text:
\section{Introduction}

Physically realizable adversarial attacks are a threat for safety-critical (semi-)autonomous systems such as self-driving cars or robots. Adversarial patches \citep{brown_2017,pmlr-v80-karmon18a} are the most prominent example of such an attack. Their realizability has been demonstrated repeatedly, for instance by Lee and Kolter \citep{lee_2019}: an attacker places a printed version of an adversarial patch in the physical world to fool a deep learning system. While empirical defenses \citep{Hayes18,NaseerKP19,selvaraju_grad-cam:_2019,wu2020defending} may offer robustness against known attacks, it does not provide any guarantees against unknown future attacks \citep{chiang2020certified}. Therefore, certified defenses for the patch threat model, which allow guaranteed robustness against all possible attacks for the given threat model, are crucial for safety-critical applications.

Research on certifiable defenses against adversarial patches can be broadly categorized into certified recovery and certified detection. \emph{Certified recovery} \citep{chiang2020certified,levine,zhang_clipped_2020,xiang_patchguard_2020,metzen2021efficient,lin2021certified,xiang2021patchcleanser,salman2021certified, ECViT} has the objective to make a correct prediction on an input even in the presence of an adversarial patch. In contrast, \emph{certified detection} \citep{mccoyd2020minority,xiang2021patchguard,han2021scalecert,huang2021zeroshot} provides a weaker guarantee by only aiming at \emph{detecting} inputs containing adversarial patches. While certified recovery is more desirable in principle, it typically comes at a high cost of reduced performance on clean data. In practice, certified detection might be preferable because it allows maintaining high clean performance. Most existing certifiable defenses against patches are focused on image classification, with the exception of DetectorGuard \citep{xiang2021detectorguard} and ObjectSeeker \citep{xiang2022objectseeker} that certifiably defend against patch hiding attacks on object detectors. Moreover, existing defences are not easily applicable to arbitrary downstream models, because they assume either that the downstream model is trained explicitly for being certifiably robust \citep{levine,metzen2021efficient}, or that the model has a certain network architecture such as BagNet \citep{zhang_clipped_2020,metzen2021efficient,xiang_patchguard_2020} or a vision transformer \citep{salman2021certified,huang2021zeroshot}. A notable exception is PatchCleanser \citep{xiang2021patchcleanser}, which can be combined with arbitrary downstream models but is restricted to image classification.

Adversarial patch attacks were also proposed for the image segmentation problem \cite{Nesti2022EvaluatingTR}, mostly for attacking CNN-based models that use a localized receptive field \citep{zhao2017pspnet}. However, recently self-attention based vision
transformers \citep{dosovitskiy2021an} have achieved new state-of-the-art in the image segmentation task \cite{liu2021Swin, senformer}. Their output may become more vulnerable to adversarial patches if they manage to manipulate the global self-attention \cite{Lovisotto2022GiveMY}. We demonstrate how significant parts of the segmentation output may be affected by a small patch for the Senformer \cite{senformer} model in Figure \ref{fig:patch_motivation}. We point out that preventive certified defences are important because newly developed attacks can immediately be used to compromise safety-critical applications unless they are properly defended.

In this work, we propose the novel framework \textsc{Demasked Smoothing} (Figure \ref{fig:intro_pic}) to obtain the first (to the best of our knowledge) certified defences against patch attacks on semantic segmentation models. Similarly to previous work \citep{levine}, we mask different parts of the input (Figure \ref{fig:mask}) and provide  guarantees with respect to every possible patch that is not larger than a certain pre-defined size. While prior work required the classification model to deal with such masked inputs, we leverage recent progress in image inpainting \citep{dong2022incremental} to reconstruct the input \emph{before} passing it to the downstream model. This decoupling of image demasking from the segmentation task allows us to support arbitrary downstream models. Moreover, we can leverage state of the art methods for image inpainting. We also propose different masking schemes tailored for the segmentation task that provide the dense input allowing the demasking model to understand the scene but still satisfy the guarantees with respect to the adversarial patch.

\begin{figure}[t]
	\centering
	\begin{subfigure}{0.49\linewidth}
		\includegraphics[width=\linewidth]{graphics/patch_motivation/pic.png}
		\caption{}
		\label{fig:patch_motivation}
	\end{subfigure}
	\begin{subfigure}{0.49\linewidth}
		\includegraphics[width=\linewidth]{graphics/masking/pic.png}
		\caption{}
		\label{fig:mask}
	\end{subfigure}
	\begin{subfigure}{\linewidth}
		\includegraphics[width=\linewidth]{graphics/intro/intro_pic.png}
		\caption{}
		\label{fig:intro_pic}
	\end{subfigure}
	\caption{(a) A simple patch attack on the state-of-the-art ViT-based Senformer \cite{senformer} manages to switch the prediction for a large object. (b) Masking the patch. (c) A sketch of \textsc{Demasked Smoothing} for certified image segmentation. First, we generate a set of masked versions of the image such that each possible patch can only affect a certain number of masked images. Then we use image inpainting to partially recover the information lost during masking and then apply an arbitrary segmentation method. The output is obtained by aggregating the segmentations pixelwise. The masking strategy and aggregation method depend on the certification mode (detection or recovery).}
\end{figure}

\clearpage
We summarize our contributions as follows:
\begin{itemize}[nolistsep]
	\item We propose \textsc{Demasked Smoothing} which is the first (to the best of our knowledge) certified recovery or certified detection based defence against adversarial patch attacks on semantic segmentation models (Section \ref{section:demasked_smoothing}).
	\item \textsc{Demasked Smoothing} can do certified detection and recovery with any possible segmentation model without requiring finetuning or any other adaptation.
	\item We implement \textsc{Demasked Smoothing}, evaluate it for different certification objectives and masking schemes (Section \ref{section:experiments}). We can certify 64\% of all pixels in certified detection for a 1\% patch and 48\% in certified recovery for a 0.5\% patch for the Senformer \citep{senformer} segmentation model on the ADE20K \cite{zhou2017scene} dataset.
\end{itemize}

\section{Related Work}
\label{section:related_work}

\textbf{Certified recovery.} The first certified recovery defence for classification models against patches was proposed by Chiang et al. \cite{chiang2020certified}, who adapted interval-bound propagation \cite{Gowal_2019_ICCV} to the patch threat model. Levine and Feizi \cite{levine} proposed De-Randomized Smoothing (DRS), which provides significant accuracy improvement when compared to Chiang et al. \cite{chiang2020certified} and scales to the ImageNet dataset. In DRS, a base classifier is trained on images where everything but a small local region is masked (ablated). At inference time, a majority vote of all specified ablations is taken as the final classification. If this vote has a large enough margin to the runner-up class, the prediction cannot be shifted by any patch that does not exceed a pre-defined size. A similar approach was adopted in Randomized Cropping \cite{lin2021certified}. A general drawback of these approaches is that the classifier needs to be trained to process masked/cropped inputs, which (in contrast to our work) prohibits the usage of arbitrary pretrained models. A further line of work studies network architectures that are particularly suited for certified recovery. For instance, models with small receptive fields such as \emph{BagNets} \cite{brendel2018approximating} have been explored, either by combining them with some fixed postprocessing \cite{zhang_clipped_2020,xiang_patchguard_2020} or by training them end-to-end for certified recovery  \cite{metzen2021efficient}. Salman et al. \cite{salman2021certified} propose to apply DRS to \emph{Vision Transfomers (ViTs)}. In contrast to the aforementioned works, our Demasked Smoothing can be applied to models with arbitrary architecture. This is a property shared with PatchCleanser \cite{xiang2021patchcleanser}, which however is limited to image classification and it is not clear how it can be extended to semantic segmentation where a class needs to be assigned to every pixel including the masked ones. Certified recovery against patches has also been extended to object detection, specifically to defend against patch hiding attacks. Two notable works in this direction are DetectorGuard \cite{xiang2021patchguard}, an extension of PatchGuard \cite{xiang_patchguard_2020} to object detection, and ObjectSeeker \cite{xiang2022objectseeker}. Randomized smoothing \citep{pmlr-v97-cohen19c} has been applied to certify semantic segmentation models against $\ell_2$-norm bounded adversarial attacks \citep{Fischer2021ScalableCS}. However, to the best of our knowledge, no certified defence against patch attacks for semantic segmentation has been proposed so far.

\textbf{Certified detection.} An alternative to certified recovery is \emph{certified detection}. Here, an adversarial patch is allowed to change the model prediction. However, if it succeeds in doing so, there is a mechanism that detects this attack certifiably with zero false negatives. Minority Reports \cite{mccoyd2020minority} was the first certified detection method against patches, which is based on sliding a mask over the input in a way that ensures that there will be one mask position that completely hides the patch. PatchGuard++ \cite{xiang2021patchguard} is an extension of Minority Reports where the sliding mask is not applied on the input but on the feature maps of a BagNet-type feature extractor. This reduces inference time drastically since the feature extractor needs to be executed only once per input. ScaleCert \cite{han2021scalecert} tries to identify ``superficial important neurons'', which allows pruning the network in a way that the prediction needs to be made for fewer masked inputs. Lastly, PatchVeto \cite{huang2021zeroshot} is a recently proposed method for certified detection that is tailored towards ViT models. It implements masking by removing certain input patches of the ViT. In this work, we propose a novel method for certified detection in the semantic segmentation task that can be used for any pretrained model.

\textbf{Image reconstruction.} The problem of learning to reconstruct the full image from inputs where parts have been masked out was pioneered by Vincent et al. \cite{JMLR:v11:vincent10a}. It recently attracted attention as proxy task for self-supervised pre-training, especially for the ViTs \cite{bao2022beit, he2021masked}. Recent approaches to this problem are using Fourier convolutions \citep{Suvorov2022ResolutionrobustLM} and visual transformers \citep{dong2022incremental}. SPG-Net \citep{Song2018SPGNetSP} trains a subnetwork to reconstruct the full semantic segmentation directly from the masked input as a part of the image inpainting pipeline. In this work, we use the state-of-the-art ZITS \citep{dong2022incremental} inpainting method.

\section{Problem Setup} \label{section:problem_setup}

\subsection{Semantic Segmentation} \label{section:image_segmentation}

In this work, we focus on the semantic segmentation task. Let $\mathcal{X}$ be a set of rectangular images. Let $x \in \mathcal{X}$ be an image with height $H$, width $W$ and the number of channels $C$. We denote $\mathcal{Y}$ to be a finite label set. The goal is to find the segmentation map $s \in \mathcal{Y}^{H \times W}$ for $x$. For each pixel $x_{i, j}$, the corresponding label $s_{i, j}$ denotes the class of the object to which $x_{i, j}$ belongs. We denote $\mathbb{S}$ to be a set of segmentation maps and $f: \mathcal{X} \rightarrow \mathbb{S}$ to be a segmentation model. Assume that we know the ground truth segmentation map $s \in \mathbb{S}$. We evaluate a model $f$ by using \textit{accuracy map} $M^{acc}(f, x, s) \in \{0, 1\}^{H \times W}$ such that $M^{acc}(f, x, s)_{i,j} :=[ f(x)_{i, j} = s_{i, j} ]$, where $[P]=1$ if $P=\text{True}$ and 0 otherwise. Let $Q(f, x, s)$ be a segmentation quality metric e.g.\ \textit{global accuracy}, $Acc(f, x, s):=\dfrac{1}{H \cdot W}\sum_{i=1}^{H} \sum_{j=1}^{W}M^{acc}(f, x, s)_{i,j}$. We discuss other metrics for the segmentation evaluation in Section \ref{section:evaluation_metrics}.

\subsection{Threat model} \label{section:threat_model}

Let us consider an untargeted adversarial patch attack on a segmentation model. Consider an image $x \in [0, 1]^{H\times W\times C}$ and its ground truth segmentation map $s$. Assume that the attacker can modify an arbitrary rectangular region of the image $x$ which has a size of $H^\prime \times W^\prime$. We refer to this modification as a \textit{patch}. Let $l \in \{0,\ 1\}^{H\times W}$ be a binary mask that defines the patch location in the image in which ones denote the pixels belonging to the patch. Let $\mathcal{L}$ be a set of all possible patch locations for a given image $x$. Let  $p \in [0, 1]^{H\times W\times C}$ be the modification itself. Then we define an operator $A$ as $A(x,\ p,\ l) = (1 - l) \odot x + l \odot p$, where $\odot$ is element-wise product. The operator $A$ applies the $H^\prime \times W^\prime$ subregion of $p$ defined by a binary mask $l$ to the image $x$ while keeping the rest of the image unchanged. We denote $\mathcal{P} := [0,\ 1]^{H \times W \times C} \times \mathcal{L}$ to be a set of all possible patch configurations $(p, l)$ that define an $H^\prime \times W^\prime$ patch. The goal of an attacker is to find $(p^\star,\ l^\star)$ s. t. $(p^\star,\ l^\star) = \argmin\limits_{(p,\ l) \in \mathcal{P}}\ Q(f, A(x, p, l), s)$

\subsection{Defence objective} \label{section:defence_objective}

In this paper, we propose certified defences against patch attacks. It means that we certify against \textit{any possible attack} from $\mathcal{P}$ including $(p^\star,\ l^\star)$. We consider two robustness objectives.

\textbf{Certified recovery} For a pixel $x_{i, j}$ our goal is to verify that the following statement is true
\begin{equation}
	\label{eq:certified_recovery_formulation}
	\forall\ (p,\ l) \in \mathcal{P}:\ f(A(x,\ p,\ l))_{i, j} = f(x)_{i,j}
\end{equation}
\textbf{Certified detection} We consider a verification function $v$ defined on $\mathcal{X}$ such that $v(x) \in \{0, 1\}^{H \times W}$. If $v(x)_{i,j}=1$, then we claim that there is no adversarial patch in the image $x$ or the prediction on a pixel $x_{i,j}$ is not affected by this patch. Otherwise $v(x)_{i,j}=0$ which means that a potential patch attack was detected and we return an alert. For a pixel $x_{i, j}$ our goal is to verify that the following statement is true
\begin{equation}
	\label{eq:certified_detection_formulation}
	\forall\ (p,\ l) \in \mathcal{P}: v(A(x, p, l))_{i, j}=1 \Rightarrow f(A(x,\ p,\ l))_{i, j} = f(x)_{i,j}
\end{equation}
The secondary objective is to keep the alert ratio as small as possible and not return an alert for the pixels that satisfy \ref{eq:certified_recovery_formulation}.

Depending on the objective our goal is to certify one of the conditions \ref{eq:certified_recovery_formulation}, \ref{eq:certified_detection_formulation} for each pixel $x_{i, j}$. It gives us a lower bound on attacker objective under any adversarial patch attack from $\mathcal{P}$.

\section{Demasked Smoothing} \label{section:demasked_smoothing}
\everypar{\looseness=-1}

\textsc{Demasked Smoothing} (Figure \ref{fig:intro_pic}) consists of several steps. First, we apply a predefined set of masks with specific properties to the input image to obtain a set of masked images. Then we reconstruct the masked regions of each image based on the available information with an inpainting model $g$. After that we apply a segmentation model $f$ to the demasked results. Finally, we aggregate the segmentation outcomes and make a conclusion for the original image with respect to the statements \eqref{eq:certified_recovery_formulation} or \eqref{eq:certified_detection_formulation}.

\subsection{Input masking}
\label{section:input_masking}

\begin{figure}[t]
	\centering
	\begin{subfigure}{0.20\linewidth}
		\includegraphics[width=\linewidth]{graphics/masking_1/orig_000000011968.jpg}
		\caption{original image}
		\label{fig:masking_orig}
	\end{subfigure}
	\begin{subfigure}{0.18\linewidth}
		\includegraphics[width=\linewidth]{graphics/rec_2.png}
		\caption{$T=2$}
		\label{fig:rec_2_scheme}
	\end{subfigure}
	\begin{subfigure}{0.20\linewidth}
		\includegraphics[width=\linewidth]{graphics/masking_1/masked_image_0000.jpg}
		\caption{column mask}
		\label{fig:rec_2_example}
	\end{subfigure}
	\begin{subfigure}{0.18\linewidth}
		\includegraphics[width=\linewidth]{graphics/rec_3.png}
		\caption{$T=3$}
		\label{fig:rec_3_scheme}
	\end{subfigure}
	\begin{subfigure}{0.20\linewidth}
		\includegraphics[width=\linewidth]{graphics/masking_1/masked_image_0004.jpg}
		\caption{3-mask}
		\label{fig:rec_3_example}
	\end{subfigure}
	\begin{subfigure}{0.18\linewidth}
		\includegraphics[width=\linewidth]{graphics/rec_4.png}
		\caption{$T=4$}
		\label{fig:rec_4_scheme}
	\end{subfigure}
	\begin{subfigure}{0.20\linewidth}
		\includegraphics[width=\linewidth]{graphics/masking_1/masked_image_0003.jpg}
		\caption{4-mask}
		\label{fig:rec_4_example}
	\end{subfigure}
	\begin{subfigure}{0.23\linewidth}
		\includegraphics[width=\linewidth]{graphics/masking_1/masked_image_0018.jpg}
		\caption{detection column}
		\label{fig:det_col}
	\end{subfigure}
	\begin{subfigure}{0.23\linewidth}
		\includegraphics[width=\linewidth]{graphics/masking_1/masked_image_0002_det.jpg}
		\caption{detection row}
		\label{fig:det_row}
	\end{subfigure}
	\caption{\label{fig:masking} examples of a mask for the column masks with $T=2$  (b, c), 3-mask with $T=3$ (d, e), and 4-mask with $T=4$ (f, g) with the number of masks $K=5,7,9$ respectively. The number of a block denotes in which mask it is not masked (there is only one such mask for each block). For each mask set, we show one of the locations $l$ in which an adversarial patch affects $T$ different maskings.}
\end{figure}

\textbf{Motivation.} Like in previous work (Section \ref{section:related_work}) we apply masking patterns to the input image and use predictions on masked images to aggregate the robust result. If an adversarial patch is completely masked, it has no effect on further processing. However, in semantic segmentation, we predict not a single whole-image label like in the classification task, but a separate label for each pixel. Thus, making prediction on a masked image must allow us to predict the labels also for the masked pixels.

\textbf{Preliminaries.} Consider an image $x \in [0, 1]^{H\times W\times C}$. We define "$*$" to be a special masking symbol that does not correspond to any pixel value and has the property that $\forall z \in \mathbb{R}:\ z \times * = *$. Let $m \in \{*, 1 \}^{H\times W}$ be a mask. We call the element-wise product $x \odot m$ a \emph{masking} of $x$ where a subset of pixels is hidden with * and the rest remains unchanged. We consider the threat model $\mathcal{P}$ with patches of size $H^\prime \times W^\prime$ (Section \ref{section:threat_model}).  We say that a mask $m$ \emph{covers} a patch $(p, l)$ if $\forall\ 1\leq i \leq H, 1 \leq j \leq W:\ (l \odot m)_{i,j} \neq 1$. It means that the patch content has no effect on the masked image i. e.\ $A(x,\ p,\ l) \odot m = x \odot m$. We divide the image $x$ into a set $B$ of non-intersecting blocks having the same size $H^\prime \times W^\prime$ as the adversarial patch $(p, l)$. $B=\{b_{q, r}\}$, $1 \leq q \leq \lceil H / H^\prime \rceil$, $1 \leq r \leq \lceil W / W^\prime \rceil$. We consider a set $M$ of $K$ masks, $|M|=K$. We refer to the masks in the set $M$ by their index $k$ as $M[k]$. To each mask $M[k]$ we assign a subset of blocks $B_k \subset B$ that are not covered in this mask while the blocks $B \setminus B_k$ are covered. We construct the masks so that each block is not covered in exactly one mask. We explain the reason for this in Section \ref{section:certification}. For a mask set $M$ we define its \emph{strength} $T(M)$ as $T(M) = \max_{(p, l) \in \mathcal{P}} \vert \{m \in M\ | A(x,\ p,\ l) \odot m \neq x \odot m \} \vert$. $T(M)$ is the largest number of masks that can be affected by some patch. If $M$ is defined, we refer to the value $T(M)$ as $T$ for simplicity of notation.

\textbf{Certified recovery.} We define a set of column masks for which $T=2$. We assign every $k$-th column to be not covered in the mask $M[k]$ (Figure \ref{fig:rec_2_example}). Any $(p, l) \in \mathcal{P}$ can intersect at most two adjacent columns since $(p, l)$ has the same width as a column. Thus, it can be not covered in at most two masks (Figure \ref{fig:rec_2_scheme}). A similar scheme can be proposed for the rows. Due to the block size in $B$, the patch $(p, l)$ cannot intersect more than four blocks at once. We define a mask set that we call \emph{3-mask} s. t. for any four adjacent blocks two belong to the same mask (Figures \ref{fig:rec_3_scheme}). Hence $T=3$ for 3-mask. See details in Appendix \ref{appendix:masking_strategies}. To achieve $T=4$ any assignment of blocks to the masks works. We consider \emph{4-mask} that allows uniform distribution of the unmasked blocks in the image (Figure \ref{fig:rec_4_scheme}).

\textbf{Certified detection.} We define $M_d = \{M_d[k]\}_{k=1}^K$  to be a set of masks s. t.\ for $\forall\ (p, l) \in \mathcal{P}\ \exists\ m \in M_d: A(x,\ p,\ l) \odot m = x \odot m$ i. e.\ for every patch exists at least one mask that covers this patch. For a patch of size $H^\prime \times W^\prime$ we consider $K=W - W^\prime + 1$ masks such that the mask $M_d[k]$ masks a column of width $W^\prime$ starting at the horizontal position $k$ in the image (Figure \ref{fig:det_col}). To obtain the guarantee for the same $\mathcal{P}$ with a smaller $K$, we consider a set of strided columns of width $W^{\prime\prime} \geq W^\prime$ and stride $W^{\prime\prime} - W^\prime + 1$ that also satisfy the condition (see the proof adapted from PatchCleanser\cite{xiang2021patchcleanser} in Section \ref{appendix:strided_proof} in the Appendix). A similar scheme can be proposed for the rows (Figure \ref{fig:det_row}). Alternatively, we could use a set of block masks of size $H^\prime \times W^\prime$. Then the number of masks grows quadratically with the image resolution. Therefore, in the experiments we focus on the column and the row masking schemes.

Let $g$ be a demasking model, $g(x \odot m) \in [0, 1]^{H\times W\times C}$. The goal of $g$ is to make the reconstruction $g(x \odot m)$ as close as possible to the original image $x$. For a segmentation model $f$ we define a \emph{segmentation set} $S(M, x, g, f):=\{S[k] = f(g(x \odot M[k]))\ |\ M[k] \in M \}$.

\subsection{Certification}
\label{section:certification}

\textbf{Certified recovery.} For the threat model $\mathcal{P}$ consider a set $M$ of $K$ masks with some strength $T$. We define a function $h: \mathcal{X} \rightarrow \mathbb{S}$ that assigns a label to the pixel $x_{i, j}$ via majority voting over labels assigned at each reconstructed segmentation $s \in S$. A class for the pixel that is predicted by the largest number of segmentations is assigned. We break the ties by assigning a class with a smaller index.
\begin{theorem} \label{th:recovery}
	If the number of masks $K$ satisfies $K \geq 2T + 1$ and for a pixel $x_{i, j}$ we have $\forall\ S[k] \in S:\ S[k]_{i, j} = h(x)_{i, j}$ (i.e.\ all the votes agree), then $\forall\ (p,\ l) \in \mathcal{P}:\ h(A(x, p, l))_{i, j}=h(x)_{i, j}$
\end{theorem}
\begin{proof}
	Assume that $\exists\ (p,\ l) \in \mathcal{P}$ s. t.\ $h(A(x, p, l))_{i, j} \neq h(x)_{i, j}$. Let us denote $x^\prime=A(x, p, l)$ and $S^\prime$ as the segmentation set for $x^\prime$. Then the class $h(x)_{i, j}$ did not get the majority vote for $S^\prime$. However, by definition of $T$ we know that $(p,\ l)$ could affect at most $T$ segmentations. Since all $K$ segmentations of $S$ have voted for $h(x)_{i, j}$, then at least $K - T > K / 2$ of them are still voting for $h(x)_{i, j}$ in $S^\prime$. Therefore $h(x^\prime)_{i, j} = h(x)_{i, j}$
\end{proof}

In Section \ref{section:input_masking} we said that by construction each block is not covered in exactly one mask. Assume that two masks keep the same block of the image unmasked. By placing a patch so that it intersects this block, the attacker can affect both of the corresponding segmentations. Thus, they can be counted as one when computing $T(M)$. It would result in producing redundant segmentations that do not affect the certification. Therefore, we consider the case of masks with non-overlapping visible blocks in Section \ref{section:input_masking}. Since each masking keeps approximately $1/K$ of the image pixels visible, we are interested in keeping $K$ as small as possible to maintain more visual information for the demasking model $g$. Thus, for the evaluation of masking schemes with $T=2,3,4$ we use the smallest possible values of $K=5,7,9$ respectively (Figure \ref{fig:masking}). We observe that although for $T=2$ we can keep a larger fraction of pixels unmasked, $T=3,4$ provide visible blocks that are spread in the image more uniformly. We evaluate these masking approaches in Section \ref{section:experiments}.

\textbf{Certified detection.} Consider $M_d = \{M_d[k]\}_{k=1}^K$. For a set of demasked segmentations S we define the verification map $v(x)_{i, j} := [f(x)_{i, j} = S[1]_{i, j} = \ldots = S[K]_{i, j}]$.
\begin{theorem} \label{th:detection}
	Assume that $v(x)_{i, j} = 1$. Then $\forall\ (p,\ l) \in \mathcal{P}: v(A(x, p, l))_{i, j}=1 \Rightarrow f(A(x,\ p,\ l))_{i, j} = f(x)_{i,j} $
\end{theorem}
\begin{proof}
	Assume that $\exists\ (p,\ l) \in \mathcal{P}$ s. t.\ $v(A(x, p, l))_{i, j}=1$ and $f(A(x,\ p,\ l))_{i, j} \neq f(x)_{i,j}$.Let us denote $x^\prime=A(x, p, l)$ and $S^\prime$ as the segmentation set for $x^\prime$. By definition of $M_d$, $\exists\ M_d[k] \in M_d$ s. t.\ $M_d[k]$ masks the patch $(p,\ l)$. Hence,
 $$g(x \odot M_d[k])=g(x^\prime \odot M_d[k]),$$
 $$S[k] = f(g(x \odot M_d[k])) = f(g(x^\prime \odot M_d[k])) = S^\prime[k],$$
Since $v(x)_{i, j} = 1$, we have $f(x)_{i, j} = S[k]_{i, j}$. Since $v(x^\prime)_{i, j} = 1$, we have $f(x^\prime)_{i, j} = S^\prime[k]_{i, j}$. Thus,  $f(x^\prime)_{i, j} = f(x)_{i,j}$.
\end{proof}

For a given image $x$ the verification map $v(x)$ is complementary to the of the model segmentation output $f(x)$ that stays unchanged. Thus, there is no drop in clean performance.

\section{Experiments} \label{section:experiments}

In this section, we evaluate \textsc{Demasked Smoothing} with the masking schemes proposed in Section \ref{section:demasked_smoothing}. Certified recovery and certified detection provide certificates of different strength (Section \ref{section:demasked_smoothing}) which are not comparable. We evaluate them separately for different patch sizes.

\subsection{Experimental Setup}
\label{section:experimental_setup}

\begin{figure}[t]
	\centering
	\begin{subfigure}{0.24\linewidth}
		\includegraphics[width=\linewidth]{graphics/reconstruction/recovery/orig_000000007601.jpg}
		\caption{original image}
		\label{fig:orig}
	\end{subfigure}
	\begin{subfigure}{0.24\linewidth}
		\includegraphics[width=\linewidth]{graphics/reconstruction/recovery/masked_image_0000.jpg}
		\caption{recovery masking}
		\label{fig:masked_rec}
	\end{subfigure}
	\begin{subfigure}{0.24\linewidth}
		\includegraphics[width=\linewidth]{graphics/reconstruction/recovery/rec_000000007601_00000.jpg}
		\caption{recovery demasking}
		\label{fig:inp_rec}
	\end{subfigure}
	\begin{subfigure}{0.24\linewidth}
		\includegraphics[width=\linewidth]{graphics/reconstruction/recovery/rec_000000007601_00000_segm.jpg}
		\caption{recovery segmentation}
		\label{fig:inp_rec_segm}
	\end{subfigure}
	\begin{subfigure}{0.24\linewidth}
		\includegraphics[width=\linewidth]{graphics/reconstruction/recovery/000000007601_gt.jpg}
		\caption{ground truth}
		\label{fig:inp_gt}
	\end{subfigure}
	\begin{subfigure}{0.24\linewidth}
		\includegraphics[width=\linewidth]{graphics/reconstruction/detection/masked_image_0002.jpg}
		\caption{detection masking}
		\label{fig:masked_det}
	\end{subfigure}
	\begin{subfigure}{0.24\linewidth}
		\includegraphics[width=\linewidth]{graphics/reconstruction/detection/rec_000000007601_00002.jpg}
		\caption{detection demasking}
		\label{fig:inp_det}
	\end{subfigure}
	\begin{subfigure}{0.24\linewidth}
		\includegraphics[width=\linewidth]{graphics/reconstruction/detection/rec_000000007601_00002_segm.jpg}
		\caption{detection segmentation}
		\label{fig:inp_det_segm}
	\end{subfigure}
	\caption{ Reconstructing the masked image with ZITS \cite{dong2022incremental} and segmenting with Senformer \cite{senformer}}
	\label{fig:inpainting}
\end{figure}

We evaluate \textsc{Demasked Smoothing} on two challenging semantic segmentation datasets: ADE20K \citep{zhou2017scene} and COCO-Stuff-10K \citep{caesar2018coco} having 150 and 171 semantic classes respectively. Validation sets of ADE20K and COCO-Stuff-10K consist of 2000 and 1000 images respectively. For demasking we use the ZITS \cite{dong2022incremental} inpainting model. We use the checkpoint provided in the official paper repository \footnote{\url{https://github.com/DQiaole/ZITS_inpainting}}. The model was trained on Places2 \citep{places2} dataset with images resized to 256$\times$256.  As a segmentation model $f$ we use Senformer \cite{senformer}, Swin \cite{liu2021Swin}, PSPNet \cite{zhao2017pspnet} and DeepLab v3 \citep{deeplabv3plus2018} (see Section \ref{appendix:additional_coco} in the Appendix for full experimental results). We note that the first two models are based on transformers and obtain near state-of-the-art result on the considered datasets. PSPNet and DeepLab v3 are CNN-based segmentation method that we consider to demonstrate that \textsc{Demasked Smoothing} is not specific to transformer-based architectures and can be applied to an arbitrary segmentation model. We use the segmentation model implementations provided in the \emph{mmsegmentation} framework \cite{mmseg2020}. For each architecture we select the best performing checkpoint. An illustration of the image reconstruction and respective Senformer segmentation can be found in Figure \ref{fig:inpainting}. Since evaluation on different images can be parallelized, we split the images equally among 5 Nvidia Tesla V100-32GB GPUs. The certification for the whole ADE20K validation set with ZITS and Senformer takes around 1.2 hours for certified recovery and 2 hours for certified detection (due to a larger number of masks). We point out that we did not focus on reaching the fastest possible execution time and it can be further improved by speeding up the corresponding modules. We provide more details in the Appendix.

\subsection{Evaluation metrics}
\label{section:evaluation_metrics}

For both certified recovery and certified detection we produce a standard segmentation output (without any abstentions) and a corresponding certification map (Figure \ref{fig:cert_map}). In case of certified detection, the segmentation output remains the same as for the original segmentation model. For the certified recovery, the output is obtained by a majority vote over the segmentations of demasked images (Section \ref{section:certification}) and is different from the original model output. We evaluate the mean intersection over union (mIoU) for these outputs. The certification map is obtained by assigning to each certified pixel the corresponding class from the segmentation output and assigning a special \emph{uncertified} label to all non-certified pixels. For each image we evaluate the fraction of pixels which are certified and correct (coincide with the ground truth). \%C is a mean of these fractions over all the images in the dataset. However, in semantic segmentation task, the class frequencies are usually skewed, therefore global pixel-wise accuracy alone is an insufficient metric.

Matching the certification map separately for each class with the ground truth segmentation of this class in the image allows us to compute the guaranteed lower bound ($cTP$) on the number of per-class true positive pixel predictions ($TP$) i.e.\ those that were correctly classified into this class. If a pixel was certified with a correct class, then this prediction cannot be changed by a patch (or, alternatively, the change will be detected by the verification function $v$ in certified detection). We consider per-class \emph{recall} $R=TP / (TP + FN)$ where $FN$ is the number of false negative predictions for this class. $P = TP + FN$ is the total area of a given class in the ground truth and does not depend on our prediction. We can evaluate \emph{certified recall} $cR= cTP / P$ which is a lower bound on recall $R$. For each class we compute its total recall in the dataset by dividing the total number of $TP$ pixels for all images over the total $P$. By averaging this number among all classes we evaluate \emph{mean recall} mR and its lower bound \emph{certified mean recall} cmR. Evaluating lower bounds on other popular metrics such as mean precision or mIoU cannot be done this way since they depend on the upper bound on false positive ($FP$) predictions. For the pixels that are not certified we cannot guarantee that they will not be assigned to a certain class, therefore, a non-trivial upper bound on $FP$ cannot be achieved. We leave this direction for future work.

Due to our threat model, certifying small objects in the scene can be difficult because they can be partially or completely covered by an adversarial patch in a way that there is not chance to recover the prediction. To provide an additional perspective on our methods, we also evaluate their mR and cmR specifically for the ``big'' classes, which occupy on average more than 20\% of the image in which they appear. These are, for example, road, building, train, and sky, which are important for understanding the scene. The full list of such classes for each dataset is provided in the Appendix.

\begin{table}
	\caption{\label{tab:det} The certified detection results(\%) for a patch occupying no more than 1\% of the image. mIoU - mean intersection over union, mR - mean recall, cmR - certified mean recall. \%C - mean percentage of certified and correct pixels in the image. mIoU and mR are the clean model metrics.}
	\vspace{+2mm}
	\centering
	\begin{tabular}{lll|c|cc|cc|c}
		\toprule
		\multirow{2}{*}{dataset} & \multirow{2}{*}{segm} & \multirow{2}{*}{mask} & \multirow{2}{*}{mIoU} & \multicolumn{2}{c|}{big} & \multicolumn{2}{c|}{all} & \multirow{2}{*}{\%C} \\
		& & & & mR & cmR & mR & cmR & \\
		\midrule
		\multirow{6}{*}{ADE20K \citep{zhou2017scene}} & \multirow{2}{*}{Senformer \citep{senformer}} & col & \multirow{2}{*}{53.08} & \multirow{2}{*}{70.19} & \textbf{59.95} & \multirow{2}{*}{63.98} & \textbf{32.90} & \textbf{64.36} \\
		& & row & & & 51.23 & & 26.48 & 59.30 \\
		\cmidrule{2-9}
		& \multirow{2}{*}{PSPNet \citep{zhao2017pspnet}} & col & \multirow{2}{*}{44.39} & \multirow{2}{*}{61.83} & \textbf{50.02} & \multirow{2}{*}{54.74} & \textbf{26.37} & \textbf{60.57} \\
		& & row & & & 42.44 & & 19.88 & 54.62 \\
		\cmidrule{2-9}
		& \multirow{2}{*}{Swin \citep{liu2021Swin} } & col & \multirow{2}{*}{48.13} & \multirow{2}{*}{68.51} & \textbf{55.45} &  \multirow{2}{*}{59.13} & \textbf{29.06} & \textbf{61.44} \\
		& & row & & & 47.21 & & 22.04 & 55.93 \\
		\midrule
		\multirow{2}{*}{COCO10K \citep{caesar2018coco}} & \multirow{2}{*}{Senformer \citep{senformer}} & col & \multirow{2}{*}{49.13} & \multirow{2}{*}{77.46} & \textbf{63.68} &  \multirow{2}{*}{61.31} & \textbf{36.05} & \textbf{53.96} \\
		& & row & & & 56.86 & & 31.67 & 50.02 \\
		\bottomrule
	\end{tabular}
\end{table}

\begin{figure}[t]
	\centering
	\begin{subfigure}{0.22\linewidth}
		\includegraphics[width=\linewidth]{graphics/cert_map/000000011968_orig.jpg}
		\caption{original image}
		\label{fig:orig_cert}
	\end{subfigure}
	\begin{subfigure}{0.22\linewidth}
		\includegraphics[width=\linewidth]{graphics/cert_map/000000011968_rec.jpg}
		\caption{recovery map}
		\label{fig:rec_cert}
	\end{subfigure}
	\begin{subfigure}{0.22\linewidth}
		\includegraphics[width=\linewidth]{graphics/cert_map/000000011968_cert_det.jpg}
		\caption{detection map}
		\label{fig:det_cert}
	\end{subfigure}
	\begin{subfigure}{0.22\linewidth}
		\includegraphics[width=\linewidth]{graphics/cert_map/000000011968_gt.jpg}
		\caption{ground truth}
		\label{fig:gt}
	\end{subfigure}
	\caption{ Certification maps}
	\label{fig:cert_map}
\end{figure}

\begin{table}[ht]
	\caption{\label{tab:rec} The certified recovery results(\%) against a 0.5\% patch. 3-mask and 4-mask correspond to $T=3$ and $T=4$ respectively (Figure \ref{fig:masking})}
	\vspace{+2mm}
	\centering
	\begin{tabular}{lll|c|cc|cc|c}
		\toprule
		\multirow{2}{*}{dataset} & \multirow{2}{*}{segm} & \multirow{2}{*}{mask} & \multirow{2}{*}{mIoU} & \multicolumn{2}{c|}{big} & \multicolumn{2}{c|}{all} & \multirow{2}{*}{\%C} \\
		& & & & mR & cmR & mR & cmR & \\
		\midrule
		\multirow{12}{*}{ADE20K \citep{zhou2017scene}} &\multirow{4}{*}{Senformer \citep{senformer}} & col & \textbf{24.79} & \textbf{64.91} & \textbf{40.78} & \textbf{29.69} & \textbf{13.23} & \textbf{48.59} \\
		& & row & 14.39 & 42.99 & 20.55 & 17.57 & 5.56 & 32.93 \\
		& & 3-mask & 19.45 & 61.62 & 27.38 & 23.49 & 7.07 & 40.22 \\
		& & 4-mask & 16.45 & 51.81 & 20.51 & 19.88 & 5.51 & 36.55 \\
		\cmidrule{2-9}
		& \multirow{4}{*}{PSPNet \citep{zhao2017pspnet}} & col & \textbf{19.17} & \textbf{51.90} & \textbf{34.11} & \textbf{23.66} & \textbf{10.76} & \textbf{44.90} \\
		& & row & 12.00 & 36.26 & 12.03 & 15.03 & 3.74 & 28.29 \\
		& & 3-mask & 15.00 & 44.93 & 19.55 & 18.41 & 5.58 & 35.85 \\
		& & 4-mask & 12.74 & 40.41 & 15.86 & 15.87 & 4.14 & 31.22 \\
		\cmidrule{2-9}
		& \multirow{4}{*}{Swin \citep{liu2021Swin}} & col & \textbf{22.43} & \textbf{59.75} & \textbf{34.88} & \textbf{27.09} & \textbf{11.70} & \textbf{46.14} \\
		& & row & 13.58 & 42.88 & 15.13 & 16.70 & 4.46 & 30.64 \\
		& & 3-mask & 17.06 & 51.03 & 24.15 & 20.74 & 6.65 & 38.27 \\
		& & 4-mask & 14.77 & 46.67 & 17.74 & 10.05 & 4.72 & 34.04 \\
		\midrule
		\multirow{4}{*}{COCO10K \citep{caesar2018coco}} &\multirow{4}{*}{Senformer \citep{senformer}} & col & \textbf{30.44} & \textbf{71.04} & \textbf{44.66} & \textbf{39.73} & \textbf{15.96} & \textbf{34.83} \\
		& & row & 27.84 & 66.58 & 24.70 & 37.23 & 9.25 & 22.64 \\
		& & 3-mask & 26.54 & 66.61 & 32.68 & 35.24 & 10.64 & 28.82 \\
		& & 4-mask & 25.73 & 66.12 & 29.83 & 34.10 & 8.57 & 24.51 \\
		\bottomrule
	\end{tabular}
\end{table}

\begin{figure}[ht]
	\centering
	\begin{subfigure}{0.49\linewidth}
		\includegraphics[width=\linewidth]{graphics/limitation/limitations_det.png}
		\caption{certified detection}
		\label{fig:limitation_det}
	\end{subfigure}
	\begin{subfigure}{0.49\linewidth}
		\includegraphics[width=\linewidth]{graphics/limitation/limitations_rec.png}
		\caption{certified recovery}
		\label{fig:limitation_rec}
	\end{subfigure}
	\caption{Performance for different adversarial patch sizes evaluated on 200 ADE20K images.}
	\label{fig:limitation}
\end{figure}

\subsection{Discussion}
The results for certified detection and certified recovery can be found in Table \ref{tab:det} and Table \ref{tab:rec} respectively.  In Table \ref{tab:det} we see that for certified detection the column masking (Figure \ref{fig:det_col}) achieves better results than row masking in all settings. For all models we can certify around 60\% of pixels on ADE20K and 50\% on COCO10K. We also achieve 63.68 and 36.05 cmR for the big and all classes respectively on COCO10K with Senformer.  In Table \ref{tab:rec} we see that for certified recovery the column masking ($T=2$, see Section \ref{section:input_masking}) achieves the highest results in all settings. However, row masking that also satisfies $T=2$ achieves worse results than the ones for $T=3,4$ on ADE20K. This suggests that not only the fraction of the image that is visible but also the mask structure affects the certification performance of \textsc{Demasked Smoothing}. For the recovery task, we also observe that majority voting achieves 24.79 mIoU on ADE20K and 30.44 on COCO10K compared to the original model values of 53.08 and 49.13 respectively. For Senformer on ADE20K we can on average certify almost 50\% of the pixels and achieve cmR of 41.78 and 13.23 for big and all classes respectively. Figure \ref{fig:limitation} shows how the performance of \textsc{Demasked Smoothing} depends on the patch size. We see that certified detection metrics remain high even for a patch as big as 5\% of the image surface and for the recovery they slowly deteriorate as we increase the patch size to 2\%.

\subsection{Limitations} \label{section:limitations}

The performance of \textsc{Demasked Smoothing} certified recovery may be insufficient for the downstream task if we certify against big patches (Figure \ref{fig:limitation}) unless robustness is prioritized over clean performance. The certification time that depends on the speed of the reconstruction and segmentation models may exceed the given quota in time-sensitive applications.

\section{Conclusion} \label{section:consclusion}

In this work, we propose the first (to the best of our knowledge) certified defences against patch attacks on segmentation models. We implement them in a framework that we call \textsc{Demasked Smoothing}. Due to its novel design based on masking schemes and image demasking, \textsc{Demasked Smoothing} is compatible with any segmentation model and can on average certify 64\% of the pixel predictions for a 1\% patch in the detection task and 48\% against a 0.5\% patch for the recovery task on the ADE20K dataset.

\textbf{Ethical and Societal Impact} This work contributes to the field of certified defences against physically-realizable adversarial attacks. The proposed approach allows to certify robustness of safety-critical applications such as medical imaging or autonomous driving. The defence might be used to improve robustness of systems used for malicious purposes such as (semi-)autonomous weaponry or unauthorized surveillance. This danger may be mitigated e.g.\ by using a system of sparsely distributed patches which makes certifying the image more challenging. All activities in our organization are carbon neutral, so the experiments performed on our GPUs do not leave any carbon dioxide footprint.

\section*{Acknowledgements}

Matthias Hein is a member of the Machine Learning Cluster of Excellence, EXC number 2064/1 – Project number 390727645 and of the BMBF Tübingen AI Center, FKZ: 01IS18039B.

redpajama_set_name: RedPajamaArXiv


text:
\section{Introduction}\label{sec:intro}
Novae are bright eruptions \cite[]{Pay1957} that occur in the degenerate envelope near the surface of a white dwarf (WD) as a result of accretion of hydrogen rich matter from a donor companion. The accumulating matter slowly raises the subsurface pressure and temperature until eventually igniting the accreted hydrogen in the CNO cycle \cite[]{Shara1981,MacDonald1983}. Since the degeneracy pressure is insensitive to temperature, heating does not cause the envelope to expand, thus, the temperature continues to rise, triggering a thermonuclear runaway (TNR) ejecting the accreted matter \cite[]{Starrfield1972}. It has been established that the manner in which a single nova eruption evolves may vary immensely depending on the system properties, specifically the WD mass and the rate that it accretes mass from its companion \cite[e.g.,][]{Shara1986,Kovetz1988,Livio1988,Kolb2001,Yaron2005,Toonen2014,Hillman2020}. In some cases, these properties may be deduced from observations \cite[e.g.,][]{Schaefer2010,Strope2010,Shara2018}. A nova producing system undergoes extensive secular changes as well. \cite{Hillman2020} have shown that the donor may be eroded over a few Gyr as the result of thousands of nova cycles of accretion and eruption, while the mass of the WD changes very little. They demonstrated this by using a feedback-dominated code designed to follow the evolution of the stellar binary components from an initial state of Roche lobe overflow (RLOF) of a red dwarf (RD) donor onto the surface of a WD accretor. They showed that the mass transfer rate ($\dot{M}$) from the RD to the WD, which had been assumed constant in nearly all earlier simulations \cite[]{Prikov1995,Idan2013,Wolf2013,Hillman2015}, varies over a few orders of magnitude --- rapidly decreasing and then slowly increasing --- during the accretion phase of a single nova cycle i.e., between eruptions. They have also found that $\dot{M}$ evolves slowly over many orders of magnitude throughout the course of thousands of nova cycles, ranging from as high as $\sim10^{-7}M_\odot yr^{-1}$ to low enough as to be considered effectively zero. Different rates of accretion characterize different types of eruptive behavior \cite[]{Collazzi2009,Knigge2011,Dubus2018}, i.e., classical novae (CN), recurrent nova (RN), dwarf nova (DN) and nova-likes (NL).
\cite{Hillman2020} showed that the behavior of their four different models, spanning a vast range of accretion rates throughout evolution, implies that the various types of phenomena do not originate from different types of systems, but rather occur at different evolutionary phases of the same type of system, demonstrating that their models alternate between states of being detached hibernating systems, NLs, DNs and CNs depending on the accretion rate at the time. This paper is a direct continuation of their study,
presenting an in-depth analysis of their results. In addition, included here are three more models as an effort to expand this exercise to consider more massive WDs, and a WD with an oxygen-neon (ONe) core. This study investigates the trends common to all the models, as well as the differences between the models, focusing on determining the key parameters that dominate each of these trends. This includes short term features of the nova cycle that characterize the eruption phase as well the accretion phase, and secular changes over thousands of cycles that slowly erode the RD.  \S\ref{sec:models} describes the seven models and the methods of calculation. The results are in \S\ref{sec:results} followed by a comparison with the results of an ONe core model in \S\ref{sec:ONe}. The conclusions are summarized in \S\ref{sec:conclusions}

\section{Methods and models}\label{sec:models}
All the simulations were carried out with the combined code for simulating the long-term evolution of a binary system producing consecutive nova eruptions \cite[]{Hillman2020}. This code utilizes two originally independent codes that have been modified and combined.
The first simulates the donor component by the use of a hydrostatic stellar evolution code which is designed to follow the evolution of a star from pre-MS all the way through to a WD \cite[]{Kovetz2009}. The data produced by this code was used to build a dense database of donor input parameters to be used in the second code --- a hydrodynamic Lagrangian nova evolution code designed to follow the evolution of hundreds of thousands of complete consecutive nova cycles on the surface of a WD \cite[]{Prikov1995,Epelstain2007,Hillman2015}. \cite{Kalomeni2016} found that regardless of the initial RD age, the ratio of orbital period ($P\rm_{orb}$) to RD mass ($M_{RD}$) for cataclysmic variables (CV) in RLOF remains the same. Since a CV system can emerge in the state of RLOF after numerous different scenarios, for simplicity, in this work each simulation begins with a zero age main sequence (ZAMS) donor filling its Roche lobe (RL). The combined code calculates the rate of mass accretion onto the surface of the WD at each timestep by accounting for orbital momentum change due to magnetic braking (MB) and gravitational radiation (GR) following \cite[]{Paxton2015}:

\begin{equation}\label{eq:JMB}
\dot{J}_{MB}=-1.06\times 10^{20}M_{RD}R_{RD}^4P\rm_{orb}^{-3}
\end{equation}
\begin{equation}\label{eq:JGR}
\dot{J}_{GR}=-\frac{32}{5c^5}\left(\frac{2\pi G}{P\rm_{orb}}\right)^\frac{7}{3}\frac{(M_{RD}M_{WD})^2}{(M_{RD}+M_{WD})^\frac{2}{3}}
\end{equation}
and by accounting for the separation change due to mass lost from the system during each nova eruption by using:
\begin{equation}\label{eq:delta_a}
\Delta{a}=2a\left(\frac{m{\rm_{ej}}-m{\rm_{acc}}}{M_{WD}}+\frac{m\rm_{acc}}{M_{RD}}\right)
\end{equation}
where $\dot{J}_{MB}$ and  $\dot{J}_{GR}$ are the change in orbital angular momentum due to magnetic braking (MB) and gravitational radiation (GR) respectively, $M_{WD}$ and $M_{RD}$ are the masses of the WD accretor and the RD donor respectively, $R_{RD}$ is the radius of the RD, $P\rm_{orb}$ is the orbital period of the binary system, and $m\rm_{acc}$ and $m\rm_{ej}$ are the accreted and ejected masses of the previous nova cycle respectively.
Further description of the method, including the treatment of the irradiated RD for tens to hundreds of years after each nova eruption, may be found in \cite{Hillman2020}, noting that all processes are treated as spherically symmetrical. The implications of this simplification on the irradiated RD means that the increase in the RD's effective temperature on the side near the WD may be higher than calculated here \cite[]{Kovetz1988}, which may increase the enhanced RLOF and therefore, the mass transfer rate in the tens to hundreds of years following an eruption. Justification for treating the effects of irradiation as spherical is based on the calculations of \cite{Kovetz1988} who showed that the thermal timescale is of order $\sim10^4$ seconds, which is very much shorter than the timescale of tens to hundreds of years during which the RD is irradiated due a nova eruption. The RD bloating is adopted from \cite{Kovetz1988} and then parameterized \cite[see][]{Hillman2020}  in order to accommodate for different WD masses.
A total of seven models were analyzed here. The four models ($\#$1 through $\#$4) that are presented in \cite{Hillman2020} in addition to three models ($\#$5 through $\#$7) with a more massive WD ($M_{WD}=1.25M_\odot$) one of which consists of an oxygen-neon (ONe) core. The initial model parameters are summarized in Table \ref{tab:mdls}.

\begin{table
	\begin{center}
		\begin{tabular}{ccccc}
			\hline
			{$\#$}&{Model}&{WD type} &{$M\rm_{WD}[M_\odot]$}& {$M\rm_{RD}[M_\odot]$}\\
			\hline
			{1.}&{$070-070$}&{CO}& {0.70}& {0.70}\\
			{2.}&{$070-045$}&{CO}& {0.70}& {0.45}\\
			{3.}&{$100-070$}&{CO}& {1.0}& {0.70}\\
			{4.}&{$100-045$}&{CO}& {1.0}& {0.45}\\
			{5.}&{$125-070$}&{CO}& {1.25}& {0.70}\\
			{6.}&{$125-045$}&{CO}& {1.25}& {0.45}\\
			{7.}&{$125-045$ (ONe)}&{ONe}& {1.25}& {0.45}\\
			\hline
		\end{tabular}
		\caption{Initial model parameters.\label{tab:mdls}}
	\end{center}
\end{table}

\section{Results}\label{sec:results}

The evolution of the binary masses for the seven models are presented in Figure \ref{fig:Masses}, showing that the three new models with a $1.25M_\odot$ WD (models $\#$5 through $\#$7) behave in a manner similar to the previous four models with less massive WDs --- all of the WD masses remain almost constant while the WDs of models with a $0.45M_\odot$ RD donor lose less mass than the WDs (of equal initial masses) of models with a $0.7M_\odot$ donor. This is because during each nova eruption the WD ejects more mass than it has accreted during the previous accretion phase meaning that the net mass change at the end of each cycle is negative. Since $m\rm_{acc}$ is inversely proportional to $M_{WD}$ \cite[e.g.,][]{Yaron2005}, WDs with more massive companions require a larger number of cycles (accretion phases) in order to erode their RD companion, meaning that they experience more eruptions as well, resulting in a larger total net mass loss.

\begin{figure
	\begin{center}

		{\includegraphics[trim={0.0cm 1.0cm 0.5cm 1.2cm},clip ,
			width=1.0\columnwidth]{masses_7_models_streched.eps}}
		\caption{\label{fig:Masses}Evolution of the WD and RD masses for the seven models.}
	\end{center}
\end{figure}

\begin{figure*
	\begin{center}

	{\includegraphics[trim={0.7cm 0.4cm 1.0cm 1.0cm},clip ,
		width=1.0\columnwidth]{Prec_7_models.eps}}
		{\includegraphics[trim={1.0cm 0.4cm 0.8cm 1.0cm},clip ,
			width=1.0\columnwidth]{Prec_7_models_log.eps}}
		\caption{\label{fig:trec}Recurrence time for the seven models, linear timescale (left) and logarithmic timescale (right).}
	\end{center}
\end{figure*}

\begin{figure*
	\begin{center}

		{\includegraphics[trim={0.5cm 0.0cm 0.5cm 1.5cm},clip ,
			width=1.0\columnwidth]{macc_and_mej_7_models_streched.eps}}

		{\includegraphics[trim={0.5cm 0.0cm 0.5cm 1.5cm},clip ,
			width=1.0\columnwidth]{mej_macc_7_models_streched.eps}}
		\caption{Accreted and ejected masses (left) and the ratio $m{\rm_{ej}}/m{\rm_{acc}}$ (right) for the seven models.\label{fig:mej_macc}}
	\end{center}
\end{figure*}

Although the models with the more massive ($0.7M_\odot$) RDs  experience roughly a factor of two more cycles than do the models with the less massive ($0.45M_\odot$) RDs (when comparing between models with the same initial WD masses) the total evolutionary time is almost the same. This is because the time to erode a RD down to $\sim0.35M_\odot$ constitutes only a small fraction of the time it takes to continue eroding the RD down to $<0.1M_\odot$. Essentially, the total evolutionary time of any $M_{WD}+M_{RD}$ combination model may be determined by the time it takes for the WD to erode a $0.35M_\odot$ RD. This is the source of the "knee" in all the mass curves (WDs and RDs) in Figure \ref{fig:Masses}. The reason for this discrepancy before and after $M_{RD}\simeq0.35M_\odot$ lies in the effect of magnetic braking (MB). When the RD mass falls below $\sim0.35M_\odot$, for which RDs become fully convective, the MB becomes inefficient in removing angular momentum and the binary separation ($a$) decreases at a substantially slower rate. This causes the accretion rate to increase at a slower rate as well, considerably extending the time needed for the WD to accumulate the critical mass ($m\rm_{acc}$) that is needed for triggering a TNR that will lead to a nova eruption. It is noted that for high mass loss rates, roughly higher than a few times $10^{-10}M_\odot yr^{-1}$, the RD will become fully convective at a mass lower than 0.35$M_\odot$ (this is in agreement with e.g., \cite{Howell2001}). Since for RDs approaching 0.35$M_\odot$, the accretion rate does not become this high for most of the accretion time, this effect may only slightly decrease the total time of the accretion phase for these RDs until the RD is somewhat more eroded.

An additional aspect which may be seen in Figure \ref{fig:Masses} is the relation between the total evolutionary times of models with different WD masses. More massive WDs erode their donor down to $<0.1M_\odot$ faster.
The total evolutionary time ($t$) may be estimated as the (average) recurrence time ($t\rm_{rec}$) multiplied by the number of cycles.
$t\rm_{rec}$ is given in Figure \ref{fig:trec}, showing a ten fold decrease in the $t\rm_{rec}$ of the  $1.25M_\odot$ WD models as compared with the $0.7M_\odot$ WD models, while the $t\rm_{rec}$ of $1.0M_\odot$ WD models are in between. The reason for this is because a more massive WD builds up the required critical sub-surface pressure with less accreted mass ($m{\rm_{acc}}$), thus, (for a given accretion rate) less time is needed. This also means that (for a given WD mass) the critical accreted mass required to trigger a TNR is lower as well, as may be seen in the left panel of Figure \ref{fig:mej_macc}, where the curves representing more massive WDs are lower than the curves representing less massive WDs. The ejected mass ($m\rm_{ej}$) shows a similar trend. On the other hand, the general shape of the curves is common to all seven models, expressing that the trend of $m\rm_{acc}$ and $m\rm_{ej}$ changes twice throughout evolution. They begin increasing, reaching a peak doubling their original value when the RD mass reaches roughly ${\sim0.3M_\odot}$. At this point there is a plateau after which they begin to decline. When the RD mass reaches ${\sim0.15M_\odot}$ they resume increasing. This is in correlation with the general trend of the accretion rate, and of $t\rm_{rec}$. The number of cycles may be estimated as $0.35M_\odot$ divided by the (average) $m\rm_{acc}$, giving the total evolutionary time as $t\propto {t\rm_{rec}}/{m\rm_{acc}}$. Although, $t\rm_{rec}$ and $m\rm_{acc}$ both decrease with increasing WD mass, so this simple parameterized calculation does not contribute sufficient information to the trend of the total evolutionary time. However,  ${t\rm_{rec}}/{m\rm_{acc}}\propto\dot{M}\rm_{avg}^{-1}$, means that, $t\propto\dot{M}\rm_{avg}^{-1}$ leading to the conclusion that a shorter total evolutionary time implies a higher total evolutionary average accretion rate. This means that on an evolutionary time scale, models with more massive WDs accrete at higher average rates and  will erode their RD companion faster, \textit{regardless of the RDs initial mass}.

The average accretion rate per model ($\dot{M}\rm_{avg}$), each divided into two epochs, is demonstrated in Figure \ref{fig:Mdot_avg_bfr_aftr}. The squares show $\dot{M}\rm_{avg}$ for the epoch of eroding the RD mass from $0.35M_\odot$ down to $<0.1M_\odot$, showing that a higher initial $M_{WD}$ yields a higher total $\dot{M}\rm_{avg}$ for this part of the evolution, for all the models. On the contrary, the circles representing $\dot{M}\rm_{avg}$  for the earlier evolutionary phase of eroding the donor from its initial mass down to $0.35M_\odot$, show an opposite trend --- the more massive initial WD masses have a slower $\dot{M}\rm_{avg}$. However this has a negligible influence on the total evolutionary time because the total time of this stage, for all seven models, is only a small fraction of the total evolutionary time.

A more detailed examination of the accretion rate, averaged per cycle is given in Figure \ref{fig:Mdot_avg}. The average accretion rate drops about two orders of magnitude when the MB stops, as expected from Figure \ref{fig:Mdot_avg_bfr_aftr}, but it also shows a more subtle change as the RD mass approaches ${\sim0.15M_\odot}$. At such low RD masses, hydrogen burning becomes less efficient, resulting in the radius not contracting with mass loss as efficiently as before. This causes the RLOF to increase, and thus causes $\dot{M}$ to temporarily stray away from its fairly constant secular average rate. It then decreases back to its normal value, until the RD is eroded ($M_{RD}<0.1M_\odot$). The period minimum (discussed later) occurs at $M_{RD}\simeq0.15M_\odot$ as well, for the same reason as the temporary $\dot{M}$ increase.

Remarkably, even though the average accretion rate per cycle (Figure \ref{fig:Mdot_avg}) \textit{and} per epoch (Figure \ref{fig:Mdot_avg_bfr_aftr}) are very similar for all the models, looking closely at the \textit{initial} and \textit{final} accretion rates shows diversity depending strongly on the WD mass. This is presented in Figure \ref{fig:Mdot_i_f} showing that for all the models the initial accretion rate per cycle ($\dot{M}\rm_{init}$) decreases and the final accretion rate per cycle ($\dot{M}\rm_{fin}$) increases seculary, however for the less massive WDs ($0.70M_\odot$) the changes occur faster resulting in these systems reaching a state of accretion rate which is practically zero ($\lesssim10^{-15}\dot{M}yr^{-1}$) at an earlier evolutionary point than the moderate mass WDs ($1.0M_\odot$), and the
massive WDs ($1.25M_\odot$) erode their donor before $\dot{M}$ has a chance to become very low. The trend is the opposite for $\dot{M}\rm_{fin}$ because the longer the accretion phase, the longer time there is for orbital momentum loss to decrease the separation and thus increase $\dot{M}$, resulting in a higher $\dot{M}\rm_{fin}$ for a lower WD mass. Because the trends are opposite, the average rates (Figure \ref{fig:Mdot_avg}) are similar.
\begin{figure
	\begin{center}

		{\includegraphics[trim={0.0cm 0.5cm 0.0cm 0.9cm},clip ,
			width=1.0\columnwidth]{Mdot_avg_bfr_aftr_7_models_2pnls.eps}}
		\caption{The average accretion rate for each of the seven models before ($M_{RD}>0.35M_\odot$) and after ($M_{RD}<0.35M_\odot$) magnetic braking turn-off. \label{fig:Mdot_avg_bfr_aftr}}
	\end{center}
\end{figure}

\begin{figure*
	\begin{center}

		{\includegraphics[trim={0.5cm 0.4cm 0.5cm 1.1cm},clip ,
			width=1.0\columnwidth]{Mdot_avg_7_models.eps}}
{\includegraphics[trim={0.5cm 0.4cm 0.5cm 1.1cm},clip ,
	width=1.0\columnwidth]{Mdot_avg_7_models_log.eps}}
		\caption{The average accretion rate per cycle for the seven models, linear timescale (left) and logarithmic timescale (right).\label{fig:Mdot_avg}}
	\end{center}
\end{figure*}
\begin{figure
	\begin{center}

	{\includegraphics[trim={0.0cm 1.2cm 0.0cm 0.7cm},clip , 			width=1.0\columnwidth]{Mdot_initial_final_top.eps}}
	{\includegraphics[trim={0.0cm 0.15cm 0.0cm 0.9cm},clip , 			width=1.0\columnwidth]{Mdot_initial_final_bottom.eps}}
		\caption{The final (top) and initial (bottom) accretion rate per cycle for the seven models.\label{fig:Mdot_i_f}}
	\end{center}
\end{figure}

\begin{figure*
	\begin{center}

		{\includegraphics[trim={0.5cm 0.0cm 0.5cm 1.1cm},clip ,
			width=1.0\columnwidth]{MRD_Porb.eps}}

		{\includegraphics[trim={0.5cm 0.0cm 0.5cm 1.1cm},clip ,
			width=1.0\columnwidth]{MRD_a.eps}
		\caption{\label{fig:MRD_a_Porb}Donor mass evolution vs. orbital period (left) and binary separation (right) for the seven models.}
	\end{center}
\end{figure*}

The accretion rate is strongly dependent on the binary separation (and orbital period) \cite[]{Ritter1988,Livio1994b,Kolb2001,Hillman2020} which show a clear trend in Figure \ref{fig:MRD_a_Porb} --- the RD mass determines $P\rm_{orb}$. All three of the models with a $0.7M_\odot$ RD begin the simulation with an orbital period of $\sim6$ hours, regardless of the WD mass (the curves overlap) and the period decreases with decreasing RD mass. When these RD masses are eroded down to ${\sim0.45M_\odot}$, their curves coincide with the overlapping curves of all the models with initial $0.45M_\odot$ RDs, that began with $P\rm_{orb}\sim3.5$ hours. The reason for the WD to be having a negligible influence on determining $P\rm_{orb}$ is that in close RLOF CVs, $R_{RL}\approx R_{RD}$. The results for the models explored in this work yield quite a narrow range of RL radii for the initial models, ranging from ${\sim0.3a}$ to ${\sim0.4a}$\footnote{The entire range of $R_{RL}$ for $0<q<\infty$ is $0<R_{RL}<0.82$ \cite[]{Eggleton1983} implying that most $R_{RL}$ in RLOF CVs would not be far from the above mentioned narrow range.}. This range is a result of the varying $q$ ($M_{RD}/M_{WD}$) which determines the relation between the separation and the RL radius via \cite[e.g.,][eq.2]{Eggleton1983}:
\begin{equation}
\frac{R_{RL}}{a}=\frac{0.49q^{\frac{2}{3}}}{0.6q{\frac{2}{3}}+{\rm{ln}}(1+q^{\frac{1}{3}})}
\end{equation}
which is the only way the WD has an effect on determining the separation. This is apparent in the right panel of Figure \ref{fig:MRD_a_Porb} as the spaces between curves with different WD masses. These spaces are (nearly) absent in the orbital period curves, because of Kepler's third law which dictates the relation $P{\rm_{orb}}\propto(a^3/(M_{WD}+M_{RD}))^{1/2}$ thus compensating for the differences in the WD mass and eliminating almost entirely the dependence of the orbital period on the WD mass.
All seven of the $P\rm_{orb}$ curves continue to decrease, in identical fashion, until reaching the minimum orbital period of $\sim1.4$ hours for a RD mass of $\lesssim0.15M_\odot$. From this point $P\rm_{orb}$ remains fairly constant until the end of the simulation, at $M_{RD}\lesssim0.1M_\odot$. The minimal period is the result of the transition of the RD donor from a star to a sub-stellar object. For a RD with a mass as low as $\lesssim0.15M_\odot$, hydrogen burning starts to become less efficient, approaching the brown dwarf limit. For the stellar mass-radius relation, $R\propto M^\alpha$, $\alpha$ begins to transition from order $\sim1$, which is characteristic of main sequence stars, to $\sim-\dfrac{1}{3}$, which is characteristic of degenerate objects. This means that for these extremely low mass RDs, the radius does not contract with mass loss as efficiently as before, halting the decrease in the orbital period \cite[]{Howell2001,King2002,Knigge2011a,Knigge2011}.

Although the relation between the RD mass and the orbital period is almost linear for almost the entire evolution, it does not reflect the detection probability of systems with different orbital periods. As discussed earlier and shown in Figure \ref{fig:trec} (see right panel), after the MB turns off, the time between eruptions ($t\rm_{rec}$) increases drastically. Since this type of system is only detected during eruption, systems with long $t\rm_{rec}$ --- i.e., systems that rarely erupt --- will rarely be detected. These systems comprise of RDs below the MB turn-off, i.e., with masses below $\sim0.35M_\odot$ which, as seen in Figure \ref{fig:MRD_a_Porb}, is correlated with orbital periods below $\sim3$ hours. Figure \ref{fig:Erup_Porb} shows the percentage of eruptions (total number of eruptions that occurred within each $P\_{orb}$ bin divided by the total evolutionary number of eruption for each model) that occur within each $P\_{orb}$ bin, exhibiting a dip in the percentage of eruptions in the regime of roughly $\sim2-3$ hours (see also figures 3 and 4 in \cite{Hillman2020}). This is in agreement with the period gap, within which a relatively small number of systems have been discovered \cite[e.g.,][]{Knigge2011}.

\begin{figure
	\begin{center}
		{\includegraphics[trim={0.7cm 1.0cm 1.2cm 0.1cm},clip ,
			width=1.0\columnwidth]{Eruptions_vs_Porb_7pnls.eps}}
		\caption{Percentage of eruptions vs. orbital period. \label{fig:Erup_Porb}}
	\end{center}
\end{figure}

\begin{figure
	\begin{center}

		{\includegraphics[trim={0.5cm 0.0cm 0.0cm 0.3cm},clip ,
			width=1.0\columnwidth]{Teffmin_rvrsd.eps}}
		\caption{\label{fig:Teff}Minimal WD effective temperature for the seven models.}
	\end{center}
\end{figure}

In addition,  Figure \ref{fig:Teff} presents the minimal WD effective temperature ($T\rm_{eff}$) per cycle, showing that its behavior follows the behavior of the accretion rate --- higher for higher accretion rates, and therefore, for less accreted mass and vice versa. This is because lower accretion rates produce stronger TNRs, causing more of an expansion of the outer layers of the WD than for faster accretion rates. When the outer layers expand, the effective temperature decreases, which means that lower accretion rates result in lower minimum effective temperatures (for a given WD mass).
For the same reason, lower accretion rates lead to the ejection of more mass than do higher accretion rates. The critical $m\rm_{acc}$ takes more time to accumulate, thus allowing more time to mix deeper into the envelope \cite[]{Prialnik1984,Prialnik1986,Iben1992}, resulting in a stronger TNR and a higher ratio $m{\rm_{ej}}/m\rm_{acc}$. This ratio is shown in Figure \ref{fig:mej_macc} (right) where all the models have a substantially higher ratio $m{\rm_{ej}}/m\rm_{acc}$ for the evolutionary epoch of $M_{RD}\gtrsim0.35M_\odot$ than for the evolutionary epoch of $M_{RD}\lesssim0.35M_\odot$, which is explained as follows.

As presented in Figure \ref{fig:Mdot_avg_bfr_aftr}, the accretion rate for $M_{RD}\gtrsim0.35M_\odot$ is of order $\sim10^{-9}-10^{-8}M_\odot yr^{-1}$ and for $M_{RD}\lesssim0.35M_\odot$ it is of order $\sim10^{11}-10^{-10}M_\odot yr^{-1}$. Examining models from \cite{Yaron2005} which are closest to the models presented here (i.e., $M_{WD}=$0.65, 1.0 and 1.25$M_\odot$ for $\dot{M}=10^{-8}$, $10^{-9}$, $10^{-10}$ and $10^{-11}M_\odot yr^{-1}$) and comparing the ratio $m{\rm_{ej}}/m\rm_{acc}$ between their models, yields that for identical WD mass and accretion rate, the ratio $m{\rm_{ej}}/m\rm_{acc}$ depends on the core temperature ($T_c$) of the WD. For $T_c=3\times10^7$[K] their ratio $m{\rm_{ej}}/m\rm_{acc}$ is higher than for $T_c=1\times10^7$[K].
The $T_c$ of all the models was followed throughout evolution and presented in Figure \ref{fig:TcTmax}, showing that it begins at $3\times10^7$[K] and declines in the same manner as the ratio $m{\rm_{ej}}/m\rm_{acc}$, reaching $<1\times10^7$[K] at around the same time that the ratio $m{\rm_{ej}}/m\rm_{acc}$ declines from its high value and stabilizes at roughly $1.1$, consistent with the behavior of the models from \cite{Yaron2005}.

Figure \ref{fig:TcTmax} also shows the maximal WD temperature ($T\rm_{max}$) per cycle, which is correlated with the accreted mass. As explained earlier, more accreted mass means that there was more time for accretion (due to a lower accretion rate). This allows more time for heavy elements (mainly carbon) to be dredged up from the core into the envelope, thus raising the burning temperature and leading to a more powerful TNR. This is exhibited as increases and decreases in $T\rm_{max}$, following the trend of the accreted mass. Although, the more substantial difference in $T\rm_{max}$ exhibited in Figure \ref{fig:TcTmax} is between models of different WD masses --- the $T\rm_{max}$ for models with $M_{WD}=0.70M_\odot$ reaches at most only $\sim1.4\times10^8$[K] while for models with $M_{WD}=1.25M_\odot$ the  $T\rm_{max}$ reaches as high as $\sim2.5\times10^8$[K].

\begin{figure
	\begin{center}

		{\includegraphics[trim={0.0cm 0.0cm 0.0cm 0.0cm},clip ,
			width=1.0\columnwidth]{Tc_Tmax_7_stretched.eps}}
		\caption{\label{fig:TcTmax}WD temperature for the seven models. Left axis: maximum envelope temperature ($T{\rm_{max}}$); Right axis: core temperature ($T_c$).}
	\end{center}
\end{figure}

To further demonstrate the independence of the WD temperature evolution from the RD mass, Figure \ref{fig:TempProf} shows depth profiles of the WD temperature at various points in time throughout evolution. The left panel shows the temperature evolution of the 0.70$M_\odot$ WDs for models with different initial RD masses (models $\#1$ and $\#2$), showing that the curves of the two models coincide and for both models there is a general cooling of the core over time (which is a feature that is evident from Figure \ref{fig:TcTmax} as well). In contrast, the right panel of Figure \ref{fig:TempProf} shows the temperature evolution of the different WD masses in the models with an initial RD mass of 0.7$M_\odot$ (models $\#1$, $\#3$ and $\#5$), all exhibiting a general cooling, but each model developing differently. The less massive WDs have a deeper envelope, a lower maximal temperature ($T{\rm_{max}}$) and less of a change in $T{\rm_{max}}$ throughout evolution.

\begin{figure*
	\begin{center}

		{\includegraphics[trim={0.6cm 1.6cm 0.37cm 0.7cm},clip ,
			width=1.0\columnwidth]{Temp_depth_070_all.eps}}

		{\includegraphics[trim={0.6cm 1.6cm 0.37cm 0.7cm},clip ,
			width=1.0\columnwidth]{Temp_depth_all_070.eps}}
		\caption{\label{fig:TempProf}WD temperature vs. depth at several points in time of the evolution for the two models with a common initial WD mass of $0.7M_\odot$ (left) and for the three models with a common initial RD mass of $0.7M_\odot$ (right).}
	\end{center}
\end{figure*}

\begin{figure
	\begin{center}

		{\includegraphics[trim={0.0cm 0.0cm 0.0cm 0.0cm},clip ,
			width=1.0\columnwidth]{X_Y_Z_ej_7_models_3panels_ver.eps}}
		\caption{\label{fig:Xej_Yej_Zej}Mass fractions of hydrogen (top), helium (middle) and heavy element (bottom) abundances in the ejecta for the seven models.}
	\end{center}
\end{figure}

\begin{subfigures}\label{fig:Abundances}
\begin{figure
	\begin{center}

		{\includegraphics[trim={0.0cm 0.0cm 0.0cm 0.0cm},clip ,
			width=1.0\columnwidth]{Abundances_1.eps}}
		\caption{\label{fig:Abundances1}Heavy element abundances in the ejecta.}
	\end{center}
\end{figure}
\begin{figure
	\begin{center}

		{\includegraphics[trim={0.0cm 0.0cm 0.0cm 0.0cm},clip ,
			width=1.0\columnwidth]{Abundances_2.eps}}
		\caption{\label{fig:Abundances2}Heavy element abundances in the ejecta --- cont.}
	\end{center}
\end{figure}
\begin{figure
	\begin{center}

		{\includegraphics[trim={0.0cm 0.0cm 0.45cm 0.1cm},clip ,
			width=1.0\columnwidth]{Abundances_3.eps}}
		\caption{\label{fig:Abundances3}Heavy element abundances in the ejecta --- cont.}
	\end{center}
\end{figure}
\begin{figure
	\begin{center}

		{\includegraphics[trim={0.0cm 0.0cm 0.0cm 0.0cm},clip ,
			width=1.0\columnwidth]{Abundances_4.eps}}
		\caption{\label{fig:Abundances4}Heavy element abundances in the ejecta --- cont.}
	\end{center}
\end{figure}
\end{subfigures}

As shown earlier, the ratio of ejected to accreted mass, demonstrates how in certain perspectives, the differences between models are small, while the evolutionary changes are substantial.
The ejecta composition shares some of these common features, while emphasizing some of the differences. Figure \ref{fig:Xej_Yej_Zej} shows the hydrogen ($X\rm_{ej}$) helium ($Y\rm_{ej}$) and heavy element ($Z\rm_{ej}$) abundances (${X\rm_{ej}+Y\rm_{ej}+Z\rm_{ej}=1}$) in the ejecta per eruption. All the curves in all three panels behave like the ratio $m{\rm_{ej}}/m\rm_{acc}$ (Figure \ref{fig:mej_macc}, right) --- a sharp difference between the early behavior and the behavior for the rest of the evolution --- when the ratio $m{\rm_{ej}}/m\rm_{acc}$ is high, the heavy element abundance in the ejecta ($Z\rm_{ej}$) is high as well. $Z\rm_{ej}$ is essentially identical for all seven models, with the curves overlapping each other. The difference arises in the helium abundance. The models with $M_{WD}=1.25M_\odot yr^{-1}$ have a higher mass fraction of helium in the ejecta --- $\sim34\%$ (and therefore a correspondingly lower mass fraction of hydrogen) as opposed to $\sim26-28\%$ for the other less massive WD models (for which the helium mass fraction for models with $M_{WD}=1.0M_\odot$ is slightly higher than the helium mass fraction for models with $M_{WD}=0.7M_\odot$). This is a direct consequence of the maximum temperature during eruption, which is higher for the more massive WDs, and therefore the hydrogen is burnt into helium more efficiently.

The enrichment of heavy elements in the ejecta is mostly due to dredge up of carbon from mixing, increasing the energy output from the CNO cycle. This means that a longer accretion phase --- which (for a given WD mass) is the result of a lower accretion rate --- will yield a higher enrichment of heavy elements in the ejecta. This is in agreement with other authors \cite[e.g.,][]{Prialnik1984,Iben1992,Prikov1995,Yaron2005}.
Figure \ref{fig:Abundances} displays the breakdown of the heavy element ejecta abundances, showing that the WD mass has a significant effect. The ejecta in models with $M_{WD}=0.7M_\odot$ constitutes only ${\sim0.3\%}$ of carbon ($^{12}C$) and ${\sim6\%}$ nitrogen ($^{14}N$) (Figure \ref{fig:Abundances1}). The percentage of carbon grows with WD mass while the percentage of nitrogen decreases, exhibiting ${\sim1\%}$ and ${\sim5\%}$ of carbon and nitrogen respectively for $M_{WD}=1.0M_\odot$ and ${\sim2.5\%}$ and ${\sim4-5\%}$ of carbon and nitrogen for $M_{WD}=1.25M_\odot$. This is the result of a (slightly) higher temperature converting carbon and oxygen to nitrogen more efficiently. For this reason, the percentage of oxygen ($^{16}O$) in Figure \ref{fig:Abundances2} also decreases with increasing WD mass, constituting $\sim5\%$ for models with $M_{WD}=0.7M_\odot$, $\sim3.5\%$ for models with $M_{WD}=1.0M_\odot$ and $\sim0.02-0.1\%$ for models with $M_{WD}=1.25M_\odot$. The remaining elements, presented in Figures \ref{fig:Abundances3} and \ref{fig:Abundances4} show trace amounts, and all exhibit the trend of increasing with increasing $M_{WD}$. There is one exception --- the ONe model, which is now discussed.

\section{Oxygen neon core}\label{sec:ONe}
Throughout the previous section, the results of the different models were compared, focusing on the WD and RD masses for which all but one comprise a carbon-oxygen (CO) core. WDs that are more massive than ${\sim1.2M_\odot}$ are commonly accepted as having a core comprised of oxygen and neon (ONe) rather than a CO core due to the nuclear processes that occur in their progenitor main sequence stars \cite[]{Law1983,Gutierrez1996,Gil2001}. Therefore, included in this study is one model ($\#$7) which consists of the same stellar masses as model $\#6$ but with an ONe core. This is for comparison, and determination of which features are affected by the core composition and which are not. One of these features, which is observable, and prominently deviates from the other models, is the ejecta abundance. While the ratio $X{\rm_{ej}}:Y{\rm_{ej}}:Z{\rm_{ej}}$ for this model is essentially the same as for its corresponding CO core model, the breakdown of the heavy elements is entirely different, with less carbon, nitrogen and oxygen. Namely ${\sim1\%}$ of carbon, which is similar to the less massive 1.0$M_\odot$ CO WDs; ${\sim2.5\%}$ of nitrogen, as opposed to ${\sim4\%}$ in the corresponding CO model; and considerably less oxygen as well, ${\sim0.007\%}$ which is about a quarter of the oxygen fraction in the corresponding CO model. On the other hand, all the rest of the elements, which for the CO core model are at the most a mass fraction of order $10^{-8}$, in the ONe core model they constitute the better part of the heavy element composition with ${\sim2.5\%}$ of neon (Ne); ${\sim2\%}$ of silicon (Si); ${\sim0.2\%}$ of magnesium (Mg) and of aluminum 26 ($^{26}$Al); ${\sim0.1\%}$ of phosphorus (P); ${\sim0.06\%}$ of aluminum 27 ($^{27}$Al); and ${\sim0.007\%}$ of sodium (Na). The favoring of neon over carbon is simply due to the WD core containing neon instead of carbon. The reduction of nitrogen and oxygen is due to the decrease in carbon reducing the rate of the CNO process. The enrichment in heavier elements, such as, silicon, phosphorus and magnesium is a result of the WD core containing neon which is required for the production of these elements. Novae have been observed to have ejecta enriched in heavy elements. For example, \cite{Delbourgo1985} report V1500 Cyg and Nova Aql 1982 being enriched in neon, and the enhancement of neon and other heavy elements was reported for V693 CrA, V351 Pup, V1974 Cyg and V838 Her \cite[][and references therein]{Cassatella2002}. \cite{Nomoto1987} suggested that enrichment in neon must be as a result of it being initially present because the CNO cycle does not lead to the efficient production of neon at temperatures typical of nova. \cite{Jose1998} performed a series of simulations of novae on CO and ONe core WDs for different mixing levels. Comparing between two of their models with WDs of $1.15M_\odot$ and identical mixing levels yields a decrease in the abundance of carbon, nitrogen and oxygen in the ejecta and a substantial increase in heavy elements, similar to the results presented here. \cite{Jose2020} perform simulations that combine 1-D and 3-D methodologies, and obtain, for a $1.25M_\odot$ WD accreting at $10^{-10}M_\odot yr^{-1}$, an ejecta that is enriched relative to a CO core. The enrichment obtained here is similar to their results. The increase in heavy element production entails a somewhat higher burning temperature as well, which may be seen in Figure \ref{fig:TcTmax} to be $\sim2.8\times10^8$[K] as opposed to the CO core model that has a maximum WD core temperature of $\sim2.6\times10^8$[K].

The ONe WD core temperature ($T_c$) cools in the same manner as the core of the corresponding CO model. This is because the evolution of $T_c$ is dependent on the time between eruptions \cite[]{Epelstain2007} which is dependent on the amount of required accreted mass ($m{\rm_{acc}}$). As shown earlier, $m{\rm_{acc}}$ is determined by the WD mass ($M_{WD}$) and accretion rate ($\dot{M}$), which behave in a similar manner as the corresponding CO model. Since the WD effective temperature ($T{\rm_{eff}}$) (Figure \ref{fig:Teff}) is also dependent on $M_{WD}$ and $\dot{M}$ \cite[]{Epelstain2007}, it behaves in the same manner as the CO core model as well. In fact, the only feature that shows a significant deviation from the CO core model is the ejecta abundance, as described above. This is in agreement with \cite{Yaron2005}, who explain that the mechanism leading to a nova eruption is the result of a TNR under electron degeneracy conditions, which is determined by the total mass fraction of heavy elements. Thus, replacing carbon with neon does not alter the required conditions, so it does not alter the amount of required $m\rm_{acc}$ and therefore does not entail significant changes to eruptive features other than the ejecta abundances.

\section{Conclusions}\label{sec:conclusions}
Using the self-consistent, feedback dominated combined code for evolving a nova producing binary system, while systematically changing one of the binary masses at a time, has led to the primary conclusion that all seven of the models presented here have the same general evolutionary behavior. Despite the common general behavior, there are certain features that vary between models and are distinctly determined by the WD mass while the RD mass has a negligible contribution and vice versa, as detailed below.

\subsection*{Common features}

\begin{itemize}
	\item Evolutionary time - All of the models complete their evolution from first Roche-lobe contact of the RD donor until the donor is eroded down to $<0.1M_\odot$ on a time scale of a few Gyr. This is regardless of the initial RD mass, even though the difference between the two RD masses used in this study is almost a factor of two. This is because only a small fraction of the total evolutionary time is spent reducing the RD mass to $0.35M_\odot$, thus the total evolutionary time is essentially the time required for the WD to erode a $0.35M_\odot$ RD donor.

	\item Accretion rate - During a single accretion phase, $\dot{M}$ for all of the models decreases rapidly and then increases slowly. In addition, on a secular time scale, for all of the models, the initial accretion rate per cycle decreases throughout evolution. This demonstrates that the mass transfer rate from a donor to a WD in a RLOF CV is far from being constant. Observations of two different systems with the same WD masses, RD masses and separation may exhibit entirely different behaviors (NL, DN, CN or detached RD-WD binary) if the observations "catch" the systems at different points in time of a nova cycle, exhibiting very different mass transfer rates.
\end{itemize}

\subsection*{Features determined by the RD}
\begin{itemize}
\item Accretion rate - For RD masses above the MB threshold the average accretion rate is about 50$\%$ higher for \textit{initially} more massive RDs. Nevertheless, in general the average accretion rate for all of the models when ${M_{RD}\gtrsim0.35M_\odot}$ is of order $\sim10^{-9}M_\odot yr^{-1}$ while it is of order only several times $10^{-11}M_\odot {yr^{-1}}$ for $M_{RD}\lesssim0.35M_\odot$. This is because of the MB threshold occurring at $\sim0.35M_\odot$ and may serve as a tool in setting a higher or lower limit on the donor mass of observed systems provided there are observationally estimated accretion rates.

\item Ejecta - The total Z of the ejecta indicates whether the mass of the RD is higher or lower than 0.35$M_\odot$, being of order $\sim35\%$ for cases with a RD mass above the MB threshold, and only $\sim15\%$ for cases with a RD mass below it. This is because the low accretion rate that characterizes RDs below the MB threshold allows more time for mixing of the accreted matter with the core.

\end{itemize}

\subsection*{Features determined by the WD}
\begin{itemize}
\item Evolutionary time - Although all the models erode their donor on the same time \textit{scale}, the time is shorter for more massive WDs. In fact, this study finds that the erosion time is roughly inversely proportional to the WD mass ($M_{WD,1}/M_{WD,2}\propto t_2/t_1$) e.g., doubling the mass of the WD would reduce the total evolutionary time by half.

\item Accretion rate - For the $0.70M_\odot$ and $1.0M_\odot$ models with donors below $0.35M_\odot$ the accretion rate during a cycle (and secularly over many cycles), decreases to a state of essentially no mass transfer for periods of many millennia, until the separation decreases sufficiently to resume mass transfer. This supports the hibernation theory \cite[]{Shara1986} showing that in between nova eruptions the system has a long detached epoch. These type of epochs may be seen for the more massive $1.25M_\odot$ WD models as well, however they may occur only when the donor is of a very low mass, thus, statistically a hibernating system with a $\sim1.25M_\odot$ WD would be very rare.

\item Ejecta: He - The helium mass fraction in the ejecta of the models with a $1.25M_\odot$ WD is of order $\sim35\%$ whereas the models with lower mass WDs have a lower mass fraction of helium. This means that the mass fraction of the helium in the ejecta may assist in estimating the the WD mass.

\item Ejecta: CNO - The CNO abundance in the ejecta is informative of the WD mass as well.
The models with a WD mass of $0.70M_\odot$ have $\sim20$ times more nitrogen (14N) than carbon (12C), while the models with a $1.0M_\odot$ WD have $\sim5$ times more and the models with a $1.25M_\odot$ WD have only twice more 12C than 14N. This means that the ratio 12C/14N in the abundance of an observed ejected nova shell may be indicative of the WD mass. The oxygen (16O) abundance refines this by being similar to the 14N abundance for the models with a $0.70M_\odot$ WD, more than half the 14N abundance for the models with a $1.0M_\odot$ WD and only a few percent the 14N abundance for the models with a $1.25M_\odot$ WD. These are observable measures which can assist in estimating the WD mass. For instance, the ratio of carbon to nitrogen observed in nova V1370 Aql\footnote{Aql 1982} is $\sim0.28$ and the ratio of oxygen to nitrogen is $\sim0.31$ \cite[]{Vanlandingham1996}. Comparison with the abundances obtained here places the WD mass between $1.0M_\odot$ and $1.25M_\odot$ which is in agreement with \cite{Shara2018} who found the WD mass of V1370 Aql via modeling to be $\sim1.13M_\odot$ based on observed amplitude and decline time of the light curve.

\end{itemize}

\subsection*{ONe composition}
The evolution of the ONe model (model $\#7$) shows results which are almost identical to those of the CO model $\#6$ except for the breakdown of the heavy element abundances, displaying considerably less oxygen and non-negligible amounts of heavy elements, such as, neon, silicon and magnesium which are comparable with the mass fractions of carbon and nitrogen. Observing these high abundances in the ejecta of a nova would indicate a WD with an ONe core, which is indeed observed for novae with estimated high mass WDs such as, V838 Her\footnote{Her 91} which shows a high C/O ratio and neon and sulfur enrichment \cite[]{Vanlandingham1996},
and QU Vul \cite[]{Mikolajewska2017}, V693 CrA \cite[]{Williams1985} and V382 Vel \cite[]{Shore2003} (among others) which exhibit a strong presence of magnesium, neon, silicon and aluminum in their spectra \cite[]{Mikolajewska2017}. These enrichments are not observed in CO novae such as the seven specified in \cite{Cassatella2005} and are not present in the results of the CO nova models studied here.

\subsection*{Evolutionary age}
An important feature that can not be deduced from the masses of the binary system is the evolutionary age of an observed system. Since the rate that the RD loses mass is the accretion rate, which can be expressed by the average value per cycle as $m{\rm_{acc}}/t{\rm_{rec}}$, and the WD loses mass at an average rate equal to $(m{\rm_{ej}}-m{\rm_{acc}})/t{\rm_{rec}}$, and $m{\rm_{ej}}\simeq m{\rm_{acc}}$, therefore over the entire evolutionary time needed to erode the RD, the WD loses very little mass and may be considered constant --- as found in this study for all seven models. This means that the evolution of the binary is dictated solely by the WDs mass and that all binaries with a certain WD mass will follow the same path, regardless of the initial RD mass (as explained above). This leads to the conclusion that observationally determining the binary masses of a certain system is \textit{not} an indication of the system's age, since for a given WD mass, a system "born" with a certain RD mass will behave in the \textit{same} manner as a system that was "born" with a more massive RD and has evolved to the same RD mass.

\subsection*{}
The results presented here show that WDs of mass up to about $1.25M_\odot$ with RD companions of initial mass up to about $0.7M_\odot$ will not grow in mass at all. To the contrary, all such models' WDs lose mass monotonically throughout their evolution. Therefore, only initially more massive stellar combinations may determine whether or not a WD in a WD+RD system may accumulate enough mass to sufficiently grow and reach the Chandrasekhar mass of $\sim1.4M_\odot$ that is required for igniting the WD core, and may help in answering the long-standing question of the possibility of WD+RD binary system being a type Ia supernova progenitor.