}$ is the Euler curvature and $BZ$ indicates the two-
dimensional Brillouin zone [45]. We note that the above integral can also be
performed on a disk $\mathcal{D}$ which is equal to the patch Euler number if
we neglect 1D integration along the boarder of $\mathcal{D}$ [46, 47]. We
choose the size of $\mathcal{D}$ large enough to suppress the Euler curvature
along the boundary, then the half-integer value of $\chi_{\mathcal{D}}$ can be
determined by integrating the Euler curvature, similar to the valley Chern
number calculation by integrating the BC around a valley. For the coupled
bilayer Hamiltonian in Eq. (1), the valley Euler number for a valley becomes
$\chi_{\eta}=\tfrac{1}{2}\text{sgn}(m\eta)$, and the change of VEN over a DW
is $\Delta\chi_{\eta}^{v}\equiv 2\chi_{\eta}=\text{sgn}(m\eta)$. The DW
between two domains with opposite VENs can host helical DW states when the
system satisfies certain symmetry conditions, as discussed below.

Note that by superposing two real bases, one can define the Chern bases
$\ket{\psi^{\pm}(\mathbf{k})}\equiv(\ket{u^{1}(\mathbf{k})}\pm
i\ket{u^{2}(\mathbf{k})})/\sqrt{2}$ such that the Chern number of
$\ket{\psi^{+}(\mathbf{k})}$ ($\ket{\psi^{-}(\mathbf{k})}$) is equal
(opposite) to the Euler number of real bases [46, 60]. When two layers are
decoupled with $t_{\perp}=0$, the Chern bases are eigenstates of the
Hamiltonian, which give the VCN of each layer. On the other hand, when
$t_{\perp}\neq 0$, the Chern bases are not eigenstates anymore, and thus only
the VEN is well-defined.

The relation between VCN and VEN is similar to that between the Chern number
and $Z_{2}$ invariant in quantum spin Hall systems. When two spin channels
with the opposite Chern numbers are superposed, the Chern number of each spin
channel is ill-defined if the spin-orbit coupling is present [61, 62, 63]
while their Chern number difference is well-defined modulo two when time-
reversal symmetry exists [64, 65]. Similarly, in our case, the VCN of each
layer is ill-defined when interlayer coupling presents, while the VEN is well-
defined when $\mathcal{I_{\text{ST}}}$ symmetry exists

Stability of helical DW states.— The helical DW states related to the VEN can
be protected when the DWC satisfies either $M_{y}$ symmetry or the combination
of chiral symmetry $\Pi$ and DW space-time inversion
$\mathcal{I^{\prime}_{\text{ST}}}\equiv\mathcal{C}_{2z}\mathcal{T}$ (see Fig.
2(a)). Using the Hamiltonian in Eq. (1), the DWC can be constructed by taking
$m\rightarrow m(y)$, where
$\lim_{|y|\rightarrow\infty}m(y)=\text{sign}(y)m_{0}$ and $m_{0}>0$.
Accordingly, the DW is located along the $x$-direction. The Hamiltonian for
DWC can be obtained from Eq. (1) by substituting
$k_{y}\rightarrow-i\partial_{y}$ as

$H^{\text{DW}}_{\eta}(k_{x},y)=v\eta
k_{x}\sigma_{x}\tau_{0}-iv\partial_{y}\sigma_{y}\tau_{0}+m(y)\sigma_{z}\tau_{z}+t_{\perp}\sigma_{0}\tau_{x}.$
(3)

Figure 2: Realization of ZBC-QVHE in AA’ stacked bilayer h-BX (X= As, P, N).
(a) Domain wall configuration (DWC) with $M_{y}$ and $C_{2z}$ symmetries. The
blue dashed line and red disc represent the $M_{y}:y\rightarrow-y$ mirror and
$C_{2z}$ rotation centre respectively. (b,c,d) Bulk band structure (top) and
Euler curvature distribution (bottom) for (b) h-BAs, (c) h-BP, and (d) h-BN.
$\mathcal{PT}$ symmetry-protected Dirac cones below the $E_{F}$ are indicated
by the purple dots at $K$ and $K^{\prime}$ . (e,f,g) DW modes (green lines)
for h-BAs, h-BP, and h-BN, respectively, where $\pm$ indicate $M_{y}$ mirror
eigenvalues. As the bulk band gap and on-site potential change at the DW
increase from (b) to (d), the Euler curvature spreads wider and the helical DW
state pair gets closer and pair-annihilate.

In the following, we show how $M_{y}=\sigma_{x}$ symmetry can protect the
helical DW states. When the DWC satisfies $M_{y}$, the DW becomes a
$M_{y}$-invariant 1D space. Moreover, since $M_{y}$ changes the sign of $m$ in
$H_{\eta}$, two domains related by $M_{y}$ should have the opposite Euler
number. Similarly, when interlayer coupling is neglected, two domains in each
layer related by $M_{y}$ should have the opposite Chern number.

For convenience, let us neglect interlayer coupling. Since each layer supports
QVHE and the VCN of two layers have opposite signs, helical DW states should
appear from each valley in the bilayer. The effective Hamiltonian for the
helical DW states from one valley can be written as
$H^{\text{DW}}_{0}=v^{\prime}k_{x}\tau_{z}$ where $\tau_{z}$ gives a good
quantum number when interlayer coupling is neglected. Since the DW is $M_{y}$
invariant, each DW state should also carry a $M_{y}$ eigenvalue. To have the
$M_{y}$ eigenvalue and the layer quantum number simultaneously, $M_{y}$ should
be represented by either $\tilde{M}_{y}=\tau_{0}$ or $\tilde{M}_{y}=\tau_{z}$
where the tilde symbol indicates the symmetry representation in the space
spanned by helical DW states. $\tilde{M}_{y}=\tau_{z}$ prohibits the mass
terms in the form of $H^{\text{DW}}_{m}=m_{1}\tau_{x}+m_{2}\tau_{y}$ even when
interlayer coupling is turned on.

The representation $\tilde{M}_{y}=\tau_{z}$ in the DW can be confirmed as
follows. For simplicity, let us consider
$H^{\text{DW}}(y,\tau)=-iv\partial_{y}\sigma_{y}+\tau m\sigma_{z}$
corresponding to Eq. (3) with $k_{x}=0$ and $t_{\perp}=0$, where $\tau=\pm 1$
indicate the upper and lower layers, respectively. Because of the chiral
symmetry $\\{H^{\text{DW}}(y,\tau),\sigma_{x}\\}=0$, if $\psi(y)$ is a zero
mode solution satisfying $H^{\text{DW}}(y,\tau)\psi(y)=0$, $\sigma_{x}\psi(y)$
is also a zero mode solution. Since there is only one zero mode per layer, two
solutions should be proportional to each other as
$\sigma_{x}\psi(y)=\lambda\psi(y)$ where $\lambda$ is a constant. Namely,
$\psi(y)$ is an eigenstate of the chiral symmetry operator $\sigma_{x}$.
Moreover, the mass term in $H^{\text{DW}}(y,\tau)$ has the opposite signs in
two layers, the DW Hamiltonians for two layers are related as
$\sigma_{y}H^{\text{DW}}(y,\tau=+1)\sigma_{y}=H^{\text{DW}}(y,\tau=-1)$. Thus,
if $\psi(y)$ is a zero mode solution for one layer, $\sigma_{y}\psi(y)$ is the
zero mode solution of the other layer. Since $\psi(y)$ and $\sigma_{y}\psi(y)$
have the opposite $\sigma_{x}$ eigenvalues and $\psi(-y)=\psi(y)$,
$\tilde{M}_{y}=\tau_{z}$ can be confirmed (see Supplemental Materials (SM)
111See the Supplemental Materials (SM) for details on tight binding,
derivation of edge modes, ZBC QVHE in twisted bilayer graphene, ZBC QVHE in
canted antiferromagnetic systems, and DFT computation [82, 83, 84]. for
additional discussion). This symmetry representation is not affected by
interlayer coupling if it is small enough to maintain the band gap. Therefore,
the DWC with $M_{y}$ symmetry can support helical DW states originating from
VENs. Since the helical states have the opposite $M_{y}$ eigenvalues, their
crossing is stable.

The helical DW states can also be symmetry-protected when $\Pi$ and
$\mathcal{I}^{\prime}_{\text{ST}}=C_{2z}T$ satisfying
$[\Pi,\mathcal{I^{\prime}_{\text{ST}}}]=0$ exist simultaneously. As noted
above, $\Pi$ is a combination of the bipartite chiral symmetry and $M_{z}$
mirror. Also, if the DWC has $C_{2z}$ symmetry,
$\mathcal{I^{\prime}_{\text{ST}}}=C_{2z}T$ exists and takes the form of
$I^{\prime}_{\text{ST}}=\sigma_{x}\mathcal{K}$ in Eq. (3). Since
$\mathcal{I^{\prime}_{\text{ST}}}$ changes the sign of $m$ in Eq. (1), two
domains related by $\mathcal{I^{\prime}_{\text{ST}}}$ have the opposite VENs.
Since $C_{2z}$ does not mix layers, in the DW
$\mathcal{I^{\prime}_{\text{ST}}}$ can be represented by
$\tilde{\mathcal{I}}^{\prime}_{\text{ST}}=K$ and forces $m_{2}=0$ in
$H^{\text{DW}}_{m}=m_{1}\tau_{x}+m_{2}\tau_{y}$. The remaining mass
$m_{1}\tau_{x}$ can be annihilated by imposing $\tilde{\Pi}=\tau_{x}$ that
satisfies $[\tilde{\Pi},\tilde{\mathcal{I}}^{\prime}_{\text{ST}}]=0$ [67, 68,
69].

Hexagonal bilayer materials.— As an example of AA’ stacked hexagonal bilayers,
we consider h-BX (B=Boron and X= As, P, N) as shown in Fig. 2. Fig.2(a)
describes the DWC with $M_{y}$ and $C_{2z}$ symmetries composed of two domains
with opposite VENs. The band structures of h-BX single domains and the
corresponding Euler curvature distribution around two valleys are shown in
Fig.2(b,c,d) where we also identify the presence of a Dirac point between the
two highest occupied bands at $K$ and $K^{\prime}$ (purple dot in
Fig.2(b,c,d)), respectively, demonstrating their half-integral valley Euler
number [47]. Our DFT simulation (see SM for detail about the computation
method) of the DWC confirms the existence of helical DW modes in h-BAs, and
hBP as shown in Fig.2(e), and (f), respectively. Consistent with our
prediction, the helical DW modes have opposite $M_{y}$ eigenvalues.

In the case of h-BN, although the system respects all symmetry conditions to
realize ZBC-QVHE, the helical DW modes are absent (see Fig.2 (g)). There are
two reasons for this. One is because, as the band gap increases (see Fig. 2
(b,c,d)), the wavefunctions at K and K’ are mixed more, which makes VEN ill-
defined. To confirm it, we have computed the Euler curvature distribution near
two valleys for these systems shown in the bottom panels of Fig. 2 (b,c,d).
One can clearly see that the Euler curvature spreads wider as the band gap
increases. In h-BN with the largest band gap, the helical DW states from two
valleys are pair-annihilated, leading to the gapped DW modes (see Fig. 2 (g)).

The other reason is due to the abrupt change of the on-site potential at the
DW, roughly proportional to the sublattice potential, occurring due to the
atomic configuration change as shown in Fig. 2 (a). As h-BN with largest
sublattice potential feels stronger potential variation at the DW, the helical
DW modes from two valleys can be pair-annihilated. We note that as long as the
DWC keeps the $M_{y}$ mirror, the crossing of helical DW states from each
valley is stable even if such potential variation happens. Interestingly, this
on-site potential variation at the DW can be compensated by applying an
external electric field to the domain. As shown in Fig. 3(a, b), the helical
DW states can be recovered by applying an external electric field, which is
obtained by using a tight-binding model relevant to h-BN with an additional
out-of-plane electric field as described in detail in the SM.

Figure 3: The evolution of the helical DW dispersion under an external
vertical electric field which can restore the helical DW states. DW dispersion
(a) without and (b) with electric field.

Discussion.— We have proposed a new type of valley dependent topological
phenomena, dubbed the ZBC-QVHE, induced by the VEN. Although the Euler number
is a topological invariant of two bands, the helical DW states are stable even
in the presence of additional bulk bands as long as they do not disturb the
half-integral Euler number of Euler bands at each valley. This is because the
crossing between helical DW states from each valley is further protected by
$M_{y}$ symmetry of the DWC, which is well-defined even in multi-band systems.
In the case of the helical DW states protected by
$\tilde{\mathcal{I}}^{\prime}_{\text{ST}}$ and $\tilde{\Pi}$ symmetries, the
stability of the helical DW state crossing is guaranteed by the fact that
$H_{\text{DW}}$ has non-zero $\mathcal{Z}_{2}$ $0$-dimensional charge when
commuting $\tilde{\mathcal{I}}^{\prime}_{\text{ST}}$ and $\tilde{\Pi}$
symmetries are present [67].

In addition to h-BX materials, we have identified various candidate systems
where ZBC-QVHE can be realized such as large-angle twisted bilayer graphene
[29, 70, 71, 72, 73, 74, 75], and hexagonal bilayer spin systems [76, 77, 78,
79, 80, 81] as described in detail in SM.

Acknowledgements R.G. and C.M. thank Yuting Qian for fruitful discussions.
R.G, C.M, S.K, and B-J.Y were supported by Samsung Science and Technology
Foundation under Project Number SSTF-BA2002-06, the National Research
Foundation of Korea (NRF) grant funded by the Korean government (MSIT)
(No.2021R1A2C4002773, and No. NRF-2021R1A5A1032996).

## References

  * Yao  _et al._ [2009] W. Yao, S. A. Yang, and Q. Niu, Edge states in graphene: From gapped flat-band to gapless chiral modes, Phys. Rev. Lett. 102, 096801 (2009).
  * Zhang  _et al._ [2013] F. Zhang, A. H. MacDonald, and E. J. Mele, Valley chern numbers and boundary modes in gapped bilayer graphene, Proceedings of the National Academy of Sciences 110, 10546 (2013), https://www.pnas.org/doi/pdf/10.1073/pnas.1308853110 .
  * Vaezi  _et al._ [2013] A. Vaezi, Y. Liang, D. H. Ngai, L. Yang, and E.-A. Kim, Topological edge states at a tilt boundary in gated multilayer graphene, Phys. Rev. X 3, 021018 (2013).
  * Jung  _et al._ [2011] J. Jung, F. Zhang, Z. Qiao, and A. H. MacDonald, Valley-hall kink and edge states in multilayer graphene, Phys. Rev. B 84, 075418 (2011).
  * Xiao  _et al._ [2007] D. Xiao, W. Yao, and Q. Niu, Valley-contrasting physics in graphene: Magnetic moment and topological transport, Phys. Rev. Lett. 99, 236809 (2007).
  * Liu  _et al._ [2019] J. Liu, Z. Ma, J. Gao, and X. Dai, Quantum valley hall effect, orbital magnetism, and anomalous hall effect in twisted multilayer graphene systems, Phys. Rev. X 9, 031021 (2019).
  * Kim  _et al._ [2014] Y. Kim, K. Choi, J. Ihm, and H. Jin, Topological domain walls and quantum valley hall effects in silicene, Phys. Rev. B 89, 085429 (2014).
  * Martin  _et al._ [2008] I. Martin, Y. M. Blanter, and A. F. Morpurgo, Topological confinement in bilayer graphene, Phys. Rev. Lett. 100, 036804 (2008).
  * Semenoff  _et al._ [2008] G. W. Semenoff, V. Semenoff, and F. Zhou, Domain walls in gapped graphene, Phys. Rev. Lett. 101, 087204 (2008).
  * Qiao  _et al._ [2011] Z. Qiao, J. Jung, Q. Niu, and A. H. MacDonald, Electronic highways in bilayer graphene, Nano Letters 11, 3453 (2011), pMID: 21766817, https://doi.org/10.1021/nl201941f .
  * Pan  _et al._ [2015] H. Pan, X. Li, F. Zhang, and S. A. Yang, Perfect valley filter in a topological domain wall, Phys. Rev. B 92, 041404 (2015).
  * Wang  _et al._ [2021] Z. Wang, S. Cheng, X. Liu, and H. Jiang, Topological kink states in graphene, Nanotechnology 32, 402001 (2021).
  * Zhou  _et al._ [2021] T. Zhou, S. Cheng, M. Schleenvoigt, P. Schüffelgen, H. Jiang, Z. Yang, and I. Žutić, Quantum spin-valley hall kink states: From concept to materials design, Phys. Rev. Lett. 127, 116402 (2021).
  * Ghader [2020] D. Ghader, Valley-polarized domain wall magnons in 2d ferromagnetic bilayers, Scientific Reports 10, 16733 (2020).
  * Ezawa [2013] M. Ezawa, Spin valleytronics in silicene: Quantum spin hall–quantum anomalous hall insulators and single-valley semimetals, Phys. Rev. B 87, 155415 (2013).
  * Kim  _et al._ [2020] M. Kim, Z. Jacob, and J. Rho, Recent advances in 2d, 3d and higher-order topological photonics, Light: Science & Applications 9, 130 (2020).
  * Zhu  _et al._ [2019] W. Zhu, Y. Long, H. Chen, and J. Ren, Quantum valley hall effects and spin-valley locking in topological kane-mele circuit networks, Phys. Rev. B 99, 115410 (2019).
  * Ju  _et al._ [2015] L. Ju, Z. Shi, N. Nair, Y. Lv, C. Jin, J. Velasco, C. Ojeda-Aristizabal, H. A. Bechtel, M. C. Martin, A. Zettl, J. Analytis, and F. Wang, Topological valley transport at bilayer graphene domain walls, Nature 520, 650 (2015).
  * Li  _et al._ [2016] J. Li, K. Wang, K. J. McFaul, Z. Zern, Y. Ren, K. Watanabe, T. Taniguchi, Z. Qiao, and J. Zhu, Gate-controlled topological conducting channels in bilayer graphene, Nature Nanotechnology 11, 1060 (2016).
  * Yin  _et al._ [2016] L.-J. Yin, H. Jiang, J.-B. Qiao, and L. He, Direct imaging of topological edge states at a bilayer graphene domain wall, Nature Communications 7, 11760 (2016).
  * Qian  _et al._ [2018] K. Qian, D. J. Apigo, C. Prodan, Y. Barlas, and E. Prodan, Topology of the valley-chern effect, Phys. Rev. B 98, 155138 (2018).
  * Lu  _et al._ [2017] J. Lu, C. Qiu, L. Ye, X. Fan, M. Ke, F. Zhang, and Z. Liu, Observation of topological valley transport of sound in sonic crystals, Nature Physics 13, 369 (2017).
  * Dong  _et al._ [2017] J.-W. Dong, X.-D. Chen, H. Zhu, Y. Wang, and X. Zhang, Valley photonic crystals for control of spin and topology, Nature Materials 16, 298 (2017).
  * Noh  _et al._ [2018] J. Noh, S. Huang, K. P. Chen, and M. C. Rechtsman, Observation of photonic topological valley hall edge states, Phys. Rev. Lett. 120, 063902 (2018).
  * Li  _et al._ [2022] H. Li, Z. Wang, Z. Wang, C. Deng, J. Luo, J. Huang, X. Wang, and H. Yang, Acoustic multichannel transports of valley edge states in bilayer sonic crystals, Applied Physics Letters 121, 243101 (2022), https://pubs.aip.org/aip/apl/article-pdf/doi/10.1063/5.0127559/16487480/243101_1_online.pdf .
  * Lu  _et al._ [2018] J. Lu, C. Qiu, W. Deng, X. Huang, F. Li, F. Zhang, S. Chen, and Z. Liu, Valley topological phases in bilayer sonic crystals, Phys. Rev. Lett. 120, 116802 (2018).
  * Yao  _et al._ [2008] W. Yao, D. Xiao, and Q. Niu, Valley-dependent optoelectronics from inversion symmetry breaking, Phys. Rev. B 77, 235406 (2008).
  * Yu  _et al._ [2020] Z.-M. Yu, S. Guan, X.-L. Sheng, W. Gao, and S. A. Yang, Valley-layer coupling: A new design principle for valleytronics, Phys. Rev. Lett. 124, 037701 (2020).
  * Mondal  _et al._ [2023] C. Mondal, R. Ghadimi, and B.-J. Yang, Quantum valley and subvalley hall effect in large-angle twisted bilayer graphene, Phys. Rev. B 108, L121405 (2023).
  * Chang  _et al._ [2023] C.-Z. Chang, C.-X. Liu, and A. H. MacDonald, Colloquium: Quantum anomalous hall effect, Rev. Mod. Phys. 95, 011002 (2023).
  * Komatsu  _et al._ [2018] K. Komatsu, Y. Morita, E. Watanabe, D. Tsuya, K. Watanabe, T. Taniguchi, and S. Moriyama, Observation of the quantum valley hall state in ballistic graphene superlattices, Science Advances 4, eaaq0194 (2018), https://www.science.org/doi/pdf/10.1126/sciadv.aaq0194 .
  * Zhao and Lu [2017] Y. X. Zhao and Y. Lu, $pt$-symmetric real dirac fermions and semimetals, Phys. Rev. Lett. 118, 056401 (2017).
  * Ahn  _et al._ [2018] J. Ahn, D. Kim, Y. Kim, and B.-J. Yang, Band topology and linking structure of nodal line semimetals with ${Z}_{2}$ monopole charges, Phys. Rev. Lett. 121, 106403 (2018).
  * Ahn and Yang [2019] J. Ahn and B.-J. Yang, Symmetry representation approach to topological invariants in ${C}_{2z}t$-symmetric systems, Phys. Rev. B 99, 235125 (2019).
  * Ünal  _et al._ [2020] F. N. Ünal, A. Bouhon, and R.-J. Slager, Topological euler class as a dynamical observable in optical lattices, Phys. Rev. Lett. 125, 053601 (2020).
  * Chen  _et al._ [2021] C. Chen, W. Wu, Z.-M. Yu, Z. Chen, Y. X. Zhao, X.-L. Sheng, and S. A. Yang, Graphyne as a second-order and real chern topological insulator in two dimensions, Phys. Rev. B 104, 085205 (2021).
  * Ezawa [2021] M. Ezawa, Topological euler insulators and their electric circuit realization, Phys. Rev. B 103, 205303 (2021).
  * Zhao  _et al._ [2022] W. Zhao, Y.-B. Yang, Y. Jiang, Z. Mao, W. Guo, L. Qiu, G. Wang, L. Yao, L. He, Z. Zhou, Y. Xu, and L. Duan, Quantum simulation for topological euler insulators, Communications Physics 5, 223 (2022).
  * Takahashi and Ozawa [2023] R. Takahashi and T. Ozawa, Bulk-edge correspondence of stiefel-whitney and euler insulators through the entanglement spectrum and cutting procedure, Phys. Rev. B 108, 075129 (2023).
  * Jiang  _et al._ [2022a] B. Jiang, A. Bouhon, S.-Q. Wu, Z.-L. Kong, Z.-K. Lin, R.-J. Slager, and J.-H. Jiang, Experimental observation of meronic topological acoustic euler insulators (2022a), arXiv:2205.03429 [cond-mat.mes-hall] .
  * Lim  _et al._ [2023] H. Lim, S. Kim, and B.-J. Yang, Real hopf insulator, Phys. Rev. B 108, 125101 (2023).
  * Park  _et al._ [2021] S. Park, Y. Hwang, H. C. Choi, and B.-J. Yang, Topological acoustic triple point, Nature Communications 12, 6781 (2021).
  * Kim  _et al._ [2017] J. Kim, S. S. Baik, S. W. Jung, Y. Sohn, S. H. Ryu, H. J. Choi, B.-J. Yang, and K. S. Kim, Two-dimensional dirac fermions protected by space-time inversion symmetry in black phosphorus, Phys. Rev. Lett. 119, 226801 (2017).
  * Ahn  _et al._ [2019a] J. Ahn, S. Park, D. Kim, Y. Kim, and B.-J. Yang, Stiefel–whitney classes and topological phases in band theory, Chinese Physics B 28, 117101 (2019a).
  * Ahn  _et al._ [2019b] J. Ahn, S. Park, and B.-J. Yang, Failure of nielsen-ninomiya theorem and fragile topology in two-dimensional systems with space-time inversion symmetry: Application to twisted bilayer graphene at magic angle, Phys. Rev. X 9, 021013 (2019b).
  * Bouhon  _et al._ [2020a] A. Bouhon, Q. Wu, R.-J. Slager, H. Weng, O. V. Yazyev, and T. Bzdušek, Non-abelian reciprocal braiding of weyl points and its manifestation in zrte, Nature Physics 16, 1137 (2020a).
  * Peng  _et al._ [2022a] B. Peng, A. Bouhon, B. Monserrat, and R.-J. Slager, Phonons as a platform for non-abelian braiding and its manifestation in layered silicates, Nature Communications 13, 423 (2022a).
  * Peng  _et al._ [2022b] B. Peng, A. Bouhon, R.-J. Slager, and B. Monserrat, Multigap topology and non-abelian braiding of phonons from first principles, Phys. Rev. B 105, 085115 (2022b).
  * Qiu  _et al._ [2023] H. Qiu, Q. Zhang, T. Liu, X. Fan, F. Zhang, and C. Qiu, Minimal non-abelian nodal braiding in ideal metamaterials, Nature Communications 14, 1261 (2023).
  * Jiang  _et al._ [2021] B. Jiang, A. Bouhon, Z.-K. Lin, X. Zhou, B. Hou, F. Li, R.-J. Slager, and J.-H. Jiang, Experimental observation of non-abelian topological acoustic semimetals and their phase transitions, Nature Physics 17, 1239 (2021).
  * Bouhon  _et al._ [2020b] A. Bouhon, T. c. v. Bzdušek, and R.-J. Slager, Geometric approach to fragile topology beyond symmetry indicators, Phys. Rev. B 102, 115135 (2020b).
  * Slager  _et al._ [2022] R.-J. Slager, A. Bouhon, and F. N. Ünal, Floquet multi-gap topology: Non-abelian braiding and anomalous dirac string phase (2022), arXiv:2208.12824 [cond-mat.mes-hall] .
  * Jiang  _et al._ [2022b] T. Jiang, R.-Y. Zhang, Q. Guo, B. Yang, and C. T. Chan, Two-dimensional non-abelian topological insulators and the corresponding edge/corner states from an eigenvector frame rotation perspective, Phys. Rev. B 106, 235428 (2022b).
  * Guo  _et al._ [2021] Q. Guo, T. Jiang, R.-Y. Zhang, L. Zhang, Z.-Q. Zhang, B. Yang, S. Zhang, and C. T. Chan, Experimental observation of non-abelian topological charges and edge states, Nature 594, 195 (2021).
  * Bouhon  _et al._ [2019] A. Bouhon, A. M. Black-Schaffer, and R.-J. Slager, Wilson loop approach to fragile topology of split elementary band representations and topological crystalline insulators with time-reversal symmetry, Phys. Rev. B 100, 195135 (2019).
  * Po  _et al._ [2019] H. C. Po, L. Zou, T. Senthil, and A. Vishwanath, Faithful tight-binding models and fragile topology of magic-angle bilayer graphene, Phys. Rev. B 99, 195455 (2019).
  * Song  _et al._ [2019] Z. Song, Z. Wang, W. Shi, G. Li, C. Fang, and B. A. Bernevig, All magic angles in twisted bilayer graphene are topological, Phys. Rev. Lett. 123, 036401 (2019).
  * Wang  _et al._ [2020] K. Wang, J.-X. Dai, L. B. Shao, S. A. Yang, and Y. X. Zhao, Boundary criticality of $\mathcal{PT}$-invariant topology and second-order nodal-line semimetals, Phys. Rev. Lett. 125, 126403 (2020).
  * Ando and Fu [2015] Y. Ando and L. Fu, Topological crystalline insulators and topological superconductors: From concepts to materials, Annual Review of Condensed Matter Physics 6, 361 (2015), https://doi.org/10.1146/annurev-conmatphys-031214-014501 .
  * Guan  _et al._ [2022] Y. Guan, A. Bouhon, and O. V. Yazyev, Landau levels of the euler class topology, Phys. Rev. Res. 4, 023188 (2022).
  * Kane and Mele [2005a] C. L. Kane and E. J. Mele, Quantum spin hall effect in graphene, Phys. Rev. Lett. 95, 226801 (2005a).
  * Bernevig and Zhang [2006] B. A. Bernevig and S.-C. Zhang, Quantum spin hall effect, Phys. Rev. Lett. 96, 106802 (2006).
  * Sheng  _et al._ [2005] L. Sheng, D. N. Sheng, C. S. Ting, and F. D. M. Haldane, Nondissipative spin hall effect via quantized edge transport, Phys. Rev. Lett. 95, 136602 (2005).
  * Kane and Mele [2005b] C. L. Kane and E. J. Mele, ${Z}_{2}$ topological order and the quantum spin hall effect, Phys. Rev. Lett. 95, 146802 (2005b).
  * Fu and Kane [2007] L. Fu and C. L. Kane, Topological insulators with inversion symmetry, Phys. Rev. B 76, 045302 (2007).
  * Note [1] See the Supplemental Materials (SM) for details on tight binding, derivation of edge modes, ZBC QVHE in twisted bilayer graphene, ZBC QVHE in canted antiferromagnetic systems, and DFT computation [82, 83, 84].
  * Bzdušek and Sigrist [2017] T. c. v. Bzdušek and M. Sigrist, Robust doubly charged nodal lines and nodal surfaces in centrosymmetric systems, Phys. Rev. B 96, 155105 (2017).
  * Kim  _et al._ [2021] S. Kim, D.-C. Ryu, and B.-J. Yang, Linking structures of doubly charged nodal surfaces in centrosymmetric superconductors, Phys. Rev. B 103, 224523 (2021).
  * Mondal  _et al._ [2022] C. Mondal, S. Kim, and B.-J. Yang, Unremovable linked nodal structures protected by crystalline symmetries in stacked bilayer graphene with kekulé texture, Phys. Rev. B 106, L121118 (2022).
  * Mele [2012] E. J. Mele, Interlayer coupling in rotationally faulted multilayer graphenes, Journal of Physics D: Applied Physics 45, 154004 (2012).
  * Shallcross  _et al._ [2008] S. Shallcross, S. Sharma, and O. A. Pankratov, Quantum interference at the twist boundary in graphene, Phys. Rev. Lett. 101, 056803 (2008).
  * Mele [2010] E. J. Mele, Commensuration and interlayer coherence in twisted bilayer graphene, Phys. Rev. B 81, 161405 (2010).
  * Kindermann [2015] M. Kindermann, Topological crystalline insulator phase in graphene multilayers, Phys. Rev. Lett. 114, 226802 (2015).
  * Park  _et al._ [2019] M. J. Park, Y. Kim, G. Y. Cho, and S. Lee, Higher-order topological insulator in twisted bilayer graphene, Phys. Rev. Lett. 123, 216803 (2019).
  * Liu  _et al._ [2022] B.-B. Liu, X.-T. Zeng, C. Chen, Z. Chen, and X.-L. Sheng, Second-order and real chern topological insulator in twisted bilayer $\alpha$-graphyne, Phys. Rev. B 106, 035153 (2022).
  * Wang  _et al._ [2019] S. Wang, P. Zhang, C. Ren, H. Tian, J. Pang, C. Song, and M. Sun, Valley hall effect and magnetic moment in magnetized silicene, Journal of Superconductivity and Novel Magnetism 32, 2947 (2019).
  * Islam and Benjamin [2016] S. F. Islam and C. Benjamin, A scheme to realize the quantum spin-valley hall effect in monolayer graphene, Carbon 110, 304 (2016).
  * Yang  _et al._ [2021] H. Yang, J. Xu, Z. Xiong, X. Lu, R.-Y. Zhang, H. Li, Y. Chen, and S. Zhang, Optically reconfigurable spin-valley hall effect of light in coupled nonlinear ring resonator lattice, Phys. Rev. Lett. 127, 043904 (2021).
  * Ezawa [2015] M. Ezawa, Monolayer topological insulators: Silicene, germanene, and stanene, Journal of the Physical Society of Japan 84, 121003 (2015), https://doi.org/10.7566/JPSJ.84.121003 .
  * Li  _et al._ [2013] X. Li, T. Cao, Q. Niu, J. Shi, and J. Feng, Coupling the valley degree of freedom to antiferromagnetic order, Proceedings of the National Academy of Sciences 110, 3738 (2013), https://www.pnas.org/doi/pdf/10.1073/pnas.1219420110 .
  * Rakhmanov  _et al._ [2012] A. L. Rakhmanov, A. V. Rozhkov, A. O. Sboychakov, and F. Nori, Instabilities of the $aa$-stacked graphene bilayer, Phys. Rev. Lett. 109, 206801 (2012).
  * Blöchl [1994] P. E. Blöchl, Projector augmented-wave method, Phys. Rev. B 50, 17953 (1994).
  * Kresse and Hafner [1993] G. Kresse and J. Hafner, Ab initio molecular dynamics for liquid metals, Phys. Rev. B 47, 558 (1993).
  * Kresse and Joubert [1999] G. Kresse and D. Joubert, From ultrasoft pseudopotentials to the projector augmented-wave method, Phys. Rev. B 59, 1758 (1999).