# A General Controller Scheme for Stabilization & Disturbance Rejection with
Application to Non-Linear Systems and its Implementation on 2 DOF Helicopter

Justin Jacob<EMAIL_ADDRESS>Navin Khaneja<EMAIL_ADDRESS>Systems and Control Engineering Department,
Indian Institute of Technology, Bombay

###### Abstract

A general controller scheme for stabilizing a non-linear system, which has its
origin from the linear system theory, is proposed in this paper. The proposed
controller can stabilize the non-linear system subjected to initial
conditions. An effective way to obtain the controller parameters is presented
with the knowledge of the system model. The controller is designed for the
linear time-invariant (LTI) system, which can reject any disturbance acting on
it. Paper emphasis the idea of an integrator controller in disturbance
rejection. The concept is extended to the application to non-linear systems
where the non-linearities are assessed as the disturbance to the refined
linear part of the system. Boundedness and convergence of the non-linear
system with the controller are proved to justify system stabilization.
Hardware implementation of the controller on the 2 dof helicopter model is
presented with experimental results, which validates the proposed control
scheme.

###### keywords:

Euler Lagrange equation , state feedback , Euclidean norm , characteristic
equation , linearization , stability

###### MSC:

[2010] 34Gxx, 37Nxx, 70E50, 70K20

††journal: arXiv

##  1 Introduction

Controllers are an integral part of any industrial system. From simple to
complex, a wide range of controllers can be found in the literature[1][2].
Here a general controller scheme for a linear time-invariant (LTI) system,
which can be applied to a non-linear system, is proposed. It’s a model-based
control scheme formulated based on the linear system theory. The parameter
design of the controller is the simplest of all controllers as it is centered
on the pole placement by state feedback.[3]. The paper presents an effective
way in finding the controller parameters, which is effortless and
straightforward, assuming the system dynamics to be known. The controller
parameters are designed based on the refined linear part of the system model
with the knowledge of the system characteristic coefficients and the desired
characteristic coefficients[4]. The performance of a second-order system can
be easily related to the characteristic coefficients. By dominant pole
analysis[5], the model can be extended and approximated to any degree.
Knowledge of the system alone doesn’t guarantee a model-based controller to
stabilize the plant. Unknown disturbance and parameter variations cause
changes to the desired system response. Keyser discusses disturbance modelling
and its importance in a model-based controller[6], and Davison proposes a
productive way for pole placement to stabilize the linear system with constant
disturbance[7]. This paper presents an approximation to disturbance acting on
the system and the importance of an integrator as a disturbance rejection
controller. The controller also stabilizes the system for any initial
conditions.
Most of the mechatronic systems have non-linear second-order coupled dynamics.
So this paper analyzes the application of the proposed controller on a non-
linear 2 dof helicopter model, which resembles a general system. One could
find a wide range of control strategies in the literature for the 3 dof
helicopter, and Kocagil[8] presents a review of it. The non-linear part of the
dynamics is considered as disturbance while modelling. Stabilization of the
system with the help of an integrator when the states are within the region of
interest is shown. The closeness of the model to a linear system depends on
the amount and types of non-linearities[9]. Usually, sinusoidal or exponential
terms contribute to these non-linearities, and these can be approximated to
the desired order by the Taylor series expansion. Typically, the third and
higher degree terms contribute significantly less when compared to the
fundamental and second-degree terms[10]. For this reason, here, the non-
linearities are approximated till the second-degree terms. Hardware
implementation of the proposed control law on the 2 dof helicopter model is
presented in this paper. The experiment results validate the application of
the controller scheme on non-linear systems for control and stabilization.

##  2 Theory

Differential equations of a coupled system are combined to form a single
equation; hence a general $n^{th}$ order linear time-invariant (LTI) system
can be described by,

$\dfrac{d^{n}x}{dt^{n}}+\sum_{i=1}^{n}a_{i}\dfrac{d^{(i-1)}x}{dt^{i}}=u+T$ (1)

here the simplest of cases with a single input, $u\in\mathbb{R}$, and a single
output which is the state, $x\in\mathbb{R}$, and other states as the
successive derivatives are taken. $T\in\mathbb{R}$ is the disturbance acting
on the system, with $\|T\|<\infty$.

###### Theorem 1

Any system of the form Eq.(1) can be stabilized using the control input

$u=b_{0}\int_{0}^{t}y\,dt+\sum_{i=1}^{n}b_{i}\dfrac{d^{(i-1)}y}{dt^{i-1}}.$
(2)

where $y=x_{d}-x$ with $x_{d}\in\mathbb{R}$ as the desired output and
$b_{i}\in\mathbb{R}$ as the gain constants corresponding to the states.

###### Remark 1

For a system of $n^{th}$ order, $(n~{}-~{}1)$ derivatives, a proportional and
an integral controller part are necessary for the control law to control,
stabilize, and reject disturbance.

###  2.1 Proof

####  2.1.1 Disturbance Rejection

Assuming the system to be stable and the disturbance is approximated to
piecewise constant. The disturbance is now a series of step inputs, as in
figure 1, where a random disturbance is examined.

Figure 1: Piece-wise constant disturbance.

Now the objective is to eliminate the response of the system to these constant
input disturbances by feedback. Adding the $\frac{1}{s}$ block to the system,
the input to the system becomes impulse input, and the output becomes impulse
response (IR).

Figure 2: Model of the effective system.

The output of the effective system is obtained as

$X(s)=\frac{1}{s}\left(\frac{G(s)}{1+G(s)H(s)}\right)+\frac{x_{d}}{s}\left(\frac{G(s)H(s)}{1+G(s)H(s)}\right).$
(3)

$H(s)$ is chosen to stabilize the system from the disturbance, which is given
by the first part in Eq.(3). The main intention is to eliminate the existence
of $\frac{1}{s}$ from the output equation. The pole at the origin makes the
system marginally stable; hence any disturbance to the system may cause
instability to the system. With $H(s)=\frac{b_{0}}{s}$, which in turn tells
$u=b_{0}\int_{0}^{t}y(\tau)d\tau$, an integral controller, eliminates
$\frac{1}{s}$ term. The key idea is to represent the disturbance as a sequence
of step inputs. For small-time $t=\epsilon$ one can obtain the sequence step
functions which will resemble the disturbance. And these step responses will
decay as the system considered is a stable one. The response to one of the
step input is

$X(s)=\dfrac{1+b_{0}\,x_{d}/s}{s^{n+1}+a_{n}s^{n}+\cdots+a_{1}s+b_{0}}.$ (4)

Applying the final value theorem[11] on Eq.(4), $x$ $\longrightarrow x_{d}$ as
$t$ $\longrightarrow~{}\infty$. Most of the practical disturbance have a span
very much less than the operational period. Hence all it’s effect, will be
eliminated over time.

###### Remark 2

Theoretically, every disturbance can be modelled by a sequence of impulse
input, and an integrator in the controller eliminates it.

####  2.1.2 Stabilization

A stable system is not always guaranteed; hence the first assumption of
stability does not hold in every case. So the system is made stable with the
idea of pole placement by giving feedback. The key idea here is to manipulate
each coefficient in the denominator of the system.

$X(s)=\dfrac{\dfrac{x_{d}}{s}\left(\dfrac{1}{s^{n}+\sum_{i=1}^{n}a_{i}s^{i-1}}\right)H(s)}{1+\left(\dfrac{1}{s^{n}+\sum_{i=1}^{n}a_{i}s^{i-1}}\right)H(s)}$
(5)

$H(s)$ has to account for all the coefficients corresponding to $s^{0}$ to
$s^{n-1}$. Thus, $H(s)=b_{1}s^{0}+b_{2}s^{1}+\cdots+b_{n}s^{n-1}$, and the
input
$u=b_{1}y+b_{2}\dfrac{dy}{dt}+b_{3}\frac{d^{2}y}{dt^{2}}+\cdots+b_{n}\dfrac{d^{n-1}y}{dt^{n-1}}$,
which is a combination of derivative controllers. Taking proportional term as
the zeroth derivative, this shows a one-to-one relationship between the number
of derivatives to the order of the system. Combining the disturbance rejection
controller and the stabilization controller the general controller scheme is
obtained. Applying the general controller scheme to Eq.(5), the integrator
part just shifts the coefficients to the next power and the same happens to
the derivative controller part. In effect the denominator becomes

$s^{n+1}+\sum_{i=1}^{n}(a_{i}+b_{i})s^{i}+b_{0}.$ (6)

An appropriate choice of gains will result in a stable system. When taking the
Laplace transform with non zero initial conditions, an additional term in the
numerator appears corresponding to the initial values. This term makes a
proper rational, and its effect goes to zero as $t$
$\longrightarrow~{}\infty$.

##  3 Modelling 2 DOF

The free body diagram of the 2 dof helicopter is shown in figure 3.

Figure 3: Free body diagram.

Here $\theta$ is the pitch angle, and $\psi$ is the yaw angle. $F_{p}$ and
$F_{y}$ are the pitch and yaw thrust forces, respectively. Here the center of
mass ($m$, moving mass of helicopter) is shifted more towards the nose end of
the helicopter, and $l$ is the length from the hinge to it.

Euler-Lagrange’s method[12] is used to obtain the dynamic model of the system
where the Lagrangian coordinates ($q$) are the pitch and yaw angles and torque
($T$) acting on pitch and yaw axis as the non conservative forces. From Euler
Lagrange’s equation $\dfrac{d}{dt}\dfrac{\partial
L}{\partial\dot{q_{i}}}-\dfrac{\partial L}{\partial q_{i}}+\dfrac{\partial
D}{\partial\dot{q_{i}}}=T_{i}$ where $L$ is the lagrangian of the system
(Total energy = potential energy + kinetic energy), and $D$ is the Rayleigh
dissipation function (viscous friction forces).
$D=\dfrac{1}{2}B_{p}\dot{\theta^{2}}+\dfrac{1}{2}B_{y}\dot{\psi^{2}}$ where
$B_{p}$ and $B_{y}$ are the pitch and yaw viscous friction thrust
coefficients, respectively.

###  3.1 Equation of Motion

Total potential energy is

$PE=mgl\sin\theta.$ (7)

The total kinetic energy includes the kinetic energy due to rotation and
kinetic energy due to translational motion.

$KE_{1}=\dfrac{1}{2}J_{p}\dot{\theta}^{2}+\dfrac{1}{2}J_{y}\dot{\psi}^{2}$ (8)
$KE_{2}=\dfrac{1}{2}m[(l\dot{\theta})^{2}+(l\cos\theta\dot{\psi})^{2}]$ (9)

here equations are obtained assuming the pitch angle to change first and later
the yaw. The Lagrangian of the system is $KE_{1}+KE_{2}-PE$, as the potential
energy is acting against the direction of motion. The Euler Lagrange’s
equation corresponding to pitch and yaw coordinates gives us the equation of
motion of the helicopter,

$J_{p}\ddot{\theta}+B_{p}\dot{\theta}=T_{\theta}-mgl\cos\theta-
ml^{2}\cos\theta\sin\theta\dot{\psi}^{2}-ml^{2}\ddot{\theta}$ (10)
$J_{y}\ddot{\psi}+B_{y}\dot{\psi}=T_{\psi}+2ml^{2}\cos\theta\sin\theta\dot{\theta}\dot{\psi}-ml^{2}\ddot{\psi}\cos^{2}\theta.$
(11)

###  3.2 Small Angle Model

Approximating the trigonometric relations by the Taylor series[10], the non-
linear terms in the equation are reduced. With second-order approximation, the
equation of motion becomes

$(J_{p}+ml^{2})\ddot{\theta}+B_{p}\dot{\theta}=T_{\theta}-mgl+\dfrac{mgl\theta^{2}}{2}-ml^{2}\dot{\psi}^{2}+\dfrac{ml^{2}\theta^{2}\dot{\psi}^{2}}{2}$
(12)
$(J_{y}+ml^{2})\ddot{\psi}+B_{y}\dot{\psi}=T_{\psi}+2ml^{2}\left(1-\dfrac{\theta^{2}}{2}\right)\dot{\theta}\dot{\psi}+ml^{2}\theta^{2}\ddot{\psi}.$
(13)

The next sections exhibit the stabilizability of a non-linear system by the
general controller scheme with the help of the 2 dof helicopter non-linear
model.

##  4 Application on Non-Linear System

###  4.1 Stability Analysis

Since the order of the system in Eq.(12) and Eq.(13) remains second order; a
proportional, derivative, and an integral control actions for each is
required. Let the states be $z_{1}=\int\theta-\theta_{d}$ and
$z_{2}=\int\psi-\psi_{d}$ and its first and second derivatives, where
$\theta_{d}$, $\psi_{d}$ are the desired pitch and yaw angles. The control
inputs required corresponding the general controller scheme are;
$T_{\theta}=-k_{1}z_{1}-k_{2}z_{3}-k_{3}z_{5}$ and
$T_{\psi}=-k_{4}z_{2}-k_{5}z_{4}-k_{6}z_{6}$, where $k_{i}$ are the gain
constants. Neglecting $ml^{2}\theta^{2}$ coming with $\ddot{\psi}$ term to
bring more components to the linear part, which forms the refined linear part,
and rearranging it to the state space form gives

$\begin{split}\begin{bmatrix}\dot{z_{1}}\\\ \dot{z_{2}}\\\ \dot{z_{3}}\\\
\dot{z_{4}}\\\ \dot{z_{5}}\\\
\dot{z_{6}}\end{bmatrix}=\begin{bmatrix}0&0&1&0&0&0\\\ 0&0&0&1&0&0\\\
0&0&0&0&1&0\\\ 0&0&0&0&0&1\\\
-k_{1}&0&-k_{2}+\alpha_{1}mgl\theta_{d}&0&-k_{3}-\alpha_{1}B_{p}&0\\\
0&-k_{4}&0&-k_{5}&0&-k_{6}-\alpha_{2}B_{y}\end{bmatrix}\begin{bmatrix}z_{1}\\\
z_{2}\\\ z_{3}\\\ z_{4}\\\ z_{5}\\\ z_{6}\end{bmatrix}+\\\ \begin{bmatrix}0\\\
0\\\ 0\\\ 0\\\ -\alpha_{1}mgl+\dfrac{a_{1}mgl\theta_{d}^{2}}{2}\\\
0\end{bmatrix}+\begin{bmatrix}0\\\ 0\\\ 0\\\ 0\\\
\dfrac{\alpha_{1}mglz_{3}^{2}}{2}-\alpha_{1}ml^{2}z_{6}^{2}+\alpha_{1}ml^{2}\theta_{d}^{2}z_{6}^{2}+2\alpha_{1}ml^{2}\theta_{d}z_{3}z_{6}+\alpha_{1}ml^{2}z_{3}^{2}z_{6}^{2}\\\
\alpha_{2}ml^{2}(2+\theta_{d}^{2})z_{5}z_{6}+2\alpha_{2}ml^{2}\theta_{d}z_{3}z_{5}z_{6}+\alpha_{2}ml^{2}z_{3}^{2}z_{5}z_{6}\end{bmatrix}\end{split}$
(14)

where $\dfrac{1}{(J_{p}+ml^{2})}=\alpha_{1}$ and
$\dfrac{1}{(J_{y}+ml^{2})}=\alpha_{2}$. Eq.(14) is of the form
$\dot{Z}=AZ+C+N$ and $A$ is the refined state matrix. With proper gain values
of $T_{\theta}$ and $T_{\psi}$, one can stabilize the equilibrium point, and
the constant term can be compensated by adding a bias to the control input.
The solution for this system now becomes

$Z(t)=e^{At}Z(0)+\int_{0}^{t}e^{A(t-\tau)}N(z,\tau)d\tau$ (15)

###  4.2 Boundedness

Taking the euclidean norm and applying triangular inequality on Eq.(15),

$\|Z(t)\|\leq\|e^{At}Z(0)\|+\|\int\limits_{0}^{t}e^{A(t-\tau)}\,N(z,\tau)\,d\tau\|$
(16)

diagonalising $A$ by a similarity transformation $M\Sigma M^{-1}$, where $M$
is the model matrix whose columns are the eigenvectors. Then

$e^{A}=Me^{\Sigma}M^{-1}$ (17)

taking the norm

$\|e^{A}\|\leq\|M\|\|e^{\Sigma}\|\|M^{-1}\|$ (18)

where
$\Sigma=diag(\lambda_{1},\lambda_{2},\lambda_{3},\lambda_{4},\lambda_{5},\lambda_{6})$
and $\lambda_{i}\in\mathbb{C}$ are the eigenvalues of matrix A.

###### Remark 3

If the matrix $M$ is orthogonal (unitary), then 2-norm and the inner product
are invariant under multiplication by it.

In general let $\|M\|\|M^{-1}\|=\beta$, and as all the eigenvalues are
negative, $e^{\lambda}$ can at most attain 1. Hence

$\|e^{A}Z(0)\|\leq\beta\|Z(0)\|.$ (19)

Now for small $\|Z\|$, $\|z_{i}\|\leq\|Z\|$ and

$\|N(z,t)\|\leq\kappa\|Z(t)\|^{2}$ (20)

where
$\kappa^{2}=(\frac{\alpha_{1}mgl}{2}+2\alpha_{1}ml^{2}\theta_{d}+\alpha_{1}ml^{2}\theta_{d}^{2})^{2}+(3\alpha_{2}ml^{2}+2\alpha_{2}ml^{2}\theta_{d}+\alpha_{2}ml^{2}\theta_{d}^{2})^{2}$.
Let $\|Z(t)\|$ is bounded by constant $\gamma$, then

$\displaystyle\|\int\limits_{0}^{t}e^{A(t-\tau)}\,N(z,\tau)\,d\tau\|$
$\displaystyle\leq\beta\,\kappa\,\gamma^{2}\|\int\limits_{0}^{t}e^{\lambda_{1}(t-\tau)}\,d\tau\|$
(21)
$\displaystyle\leq\beta\,\kappa\,\gamma^{2}\|\dfrac{e^{\lambda_{1}}-1}{\lambda_{1}}\|$
(22) $\displaystyle\leq\dfrac{\beta\,\kappa\,\gamma^{2}}{|\lambda_{1}|}.$ (23)

Combining both terms and substituting back in Eq.(16)

$\|Z(t)\|\leq\beta\|Z(0)\|+\dfrac{\beta\,\kappa\,\gamma^{2}}{|\lambda_{1}|}\leq\gamma.$
(24)

Figure 4: Illustration of bounds on states and non-linearity.

Hence for small initial conditions, $\gamma^{2}$ will be less than $\gamma$,
and the states never get out of the bound.

###  4.3 Convergence

Let $t_{1}=t_{2}+t_{0}$, and $t_{0}$, $t_{1}$, $t_{2}$ $\in\mathbb{N}$, then

$\begin{split}Z(t_{1})=e^{A(t_{2})}e^{A(t_{0})}\,Z(0)+\int\limits_{0}^{t_{2}}e^{A(t_{2}-\tau)}e^{A(t_{0})}\,N(z,\tau)\,d\tau\\\
+\int\limits_{t_{2}}^{t_{2}+t_{0}}e^{A(t_{2}-\tau)}e^{A(t_{0})}\,N(z,\tau)\,d\tau.\end{split}$
(25)

The difference between two time instance

$\begin{split}Z(t_{1})-Z(t_{2})=e^{A(t_{2})}\left(e^{A(t_{0})}-I\right)\,Z(0)\\\
+\int\limits_{0}^{t_{2}}e^{A(t_{2}-\tau)}\left(e^{A(t_{0})}-I\right)\,N(z,\tau)\,d\tau\\\
+\int\limits_{t_{2}}^{t_{2}+t_{0}}e^{A(t_{2}-\tau)}e^{A(t_{0})}\,N(z,\tau)\,d\tau.\end{split}$
(26)

Taking the norm and substituting the upper bounds for non-linear term,

$\begin{split}\|Z(t_{1})-Z(t_{2})\|\leq\|e^{A(t_{2})}\left(e^{A(t_{0})}-I\right)\|\,\|Z(0)\|\\\
+\int\limits_{0}^{t_{2}}\|e^{A(t_{2}-\tau)}\left(e^{A(t_{0})}-I\right)\|\,\gamma^{2}d\tau\\\
+\int\limits_{t_{2}}^{t_{2}+t_{0}}\|e^{A(t_{2}-\tau)}e^{A(t_{0})}\|\,\gamma^{2}d\tau.\end{split}$
(27)

Note that all the terms except terms with $t_{2}$ are constants, and $e^{A}$
is bounded by the exponential of the maximum of eigenvalue. Evaluating the
integral

$\|\int\limits_{0}^{t_{2}}e^{A(t_{2}-\tau)}d\tau\|\leq\|\int\limits_{0}^{t_{2}}e^{\lambda_{max}(t_{2}-\tau)}d\tau\|\leq\|\dfrac{e^{\lambda_{max}t_{2}}-1}{\lambda_{max}}\|$
(28)

as all the eigenvalues are negative, its a finite value, hence

$\|Z(t_{1})-Z(t_{2})\|\leq\varepsilon.$ (29)

The integral term in Eq.(15) is bounded by $\dfrac{1}{\lambda_{max}}$, and the
rate of decay of $1^{st}$ term to zero and the rising of the $2^{nd}$ to the
upper bound is same. Hence $X(t)$ always reduces if the initial states are
small enough. This in turns reduce the non-linear term and from Eq.(27), as
$t_{1}$, $t_{2}$ $\longrightarrow~{}\infty$, RHS $\longrightarrow~{}0$. This
resembles a Cauchy sequence[10], and the states converge over time.
Boundedness along with convergence proves the system is stabilizable with the
controller. This analysis can be generalized to any non-linear system.

###### Remark 4

The bounded non-linearities are similar to the unpredicted disturbance acting
on the refined linear model.

##  5 Experiment

The set-up used in the laboratory is the Quanser 2 dof helicopter, which is
mounted on a fixed base with two propellers (pitch and yaw) and is driven by
DC motors. High-resolution encoders present in the fixed base measure the
pitch and yaw angles, and are fed via the data acquisition board (DAB) to the
computer. The DAB drives the actuators through a power amplifier. The main
parameters associated with Quanser 2 dof Helicopter and the relation between
torque and voltage are available in [13].

Figure 5: PID controllers with 2 dof helicopter system. Figure 6: Hardware
data management block.

Controller gain values obtained are from dominant pole analysis along with the
parameters of a second-order system. Considering a peak overshoot of $1\%$ and
settling time of $4\text{\,}\mathrm{s}$, the gain values obtained are
Pitch Controller Gains :
$k_{1}=1.7431$, $k_{2}=2.4095$, $k_{3}=0.3849$
Yaw Controller Gains :
$k_{4}=1.8398$, $k_{5}=2.5431$, $k_{6}=0.9326$
Separate performance characteristics can be utilized for the pitch and the yaw
dynamics, and its the choice of the designer. Interfacing between the hardware
and software (MATLAB) is done with the help of the QUARC library. The input to
the pitch motor is limited to $\pm$24\text{\,}\mathrm{V}$$ and for the yaw
motor to $\pm$15\text{\,}\mathrm{V}$$. Pitch axis encoder resolution is set to
$2\pi/(4*1024)\,\text{rad/count}$ and yaw to
$2\pi/(8*1024)\,\text{rad/count}$. The initial position of the helicopter is
taken corresponding to
$\theta_{0}=$-40.5\text{\,}\mathrm{\SIUnitSymbolDegree}$$ and
$\psi_{0}=$0\text{\,}\mathrm{\SIUnitSymbolDegree}$$. The upper limit of
$\theta$ is $35\text{\,}\mathrm{\SIUnitSymbolDegree}$ due to the hardware
setup. To obtain the derivatives of $\theta$ and $\psi$, a second-order low
pass filter with a damping ratio of $.85$ and cut-off frequency of
$40\pi\,\text{Hz}$ is used. A back-calculation anti integral windup[14] with
an integral reset time of $1\text{\,}\mathrm{s}$ is used along with the
integral controller. Experiments were conducted on the 2 dof helicopter model
with the proposed controller, which turned out to be a PID controller due to
the second-order system dynamics.

###  5.1 Results

The experiment was conducted for $30\text{\,}\mathrm{s}$ with the desired
pitch of $0$ $\deg$ and desired yaw of $10$ $\deg$. Figure 7 shows the
reference, actual and simulated output of the pitch angle in degrees. Figure 8
shows the reference, actual and simulated output of the yaw angle in degrees.
The actual voltage output to the pitch and yaw motors, shown in figure 9.

Figure 7: Comparing pitch simulation and experimental output for
$\theta_{d}=$0\text{\,}\mathrm{\SIUnitSymbolDegree}$$. Figure 8: Comparing yaw
simulation and experimental output for
$\psi_{d}=$10\text{\,}\mathrm{\SIUnitSymbolDegree}$$. Figure 9: Voltage
outputs for pitch and yaw motors for
$\theta_{d}=$0\text{\,}\mathrm{\SIUnitSymbolDegree}$$ and
$\psi_{d}=$10\text{\,}\mathrm{\SIUnitSymbolDegree}$$.

###  5.2 Inference

The system is highly non-linear and coupled; a slight overshoot in the
simulation resulted in a more prominent oscillation in the experiment. Also,
the system is very much prone to any external disturbance. So the gain values
are designed such that the overshoot in simulation is very much negligible. If
the set-point is far from the initial conditions, then the system takes a
longer period to settle. Proper adjustment of the gain values can offset these
conditions. Further, a low pass filter must accompany a higher-order
derivative controller; else, it may damage the actuator. Optimization of
control pulse based on different strategies, which change the controller
parameters, can be implemented easily. The key idea is how the gains are
related to the system dynamics and desired characteristic coefficient.

##  6 Conclusion

Modelling an accurate system is almost impossible, as there will be parameter
variations and uncertainties acting on the system. A general controller scheme
is proposed for a linear time-invariant (LTI) system, which takes care of all
the uncertainties. The scheme is based only on the refined linear part of the
model while keeping track of the non-linear function. The design of the
controller parameters depends only on the refined linear system characteristic
coefficients and the desired characteristic coefficients. The proposed
controller is effortless and straightforward in design and can stabilize the
non-linear system even though it’s derived from the linearized model. The
integrator interprets the non-linearities as a disturbance to the refined
linear model. The proposed controller does a fine job in stabilizing the non-
linear 2 dof helicopter model.

## References

  * [1] Pushpkant, S. Jha, Comparative study of different classical and modern control techniques for the position control of sophisticated mechatronic system, Procedia Computer Science 93 (2016) 1038–1045, proceedings of the 6th International Conference on Advances in Computing and Communications.  doi:https://doi.org/10.1016/j.procs.2016.07.307.
URL https://www.sciencedirect.com/science/article/pii/S1877050916315538

  * [2] P. Faradja, G. Qi, Robustness based comparison between a sliding mode controller and a model free controller with the approach of synchronization of nonlinear systems, in: 2015 15th International Conference on Control, Automation and Systems (ICCAS), 2015, pp. 36–40.  doi:10.1109/ICCAS.2015.7364875.
  * [3] J. Jacob, S. Das, N. Khaneja, A concise method of pole placement to stabilize the linear time invariant mimo system, in: 2019 Sixth Indian Control Conference (ICC), IEEE, 2019, pp. 35–39.
  * [4] C.-T. Chen, Linear system theory and design (1999).
  * [5] Automatic tuning of pid controllers based on dominant pole design, IFAC Proceedings Volumes 18 (15) (1985) 205–210, iFAC Workshop on Adaptive Control of Chemical Processes, Frankfurt a.M ,FRG, 21-22 October 1985.  doi:https://doi.org/10.1016/B978-0-08-033431-8.50039-7.
URL https://www.sciencedirect.com/science/article/pii/B9780080334318500397

  * [6] R. De Keyser, C. Ionescu, The disturbance model in model based predictive control, in: Proceedings of 2003 IEEE Conference on Control Applications, 2003\. CCA 2003., Vol. 1, 2003, pp. 446–451 vol.1.  doi:10.1109/CCA.2003.1223451.
  * [7] E. Davison, H. Smith, Pole assignment in linear time-invariant multivariable systems with constant disturbances, Automatica 7 (4) (1971) 489–498.  doi:https://doi.org/10.1016/0005-1098(71)90099-9.
URL https://www.sciencedirect.com/science/article/pii/0005109871900999

  * [8] B. M. Kocagil, A. Ç. Arıcan, Ü. M. Güzey, S. Özcan, M. U. Salamci, Controller designs for nonlinear systems with application to 3 dof helicopter model, Gazi University Journal of Science Part A: Engineering and Innovation 4 (3) (2017) 47–66.
  * [9] H. K. Khalil, Nonlinear systems, Prentice-Hall, 2002.
  * [10] E. T. Whittaker, G. N. Watson, A course of modern analysis, Courier Dover Publications, 2020.
  * [11] B. Rasof, The initial- and final-value theorems in laplace transform theory, Journal of the Franklin Institute 274 (3) (1962) 165–177.  doi:https://doi.org/10.1016/0016-0032(62)90939-0.
URL https://www.sciencedirect.com/science/article/pii/0016003262909390

  * [12] D. Morin, Introduction to classical mechanics: with problems and solutions, Cambridge University Press, 2008.
  * [13] 2 dof helicopter, http:https://www.quanser.com/products/2-dof-helicopter/, [Online; accessed 14-February-2020].
  * [14] H. Markaroglu, M. Guzelkaya, I. Eksin, E. Yesil, Tracking time adjustment in back calculation anti-windup scheme, 2006.  doi:10.7148/2006-0613.


# THAT: Two Head Adversarial Training for Improving Robustness at Scale

Zuxuan Wu1,3 Tom Goldstein2 Larry S. Davis2 Ser-Nam Lim3
1 Fudan University 2 University of Maryland 3 Facebook AI

###### Abstract

Many variants of adversarial training have been proposed, with most research
focusing on problems with relatively few classes. In this paper, we propose
Two Head Adversarial Training (THAT), a two-stream adversarial learning
network that is designed to handle the large-scale many-class ImageNet
dataset. The proposed method trains a network with two heads and two loss
functions; one to minimize feature-space domain shift between natural and
adversarial images, and one to promote high classification accuracy. This
combination delivers a hardened network that achieves state of the art robust
accuracy while maintaining high natural accuracy on ImageNet. Through
extensive experiments, we demonstrate that the proposed framework outperforms
alternative methods under both standard and “free” adversarial training
settings.

##  1 Introduction

Convolutional neural networks have demonstrated remarkable performance in a
multitude of computer vision tasks like image classification [16, 48], object
detection [34, 3, 24], _etc_. Despite the power of these state-of-the-art
models, they are found to be extremely unstable to input perturbations [17,
22, 12]. This fragility can be exploited by crafting adversarial examples,
which are optimized to manipulate networks while appearing innocuous to
humans.

One popular method to mitigate the brittleness of neural networks is
adversarial training [25, 14, 20], in which network parameters are updated
using adversarially perturbed images. This produces a hardened network that is
robust to adversarial perturbations in the pixel space. While adversarial
training is able to increase the robustness of classifiers, it often reduces
accuracy on clean images at test time [51, 40, 2]. This accuracy loss is
believed to be in part because of fundamental tradeoffs between accuracy and
robustness [35, 40, 2], and in part because of domain shift between clean and
adversarial image distributions [45, 27, 10].

Figure 1: A conceptual overview of our framework. We train a neural network
with two heads, each with its own loss function. The first loss term acts on
the “feature extraction head,” and promotes high feature similarity between an
adversarial image and its clean counterpart. The second loss term acts on the
“classification head,” and enforces that adversarial images receive correct
class labels.

In light of this, we propose to align features of clean images with their
adversarially perturbed counterparts for improved clean accuracy and
robustness. Our approach is inspired by recent self-supervised learning
frameworks [5, 15], in which two random crops of the same image are considered
as a positive pair and their distance in feature space is minimized to learn
generic feature representations. Here, a clean image and its adversarial copy
form a positive pair, and by contrasting it with other pairs, we modulate
standard adversarial training to prevent the adversarial feature distribution
from drifting away from the natural distribution.

With this in mind, we introduce Two Head Adversarial Training (THAT), an
adversarial training framework that uses multiple training objectives to boost
robustness. THAT adversarially trains a robust encoder using two parallel
heads, a feature head and a classification head, both sitting on a shared
ResNet backbone. For each training step, clean images are passed through a
naturally trained clean network to produce features. Then, adversarial
examples are made by attacking the classification head of the robust encoder.
A loss function is then computed that contains two terms: a contrastive loss
that promotes similarity between the natural features from the clean encoder
and the adversarial features from the robust encoder, and a classification
loss from the classification head. The former term enforces that feature
representations of adversarial images are aligned with natural feature
representations (_i.e_., domain shift is minimized), while the second term
ensures that the feature representations contain the information needed for
accurate classification. The robust encoder is then updated to minimize the
combined loss.

At test time, we consider two different classification modes for defense. In
addition to using a standard classification head, we also consider a nearest-
neighbor-based classification procedure that relies on the feature extraction
head.

We conduct extensive experiments on ImageNet [8] using standard adversarial
training updates, and also using accelerated (_a.k.a_ , “free” [36])
adversarial updates. In both settings, we demonstrate that THAT outperforms
other adversarial training frameworks in terms of both clean accuracy and
robustness with different backbones.

##  2 Background and Related Work

Adversarial robustness. To mitigate threats posed by adversarial examples [29,
38], adversarial training [14, 25, 36, 43, 11, 50, 47] solves a min-max
optimization problem in which adversarial examples are crafted to maximize the
training loss, and these examples are then used to update network parameters
during loss minimization. This process can be interpreted as approximately
solving the saddle-point optimization problem:

$\displaystyle\min_{\bm{\theta}}\mathbb{E}_{(X,y)\sim\mathcal{D}}\left[\max_{\|\mathbf{\delta}\|_{\infty}<\epsilon}\ell(f(X+\mathbf{\delta}),\,y;\,{\bm{\theta}})\right],$
(1)

where $X$ is a clean image drawn from the training set $\mathcal{D}$ with $y$
as its label, $f$ represents a model parameterized by weights $\bm{\theta}$,
$\delta$ is the adversarial perturbation, and $\ell$ denotes the cross-entropy
loss.

Early adversarial training methods crafted adversarial examples with the Fast
Gradient Sign method (FGSM) [14], but this approach results in networks that
are easily broken by multi-step attacks. Madry _et al_. use project gradient
descent (PGD) to generate adversarial examples to improve robustness for
multi-step attacks [25]. PGD performs gradient ascent on input images in the
signed gradient direction with respect to the classification loss, and then
clips the perturbation to enforce an $\ell_{\infty}$-norm constraint. Kannan
_et al_. further regularize adversarial training by penalizing the difference
between logits from clean images and their adversarial variants [20]. Xie _et
al_. introduce denoising blocks that use self-attention in feature maps to
improve adversarial training [46]. Balaji _et al_. improve adversarial
training for ImageNet by imposing different robustness criteria for each
training sample [2]. The TRADES method achieves high levels of robustness by
training with a loss that promotes similarity between the predicted label
scores for natural and adversarial images [51]. Due to the huge computational
overhead of adversarial training methods, Shafahi _et al_. introduce a “free”
adversarial training strategy that updates model weights and generates
adversarial examples by replaying mini-batches [36].

In our work, we build upon standard and free adversarial training settings and
demonstrate that explicitly contrasting features improves both clean accuracy
and robustness. Dubey [10] _et al_. show that nearest neighbor search can be
used for deflecting strong attacks, but this requires an extremely large
gallery of reference images ($\sim 1$ billion) to achieve good performance.
Instead, we show that our network is able achieve strong defense via nearest
neighbors using the much smaller ImageNet dataset. In addition, Mao _et al_.
use a triplet loss for better adversarial training [27], which requires manual
hard negative mining. Our contrastive loss automatically performs hard
negative mining with a number of negative samples.

Representation learning with contrastive losses. Extensive studies have been
conducted to learn visual representations in a self-supervised manner [30, 4,
23, 28, 49, 13, 9]. Among these approaches, contrastive learning methods [44,
15, 5, 39] currently achieve state-of-the-art results by maximizing the
agreement of positive pairs (two random crops of the same image) relative to a
large number of negative pairs. Wu _et al_. perform instance discriminative
tasks based on the entire ImageNet training set [44]. MoCo introduces a memory
bank to maintain consistent representations of negative samples with the help
of a momentum encoder [15]. In this paper, we focus on improving the
robustness of neural networks with contrastive losses. We consider a clean
image and its adversarially perturbed variant as a positive pair rather than
two stochastic data augmentations.

Adversarial training and self-supervised learning. There are some very recent
studies exploring adversarial training with self-supervised learning [18, 19,
21, 6]. Chen _et al_. use several self-supervised losses like predicting
rotations, permutations, to pretrian a ResNet and study its robustness [6].
[18, 19, 21, 6] focus on better pretraining with adversarial examples for
downstream tasks on small datasets. In contrast, we use a contrastive branch
to align features of clean and adversarial images to boost the performance of
standard adversarial training. In addition, we also target at large datasets
for large-scale adversarial training.

Figure 2: An overview of the framework. Given a pair containing a clean image
and its adversarial variant, features from both images are mapped to locations
on a hypersphere. After robust optimization, both feature vectors lie in close
proximity. At the same time, the classification logits from the clean and
adversarial image are projected onto a sphere, and forced to lie close to the
ground truth label during training. See texts for more details.

Theoretical motivation and relation to TRADES. A successful and well-known
training strategy for adversarial defense is TRADES [51]. This method is
related to THAT in that it can be interpreted as applying a regularization to
compare logits (as opposed to features). However, while TRADES has been highly
successful at robust optimization for CIFAR-10 and MNIST, which have
relatively few classes, we have found the TRADES objective to lead to unstable
and non-convergent behavior when used on ImageNet. This problem was also
observed in [33]. Here, we explore theoretical reasons for the failure of
TRADES and discuss how these weaknesses motivate the use of THAT.

TRADES is based on the decomposition
$\mathcal{R}_{rob}=\mathcal{R}_{nat}+\mathcal{R}_{bnd},$ which represents the
robust accuracy of a model as the sum of the natural risk (_i.e_., the 0-1
loss), and the “boundary” risk. The boundary risk is the probability that, for
an input $X$, there exists an input point $X^{\prime}$ within a ball around
$X$ such that $X$ and $X^{\prime}$ are assigned different labels. These terms
are then upper bounded by a smooth loss and minimized. The multi-class TRADES
objective is:

$\displaystyle\min_{\bm{\theta}}\quad$
$\displaystyle\mathbb{E}_{(X,y)\sim\mathcal{D}}\,\,\,\ell(f(X),\,y;\,{\bm{\theta}})$
(2)
$\displaystyle+\lambda\max_{\|\mathbf{\delta}\|_{\infty}<\epsilon}\mathcal{L}(f(X+\mathbf{\delta}),f(X);\,{\bm{\theta}}),$
(3)

where $\mathcal{L}$ is a loss function that measures the discrepancy between
class label distributions predicted for $X$ and its adversarial example
$X+\mathbf{\delta}$, and $\lambda$ is a scalar parameter.

For 2-class problems, the loss (2) is a tight convex relaxation of the non-
convex 0-1 loss whenever $\mathcal{L}$ is a calibrated loss function that
satisfies several weak assumptions [51]. However, the tightness result for
TRADES is specific to binary classification; the relaxation is no longer tight
for multi-class problems, and becomes extremely pathological for many-class
problems like ImageNet.

To understand why this is, observe that TRADES uses the KL divergence for
$\mathcal{L}(\cdot,\cdot)$ when solving multi-class problems. If $p$ and $q$
are the class distributions predicted by the network for $X$ and its
adversarial example, respectively, then the TRADES loss contains the KL-
divergence term:

$\mathcal{L}(f(X+\mathbf{\delta}),f(X);\,{\bm{\theta}})=\sum_{i}p_{i}\log(p_{i}/q_{i}),$
(4)

where the sum in Eqn. (4) is over class indices. For typical ImageNet images,
the distributions $p$ and $q$ contain just a few relevant/large class
probabilities, and then a “long tail” with nearly 1000 small probabilities
that are generally discarded when making classification decisions. The KL loss
used by TRADES sums over all of these class labels, and its value becomes
highly dominated by the many contributions from classes with small
probabilities. Furthermore, the smallest values of $q_{i},$ which appear in
the denominator of Eqn. (4), make the loss most sensitive to unlikely classes.
In practice, we often ignore such class labels with near-zero probability, and
yet they account for a dominant share of the TRADES objective.

Our proposed method is similar in spirit to TRADES —it enforces similarity
between network outputs for natural and adversarial images. But unlike TRADES,
our proposed method uses a contrastive loss that is computed using the inner
product between feature vectors, and is dominated by large entries in feature
representations. This enables THAT to do contrastive learning while avoiding
the pathological behaviors that TRADES suffers in the many-class regime.

##  3 THAT: Two Head Adversarial Training

In this section, we introduce THAT, a contrastive framework with a naturally
trained clean encoder and an adversarially trained robust encoder. The method
learns feature representations that are robust to attacks while simultaneously
achieving high classification accuracy. Each of these objectives is achieved
with a loss function on a separate head of the network. We describe each
component of our framework here.

Naturally trained clean encoder. The natural/clean encoder
$g(X;{\bm{W}_{c}})$, parameterized by weights ${\bm{W}_{c}}$, takes a clean
image $X$ as inputs. Following [7], it uses a two-layer projection head on top
of feature maps from the Res_5 stage of a ResNet to produce a 128D feature
representation ${\bm{v}}$. The feature vector is further normalized with an
$\ell_{2}$ norm. We set the weights of the clean encoder from a pre-trained
self-supervised model [7]. The weights of this model remain frozen while the
robust model is trained.

Adversarially trained robust encoder. The robust encoder
$f(X_{\text{adv}};{\bm{W}_{a}})$, parameterized by weights ${\bm{W}_{a}}$, is
a two-head architecture with a feature head and a classifier head. In
particular, ${\bm{W}_{a}}=\\{{{\bm{W}_{ab}},\bm{W}_{af}},{\bm{W}_{ac}}\\}$,
where $\bm{W}_{ab}$, $\bm{W}_{af}$ and $\bm{W}_{ac}$ represent the weight
matrices for the base ResNet model, a feature head with two fully-connected
layers, and the classifier head with one fully-connected layer, respectively.
Given a clean image $X$, the robust encoder first generates its adversarially
perturbed version $X_{adv}=X+\mathbf{\delta}$ on-the-fly by attacking the
classification head using multiple steps of PGD. The feature head then
computes a 128 dimensional feature vector ${\bm{u}}$ for the perturbed image,
which is normalized to have unit $\ell_{2}$ norm. At the same time, the
separate classifier head produces a logit vector ${\bm{z}}$ for use in the
classification loss.

The contrastive loss. The feature extraction head provides adversarial
features ${\bm{u}}$ for the attack image, and the clean network provides a
clean image representation ${\bm{v}}$. These two representations form a
“positive pair” and should be aligned by the contrastive loss. We also form
“negative pairs” by comparing ${\bm{u}}$ with representations from randomly
selected clean images, which could be sampled from the same mini-batch or from
an external memory bank. Here, we use a memory bank as it is has been
demonstrated that using a large number of negative pairs is beneficial [15,
44]. Finally, we form the contrastive loss function [37, 31]:

$\displaystyle\small\ell_{\text{cl}}({\bm{u}})=-\log\frac{\exp(\bm{u}^{T}\bm{v}/\tau)}{\exp(\bm{u}^{T}\bm{v}/\tau)+\sum_{\bm{v}\in\mathcal{V}_{-}}\exp(\bm{u}^{T}\bm{v}/\tau)},$
(5)

where $\mathcal{V}_{-}$ is the set of features from random negative samples.
The parameter $\tau$ is the “temperature,” controlling the sharpness of the
distribution. The contrastive loss forces the adversarial representation
${\bm{u}}$ to be closer to its own clean base image than other images. This
suppresses domain shift between the clean and adversarial images in feature
space.

Classifier loss. The contrastive learning loss forces feature representations
to be invariant to attacks, but it does not measure classification performance
of these representations. To get good classification performance, the
classifier head of the robust network produces its own training loss. For the
classifier head, we use a “normalized” cross entropy [41, 32, 44], which
measures the disparity between output logits and ones-hot vectors using a
contrastive loss. This keeps gradient scaling and training dynamics of the
classifier loss similar to the contrastive loss on the features. The
normalized cross entropy loss is:

$\displaystyle\ell_{\text{nce}}({\bm{z}})=-y_{i}\log\frac{\exp({\bm{\hat{z}}}^{T}{\bm{\hat{w}}}_{i}/\eta)}{\sum_{i=1}^{C}\exp({\bm{\hat{z}}}^{T}{\bm{\hat{w}}}_{i}/\eta)},$
(6)

where ${\bm{\hat{z}}}$ is the normalized logits based on ${\bm{z}}$,
${\bm{\hat{w}}}_{i}$ is the $i$ the column in $\bm{W}_{ac}$ representing the
normalized weights for the $i$-th class, $y_{i}\in\mathbb{R}^{\\{0,1\\}}$ is
the label for the $i$-th class, and $C$ is the total number of classes in the
dataset. $\eta$ is a learnable parameter to control the sharpness of the
distribution. Here, ${\bm{\hat{w}}}_{i}$ is considered as the class prototype,
and we are forcing the logit vectors to lie close to it. This is similar in
spirit to Eqn (5), in which features from an adversarial example are mapped to
be close to features of its clean twin.

Finally, the combined training objective of THAT can be written as:

$\displaystyle\min_{\bm{W}_{a}}\mathbb{E}_{(X,y)\sim\mathcal{D}}$
$\displaystyle\,\ell_{\text{nce}}(f(X+\mathbf{\delta}),\,y;\,{\bm{W}_{a}})+$
$\displaystyle\ell_{\text{cl}}(g(X),f(X+\mathbf{\delta});{\bm{W}_{a}})$ (7)
$\displaystyle\text{where}\,\,\,\delta=$
$\displaystyle\max_{\|\mathbf{\delta}\|_{\infty}<\epsilon}\ell_{\text{nce}}(f(X+\mathbf{\delta}),\,y;\,{\bm{W}_{a}}).$

Algorithm 1 Pseudocode of our approach in PyTorch style.

⬇

# g: naturally trained clean encoder

# f: adversarially trained robust encoder

# eps: adversarial perturbation epsilon

# K: number of steps for PGD

# mem: memory bank with clean image features

for x, y in loader: # x: data, y: labels

# generate adversarial examples with K-step PGD

x_adv = PGD_attack(f, x, y, K, eps)

# compute features for clean and adversarial images

feat_clean = g.forward(x)

feat_adv, logits_adv = f.forward(x_adv)

# compute contrastive losses

loss_cl = cl_loss(feat_adv, feat_clean, mem)

# compute classification losses

loss_cls = nce_loss(logits_adv, y)

loss = loss_cls + loss_cl

loss.backward()

optimizer.step()

| Clean | PGD-10 | PGD-30 | PGD-200 | PGD-1000
---|---|---|---|---|---
R50 |  |  |  |  |
Standard AT | 50.81 | 47.78 | 39.31 | 38.09 | 37.74
Ours | 53.29 (+2.48) | 49.62 (+1.84) | 41.01 (+1.70) | 40.22 (+2.13) | 39.59 (+1.85)
R101 |  |  |  |  |
Standard AT | 56.21 | 51.40 | 42.68 | 41.08 | 40.86
Ours | 58.17 (+1.96) | 52.70 (+1.30) | 44.02 (+1.34) | 42.79 (+1.71) | 42.34 (+1.48)
R152 |  |  |  |  |
Standard AT | 57.61 | 52.13 | 43.86 | 42.73 | 42.14
Ours | 60.38 (+2.77) | 54.69 (+2.56) | 45.67 (+1.81) | 44.51 (+1.78) | 44.22 (+2.08)
Table 1: Results and comparisons of our method with standard adversarial
training using different backbone networks.

Defense strategies. Once THAT is trained, it is able to defend against strong
PGD attacks during testing. We experiment with two different classification
modes for defense during testing: (i) standard softmax-based defense using
outputs from the classification head of the robust encoder; (ii) nearest-
neighbor based defense using features from the feature head of the robust
encoder. Below we introduce the nearest-neighbor classifier in detail.

The nearest-neighbor classifier computes feature representations for all
training samples with the clean encoder and stores them in a memory bank
$\bm{M}_{\text{train}}$. Given a test image $\hat{X}$, we first compute its
feature ${\bm{u}}_{t}$ through the robust feature head. Then, the embedding is
compared with those of all training samples to retrieve the top-$k$ nearest
neighbors. $N_{k}$ similarity scores are computed based on dot products, and a
weighted average of neighbor labels is computed. More precisely, the
confidence of $\hat{X}$ belonging to the $c$-th class is defined as:

$\displaystyle
P(c|\hat{X})=\sum_{i=1}^{N_{k}}{\bm{u}}_{t}^{T}{\bm{u}}^{i}\cdot{\bm{y}}^{i}(c),$
(8)

where ${\bm{u}}^{i}$ is the feature for $i$-th neighbor sample, and
${\bm{y}}^{i}$ is the corresponding one-hot label.

##  4 Experiments

Datasets and metics. We evaluate our framework on the ImageNet classification
benchmark [8], which has ${\sim}1.28$ million images annotated into 1000
classes. We consider two adversarial training settings: (1) standard
adversarial training (Standard AT) [25, 20] using $K$-step PGD to generate
adversarial examples. This method increases model robustness but is
computationally expensive (_i.e_., $K$ times slower compared to natural image
training). In this setting, for both training and testing, we consider
_targeted attacks_ by randomly selecting a targeted class uniformly following
[46]; (2) The “free” adversarial training method [36] (Free AT), which speeds
up standard adversarial training by updating model weights and generating
adversarial examples at the same time with mini-batch replay. Following [36],
we consider _untargeted attacks_ for both training and testing. We report
top-1 classification accuracy on the 50k ImageNet validation data using both
clean images and adversarially perturbed images and with many-step PGD attacks
as in [46, 20, 1].

Implementation details. We adopt Pytorch for implementation. Since adversarial
training on ImageNet is expensive, we use distributed training with
synchronized SGD. In particular, for standard adversarial training, we set the
maximum perturbation for each pixel to $\epsilon=16$, the step size to
$\alpha=4$, and the number of attack iterations to $K=10$. We found that this
achieves similar results (_i.e_., robustness and clean accuracy) compared to
using $30$ attack iterations with a step size of $1$, but can reduce training
time by 3$\times$. We use a batch of size $4096$ on 32 Tesla V100 32GB GPUs
and train for $100$ epochs as in [46]. The initial learning rate is set to
$1.6$, and is decayed by a factor of 10 at the $35$, $60$, and $90$ epoch. For
fast adversarial training, we set $\epsilon=4$ and set the number of replays
to $4$, following [36]. We use a batch size of $2048$ during training and
train for $90$ epochs (effectively $23$ epochs with replay [36]). The clean
encoder has the same backbone as the robust encoder, but is initialized from
pre-trained self-supervised models [7] and fixed during training. We also show
the clean encoder can be trained in Section 4.3.

Figure 3: Results of different $\epsilon$ using a ResNet152 architecture,
evaluated with PGD-200.

###  4.1 Classifier-based Defense

Standard adversarial training. Table 1 summarizes the results of our approach
and comparisons with standard adversarial training (standard AT) using three
different backbones, _i.e_. ResNet50 (R50), ResNet101 (R101), and ResNet152
(R152). We can see from the table that compared to standard AT, our method
with a R152 backbone achieves a clean accuracy of 60.38% and an accuracy of
44.22% when evaluated with PGD-1000, offering 2% (absolute percentage points)
compared to the standard AT baseline. We observe similar trends for both R50
and R101, confirming the generalization of our approach with different
backbone networks. In addition, the performance of network models degrades
when more attack iterations are used and tends to stabilize after 200
iterations. Comparing across different backbones, we can see that models with
larger capacity perform better in terms of both clean accuracy and robustness,
as observed in [47]. We also evaluate both our approach and standard AT with
different maximum perturbation values (_i.e_. $\epsilon$). The results are
shown in Figure 3. We see that our approach clearly outperforms the standard
baseline model with different perturbation values.

Furthermore, we compare with the following state-of-the-art models on
ImageNet: (1) ALP [20], which penalizes the outputs of clean images to be
similar to those of adversarial images with a mean-squared error loss; (2)
Feature Denoising [46], which adds non-local blocks [42] after each residual
block in ResNet models ; (3) MBN-ALP [47], which reimplements the ALP
algorithm by using different batch normalization statistics for clean and
adversarial images. Results are summarized in Fig. 4.

We see from the figure that THAT achieves better results than alternative
methods when strong attacks are presented at test time (_i.e_., the number of
attack iterations is greater than 200). Compared to Feature Denoising [46]
which performs self-attention on feature maps, THAT offers 1.4% gain when
evaluated against PGD-1000 and is slightly worse with PGD-10 attacks. We also
experiment with non-local blocks and observe that they can slightly improve
the performance for weak attacks and clean accuracy. However, adding non-local
blocks makes training more computationally expensive as it flattens all the
pixels into a huge vector to compute a dense graph. In addition, we also
compare our R152 baseline with that in [46], and our method achieves better
robustness against strong attacks while being 0.4% worse against PGD-10.
Furthermore, both THAT and Feature Denoising outperform ALP and its variant by
clear margins.

102005001000Number of attack steps27.032.037.042.047.052.057.0Top-1
accuracyOursR152Feature Denoise [46]R152 [46]MBN-ALP [47]ALP-Inception v3

Figure 4: Comparisons of THAT with state-of-the-art models for standard adversarial training on ImageNet. | Clean | PGD-10 | PGD-100
---|---|---|---
R50 |  |  |
Free [36] | 60.21 | 32.77 | 31.82
Ours | 63.01 (+2.8) | 34.25 (+1.48) | 33.26 (+1.44)
R101 |  |  |
Free [36] | 63.34 | 35.38 | 34.32
Ours | 67.22 (+3.88) | 38.56 (+3.18) | 37.17 (+2.85)
R152 |  |  |
Free [36] | 64.45 | 36.99 | 35.99
Ours | 68.82 (+4.37) | 39.83 (+2.84) | 38.27 (+2.28)
Table 2: Results and comparisons with the “free” adversarial training [36].
Here, the PGD attacks are untargeted.

Accelerated training results. We now experiment with an accelerated
adversarial training scheme to verify that THAT is compatible with different
strategies. In particular, we train the proposed architecture on top of the
“free” training framework introduced in [36]. The results are summarized in
Table 2. Similarly to adversarial training, we observe THAT offers significant
performance gains for both clean accuracy and robustness compared to the
baseline method. In particular, R152 offers a 4% gain for clean accuracy and
2.28% improvement against PGD-100. Note that the results in Table 2 are not
directly comparable to Table 1 since the attacks in the “free” setting are
untargeted. In addition, we only evaluate 100 attack iterations as in [36]
since the performance stabilizes.

###  4.2 Nearest neighbor classification

We demonstrate that features computed from the feature head of the robust
encoder are able to facilitate nearest-neighbor based defense against strong
PGD attacks. We compare THAT with a R152-Con model, which augments a R152
model with a feature head for contrastive learning. R152-Con is trained on
clean images without adversarial training, offering an accuracy of 78.89% on
the clean ImageNet validation set.

Method | PGD-10 | PGD-30 | PGD-500
---|---|---|---
R152-Con | 15.08 | 11.35 | 10.71
Ours | 35.38 | 29.24 | 27.67
Table 3: Results and comparisons of defending with nearest neighbors.

Table 3 summarizes the results of THAT and R152-Con using the top-50 nearest
neighbors to classify test images. Interestingly, R152-Con offers a 15% top-1
accuracy against PGD-10 with nearest neighbor based defense, even though the
model is not adversarially trained. This is much better than the 0.66%
accuracy of its clean-trained softmax classifier, which indicates that nearest
neighbor methods are indeed more resistant to PGD than softmax. THAT achieves
35.4% accuracy against PGD-10, which greatly exceeds naturally trained
R152-Con. To compare to a KNN based robust model, we report results from [10]
which similarly performs defense with nearest neighbors, but the features are
used for classification rather then explicitly designed for contrasting
learning. For fair comparisons we follow the setting in [10], which constrains
perturbations within an $\ell_{2}$ ball instead of the (more standard)
$\ell_{\infty}$ ball used in other sections of this paper. The results are
summarized in Table 4. Using the same set of images for retrieval (_i.e_.,
ImageNet training set with 1.28 million images), THAT outperforms [10] by
11.8% in top-1 accuracy, highlighting the effectiveness of features from the
feature head for defense. In addition, with a R152 model, THAT achieves
performance comparable to Dubey’s KNN defense with one billion training images
available for retrieval. Note that we did not retrain our network against $L2$
threat models.

Method | Top-1 accuracy (PGD-10)
---|---
IG-1B-R50 [10] | 46.2
ImageNet-1.3M (Ours-R152) | 45.6
ImageNet-1.3M-R50 [10] | 23.5
IMageNet-1.3M (Ours-R50) | 35.3
Table 4: Comparisons with state-of-the-art nearest neighbor defense. Here,
IG-1B denotes the dataset with 1 billion images from Instagram [26].  Figure
5: Top-5 nearest neighbors retrieved given an adversarially perturbed query
image. Left: A query image which has been adversarially perturbed with PGD-10.
Right: top-5 nearest neighbors of the query image from the training set of
ImageNet.

We also show qualitatively in Figure 5 both success (top two rows) and failure
(bottom two rows) cases of randomly selected samples with the KNN defense. For
both success and failure cases, we see that retrieved samples are indeed
visually similar to the query image although the query image is perturbed with
adversarial noise. The incorrect predictions for failure cases are largely due
to the existence of fine-grained classes, rather than a robustness failure of
the embedding. For example, in the third row of Fig. 5, different kinds of
cats are retrieved but they belong to different species other than the
“siamese cat”.

###  4.3 Discussion

We conduct a set of experiments to analyze different components of THAT, and
discuss the results.

Ablation on losses of THAT. We show results of THAT with different loss
functions in Table 5. We observe that compared to our full framework, removing
either the contrastive loss or the normalized softmax degrades the performance
slightly, yet the resulting models still outperform the standard adversarial
training baseline by at least 1% in clean accuracy and 0.6% against PGD-1000.
This highlights the importance of both components for adversarial training.
Furthermore, without the contrastive learning branch, our framework produces
58.92% and 42.78% accuracy when evaluated on clean images and against PGD-1000
attacks, respectively. The result is slightly worse compared to removing the
normalized softmax (_i.e_., a standard cross-entropy loss is used in the
pipeline), suggesting that contrastive learning is relatively important. Note
that we did not compare to TRADES [51] because we found it to be unstable and
non-convergent, even after hyper-parameter searching. Similar attempts and
failures to train TRADES on ImageNet are mentioned in [33]. See Section 2. As
a workaround, we compare with standard adversarial training with KL divergence
loss to force probability distributions from clean images to be close to those
of adversarial images 111Note that this is different from TRADES as TRADES
maximizes the KL divergence to generate adversarial examples, while we instead
maximize classification loss as in our approach.. We see that it achieves high
clean accuracy but is extremely vulnerable to strong PGD attacks. This is
likely because of the strong emphasis that the KL loss puts on unlikely class
labels (see Section 2).

Method | Clean | PGD-10 | PGD-1000
---|---|---|---
Standard AT | 57.61 | 52.13 | 42.14
Standard AT + KL | 71.05 | 14.13 | 0.00
Ours w.o. CL | 58.92 | 53.32 | 42.78
Ours w.o. NCE | 59.64 | 53.80 | 42.77
Ours | 60.38 | 54.69 | 44.22
Table 5: Ablating different components of THAT.

Number of negative samples for contrastive learning. Self-supervised learning
methods suggest the number of negative samples used for contrastive learning
is important. Therefore, we analyze the performance of THAT using different
numbers of examples in the memory for contrastive learning. The results are
summarized in Table 6. We see that increasing the number of samples in the
memory is indeed beneficial for improving clean accuracy and robustness. With
$65536$ samples in the memory, THAT offers a clean accuracy of 60.68%,
outperforming standard adversarial training by 3%. A memory size of $32768$
offers the best trade-off between clean accuracy and robustness.

# Samples | Clean | PGD-10 | PGD-1000
---|---|---|---
0 | 57.61 | 43.86 | 42.14
4096 | 59.77 | 45.40 | 43.15
8192 | 58.25 | 45.89 | 43.79
16384 | 60.26 | 45.71 | 43.59
32768 | 60.38 | 45.67 | 44.22
65536 | 60.68 | 45.69 | 43.43
Table 6: Results of THAT using different number of negative samples.

Clean encoder. Instead of freezing the weights of the clean encoder during
training, we also experiment with updating its weights to reflect the
parameters of the robust encoder with momentum to ensure consistent
representations in memory [15]. The results are presented in Table 7. This
modified implementation that updates both networks at once clearly beats
standard adversarial training in terms of robustness, and slightly in terms of
clean accuracy. However our proposed framework beats both methods in terms of
clean accuracy and robustness.

Method | Clean | PGD-10 | PGD-1000
---|---|---|---
Standard AT | 57.61 | 52.13 | 42.14
Ours-MoCo | 57.76 | 53.36 | 43.03
Ours | 60.38 | 54.69 | 44.22
Table 7: Results of updating the clean encoder in a MoCo [15] fashion.

Loss surface visualization. Figure 6 visualizes the loss surface of a selected
sample with both THAT (left side) and standard adversarial training (right
side). On the top row, we show the cross-entropy loss projected on one random
(Rademacher) and one adversarial direction. On the bottom, we project the loss
along two random directions. We see that the loss surface for THAT is more
flat than standard adversarial training. Since both models are adversarially
trained, the loss does not increase along the gradient direction. See more
examples in the supplemental material.

Figure 6: Loss surface visualization of THAT (left) and standard AT (right).

##  5 Conclusion

We presented THAT, a two-stream contrastive learning framework for improved
robustness and clean accuracy. THAT is trained using two loss functions; one
to align the feature distributions between natural and adversarial images, and
one to promote good classification accuracy. The resulting model is able to
defend against strong adversarial attacks at test time not only using the
hardened classifier but also using a KNN search. Through extensive
experiments, we demonstrate THAT achieves better results than alternative
methods for ImageNet under a wide range of settings.

## References

  * [1] Anish Athalye, Nicholas Carlini, and David Wagner.  Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples.  In ICML, 2018.
  * [2] Yogesh Balaji, Tom Goldstein, and Judy Hoffman.  Instance adaptive adversarial training: Improved accuracy tradeoffs in neural nets.  arXiv preprint arXiv:1910.08051, 2019.
  * [3] Nicolas Carion, Francisco Massa, Gabriel Synnaeve, Nicolas Usunier, Alexander Kirillov, and Sergey Zagoruyko.  End-to-end object detection with transformers.  In ECCV, 2020.
  * [4] Mathilde Caron, Piotr Bojanowski, Armand Joulin, and Matthijs Douze.  Deep clustering for unsupervised learning of visual features.  In ECCV, 2018.
  * [5] Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton.  A simple framework for contrastive learning of visual representations.  In ICML, 2020.
  * [6] Tianlong Chen, Sijia Liu, Shiyu Chang, Yu Cheng, Lisa Amini, and Zhangyang Wang.  Adversarial robustness: From self-supervised pre-training to fine-tuning.  In CVPR, 2020.
  * [7] Xinlei Chen, Haoqi Fan, Ross Girshick, and Kaiming He.  Improved baselines with momentum contrastive learning.  arXiv preprint arXiv:2003.04297, 2020.
  * [8] J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei.  ImageNet: A Large-Scale Hierarchical Image Database.  In CVPR, 2009.
  * [9] Alexey Dosovitskiy, Philipp Fischer, Jost Tobias Springenberg, Martin Riedmiller, and Thomas Brox.  Discriminative unsupervised feature learning with exemplar convolutional neural networks.  IEEE TPAMI, 2016.
  * [10] Abhimanyu Dubey, Laurens van der Maaten, Zeki Yalniz, Yixuan Li, and Dhruv Mahajan.  Defense against adversarial images using web-scale nearest-neighbor search.  In CVPR, 2019.
  * [11] Logan Engstrom, Andrew Ilyas, and Anish Athalye.  Evaluating and understanding the robustness of adversarial logit pairing.  arXiv preprint arXiv:1807.10272, 2018.
  * [12] Robert Geirhos, Carlos RM Temme, Jonas Rauber, Heiko H Schütt, Matthias Bethge, and Felix A Wichmann.  Generalisation in humans and deep neural networks.  In NeurIPS, 2018.
  * [13] Spyros Gidaris, Andrei Bursuc, Nikos Komodakis, Patrick Pérez, and Matthieu Cord.  Learning representations by predicting bags of visual words.  In CVPR, 2020.
  * [14] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy.  Explaining and harnessing adversarial examples.  In ICLR, 2015.
  * [15] Kaiming He, Haoqi Fan, Yuxin Wu, Saining Xie, and Ross Girshick.  Momentum contrast for unsupervised visual representation learning.  In CVPR, 2020.
  * [16] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun.  Deep residual learning for image recognition.  In CVPR, 2016.
  * [17] Dan Hendrycks and Thomas Dietterich.  Benchmarking neural network robustness to common corruptions and perturbations.  In ICLR, 2019.
  * [18] Chih-Hui Ho and Nuno Vasconcelos.  Contrastive learning with adversarial examples.  arXiv preprint arXiv:2010.12050, 2020.
  * [19] Ziyu Jiang, Tianlong Chen, Ting Chen, and Zhangyang Wang.  Robust pre-training by adversarial contrastive learning.  arXiv preprint arXiv:2010.13337, 2020.
  * [20] Harini Kannan, Alexey Kurakin, and Ian Goodfellow.  Adversarial logit pairing.  arXiv preprint arXiv:1803.06373, 2018.
  * [21] Minseon Kim, Jihoon Tack, and Sung Ju Hwang.  Adversarial self-supervised contrastive learning.  arXiv preprint arXiv:2006.07589, 2020.
  * [22] Alexey Kurakin, Ian Goodfellow, and Samy Bengio.  Adversarial examples in the physical world.  In ICLR Workshops, 2017.
  * [23] Gustav Larsson, Michael Maire, and Gregory Shakhnarovich.  Learning representations for automatic colorization.  In ECCV, 2016.
  * [24] Tsung-Yi Lin, Priya Goyal, Ross Girshick, Kaiming He, and Piotr Dollár.  Focal loss for dense object detection.  In ICCV, 2017.
  * [25] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu.  Towards deep learning models resistant to adversarial attacks.  In ICLR, 2018.
  * [26] Dhruv Mahajan, Ross Girshick, Vignesh Ramanathan, Kaiming He, Manohar Paluri, Yixuan Li, Ashwin Bharambe, and Laurens van der Maaten.  Exploring the limits of weakly supervised pretraining.  In ECCV, 2018.
  * [27] Chengzhi Mao, Ziyuan Zhong, Junfeng Yang, Carl Vondrick, and Baishakhi Ray.  Metric learning for adversarial robustness.  In NeurIPS, 2019.
  * [28] Ishan Misra and Laurens van der Maaten.  Self-supervised learning of pretext-invariant representations.  In CVPR, 2020.
  * [29] Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard.  Deepfool: a simple and accurate method to fool deep neural networks.  In CVPR, 2016.
  * [30] Mehdi Noroozi and Paolo Favaro.  Unsupervised learning of visual representations by solving jigsaw puzzles.  In ECCV, 2016.
  * [31] Aaron van den Oord, Yazhe Li, and Oriol Vinyals.  Representation learning with contrastive predictive coding.  arXiv preprint arXiv:1807.03748, 2018.
  * [32] Hang Qi, Matthew Brown, and David G Lowe.  Low-shot learning with imprinted weights.  In CVPR, 2018.
  * [33] Chongli Qin, James Martens, Sven Gowal, Dilip Krishnan, Krishnamurthy Dvijotham, Alhussein Fawzi, Soham De, Robert Stanforth, and Pushmeet Kohli.  Adversarial robustness through local linearization.  In NeurIPS, 2019.
  * [34] Shaoqing Ren, Kaiming He, Ross Girshick, and Jian Sun.  Faster r-cnn: Towards real-time object detection with region proposal networks.  In NeurIPS, 2015.
  * [35] Ali Shafahi, W Ronny Huang, Christoph Studer, Soheil Feizi, and Tom Goldstein.  Are adversarial examples inevitable?  In ICLR, 2019.
  * [36] Ali Shafahi, Mahyar Najibi, Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S Davis, Gavin Taylor, and Tom Goldstein.  Adversarial training for free!  In NeurIPS, 2019.
  * [37] Kihyuk Sohn.  Improved deep metric learning with multi-class n-pair loss objective.  In NeurIPS, 2016.
  * [38] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus.  Intriguing properties of neural networks.  In ICLR, 2014.
  * [39] Yonglong Tian, Dilip Krishnan, and Phillip Isola.  Contrastive multiview coding.  In eccv, 2020.
  * [40] Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry.  Robustness may be at odds with accuracy.  In ICLR, 2019.
  * [41] Hao Wang, Yitong Wang, Zheng Zhou, Xing Ji, Dihong Gong, Jingchao Zhou, Zhifeng Li, and Wei Liu.  Cosface: Large margin cosine loss for deep face recognition.  In CVPR, 2018.
  * [42] Xiaolong Wang, Ross Girshick, Abhinav Gupta, and Kaiming He.  Non-local neural networks.  In CVPR, 2018.
  * [43] Eric Wong, Leslie Rice, and J. Zico Kolter.  Fast is better than free: Revisiting adversarial training.  In ICLR, 2020.
  * [44] Zhirong Wu, Yuanjun Xiong, Stella X Yu, and Dahua Lin.  Unsupervised feature learning via non-parametric instance discrimination.  In CVPR, 2018.
  * [45] Cihang Xie, Mingxing Tan, Boqing Gong, Jiang Wang, Alan L Yuille, and Quoc V Le.  Adversarial examples improve image recognition.  In CVPR, 2020.
  * [46] Cihang Xie, Yuxin Wu, Laurens van der Maaten, Alan Yuille, and Kaiming He.  Feature denoising for improving adversarial robustness.  In CVPR, 2019.
  * [47] Cihang Xie and Alan Yuille.  Intriguing properties of adversarial training at scale.  In ICLR, 2020.
  * [48] Saining Xie, Ross Girshick, Piotr Dollár, Zhuowen Tu, and Kaiming He.  Aggregated residual transformations for deep neural networks.  In CVPR, 2017.
  * [49] Xueting Yan, Ishan Misra, Ishan, Abhniav Gupta, Deepti Ghadiyaram, and Dhruv Mahajan.  ClusterFit: Improving generalization of visual representations.  In CVPR, 2020.
  * [50] Haichao Zhang and Jianyu Wang.  Defense against adversarial attacks using feature scattering-based adversarial training.  In NeurIPS, 2019.
  * [51] Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P Xing, Laurent El Ghaoui, and Michael I Jordan.  Theoretically principled trade-off between robustness and accuracy.  In ICML, 2019.


Present address: ]Department of Mechanical Engineering, University of
Rochester, Rochester, New York 14627, USA

# Pressure dependence of the magnetic ground state in CePtSi2

S. E. Dissanayake  [  Neutron Scattering Division, Oak Ridge National
Laboratory, Oak Ridge, Tennessee 37831, USA  H. Muto  Graduate School of
Science and Technology, Niigata University, Ikarashi, Niigata 950-2181, Japan
S. Suzuki  Graduate School of Science and Technology, Niigata University,
Ikarashi, Niigata 950-2181, Japan  T. Nakano  Graduate School of Science and
Technology, Niigata University, Ikarashi, Niigata 950-2181, Japan  S. Watanabe
Department of Basic Sciences, Kyushu Institute of Technology, Kitakyushu,
Fukuoka 804-8550, Japan  F. Ye  Neutron Scattering Division, Oak Ridge
National Laboratory, Oak Ridge, Tennessee 37831, USA  W. Tian  Neutron
Scattering Division, Oak Ridge National Laboratory, Oak Ridge, Tennessee
37831, USA  J. Gouchi  Institute for Solid State Physics, University of Tokyo,
Kashiwa, Chiba 277-8581, Japan  M. Matsuda<EMAIL_ADDRESS>Neutron
Scattering Division, Oak Ridge National Laboratory, Oak Ridge, Tennessee
37831, USA  Y. Uwatoko  Institute for Solid State Physics, University of
Tokyo, Kashiwa, Chiba 277-8581, Japan

###### Abstract

CePtSi2 was reported to exhibit an antiferromagnetic order below
$T\rm^{*}$=1.8 K at ambient pressure, a valence state change at $\sim$1.2 GPa,
and superconductivity in the range between 1.4 and 2.1 GPa with the maximum
transition temperature of 0.14 K [T. Nakano $et$ $al$., Phys. Rev. B 79,
172507 (2009)]. We have performed polycrystalline and single crystal neutron
diffraction experiments to determine the magnetic structure under ambient and
high pressures. We found that incommensurate magnetic peaks with the magnetic
propagation vector of (0.32, 0, 0.11) at ambient pressure below
$T\rm_{SDW}\sim$1.25 K. Those magnetic peaks which originate from a spin-
density-wave order with the easy axis along the $c$ axis and an averaged
ordered moment of 0.45(5)$\mu\rm_{B}$, suggesting that there may be an
intermediate phase between $T\rm^{*}$ and $T\rm_{SDW}$. Applying pressures,
the magnetic propagation vector shows no change and the magnetic order
disappears around 1.0 GPa, which is much lower than the critical pressure for
the superconducting phase. The results suggest that other than magnetic
fluctuations may play a primary role in the superconducting pairing mechanism.

##  I Introduction

Unconventional spin-mediated superconductor, which is discussed widely in
cuprates, iron based systems, and heavy fermionic systems, has attracted
considerable attention. Recently, there were reports of a new mechanism of
superconductivity: “valence-mediated superconductivity”, a novel mechanism
Miyake1999 ; Onishi2000 ; Watanabe2007 ; Holmes2007  that would be the third
one after the phonon- and spin-mediated superconductivity. It was proposed
that the higher pressure superconducting phase in CeCu2(Si,Ge)2 originates
from the valence fluctuations Watanabe2006 ; Watanabe2011 . A sharp change in
the nuclear-quadrupole-resonance (NQR) frequency observed under pressure
$P\rm_{v}=4.5\pm 0.2$ GPa in CeCu2Si2 evidenced the valence crossover, which
supports the valence-fluctuation mediated superconductivity Kobayashi2013 .
Around $P=P\rm_{v}$, the residual resistivity has a peak under pressure, where
the resistivity shows the remarkable non-Fermi liquid behavior $\rho(T)\sim T$
Holmes2004 . These behaviors are also explained by the enhanced valence
fluctuations of the Ce ions Miyake1999 ; Holmes2004 .

CePtSi2 has the CeNiGe2-type orthorhombic layered structure. It shows a large
decrease of resistivity below $\sim$1.8 K Nakano2009  and a peak of heat
capacity at the same temperature Hirose2011  under ambient pressure, which was
ascribed to an antiferromagnetic ordering temperature ($T^{*}$) TN . There is
another anomaly of resistivity at a lower temperature of $T\rm_{FL}$
($\sim$1.4 K), below which the resistivity shows the Fermi liquid behavior
with $T^{2}$-dependence Nakano2010 ; Nakano2013 . Applying pressure, both
$T^{*}$ and $T\rm_{FL}$ decrease and superconductivity appears at $P\rm_{c1}$=
1.4 GPa Nakano2009 ; Hirose2011 , as shown in Fig. 1. The maximum
superconducting transition temperature is 0.14 K around 1.4 GPa. The
resistivity of CePtSi2 shows two local maxima $T_{1}$ (4 K) and $T_{2}$ (33 K)
at ambient pressure Nakano2009 ; Nakano2010 ; Nakano2013 . These two maxima
are well-known characteristics of Ce based Kondo compounds, showing an
interplay between the Kondo effect and crystalline electric field (CEF)
splitting, as reported in CeCu2Ge2 Jaccard1999 . Applying pressure, $T_{2}$ is
almost unchanged, whereas $T_{1}$ starts to increase above $P\rm_{v}$
($\sim$1.2 GPa) and gradually approach $T_{2}$, suggesting that a valence
change occurs around $P\rm_{v}$ as a crossover in CePtSi2 Nakano2013 . The
resistivity data also show the quantum critical behavior around $\sim$1.2 GPa,
where non-Fermi liquid behavior was observed Nakano2009 ; Nakano2013 . Around
$P\rm_{v}(\sim 1.2$ GPa), the residual resistivity has a peak and the
$T$-linear-like resistivity was observed in CePtSi2 Nakano2009 ; Nakano2013 .
Since $P\rm_{v}$ is close to $P\rm_{c1}$, it is expected that the valence
fluctuation mediates the superconductivity in this material Nakano2009 ;
Nakano2010 ; Nakano2013 . Up to date, the detailed magnetic structure and its
pressure dependence in CePtSi2 have not been clarified, which is critical to
understand the nature for the quantum critical behavior and the
superconductivity.

We performed a neutron diffraction study on the magnetic structure of CePtSi2
as a function of pressure. We found that the magnetic structure at ambient
pressure is a spin-density-wave (SDW) structure with the magnetic propagation
vector of (0.32, 0, 0.11). The magnetic transition temperature ($T\rm_{SDW}$)
was clearly determined to be 1.25(3) K, which is much lower than $T\rm^{*}$
previously determined from the resistivity and heat capacity measurements and
is rather close to $T\rm_{FL}$. Applying pressure, the magnetic propagation
vector is pressure independent and the magnetic order almost disappears around
1.0 GPa, which is much lower than $P\rm_{c1}$. These results suggest that
magnetic fluctuations may not play a primary role in the superconducting
pairing mechanism in CePtSi2, which should be elucidated with further studies.

Figure 1: Temperature-pressure phase diagram of CePtSi2. The filled circles
and triangles represent the data in Refs. Nakano2009, , Nakano2010, , and
Nakano2013,  and the present results, respectively. The lines are guides to
the eye.

##  II Experimental details

A polycrystalline sample of CePtSi2, used for measurements at ambient
pressure, was synthesized by arc-melting stoichiometric amounts of Ce (3N), Pt
(4N), and Si (5N) in an Ar atmosphere with additional remelting and post-
annealing to ensure homogeneity Nakano2009 . Single crystal samples, used for
measurements at ambient and high pressures, were grown by the Czochralski
method in a tetra-arc furnace, using the CePt1.1Si2.2 ingot, after the
previously reported method Kasaya1996 . The bulk properties of the single
crystal samples are consistent with those reported previously Nakano2009 ;
Hirose2011 ; Nakano2010 ; Nakano2013 , as shown in the Supplemental Material
SupplMater . Note that the crystals grown using different methods show very
similar bulk properties, including the transition temperatures. This suggests
that the sample dependence is negligibly small.

High pressure single crystal neutron diffraction measurements were performed
using the time-of-flight diffractometer CORELLI corelli  at the Spallation
Neutron Source (SNS) and the triple-axis spectrometers HB-1 and HB-1A at the
High Flux Isotope Reactor (HFIR) at Oak Ridge National Laboratory (ORNL). The
hydrostatic pressures were generated with a self-clamped piston-cylinder cell
(SCPCC) made of a Zr-based amorphous alloy cell . The crystal dimensions were
1.2$\times$1.2$\times$3 mm3. Fluorinert was chosen as the pressure
transmitting medium. The pressure inside SCPCC was monitored by measuring the
lattice constant of a comounted NaCl crystal. We found that the pressure is
reduced by a few percent on cooling from room temperature to 0.3 K. A 3He
refriegerator was used to cool down the polycrystalline and single crystal
samples down to 0.3 K. The single crystal was mounted with $(H0L)$ in the
horizontal scattering plane.

For magnetic structure analysis, the representation analysis was performed
using the SARAh package sarah . Rietveld refinements were performed for
polycrystalline and single crystal diffraction data using the FullProf package
fullprof . The magnetic form factor for Ce3+ was used for the magnetic
structure refinement. This is considered to be reasonable since the primary
purpose for the refinement is to distinguish between two possible magnetic
structure models, as described in Sec. IIIA.

##  III Experimental Results

###  III.1 Magnetic structure at ambient pressure

Figure 2: Contour maps of neutron diffraction intensity at a low-$Q$ region in
the $(H0L)$ plane in CePtSi2 measured at 0.24 K (a) and 2.0 K (b) at ambient
pressure. Magnetic peaks are observed at (0.32, 0, 0.11), ($-$0.32, 0, 0.11),
(0.32, 0, $-$0.11), and ($-$0.32, 0, $-$0.11) at 0.24 K. (c) and (d)
Temperature dependence of the (0.32, 0, 0.11) magnetic Bragg peak intensity.
The solid line is the result of a fit to a power-law function.

In order to search for magnetic signal in CePtSi2, we first preformed a
neutron diffraction measurement using a polycrystalline sample. However, no
magnetic signal was observed down to 0.3 K. Then, a single crystal was
measured on a time-of-flight diffractometer CORELLI, which has wide-range two-
dimensional detectors suitable for observing incommensurate Bragg peaks. As
shown in Figs. 2(a) and 2(b), a magnetic Bragg peak was observed at (0.32, 0,
0.11) and its three equivalent positions at 0.24 K, whereas those peaks
disappear at 2 K. Figure 2(c) shows the magnetic intensity at (0.32, 0, 0.11)
as a function of temperature. The magnetic intensity develops below 1.25(3) K,
where the low temperature magnetic phase was expected. No other magnetic
signal was observed between 1.25 and 1.8 K, as shown in Fig. 2(d), where an
intermediate magnetic phase was predicted. We tried to find other magnetic
Bragg peaks below 1.25 K other than the four peaks in order to perform a
magnetic structure analysis. However, no additional peaks were found. As
described below, this is because the magnetic peaks at higher-$Q$’s were not
covered by the vertical detector range.

Figure 3: Two possible spin density wave structures for CePtSi2. The spin
directions of $S_{1}$ and $S_{2}$ as well as those of $S_{3}$ and $S_{4}$ are
parallel in Model 1 (a) and antiparallel in Model 2 (b), respectively. Model 1
was found to be the appropriate magnetic structure. Atomic coordinates of the
atoms corresponding to $S_{1}$, $S_{2}$, $S_{3}$ and $S_{4}$ are, $S_{1}$:
$(0,~{}0.39465,~{}0.25)$, $S_{2}$: $(0,~{}0.60535,~{}0.75)$, $S_{3}$:
$(0.5,~{}0.89465,~{}0.25)$ and $S_{4}$: $(0.5,~{}0.10535,~{}0.75)$. (See the
Supplementary Material SupplMater .) Figure 4: Neutron diffraction intensities
around (0.32, 0, 0.11), (0.32, 2, 0.11), and (0.68, 1, 0.11) measured on HB-1A
using polycrystalline sample of CePtSi2. The background signal measured at 3 K
was subtracted. Constant value was added to help the refinement using
Fullprof. The open circles are observed points. The bold solid line represents
the result of the Rietveld refinement. The thin blue line is the difference
between the observed and fitted intensities. The magnetic form factor for Ce3+
was used for the magnetic structure refinement. The residual intensity at
$Q\sim$1.05 Å-1 is too sharp for actual magnetic peak and is most probably due
to imperfect background subtraction.

We performed a representation analysis Bertaut62 ; Bertaut68 ; Bertaut71 ;
Bertaut81 ; Izyumov-book ; Bradley_Cracknell ; Cracknell ; Wills-J-de-Physique
; Wills-PRB-Jarosites ; Kovalev  to narrow down the possible magnetic
structures below 1.25 K, given that a magnetic Bragg peak was observed at
(0.32, 0, 0.11). There are two candidates for the magnetic structure, as shown
in Fig. 3. Model 1 and Model 2 are obtained using basis vectors
$\bf{\psi_{6}}$ from $\Gamma_{2}$ and $\bf{\psi_{3}}$ from $\Gamma_{1}$,
respectively. (See the Supplementary Material SupplMater .) Both Models 1 and
2 are spin density wave type structures with an easy axis along the $c$ axis.
The spin directions of $S_{1}$ and $S_{2}$ as well as those of $S_{3}$ and
$S_{4}$, where $S_{i}$ ($i$=1, 2, 3, and 4) are four Ce moments in a unit cell
SupplMater , are parallel in Model 1 and antiparallel in Model 2,
respectively. In order to distinguish the two magnetic structure models, the
magnetic intensities at (0.32, 2, 0.11) and (0.68, 1, 0.11) should be
evaluated, which were not measurable on CORELLI using the single crystal
because those peaks are out of the vertical detector coverage. In the Model 1,
it is expected that the (0.32, 2, 0.11) intensity is negligibly weak and the
(0.68, 1, 0.11) intensity is a factor of $\sim$4 weaker than the (0.32, 0,
0.11) intensity. On the other hand, in the Model 2, both the (0.32, 2, 0.11)
and (0.68, 1, 0.11) intensities are expected to be larger than the (0.32, 0,
0.11) intensity.

Figure 5: (0.32, 0, 0.11) magnetic Bragg peak measured at 0.12 GPa (a), 0.25
GPa (b), and 0.4 GPa (c). The background intensities measured above
$T\rm_{SDW}$ are subtracted in (b) and (c). The solid lines are the results of
fits to a Gaussian function. The data shown in (a),(b) and (c) were measured
at CORELLI diffractometer, HB-1, and HB-1A triple axis spectrometers,
respectively. (a) represents $d$-spacing dependence of integrated intensities
obtained using the instrument view window in CORELLI, while (b) and (c)
represent background subtracted $\theta$-2$\theta$ scans. Figure 6:
Temperature dependence of the (0.32, 0, 0.11) magnetic Bragg peak intensity
measured at 0.12 GPa (a) and 0.25 GPa (b). The solid lines are the fitting
results to a power-law function. (c) Averaged magnetic moment around 0.3 K as
a function of applied pressure. The broken line is a guide to the eye.

In order to observe the magnetic Bragg intensities at the mentioned (0.32, 2,
0.11) and (0.68, 1, 0.11) reflections, we performed a neutron diffraction
measurement using a polycrystalline sample on HB-1A. Figure 4 shows the
neutron diffraction pattern around (0.32, 0, 0.11), (0.32, 2, 0.11), and
(0.68, 1, 0.11) observed at 0.3 K note . The magnetic Bragg intensities at
(0.32, 2, 0.11) and (0.68, 1, 0.11) are much weaker than that at (0.32, 0,
0.11), revealing that the Model 1 is the appropriate magnetic structure at
ambient pressure. The averaged magnetic moment was determined to be 0.45(5)
$\mu_{B}$. It is worth noting that this magnetic structure is the simplest
magnetic structure that can be derived from the available data. More
complicated structure or small deviations from the above structure may be
possible if further weak magnetic peaks could be detected.

###  III.2 Pressure dependence of the magnetic ground state

The high pressure neutron diffraction measurements using single crystal
samples were performed on CORELLI, HB-1A, and HB-1. Since the magnetic moment
is small ($<$0.5$\mu\rm_{B}$), the measurements were challenging due to high
background and low beam transmission originating from the pressure cell and
pressure transmitting medium. The Bragg peak intensities around (0.32, 0,
0.11) at 0.12, 0.25, and 0.4 GPa are plotted in Fig. 5. We found that the
magnetic propagation vector is almost independent of pressure.

The order parameters of the integrated magnetic intensities at 0.12 and 0.25
GPa are plotted in Figs. 6(a) and 6(b), respectively. $T\rm_{SDW}$ gradually
decreases with increasing pressure, as shown in Fig. 1. The averaged magnetic
moment as a function of pressure is shown in Fig. 6(c). The magnetic moment
also decreases gradually with increasing pressure. The magnetic intensity at
0.4 GPa, where magnetic moment is 0.24(3)$\mu\rm_{B}$, is already very weak
and reaches the limit for measuring magnetic signal with reasonably good
signal-to-noise ratio. Therefore, we did not measure at higher pressures than
0.4 GPa in this study. As summarized in Fig. 1, $T\rm_{SDW}$ is systematically
lower than the $T^{*}$, obtained from the resistivity measurements.
Extrapolating the $T\rm_{SDW}$-pressure (Fig. 1) and magnetic moment-pressure
[Fig. 6(c)] relations to higher pressures, the long-range SDW order is
expected to disappear at $\sim$1.1$\pm 0.15$ and $\sim$0.9$\pm 0.1$ GPa,
respectively.

##  IV Discussion

As described in Sec. I, the resistivity becomes $T$-linear-like and the
residual resistivity shows a maximum at the quantum critical pressure
$\sim$1.2 GPa Nakano2009 . This pressure corresponds to the pressure where a
valence crossover or a valence transition was reported Nakano2013 , suggesting
that the quantum critical behavior is driven by the valence fluctuations in
CePtSi2. Our results suggest that the long-range magnetic order may disappear
around $\sim$1.0 GPa, which is lower than the quantum critical pressure
($\sim$1.2 GPa) and $P\rm_{c1}$($\sim$1.4 GPa). This implies that the magnetic
critical point may not be directly related with the quantum critical behavior
and the appearance of superconductivity.

The temperature-pressure phase diagram in Ce- and Yb-based heavy fermion
metals with valence fluctuations was discussed in Ref. Watanabe2011 . The
interplay of the magnetic order and valence fluctuations is important to
understand the physical properties in the Ce- and Yb-based systems. Applying
pressure, valence fluctuations are gradually enhanced, which leads to the
suppression of a magnetic order. $P\rm_{m}$ and $P\rm_{v}$ are defined as
critical pressures, where the magnetic order is suppressed completely and the
valence transition occurs, respectively. There are three categories with (a)
$P\rm_{m}$ $<$ $P\rm_{v}$, (b) $P\rm_{m}$ = $P\rm_{v}$, and (c) $P\rm_{m}$ $>$
$P\rm_{v}$. The phase diagram changes from (a) to (c) with reducing the
$c$-$f$ mixing in the periodic Anderson model. The phase diagram in CePtSi2 is
considered to be located between (a) and (b) and close to (b), since
$P\rm_{v}$ is reported to be $\sim$1.2 GPa Nakano2009  and the present results
suggest that $P\rm_{m}\sim$1.0(1) GPa. The superconducting phase is located
between 1.4 and 2.1 GPa, which is higher than $P\rm_{m}$ and $P\rm_{v}$, where
the superconducting transition temperature is supposed to be enhanced.
Although the superconducting phase was shown to be stabilized in the extended
region around $P=P\rm_{v}$ Onishi2000 ; Watanabe2006 , the quantitative
explanation for the measured superconducting region should be addressed by
future theoretical studies.

One of the most remarkable findings in this study is that $T\rm_{SDW}$
obtained from neutron diffraction measurements is much lower than $T^{*}$
determined by resistivity and heat capacity measurements Nakano2009 ;
Hirose2011 . As described in Sec. I, an additional anomalous temperature
($T\rm_{FL}$) was reported below $T^{*}$. The transition temperature and its
pressure dependence of $T\rm_{FL}$ are similar to those of $T\rm_{SDW}$ (Fig.
1), suggesting that the $T\rm_{FL}$ corresponds to $T\rm_{SDW}$. Furthermore,
the heat capacity shows a broad shoulder around 1.25 K Hirose2011 ; SupplMater
. This may also correspond to the antiferromagnetic transition. This is in
contrast to CeRhGe2 which shows a sharp lambda transition Hirose2011 . These
results suggest that an additional phase exists between $T^{*}$ and
$T\rm_{SDW}$/$T\rm_{FL}$ and the magnetic state may be disordered in the
phase, since we did not observe magnetic Bragg peaks. It is puzzling why no
sharp anomaly is observed at $T\rm_{SDW}$ in the resistivity and heat capacity
measurements.

Here, we discuss a possible state in the intermediate phase between $T^{*}$
and $T\rm_{FL}$/$T\rm_{SDW}$. Since no magnetic Bragg peaks were observed in
this phase, a long-range magnetic order does not likely occur. One possible
state is a quadrupole order. The CEF ground state in CePtSi2 is reported as
$|\psi_{\pm}\rangle=0.656|\pm 3/2\rangle+0.288|\mp 1/2\rangle+0.698|\mp
5/2\rangle$ Hirose2011 . Then, it is possible that the electric quadrupole
originates from the transition between the $J_{z}=\pm 3/2$ and $J_{z}=\mp 1/2$
states and/or the $J_{z}=\mp 1/2$ and $J_{z}=\mp 5/2$ states. As discussed in
Ref. Watanabe2011 , the magnetic order can be suppressed by valence
fluctuations enhanced at the valence-crossover pressure or by valence-
transition pressure $P\rm_{v}$. In the CEF of the present system, the electric
quadrupole order can occur as mentioned above. In this case, the quadrupole
order is also considered to be suppressed by $P\rm_{v}$. The Ce site is not
centro-symmetric locally, which gives rise to the odd-parity CEF. Therefore,
in this case, an odd-parity multipolar order can be induced. In
$\beta$-YbAlB4, magnetic toroidal degree of freedom is induced under the odd-
parity CEF Watanabe2019 . If the odd-parity multipole is composed of 4$f$ and
5$d$ orbitals at Ce, the origin of the ordering of the multipole and the
emergence of the valence-crossover pressure or valence-transition pressure
$P\rm_{v}$ is common, which is the Coulomb repulsion between the 4$f$ and 5$d$
orbitals at Ce Watanabe2019 .

##  V Summary

Our neutron diffraction study in CePtSi2 has revealed that the magnetic
structure is SDW with the magnetic propagation vector of (0.32, 0, 0.11) and
the easy axis along the $c$ axis at ambient pressure. $T\rm_{SDW}$ ($\sim$1.25
K) is much lower than $T\rm^{*}$ ($\sim$1.8 K) but close to $T\rm_{FL}$
($\sim$1.4 K), suggesting that there may be an intermediate phase between
$T\rm^{*}$ and $T\rm_{SDW}$, which might be a quadruple or odd-parity
multipoler ordered state. Applying pressure, the magnetic order may disappear
around 1.0 GPa, which is lower than $P\rm_{c1}$($\sim$1.4 GPa), suggesting
that magnetic fluctuations are not directly coupled to the superconducting
pairing mechanism. Further experimental and theoretical studies are highly
desirable to clarify the superconducting pairing mechanism in CePtSi2.

## Acknowledgments

We thank R. Kobayashi for his preliminary measurement at the early stage of
this research. This research was supported in part by the U.S.-Japan
Cooperative Program on Neutron Scattering. This research used resource at the
Spallation Neutron Source and High Flux Isotope Reactor, DOE Office of Science
User Facilities operated by the Oak Ridge National Laboratory. This work was
partially supported by MEXT, the Grant-in-Aid for Scientific Research “Grant
No. 19H00648”.

## References

  * (1) K. Miyake, O. Narikiyo, and Y. Onishi, Physica B 259-261, 676 (1999).
  * (2) Y. Onishi and K. Miyake, J. Phys. Soc. Jpn. 69, 3955 (2000).
  * (3) S. Watanabe, M. Imada, and K. Miyake, J. Magn. Magn. Mater. 310, 841 (2007).
  * (4) A. T. Holmes, D. Jaccard, and K. Miyake, J. Phys. Soc. Jpn. 76, 051002 (2007).
  * (5) S. Watanabe, M. Imada, and K. Miyake, J. Phys. Soc. Jpn. 75, 043710 (2006).
  * (6) S. Watanabe and K. Miyake, J. Phys. Condens. Matter., 23, 094217 (2011).
  * (7) T. C. Kobayashi, K. Fujiwara, K. Takeda, H. Harima, Y. Ikeda, T. Adachi, Y. Ohishi, C. Geibel, and F. Steglich, J. Phys. Soc. Jpn. 82, 114701 (2013).
  * (8) A. T. Holmes, D. Jaccard, and K. Miyake, Phys. Rev. B 69, 024508 (2004).
  * (9) T. Nakano, M. Ohashi, G. Oomi, K. Matsubayashi, and Y. Uwatoko, Phys. Rev. B 79, 172507 (2009).
  * (10) Y. Hirose, N. Nishimura, F. Honda, K. Sugiyama, M. Hagiwara, K. Kindo, T. Takeuchi, E. Yamamoto, Y. Haga, M. Matsuura, K. Hirota, A. Yasui, H. Yamagami, R. Settai, and Y. Onuki, J. Phys. Soc. Jpn. 80 024711 (2011).
  * (11) $T\rm_{N}$ was used to represent this characteristic temperature in the literature. $T^{*}$ is used in this paper since no magnetic order was observed below the temperature.
  * (12) T. Nakano, M. Ohashi, G. Oomi, K. Matsubayashi, and Y. Uwatoko, J. Supercond. Nov. Magn. 23, 799 (2010).
  * (13) T. Nakano, S. Onuki, and N. Takeda , J. Supercond. Nov. Magn. 26, 2135 (2013).
  * (14) D. Jaccard, H. Wilhelm, K. Alami-Yadri, E. Vargoz, Physica B 259-261, 1 (1999).
  * (15) M. Kasaya, M. Ito, A. Ono, and O. Sakai, Physica B 224, 336 (1996).
  * (16) Supplemental Material for the representation analysis of the magnetic structure, sample characterization, and neutron diffraction measurements.
  * (17) F. Ye, Y. Liu, R. Whitfield, R. Osborn, and S. Rosenkranz, J. Appl. Crystallogr. 51, 315 (2018).
  * (18) K. Komatsu, K. Munakata, K. Matsubayashi, Y. Uwatoko, Y. Yokoyama, K. Sugiyama, and M. Matsuda, High Pressure Research, 35, 254 (2015).
  * (19) A. S. Wills, Physica B 276-278, 680 (2000).
  * (20) J. Rodriguez-Carvajal, Physica B 192, 55 (1993).
  * (21) E. F. Bertaut, J. Appl. Phys. 33 1138 (1962).
  * (22) E. F. Bertaut, Acta. Cryst. A24 217 (1968).
  * (23) E. F. Bertaut, J. de Physique Colloques 32, C1-462 (1971).
  * (24) E. F. Bertaut, J. Magn. Magn. Mat. 24, 267 (1981).
  * (25) Yu. A. Izyumov, V. E. Naish, and R. P. Ozerov, Neutron Diffraction of Magnetic Materials (Consultants Bureau, New York, 1991).
  * (26) C. J. Bradley and A. P. Cracknell, The Mathematical Theory of Symmetry in Solids (Clarendon Press, Oxford, U.K., 1972).
  * (27) A. P. Cracknell, Magnetism in Crystalline Materials (Pergamon Press, Oxford, U.K., 1975).
  * (28) A. S. Wills, J. Phys. IV France 11, Pr9-133 (2001).
  * (29) A. S. Wills, Phys. Rev. B, 63, 064430 (2001).
  * (30) O. V. Kovalev, Representations of the Crystallographic Space Groups, 2nd edition (Gordon and Breach Science Publishers, Lausanne, 1993).
  * (31) Note that the magnetic Bragg peaks were not observed in the preliminary powder diffraction measurement on a neutron powder diffractometer, because the intrinsic high instrumental $Q$ resolution is compensated by the low beam flux, that is not strong enough to observe the weak magnetic signals.
  * (32) S. Watanabe and K. Miyake, J. Phys. Soc. Jpn. 88, 033701 (2019).