# Towards Transferable Attacks Against Vision-LLMs
in Autonomous Driving with Typography

Nhat Chung1,2, Sensen Gao1,3, Tuan-Anh Vu1,4, Jie Zhang5, Aishan Liu6, Yun
Lin7, Jin Song Dong8, Qing Guo1,8,∗
1CFAR and IHPC, A*STAR, Singapore
2VNU-HCM, Vietnam 3Nankai University, China 4HKUST, HKSAR
5Nanyang Technological University, Singapore 6Beihang University, China
7Shanghai Jiao Tong University, China 8National University of Singapore,
Singapore
∗Corresponding author<EMAIL_ADDRESS>
###### Abstract

Vision-Large-Language-Models (Vision-LLMs) are increasingly being integrated
into autonomous driving (AD) systems due to their advanced visual-language
reasoning capabilities, targeting the perception, prediction, planning, and
control mechanisms. However, Vision-LLMs have demonstrated susceptibilities
against various types of adversarial attacks, which would compromise their
reliability and safety. To further explore the risk in AD systems and the
transferability of practical threats, we propose to leverage typographic
attacks against AD systems relying on the decision-making capabilities of
Vision-LLMs. Different from the few existing works developing general datasets
of typographic attacks, this paper focuses on realistic traffic scenarios
where these attacks can be deployed, on their potential effects on the
decision-making autonomy, and on the practical ways in which these attacks can
be physically presented. To achieve the above goals, we first propose a
dataset-agnostic framework for automatically generating false answers that can
mislead Vision-LLMs’ reasoning. Then, we present a linguistic augmentation
scheme that facilitates attacks at image-level and region-level reasoning, and
we extend it with attack patterns against multiple reasoning tasks
simultaneously. Based on these, we conduct a study on how these attacks can be
realized in physical traffic scenarios. Through our empirical study, we
evaluate the effectiveness, transferability, and realizability of typographic
attacks in traffic scenes. Our findings demonstrate particular harmfulness of
the typographic attacks against existing Vision-LLMs (_e.g_., LLaVA, Qwen-VL,
VILA, and Imp), thereby raising community awareness of vulnerabilities when
incorporating such models into AD systems. We will release our source code
upon acceptance.

##  1 Introduction

Vision-Language Large Models (Vision-LLMs) have seen rapid development over
the recent years [1, 2, 3], and their incorporation into autonomous driving
(AD) systems have been seriously considered by both industry and academia [4,
5, 6, 7, 8, 9]. The integration of Vision-LLMs into AD systems showcases their
ability to convey explicit reasoning steps to road users on the fly and
satisfy the need for textual justifications of traffic scenarios regarding
perception, prediction, planning, and control, particularly in safety-critical
circumstances in the physical world. The core strength of Vision-LLMs lies in
their auto-regressive capabilities through large-scale pretraining with
visual-language alignment [1], making them even able to perform zero-shot
optical character recognition, grounded reasoning, visual-question answering,
visual-language reasoning, _etc_. Nevertheless, despite their impressive
capabilities, Vision-LLMs are unfortunately not impervious against adversarial
attacks that can misdirect the reasoning processes [10]. Any successful attack
strategies have the potential to pose critical problems when deploying Vision-
LLMs in AD systems, especially those that may even bypass the models’ black-
box characteristics. As a step towards their reliable adoption in AD, studying
the transferability of adversarial attacks is crucial to raising awareness of
practical threats against deployed Vision-LLMs, and to efforts in building
appropriate defense strategies for them.

In this work, we revisit the shared auto-regressive characteristic of
different Vision-LLMs and intuitively turn that strength into a weakness by
leveraging typographic forms of adversarial attacks, also known as typographic
attacks. Typographic attacks were first studied in the context of the well-
known Contrastive Language-Image Pre-training (CLIP) model [11, 12]. Early
works in this area focused on developing a general typographic attack dataset
targeting multiple-choice answering (such as object recognition, visual
attribute detection, and commonsense answering) and enumeration [13].
Researchers also explored multiple-choice self-generating attacks against
zero-shot classification [14], and proposed several defense mechanisms,
including keyword-training [15] and prompting the model for detailed reasoning
[16]. Despite these initial efforts, the methodologies have neither seen a
comprehensive attack framework nor been explicitly designed to investigate the
impact of typographic attacks on safety-critical systems, particularly those
in AD scenarios.

Our work aims to fill this research gap by studying typographic attacks from
the perspective of AD systems that incorporate Vision-LLMs. In summary, our
scientific contributions are threefold:

  * •

Dataset-Independent Framework: we introduce a dataset-independent framework
designed to automatically generate misleading answers that can disrupt the
reasoning processes of Vision-Large Language Models (Vision-LLMs).

  * •

Linguistic Augmentation Schemes: we develop a linguistic augmentation scheme
aimed at facilitating stronger typographic attacks on Vision-LLMs. This scheme
targets reasoning at both the image and region levels and is expandable to
multiple reasoning tasks simultaneously.

  * •

Empirical Study in Semi-Realistic Scenarios: we conduct a study to explore the
possible implementations of these attacks in real-world traffic scenarios.

Through our empirical study of typographic attacks in traffic scenes, we hope
to raise community awareness of critical typographic vulnerabilities when
incorporating such models into AD systems.

##  2 Related Work

###  2.1 Vision-LLMs

Having demonstrated the proficiency of Large Language Models (LLMs) in
reasoning across various natural language benchmarks, researchers have
extended LLMs with visual encoders to support multimodal understanding. This
integration has given rise to various forms of Vision-LLMs, capable of
reasoning based on the composition of visual and language inputs.

Vision-LLMs Pre-training. The interconnection between LLMs and pre-trained
vision models involves the individual pre-training of unimodal encoders on
their respective domains, followed by large-scale vision-language joint
training [17, 18, 19, 20, 2, 1]. Through an interleaved visual language corpus
(_e.g_., MMC4 [21] and M3W [22]), auto-regressive models learn to process
images by converting them into visual tokens, combine these with textual
tokens, and input them into LLMs. Visual inputs are treated as a foreign
language, enhancing traditional text-only LLMs by enabling visual
understanding while retaining their language capabilities. Hence, a
straightforward pre-training strategy may not be designed to handle cases
where input text is significantly more aligned with visual texts in an image
than with the visual context of that image.

Vision-LLMs in AD Systems. Vision-LLMs have proven useful for perception,
planning, reasoning, and control in autonomous driving (AD) systems [6, 7, 9,
5]. For example, existing works have quantitatively benchmarked the linguistic
capabilities of Vision-LLMs in terms of their trustworthiness in explaining
the decision-making processes of AD [7]. Others have explored the use of
Vision-LLMs for vehicular maneuvering [8, 5], and [6] even validated an
approach in controlled physical environments. Because AD systems involve
safety-critical situations, comprehensive analyses of their vulnerabilities
are crucial for reliable deployment and inference. However, proposed adoptions
of Vision-LLMs into AD have been straightforward, which means existing issues
(_e.g_., vulnerabilities against typographic attacks) in such models are
likely present without proper countermeasures.

###  2.2 Transferable Adversarial Attacks

Adversarial attacks are most harmful when they can be developed in a closed
setting with public frameworks yet can still be realized to attack unseen,
closed-source models. The literature on these transferable attacks popularly
spans across gradient-based strategies. Against Vision-LLMs, our research
focuses on exploring the transferability of typographic attacks.

Gradient-based Attacks. Since Szegedy _et al_. introduced the concept of
adversarial examples, gradient-based methods have become the cornerstone of
adversarial attacks [23, 24]. Goodfellow _et al_. proposed the Fast Gradient
Sign Method (FGSM [25]) to generate adversarial examples using a single
gradient step, perturbing the model’s input before backpropagation. Kurakin
_et al_. later improved FGSM with an iterative optimization method, resulting
in Iterative-FGSM (I-FGSM) [26]. Projected Gradient Descent (PGD [27]) further
enhances I-FGSM by incorporating random noise initialization, leading to
better attack performance. Gradient-based transfer attack methods typically
use a known surrogate model, leveraging its parameters and gradients to
generate adversarial examples, which are then used to attack a black-box
model. These methods often rely on multi-step iterative optimization
techniques like PGD and employ various data augmentation strategies to enhance
transferability [28, 29, 30, 31, 32]. However, gradient-based methods face
limitations in adversarial transferability due to the disparity between the
surrogate and target models, and the tendency of adversarial examples to
overfit the surrogate model [33, 34].

Typographic Attacks. The development of large-scale pretrained vision-language
with CLIP [11, 12] introduced a form of typographic attacks that can impair
its zero-shot performances. A concurrent work [13] has also shown that such
typographic attacks can extend to language reasoning tasks of Vision-LLMs like
multi-choice question-answering and image-level open-vocabulary recognition.
Similarly, another work [14] has developed a benchmark by utilizing a Vision-
LLM to recommend an attack against itself given an image, a question, and its
answer on classification datasets. Several defense mechanisms [15, 16] have
been suggested by prompting the Vision-LLM to perform step-by-step reasoning.
Our research differs from existing works in studying autonomous typographic
attacks across question-answering scenarios of recognition, action reasoning,
and scene understanding, particularly against Vision-LLMs in AD systems. Our
work also discusses how they can affect reasoning capabilities at the image
level, region-level understanding, and even against multiple reasoning tasks.
Furthermore, we also discuss how these attacks can be realized in the physical
world, particularly against AD systems.

##  3 Preliminaries

###  3.1 Revisiting Auto-Regressive Vision-LLMs

As a simplified formulation of auto-regressive Vision-LLMs, suppose we have a
visual input $\mathbf{v}$, a sequence of tokens generated up to timestep
$t-1$, denoted as $x_{1},x_{2},\dots,x_{t-1}$, and $f(\cdot)$ as the Vision-
LLM model function, whose goal is to predict the next token $x_{t}$. We can
denote its output vector of logits $\mathbf{y}_{t}$ at each timestep $t$ based
on the previous tokens and the visual context:

$\displaystyle\mathbf{y}_{t}$
$\displaystyle=f(x_{1},\dots,x_{t-1},\mathbf{v})$ (1)
$\displaystyle=f(x_{1},\dots,x_{t-1},v_{1},\dots,v_{m}),$

where $v_{1},\dots,v_{m}$ denotes $m$ visual tokens encoded by a visual
encoder on $\mathbf{v}$. The logits $\mathbf{y}_{t}$ are converted into a
probability distribution using the softmax function. Specifically,
$y_{t,j}\in\mathbf{y}_{t}$ is the logit for token $j$ in the vocabulary $C$ at
timestep $t$, generally as follows:

$P(x_{t}=j|x_{1},x_{2},\dots,x_{t-1},\mathbf{v})=\frac{\exp(y_{t,j})}{\sum_{k\in
C}\exp(y_{t,k})}.$ (2)

Then, the general language modeling loss for training the model can be based
on cross-entropy loss. For a sequence of tokens
$\mathbf{x}=\\{x_{1},\dots,x_{n}\\}$, the loss is given by:

$\mathcal{L}_{LM}(\mathbf{x})=\sum_{t=1}^{n}\log P(x_{t}\ |\
x_{1},\dots,x_{t-1},v_{1},\dots,v_{m})=\sum_{k=1}^{n+m}\log P(x_{t}\ |\
z_{1},\dots,z_{k-1}),$ (3)

where $z_{i}$ denotes either a textual token $x$ or visual token $v$ at
position $i$. Vision-LLMs possess conversational capabilities at their core,
so interleaving language data ($m=0$) and vision-language data ($m>0$) during
optimization is crucial for enabling visual understanding while retaining
language reasoning [1]. Regardless of $m$, the loss objective of vision-guided
language modeling is essentially the same as auto-regressive language modeling
[35]. Consequently, as part of the alignment process, these practices imply
blurred boundaries between textual and visual feature tokens during training.
They may also facilitate text-to-text alignment between raw texts and within-
image texts at inference.

###  3.2 Typographic Attacks in Vision-LLMs-based AD Systems

The integration of Vision-LLMs into end-to-end AD systems has brought
promising results thus far [9], where Vision-LLMs can enhance user trust
through explicit reasoning steps of the scene. On the one hand, language
reasoning in AD systems can elevate their capabilities by utilizing the
learned commonsense of LLMs, while being able to proficiently communicate to
users. On the other hand, exposing Vision-LLMs to public traffic scenarios not
only makes them more vulnerable to typographic attacks that misdirect the
reasoning process but can also prove harmful if their results are connected
with decision-making, judgment, and control processes.

Table 1: Transferability and stealthiness of attacks.

Method |  SSIM$\uparrow$ | Exact$\downarrow$ | Lingo-Judge$\downarrow$ | BLEURT$\downarrow$ | BERTScore$\downarrow$
---|---|---|---|---|---
gradient-based, CLIP (16/255) [11] | 0.6425 | 0.3670 | 0.3126 | 0.4456 | 0.6766
gradient-based, ALBEF (16/255) [36] | 0.6883 | 0.3493 | 0.3139 | 0.4438 | 0.6754
our typographic attack | 0.9506 | 0.0700 | 0.0700 | 0.5563 | 0.7327

Unlike the less transferable gradient-based attacks, typographic attacks are
more transferable across Vision-LLMs by exploiting the inherent text-to-text
alignment between raw texts and within-image texts to introduce misleading
textual patterns in images, and influence the reasoning of a Vision-LLM,
_i.e_., dominating over visual-text alignment. In digital form, the attack is
formulated as a function $\tau(\cdot)$ that applies transformations
representing typographic attacks to obtain an adversarial image
$\hat{\mathbf{v}}=\tau(\mathbf{v})$. Then, Eq. 1 can be rewritten as:

$\displaystyle\mathbf{y}_{t}$
$\displaystyle=f(x_{1},\dots,x_{t-1},\color[rgb]{0,0,1}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,1}\hat{\mathbf{v}}\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0})$
(4)
$\displaystyle=f(x_{1},\dots,x_{t-1},\color[rgb]{0,0,1}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,1}\hat{v}_{1},\dots,\hat{v}_{m}\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}),$

where $\hat{v}_{1},\dots,\hat{v}_{m}$ denotes $m$ visual tokens under the
influenced image $\hat{\mathbf{v}}$, and whose textual content is meant to ❶
align with $\\{x_{1},\dots,x_{t-1}\\}$, ❷ yet guide the reasoning process
towards an incorrect answer. By exploiting the fundamental properties of many
Vision-LLMs in language modeling to construct adversarial patterns, ❸
typographic attacks $\tau(\cdot)$ aim to be transferable across various pre-
trained Vision-LLMs by directly influencing the visual information with texts.
Our study is geared towards typographic attacks in AD scenarios to thoroughly
understand the issues and raise awareness.

##  4 Methodology

Figure 1 shows an overview of our typographic attack pipeline, which goes from
prompt engineering to attack annotation, particularly through Attack Auto-
Generation, Attack Augmentation, and Attack Realization steps. We describe the
details of each step in the following subsections.

Figure 1: Our proposed pipeline is from attack generation via directives to
augmentation by commands and conjunctions to positioning the attacks and
finally influencing inference.

###  4.1 Auto-Generation of Typographic Attack

In this subsection, to handle the lack of both autonomy and diversity in
typographic attacks, we propose to employ the support of an LLM and prompt
engineering, denoted by a model function $l(\cdot)$, to generate adversarial
typographic patterns automatically. Let $\mathbf{q}$, $\mathbf{a}$
respectively be the question prompt input and its answer on an image
$\mathbf{v}$, the adversarial text can be naively generated as
$\hat{\mathbf{a}}$,

$\displaystyle\hat{\mathbf{a}}=l(\mathbf{q},\mathbf{a}).$ (5)

In order to generate useful misdirection, the adversarial patterns must align
with an existing question while guiding LLM toward an incorrect answer. We can
achieve this through a concept called directive, which refers to configuring
the goal for an LLM, _e.g_., ChatGPT, to impose specific constraints while
encouraging diverse behaviors. In our context, we direct the LLM to generate
$\mathbf{\hat{a}}$ as an opposite of the given answer $\mathbf{a}$, under the
constraint of the given question $\mathbf{q}$. Therefore, we can initialize
directives to the LLM using the following prompts in Fig. 2,

Figure 2: Context directive for constraints of attack generation.

When generating attacks, we would impose additional constraints depending on
the question type. In our context, we focus on tasks of ❶ scene reasoning
(_e.g_., counting), ❷ scene object reasoning (_e.g_., recognition), and ❸
action reasoning (_e.g_., action recommendation), as follows in Fig. 3,

Figure 3: Template directive for attack generation, and an example.

The directives encourage the LLM to generate attacks that influence a Vision-
LLM’s reasoning step through text-to-text alignment and automatically produce
typographic patterns as benchmark attacks. Clearly, the aforementioned
typographic attack only works for single-task scenarios, _i.e_., a single pair
of question and answer. To investigate multi-task vulnerabilities with respect
to multiple pairs, we can also generalize the formulation to $K$ pairs of
questions and answers, denoted as $\mathbf{q}_{i},\mathbf{a}_{i}$, to obtain
the adversarial text $\hat{\mathbf{a}}_{i}$ for $i\in\left[1,K\right]$.

###  4.2 Augmentations of Typographic Attack

Inspired by the success of instruction-prompting methodologies [37, 38], the
greedy reasoning in LLMs [39], and to further exploit the ambiguity between
textual and visual tokens in Vision-LLMs, we propose to augment the
typographic attacks prompts within images by explicitly providing instruction
keywords that emphasize text-to-text alignment over that of visual-language
tokens. Our approach realizes the concept in the form of instructional
directives: ❶ command directives for emphasizing a false answer and ❷
conjunction directives to additionally include attack clauses. In particular,
we have developed,

  * •

Command Directive. By embedding commands with the attacks, we aim to prompt
the Vision-LLMs into greedily producing erroneous answers. Our work
investigates the "ANSWER:" directive as a prefix before the first attack
prompt.

  * •

Conjunction Directive. Conjunctions, connectors (or the lack thereof) act to
link together separate attack concepts that make the overall text appear more
coherent, thereby increasing the likelihood of multi-task success. In our
work, we investigate these directives as "AND," "OR," "WITH," or simply empty
spaces as prefixes between attack prompts.

While other forms of directives can also be useful for enhancing the attack
success rate, we focus on investigating basic directives related to
typographic attacks in this work.

###  4.3 Realizations of Typographic Attacks

Digitally, typographic attacks are about embedding texts within images to fool
the capabilities of Vision-LLMs, which might involve simply putting texts into
the images. Physically, typographic attacks can incorporate real elements
(_e.g_., stickers, paints, and drawings) into environments/entities observable
by AI systems, with AD systems being prime examples. This would include the
placement of texts with unusual fonts or colors on streets, objects, vehicles,
or clothing to mislead AD systems in reasoning, planning, and control. We
investigate Vision-LLMs when incorporated into AD systems, as they are likely
under the most risk against typographic attacks. We categorize the placement
locations as being identified with backgrounds and foregrounds in traffic
scenes.

  * •

Backgrounds, which refer to elements in the environment that are static and
pervasive in a traffic scene (_e.g_., streets, buildings, and bus stops). The
background components present predefined locations for introducing deceptive
typographic elements of various sizes.

  * •

Foregrounds, which refer to dynamic elements and directly interact with the
perception of AD systems (_e.g_., vehicles, cyclists, and pedestrians). The
foreground components present dynamic and variable locations for typographic
attacks of various sizes.

In our work, foreground placements are supported by an open-vocabulary object
detector [40] to flexibly extract box locations of specific targets. Let
$\mathbf{A}=\hat{\mathbf{a}}_{1}||\dots||\hat{\mathbf{a}}_{K}$ be the
typographic concatenation of attacks, and $\mathbf{A}^{\prime}$ be its
augmented version, either on background or foreground, the function
$\tau(\cdot)$ would perform inpainting $\mathbf{A}$ or $\mathbf{A}^{\prime}$
into image $\mathbf{v}$’s cropped box coordinates
$x_{min},y_{min},x_{max},y_{max}$.

Depending on the attacked task, we observe that different text placements and
observed sizes would render some attacks more effective while some others are
negligible. Our research illuminates that background-placement attacks are
quite effective against scene reasoning and action reasoning but not as
effective against scene object reasoning unless foreground placements are also
included.

##  5 Experiments

Figure 4: Example attacks against Imp and GPT4 on the dataset by CVPRW’24.

###  5.1 Experimental Setup

We perform experiments with Vision-LLMs on VQA datasets for AD, such as
LingoQA [7] and the dataset of CVPRW’2024 Challenge
111https://cvpr24-advml.github.io by CARLA simulator. We have used LLaVa [2]
to output the attack prompts for LingoQA and the CVPRW’2024 dataset, and
manually for some cases of the latter. Regarding LingoQA, we tested 1000 QAs
in real traffic scenarios in tasks, such as scene reasoning and action
reasoning. Regarding the CVPRW’2024 Challenge dataset, we tested more than 300
QAs on 100 images, each with at least three questions related to scene
reasoning (_e.g_., target counting) and scene object reasoning of 5 classes
(cars, persons, motorcycles, traffic lights and road signals). Our evaluation
metrics are based on exact matches, Lingo-Judge Accuracy [7], and BLEURT [41],
BERTScore [42] against non-attacked answers, with SSIM (Structural Similarity
Index) to quantify the similarity between original and attacked images. In
terms of models, we qualitatively and/or quantitatively tested with LLaVa [2],
VILA [1], Qwen-VL [17], and Imp [18]. The models were run on an NVIDIA A40 GPU
with approximately 45GiB of memory.

Table 2: Ablation study of our automatic attack strategy effectiveness. Lower
scores mean more effective attacks, with (auto) denoting automatic attacks.

| Attack | LingoQA |  CVPRW’24 (counting only)
---|---|---|---
Type | Exact$\downarrow$ | Lingo-Judge$\downarrow$ | BLEURT$\downarrow$ | BERTScore$\downarrow$ | Exact$\downarrow$ | Lingo-Judge$\downarrow$ | BLEURT$\downarrow$ | BERTScore$\downarrow$
Qwen-VL | auto | 0.3191 | 0.3330 | 0.5460 | 0.6861 | 0.1950 | 0.1950 | 0.6267 | 0.7936
Imp | auto | 0.5244 | 0.4755 | 0.6398 | 0.7790 | 0.1900 | 0.1700 | 0.6194 | 0.7983
VILA | auto | 0.4744 | 0.5415 | 0.6462 | 0.7717 | 0.1700 | 0.1750 | 0.7052 | 0.8362
LLaVa | auto | 0.5053 | 0.4021 | 0.5771 | 0.7435 | 0.3450 | 0.3450 | 0.7524 | 0.8781

Table 3: Ablation of attack effectiveness on CVPRW’24 dataset’s counting
subtask. Lower scores mean more effective attacks, with (single) denoting
single question attack, (composed) for multi-task attack, and (+a) means
augmented with directives.

| Attack Type | Exact$\downarrow$ | Lingo-Judge$\downarrow$ | BLEURT$\downarrow$ | BERTScore$\downarrow$
---|---|---|---|---|---
Qwen-VL | single | 0.4000 | 0.3300 | 0.6890 | 0.8508
single+a | 0.3950 | 0.3350 | 0.6786 | 0.8354
composed | 0.0400 | 0.0400 | 0.5931 | 0.7998
composed+a | 0.0700 | 0.0700 | 0.5563 | 0.7327
Imp | single | 0.4850 | 0.3500 | 0.7032 | 0.8490
single+a | 0.4800 | 0.3600 | 0.6870 | 0.8402
composed | 0.0360 | 0.0300 | 0.5733 | 0.7954
composed+a | 0.0850 | 0.0800 | 0.5919 | 0.8047
VILA | single | 0.4650 | 0.4300 | 0.7642 | 0.8796
single+a | 0.4800 | 0.4600 | 0.7666 | 0.8871
composed | 0.0300 | 0.0300 | 0.6474 | 0.8121
composed+a | 0.0950 | 0.0950 | 0.6633 | 0.8221
LLaVa | single | 0.3900 | 0.3900 | 0.7641 | 0.8893
single+a | 0.4100 | 0.4100 | 0.7714 | 0.8929
composed | 0.0100 | 0.0100 | 0.6303 | 0.8549
composed+a | 0.1400 | 0.1400 | 0.6758 | 0.8694

Table 4: Ablation of both image-level (counting) and patch-level (target
recognition) attack strategy effectiveness on CVPRW’24 dataset. Lower scores
mean more effective attacks, with (naive patch) denoting typographic attacks
directly on a specific target, (composed) denoting multi-task attacks on both
the specific target and at the image level, and (+a) means augmented with
directives.

| Attack Type | Exact$\downarrow$ | Lingo-Judge$\downarrow$ | BLEURT$\downarrow$ | BERTScore$\downarrow$
---|---|---|---|---|---
Qwen-VL | naive patch | 0.2291 | 0.2088 | 0.3996 | 0.6442
composed | 0.1316 | 0.1088 | 0.3451 | 0.6247
composed+a | 0.0582 | 0.0303 | 0.2947 | 0.5718
Imp | naive patch | 0.1607 | 0.0860 | 0.5291 | 0.7838
composed | 0.1620 | 0.1114 | 0.5728 | 0.8092
composed+a | 0.1215 | 0.0658 | 0.5014 | 0.7674
VILA | naive patch | 0.4025 | 0.0810 | 0.5241 | 0.7238
composed | 0.1455 | 0.0506 | 0.5288 | 0.7687
composed+a | 0.0873 | 0.0329 | 0.5062 | 0.7498
LLaVa | naive patch | 0.2443 | 0.1949 | 0.5482 | 0.8208
composed | 0.0708 | 0.0443 | 0.5161 | 0.7376
composed+a | 0.0481 | 0.0278 | 0.4928 | 0.8152

####  5.1.1 Attacks on Scene/Action Reasoning

As shown in Tab. 2, Fig. 4, and Fig. 5, our framework of attack can
effectively misdirect various models’ reasoning. For example, Tab. 2 showcases
an ablation study on the effectiveness of automatic attack strategies across
two datasets: LingoQA and CVPRW’24 (focused solely on counting). The former
two metrics (_i.e_. Exact and Lingo-Judge) are used to evaluate semantic
correctness better, showing that short answers like the counting task can be
easily misled, but longer, more complex answers in LingoQA may be more
difficult to change. For example, the Qwen-VL attack scores 0.3191 under the
Exact metric for LingoQA, indicating relative effectiveness compared to other
scores in the same metric in counting. On the other hand, we see that the
latter two scores (_i.e_. BLEURT and BERTScore) are typically high, hinting
that our attack can mislead semantic reasoning, but even the wrong answers may
still align with humans decently.

In terms of scene reasoning, we show in Tab. 4, Tab. 4, and Fig. 4 the
effectiveness of our proposed attack against a number of cases. For example,
in Fig. 4, a Vision-LLM can somewhat accurately answer queries about a clean
image, but a typographic attacked input can make it fail, such as to
accurately count people and vehicles, and we show that an augmented
typographic attacked input can even attack stronger models (_e.g_. GPT4 [43]).
In Fig. 5, we also show that scene reasoning can be misdirected where
irrelevant details are focused on and hallucinate under typographic attacks.
Our work also suggests that scene object reasoning / grounded object reasoning
is typically more robust, as both object-level and image-level attacks may be
needed to change the models’ answers.

In terms of action reasoning, we show in Fig. 5 that Vision-LLMs can recommend
terribly bad advice, suggesting unsafe driving practices. Nevertheless, we see
a promising point when Qwen-VL recommended fatal advice, but it reconsidered
over the reasoning process of acknowledging the potential dangers of the
initial bad suggestion. These examples demonstrate the vulnerabilities in
automated reasoning processes under deceptive or manipulated conditions, but
they also suggest that defensive learning can be applied to enhance model
reasoning.

####  5.1.2 Compositions and Augmentations of Attacks

Table 5: Ablation study of our composition keywords, attack location on an
image and their overall effectiveness by the metric defined in the CVPRW’24
Challenge333https://challenge.aisafety.org.cn/#/competitionDetail?id=13.

|  | empty
---
(top)
| AND
---
(top)
| OR
---
(top)
| OR
---
(bottom)
| WITH
---
(top)
| WITH
---
(bottom)
| combined
---
(bottom)
| QwenVL, Imp, GPT4
---
composed+a
48.08 | 46.97 | 47.24 | 50.54 | 51.33 | 51.02 | 53.56

We showed that composing multiple QA tasks for an attack is possible for a
particular scenario, thereby suggesting that typographic attacks are not
single-task attacks, as suggested by previous works. Furthermore, we found
that augmentations of attacks are possible, which would imply that typographic
attacks that leverage the inherent language modeling process can misdirect the
reasoning of Vision-LLMs, as especially shown in the case of the strong GPT-4.
However, as shown in Tab. 3, it may be challenging to search for the best
augmentation keywords.

####  5.1.3 Towards Physical Typographic Attacks

In our toy experiments with semi-realistic attacks in Fig.5, we show that
attacks involve manipulating text within real-world settings are potentially
dangerous due to their ease of implementation, such as on signs, behind
vehicles, on buildings, billboards, or any everyday object that an AD system
might perceive and interpret to make decisions. For instance, modifying the
text on a road sign from "stop" to "go faster" can pose potentially dangerous
consequences on AD systems that utilize Vision-LLMs.

Figure 5: Example attacks on the LingoQA dataset against Qwen-VL-7B.

##  6 Conclusion

Our research has developed a comprehensive typographic attack framework
designed for benchmarking Vision-LLMs under AD systems, exploring their
adoption, the potential impacts on decision-making autonomy, and the methods
by which these attacks can be physically implemented. Firstly, our dataset-
agnostic framework is capable of automatically generating misleading responses
that misdirect the reasoning of Vision-LLMs. Secondly, our linguistic
formatting scheme is shown to augment attacks at a higher degree and can
extend to simultaneously targeting multiple reasoning tasks. Thirdly, our
study on the practical implementation of these attacks in physical traffic
scenarios is critical for highlighting the need for defense models. Our
empirical findings on the effectiveness, transferability, and realizability of
typographic attacks in traffic environments highlight their effects on
existing Vision-LLMs (e.g., LLaVA, Qwen-VL, VILA). This research underscores
the urgent need for increased awareness within the community regarding
vulnerabilities associated with integrating Vision-LLMs into AD systems.

Limitations. One of the primary limitations of our typographic attack
framework lies in its dependency on environmental control and predictability.
Our framework can demonstrate the vulnerability of Vision-LLMs to typographic
manipulations in controlled settings, so the variability and unpredictability
of real-world traffic scenarios can significantly diminish the consistency and
reproducibility of the attacks. Additionally, our attacks assume that AD
systems do not evolve to recognize and mitigate such manipulations, which may
not hold true as defensive technologies advance. Another limitation is the
ethical concern of testing and deploying such attacks, which could potentially
endanger public safety if not managed correctly. This necessitates a careful
approach to research and disclosure to ensure that knowledge of
vulnerabilities does not lead to malicious exploitation.

Safeguards. To safeguard against the vulnerabilities exposed by typographic
attacks, it is essential to develop robust defensive mechanisms within AD
systems. While the current literature on defensive techniques is still
understudied, there are ways forward to mitigate potential issues. A
concurrent work is investigating how better prompting can support better
reasoning to defend against the attacks [16], or how incorporating keyword
training of Vision-LLMs can make these systems more resilient to such attacks
by conditioning their answers on specific prefixes [15]. Another basic
approach is to detect and remove all non-essential texts in the visual
information. Overall, it is necessary to foster a community-wide effort toward
establishing standards and best practices for the secure deployment of Vision-
LLMs into AD.

Broader Impacts. The implications of our research into typographic attacks
extend beyond the technical vulnerabilities of AD systems, touching on broader
societal, ethical, and regulatory concerns. As Vision-LLMs and AD technologies
proliferate, the potential for such attacks underscores the need for
comprehensive safety and security frameworks that anticipate and mitigate
unconventional threats. This research highlights the interplay between
technology and human factors, illustrating how seemingly minor alterations in
a traffic environment can lead to significant misjudgments by AD systems,
potentially endangering public safety.

## References

  * [1] Ji Lin, Hongxu Yin, Wei Ping, Yao Lu, Pavlo Molchanov, Andrew Tao, Huizi Mao, Jan Kautz, Mohammad Shoeybi, and Song Han.  VILA: On pre-training for visual language models.  In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2024.
  * [2] Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jae Lee.  Visual instruction tuning.  In NeurIPS, 2023.
  * [3] Duzhen Zhang, Yahan Yu, Chenxing Li, Jiahua Dong, Dan Su, Chenhui Chu, and Dong Yu.  MM-LLMs: Recent advances in multimodal large language models.  In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics, 2024.
  * [4] Jinkyu Kim, Anna Rohrbach, Trevor Darrell, John F. Canny, and Zeynep Akata.  Textual explanations for self-driving vehicles.  In Vittorio Ferrari, Martial Hebert, Cristian Sminchisescu, and Yair Weiss, editors, Computer Vision - ECCV 2018 - 15th European Conference, Munich, Germany, September 8-14, 2018, Proceedings, Part II, volume 11206 of Lecture Notes in Computer Science, pages 577–593. Springer, 2018.
  * [5] Hao Shao, Yuxuan Hu, Letian Wang, Steven L. Waslander, Yu Liu, and Hongsheng Li.  LMDrive: Closed-loop end-to-end driving with large language models.  In CVPR, 2024.
  * [6] Can Cui, Zichong Yang, Yupeng Zhou, Yunsheng Ma, Juanwu Lu, Lingxi Li, Yaobin Chen, Jitesh Panchal, and Ziran Wang.  Personalized autonomous driving with large language models: Field experiments, 2024.
  * [7] Ana-Maria Marcu, Long Chen, Jan Hünermann, Alice Karnsund, Benoit Hanotte, Prajwal Chidananda, Saurabh Nair, Vijay Badrinarayanan, Alex Kendall, Jamie Shotton, and Oleg Sinavski.  LingoQA: Video question answering for autonomous driving.  arXiv preprint arXiv:2312.14115, 2023.
  * [8] Ming Nie, Renyuan Peng, Chunwei Wang, Xinyue Cai, Jianhua Han, Hang Xu, and Li Zhang.  Reason2Drive: Towards interpretable and chain-based reasoning for autonomous driving.  arXiv preprint, 2023.
  * [9] Zhenjie Yang, Xiaosong Jia, Hongyang Li, and Junchi Yan.  LLM4Drive: A survey of large language models for autonomous driving.  CoRR, abs/2311.01043, 2023.
  * [10] Haoqin Tu, Chenhang Cui, Zijun Wang, Yiyang Zhou, Bingchen Zhao, Junlin Han, Wangchunshu Zhou, Huaxiu Yao, and Cihang Xie.  How many unicorns are in this image? a safety evaluation benchmark for vision LLMs.  arXiv preprint arXiv:2311.16101, 2023.
  * [11] Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and Ilya Sutskever.  Learning transferable visual models from natural language supervision.  In Proceedings of the 38th International Conference on Machine Learning, ICML 2021, 18-24 July 2021, Virtual Event, volume 139 of Proceedings of Machine Learning Research, pages 8748–8763. PMLR, 2021.
  * [12] Gabriel Goh, Nick Cammarata †, Chelsea Voss †, Shan Carter, Michael Petrov, Ludwig Schubert, Alec Radford, and Chris Olah.  Multimodal neurons in artificial neural networks.  Distill, 2021.  https://distill.pub/2021/multimodal-neurons.
  * [13] Hao Cheng, Erjia Xiao, Jindong Gu, Le Yang, Jinhao Duan, Jize Zhang, Jiahang Cao, Kaidi Xu, and Renjing Xu.  Unveiling typographic deceptions: Insights of the typographic vulnerability in large vision-language model.  CoRR, abs/2402.19150, 2024.
  * [14] Maan Qraitem, Nazia Tasnim, Piotr Teterwak, Kate Saenko, and Bryan A. Plummer.  Vision-LLMs can fool themselves with self-generated typographic attacks.  CoRR, abs/2402.00626, 2024.
  * [15] Hiroki Azuma and Yusuke Matsui.  Defense-prefix for preventing typographic attacks on CLIP.  In IEEE/CVF International Conference on Computer Vision, ICCV 2023 - Workshops, Paris, France, October 2-6, 2023, pages 3646–3655. IEEE, 2023.
  * [16] Hao Cheng, Erjia Xiao, and Renjing Xu.  Typographic attacks in large multimodal models can be alleviated by more informative prompts.  arXiv preprint arXiv:2402.19150, 2024.
  * [17] Jinze Bai, Shuai Bai, Shusheng Yang, Shijie Wang, Sinan Tan, Peng Wang, Junyang Lin, Chang Zhou, and Jingren Zhou.  Qwen-VL: A versatile vision-language model for understanding, localization, text reading, and beyond.  arXiv preprint arXiv:2308.12966, 2023.
  * [18] Zhenwei Shao, Xuecheng Ouyang, Zhenbiao Gai, Zhou Yu, and Jun Yu.  Imp: An emprical study of multimodal small language models, 2024.
  * [19] Danny Driess, Fei Xia, Mehdi S. M. Sajjadi, Corey Lynch, Aakanksha Chowdhery, Brian Ichter, Ayzaan Wahid, Jonathan Tompson, Quan Vuong, Tianhe Yu, Wenlong Huang, Yevgen Chebotar, Pierre Sermanet, Daniel Duckworth, Sergey Levine, Vincent Vanhoucke, Karol Hausman, Marc Toussaint, Klaus Greff, Andy Zeng, Igor Mordatch, and Pete Florence.  PaLM-E: An embodied multimodal language model, 2023.
  * [20] Rohan Bavishi, Erich Elsen, Curtis Hawthorne, Maxwell Nye, Augustus Odena, Arushi Somani, and Sağnak Taşırlar.  Fuyu-8B: A multimodal architecture for ai agents, 2024.
  * [21] Wanrong Zhu, Jack Hessel, Anas Awadalla, Samir Yitzhak Gadre, Jesse Dodge, Alex Fang, Youngjae Yu, Ludwig Schmidt, William Yang Wang, and Yejin Choi.  Multimodal C4: an open, billion-scale corpus of images interleaved with text.  In Advances in Neural Information Processing Systems 36: Annual Conference on Neural Information Processing Systems 2023, NeurIPS 2023, New Orleans, LA, USA, December 10 - 16, 2023, 2023.
  * [22] Jean-Baptiste Alayrac, Jeff Donahue, Pauline Luc, Antoine Miech, Iain Barr, Yana Hasson, Karel Lenc, Arthur Mensch, Katherine Millican, Malcolm Reynolds, Roman Ring, Eliza Rutherford, Serkan Cabi, Tengda Han, Zhitao Gong, Sina Samangooei, Marianne Monteiro, Jacob L. Menick, Sebastian Borgeaud, Andy Brock, Aida Nematzadeh, Sahand Sharifzadeh, Mikolaj Binkowski, Ricardo Barreira, Oriol Vinyals, Andrew Zisserman, and Karén Simonyan.  Flamingo: a visual language model for few-shot learning.  In Advances in Neural Information Processing Systems 35: Annual Conference on Neural Information Processing Systems 2022, NeurIPS 2022, New Orleans, LA, USA, November 28 - December 9, 2022, 2022.
  * [23] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus.  Intriguing properties of neural networks.  arXiv preprint arXiv:1312.6199, 2013.
  * [24] Naveed Akhtar and Ajmal Mian.  Threat of adversarial attacks on deep learning in computer vision: A survey.  IEEE Access, 6:14410–14430, 2018.
  * [25] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy.  Explaining and harnessing adversarial examples.  arXiv preprint arXiv:1412.6572, 2014.
  * [26] Alexey Kurakin, Ian J Goodfellow, and Samy Bengio.  Adversarial examples in the physical world.  In Artificial intelligence safety and security, pages 99–112. Chapman and Hall/CRC, 2018.
  * [27] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu.  Towards deep learning models resistant to adversarial attacks.  arXiv preprint arXiv:1706.06083, 2017.
  * [28] Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan L Yuille.  Improving transferability of adversarial examples with input diversity.  In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 2730–2739, 2019.
  * [29] Xiaosen Wang, Xuanran He, Jingdong Wang, and Kun He.  Admix: Enhancing the transferability of adversarial attacks.  In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 16158–16167, 2021.
  * [30] Jianping Zhang, Jen-tse Huang, Wenxuan Wang, Yichen Li, Weibin Wu, Xiaosen Wang, Yuxin Su, and Michael R Lyu.  Improving the transferability of adversarial samples by path-augmented method.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 8173–8182, 2023.
  * [31] Jiadong Lin, Chuanbiao Song, Kun He, Liwei Wang, and John E Hopcroft.  Nesterov accelerated gradient and scale invariance for adversarial attacks.  arXiv preprint arXiv:1908.06281, 2019.
  * [32] Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu.  Evading defenses to transferable adversarial examples by translation-invariant attacks.  In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4312–4321, 2019.
  * [33] Zeyu Qin, Yanbo Fan, Yi Liu, Li Shen, Yong Zhang, Jue Wang, and Baoyuan Wu.  Boosting the transferability of adversarial attacks with reverse adversarial perturbation.  Advances in neural information processing systems, 35:29845–29858, 2022.
  * [34] Sensen Gao, Xiaojun Jia, Xuhong Ren, Ivor Tsang, and Qing Guo.  Boosting transferability in vision-language attacks via diversification along the intersection region of adversarial trajectory.  arXiv preprint arXiv:2403.12445, 2024.
  * [35] Alec Radford, Jeff Wu, Rewon Child, David Luan, Dario Amodei, and Ilya Sutskever.  Language models are unsupervised multitask learners.  OpenAI blog, 2019.
  * [36] Junnan Li, Ramprasaath R. Selvaraju, Akhilesh Deepak Gotmare, Shafiq Joty, Caiming Xiong, and Steven Hoi.  Align before fuse: Vision and language representation learning with momentum distillation.  In NeurIPS, 2021.
  * [37] Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Brian Ichter, Fei Xia, Ed H. Chi, Quoc V. Le, and Denny Zhou.  Chain-of-thought prompting elicits reasoning in large language models.  In Advances in Neural Information Processing Systems 35: Annual Conference on Neural Information Processing Systems 2022, NeurIPS 2022, New Orleans, LA, USA, November 28 - December 9, 2022, 2022.
  * [38] Guanzhi Wang, Yuqi Xie, Yunfan Jiang, Ajay Mandlekar, Chaowei Xiao, Yuke Zhu, Linxi Fan, and Anima Anandkumar.  Voyager: An open-ended embodied agent with large language models.  Transactions on Machine Learning Research, 2024.
  * [39] Abulhair Saparov and He He.  Language models are greedy reasoners: A systematic formal analysis of chain-of-thought.  In The Eleventh International Conference on Learning Representations, 2023.
  * [40] Shilong Liu, Zhaoyang Zeng, Tianhe Ren, Feng Li, Hao Zhang, Jie Yang, Chunyuan Li, Jianwei Yang, Hang Su, Jun Zhu, et al.  Grounding DINO: Marrying dino with grounded pre-training for open-set object detection.  arXiv preprint arXiv:2303.05499, 2023.
  * [41] Thibault Sellam, Dipanjan Das, and Ankur P Parikh.  BLEURT: Learning robust metrics for text generation.  In Proceedings of ACL, 2020.
  * [42] Tianyi Zhang*, Varsha Kishore*, Felix Wu*, Kilian Q. Weinberger, and Yoav Artzi.  BERTScore: Evaluating text generation with bert.  In International Conference on Learning Representations, 2020.
  * [43] OpenAI team.  GPT-4 technical report, 2024.


# Bayesian inference on the isospin splitting of nucleon effective mass from
giant resonances in 208Pb

Zhen<EMAIL_ADDRESS>Sino-French Institute of Nuclear
Engineering and Technology, Sun Yat-sen University, Zhuhai 519082, China  Xue-
Bin Feng  Sino-French Institute of Nuclear Engineering and Technology, Sun
Yat-sen University, Zhuhai 519082, China  Lie-Wen<EMAIL_ADDRESS>School of Physics and Astronomy, Shanghai Key Laboratory for Particle Physics
and Cosmology, and Key Laboratory for Particle Astrophysics and Cosmology
(MOE), Shanghai Jiao Tong University, Shanghai 200240, China

###### Abstract

From a Bayesian analysis of the electric dipole polarizability, the
constrained energy of isovector giant dipole resonance, the peak energy of
isocalar giant quadrupole resonance and the constrained energy of isocalar
giant monopole resonance in 208Pb, we extract the isoscalar and isovector
effective masses in nuclear matter at saturation density $\rho_{0}$ as
$m_{s,0}^{\ast}/m=0.87_{-0.04}^{+0.04}$ and
$m_{v,0}^{\ast}/m=0.78_{-0.05}^{+0.06}$ at $90\%$ confidence level. The
obtained constraints on $m_{s,0}^{\ast}$ and $m_{v,0}^{\ast}$ lead to a
positive isospin splitting of nucleon effective mass in asymmetric nuclear
matter of isospin asymmetry $\delta$ at $\rho_{0}$ as
$m_{n-p}^{*}/m=(0.20^{+0.15}_{-0.14})\delta$. In addition, the symmetry energy
at the subsaturation density $\rho^{\ast}=0.05~{}\mathrm{fm}^{-3}$ is
determined to be $E_{\mathrm{sym}}(\rho^{\ast})=16.7\pm 1.3$ MeV at $90\%$
confidence level.

###### pacs:

21.65.Ef, 21.65.Cd, 24.30.Cz, 21.30.Fe

##  I Introduction

The nucleon effective mass, which characterizes the momentum or energy
dependence of single nucleon potential in nuclear medium, is crucial in
nuclear physics and astrophysics Jeukenne et al. (1976); Mahaux et al. (1985);
Jaminon and Mahaux (1989); Li and Chen (2015); Li et al. (2018). While various
kinds of nucleon effective masses have been defined in nonrelativistic and
relativistic approaches Mahaux et al. (1985); Jaminon and Mahaux (1989); Li
and Chen (2015); Li et al. (2018); Chen et al. (2007); Li et al. (2008), here
we focus on the total effective mass normally used in the nonrelativistic
approach. In asymmetric nuclear matter, effective masses of neutrons and
protons, $m_{n}^{\ast}$ and $m_{p}^{\ast}$, may be different due to the
momentum dependence of the symmetry potential. The difference
$m_{n-p}^{\ast}\equiv m_{n}^{\ast}-m_{p}^{\ast}$ is the so-called isospin
splitting of nucleon effective mass, which plays an important role in many
physical phenomena and questions in nuclear physics, astrophysics, and
cosmology Li and Chen (2015); Li et al. (2018). For example, the
$m_{n-p}^{\ast}$ affects the isospin dynamics in heavy-ion collisions Li et
al. (2004); Li and Chen (2005); Chen et al. (2005); Rizzo et al. (2005);
Giordano et al. (2010); Feng (2012); Zhang et al. (2014); Xie and Zhang
(2014), thermodynamic properties of asymmetric nuclear matter Behera et al.
(2011); Xu et al. (2015); Xu (2015), and cooling of neutron stars Baldo et al.
(2014).

Due to the limited isospin asymmetry in normal nuclei, the accurate
determination of $m_{n-p}^{\ast}$ is rather difficult. Even the sign of
$m_{n-p}^{\ast}$ remains a debated issue. For example, $m_{n-p}^{\ast}>0$ in
neutron-rich matter at the nuclear saturation density $\rho_{0}\approx 0.16$
fm-3 is favored by optical model analyses of nucleon-nucleus scattering data
Li et al. (2015); Xu et al. (2010), Skyrme energy density functional (EDF)
Zhang and Chen (2016) and transport model Kong et al. (2017) analyses of
nuclear giant resonances, Brueckner-Hartree-Fock calculations Zuo et al.
(1999, 2005); Ma et al. (2004); van Dalen et al. (2005), chiral effective
theory Zhang et al. (2018); Holt et al. (2013, 2016) and an analysis of
various constraints on the magnitude and density slope of symmetry energy Li
and Han (2013), whereas the transport model analyses on single and/or double
n/p ratio in heavy-ion collisions Coupland et al. (2016); Morfouace et al.
(2019) (but see Ref. Kong et al. (2015)) and an energy density functional
study on nuclear electric dipole polarizability Malik et al. (2018) lead to
opposite conclusions.

To understand these contradictive results and eventually determine the isospin
splitting of nucleon effective mass needs not only the improvement of both
theoretical models/calculations and experimental measurements, but also more
sophisticated analysis approaches to quantifying the model uncertainties based
on given experimental measurements. The latter is a quite general issue in
nuclear theory, where due to the lack of a well-settled ab initio starting
point, a lot of effective theories or models have been developed with
parameters determined by fitting empirical knowledge or experimental data
Dobaczewski et al. (2014). Over the past decade, various statistical
approaches, e.g., covariance analysis Reinhard and Nazarewicz (2010);
Piekarewicz et al. (2015), Bayesian analysis McDonnell et al. (2015); Bernhard
et al. (2015); Pratt et al. (2015); Xie and Li (2019, 2020); Drischler et al.
(2020); Xu et al. (2020); Kejzlar et al. (2020) and bootstrap method Bertsch
and Bingham (2017); Pastore (2019), have been introduced in nuclear physics
studies to quantify uncertainties and evaluate correlations of model
parameters. Among them, the Bayesian inference method has been accepted as a
powerful statistical approach and extensively used in various areas of nuclear
physics. For a very recent review on Bayesian analysis and its applications in
nuclear structure study, we refer the readers to Ref. Kejzlar et al. (2020).

In our previous work Zhang and Chen (2016), we have extracted the isospin
splitting of nucleon effective mass from the isovector giant dipole resonance
(IVGDR) and isocalar giant quadrupole resonance (ISGQR) of 208Pb based on
random phase approximation (RPA) calculations using a number of representative
Skyrme interactions. However, some factors in the analysis, e.g., the choice
of Skyrme interactions and the priorly assumed linear
$1/E_{\mathrm{GQR}}^{2}$-$m_{s,0}^{\ast}$ relations, could affect the
conclusions, and the statistical meaning of the obtained uncertainties are
therefore unclear. In the present work, within the framework of Skyrme energy
density functional theory and random phase approximation approach, we employ
the Bayesian inference method to extract the isospin splitting of nucleon
effective mass from the electric dipole polarizability Tamii et al. (2011);
Roca-Maza et al. (2015), the constrained energy in IVGDR Dietrich and Berman
(1988) and the ISGQR peak energy Roca-Maza et al. (2013a) in 208Pb. The
binding energy Wang et al. (2017), the charge radius Angeli and Marinova
(2013), the constrained energy of isocalar giant monopole resonance (ISGMR)
Patel et al. (2013) and the neutron $3p_{1/2}-3p_{3/2}$ energy splitting
Vautherin and Brink (1972) of 208Pb are also included in the analysis to
guarantee the energy density functional can always reasonably describe the
ground state and collective excitation state of 208Pb. The isoscalar and
isovector effective masses, and the neutron-proton effective mass splitting at
saturation density together with the symmetry energy at the subsaturation
density $\rho^{\ast}=0.05~{}\mathrm{fm}^{-3}$ are extracted from the Bayesian
analysis.

The paper is organized as follows. In Sec. II, we introduce the theoretical
models and statistical approaches used in this work. In the next section
presented are the results for the uncertainties of model parameters, the
isospin splitting of nucleon effective mass at $\rho_{0}$ and the symmetry
energy at $\rho^{\ast}=0.05~{}\mathrm{fm}^{-3}$. Finally, we draw conclusions
in Sec. IV.

##  II Model and Method

###  II.1 Nucleon effective mass in Skyrme energy density functional

As in Ref. Zhang and Chen (2016), we study the nucleon effective mass within
the standard Skyrme energy density functional based on the conventional Skyrme
interaction:

$\displaystyle v(\bm{r}_{1},\bm{r}_{2})$ $\displaystyle=$ $\displaystyle
t_{0}(1+x_{0}P_{\sigma})\delta(\bm{r}_{1}-\bm{r}_{2})$ (1)
$\displaystyle+\frac{1}{2}t_{1}(1+x_{1}P_{\sigma})[\bm{k}^{\prime
2}\delta(\bm{r}_{1}-\bm{r}_{2})+\mathrm{c.c.}]$
$\displaystyle+t_{2}(1+x_{2}P_{\sigma})\bm{k}^{\prime}\cdot\delta(\bm{r}_{1}-\bm{r}_{2})\bm{k}$
$\displaystyle+\frac{1}{6}t_{3}(1+x_{3}P_{\sigma})\rho^{\alpha}\left(\frac{\bm{r}_{1}+\bm{r}_{2}}{2}\right)\delta(\bm{r}_{1}-\bm{r}_{2})$
$\displaystyle+iW_{0}(\bm{\sigma}_{1}+\bm{\sigma}_{2})\cdot[\bm{k}^{\prime}\times\delta(\bm{r}_{1}-\bm{r}_{2})\bm{k}].$

Here $\bm{\sigma}_{i}$ is the Pauli spin operator,
$P_{\sigma}=(1+\bm{\sigma}_{1}\cdot\bm{\sigma}_{2})/2$ is the spin-exchange
operator, $\bm{k}=-i(\bm{\nabla}_{1}-\bm{\nabla}_{2})/2$ is the relative
momentum operator, and $\bm{k}^{\prime}$ is the conjugate operator of $\bm{k}$
acting on the left.

Within the framework of Skyrme energy density functional, the 9 parameters
$t_{0}-t_{3}$, $x_{0}-x_{3}$ and $\alpha$ of the Skyrme interaction can be
expressed in terms of 9 macroscopic quantities (pseudo-observables): the
nuclear saturation density $\rho_{0}$, the energy per particle of symmetric
nuclear matter $E_{0}(\rho_{0})$, the incompressibility $K_{0}$, the isocalar
effective mass $m_{s,0}^{*}$ at $\rho_{0}$, the isovector effective mass
$m_{v,0}^{*}$ at $\rho_{0}$, the gradient coefficient $G_{S}$, the symmetry-
gradient coefficient $G_{V}$, and the magnitude $E_{\mathrm{sym}}(\rho_{0})$
and density slope $L$ of the nuclear symmetry energy at $\rho_{0}$ Chen et al.
(2010); Chen and Gu (2012); Kortelainen et al. (2010). The detailed analytical
expressions can be found in Ref. Chen et al. (2010); Chen and Gu (2012). Since
the 9 macroscopic quantities have clear physical meaning and available
empirical ranges, in the Bayesian analysis, we use them as model parameters.
Consequently, our model has the following 10 parameters:

$\displaystyle\bm{p}$ $\displaystyle=$
$\displaystyle\\{\rho_{0},~{}E_{0}(\rho_{0}),~{}K_{0},~{}E_{\mathrm{sym}}(\rho_{0}),~{}L,$
(2)
$\displaystyle~{}G_{S},~{}G_{V},~{}W_{0},~{}m_{s,0}^{\ast},~{}m_{v,0}^{\ast}\\}.$

In terms of the Skyrme parameter $t_{0}\sim t_{3}$ and $x_{0}\sim x_{3}$, the
nucleon effective mass in asymmetric nuclear matter with density $\rho$ and
isospin asymmetry $\delta$ can be expressed as Chabanat et al. (1997)

$\displaystyle\frac{\hbar^{2}}{2m_{q}^{\ast}(\rho,\delta)}$ $\displaystyle=$
$\displaystyle\frac{\hbar^{2}}{2m}+\frac{1}{4}t_{1}\left[\left(1+\frac{1}{2}x_{1}\right)\rho-\left(\frac{1}{2}+x_{1}\right)\rho_{q}\right]$
(3) $\displaystyle+$
$\displaystyle\frac{1}{4}t_{2}\left[\left(1+\frac{1}{2}x_{2}\right)\rho+\left(\frac{1}{2}+x_{2}\right)\rho_{q}\right].$

The well-known isocalar and isovector effective masses, $m_{s}^{\ast}$ and
$m_{v}^{\ast}$, which are respectively defined as the proton (neutron)
effective mass in symmetric nuclear matter and pure neutron (proton) matter,
are then given by Chabanat et al. (1997)

$\displaystyle\frac{\hbar^{2}}{2m_{s}^{\ast}(\rho)}=\frac{\hbar^{2}}{2m}+\frac{3}{16}t_{1}\rho+\frac{1}{16}t_{2}(4x_{2}+5)\rho,$
(4)
$\displaystyle\frac{\hbar^{2}}{2m_{v}^{*}(\rho)}=\frac{\hbar^{2}}{2m}+\frac{1}{8}t_{1}(x_{1}+2)\rho+\frac{1}{8}t_{2}(x_{2}+2)\rho.$
(5)

Once given $m_{s}^{\ast}$ and $m_{v}^{\ast}$, the isospin splitting of nucleon
effective mass can be obtained as Zhang and Chen (2015)

$\displaystyle m^{\ast}_{n-p}(\rho,\delta)$ $\displaystyle\equiv$
$\displaystyle\frac{m_{n}^{\ast}-m_{p}^{\ast}}{m}=2\frac{m_{s}^{\ast}}{m}\sum_{n=1}^{\infty}\left(\frac{m_{s}^{\ast}-m_{v}^{\ast}}{m_{v}^{\ast}}\delta\right)^{2n-1}$
(6) $\displaystyle=$ $\displaystyle\sum_{n=1}^{\infty}\Delta
m^{*}_{2n-1}(\rho)\delta^{2n-1},$

with the isospin splitting coefficients $\Delta m^{*}_{2n-1}(\rho)$ given by

$\displaystyle\Delta
m^{*}_{2n-1}(\rho)=2\frac{m_{s}^{\ast}}{m}\left(\frac{m_{s}^{\ast}}{m_{v}^{\ast}}-1\right)^{2n-1}.$
(7)

In the following, we use $\Delta m_{1}^{\ast}$ to indicate the linear isospin
splitting coefficient at the saturation density $\rho_{0}$.

###  II.2  Nuclear giant resonances

Nuclear giant resonances are usually studied using random phase approximation
(RPA) approach Colò et al. (2013). For a given excitation operator
$\hat{F}_{JM}$, the strength function is calculated as:

$S(E)=\sum_{\nu}|\langle\nu\|\hat{F}_{J}\|\tilde{0}\rangle|^{2}\delta(E-E_{\nu}),$
(8)

with $E_{\nu}$ being the energy of RPA excitation state $|\nu\rangle$, and the
moments $m_{k}$ of strength function (sum rules) are usually evaluated as:

$m_{k}=\int
dEE^{k}S(E)=\sum_{\nu}|\langle\nu\|\hat{F}_{J}\|\tilde{0}\rangle|^{2}E_{\nu}^{k}.$
(9)

For the ISGMR, IVGDR and ISGQR studied here, the excitation operators are
defined as:

$\displaystyle\hat{F}^{\mathrm{IS}}_{0}$ $\displaystyle=$
$\displaystyle\sum_{i}^{A}r_{i}^{2}$ (10)
$\displaystyle\hat{F}^{\mathrm{IV}}_{1M}$ $\displaystyle=$
$\displaystyle\frac{N}{A}\sum^{Z}_{i=1}r_{i}Y_{\text{1M}}(\hat{r}_{i})-\frac{Z}{A}\sum^{N}_{i=1}r_{i}Y_{\text{1M}}(\hat{r}_{i}),$
(11) $\displaystyle\hat{F}^{\mathrm{IS}}_{2M}$ $\displaystyle=$
$\displaystyle\sum_{i=1}^{A}r_{i}^{2}Y_{2M}(\hat{r}_{i}),$ (12)

where $Z$, $N$ and $A$ are proton, neutron and mass number, respectively;
$r_{i}$ is the nucleon’s radial coordinate; $Y_{\text{1M}}(\hat{r_{i}})$ and
$Y_{\text{2M}}(\hat{r_{i}})$ are the corresponding spherical harmonic
function.

Particularly, in linear response theory, the inverse energy weighted sum rule
can also be extracted from the constrained Hartree-Fock (CHF) approach Bohigas
et al. (1979); Sil et al. (2006):

$m_{-1}=-\left.\frac{1}{2}\frac{d^{2}\langle\lambda|\mathcal{H}|\lambda\rangle}{d\lambda^{2}}\right|_{\lambda=0},$
(13)

where $|\lambda\rangle$ is the ground-state for the nuclear system Hamilton
$\mathcal{H}$ constrained by the field $\lambda\hat{F}_{J}$.

The energy of isoscalar giant monopole resonance (GMR), i.e., the breathing
mode, is an important probe of the incompressibility in nuclear matter. It can
be evaluated in the constrained approximation Blaizot (1980) as

$E_{\mathrm{GMR}}=\sqrt{\frac{m_{1}(\mathrm{GMR})}{m_{-1}(\mathrm{GMR})}},$
(14)

where the energy weighted sum rule $m_{1}$ of ISGMR is related to the ground-
state rms radius $\langle r^{2}\rangle$ by Bohr and Mottelson (1975)

$m_{1}(\mathrm{GMR})=2\frac{\hbar^{2}}{m}A\langle r^{2}\rangle.$ (15)

Therefore, we calculate the $E_{\mathrm{GMR}}$ by using the CHF method for
computational efficiency.

For the isovector giant dipole resonance, we consider two observables, the
electric dipole polarizability $\alpha_{\mathrm{D}}$ and the constrained
energy $E_{\mathrm{GDR}}\equiv\sqrt{m_{1}/m_{-1}}$. The $\alpha_{\mathrm{D}}$
in 208Pb probes the symmetry energy at about $\rho_{0}/3$ Zhang and Chen
(2015) and is therefore sensitive to both the magnitude and density slope of
the symmetry energy at saturation density Roca-Maza et al. (2013b). It is
related to the inverse energy-weighted sum rule in the IVGDR by

$\alpha_{\mathrm{D}}=\frac{8\pi}{9}e^{2}m_{-1}(\mathrm{GDR}).$ (16)

Meanwhile, the energy weighted sum rule $m_{1}$ of IVGDR is related to the
isovector effective mass at saturation density $m_{v,0}^{\ast}$ via Colò et
al. (2013); Zhang and Chen (2016)

$m_{1}(\mathrm{GDR})=\frac{9}{4\pi}\frac{\hbar^{2}}{2m}\frac{NZ}{A}(1+\kappa)\approx\frac{9\hbar^{2}}{8\pi}\frac{NZ}{A}\frac{1}{m_{v,0}^{\ast}},$
(17)

where $\kappa$ is the well-known Thomas-Reiche-Kuhn sum rule enhancement. One
then has approximately

$~{}E_{\mathrm{GDR}}^{2}\propto\frac{1}{m_{v,0}^{\ast}\alpha_{\mathrm{D}}},$
(18)

which suggests that the $E_{\mathrm{GDR}}$ is negatively correlated to the
$m_{v,0}^{\ast}$.

As well known, the excitation energy of isocalar giant quadruple resonance is
sensitive to the isoscalar effective mass at saturation density. For example
in the harmonic oscillator model, the ISGQR energy is Bohr and Mottelson
(1975); Roca-Maza et al. (2013a)

$E_{\mathrm{GQR}}=\sqrt{\frac{2m}{m_{s,0}^{*}}}\hbar\omega_{0}$ (19)

with $\hbar\omega_{0}$ being the frequency of the harmonic oscillator. In the
present work, we determine the $E_{\mathrm{GQR}}$ as the peak energy of the
response function obtained from RPA calculations. To obtain continuous
response function, the discrete RPA results are smeared out with Lorentzian
functions. The width of Lorentzian functions is taken to be $3$ MeV to roughly
reproduce experimental width $\sim 3$ MeV of ISGQR.

Table 1: Prior ranges of the ten parameters used. Quantity | lower limit | upper limit
---|---|---
$\rho_{0}~{}(\mathrm{fm}^{-3})$ | 0.155 | 0.165
$E_{0}~{}(\mathrm{MeV})$ | -16.5 | -15.5
$K_{0}~{}(\mathrm{MeV})$ | 210.0 | 250.0
$E_{\mathrm{sym}}(\rho_{0})~{}(\mathrm{MeV})$ | 29.0 | 35.0
$L~{}(\mathrm{MeV})$ | 20.0 | 120.0
$G_{S}~{}(\mathrm{MeV}\cdot\mathrm{fm}^{5})$ | 110.0 | 170.0
$G_{V}~{}(\mathrm{MeV}\cdot\mathrm{fm}^{5})$ | -70.0 | 70.0
$W_{0}~{}(\mathrm{MeV}\cdot\mathrm{fm}^{5})$ | 110.0 | 140.0
$m_{s,0}^{\ast}/m$ | 0.7 | 1.0
$m_{v,0}^{\ast}/m$ | 0.6 | 0.9
Table 2: Experimental values and uncertainties used for the binding energy $E_{B}$ Wang et al. (2017), the charge radius $r_{C}$ Angeli and Marinova (2013), the breathing mode energy $E_{\mathrm{GMR}}$ Patel et al. (2013), the neutron $3p_{1/2}-3p_{3/2}$ energy level splitting $\epsilon_{ls}$ Vautherin and Brink (1972), the electric dipole polarizability $\alpha_{\mathrm{D}}$ Tamii et al. (2011); Roca-Maza et al. (2015), the IVGDR constrained energy Dietrich and Berman (1988) and the ISGQR peak energy Roca-Maza et al. (2013a) in 208Pb. | value | $\sigma$
---|---|---
$E_{B}$ (MeV) | -1363.43 | 0.5
$r_{C}$ (fm) | 5.5012 | 0.01
$E_{\mathrm{GMR}}$ (MeV) | 13.5 | 0.1
$\epsilon_{ls}$ (MeV) | 0.89 | 0.09
$\alpha_{\mathrm{D}}~{}(\mathrm{fm}^{3})$ | 19.6 | 0.6
$E_{\mathrm{GDR}}$ (MeV) | 13.46 | 0.1
$E_{\mathrm{GQR}}$ (MeV) | 10.9 | 0.1

###  II.3 Bayesian analysis

The Bayesian analysis method has been widely accepted as a powerful
statistical approach to quantifying the uncertainties and evaluating the
correlations of model parameters as well as making predictions with certain
confidence level according to experimental measurements and empirical
knowledge McDonnell et al. (2015); Bernhard et al. (2015); Pratt et al.
(2015); Xie and Li (2019, 2020); Drischler et al. (2020); Xu et al. (2020);
Kejzlar et al. (2020). In this work, we employ the MADAI package MAD  to do
Bayesian analysis based on the Gaussian process emulators. For details on the
statistical approach, we refer the readers to, e.g., Ref. Bernhard et al.
(2015).

According to Bayes’ theorem, the posterior probability distribution of model
parameter $\bm{p}$ (which we are seeking for) given experimental measurements
$\bm{\mathcal{O}}^{\mathrm{exp}}$ for a set of observables $\bm{\mathcal{O}}$
can be evaluated as

$P(\bm{p}|\mathcal{M},\bm{\mathcal{O}}^{\mathrm{exp}})=\frac{P(\mathcal{M},\bm{\mathcal{O}}^{\mathrm{exp}}\mid\bm{p})P(\bm{p})}{\int
P(\mathcal{M},\bm{\mathcal{O}}^{\mathrm{exp}}\mid\bm{p})P(\bm{p})d\bm{p}},$
(20)

where $\mathcal{M}$ is the given model, $P(\bm{p})$ is the prior probability
of model parameters $\bm{p}$ before being confronted with the experimental
measurements $\bm{\mathcal{O}}^{\mathrm{exp}}$, and
$P(\mathcal{M},\bm{\mathcal{O}}^{\mathrm{exp}}|\bm{p})$ denotes the likelihood
or the conditional probability of observing $\bm{\mathcal{O}}^{\mathrm{exp}}$
given the model $\mathcal{M}$ predictions at $\bm{p}$. The posterior
univariate distribution of a single model parameter $p_{i}$ is given by

$P(p_{i}|\mathcal{M},\bm{\mathcal{O}}^{\mathrm{exp}})=\frac{\int
P(\bm{p}|\mathcal{M},\bm{\mathcal{O}}^{\mathrm{exp}})d\prod_{j\neq
i}p_{j}}{\int
P(\bm{p}|\mathcal{M},\bm{\mathcal{O}}^{\mathrm{exp}})d\prod_{j}p_{j}},$ (21)

and the correlated bivariate distribution of two parameters $p_{i}$ and
$p_{j}$ is given by

$P[(p_{i},p_{j})|\mathcal{M},\bm{\mathcal{O}}^{\mathrm{exp}}]=\frac{\int
P(\bm{p}|\mathcal{M},\bm{\mathcal{O}}^{\mathrm{exp}})d\prod_{k\neq
i,j}p_{k}}{\int
P(\bm{p}|\mathcal{M},\bm{\mathcal{O}}^{\mathrm{exp}})d\prod_{k}p_{k}}.$ (22)

From the univariate distribution, the mean value of $p_{i}$ can be calculated
as

$\langle p_{i}\rangle=\int
p_{i}P(p_{i}|\mathcal{M},\bm{\mathcal{O}}^{\mathrm{exp}})dp_{i}.$ (23)

The confidence interval of $p_{i}$ at a confidence level $1-\alpha$ is
normally obtained as the interval between the $(50\alpha)^{\text{th}}$ and
$(100-50\alpha)^{\text{th}}$ percentile of the posterior univariate
distribution. Particularly, the median value $U_{p_{i}}$ of $p_{i}$ is defined
as the $50^{\mathrm{th}}$ percentile, i.e.,

$\int^{U_{p_{i}}}_{-\infty}P(p_{i}|\mathcal{M},\bm{\mathcal{O}}^{\mathrm{exp}})dp_{i}=0.5.$
(24)

For the prior distribution, we assume the ten parameters uniformly distributed
in the empirical ranges listed in Tab. 1. As can be seen from Eq. (20), the
posterior distribution is determined by the combination of the prior
distribution and likelihood function, which depends on the experimental
measurement for observable. Therefore, the prior distribution is very
important in the Bayesian analysis and can significantly affect the extracted
constraints. Nevertheless, in the present work, due to the relatively poor
knowledge on $m_{s,0}^{\ast}$ and $m_{v,0}^{\ast}$ in the Skyrme EDF, we
assume large prior ranges for $m_{s,0}^{\ast}$ and $m_{v,0}^{\ast}$ and thus
the constraints on nucleon effective masses are mainly due to the giant
resonance observables. Narrowing the prior ranges of all parameters by $20\%$
only slightly reduces the posterior uncertainties of the iospin splitting of
nucleon effective mass by few percent.

The likelihood function is taken to be the commonly used Gaussian form

$P(\mathcal{M},\bm{\mathcal{O}}^{\mathrm{exp}}_{i}\mid\bm{p})\propto\mathrm{exp}\left\\{-\sum_{i}\frac{[\mathcal{O}_{i}(\bm{p})-\mathcal{O}^{\mathrm{exp}}_{i}]^{2}}{2\sigma_{i}^{2}}\right\\},$
(25)

where $\mathcal{O}_{i}(\bm{p})$ is the model prediction for an observable at
given point $\bm{p}$, $\mathcal{O}^{\mathrm{exp}}_{i}$ is the corresponding
experimental measurement, and $\sigma_{i}$ is the uncertainty or the width of
likelihood function. For a given parameter set $\bm{p}$, we calculate the
following 7 observables in 208Pb from Hartree-Fock, CHF and RPA calculations:
the electric dipole polarizability $\alpha_{\rm{D}}$ Tamii et al. (2011);
Roca-Maza et al. (2015), the IVGDR constrained energy $E_{\rm{GDR}}$Dietrich
and Berman (1988), the ISGQR peak energy $E_{\mathrm{GQR}}$ Roca-Maza et al.
(2013a), the binding energy $E_{B}$ Wang et al. (2017), the charge radius
$r_{C}$ Angeli and Marinova (2013), the breathing mode energy
$E_{\mathrm{GMR}}$ Patel et al. (2013) and the neutron $3p_{1/2}-3p_{3/2}$
energy level splitting $\epsilon_{ls}$ Vautherin and Brink (1972). The
experimental values for the 7 observables together with the assigned
uncertainties are listed in Tab. 2. For the $\alpha_{\mathrm{D}}$ and
$E_{\mathrm{GMR}}$, the $\sigma_{i}$ are taken to be their experimental
uncertainties given in Refs. Tamii et al. (2011) and Patel et al. (2013); for
the well determined $E_{B}$, $r_{C}$, $\epsilon_{ls}$ and $E_{\mathrm{GDR}}$,
we assign them artificial $1\sigma$ errors of $0.5$ MeV, $0.01$ fm, $0.09$ MeV
and $0.1$ MeV, respectively; for the experimental value and uncertainty of
$E_{\mathrm{GQR}}$, we use the weighted average of experimental measurements,
$10.9\pm 0.1$ MeV reported in Ref. Roca-Maza et al. (2013a). We note that
decreasing the artificial errors of $E_{B}$, $r_{C}$, $\epsilon_{ls}$ and
$E_{\mathrm{GDR}}$ by half only slightly reduces the posterior uncertainty of
$\Delta m_{1}^{*}$ by about $7\%$, and does not affect the constraint on the
symmetry energy at the subsaturation density
$\rho^{*}=0.05~{}\mathrm{fm}^{-3}$.

According to the prior distribution and defined likelihood function, the
Markov chain Monte Carlo (MCMC) process using Metropolis-Hastings algorithm is
performed to evaluate the posterior distributions of model parameters. For
10-dimensional parameter space in this work, a huge number of MCMC steps are
needed to extract posterior distributions, and thus theoretical calculations
for all MCMC steps are infeasible. Instead, in this work, we first sample a
number of parameter sets in the designed parameter space, and train Gaussian
process (GP) emulators Rasmussen and Williams (2006) using the model
predictions with the sampled parameter sets. The obtained GPs provide fast
interpolators and are used to evaluate the likelihood function in each MCMC
step.

Figure 1: (Color online). Visualization of the Pearson correlation coefficients among model parameters and observables from the training data. The numerical values of correlation coefficients are annotated and color-coded, where darker red indicates more positive values and darker blue indicates more negative. Figure 2: (Color online). Univariate and bivariate posterior distributions of the 10 model parameters. The solid, dashed and dotted lines in the upper-right panels enclose $68.3\%$, $90\%$ and $95.4\%$ confidence regions, respectively; the diagonal plots show Gaussian kernel density estimations of the posterior marginal distribution for respective parameters; in the lower-left panels are scatter histograms of MCMC samples. The range of variations of the 10 parameters are the prior range listed in Table 1. Table 3: Best value, mean, median and confidence intervals of the model parameters from MCMC sampling. | best | mean | median |  $68.3\%$ C.I. |  $90\%$ C.I. |  $95.4\%$ C.I.
---|---|---|---|---|---|---
$\rho_{0}~{}(\text{fm}^{-3})$ | 0.1597 | 0.1612 | 0.1613 | $0.1589\sim 0.1635$ | $0.1577\sim 0.1644$ | $0.1570\sim 0.1647$
$E_{0}~{}(\text{MeV})$ | -16.04 | -16.10 | -16.10 | $-16.34\sim-15.87$ | $-16.44\sim-15.78$ | $-16.47\sim-15.74$
$K_{0}~{}(\text{MeV})$ | 224.6 | 223.5 | 223.4 | $219.4\sim 227.6$ | $216.9\sim 230.3$ | $215.6\sim 231.8$
$E_{\text{sym}}(\rho_{0})~{}(\text{MeV})$ | 34.4 | 32.7 | 33.0 | $30.9\sim 34.4$ | $29.9\sim 34.8$ | $29.5\sim 34.9$
$L(\rho_{0})~{}(\text{MeV})$ | 48.8 | 40.3 | 40.4 | $27.9\sim 51.9$ | $22.8\sim 58.1$ | $21.4\sim 61.1$
$G_{S}~{}(\text{MeV}\cdot\text{fm}^{5})$ | 125.7 | 135.5 | 135.1 | $118.2\sim 152.5$ | $112.7\sim 160.3$ | $111.2\sim 163.5$
$G_{V}~{}(\text{MeV}\cdot\text{fm}^{5})$ | 65.0 | -1.6 | -3.1 | $-50.9\sim 49.5$ | $-64.1\sim 63.9$ | $-67.3\sim 67.3$
$W_{0}~{}(\text{MeV}\cdot\text{fm}^{5})$ | 111.6 | 118.4 | 117.0 | $112.0\sim 125.1$ | $110.6\sim 131.4$ | $110.3\sim 134.7$
$m_{s,0}^{*}/m$ | 0.88 | 0.87 | 0.87 | $0.84\sim 0.89$ | $0.83\sim 0.91$ | $0.82\sim 0.92$
$m_{v,0}^{*}/m$ | 0.78 | 0.78 | 0.78 | $0.75\sim 0.81$ | $0.73\sim 0.84$ | $0.72\sim 0.85$

##  III Results and Discussions

We first generated 2500 parameter sets using the maximin Latin cube sampling
method Morris and Mitchell (1995). 24 of them are near the edge of the allowed
parameter space and lead to numerical instability in Hartree-Fock (HF) or RPA
calculations. Therefore, we discarded the 24 parameter sets and used the left
2476 parameter sets in HF, CHF and RPA calculation to obtain the training data
for Gaussian emulators.

Results from the 2476 training points can inform us of correlations between
observables and model parameters. We show in Fig. 1 the Pearson correlation
coefficients among model parameters and the chosen 7 observables obtained from
the training data. In Fig. 1, darker red indicates positive larger value and
thus stronger positive correlation, and darker blue indicates more negative
value and thus stronger negative correlation. One can expect that the
parameters strongly correlated with the chosen observables are more likely to
be constrained. Particularly, it is seen that the correlations among
observables in nuclear giant resonances and model parameters are nicely
consistent with the empirical knowledge introduced in Chapter II.2: the
$\alpha_{\mathrm{D}}$ is positively (negatively) correlated to $L$
[$E_{\mathrm{sym}}(\rho_{0})$] because it is mostly sensitive to the symmetry
energy at $\rho^{\ast}=0.05~{}\mathrm{fm}^{-3}$ Zhang and Chen (2015); the
$E_{\mathrm{GDR}}$ is negatively correlated to both $m_{v,0}^{\ast}$ and $L$,
but positively to $E_{\mathrm{sym}}(\rho_{0})$, which can be understood from
Eq. (18) and the dependence of $\alpha_{\mathrm{D}}$ on $L$ and
$E_{\mathrm{sym}}(\rho_{0})$; the $E_{\mathrm{GQR}}$ is strongly negatively
correlated with $m_{s,0}^{\ast}$ [see Eq. (19)]; the $E_{\mathrm{GMR}}$ is
mostly sensitive to the incompressibility $K_{0}$. Meanwhile, the $G_{V}$ is
weakly correlated to all observables, and therefore can not be well
constrained in the present analysis.

Based on the training data, Gaussian process emulators were tuned to quickly
predict model output for MCMC process. With the help of GPs, we first ran
$10^{6}$ burn-in MCMC steps to allow the chain to reach equilibrium, and then
generated $10^{7}$ points in parameter space via the MCMC sampling. The
posterior distributions of model parameters are then extracted from the
$10^{7}$ samples, and visualized in Fig. 2. The lower-left panels show the
bivariate scatter histograms of the MCMC samples; the diagonal ones present
the univariate posterior distribution of the model parameters; the solid,
dashed, and dotted lines in the upper-right panels enclose $68.3\%$, $90\%$
and $95.4\%$ confidence regions, respectively. Fig. 2 intuitively present the
uncertainties and correlations of the model parameter imposed by the
experimental measurements for the chosen observables. Remarkably, $K_{0}$,
$m_{s,0}^{\ast}$, and $m_{v,0}^{\ast}$ are well constrained by the giant
monopole, dipole and quadruple resonances, respectively. Another interesting
feature is the strong positive correlation between
$E_{\mathrm{sym}}(\rho_{0})$ and $L$, which can be understood by the fact that
$\alpha_{\mathrm{D}}$ is positively correlated to $L$ but negative to
$E_{\mathrm{sym}}(\rho_{0})$ (see Fig. 1). Similarly, the $E_{B}$ datum leads
to a negative $E_{0}$-$G_{S}$ correlation, and $r_{C}$ datum results in a
positive $\rho_{0}$-$G_{S}$ correlation. Therefore, the combination of $E_{B}$
and $r_{C}$ leads to a negative $\rho_{0}$-$E_{0}$ correlation.

Figure 3: (Color online). Posterior bivariate (a) and univariate [(b) and (c)]
distributions of $E_{\mathrm{sym}}(\rho^{\ast})$ at
$\rho^{\ast}=0.05~{}\mathrm{fm}^{-3}$ and the linear isospin splitting
coefficient $\Delta m_{1}^{\ast}$ at $\rho_{0}$. The shaded regions in window
(a) indicate the $68.3\%$, $90\%$ and $95.4\%$ confidence regions.

To quantify the posterior distribution from the Bayesian analysis, we list
statistical quantities estimated from the MCMC samples, including the mean
value, median value and confidence intervals at $68.3\%$, $90\%$ and $95.4\%$
confidence levels. The best value, i.e., the parameter set that gives the
largest likelihood function, is also listed for reference. In particular, we
obtain $m_{s,0}^{\ast}/m=0.87_{-0.03}^{+0.02}$ and
$m_{v,0}^{\ast}/m=0.78_{-0.03}^{+0.03}$ at $68\%$ confidence level, and
$m_{s,0}^{\ast}/m=0.87_{-0.04}^{+0.04}$ and
$m_{v,0}^{\ast}/m=0.78_{-0.05}^{+0.06}$ at $90\%$ confidence level. The
results are consistent with $m_{s,0}^{\ast}=0.91\pm 0.05$ and
$m_{v,0}^{\ast}/m=0.8\pm 0.03$ extracted from the GDR and GQR in Ref. Zhang
and Chen (2016) using the conventional method. We would like to mention that
that compared with our previous work in Ref. Zhang and Chen (2016), where a
conventional analysis was carried out based on only 50 representative Skyrme
EDFs, the present work extract the posterior distributions of model parameters
from a huge number of parameter sets from MCMC sampling. The uncertainties of
model parameters are thus better evaluated and the constraints obtained in the
present work should be more reliable. The obtained $90\%$ confidence interval
for $m_{v,0}^{\ast}$ is also in very good agreement with the result of
$0.79_{-0.06}^{+0.06}$ from a recent Bayesian analysis of giant dipole
resonance in 208Pb Xu et al. (2020). Note that compared with the present work,
the Bayesian analysis in Ref. Xu et al. (2020) uses the same GDR data, but the
MCMC process is based on fully self-consistent RPA calculations. Therefore,
the consistence between the two results also verifies the reliability of
Gaussian emulators as a fast surrogate of real model calculations.

In Fig. 3, we further show the posterior bivariate and univariate
distributions of the symmetry energy at $\rho^{\ast}=0.05~{}\mathrm{fm}^{-3}$
and the linear isospin splitting coefficient $\Delta m_{1}^{\ast}$ at
$\rho_{0}$. Because of the approximate relations
$E_{\mathrm{sym}}(\rho^{\ast})\propto 1/\alpha_{\mathrm{D}}$ and
$E_{\mathrm{GDR}}^{2}\propto(\alpha_{\mathrm{D}}m_{v,0}^{\ast})^{-1}$, the GDR
data lead to positive correlation between $E_{\mathrm{sym}}(\rho^{\ast})$ and
$m_{v,0}^{\ast}$. Therefore, Fig. 3 exhibits a negative
$E_{\mathrm{sym}}(\rho^{\ast})$-$\Delta m_{1}$ correlations [see Eq. (7)]. The
confidence intervals of $E_{\mathrm{sym}}(\rho^{\ast})$ and $\Delta m^{*}_{1}$
can be extracted from their univariate distributions shown in Fig. 3 (b) and
(c). Specifically, we obtained
$E_{\mathrm{sym}}(\rho^{\ast})=16.7_{-0.8}^{+0.8}~{}\mathrm{MeV}$ and $\Delta
m_{1}^{\ast}=0.20_{-0.09}^{+0.09}$ at $68.3\%$ confidence level, and
$E_{\mathrm{sym}}(\rho^{\ast})=16.7_{-1.3}^{+1.3}~{}\mathrm{MeV}$ and $\Delta
m_{1}^{\ast}=0.20_{-0.14}^{+0.15}$ at $90\%$ confidence level. For the higher
order terms, we find, for example, $\Delta m_{3}^{\ast}$ is less than 0.01 at
$90\%$ confidence level and therefore can be neglected.

Within the uncertainties, the present constraint on $\Delta m_{1}^{\ast}$ is
consistent with the constraints $m_{n-p}^{\ast}/m=(0.32\pm 0.15)\delta$ Xu et
al. (2010) and $m_{n-p}^{\ast}/m=(0.41\pm 0.15)\delta$ Li et al. (2015)
extracted from the global optical model analysis of nucleon-nucleus scattering
data, and also agrees with $\Delta m_{1}^{\ast}=0.27$ obtained by analysing
various constraints on the magnitude and density slope of the symmetry energy
Li and Han (2013). It is also consistent with the constraints from analyses of
isovector GDR and isocalar GQR with RPA calculations using Skyrme interactions
Zhang and Chen (2016) and transport model using an improved isospin- and
momentum-dependent interaction Kong et al. (2017). In addition, the present
constraint $E_{\mathrm{sym}}(\rho^{*})=16.7^{+1.3}_{-1.3}$ MeV is consistent
with the result $15.91\pm 0.99$ MeV obtained in Ref. Zhang and Chen (2015)
where the data on the $\alpha_{\mathrm{D}}$ in 208Pb does not consider the
contribution of the quasideuteron effect Roca-Maza et al. (2015). Including
the quasideuteron effect will slightly enhance the
$E_{\mathrm{sym}}(\rho^{*})$ and thus improves the agreement with the present
result.

To end the section, we would like to discuss the limitations of the present
work. In this work we only focus on nuclear giant resonances in 208Pb.
However, the $m_{v,0}^{\ast}$ from the GDR of 208Pb is not consistent with the
GDR in 16O Erler et al. (2010). Describing the giant resonances simultaneously
in light and heavy nuclei is still a challenge. For the ambiguities in
determining nucleon effective masses from nuclear giant resonances, we refer
the readers to Ref. Li et al. (2018). It is also worth mentioning that due to
the simple quadratic momentum dependence of the single-nucleon potential in
Skyrme energy density functional, the nucleon effective mass is momentum
independent and only has a simple density dependence[see Eq. (3)], which is
not the case in microscopic many body theories like chiral effective theory
Holt et al. (2013, 2016). The extended Skyrme pseudopotential Carlsson et al.
(2008); Raimondi et al. (2011); Wang et al. (2018) with higher order momentum-
dependent terms may help to address the issues on the isospin splitting of
nucleon effective mass.

##  IV  Conclusions

Within the framework of Skyrme energy density functional and random phase
approximation, we have done a Bayesian analysis for the data on the ground and
collective excitation states of 208Pb to extract information on the nucleon
effective mass and its isospin splitting. Our results indicate that the
isoscalar effective mass $m^{*}_{s,0}/m$ exhibits a particularly strong
correlation with the peak energy of isocalar giant quadrupole resonance, and
the isovector effective mass $m^{*}_{v,0}/m$ is correlated with the
constrained energy of isovector giant dipole resonance. By including in the
analysis the constrained energy of the isoscalar monopole resonance, the peak
energy of isocalar giant quadrupole resonance, the electric dipole
polarizability and the constrained energy of the isovector giant dipole
resonance, we have constrained the isocalar and isovector effective masses,
and the isospin splitting of nucleon effective mass at saturation density,
respectively, as $m_{s,0}^{\ast}/m=0.87^{+0.04}_{-0.04}$,
$m_{v,0}^{\ast}/m=0.78^{+0.06}_{-0.05}$, and
$m_{n-p}^{\ast}/m=(0.20_{-0.14}^{+0.15})\delta$ at $90\%$ confidence level.
Corresponding to the $68.3\%$ ($1\sigma$) confidence level, the constraints
become $m^{*}_{s,0}/m=0.87^{+0.02}_{-0.03}$,
$m^{*}_{v,0}/m=0.78^{+0.03}_{-0.03}$, and
$m_{n-p}^{\ast}/m=(0.20_{-0.08}^{+0.09})\delta$. In addition, the symmetry
energy at the subsaturation density $\rho^{\ast}=0.05~{}\mathrm{fm}^{-3}$ has
been constrained as
$E_{\mathrm{sym}}(\rho^{\ast})=16.7_{-0.8}^{+0.8}~{}\mathrm{MeV}$ at $68.3\%$
confidence level, and
$E_{\mathrm{sym}}(\rho^{\ast})=16.7_{-1.3}^{+1.3}~{}\mathrm{MeV}$ at $90\%$
confidence level.

## Acknowledgements

This work was supported in part by the National Natural Science Foundation of
China under Grants No. 11905302 and No. 11625521, and National SKA Program of
China No. 2020SKA0120300.

## References

  * Jeukenne et al. (1976) J. Jeukenne, A. Lejeune, and C. Mahaux, Phys. Rep. 25, 83 (1976).
  * Mahaux et al. (1985) C. Mahaux, P. Bortignon, R. Broglia, and C. Dasso, Phys. Rep. 120, 1 (1985).
  * Jaminon and Mahaux (1989) M. Jaminon and C. Mahaux, Phys. Rev. C 40, 354 (1989).
  * Li and Chen (2015) B.-A. Li and L.-W. Chen, Mod. Phys. Lett. A 30, 1530010 (2015).
  * Li et al. (2018) B. A. Li, B. J. Cai, L. W. Chen, and J. Xu, Prog. Part. Nucl. Phys. 99, 29 (2018), eprint 1801.01213.
  * Chen et al. (2007) L. W. Chen, C. M. Ko, and B. A. Li, Phys. Rev. C 76, 054316 (2007).
  * Li et al. (2008) B. A. Li, L. W. Chen, and C. M. Ko, Phys. Rep. 464, 113 (2008).
  * Li et al. (2004) B.-A. Li, C. B. Das, S. Das Gupta, and C. Gale, Phys. Rev. C 69, 011603 (2004).
  * Li and Chen (2005) B.-A. Li and L.-W. Chen, Phys. Rev. C 72, 064611 (2005).
  * Chen et al. (2005) L.-W. Chen, C. M. Ko, and B.-A. Li, Phys. Rev. Lett. 94, 032701 (2005).
  * Rizzo et al. (2005) J. Rizzo, M. Colonna, and M. D. Toro, Phys. Rev. C 72, 064609 (2005).
  * Giordano et al. (2010) V. Giordano, M. Colonna, M. Di Toro, V. Greco, and J. Rizzo, Phys. Rev. C 81, 044611 (2010).
  * Feng (2012) Z.-Q. Feng, Phys. Lett. B 707, 83 (2012).
  * Zhang et al. (2014) Y. Zhang, M. Tsang, Z. Li, and H. Liu, Phys. Lett. B 732, 186 (2014).
  * Xie and Zhang (2014) W.-J. Xie and F.-S. Zhang, Phys. Lett. B 735, 250 (2014).
  * Behera et al. (2011) B. Behera, T. R. Routray, and S. K. Tripathy, J. Phys. G 38, 115104 (2011).
  * Xu et al. (2015) J. Xu, L.-W. Chen, and B.-A. Li, Phys. Rev. C 91, 014611 (2015).
  * Xu (2015) J. Xu, Phys. Rev. C 91, 037601 (2015).
  * Baldo et al. (2014) M. Baldo, G. F. Burgio, H.-J. Schulze, and G. Taranto, Phys. Rev. C 89, 048801 (2014).
  * Li et al. (2015) X.-H. Li, W.-J. Guo, B.-A. Li, L.-W. Chen, F. J. Fattoyev, and W. G. Newton, Phys. Lett. B 743, 408 (2015).
  * Xu et al. (2010) C. Xu, B.-A. Li, and L.-W. Chen, Phys. Rev. C 82, 054607 (2010).
  * Zhang and Chen (2016) Z. Zhang and L. W. Chen, Phys. Rev. C 93, 034335 (2016).
  * Kong et al. (2017) H.-Y. Kong, J. Xu, L.-W. Chen, B.-A. Li, and Y.-G. Ma, Phys. Rev. C 95, 034324 (2017).
  * Zuo et al. (1999) W. Zuo, I. Bombaci, and U. Lombardo, Phys. Rev. C 60, 024605 (1999).
  * Zuo et al. (2005) W. Zuo, L. G. Cao, B. A. Li, U. Lombardo, and C. W. Shen, Phys. Rev. C 72, 014005 (2005).
  * Ma et al. (2004) Z.-Y. Ma, J. Rong, B.-Q. Chen, Z.-Y. Zhu, and H.-Q. Song, Phys. Lett. B 604, 170 (2004).
  * van Dalen et al. (2005) E. N. E. van Dalen, C. Fuchs, and A. Faessler, Phys. Rev. Lett. 95, 022302 (2005).
  * Zhang et al. (2018) Z. Zhang, Y. Lim, J. W. Holt, and C. M. Ko, Phys. Lett. B 777, 73 (2018).
  * Holt et al. (2013) J. W. Holt, N. Kaiser, G. A. Miller, and W. Weise, Phys. Rev. C 88, 024614 (2013).
  * Holt et al. (2016) J. W. Holt, N. Kaiser, and G. A. Miller, Phys. Rev. C 93, 064603 (2016).
  * Li and Han (2013) B. A. Li and X. Han, Phys. Lett. B 727, 276 (2013).
  * Coupland et al. (2016) D. D. S. Coupland, M. Youngs, Z. Chajecki, W. G. Lynch, M. B. Tsang, Y. X. Zhang, M. A. Famiano, T. K. Ghosh, B. Giacherio, M. A. Kilburn, et al., Phys. Rev. C 94, 011601 (2016).
  * Morfouace et al. (2019) P. Morfouace, C. Y. Tsang, Y. Zhang, W. G. Lynch, M. B. Tsang, D. D. S. Coupland, M. Youngs, Z. Chajecki, M. A. Famiano, T. K. Ghosh, et al., Phys. Lett. B 799, 135045 (2019).
  * Kong et al. (2015) H.-Y. Kong, Y. Xia, J. Xu, L.-W. Chen, B.-A. Li, and Y.-G. Ma, Phys. Rev. C 91, 047601 (2015).
  * Malik et al. (2018) T. Malik, C. Mondal, B. K. Agrawal, J. N. De, and S. K. Samaddar, Phys. Rev. C 98, 064316 (2018), eprint 1811.09077.
  * Dobaczewski et al. (2014) J. Dobaczewski, W. Nazarewicz, and P. G. Reinhard, J. Phys. G 41, 074001 (2014).
  * Reinhard and Nazarewicz (2010) P. G. Reinhard and W. Nazarewicz, Phys. Rev. C 81, 051303(R) (2010).
  * Piekarewicz et al. (2015) J. Piekarewicz, W. C. Chen, and F. J. Fattoyev, J. Phys. G 42, 034018 (2015).
  * McDonnell et al. (2015) J. D. McDonnell, N. Schunck, D. Higdon, J. Sarich, S. M. Wild, and W. Nazarewicz, Phys. Rev. Lett. 114, 122501 (2015).
  * Bernhard et al. (2015) J. E. Bernhard, P. W. Marcy, C. E. Coleman-Smith, S. Huzurbazar, R. L. Wolpert, and S. A. Bass, Phys. Rev. C 91, 054910 (2015).
  * Pratt et al. (2015) S. Pratt, E. Sangaline, P. Sorensen, and H. Wang, Phys. Rev. Lett. 114, 202301 (2015).
  * Xie and Li (2019) W.-J. Xie and B.-A. Li, Astrophys. J. 883, 174 (2019).
  * Xie and Li (2020) W.-J. Xie and B.-A. Li, Astrophys. J. 899, 4 (2020).
  * Drischler et al. (2020) C. Drischler, R. J. Furnstahl, J. A. Melendez, and D. R. Phillips, Phys. Rev. Lett. 125, 202702 (2020).
  * Xu et al. (2020) J. Xu, J. Zhou, Z. Zhang, W.-J. Xie, and B.-A. Li, Phys. Lett. B 810, 135820 (2020).
  * Kejzlar et al. (2020) V. Kejzlar, L. Neufcourt, W. Nazarewicz, and P.-G. Reinhard, J. Phys. G 47, 094001 (2020).
  * Bertsch and Bingham (2017) G. F. Bertsch and D. Bingham, Phys. Rev. Lett. 119, 252501 (2017), eprint 1703.08844.
  * Pastore (2019) A. Pastore, J. Phys. G 46, 052001 (2019), eprint 1810.05585.
  * Tamii et al. (2011) A. Tamii, I. Poltoratska, P. Von Neumann-Cosel, Y. Fujita, T. Adachi, C. A. Bertulani, J. Carter, M. Dozono, H. Fujita, K. Fujita, et al., Phys. Rev. Lett. 107, 062502 (2011).
  * Roca-Maza et al. (2015) X. Roca-Maza, X. Viñas, M. Centelles, B. K. Agrawal, G. Colò, N. Paar, J. Piekarewicz, and D. Vretenar, Phys. Rev. C 92, 064304 (2015).
  * Dietrich and Berman (1988) S. S. Dietrich and B. L. Berman, At. Data Nucl. Data Tables 38, 199 (1988).
  * Roca-Maza et al. (2013a) X. Roca-Maza, M. Brenna, B. K. Agrawal, P. F. Bortignon, G. Colò, L. G. Cao, N. Paar, and D. Vretenar, Phys. Rev. C 87, 034301 (2013a).
  * Wang et al. (2017) M. Wang, G. Audi, F. G. Kondev, W. J. Huang, S. Naimi, and X. Xu, Chin. Phys. C 41, 030003 (2017).
  * Angeli and Marinova (2013) I. Angeli and K. Marinova, At. Data Nucl. Data Tables 99, 69 (2013).
  * Patel et al. (2013) D. Patel, U. Garg, M. Fujiwara, T. Adachi, H. Akimune, G. Berg, M. Harakeh, M. Itoh, C. Iwamoto, A. Long, et al., Phys. Lett. B 726, 178 (2013).
  * Vautherin and Brink (1972) D. Vautherin and D. M. Brink, Phys. Rev. C 5, 626 (1972).
  * Chen et al. (2010) L. W. Chen, C. M. Ko, B. A. Li, and J. Xu, Phys. Rev. C 82, 024321 (2010).
  * Chen and Gu (2012) L.-W. Chen and J.-Z. Gu, J. Phys. G 39, 035104 (2012).
  * Kortelainen et al. (2010) M. Kortelainen, T. Lesinski, J. Moré, W. Nazarewicz, J. Sarich, N. Schunck, M. V. Stoitsov, and S. Wild, Phys. Rev. C 82, 024313 (2010).
  * Chabanat et al. (1997) E. Chabanat, P. Bonche, P. Haensel, J. Meyer, and R. Schaeffer, Nucl. Phys. A 627, 710 (1997).
  * Zhang and Chen (2015) Z. Zhang and L. W. Chen, Phys. Rev. C 92, 031301(R) (2015).
  * Colò et al. (2013) G. Colò, L. Cao, N. Van Giai, and L. Capelli, Comput. Phys. Commun. 184, 142 (2013).
  * Bohigas et al. (1979) O. Bohigas, A. Lane, and J. Martorell, Phys. Rep. 51, 267 (1979).
  * Sil et al. (2006) T. Sil, S. Shlomo, B. K. Agrawal, and P.-G. Reinhard, Phys. Rev. C 73, 034316 (2006).
  * Blaizot (1980) J. Blaizot, Phys. Rep. 64, 171 (1980).
  * Bohr and Mottelson (1975) A. Bohr and B. Mottelson, _Nuclear Structure, Vols. I and II_ (Benjamin, London, 1975).
  * Roca-Maza et al. (2013b) X. Roca-Maza, M. Brenna, G. Colò, M. Centelles, X. Viñas, B. K. Agrawal, N. Paar, D. Vretenar, and J. Piekarewicz, Phys. Rev. C 88, 024316 (2013b).
  * (68) URL https://madai.phy.duke.edu.
  * Rasmussen and Williams (2006) C. E. Rasmussen and C. K. I. Williams, _Gaussian Processes for Machine Learning_ (MIT Press, Cambridge, MA, 2006).
  * Morris and Mitchell (1995) M. D. Morris and T. J. Mitchell, J. Stat. Plan. Inf. 43, 381 (1995).
  * Erler et al. (2010) J. Erler, P. Klüpfel, and P.-G. Reinhard, J. Phys. G 37, 064001 (2010).
  * Carlsson et al. (2008) B. G. Carlsson, J. Dobaczewski, and M. Kortelainen, Phys. Rev. C 78, 044326 (2008).
  * Raimondi et al. (2011) F. Raimondi, B. G. Carlsson, and J. Dobaczewski, Phys. Rev. C 83, 054311 (2011).
  * Wang et al. (2018) R. Wang, L. W. Chen, and Y. Zhou, Phys. Rev. C 98, 054618 (2018).