# Towards Adversarially Robust Deep Image Denoising

Hanshu Yan1 Jingfeng Zhang2 Jiashi Feng3 Masashi Sugiyama2,4 Vincent Y. F.
Tan1,5 1ECE, NUS; 2RIKEN-AIP; 3ByteDance Inc; 4GSFS, UTokyo; 5Math, NUS
<EMAIL_ADDRESS>
###### Abstract

This work systematically investigates the adversarial robustness of deep image
denoisers (DIDs), i.e, how well DIDs can recover the ground truth from noisy
observations degraded by adversarial perturbations. Firstly, to evaluate DIDs’
robustness, we propose a novel adversarial attack, namely Observation-based
Zero-mean Attack (ObsAtk), to craft adversarial zero-mean perturbations on
given noisy images. We find that existing DIDs are vulnerable to the
adversarial noise generated by ObsAtk. Secondly, to robustify DIDs, we propose
an adversarial training strategy, hybrid adversarial training (HAT), that
jointly trains DIDs with adversarial and non-adversarial noisy data to ensure
that the reconstruction quality is high and the denoisers around non-
adversarial data are locally smooth. The resultant DIDs can effectively remove
various types of synthetic and adversarial noise. We also uncover that the
robustness of DIDs benefits their generalization capability on unseen real-
world noise. Indeed, HAT-trained DIDs can recover high-quality clean images
from real-world noise even without training on real noisy data. Extensive
experiments on benchmark datasets, including Set68, PolyU, and SIDD,
corroborate the effectiveness of ObsAtk and HAT.

##  1 Introduction

Image denoising, which aims to reconstruct clean images from their noisy
observations, is a vital part of the image processing systems. The noisy
observations are usually modeled as the addition between ground-truth images
and zero-mean noise maps Dabov et al. (2007); Zhang et al. (2017). Recently,
deep learning-based methods have made significant advancements in denoising
tasks Zhang et al. (2017); Anwar and Barnes (2019) and have been applied in
many areas including medical imaging Gondara (2016) and photography Abdelhamed
et al. (2018). Despite the success of deep denoisers in recovering high-
quality images from a certain type of noisy images, we still lack knowledge
about their robustness against adversarial perturbations, which may cause
severe safety hazards in high-stake applications like medical diagnosis. To
address this problem, the first step should be developing attack methods
dedicated for denoising to evaluate the robustness of denoisers. In contrast
to the attacks for classification Goodfellow et al. (2015); Madry et al.
(2018), attacks for denoising should consider not only the adversarial budget
but also some assumptions of natural noise, such as zero-mean, because certain
perturbations, such as adding a constant value, do not necessarily result in
visual artifacts. Although Choi _et al._ Choi et al. (2021, 2019) studied the
vulnerability for various deep image processing models, they directly applied
the attack from classification. To the best of our knowledge, no attacks are
truly dedicated for the denoising task till now.

To this end, we propose the observation-based zero-mean attack (ObsAtk), which
crafts a worst-case zero-mean perturbation for a noisy observation by
maximizing the distance between the output and the ground-truth. To ensure
that the perturbation satisfies the adversarial budget and the zero-mean
constraints, we utilize the classical projected-gradient-descent (PGD) Madry
et al. (2018) method for optimization, and develop a two-step operation to
project the perturbation back into the feasible region. Specifically, in each
iteration, we first project the perturbation onto the zero-mean hyperplane.
Then, we linearly rescale the perturbation to adjust its norm to be less or
equal to the adversarial budget. We examine the effectiveness of ObsAtk on
several benchmark datasets and find that deep image denoisers are indeed
susceptible to ObsAtk: the denoisers cannot remove adversarial noise
completely and even yield atypical artifacts, as shown in Figure 2(g).

To robustify deep denoisers against adversarial perturbations, we propose an
effective adversarial training strategy, namely hybrid adversarial training
(HAT), to train denoisers by using adversarially noisy images and non-
adversarial noisy images together. The loss function of HAT consists of two
terms. The first term ensures the reconstruction performance from common non-
adversarial noisy images, and the second term ensures the reconstructions
between non-adversarial and adversarial images to be close to each other.
Thus, we can obtain denoisers that perform well on both non-adversarial noisy
images and their adversarial perturbed versions. Extensive experiments on
benchmark datasets verify the effectiveness of HAT.

Moreover, we reveal that adversarial robustness benefits the generalization
capability to unseen types of noise, i.e., HAT can train denoisers for real-
world noise removal only with synthetic noise sampled from common
distributions like Gaussians. That is because ObsAtk searches for the worst-
case perturbations around different levels of noisy images, and training with
adversarial data ensures the denoising performance on various types of noise.
In contrast, other reasonable methods for real-world denoising Guo et al.
(2019); Lehtinen et al. (2018) mostly require a large number of real-world
noisy data for the training, which are unfortunately not available in some
applications like medical radiology. We conduct experiments on several real-
world datasets. Numerical and visual results demonstrate the effectiveness of
HAT for real-world noise removal.

In summary, there are three main contributions in this work: 1) We propose a
novel attack, ObsAtk, to generate adversarial examples for noisy observations,
which facilitates the evaluation of the robustness of deep image denoisers. 2)
We propose an effective adversarial training strategy, HAT, for robustifying
deep image denoisers. 3) We build a connection between adversarial robustness
and the generalization to unseen noise, and show that HAT serves as a
promising framework for training generalizable deep image denoisers.

##  2 Notation and Background

#### Adversarial robustness and adversarial training

Consider a deep neural network (DNN) $\\{f_{\theta}:\theta\in\Theta\\}$
mapping an input ${\mathbf{y}}$ to a target ${\mathbf{x}}$, the model is
trained to minimize a certain loss function that is measured by particular
distance $d(\cdot,\cdot)$ between output $f_{\theta}({\mathbf{y}})$ and the
target ${\mathbf{x}}$. In high stake applications, the DNN should resist small
perturbations on the input data and map the perturbed input to a result close
to the target. The notion of robustness has been proposed to measure the
resistance of DNNs against the slight changes of the input Szegedy et al.
(2014); Goodfellow et al. (2015). The robustness is characterized by the
distance $d(f_{\theta}({\mathbf{y}}^{\prime}),{\mathbf{x}})$ between
$f_{\theta}({\mathbf{y}}^{\prime})$ and target ${\mathbf{x}}$, where the
worst-case perturbed input ${\mathbf{y}}^{\prime}$ is located within a small
neighborhood of the original input ${\mathbf{y}}$ and maximizes the distance
between its output and target ${\mathbf{x}}$.

${\mathbf{y}}^{\prime}=\operatorname*{arg\,max}_{{\mathbf{y}}^{\prime}:\|{\mathbf{y}}^{\prime}-{\mathbf{y}}\|\leq\rho}d(f_{\theta}({\mathbf{y}}^{\prime}),{\mathbf{x}}).$
(1)

The worst-case perturbation ${\mathbf{y}}^{\prime}$ can be approximated via
many adversarial attack methods, such as FGSM Goodfellow et al. (2015), I-FGSM
Kurakin et al. (2017), and PGD Madry et al. (2018), which solve (1) via
gradient descent methods. The distance
$d(f_{\theta}({\mathbf{y}}^{\prime}),{\mathbf{x}})$ is an indication of the
robustness of $f_{\theta}$ around ${\mathbf{y}}$: a small distance implies
strong robustness and vice versa. In terms of image classification, the
$\rho$-neighborhood is usually defined by the $\ell_{\infty}$-norm and the
distance $d(\cdot,\cdot)$ is measured by the cross-entropy loss Madry et al.
(2018) or a margin loss Carlini and Wagner (2017). For image restoration, the
distance between images is usually measured by the $\ell_{2}$-norm Zhang et
al. (2017).

In most cases, deep learning models have been shown to be vulnerable against
adversarial attacks under normal training (NT) Tramer et al. (2020); Yan et
al. (2019). To robustify DNNs, Madry _et al._ Madry et al. (2018) proposed the
PGD adversarial training (AT) method which trains DNNs with adversarial
examples of the original data. AT is formally formulated as the following min-
max optimization problem,

$\min_{\theta\in\Theta}\max_{{\mathbf{y}}^{\prime}:\|{\mathbf{y}}^{\prime}-{\mathbf{y}}\|\leq\rho}d(f_{\theta}({\mathbf{y}}^{\prime}),{\mathbf{x}}).$
(2)

Its effectiveness has been verified by extensive empirical and theoretical
results Yan et al. (2021); Gao et al. (2019). For further improvement, many
variants of PGD have been proposed in terms of its robustness enhancement
Zhang et al. (2019a), generalization to non-adversarial data Zhang et al.
(2020a), and computational efficiency Shafahi et al. (2019).

#### Deep image denoising

During image capturing, unknown types of noise may be induced by physical
sensors, data compression, and transmission. Noisy observations are usually
modeled as the addition between the ground-truth images and certain zero-mean
noise Dabov et al. (2007); Zhang et al. (2019b), i.e.,
${\mathbf{Y}}={\mathbf{X}}+{\mathbf{V}}$ with
$\mathbb{E}_{Q}\big{[}\sum_{i=1}^{m}{\mathbf{V}}_{[i]}\big{]}=0$, where
${\mathbf{V}}_{[i]}$ is the $i^{\text{th}}$ element of ${\mathbf{V}}$. The
random vector ${\mathbf{X}}\in{\mathbb{R}}^{m}$ with distribution $P$ denotes
a random clean image and the noise ${\mathbf{V}}\in{\mathbb{R}}^{m}$ with a
distribution $Q$ satisfies the zero-mean constraint. Denoising techniques aim
to recover clean images from their noisy observations Zhang et al. (2017);
Dabov et al. (2007). Suppose we are given a training set
$\mathcal{S}=\\{({\mathbf{y}}_{j},{\mathbf{x}}_{j})\\}^{N}_{j=1}$ of noisy and
clean image pairs sampled from distributions $Q$ and $P$ respectively, we can
train a DNN to effectively remove the noise induced by distribution $Q$ from
the noisy observations. A series of DNNs have been developed for denoising in
recent years, including DnCNN Zhang et al. (2017), FFDNet Zhang et al. (2018),
and RIDNet Anwar and Barnes (2019).

In real-world applications Abdelhamed et al. (2018); Xu et al. (2017), the
noise distribution $Q$ is usually unknown due to the complexity of the image
capturing procedures; besides, collecting a large number of image pairs
(clean/noisy or noisy/noisy) for training sometimes may be unrealistic in
safety-critical domains such as medical radiology Zhang et al. (2019b). To
overcome these, researchers developed denoising techniques by approximating
real noise with common distributions like Gaussian or Poisson Dabov et al.
(2007); Zhang et al. (2019b). To train denoisers that can deal with different
levels of noise, where the noise level is measured by the energy-density
$\|{\mathbf{v}}\|^{2}_{2}/m$ of noise, the training set may consist of noisy
images sampled from a variety of noise distributions Zhang et al. (2017),
whose expected energy-densities range from zero to certain budget
$\epsilon^{2}$ (the expected $\ell_{2}$-norms range from zero to
$\epsilon\sqrt{m}$). For example,
$\mathcal{S}^{\epsilon}=\\{({\mathbf{y}}_{j},{\mathbf{x}}_{j})\\}^{N}_{j=1}$
where ${\mathbf{y}}_{j}={\mathbf{x}}_{j}+{\mathbf{v}}_{j}$ and
${\mathbf{x}}_{j}$ and ${\mathbf{v}}_{j}$ are sampled from $P$ and $Q$
respectively and where $Q$ is randomly selected from a set of Gaussian
distributions
$\mathcal{Q}^{\epsilon}=\\{\mathcal{N}(\bm{0},\sigma^{2}\mathbf{I})|\sigma\in[0,\epsilon]\\}$.
The denoiser $f_{\theta}^{\epsilon}(\cdot)$ trained with
$\mathcal{S}^{\epsilon}$ is termed as an $\epsilon$-denoiser.

#### On robustness of deep image denoisers

In practice, data storage and transmission may induce imperceptible
perturbations on the original data so that the perturbed noise may be
statistically slightly different from the noise sampled from the specific
original distribution. Although an $\epsilon$-denoiser can successfully remove
noise sampled from $Q\in\mathcal{Q}^{\epsilon}$, the performance of noise
removal on the perturbed data is not guaranteed. Thus, we propose a novel
attack method, ObsAtk, to assess the adversarial robustness of DIDs in Section
3. To robustify DIDs, we propose an adversarial training strategy, HAT, in
Section 4. HAT-trained DIDs can effectively denoise adversarial perturbed
noisy images and preserve good performance on non-adversarial data.

Besides the adversarial robustness issue, it has been shown that
$\epsilon$-denoisers trained with $\mathcal{S}^{\epsilon}$ cannot generalize
well to unseen real-world noise Lehtinen et al. (2018); Batson and Royer
(2019). Several methods have been proposed for real-world noise removal, but
most of them require a large number of real noisy data for training, e.g.,
CBDNet (clean/noisy pairs) Guo et al. (2019) and Noise2Noise (noisy pairs)
Lehtinen et al. (2018), which is sometimes impractical. In Section 4.3, we
show that HAT-trained DIDs can generalize well to unseen real noise without
the need of utilizing real noisy images for training.

##  3 ObsAtk for Robustness Evaluation

In this section, we propose a novel adversarial attack, Observation-based
Zero-mean Attack (ObsAtk), to evaluate the robustness of DIDs. We also conduct
experiments on benchmark datasets to demonstrate that normally-trained DIDs
are vulnerable to adversarial perturbations.

###  3.1 Observation-based Zero-mean Attack

Figure 1: Illustration of ObsAtk. Left: We perturb a noisy observation
${\mathbf{y}}$ of the ground-truth ${\mathbf{x}}$ with an adversarial budget
$\rho$ in the $\ell_{2}$-norm. For an $\epsilon$-denoiser, we choose a proper
value of $\rho$ to ensure the norm of the total noise is bounded by
$\epsilon\sqrt{m}$, where $m$ denotes the image size. Right: The perturbation
$\bm{\delta}$ is projected via the two-step operation onto the region defined
by the zero-mean and $\rho$-ball constraints.

An $\epsilon$-denoiser $f^{\epsilon}_{\theta}(\cdot)$ can generate a high-
quality reconstruction $f^{\epsilon}_{\theta}({\mathbf{y}})$ close to the
ground-truth ${\mathbf{x}}$ from a noisy observation
${\mathbf{y}}={\mathbf{x}}+{\mathbf{v}}$. To evaluate the robustness of
$f^{\epsilon}_{\theta}(\cdot)$ with respect to a perturbation on
${\mathbf{y}}$, we develop an attack to search for the worst perturbation
$\bm{\delta}^{*}$ that degrades the recovered image
$f^{\epsilon}_{\theta}({\mathbf{y}}+\bm{\delta}^{*})$ as much as possible.
Formally, we need to solve the problem stated in Eq. (3). The optimization
problem is subject to two constraints: The first constraint requires the norm
of $\bm{\delta}$ to be bounded by a small adversarial budget $\rho$. The
second constraint restricts the mean $M(\bm{\delta})$ of all elements in
$\bm{\delta}$ to be zero. This corresponds to the zero-mean assumption of
noise in real-world applications because a small mean-shift does not
necessarily result in visual noise. For example, a mean-shift in gray-scale
images implies a slight change of brightness. Since the zero-mean perturbation
is added to a noisy observation ${\mathbf{y}}$, we term the proposed attack as
Observation-based Zero-mean Attack (ObsAtk).

$\displaystyle\bm{\delta}^{*}$
$\displaystyle=\operatorname*{arg\,max}_{\bm{\delta}\in{\mathbb{R}}^{m}}\|f_{\theta}^{\epsilon}({\mathbf{y}}+\bm{\delta})-{\mathbf{x}}\|_{2}^{2},$
(3a) s.t.
$\displaystyle\|\bm{\delta}\|_{2}\leq\rho,\;\;\text{~{}}\;\;M(\bm{\delta})=\frac{1}{m}\sum_{i=1}^{m}\bm{\delta}_{[i]}=0.$
(3b)

Algorithm 1 ObsAtk

1:Denoiser $f_{\theta}(\cdot)$, ground-truth ${\mathbf{x}}$, noisy observation
${\mathbf{y}}$, adversarial budget $\rho$, #iterations $T$, step-size $\eta$,
minimum pixel value $p_{\text{min}}$, maximum pixel value $p_{\text{max}}$

2:Adversarial perturbation $\bm{\delta}$

3:$\bm{\delta}\leftarrow\mathbf{0}$

4:for $t=1$ to $T$ do

5:
$\bm{\delta}\leftarrow\bm{\delta}+\eta\nabla_{\bm{\delta}}\|f_{\theta}^{\epsilon}({\mathbf{y}}+\bm{\delta})-{\mathbf{x}}\|_{2}^{2}$;

6:
$\bm{\delta}\leftarrow\bm{\delta}-(\bm{\delta}^{\top}{\mathbf{n}}/{\|{{\mathbf{n}}}\|^{2}_{2}}){{\mathbf{n}}}$
where ${\mathbf{n}}$ is in (4a)

7:
$\bm{\delta}\leftarrow\min(\nicefrac{{\rho}}{{\|\bm{\delta}\|_{2}}},1)\bm{\delta}$;

8:$\bm{\delta}\leftarrow\text{Clip}({\mathbf{y}}+\bm{\delta},p_{\text{min}},p_{\text{max}})-{\mathbf{y}}$

We solve the constrained optimization problem Eq. (3) by using the classical
projected-gradient-descent (PGD) method. PGD-like methods update optimization
variables iteratively via gradient descent and ensure the constraints to be
satisfied by projecting parameters back to the feasible region at the end of
each iteration. To deal with the $\ell_{2}$-norm and zero-mean constraints, we
develop a two-step operation in Eq. (4), that first projects the perturbation
$\bm{\delta}$ back to the zero-mean hyperplane and then projects the result
onto the $\rho$-neighborhood.

$\displaystyle\bm{\delta}^{\prime}$
$\displaystyle=\bm{\delta}-\frac{\bm{\delta}^{\top}{\mathbf{n}}}{\|{{\mathbf{n}}}\|^{2}_{2}}{{\mathbf{n}}},\quad\mbox{where}\quad{\mathbf{n}}=[1,1,\ldots,1]^{\top},$
(4a) $\displaystyle\bm{\delta}^{\prime\prime}$
$\displaystyle=\min\Big{(}\frac{\rho}{\|\bm{\delta}^{\prime}\|_{2}},1\Big{)}\text{~{}}\bm{\delta}^{\prime}.$
(4b)

In each iteration, as shown in Figure 1, the first step involves projecting
the perturbation $\bm{\delta}$ onto the zero-mean hyperplane. The zero-mean
hyperplane consists of all the vectors ${\mathbf{z}}$ whose mean of all
elements equals zero, i.e., ${\mathbf{n}}^{\top}{\mathbf{z}}=0$, where
${\mathbf{n}}$ is the length-$d$ all ones vector. Thus, ${\mathbf{n}}$ is a
normal of the zero-mean plane. We can project any vector onto the zero-mean
plane via (4a). The vector $\bm{\delta}$ is first projected along the
direction of ${\mathbf{n}}$, then its projection $\bm{\delta}^{\prime}$ onto
the zero-mean plane equals itself minus its projection onto ${\mathbf{n}}$.
The second step involves further projecting $\bm{\delta}^{\prime}$ back to the
$\rho$-ball via linear scaling. If $\bm{\delta}^{\prime}$ is already within
the $\rho$-ball, we keep $\bm{\delta}^{\prime}$ unchanged. Otherwise, the
final projection $\bm{\delta}^{\prime\prime}$ is obtained by scaling
$\bm{\delta}^{\prime}$ with a factor ${\rho}/{\|\bm{\delta}^{\prime}\|_{2}}$.
For any two sets $A$ and $B$, although the projection onto $A\cap B$ is, in
general, not equal to the result obtained by first projecting onto $A$, then
onto $B$, surprisingly, the following holds for the two sets in (3b).

######  Theorem 1 (Informal)

Given any vector $\bm{\delta}\in{\mathbb{R}}^{m}$, the projection of
$\bm{\delta}$ via the two-step operation in (4) satisfies the two constraints
in (3b), and the two-step projection is equivalent to the exact projection
onto the set defined by (3b).

The formal statement and the proof of Theorem 1 are provided in Appendix A.
The complete procedure of ObsAtk is summarized in Algorithm 1.

(a) ${\mathbf{x}}$

(b) ${\mathbf{v}}$

(c) ${\mathbf{y}}$

(d) $f^{\epsilon}_{\theta}({\mathbf{y}})$

(e) ${\mathbf{v}}+\bm{\delta}$

(f) ${\mathbf{y}}+\bm{\delta}$

(g) $f^{\epsilon}_{\theta}({\mathbf{y}}+\bm{\delta})$

Figure 2:  Given a normally-trained denoiser $f^{\epsilon}_{\theta}(\cdot)$,
from left to right are the ground-truth image ${\mathbf{x}}$, Gaussian noise
${\mathbf{v}}$, the Gaussian noisy image
${\mathbf{y}}={\mathbf{x}}+{\mathbf{v}}$, the reconstruction
$f^{\epsilon}_{\theta}({\mathbf{y}})$ from ${\mathbf{y}}$, adversarial noise
${\mathbf{v}}+\bm{\delta}$, the adversarially noisy image
${\mathbf{y}}+\bm{\delta}$, and the reconstruction
$f^{\epsilon}_{\theta}({\mathbf{y}}+\bm{\delta})$ from
${\mathbf{y}}+\bm{\delta}$. Comparing (a), (d) and (g), we observe that
$f^{\epsilon}_{\theta}(\cdot)$ can effectively remove Gaussian noise but its
performance is degraded when dealing with the adversarial noise (noise remains
on the roof and strange contours appear in the sky).

###  3.2 Robustness Evaluation via ObsAtk

We use ObsAtk to evaluate the adversarial robustness of $\epsilon$-denoisers
on several gray-scale and RGB benchmark datasets, including Set12, Set68,
BSD68, and Kodak24. For gray-scale image denoising, we use Train400 to train a
DnCNN-B Zhang et al. (2017) model, which consists of 20 convolutional layers.
We follow the training setting in Zhang _et al._ Zhang et al. (2017) and
randomly crop $128\times 3000$ patches in size of $50\times 50$. Noisy and
clean image pairs are constructed by injecting different levels of white
Gaussian noise into clean patches. The noise levels $\sigma$ are uniformly
randomly selected from $[0,\epsilon]$ with $\epsilon=\nicefrac{{25}}{{255}}$.
For RGB image denoising, we use BSD432 (BSD500 excluding images in BSD68) to
train a DnCNN-C model with the same number of layers as DnCNN-B and but set
the input and output channels to be three. Other settings follow those of the
training of DnCNN-B.

We evaluate the denoising capability of the $\epsilon$-denoiser on Gaussian
noisy images and their adversarially perturbed versions. The image quality of
reconstruction is measured via the peak-signal-noise ratio (PSNR) metric. A
large PSNR between reconstruction and ground-truth implies a good performance
of denoising. We denote the energy-density of the noise in test images as
$\hat{\epsilon}^{2}$ and consider three levels of noise, i.e.,
$\hat{\epsilon}=\nicefrac{{25}}{{255}}$, $\nicefrac{{15}}{{255}}$, and
$\nicefrac{{10}}{{255}}$. For Gaussian noise removal, we add white Gaussian
noise with $\sigma=\hat{\epsilon}$ to clean images. For Uniform noise removal,
we generate noise from
$\mathcal{U}(-\sqrt{3}\hat{\epsilon},\sqrt{3}\hat{\epsilon})$. For denoising
adversarial noisy images, the norm budgets of adversarial perturbation are set
to be $\rho=\nicefrac{{5}}{{255}}\cdot\sqrt{m}$ and
$\nicefrac{{7}}{{255}}\cdot\sqrt{m}$ respectively, where $m$ equals the size
of test images. We perturb noisy observations whose noise are generated from
$\mathcal{N}(0,\hat{\epsilon}-\nicefrac{{\rho}}{{\sqrt{m}}})$, so that the
$\ell_{2}$-norms of total noise in adversarial images are still bounded by
$\hat{\epsilon}\cdot\sqrt{m}$ and the energy-density thus are bounded by
$\hat{\epsilon}^{2}$ . We use Atk-$\nicefrac{{\rho}}{{\sqrt{m}}}$ to denote
the adversarially perturbed noisy images in the size of $m$ with adversarial
budget $\rho$. The number of iterations of PGD in ObsAtk is set to be five.

Table 1: The average PSNR (in dB) results of DnCNN denoisers on the gray-scale
and RGB datasets. Four types of noise are used for evaluation, viz. Gaussian
$\mathcal{N}$ and Uniform $\mathcal{U}$ random noise, and ObsAtk with two
different adversarial budgets. The energy-density of noise is bounded by
$\hat{\epsilon}^{2}$.

Dataset | $\hat{\epsilon}$ | $\mathcal{N}$ | $\mathcal{U}$ | Atk-$\nicefrac{{5}}{{255}}$ | Atk-$\nicefrac{{7}}{{255}}$
---|---|---|---|---|---
Set68 | $\nicefrac{{25}}{{255}}$ | 29.16/0.02 | 29.15/0.01 | 24.26/0.12 | 23.12/0.10
$\nicefrac{{15}}{{255}}$ | 31.68/0.00 | 31.68/0/00 | 26.66/0.04 | 26.08/0.02
Set12 | $\nicefrac{{25}}{{255}}$ | 30.39/0.01 | 30.41/0.01 | 24.32/0.18 | 22.96/0.13
$\nicefrac{{15}}{{255}}$ | 32.78/0.00 | 32.81/0.00 | 26.91/0.05 | 26.25/0.01
BSD68 | $\nicefrac{{25}}{{255}}$ | 31.25/0.11 | 31.17/0.11 | 27.44/0.08 | 26.08/0.06
$\nicefrac{{15}}{{255}}$ | 33.98/0.11 | 33.93/0.12 | 29.31/0.08 | 27.84/0.04
Kodak24 | $\nicefrac{{25}}{{255}}$ | 32.20/0.13 | 32.13/0.14 | 27.87/0.08 | 26.37/0.07
$\nicefrac{{15}}{{255}}$ | 34.77/0.13 | 34.73/0.14 | 29.55/0.07 | 28.00/0.04

From Tables 1, we observe that ObsAtk clearly degrades the reconstruction
performance of DIDs. In comparison to Gaussian or Uniform noisy images with
the same noise levels, the recovered results from adversarial images are much
worse in the sense of the PSNR. For example, when removing
$\hat{\epsilon}=\nicefrac{{15}}{{255}}$ noisy images in Set12, the average
PSNR of reconstructions from Gaussian noise can achieve 32.78 dB, whereas the
PSNR drops to 26.25 dB when dealing with Atk-$\nicefrac{{7}}{{255}}$
adversarial images. We observe the consistent phenomenon that a normally-
trained denoiser $f^{\epsilon}_{\theta}(\cdot)$ cannot effectively remove
adversarial noise from visual results in Figure 2.

##  4 Robust and Generalizable Denoising via HAT

The previous section shows that existing deep denoisers are vulnerable to
adversarial perturbations. To improve the adversarial robustness of deep
denoisers, we propose an adversarial training method, hybrid adversarial
training (HAT), that uses original noisy images and their adversarial versions
for training. Furthermore, we build a connection between the adversarial
robustness of deep denoisers and their generalization capability to unseen
types of noise. We show that HAT-trained denoisers can effectively remove
real-world noise without the need to leverage the real-world noisy data.

###  4.1 Hybrid Adversarial Training

AT has been proved to be a successful and universally applicable technique for
robustifying deep neural networks. Most variants of AT are developed for the
classification task specifically, such as TRADES Zhang et al. (2019a) and
GAIRAT Zhang et al. (2020b). Here, we propose an AT strategy, HAT, for robust
image denoising:

$\displaystyle\min_{\theta\in\Theta}\mathbb{E}_{{\mathbf{X}}\sim P}$
$\displaystyle\mathbb{E}_{Q\sim\mathcal{U}(\mathcal{Q}^{\epsilon})}\mathbb{E}_{{\mathbf{V}}\sim
Q}\frac{1}{2}\Big{(}\frac{1}{1+\alpha}\|f_{\theta}^{\epsilon}({\mathbf{Y}})-{\mathbf{X}}\|_{2}^{2}$
$\displaystyle+\frac{\alpha}{1+\alpha}\|f_{\theta}^{\epsilon}({\mathbf{Y}})-f_{\theta}^{\epsilon}({\mathbf{Y}}^{\prime})\|_{2}^{2}\Big{)},$
(5)

where ${\mathbf{Y}}={\mathbf{X}}+{\mathbf{V}}$ and
${\mathbf{Y}}^{\prime}={\mathbf{Y}}+\bm{\delta}^{*}$. Note that
$\bm{\delta}^{*}$ is the adversarial perturbation obtained by solving ObsAtk
in Eq. (3).

As shown in Eq. (5), the loss function consists of two terms. The first term
measures the distance between ground-truth images ${\mathbf{x}}$ and
reconstructions $f_{\theta}^{\epsilon}({\mathbf{y}})$ from non-adversarial
noisy images ${\mathbf{y}}$, where ${\mathbf{y}}$ contains noise
${\mathbf{v}}$ sampled from a certain common distribution $Q$, such as
Gaussian. This term encourages a good reconstruction performance of
$f_{\theta}^{\epsilon}$ from common distributions. The second term is the
distance between $f_{\theta}^{\epsilon}({\mathbf{y}})$ and the reconstruction
$f_{\theta}^{\epsilon}({\mathbf{y}}^{\prime})$ from the adversarially
perturbed version ${\mathbf{y}}^{\prime}$ of ${\mathbf{y}}$. This term ensures
that the reconstructions from any two noisy observations within a small
neighborhood of ${\mathbf{y}}$ have similar image qualities. Minimizing these
two terms at the same time controls the worst-case reconstruction performance
$\|f_{\theta}^{\epsilon}({\mathbf{y}}^{\prime})-{\mathbf{x}}\|$.

The coefficient $\alpha$ balances the trade-off between reconstruction from
common noise and the local continuity of $f_{\theta}^{\epsilon}$. When
$\alpha$ equals zero, HAT degenerates to normal training on common noise. The
obtained denoisers fail to resist adversarial perturbations as shown in
Section 3. When $\alpha$ is very large, the optimization gradually ignores the
first term and completely aims for local smoothness. This may yield a trivial
solution that $f_{\theta}^{\epsilon}$ always outputs a constant vector for any
input. A proper value of $\alpha$ thus ensures a denoiser that performs well
for common noise and the worst-case adversarial perturbations simultaneously.
We perform an ablation study on the effect of $\alpha$ for the robustness
enhancement and unseen noise removal in Appendix C.

To train a denoiser applicable to different levels of noise with an energy-
density bounded by $\epsilon^{2}$, we randomly select a noise distribution $Q$
from a family of common distributions $\mathcal{Q}^{\epsilon}$.
$\mathcal{Q}^{\epsilon}$ includes a variety of zero-mean distributions whose
variance are bounded by $\epsilon^{2}$. For example, we define
$\mathcal{Q}^{\epsilon}_{\mathcal{N}}=\\{\mathcal{N}(\bm{0},\sigma^{2}\mathbf{I}))|\sigma\sim\mathcal{U}(0,\epsilon)\\}$
for the experiments in the remaining of this paper.

###  4.2 Robustness Enhancement via HAT

(a) Ground-truth

(b) NT

(c) HAT

Figure 3:  From left to right are the ground-truth, the reconstruction of a
normally-trained denoiser against attack, and the reconstruction of a HAT-
trained denoiser against attack.

We follow the same settings as those in Section 3 for training and evaluating
$\epsilon$-deep denoisers. The highest level of noise used for training is set
to be $\epsilon=\nicefrac{{25}}{{255}}$. Noise is sampled from a set of
Gaussian distributions $\mathcal{Q}^{\epsilon}_{\mathcal{N}}$. We train deep
denoisers with the HAT strategy and set $\alpha$ to be $1$, and use one-step
Atk-$\nicefrac{{5}}{{255}}$ to generate adversarially noisy images for
training. We compare HAT with normal training (NT) and the vanilla adversarial
training (vAT) used in Choi _et al._ Choi et al. (2021) that trains denoisers
only with adversarial data. The results on Set68 and BSD68 are provided in
this section. More results on Set12 and Kodak24 (in Tables B.1 and B.2) are
provided in Appendix B.

Table 2: The average PSNR (in dB) results of DnCNN-B denoisers on the gray-
scale Set68 dataset. NT and HAT are compared in terms of the noise removal of
Gaussian noise and adversarial noise. We repeat the training for three times
and report the mean and standard deviation (mean/std).

Method | $\hat{\epsilon}$ | $\mathcal{N}$ | Atk-$\nicefrac{{3}}{{255}}$ | Atk-$\nicefrac{{5}}{{255}}$ | Atk-$\nicefrac{{7}}{{255}}$
---|---|---|---|---|---
NT | $\nicefrac{{25}}{{255}}$ |  29.16/0.02 | 26.20/0.07 | 24.26/0.12 | 23.12/0.10
$\nicefrac{{15}}{{255}}$ |  31.68/0.00 | 27.98/0.05 | 26.66/0.04 | 26.08/0.02
vAT | $\nicefrac{{25}}{{255}}$ | 29.05/0.07 | 27.02/0.15 | 25.51/0.32 | 24.34/0.34
$\nicefrac{{15}}{{255}}$ | 31.53/0.09 | 28.74/0.16 | 27.43/0.19 | 26.68/0.15
HAT | $\nicefrac{{25}}{{255}}$ | 28.88/0.04 |  27.48/0.10 |  26.40/0.16 |  25.32/0.17
$\nicefrac{{15}}{{255}}$ | 31.36/0.03 |  29.52/0.01 |  28.34/0.03 |  27.34/0.03

From Tables 2 and 3, we observe that HAT obviously improves the reconstruction
performance from adversarial noise in comparison to normal training. For
example, on the Set68 dataset (Table 2), when dealing with
$\nicefrac{{15}}{{255}}$-level noise, the normally-trained denoiser achieves
31.68 dB for Gaussian noise removal, but the PSNR drops to 26.08 dB against
Atk-$\nicefrac{{7}}{{255}}$. In contrast, the HAT-trained denoiser achieves a
PSNR of 27.34 dB (1.26 dB higher) against Atk-$\nicefrac{{7}}{{255}}$ and
maintains a PSNR of 31.36 dB for Gaussian noise removal. In Figure 3, we can
see that when dealing with adversarially noisy images, the HAT-trained
denoiser can recover high-quality images while the normally-trained denoiser
preserves noise patterns in the output. Besides, we observe that, similar to
image classification tasks Zhang et al. (2019a), AT-based methods (HAT and
vAT) robustify deep denoisers at the expense of the performance on non-
adversarial data (Gaussian denoising). Nevertheless, the degraded
reconstructions are still reasonably good in terms of the PSNR.

Table 3: The average PSNR (in dB) results of DnCNN-C denoisers on the RGB
BSD68 dataset.

Method | $\hat{\epsilon}$ | $\mathcal{N}$ | Atk-$\nicefrac{{3}}{{255}}$ | Atk-$\nicefrac{{5}}{{255}}$ | Atk-$\nicefrac{{7}}{{255}}$
---|---|---|---|---|---
NT | $\nicefrac{{25}}{{255}}$ |  31.25/0.11 | 28.93/0.08 | 27.44/0.08 | 26.08/0.06
$\nicefrac{{15}}{{255}}$ |  33.98/0.11 | 31.09/0.10 | 29.31/0.08 | 27.84/0.04
vAT | $\nicefrac{{25}}{{255}}$ | 30.64/0.02 | 28.81/0.03 | 27.67/0.01 | 26.64/0.03
$\nicefrac{{15}}{{255}}$ | 33.45/0.06 | 31.10/0.05 | 29.79/0.02 | 28.63/0.08
HAT | $\nicefrac{{25}}{{255}}$ | 30.98/0.03 |  29.18/0.03 |  28.02/0.02 |  26.93/0.04
$\nicefrac{{15}}{{255}}$ | 33.67/0.04 |  31.38/0.04 |  30.03/0.02 |  28.80/0.01

Table 4: Comparison of different methods for denoising real-world noisy images
in terms of PSNR (dB). We repeat the experiments of each denoising method for
three times and report the mean/standard deviation of PSNR values.

Dataset | BM3D |  | DIP | N2S(1) | NT | vAT | HAT | N2C
---|---|---|---|---|---|---|---|---
PolyU | 37.40 / 0.00 |  | 36.08 / 0.01 | 35.37 / 0.15 | 35.86 / 0.01 | 36.77 / 0.00 |  37.82 / 0.04 | – / –
CC | 35.19 / 0.00 |  | 34.64 / 0.06 | 34.33 / 0.14 | 33.56 / 0.01 | 34.49 / 0.10 |  36.26 / 0.06 | – / –
SIDD | 25.65 / 0.00 |  | 26.89 / 0.02 | 26.51 / 0.03 | 27.20 / 0.70 | 27.08 / 0.28 |  33.44 / 0.02 |  33.50 / 0.03

###  4.3 Robustness Benefits Generalization to Unseen Noise

It has been shown that denoisers that are normally trained on common synthetic
noise fail to remove real-world noise induced by standard imaging procedures
Xu et al. (2017); Abdelhamed et al. (2018). To train denoisers that can handle
real-world noise, researchers have proposed several methods which can be
roughly divided into two categories, namely dataset-based denoising methods
and single-image-based denoising methods. High-performance dataset-based
methods require a set of real noisy data for training, e.g., CBDNet requiring
pairs of clean and noisy images Guo et al. (2019) and Noise2Noise requiring
multiple noisy observations of every single image Lehtinen et al. (2018).
However, a large number of paired data are not available in some applications,
such as medical radiology and high-speed photography. To address this, single-
image-based methods are proposed to remove noise by exploiting the correlation
between signals across pixels and the independence between noise. This
category of methods, such as DIP Ulyanov et al. (2018) and N2S Batson and
Royer (2019), are adapted to various types of signal-independent noise, but
they optimize the deep denoiser on each test image. The test-time optimization
is extremely time-consuming, e.g., N2S needs to update a denoiser for
thousands of iterations to achieve good reconstruction performance.

Here, we point out that HAT is a promising framework to train a generalizable
deep denoiser only with synthetic noise. The resultant denoiser can be
directly applied to perform denoising for unseen noisy images in real-time.
During training, HAT first samples noise from common distributions (Gaussian)
with noise levels from low to high. ObsAtk then explores the
$\rho$-neighborhood for each noisy image to search for a particular type of
noise that degrades the denoiser the most. By ensuring the denoising
performance of the worst-case noise, the resultant denoiser can deal with
other unknown types of noise within the $\rho$-neighborhood as well. To train
a robust denoiser that generalizes well to real-world noise, we need to choose
a proper adversarial budget $\rho$. When $\rho$ is very small and close to
zero, the HAT reduces to normal training. When $\rho$ is very much larger than
the norm of basic noise ${\mathbf{v}}$, the adversarially noisy image may be
visually unnatural because the adversarial perturbation $\bm{\delta}$ only
satisfies the zero-mean constraint and is not guaranteed to be spatially
uniformly distributed as other types of natural noise being. In practice, we
set the value of $\rho$ of ObsAtk to be $\nicefrac{{5}}{{255}}\cdot\sqrt{m}$,
where $m$ denotes the size of image patches. The value of $\alpha$ of HAT is
kept unchanged as $2$.

#### Experimental Settings

We evaluate the generalization capability of HAT on several real-world noisy
datasets, including PolyU Xu et al. (2018), CC Xu et al. (2017), and SIDD
Abdelhamed et al. (2018). PolyU, CC, and SIDD contain RGB images of common
scenes in daily life. These images are captured by different brands of digital
cameras and smartphones, and they contain various levels of noise by adjusting
the ISO values. For the PolyU and CC, we use the clean images in BSD500 for
training an adversarially robust $\epsilon$-denoiser with
$\epsilon=\nicefrac{{25}}{{255}}$. We sample Gaussian noise from a set of
distributions $\mathcal{Q}^{\epsilon}_{\mathcal{N}}$ and add the noise to
clean images to craft noisy observations. HAT trains the denoiser jointly with
Gaussian noisy images and their adversarial versions. For the SIDD, we use
clean images in the SIDD-small set for training and test the denoisers on the
SIDD-val set. The highest level of noise used for HAT is set to be
$\epsilon=\nicefrac{{50}}{{255}}$. In each case, we only use clean images for
training denoisers without the need of real noisy images

#### Results

We compare HAT-trained denoisers with the NT and vAT-trained ones. From Table
4, we observe that HAT performs much better than both competitors. For
example, on the SIDD-val dataset, the HAT-trained denoiser achieves an average
PSNR value of 33.44 dB that is 6.24 dB higher than the NT-trained one. We also
compare HAT-trained denoisers with single-image-based methods, including DIP,
N2S, and the classical BM3D Dabov et al. (2007). For DIP and N2S,111The
officially released codes of DIP and N2S are used here.  the numbers of
iterations for each image are set to be 2,000 and 1,000, respectively. N2S
works in two modes, namely single-image-based denoising and dataset-based
denoising. Here, we use N2S in the single-image-based mode, denoted as N2S(1),
due to the assumption that no real noisy data are available for training. We
observe that HAT-trained denoisers consistently outperform these baselines.
Visual comparisons are provided in Appendix D. Besides, since the SIDD-small
provides a set of real noisy and ground-truth pairs, we train a denoiser,
denoted as Noise2Clean (N2C), with these paired data and use the N2C denoiser
as the oracle for comparison. We observe that HAT-trained denoisers are
comparable to the N2C one for denoising images in SIDD-val (a PSNR of 33.44dB
vs 33.50dB).

##  5 Conclusion

Normally-trained deep denoisers are vulnerable to adversarial attacks. HAT can
effectively robustify deep denoisers and boost their generalization capability
to unseen real-world noise. In the future, we will extend the adversarial-
training framework to other image restoration tasks, such as deblurring. We
aim to develop a generic AT-based robust optimization framework to train deep
models that can recover clean images from unseen types of degradation.

##  6 Acknowledgments

HY and VYFT are funded by a Singapore National Research Foundation (NRF)
Fellowship (R-263-000-D02-281).
JZ was supported by JST ACT-X Grant Number JPMJAX21AF.
MS was supported by JST CREST Grant Number JPMJCR18A2.

## References

  * Abdelhamed et al. [2018] Abdelrahman Abdelhamed, Stephen Lin, and Michael S. Brown.  A High-Quality Denoising Dataset for Smartphone Cameras.  In CVPR, 2018.
  * Anwar and Barnes [2019] Saeed Anwar and Nick Barnes.  Real Image Denoising with Feature Attention.  In ICCV, 2019.
  * Batson and Royer [2019] Joshua Batson and Loic Royer.  Noise2Self: Blind Denoising by Self-Supervision.  In ICML, 2019.
  * Boyd et al. [2004] Stephen Boyd, Stephen P Boyd, and Lieven Vandenberghe.  Convex optimization.  Cambridge university press, 2004.
  * Carlini and Wagner [2017] Nicholas Carlini and David Wagner.  Towards Evaluating the Robustness of Neural Networks.  In IEEE Symposium on Security and Privacy (SP), 2017.
  * Choi et al. [2019] Jun-Ho Choi, Huan Zhang, Jun-Hyuk Kim, Cho-Jui Hsieh, and Jong-Seok Lee.  Evaluating Robustness of Deep Image Super-Resolution against Adversarial Attacks.  In ICCV, 2019.
  * Choi et al. [2021] Jun-Ho Choi, Huan Zhang, Jun-Hyuk Kim, Cho-Jui Hsieh, and Jong-Seok Lee.  Deep Image Destruction: A Comprehensive Study on Vulnerability of Deep Image-to-Image Models against Adversarial Attacks.  arXiv:2104.15022 [cs, eess], 2021.
  * Dabov et al. [2007] Kostadin Dabov, Alessandro Foi, Vladimir Katkovnik, and Karen Egiazarian.  Image Denoising by Sparse 3-D Transform-Domain Collaborative Filtering.  IEEE TIP, 16, 2007.
  * Gao et al. [2019] Ruiqi Gao, Tianle Cai, Haochuan Li, Cho-Jui Hsieh, Liwei Wang, and Jason D. Lee.  Convergence of Adversarial Training in Overparametrized Neural Networks.  In NeurIPS, 2019.
  * Gondara [2016] Lovedeep Gondara.  Medical image denoising using convolutional denoising autoencoders.  In ICDMW, 2016.
  * Goodfellow et al. [2015] Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy.  Explaining and Harnessing Adversarial Examples.  arXiv:1412.6572 [cs, stat], 2015.
  * Guo et al. [2019] Shi Guo, Zifei Yan, Kai Zhang, Wangmeng Zuo, and Lei Zhang.  Toward Convolutional Blind Denoising of Real Photographs.  In CVPR, 2019.
  * Kurakin et al. [2017] Alexey Kurakin, Ian Goodfellow, and Samy Bengio.  Adversarial examples in the physical world.  arXiv:1607.02533 [cs, stat], 2017.
  * Lehtinen et al. [2018] Jaakko Lehtinen, Jacob Munkberg, Jon Hasselgren, Samuli Laine, Tero Karras, Miika Aittala, and Timo Aila.  Noise2Noise: Learning Image Restoration without Clean Data.  In ICML, 2018.
  * Madry et al. [2018] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu.  Towards Deep Learning Models Resistant to Adversarial Attacks.  In ICLR, 2018.
  * Shafahi et al. [2019] Ali Shafahi, Mahyar Najibi, Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S. Davis, Gavin Taylor, and Tom Goldstein.  Adversarial Training for Free!  In NeurIPS, 2019.
  * Szegedy et al. [2014] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus.  Intriguing properties of neural networks.  In ICLR, 2014.
  * Tramer et al. [2020] Florian Tramer, Nicholas Carlini, Wieland Brendel, and Aleksander Madry.  On Adaptive Attacks to Adversarial Example Defenses.  arXiv:2002.08347 [cs, stat], 2020.
  * Ulyanov et al. [2018] Dmitry Ulyanov, Andrea Vedaldi, and Victor Lempitsky.  Deep Image Prior.  In CVPR, 2018.
  * Xu et al. [2017] Jun Xu, Lei Zhang, David Zhang, and Xiangchu Feng.  Multi-channel Weighted Nuclear Norm Minimization for Real Color Image Denoising.  In ICCV, 2017.
  * Xu et al. [2018] Jun Xu, Hui Li, Zhetong Liang, David Zhang, and Lei Zhang.  Real-world Noisy Image Denoising: A New Benchmark.  arXiv:1804.02603 [cs], 2018.
  * Yan et al. [2019] Hanshu Yan, Jiawei Du, Vincent Tan, and Jiashi Feng.  On Robustness of Neural Ordinary Differential Equations.  In ICLR, 2019.
  * Yan et al. [2021] Hanshu Yan, Jingfeng Zhang, Gang Niu, Jiashi Feng, Vincent Tan, and Masashi Sugiyama.  CIFS: Improving Adversarial Robustness of CNNs via Channel-wise Importance-based Feature Selection.  In ICML, 2021.
  * Zhang et al. [2017] Kai Zhang, Wangmeng Zuo, Yunjin Chen, Deyu Meng, and Lei Zhang.  Beyond a Gaussian Denoiser: Residual Learning of Deep CNN for Image Denoising.  IEEE TIP, 2017.
  * Zhang et al. [2018] Kai Zhang, Wangmeng Zuo, and Lei Zhang.  FFDNet: Toward a Fast and Flexible Solution for CNN based Image Denoising.  IEEE TIP, 2018.
  * Zhang et al. [2019a] Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P. Xing, Laurent El Ghaoui, and Michael I. Jordan.  Theoretically Principled Trade-off between Robustness and Accuracy.  In ICML, 2019.
  * Zhang et al. [2019b] Yide Zhang, Yinhao Zhu, Evan Nichols, Qingfei Wang, Siyuan Zhang, Cody Smith, and Scott Howard.  A Poisson_gaussian Denoising Dataset with Real Fluorescence Microscopy Images.  In CVPR, 2019.
  * Zhang et al. [2020a] Jingfeng Zhang, Xilie Xu, Bo Han, Gang Niu, Lizhen Cui, Masashi Sugiyama, and Mohan Kankanhalli.  Attacks Which Do Not Kill Training Make Adversarial Learning Stronger.  In ICML, 2020.
  * Zhang et al. [2020b] Jingfeng Zhang, Jianing Zhu, Gang Niu, Bo Han, Masashi Sugiyama, and Mohan Kankanhalli.  Geometry-aware Instance-reweighted Adversarial Training.  In ICLR, 2020.

Appendices

##  Appendix A Two-step Projection

###### Theorem 1

For any arbitrary vector $\bm{\delta}\in{\mathbb{R}}^{m}$, its projection onto
the region defined by the intersection of the norm-bounded and zero-mean
constraints is equivalent to the projection first onto the zero-mean
hyperplane followed by the projection onto the $\rho$-ball ($\rho>0$), i.e.,

$\text{Proj}_{A\cap
B}(\bm{\delta})=\text{Proj}_{B}(\text{Proj}_{A}(\bm{\delta})),$ (6)

where

$\displaystyle A$
$\displaystyle=\big{\\{}{\mathbf{z}}\in{\mathbb{R}}^{m}\,\big{|}\,{\mathbf{n}}^{\top}{\mathbf{z}}=0\big{\\}},$
(7a) $\displaystyle B$
$\displaystyle=\big{\\{}{\mathbf{z}}\in{\mathbb{R}}^{m}\,\big{|}\,\|{\mathbf{z}}\|_{2}^{2}\leq\rho^{2}\big{\\}},$
(7b)

and ${\mathbf{n}}=[1,1,\ldots,1]^{\top}$.

Figure A.1: Illustration of Theorem 1. In the case of
$\|\text{Proj}_{A}(\bm{\delta})\|>\rho$, the red-dot lines show that the
perturbation $\bm{\delta}$ is projected onto the region defined by the zero-
mean and $\rho$-ball constraints sequentially. The blue-dot line shows the
exact projection of $\bm{\delta}$ on to $A\cap B$.

#### Proof

Let us consider the RHS of Eq. (6) first. It is easy to derive the projections
onto $A$ and $B$ seperately:

$\displaystyle\text{Proj}_{A}(\bm{\delta})$
$\displaystyle=\bm{\delta}-\frac{{\mathbf{n}}^{\top}\bm{\delta}}{\|{{\mathbf{n}}}\|^{2}_{2}}{{\mathbf{n}}},$
(8a) $\displaystyle\text{Proj}_{B}(\bm{\delta})$
$\displaystyle=\min\Big{(}\frac{\rho}{\|\bm{\delta}\|_{2}},1\Big{)}\text{~{}}\bm{\delta}.$
(8b)

Thus, we have

$\text{Proj}_{B}(\text{Proj}_{A}(\bm{\delta}))=\begin{cases}\text{Proj}_{A}(\bm{\delta}),&\text{if
$\|\text{Proj}_{A}(\bm{\delta})\|\leq\rho$};\\\
\frac{\rho}{\|\text{Proj}_{A}(\bm{\delta})\|_{2}}\text{Proj}_{A}(\bm{\delta}),&\text{if
$\|\text{Proj}_{A}(\bm{\delta})\|>\rho$.}\end{cases}$ (9)

Now let us consider the LHS of Eq. (6). The projection onto $A\cap B$ can be
formulated as the solution of the following convex optimization problem:

$\min_{{\mathbf{z}}}\frac{1}{2}\|\bm{\delta}-{\mathbf{z}}\|^{2}_{2},\quad\text{s.t.}\quad{\mathbf{n}}^{\top}{\mathbf{z}}=0,\quad\|{\mathbf{z}}\|^{2}_{2}\leq\rho^{2},$
(10)

where ${\mathbf{z}}\in{\mathbb{R}}^{m}$. We can write the Lagrangian,
$L:{\mathbb{R}}^{m}\times{\mathbb{R}}\times{\mathbb{R}}\to{\mathbb{R}}$,
associated with the problem (10) as

$L({\mathbf{z}},\lambda,\nu)=\frac{1}{2}\|\bm{\delta}-{\mathbf{z}}\|^{2}_{2}+\lambda(\|{\mathbf{z}}^{*}\|^{2}_{2}-\rho^{2})+\nu{\mathbf{n}}^{\top}{\mathbf{z}}.$
(11)

Since there exists an ${\mathbf{z}}\in{\mathbb{R}}^{m}$, e.g.,
${\mathbf{z}}=[0,\ldots,0]^{\top}\in{\mathbb{R}}^{m}$, such that
${\mathbf{n}}^{\top}{\mathbf{z}}=0$ and $\|{\mathbf{z}}\|^{2}_{2}<\rho^{2}$,
the problem (10) is strictly feasible, i.e., it satisfies the Slater’s
condition Boyd et al. [2004]. Besides, the objective and the constraints are
all differentiable, thus the KKT conditions in Eq. (12) provide necessary and
sufficient conditions for optimality.

$\displaystyle\|{\mathbf{z}}^{*}\|^{2}_{2}-\rho^{2}\leq 0,$ (12a)
$\displaystyle{\mathbf{n}}^{\top}{\textnormal{z}}^{*}=0,$ (12b)
$\displaystyle\lambda\geq 0,$ (12c)
$\displaystyle\lambda(\|{\mathbf{z}}^{*}\|^{2}_{2}-\rho^{2})=0,$ (12d)
$\displaystyle\frac{\partial
L}{\partial{\mathbf{z}}}=(1+2\lambda){\mathbf{z}}^{*}-\bm{\delta}+\nu{\mathbf{n}}=0.$
(12e)

We obtain the optimal solution by considering the following two cases
separately, i.e., $\|\text{Proj}_{A}(\bm{\delta})\|\leq\rho$ and
$\|\text{Proj}_{A}(\bm{\delta})\|>\rho$.

Case-(1): $\|\text{Proj}_{A}(\bm{\delta})\|>\rho$.
If $\lambda>0$, then Eq. (12) reduces to the following equation:

$\displaystyle{\mathbf{n}}^{\top}{\textnormal{z}}^{*}=0,$ (13a)
$\displaystyle\|{\mathbf{z}}^{*}\|^{2}_{2}-\rho^{2}=0,$ (13b)
$\displaystyle(1+2\lambda){\mathbf{z}}^{*}-\bm{\delta}+\nu{\mathbf{n}}=0.$
(13c)

We can easily solve these equations and obtain that

$\displaystyle(1+2\lambda)$ $\displaystyle=\text{Proj}_{A}(\bm{\delta})/\rho,$
(14a) $\displaystyle\nu$ $\displaystyle={\mathbf{n}}^{\top}\bm{\delta}/m,$
(14b) $\displaystyle{\mathbf{z}}^{*}$
$\displaystyle=\frac{\rho}{\|\text{Proj}_{A}(\bm{\delta})\|_{2}}\text{Proj}_{A}(\bm{\delta}).$
(14c)

If $\lambda=0$, then Eq. (12) reduces to the following set of equations:

$\displaystyle\|{\mathbf{z}}^{*}\|^{2}_{2}-\rho^{2}$ $\displaystyle\leq 0,$
(15a) $\displaystyle{\mathbf{n}}^{\top}{\textnormal{z}}^{*}$ $\displaystyle=0$
(15b) $\displaystyle{\mathbf{z}}^{*}-\bm{\delta}+\nu{\mathbf{n}}$
$\displaystyle=0.$ (15c)

According to (15b) and (15c), we obtain that
${\mathbf{z}}^{*}=\bm{\delta}-\frac{{\mathbf{n}}^{\top}\bm{\delta}}{m}{\mathbf{n}}=\text{Proj}_{A}(\bm{\delta})$
with a norm strictly larger than $\rho$, which contradicts the constraint
$\|{\mathbf{z}}^{*}\|^{2}_{2}\leq\rho^{2}$. Thus, for the case of
$\|\text{Proj}_{A}(\bm{\delta})\|>\rho$, we have that
${\mathbf{z}}^{*}=\frac{\rho}{\|\text{Proj}_{A}(\bm{\delta})\|_{2}}\text{Proj}_{A}(\bm{\delta})$
which is equal to $\text{Proj}_{B}(\text{Proj}_{A}(\bm{\delta}))$ in Eq. (9).

Case-(2): $\|\text{Proj}_{A}(\bm{\delta})\|\leq\rho$.
Since $\|\text{Proj}_{A}(\bm{\delta})\|\leq\rho$ and
$\|\text{Proj}_{A}(\bm{\delta})\|\in A$, we have
$\text{Proj}_{A}(\bm{\delta})\in A\cap B$. For any other point
${\mathbf{z}}^{\prime}\in A\cap B$ and
${\mathbf{z}}^{\prime}\neq\text{Proj}_{A}(\bm{\delta})$, we have
$\|\bm{\delta}-{\mathbf{z}}^{\prime}\|>\|\bm{\delta}-\text{Proj}_{A}(\bm{\delta})\|$,
where the strict inequality holds because $A$ is the set of points from a
hyperplane. Thus, ${\mathbf{z}}^{\prime}$ is not the $\text{Proj}_{A\cap
B}(\bm{\delta})$. Therefore, $\text{Proj}_{A\cap
B}(\bm{\delta})=\text{Proj}_{A}(\bm{\delta})=\text{Proj}_{B}(\text{Proj}_{A}(\bm{\delta}))$.

In summary, we show that $\text{Proj}_{A\cap
B}(\bm{\delta})=\text{Proj}_{B}(\text{Proj}_{A}(\bm{\delta}))$ for any
arbitrary $\bm{\delta}\in{\mathbb{R}}^{m}$.

##  Appendix B Experiments of Robustness Enhancement on Set12 and Kodak24

We compare the robustness of deep denoisers trained via three strategies,
i.e., NT, vAT and HAT. The results on Set 12 and Kodak24 are provided in Table
B.1 and Table B.2 respectively. We observe that HAT can effectively robustify
deep denoisers. The reconstruction quality of HAT-trained denoisers from
adversarially noisy images is clearly better than that of the NT and vAT-
trained ones.

Table B.1: The average PSNR (in dB) results of DnCNN-B denoisers on the gray-
scale Set12 dataset.

Training | $\hat{\epsilon}$ | $\mathcal{N}$ | Atk-$\nicefrac{{3}}{{255}}$ | Atk-$\nicefrac{{5}}{{255}}$ | Atk-$\nicefrac{{7}}{{255}}$
---|---|---|---|---|---
NT | $\nicefrac{{25}}{{255}}$ |  30.39/0.01 | 26.51/0.14 | 24.32/0.18 | 22.96/0.13
$\nicefrac{{15}}{{255}}$ |  32.78/0.00 | 28.50/0.08 | 26.91/0.05 | 26.25/0.01
vAT | $\nicefrac{{25}}{{255}}$ | 30.25/0.08 | 27.56/0.06 | 25.82/0.04 | 24.33/0.04
$\nicefrac{{15}}{{255}}$ | 32.63/0.09 | 29.37/0.17 | 27.83/0.15 | 26.91/0.08
HAT | $\nicefrac{{25}}{{255}}$ | 30.01/0.06 |  27.96/0.15 |  26.46/0.20 |  25.13/0.19
$\nicefrac{{15}}{{255}}$ | 32.47/0.04 |  29.95/0.03 |  28.45/0.04 |  27.20/0.03

Table B.2: The average PSNR (in dB) results of DnCNN-C denoisers on the RGB
Kodak24 dataset.

Training | $\hat{\epsilon}$ | $\mathcal{N}$ | Atk-$\nicefrac{{3}}{{255}}$ | Atk-$\nicefrac{{5}}{{255}}$ | Atk-$\nicefrac{{7}}{{255}}$
---|---|---|---|---|---
NT | $\nicefrac{{25}}{{255}}$ |  32.20/0.13 | 29.57/0.09 | 27.87/0.08 | 26.37/0.07
$\nicefrac{{15}}{{255}}$ |  34.77/0.13 | 31.54/0.11 | 29.55/0.07 | 28.00/0.04
vAT | $\nicefrac{{25}}{{255}}$ | 31.44/0.01 | 29.41/0.05 | 28.13/0.06 | 26.98/0.02
$\nicefrac{{15}}{{255}}$ | 34.14/0.08 | 31.53/0.11 | 30.06/0.08 | 28.78/0.06
HAT | $\nicefrac{{25}}{{255}}$ | 31.83/0.04 |  29.85/0.02 |  28.56/0.02 |  27.34/0.05
$\nicefrac{{15}}{{255}}$ | 34.36/0.06 |  31.84/0.05 |  30.37/0.02 |  29.05/0.01

##  Appendix C Ablation study

###  C.1 Effect of $\alpha$ on Robustness Enhancement and Generalization to
Real-world noise

Here, we evaluate the effect of $\alpha$ in HAT on the adversarial robustness
and the generalization capability to real-world noise. We train deep denoisers
on the RGB BSD500 (except 68 images for test) dataset. The obtained denoisers
are tested on the BSD68 dataset for Gaussian and adversarial noise removal.
The generalization capability is evaluated on two datasets of real-world noisy
images, i.e., PolyU and CC. Experimental settings follow those in Section 4.2.

Figure C.1 corroborates the analysis in Section 4.1 that the coefficient
$\alpha$ balances the trade-off between reconstruction from common noise and
the adversarial robustness. We also find that the generalization capability to
real-world noise is correlated to the adversarial robustness. Specifically,
good adversarial robustness usually implies good generalization to real-world
noise. In Figure C.1, the best robustness and the best performance on real-
world noise appear around $\alpha=1$ or $2$. When $\alpha$ is too large or too
small, the robustness and generalization worsen. For the noise sampled from
Gaussian distributions, increasing $\alpha$ degrades the denoising
performance. In summary, we set $\alpha$ to $1$ or $2$ to achieve a good
balance between the denoising performance on common noise and the adversarial
robustness as well as real-world generalization.

Figure C.1: Ablation study on the effect of $\alpha$ in HAT. Green lines show
the denoising results on non-adversarial noise sampled from common
distributions. The legend $\hat{\epsilon}$-w-$\mathcal{N}$ denotes the
Gaussian noise ($\sigma=\nicefrac{{w}}{{255}}$) with a energy-density bounded
by $\hat{\epsilon}^{2}=\nicefrac{{w^{2}}}{{255^{2}}}$. Blue lines show that
denoising results on adversarially perturbed noisy images.
$\hat{\epsilon}$-w-ObsAtk-5 denotes the adversarial noise crafted by ObsAtk-5
with a energy-density bounded by $\hat{\epsilon}^{2}$. Red lines show the
denoising results on real-world noisy images.

###  C.2 Effect of $\rho$ on Generalization to Real-world Noise

Here, we evaluate the effect of $\rho$ used in HAT on the generalization
capability to real-world noise. We train deep denoisers on the RGB BSD500
(except 68 images for test) dataset and evaluate the generalization capability
on two real-world datasets, namely PolyU and CC. The $\alpha$ is set to be
$2$. The adversarial budget $\rho$ of ObsAtk-$\nicefrac{{\rho}}{{\sqrt{m}}}$,
that generates adversarially noisy images for HAT, is set to be values from
$[0,\sqrt{m},3\sqrt{m},\ldots,11\sqrt{m}]$ for comparison, where $m$ denotes
the size of images. Other experimental settings follow those in Section 4.2.

Figure C.2 corroborates the analysis in Section 4.3. When $\rho$ is very small
and close to zero, the HAT reduces to normal training. The resultant denoisers
cannot effectively remove real-world noise. When $\rho$ is very much larger
than the norm of basic noise ${\mathbf{v}}$, the statistics of adversarial
noise may be very unnatural because the adversarial perturbation $\bm{\delta}$
might concentrate on a certain region, like edges or texture, and not be
spatially uniformly distributed as other types of natural noise being. We can
see that, when $\rho>\nicefrac{{7}}{{255}}\sqrt{m}$, the denoising performance
on real-world datasets starts to decrease. In practice, we set the value of
$\rho$ of ObsAtk to be $\nicefrac{{5}}{{255}}\cdot\sqrt{m}$ to train
generalizable denoisers.

Figure C.2: Ablation study on the effect of $\rho$ in HAT.

##  Appendix D Visual results of real-world noise removal

We show the denoising results on SIDD-val set in Figure D.1. We observe that
HAT-trained denoiser can effectively remove the real-world noise while the
normally-trained one retains much noise in the reconstructions. Besides, the
HAT-trained denoiser outperforms other baseline methods and produces much
cleaner results.

(a) Noisy

(b) BM3D

(c) DIP

(d) N2S

(e) NT

(f) vAT

(g) HAT

(h) Ground-truth

Figure D.1:  Comparison of different denoisers for denoising SIDD-val set.
From left to right are the input noisy image, reconstructions of different
denoisers including BM3D, DIP, N2S, NT-trained DnCNN, vAT-trained DnCNN, and
HAT-trained DnCNN. We can see that the HAT-trained denoiser performs the best
in comparison to other baseline methods.


# Tracking quantum state evolution by the Berry curvature with a two-level
system

Ze-Lin Zhang  Fujian Key Laboratory of Quantum Information and Quantum Optics,
College of Physics and Information Engineering, Fuzhou University, Fuzhou
350116, China  School of Astronomy and Space Science, Nanjing University,
Nanjing 210093, China  Ping Xu  Fujian Key Laboratory of Quantum Information
and Quantum Optics, College of Physics and Information Engineering, Fuzhou
University, Fuzhou 350116, China  Zhen-Biao Yang  E-mail address:
<EMAIL_ADDRESS>Fujian Key Laboratory of Quantum Information and Quantum
Optics, College of Physics and Information Engineering, Fuzhou University,
Fuzhou 350116, China

###### Abstract

We investigate two kinds of topological structures $($sphere and torus$)$
spanned by the controlled parameters of a driven two-level system’s
Hamiltonian, and consider the connection between the structures and the
system’s dynamics. We discuss the Berry curvature obtained through the
dynamical response method, show the certain physical and observable manifolds
including the gapped region probed by integrating the Berry curvature, and
demonstrate the system’s state evolution can be tracked and manipulated by
extracting the Berry curvature.

##  I Introduction

The concept of geometric phase, especially the Berry phase, plays a pivotal
role in broadening our understanding of fundamental significance of geometry
in physics Berry-1984 . It stems from manipulating the geometrical structure
formed of the system’s parameter space, which drives the adiabatic cyclic
evolution of nondegenerate quantum eigenstates. The topological structure of a
certain closed manifold formed by the Hamiltonian parameter space can be
captured by the distribution of the Berry curvature. In general, the geometric
structure of the parameter space $($i.e., a spin-1/2 particle in a magnetic
field$)$ and the space of states in Hilbert space $\mathbb{C}^{2}$ $($i.e.,
the Bloch sphere$)$ are sphere structures. It is an alternative to build a
torus manifold formed in the parameter space of the Hamiltonian of a driven
two-level system. We show how the manifold can be controlled by adjusting the
drive. We extract the Berry curvature using the dynamically non-adiabatic
response method Gritsev-2012  $($different from the conventional Berry
curvature Hasan-2010 , as described in Appendix A$)$ and attach it to the
system’s evolution characterized by certain quantum state fidelity, showing
the tight connection between them.

As the physical meaning of the singularity can be considered as the Abelian
$($non-Abelian case is not considered here Sugawa-2018 $)$ monopole in
parameter space, the Berry curvature can be viewed as the magnitude of
magnetic field emerging from it. Such a Berry curvature can be viewed as an
intuitive geometric monitor between the Hamiltonian parameter space and the
Hilbert space, and it can be directly measured Flaschner-2016 . The tight link
between the parametric manifold and the system’s state evolution helps to
explore the dynamics of the system from a geometric point of view. It makes
sense to track the evolution of quantum states by redesigning the geometrical
quantities$-$such as the observable Berry curvature.

The configuration of this paper proceeds as follows. In Sec. II, we introduce
the concepts of the Berry curvature and the first Chern number
$($$\mathds{C}_{1}$, topological invariant$)$ associated with their physical
meaning in quantum theory. We then introduce the dynamical response method for
characterizing them. In Sec. III, we compare two different manifolds, sphere
and torus, which are parameterized by the system’s Hamiltonian. Based on this
point, we show the difference between the conventional Berry curvature and the
dynamical Berry curvature $($obtained by dynamical method, Berry curvature
should be used unless otherwise specified$)$ associated with their first Chern
number in the torus case. It is worth mentioning that the first Chern number
$($an artifact of approximating the curvature with the dynamical response
method$)$ which we calculated in our work is different to the mathematically
defined first Chern number. To highlight the physical and geometric meaning of
the Berry curvature, we compare it with the Gaussian curvature $($only have
geometric meaning$)$. A simple geometric transformation from sphere to torus
is also shown. To test the robustness of the quantum state evolution, we show
the dynamics of the system decaying to the reservoir. In Sec. IV, we discuss
the correlations between the Berry curvature and the quantum states during the
deformation process of the manifolds. We also describe the experimental
feasibility of this theoretical method. Summary and prospects are presented in
Sec. V.

##  II Topology in the specific state manifold

We first introduce the Berry curvature in a fundamentally mathematical
background. Let us consider a set of parameters
$\textbf{{R}}=(\textit{R}^{\mu},\textit{R}^{\nu},\cdots)\in\mathcal{M}$, where
$\mathcal{M}$ denotes the Hamiltonian parameters base manifold and acts over
the Hilbert space. Vector appears bold in the full text. The Berry curvature
$\textit{B}_{\mu\nu}$ has a direct connection to quantum geometric tensor
$\textit{Q}_{\mu\nu}$ introduced to depict the manifolds of adiabatically
connected wave functions $|\psi(\textbf{{R}})\rangle$ $($for simplicity, we
use $|\psi\rangle$ instead of it$)$ Provost-1980 :

$\displaystyle\textit{Q}_{\mu\nu}=\langle\partial_{\mu}\psi|\partial_{\nu}\psi\rangle-\langle\partial_{\mu}\psi|\psi\rangle\langle\psi|\partial_{\nu}\psi\rangle$
(1)

with $\partial_{\mu(\nu)}\equiv{\partial}/{\partial\textit{R}^{\mu(\nu)}}$.
The Berry curvature is given by the antisymmetric imaginary part of the
quantum geometric tensor:

$\displaystyle\textit{B}_{\mu\nu}=-2\textrm{Im}[\textit{Q}_{\mu\nu}]=\partial_{\mu}\textit{A}_{\nu}-\partial_{\nu}\textit{A}_{\mu},$
(2)

where $\textit{A}_{\mu(\nu)}=i\langle\psi|\partial_{\mu(\nu)}|\psi\rangle$ is
the Berry connection Simon-1983 .

In analogy to classical electrodynamics, the local gauge-dependent Berry
connection $\textit{A}_{\mu(\nu)}$ could not be physically observed, while the
gauge-invariant $\textit{B}_{\mu\nu}$ may be related to a physical observable
that reflects the local geometry property of the eigenstates in the parameter
space. For a general two-level system, there only have two eigenstates
$|{e}\rangle$ and $|{g}\rangle$ of the Hamiltonian $\hat{\textit{H}}$, with
the corresponding higher energy $\textit{E}_{e}$ and lower energy
$\textit{E}_{g}$, in describing the Berry curvature

$\displaystyle\textit{B}_{\mu\nu}^{N}=-\textrm{Im}\frac{\langle
g|\partial_{\mu}\hat{\textit{H}}|e\rangle\langle
e|\partial_{\nu}\hat{\textit{H}}|g\rangle-\langle
g|\partial_{\nu}\hat{\textit{H}}|e\rangle\langle
e|\partial_{\mu}\hat{\textit{H}}|g\rangle}{(\textit{E}_{e}-\textit{E}_{g})^{2}}$
(3)

and

$\displaystyle\textit{B}_{\mu\nu}^{S}=-\textrm{Im}\frac{\langle
e|\partial_{\mu}\hat{\textit{H}}|g\rangle\langle
g|\partial_{\nu}\hat{\textit{H}}|e\rangle-\langle
e|\partial_{\nu}\hat{\textit{H}}|g\rangle\langle
g|\partial_{\mu}\hat{\textit{H}}|e\rangle}{(\textit{E}_{g}-\textit{E}_{e})^{2}},$
(5)

where the quantum states $|{e}\rangle=(1,0)^{T}$ and $|{g}\rangle=(0,1)^{T}$
represent the excited state and the ground state of the two-level system,
respectively. Eqs. $($3$)$ and $($5$)$ indicate that degeneracies are some
singularities $($gapped regions$)$ that contribute nonzero terms to
topological invariants. Such as, the first Chern number $\mathds{C}_{1}$, a
topological invariant defined by

$\displaystyle\mathds{C}_{1}=\frac{1}{2\pi}\varoiint_{\textit{S}^{2}}\textbf{{B}}\cdot
d{\textbf{{S}}}=\frac{1}{4\pi}\varoiint_{\textit{S}^{2}}\textit{B}_{\mu\nu}d\textit{R}^{\mu}\wedge
d\textit{R}^{\nu},$ (7)

where B is the Abelian field strength $($the vector form of the Berry
curvature $\textit{B}_{\mu\nu}$$)$ over a closed two-dimensional manifold
$\textrm{S}^{2}$, where S is a vector normal to the surface. When the manifold
is not closed, the surface integral turns into the Berry phase:
$\phi_{B}=\iint_{\textrm{S}^{2}}{\textbf{{B}}}\cdot d{\textbf{{S}}}$. In the
circumstances, the first Chern number $\mathds{C}_{1}=\pm 1$, which can be
viewed as the Abelian monopoles, sources $\rho_{N}$ $($$\mathds{C}_{1}=+1$$)$
and sinks $\rho_{S}$ $($$\mathds{C}_{1}=-1$$)$, in the parameter space
Zhang1-2017 ; Zhang2-2017 .

Ref. Schroer-2014  states that the Berry curvature can be extracted from the
linear response of the driven two-level system to non-adiabatic manipulations
$($deviations from adiabaticity$)$ of its Hamiltonian $\hat{\textit{H}}$
$($$\mu=\theta$, $\nu=\phi$$)$ which leads to the generalized force
$\textit{F}_{\phi}=-\langle\psi(t)|\partial_{\phi}\hat{\textit{H}}|\psi(t)\rangle$.
In an Abelian system, the force along the $\phi$-direction reads

$\displaystyle\textit{F}_{\phi}=\textrm{const}+\theta_{t}\cdot\textit{B}_{\theta\phi}+\mathcal{O}({\theta_{t}}^{2}),$
(8)

which results from a parameter $\theta$ ramping with velocity $\theta_{t}$,
and $\textit{B}_{\theta\phi}$ is a component of the tensor
$\textit{B}_{\mu\nu}$. To neglect the nonlinear term
$\mathcal{O}({\theta_{t}}^{2})$, the system’s parameters should be ramped
slowly enough. The focus of interest here is the second term
$\theta_{t}\cdot\textit{B}_{\theta\phi}$, which is the desired first-order
reaction force $($analogous to the Lorentz force$)$ Berry-1993 . It is worth
mentioning that, different from the conventional Berry curvature $($full
geometric meaning$)$ Hasan-2010 , the Berry curvature defined here is in
physics more intuitive and experimentally more accessible Roushan-2014 , as
described in Appendix A.

##  III From Sphere to Torus

Now, we assume a superconducting transmon qubit, which is effectively a
nonlinear resonator $($with a transition frequency of $\omega_{q}$ and the
reasonable anharmonicity, to ensure the transition only occurs between the
first energy level $\textit{E}_{g}$ and the second energy level
$\textit{E}_{e}$$)$, driven by a microwave drive. To investigate the Berry
curvature characterized by the Hamiltonian parameter space and its connection
to the evolution of the system’s state, we perform a comparative study of two
special kinds of manifolds, sphere and torus, in parameter space of the
system’s Hamiltonian, as shown in Fig. 1.

Figure 1: $($Color online$)$ $($a$)$ A schematic of a parameter sweep for
$\Delta_{2}=0$, see Eq. $(\ref{detuning})$. The sweep red line on the sphere
depicts $\theta$ ramping from 0 to $\pi$. $($b$)$ The transformed case with
$\Delta_{2}=2\Delta_{1}=2\Omega_{1}$. The sweep red line on the torus
$(\textrm{T}^{2})$ surface depicts $\theta$ ramping from 0 to $2\pi$. In this
case, the radius of the blue circle $\Delta_{1}=\Omega_{1}$ is the half length
of the orange circle’s radius $\Delta_{2}$. The blue points shown in $($a$)$
and $($b$)$ depict the degenerate singularities $($gapped regions$)$.

We first consider the sphere case. In the rotating frame of the microwave
drive with frequency $\omega_{m}$, and in the units with $\hbar=1$, the
Hamiltonian for the qubit can be written as

$\displaystyle\hat{\textit{H}}_{\textrm{sph}}=\frac{1}{2}\left(\begin{array}[]{cc}\Delta&\Omega{\textit{e}}^{-\textit{i}\phi}\\\
\Omega{\textit{e}}^{\textit{i}\phi}&-\Delta\\\ \end{array}\right),$ (11)

where the detuning is $\Delta=\omega_{m}-\omega_{q}$, and $\phi$ is the phase
of the drive. In principle, by changing the detuning $\Delta$ and the Rabi
frequency $\Omega$, we could get arbitrary closed Hamiltonian manifold of the
qubit. We set the detuning and the Rabi frequency to vary as

$\displaystyle\Delta=\Delta_{1}\cos\theta+\Delta_{2},~{}~{}~{}~{}\Omega=\Omega_{1}\sin\theta.$
(12)

The corresponding parametric equations of Eq. $($11$)$ is given by

$\displaystyle\\{\hat{\sigma}^{x}\\}_{\textrm{sph}}=\Omega_{1}\sin\theta\cos\phi,~{}~{}~{}~{}\\{\hat{\sigma}^{y}\\}_{\textrm{sph}}=\Omega_{1}\sin\theta\sin\phi,~{}~{}~{}~{}\\{\hat{\sigma}^{z}\\}_{\textrm{sph}}=\Delta_{1}\cos\theta+\Delta_{2},$
(13)

where $\\{\cdot\\}_{\textrm{sph}}$ represents the magnitude of vector
component projection onto different axes of the three dimensional space of
Hamiltonians generated by the Pauli matrices in the case of sphere, as shown
in 1$($a$)$. We notice that if we change the parameter $\Delta_{2}$, the whole
sphere will move up and down in the parameter space.

Figure 2: $($Color online$)$ $($a$)$ As the distance to the origin decreases,
a ring torus becomes a horn torus, then a spindle torus, and then degenerates
into a sphere, and finally recurs to a ring torus. $($b$)$ Curves on the torus
have different Gaussian curvatures, it could be greater than 0, equal to 0 and
less than 0. But the Berry curvature is different. It is affected by the types
of the quantum state manifolds: the ground state manifold for the sources
$\rho_{N}$ $($the green ball$)$ and the excited state manifold for the sinks
$\rho_{S}$ $($the red ball$)$. $($c$)$ Measuring Berry curvature in the two-
level system. The upper part describes the experimental pulse sequence.
Following an initial measurement to project into the ground state, the Rabi
frequency and the detuning are adjusted along a torus protocol, after which
quantum state tomography is performed. The middle part depicts the process of
such a tomography with parameters $\tau_{\textit{tor}}=1~{}\mu$s,
$\Delta_{1}/2\pi=\Omega_{1}/2\pi=1.735~{}$MHz, and $\Delta_{2}=0$. The lower
part represents the distribution of the Berry curvature during a complete
period.

Interestingly, if the locations of the Rabi frequency $\Omega$ and the
detuning $\Delta$ are exchanged in the Hamiltonian matrix, the original
manifold will transform into the torus parameter space. The Hamiltonian of the
system is then given by

$\displaystyle\hat{\textit{H}}_{\textrm{tor}}=\frac{1}{2}\left(\begin{array}[]{cc}\Omega&\Delta{\textit{e}}^{-\textit{i}\phi}\\\
\Delta{\textit{e}}^{\textit{i}\phi}&-\Omega\\\ \end{array}\right).$ (16)

The corresponding parametric equations of this Hamiltonian can be written
as111While this paper was in preparation, we became aware of the interesting
work published considering the similar Hamiltonian manifold transformation in
Ref. Mera-2019 .

$\displaystyle\\{\hat{\sigma}^{x}\\}_{\textrm{tor}}=(\Delta_{1}\cos\theta+\Delta_{2})\cos\phi,~{}~{}~{}~{}\\{\hat{\sigma}^{y}\\}_{\textrm{tor}}=(\Delta_{1}\cos\theta+\Delta_{2})\sin\phi,~{}~{}~{}~{}\\{\hat{\sigma}^{z}\\}_{\textrm{tor}}=\Omega_{1}\sin\theta,$
(17)

where $\\{\cdot\\}_{\textrm{tor}}$ has the same meaning in torus case. If the
parameter $\Delta_{2}$ $($the radius of the orange circle in Fig. 1$($b$)$$)$
is changed from $-2\Delta_{1}$ to $2\Delta_{1}$, the torus will first contract
and then expand around the degenerate point $($gapped region$)$ in the
parameter space. As the distance to the gapped region decreases, the ring
torus $(0<\theta<\pi/2)$ becomes a horn torus $(\theta=\pi/2)$, then
successively a spindle torus $(\pi/2<\theta<3\pi/2)$ and a sphere
$(\theta=\pi)$, and finally recurs to the ring torus $(3\pi/2<\theta<2\pi)$
again within one period, as shown in Fig. 2$($a$)$.

We now analyze the distinctions between the Gaussian curvature and the Berry
curvature in the Hamiltonian dynamics. Fig. 2$($b$)$ depicts the distribution
of the Berry curvature around the torus. In the sight of differential
geometry, according to Eqs. $($13$)$ and $($17$)$, the Gaussian curvatures of
the sphere $\textit{K}_{\textrm{sph}}$ and the torus
$\textit{K}_{\textrm{tor}}$ are separately given by Struik-1961

$\displaystyle\textit{K}_{\textrm{sph}}=\frac{1}{{\Omega_{1}^{2}}}$ (18)

and

$\displaystyle\textit{K}_{\textrm{tor}}=\frac{\cos\theta}{\Delta_{1}(\Delta_{2}+\Delta_{1}\cos\theta)},$
(19)

with the corresponding Gaussian area elements of the sphere and the torus
being separately written as

$\displaystyle d\sigma_{\textrm{sph}}=\Omega_{1}^{2}\sin\theta d\theta\wedge
d\phi$ (20)

and

$\displaystyle
d\sigma_{\textrm{tor}}={\Delta_{1}(\Delta_{2}+\Delta_{1}\cos\theta)}d\theta\wedge
d\phi,$ (21)

where $\Delta_{1}=\Omega_{1}$, and $\Delta_{2}$ varying from -4.27$\Delta_{1}$
to 4.27$\Delta_{1}$, which are depicted in Fig. 1$($b$)$. We thus then get the
Euler-Poincaré characteristic number
$\chi(\mathcal{M})=\frac{1}{2\pi}\int\textit{K}d\sigma$, as shown in Fig. 3.
As we mentioned above, the degenerate points emerging from the Berry curvature
$\textit{B}_{\mu\nu}$ act as sources and sinks of $\mathds{C}_{1}=\pm 1$ that
are analogous to Abelian monopoles in parameter space. In order to probe much
deeper into the properties of the Berry curvature, we turn to the degenerate
points at $\Delta=\Omega=0$ of the spherical coordinate around which these two
manifolds can be manipulated. From the second term of Eq. $($8$)$, the Berry
curvatures of the sphere and the torus parameter space are given by

$\displaystyle\textit{B}_{{\theta\phi}}^{\textrm{sph}}=\frac{\Omega_{1}\sin\theta}{2\theta_{t}^{\textrm{sph}}}\langle\hat{\sigma}^{y}\rangle$
(22)

and

$\displaystyle\textit{B}_{{\theta\phi}}^{\textrm{tor}}=\frac{\Delta_{1}\cos\theta+\Delta_{2}}{2\theta_{t}^{\textrm{tor}}}\langle\hat{\sigma}^{y}\rangle,$
(23)

respectively, where $\theta_{t}^{\textrm{sph}}=\pi/{\tau_{\textrm{sph}}}$ is
the quench velocity and ${\tau_{\textrm{sph}}}=1~{}\mu$s is the ramping time,
of quantum state tomography in the sphere case Schroer-2014 . For the torus
case, we set $\theta_{t}^{\textrm{tor}}=2\pi/{\tau_{\textrm{tor}}}$ and
$\tau_{\textrm{tor}}=1~{}\mu$s. The measurement period corresponds to $2\pi$
(before the ramping time ${\tau_{\textrm{tor}}}$) in the case of the torus
manifold other than $\pi$ in the case of the spherical manifold, as shown in
Fig. 2$($c$)$. Here, we set the torus of size
$\Delta_{1}/2\pi=\Omega_{1}/2\pi=1.735$ MHz and $\Delta_{2}=0$. As it is shown
in Eq. $($17$)$, the torus turns into a sphere with the radius
$\Delta_{1}(\Omega_{1})$.

Figure 3: $($Color online$)$. Topological invariants. The first Chern number
$\mathds{C}_{1}$ and the Euler-Poincaré characteristic number
$\chi(\mathcal{M})=2(1-{g})$ for the sphere and the torus, respectively, where
${g}$ represents the genus of manifolds. The green solid line shows
$\mathds{C}_{1}(\textrm{S}^{2})$ and the orange solid line shows
$\mathds{C}_{1}(\textrm{T}^{2})$. The red dashed line shows
$\chi(\textrm{T}^{2})=0$ and the black dashed line shows
$\chi(\textrm{S}^{2})=2$. The numerical simulation using a Lindblad master
equation is represented by the purple astragal and the cyan astragal. Here we
notice that the blue solid line shows that the first Chern number of the torus
with $\Delta_{1}/2\pi=\Omega_{1}/2\pi=1.735\times 10~{}$kHz approximates to 0
and it will be explained in the next section.

The Berry curvature can be extracted from the linear response of the qubit
system to nonadiabatic manipulations $($deviations from adiabaticity$)$ of its
Hamiltonian which leads to the first-order reaction force. As the Hamiltonians
with parameters $\Delta$ and $\Omega$ are cylindrically symmetric about the
$z$ axis, the corresponding Chern number
$\mathds{C}_{1}(\mathcal{M})=(2\pi)^{-1}\int_{0}^{2\pi}d\phi\int_{0}^{\theta^{\prime}}d\theta\textit{B}_{\theta\phi}$
can be separately represented as

$\displaystyle\mathds{C}_{1}(\textrm{S}^{2})=\int_{0}^{\pi}\textit{B}_{\theta\phi}^{\textrm{sph}}d\theta$
(24)

and

$\displaystyle\mathds{C}_{1}(\textrm{T}^{2})=\int_{0}^{2\pi}\textit{B}_{\theta\phi}^{\textrm{tor}}d\theta,$
(25)

respectively, where $\theta^{\prime}=\pi$ for the sphere case and
$\theta^{\prime}=2\pi$ for the torus case, similarly as we mentioned before.

As shown in Fig. 3, we notice that the first Chern number of both manifolds
are not constant. In the case of the sphere, the absolute value of the first
Chern number $|\mathds{C}_{1}|=1$, if and only if the degenerate points are
wrapped by the Hamiltonian manifold Zhang1-2017 . However, the first Chern
number of the torus is oscillating between 0 and 1, and the oscillation
frequency is proportional to the magnitude of the parameters $($$\Delta$ and
$\Omega$$)$. To some extent, the integrals in Eqs. $($24$)$ and $($25$)$ are
not $($quantized$)$ winding numbers when the manifolds are no longer enclosing
the degenerate points $($gapped regions$)$. It is different from the result
using the method calculating the conventional Berry curvature and Chern number
Hasan-2010 , as shown in Appendix A. In the next section, we will notice that
the first Chern number of a static torus actually approximates to zero, as
shown in Fig. 3. Here, our choice of the magnitude of the parameters of the
torus is ten times smaller than the sphere. The oscillation of the Chern
number stems from the form of the Berry curvature in Eq. $($23$)$, with the
condition of $\Delta_{2}$ varying from $-4.27\Delta_{1}$ to $4.27\Delta_{1}$.
Under this condition, the first Chern number is not well defined.

To study the robustness of manipulating the qubit dynamics, we need to put our
proposal into an open quantum system. The whole dynamics of the system
decaying to the reservoir can be modeled by the Lindblad master equation

$\displaystyle\frac{d\hat{\rho}(t)}{dt}=i[\hat{\rho}(t),\hat{{\textit{H}}}_{\textrm{tor}}(t)]+\frac{\mathcal{D}[\hat{\sigma}_{-}]\hat{\rho}(t)}{T_{1}}+\frac{\mathcal{D}[\hat{\sigma}_{z}]\hat{\rho}(t)}{2T_{\phi}},$
(26)

where we use Pauli operator $\hat{\sigma}_{z}$, annihilation operator
$\hat{\sigma}_{-}=\hat{\sigma}_{x}-i\hat{\sigma}_{y}$, and the Lindblad super-
operator is defined for any operator $\hat{\mathcal{L}}$ as
$\mathcal{D}[\hat{\mathcal{L}}]\hat{\rho}=\hat{\mathcal{L}}\hat{\rho}\hat{\mathcal{L}}^{{\dagger}}-(1/2)\hat{\mathcal{L}}^{{\dagger}}\hat{\mathcal{L}}\hat{\rho}-(1/2)\hat{\rho}\hat{\mathcal{L}}^{{\dagger}}\hat{\mathcal{L}}$.
The qubit dephasing rate is
$1/\textit{T}_{\phi}=1/\textit{T}_{2}^{*}-1/2\textit{T}_{1}$, where
$\textit{T}_{\phi}$ represents the dephasing time, $\textit{T}_{1}$ is the
relaxation time characterizing a qubit relaxing from the excited state
$|e\rangle$ to the ground state $|g\rangle$, and $\textit{T}_{2}^{*}$ depicts
the Ramsey dephasing time. The system’s parameters we take for the simulation
are $\textit{T}_{1}=60~{}{\mu}$s and $\textit{T}_{2}^{*}=40~{}{\mu}$s, which
are about to be available with the improvement of the recently implemented
superconducting devices Song-2017 ; Ning-2019 .

##  IV The connection between the Berry curvature and the quantum states
evolution

Now, let us show the connection between the Berry curvature of the torus
Hamiltonian parameter space and the fidelity of system’s states. For
simplicity, here we just consider the case of the source $\rho_{N}$ which sits
at $\Delta=\Omega=0$ in the parameter space. The eigenstates of the
Hamiltonian $\hat{\textit{H}}_{\textrm{tor}}$ are given by

$\displaystyle|\psi_{e}\rangle=\frac{\Delta/2|e\rangle}{\sqrt{{{\Delta}^{2}}/{4}+(\textit{E}_{e}-{\Omega}/{2})^{2}}}+\frac{e^{i\phi}(\textit{E}_{e}-{\Omega}/{2})|g\rangle}{\sqrt{{{\Delta}^{2}}/{4}+(\textit{E}_{e}-{\Omega}/{2})^{2}}}$
(27)

and

$\displaystyle|\psi_{g}\rangle=\frac{\Delta/2|e\rangle}{\sqrt{{{\Delta}^{2}}/{4}+(\textit{E}_{g}-{\Omega}/{2})^{2}}}+\frac{e^{i\phi}(\textit{E}_{g}-{\Omega}/{2})|g\rangle}{\sqrt{{{\Delta}^{2}}/{4}+(\textit{E}_{g}-{\Omega}/{2})^{2}}},$
(28)

respectively, with the eigenvalues
$\textit{E}_{e(g)}=\pm{\sqrt{{\Delta}^{2}+{\Omega}^{2}}}/{2}$. The fidelity
for the quantum state is defined as
$f=\langle\psi_{\alpha}|\hat{\rho}(t_{f})|\psi_{\alpha}\rangle$
$($$\alpha=e,g$$)$, with the target state $\hat{\rho}(t_{f})=|g\rangle\langle
g|$. The system’s states can then be tracked by the change of the Berry
curvature.

Figure 4: $($Color online$)$ $($a$)$ The Berry curvature measured as a
function of $\Delta_{2}/\Delta_{1}$ for which we take the values of the
parameters $\Delta_{1}/2\pi=\Omega_{1}/2\pi=1.735\times 10~{}$kHz,
$\Delta_{2}$ from $-2\Delta_{1}$ to $2\Delta_{1}$, and the ramping time
$\tau_{\textrm{tor}}=1~{}\mu$s. The region of the Berry curvature is from
$-2.375\times 10^{-4}$ to $5.623\times 10^{-3}$. $($b$)$ The fidelity:
${|\langle g|\psi_{g}\rangle|}^{2}$. $($c$)$ The fidelity: ${|\langle
g|\psi_{e}\rangle|}^{2}$. The dashed red circles in $($b$)$ and $($c$)$
enclose the singularities which are located at
$[\Delta_{2}/\Delta_{1}=-1,\theta/\pi=0],[\Delta_{2}/\Delta_{1}=-1,\theta/\pi=2]$,
and $[\Delta_{2}/\Delta_{1}=1,\theta/\pi=1]$, respectively.

In order to manifest the physical meaning that stems from the Berry curvature,
we first consider the adiabatic case. If we set the parameters
$\Delta_{1}/2\pi=\Omega_{1}/2\pi=1.735\times 10~{}$kHz, from Fig. 2 $($b$)$,
we can imagine that the strength of the “magnetic fields” originated from the
singularities are too small to have a significant effect on the evolution of
the system’s states, as shown in Fig. 4. Under the circumstances, the
corresponding first Chern number of the torus no longer oscillates and
approximates to zero $($the first Chern number of the torus is approximately
equal to the Euler-Poincaré characteristic number here$)$, as mentioned in the
last section of Fig. 3. The system’s states evolve adiabatically in their own
eigenstate spaces. In Fig. 4$($b$)$ and 4$($c$)$, we notice that each of them
has three interesting points enclosed by the red dotted circles. Actually,
these points correspond to the same singularity in the torus parameter space.
As shown in Fig. 2$($a$)$, the spherical manifold emerges twice during the
process of the deformation of the torus for $\Delta_{2}$ varying from
$-2\Delta_{1}$ to $2\Delta_{1}$. The transition of the system’s states occurs
at $|\Delta_{2}/\Delta_{1}|=1$ during the process with $\Delta_{2}$ varying
from $-\Delta_{1}$ to $\Delta_{1}$.

It becomes aware of the interesting connection between the Berry curvature and
the evolution of the system’s states by controlling the system’s parameters.
In Fig. 5, the Berry curvature ${\textit{B}}_{\theta\phi}$ and the fidelity of
the target state $|g\rangle$ are plotted versus $\theta/\pi$ and
$\Delta_{2}/\Delta_{1}$. If we set
$\Delta_{1}/2\pi={\Omega_{1}/2\pi}=1.735~{}$MHz, we can realize that one of
the eigenstates $|\psi_{g}\rangle$ is slightly affected by the corresponding
Berry curvature. Both of the eigenstates $(|\psi_{g}\rangle$ and
$|\psi_{e}\rangle)$ no longer evolve in the adiabatic way. The deviations from
the adiabaticity become large enough to affect the evolution of the system’s
states, as shown in Fig. 5. We continue to tune up the parameters to
$\Delta_{1}/2\pi={\Omega_{1}/2\pi}=1.735\times 10~{}$MHz, where the Berry
curvature becomes ten times larger than before.

Figure 5: $($Color online$)$. $($a$)$ The Berry curvature measured as a
function of $\Delta_{2}/\Delta_{1}$ for which we take the values of the
parameters $\Delta_{1}/2\pi=\Omega_{1}/2\pi=1.735~{}$MHz, $\Delta_{2}$ from
$-2\Delta_{1}$ to $2\Delta_{1}$, and the ramping time
$\tau_{\textit{tor}}=1~{}\mu$s. With the same setting, $($d$)$ is only
different with $\Delta_{1}/2\pi=\Omega_{1}/2\pi=1.735\times 10~{}$MHz. $($b$)$
and $($e$)$ depict the fidelity of $|\psi_{g}\rangle$ without qubit’s
decoherence. $($c$)$ and $($f$)$ represent the fidelity of $|\psi_{g}\rangle$
with $\textit{T}_{1}=60{\mu}$s and $\textit{T}_{2}^{*}=40{\mu}$s. The density
matrix of the target state here is $\hat{\rho}(t_{f})=|g\rangle\langle g|$.

From Ref. Zhang1-2017 , we know that the magnitude of the Berry curvature in
parameter space corresponds to the strength of the magnetic field of the
monopoles $($singularities$)$. When the degenerate points pass through the
parameter space manifolds, the quantum states influenced by the Berry
curvature will cause ripples in the Hilbert space, this phenomenon is more
obvious in Fig. 5$($e$)$ than in Fig. 5$($b$)$ for $\Delta_{2}/\Delta_{1}=1$.
In Fig. 5$($d$)$, we notice that there is a significantly closed triangular
region emerging from $\Delta_{2}/\Delta_{1}=-1$ to $\Delta_{2}/\Delta_{1}=1$.
This reflects the process of the measurement of the Berry curvature. Actually,
the triangular region also exists in Fig. 4$($a$)$ and Fig. 5$($a$)$. However,
the magnitude of the Berry curvature is too small to show the region. In Fig.
5$($c$)$ and 5$($f$)$, the numerical simulation using the Lindblad master
equation of Eq. $($26$)$ models the imperfect dynamics with
$\textit{T}_{1}=60~{}{\mu}$s and $\textit{T}_{2}^{*}=40~{}{\mu}$s, showing
that the fidelity of the system’s states almost stay unchanged under the
considered noise effects.

##  V Concluding remarks

In conclusion, we study the Berry curvature characterized by Hamiltonian
parameter space and its connection to the evolution of the system’s states
with a microwave-addressed two-level system. We firstly show two different
topological Hamiltonian parameter spaces, a sphere and a torus. The dynamics
revealed is, to an extent, to simulate that, strength of the magnetic field
described by the Berry curvature influences the evolution of the system’s
states during the whole process of the deformation of the manifold.

Generally, the first Chern number is always an integer number if the base
space is a compact oriented two-dimensional smooth manifold. However, the
first Chern number of the variational torus manifold is no more discrete
numbers under the circumstance in the case considered here. We need to
emphasize that the non-integer first Chern number mentioned in the dynamically
non-adiabatic response method is due to an artifact of approximating
curvature. Discrete numbers still can be obtained by considering an
irreducible representation of SU$(2)$ with spin-1 case Mera-2019 . However,
this is not the key point here. Back to our case, in the adiabatic case, the
first Chern number of the torus is approximately equivalent to the Euler-
Poincaré number. With the increase of the magnitude of the Berry curvature,
the balance between them is gradually broken.

For different kinds of manifolds with different geometrical and topological
structures in parameter space, different distributions of the Berry curvature
will affect variously the evolution of quantum states. We find that Berry
curvature plays a crucial role in connecting the Hamiltonian parameter space
and the Hilbert space. We can built up some other kinds of Hamiltonian
manifolds in parameter space. This helps us to gain insight into the
manipulation of the qubit dynamics from the geometric point of view.

###### Acknowledgements.

This work was supported in part by the National Natural Science Foundation of
China under Grants No.11875108, No.11405031, and the Natural Science
Foundation of Fujian Province under Grants 2018J01412.

##  Appendix A A concise comparison between two approaches for calculating the
Berry curvature

In general case, the first Chern number of the ground state manifold is
encoded in the gauge-invariant curvature 2-form which can be written as
Hasan-2010

$\displaystyle{\mathcal{B}=\textit{B}_{{\theta\phi}}d\theta\wedge{d}\phi,}$
(29)

where $\textit{B}_{{\theta\phi}}$ is the conventional Berry curvature. For our
two-level Hamiltonian, the conventional Berry curvature of the ground state in
the gapped region can be expressed as

$\displaystyle\textit{B}_{{\theta\phi}}=\frac{1}{2}\hat{x}\cdot(\frac{\partial\hat{x}}{\partial\theta}\times\frac{\partial\hat{x}}{\partial\phi})$
(30)

via the normalized vector component
$\hat{x}={\boldsymbol{x}}/\|\boldsymbol{x}\|$, which in the sphere and the
torus cases are respectively

$\displaystyle\boldsymbol{x}_{\textrm{sph}}$ $\displaystyle=$
$\displaystyle({x}^{1},{x}^{2},{x}^{3})_{\textrm{sph}}=\\{\hat{\sigma}^{\mu}\\}_{\textrm{sph}}=\\{\hat{\sigma}^{x},\hat{\sigma}^{y},\hat{\sigma}^{z}\\}_{\textrm{sph}}=(\Omega\cos\phi,~{}\Omega\sin\phi,~{}\Delta)$
(31)

and

$\displaystyle\boldsymbol{x}_{\textrm{tor}}$ $\displaystyle=$
$\displaystyle({x}^{1},{x}^{2},{x}^{3})_{\textrm{tor}}=\\{\hat{\sigma}^{\mu}\\}_{\textrm{tor}}=\\{\hat{\sigma}^{x},\hat{\sigma}^{y},\hat{\sigma}^{z}\\}_{\textrm{tor}}=(\Delta\cos\phi,~{}\Delta\sin\phi,~{}\Omega).$
(32)

We can then calculate the conventional Berry curvatures of the two families
via Eq. $($30$)$ to be

$\displaystyle\textit{B}_{{\theta\phi}}^{\rm{S}^{2}}=\frac{\Omega_{1}^{2}\sin\theta(\Delta_{2}\cos\theta+\Delta_{1})}{2\big{[}(\Delta_{1}\cos\theta+\Delta_{2})^{2}+\Omega_{1}^{2}\sin^{2}\theta\big{]}^{3/2}}$
(33)

and

$\displaystyle\textit{B}_{{\theta\phi}}^{\rm{T}^{2}}=-\frac{\Omega_{1}(2(\Delta_{1}^{2}+\Delta_{2}^{2})\cos\theta+\Delta_{2}\Delta_{1}(\cos
2\theta+3))}{4\big{[}(\Delta_{1}\cos\theta+\Delta_{2})^{2}+\Omega_{1}^{2}\sin^{2}\theta\big{]}^{3/2}}.$
(34)

The corresponding first Chern number of them can be calculated as

$\displaystyle\mathds{C}_{1}(\textrm{S}^{2})=\frac{1}{2\pi}\int_{0}^{\pi}d\theta\int_{0}^{2\pi}{d}\phi~{}\textit{B}_{\theta\phi}^{\rm{S}^{2}}=\frac{1}{2}\left(\frac{\Delta_{1}-\Delta_{2}}{\sqrt{\left(\Delta_{1}-\Delta_{2}\right){}^{2}}}+\frac{\Delta_{1}+\Delta_{2}}{\sqrt{\left(\Delta_{1}+\Delta_{2}\right){}^{2}}}\right)$
(35)

and

$\displaystyle\mathds{C}_{1}(\textrm{T}^{2})=\frac{1}{2\pi}\int_{0}^{2\pi}d\theta\int_{0}^{2\pi}{d}\phi~{}\textit{B}_{\theta\phi}^{\rm{T}^{2}}=0.$
(36)

From Eq. $($35$)$, we notice that the first Chern number is not well defined
for $\Delta_{1}=\pm\Delta_{2}$.

We now numerically calculate the Berry curvature using the dynamical method as
follows Gritsev-2012 :

$\displaystyle\textit{B}_{{\theta\phi}}^{\textrm{sph}}$ $\displaystyle=$
$\displaystyle\frac{\langle\psi(t)|\partial_{\phi}\hat{\textit{H}}_{\textrm{sph}}|\psi(t)\rangle}{\theta_{t}^{\textrm{sph}}}=\frac{1}{2\theta_{t}^{\textrm{sph}}}\bigg{\langle}\psi(t)\bigg{|}\partial_{\phi}\left(\begin{array}[]{cc}\Delta&\Omega{\textit{e}}^{-\textit{i}\phi}\\\
\Omega{\textit{e}}^{\textit{i}\phi}&-\Delta\\\
\end{array}\right)\bigg{|}\psi(t)\bigg{\rangle}=\frac{\Omega_{1}\sin\theta}{2\theta_{t}^{\textrm{sph}}}\bigg{\langle}\psi(t)\bigg{|}\left(\begin{array}[]{cc}0&-i\\\
i&0\\\ \end{array}\right)\bigg{|}\psi(t)\bigg{\rangle}$ (41) $\displaystyle=$
$\displaystyle\frac{\Omega_{1}\sin\theta}{2\theta_{t}^{\textrm{sph}}}\langle\hat{\sigma}^{y}\rangle=\frac{\Omega_{1}\sin\theta}{2\theta_{t}^{\textrm{sph}}}\textrm{Tr}(\hat{\rho}\hat{\sigma}^{y})$
(44)

and

$\displaystyle\textit{B}_{{\theta\phi}}^{\textrm{tor}}$ $\displaystyle=$
$\displaystyle\frac{\langle\psi(t)|\partial_{\phi}\hat{\textit{H}}_{\textrm{tor}}|\psi(t)\rangle}{\theta_{t}^{\textrm{tor}}}=\frac{1}{2\theta_{t}^{\textrm{tor}}}\bigg{\langle}\psi(t)\bigg{|}\partial_{\phi}\left(\begin{array}[]{cc}\Omega&\Delta{\textit{e}}^{-\textit{i}\phi}\\\
\Delta{\textit{e}}^{\textit{i}\phi}&-\Omega\\\
\end{array}\right)\bigg{|}\psi(t)\bigg{\rangle}=\frac{\Delta_{1}\cos\theta+\Delta_{2}}{2\theta_{t}^{\textrm{tor}}}\bigg{\langle}\psi(t)\bigg{|}\left(\begin{array}[]{cc}0&-i\\\
i&0\\\ \end{array}\right)\bigg{|}\psi(t)\bigg{\rangle}~{}~{}~{}~{}$ (49)
$\displaystyle=$
$\displaystyle\frac{\Delta_{1}\cos\theta+\Delta_{2}}{2\theta_{t}^{\textrm{tor}}}\langle\hat{\sigma}^{y}\rangle=\frac{\Delta_{1}\cos\theta+\Delta_{2}}{2\theta_{t}^{\textrm{tor}}}\textrm{Tr}(\hat{\rho}\hat{\sigma}^{y}),$
(52)

where $\hat{\rho}$ is the density matrix of the lower dressed state
$|\psi(t)\rangle=|\psi_{g}\rangle$ in Eq. $($28$)$. Eqs. $($8$)$, $($41$)$ and
$($49$)$ show the approach to measure Berry curvature is a leading order
approximation, good to the first order in the ramping rate $\theta_{t}$
$($sphere case$)$. However, we notice that the first Chern number in the torus
case is no longer a constant number outside the gapped region. The various
oscillations in Fig. 3 and Fig. 5 noted in the text could not happen in the
case of the conventional Berry curvature. From Ref. Gritsev-2012 , we know
that the method is not that perfect when the ramp velocity is sufficient large
$($large deviation from the linear response regime$)$. Therefore, the
dynamically non-adiabatic response method we adopt here actually is not
equivalent to the conventional one under certain circumstances.

## References

  * (1) M. V. Berry, Quantal phase factors accompanying adiabatic changes, Proc. R. Soc. A, 392, 45 (1984).
  * (2) V. Gritsev and A. Polkovnikov, Dynamical quantum Hall effect in the parameter space, Proc. Natl. Acad. Sci. U.S.A., 109, 6457 (2012).
  * (3) M. Z. Hasan and C. L. Kane, Topological insulators, Rev. Mod. Phys., 82, 3045 (2010).
  * (4) S. Sugawa, F. Salces-Carcoba, P. R. Perry, Y. C. Yue, I. B. Spielman, Second Chern number of a quantum-simulated non-Abelian Yang monopole, Science, 360, 6396 (2018).
  * (5) N. Fl$\ddot{\mathrm{a}}$schner, B. S. Remet al., Experimental reconstruction of the Berry curvature in a Floquet Bloch band, Science, 352, 6289 (2016).
  * (6) J. Provost and G. Vallee, Riemannian structure on manifolds of quantum states, Commun. Math. Phys., 76, 289 (1980).
  * (7) B. Simon, Holonomy, the Quantum Adiabatic Theorem, and Berry’s Phase, Phys. Rev. Lett., 51, 2167 (1983).
  * (8) Z. L. Zhang, M. F. Chen, H. Z. Wu and Z. B. Yang, Quantum simulation of Abelian Wu-Yang monopoles in spin-1/2 systems, Laser Phys. Lett., 14, 045204 (2017).
  * (9) Z. L. Zhang, M. F. Chen, H. Z. Wu and Z. B. Yang, Quantum simulation of gravitational-like waves in minisuperspace with an artificial qubit, Phys. Rev. D, 95, 046010 (2017).
  * (10) M. D. Schroer, M. H. Kolodrubetzet et al., Measuring a topological transition in an artificial spin-1/2 system, Phys. Rev. Lett., 113, 050402 (2014).
  * (11) M. V. Berry, and J. M. Robbins, Chaotic classical and half-classical adiabatic reactions: geometric magnetism and deterministic friction, Proc. R. Soc., 442, 659 (1993).
  * (12) P. Roushan, C. Neill et al., Observation of topological transitions in interacting quantum circuits, Nature, 515, 241 (2014).
  * (13) D. J. Struik, Lectures on Classical Differential Geometry, (Addison-Wesley Pub. Co., 1961).
  * (14) B. Mera, K. Sacha, and Y. Omar, Topologically Protected Quantization of Work, Phys. Rev. Lett., 123, 020601 (2019).
  * (15) C. Song, S. B. Zheng, et al., Continuous-variable geometric phase and its manipulation for quantum computation in a superconducting circuit, Nat. Commun., 8, 1061 (2017).
  * (16) W. Ning, X. J. Huang et al., Deterministic Entanglement Swapping in a Superconducting Circuit, Phys. Rev. Lett., 123, 060502 (2019).