prompt_front: Now, answer the following question based on the text below, only give me the answer and do not output any other words.

Question: What is the future direction mentioned in the conclusion?

Read the following text and answer briefly.

Context 1: Paper Info

Title: Is In-hospital Meta-information Useful for Abstractive Discharge Summary Generation?
Publish Date: 10 Mar 2023
Author List: Mamoru Komachi (from Tokyo Metropolitan University), Takashi Okumura (from Kitami Institute of Technology), Hiromasa Horiguchi (from National Hospital Organization), Yuji Matsumoto

Figure

Fig  1 Example of part of a discharge summary which is a dummy we created 
Fig  2  Overview of our proposed method A new feature embedding layer encoding hospital, physician, disease, and length of stay is added to the standard transformer architecture The figure shows an example of hospital embedding 
Statistics of our data for experiment 
of summarization models with different meta-information The best results are highlighted in bold Each score is the average of three models with different seeds The BS and BR indicate BERTScore and BLEURT, respectively 
Statistics on the number of cases handled by physicians C/P denotes Cases/Physician, which indicates how many cases an individual physician has Method of Grouping Physician IDs A most naive method of mapping physician IDs to features is without any grouping process The data contains 4,846 physicians, so |M | was set to 4,846 However it caused our model's training to be unstable This might be due to the many physician IDs appearing for the first time in the test time Table

abstract

During the patient's hospitalization, the physician must record daily observations of the patient and summarize them into a brief document called "discharge summary" when the patient is discharged  Automated generation of discharge summary can greatly relieve the physicians' burden, and has been addressed recently in the research community 
Most previous studies of discharge summary generation using the sequenceto-sequence architecture focus on only inpatient notes for input  However, electric health records (EHR) also have rich structured metadata (e g , hospital, physician, disease, length of stay, etc ) that might be useful  This paper investigates the effectiveness of medical meta-information for summarization tasks 
We obtain four types of meta-information from the EHR systems and encode each meta-information into a sequence-to-sequence model  Using Japanese EHRs, meta-information encoded models increased ROUGE-1 by up to 4 45 points and BERTScore by 3 77 points over the vanilla Longformer  Also, we found that the encoded meta-information improves the precisions of its related terms in the outputs 
Our results showed the benefit of the use of medical meta-information 

INTRODUCTION

Clinical notes are written daily by physicians from their consults and are used for their own decision-making or coordination of treatment  They contain a large amount of important data for machine learning, such as conditions, laboratory tests, diagnoses, procedures, and treatments  While invaluable to physicians and researchers, the paperwork is burdensome for physicians ,  
Discharge summaries, a subset of these, also play a crucial role in patient care, and are used to share information between hospitals and physicians (see an example in Figure )  It is created by the physician as a summary of notes during hospitalization at the time of the patient's discharge, which is known to be very time-consuming 
Researchers have begun to apply automatic summarization techniques to address this problem -   Previous studies used extractive or abstractive summarization methods, but most of them focused on only progress notes for inputs  Properly summarizing an admission of a patient is a quite complex task, and requires various meta-information such as the patient's age, gender, vital signs, laboratory values and background to specific diseases 
Therefore, discharge summary generation needs more medical meta-information, than similar but narrower tasks such as radiology report generation  However, what kind of meta-information is important for summarization has not been investigated, even though it is critical not only for future research on medical summarization but also for the policy of data collection infrastructure 
In this paper, we first reveal the effects of meta-information on neural abstractive summarization on admissions  Our model is based on an encoder-decoder transformer with an additional feature embedding layer in the encoder (Figure )  Hospital, physician, disease, and length of stay are used as meta-information, and each feature is embedded in the vector space 
For experiments, we collect progress notes, discharge summaries and coded information from the electronic health record system, which are managed by a largest multi-hospital organization in Japan  Our main contributions are as follows: • We found that a transformer encoding meta-information generates higher quality summaries than the vanilla one, and clarified the benefit of using meta-information for medical summarization tasks 
• We found that a model encoding disease information can produce proper disease and symptom words following the source  In addition, we found that the model using physician and hospital information can generate symbols that are commonly written in the summary  • We are the first to apply the abstractive summarization method to generate Japanese discharge summaries 
In the studies of summarization of medical documents, it is common to retrieve key information such as disease, examination result, or medication from EHRs -   Other researchs more similar to our study targeted to help physicians get the point of medical documents quickly by generating a few key sentences -  
Studies generating contextualized summaries can be categorized by the type of model inputs and architectures  Some studies produced a whole discharge summary using structured data for input - The sensitivity of the gram stain for bacterial meningitis is about 60%, and the sensitivity of the culture is not high either 
Also, the glucose in the cerebrospinal fluid would have been slightly lower  Although no definitive diagnosis could be made, bacterial meningitis was the most suspicious disease  The causative organism was assumed to be MRSA, and vancomycin and meropenem (meningitis dose) were used to cover a wide range of enteric bacteria 
a whole discharge summary from free-form inpatient records -   The free-form data is more challenging since it is noisier than structured data  In inputting of the free-form data, extractive summarization methods, which extract sentences from the source, are commonly used , -   On the other hands, an encoder-decoder model was used for abstractive summarization , , with a limited number of studies 
The various issues in the abstractive generation of discharge summary would be studied in the future  Studies using medical meta-information have long been conducted on a lot of tasks -   In abstractive summarization on discharge summary,  developed a model incorporating similarity of progress notes and information of the record author 
They presented an idea of integrating meta-information into the abstractive summarization model on medical documents, but did not reveal how meta-information would affect the quality of the summaries  Our method is based on the encoder-decoder transformer model  The transformer model is known for its high performance and has been widely used in recent studies, thus it is suitable for our purpose 
As shown in Figure , the standard input to a transformer's encoder is created by a token sequence T = [t 0 , t 1 ,    , t i ] and position sequence P = [p 0 , p 1 ,    , p i ], where i is the maximum input length  The token and position sequences are converted into token embeddings E T and positional embeddings E P by looking up the vocabulary tables 
The sum of E T and E P is input into the model  In this paper, we attempt to encode meta-information to feature embeddings  We follow the segment embeddings of BERT and the language embeddings of XLM , which provide additional information to the model  It is not a new idea but is suitable for our validation 
Our method is formulated as follows: Let M be feature type, M ∈ {Vanilla, Hospital, Physician, Disease, Length of stay}, since we set five types of features  Feature embeddings E M is created by looking up the feature table where m j is featue value (e g , pysician ID, disease code, etc ) and |M | is the maximum number of differences in a feature 
In our study, |M | is set to four different values depending on features  Specifically, they are as follows  a) Hospital: As shown in Table , the data includes five hospital records  They were obtained mechanically from the EHR system  b) Physician: Physicians are also managed by IDs in the EHR systems  We hashed the physician IDs into 485 groups containing 10 people each 
Specifically, as a naive strategy, we shuffled and listed the cases within each hospital, and hashed them into groups in the order of appearance of the physician IDs  So each group has the information about the relevance of the hospitals  The reason for employing a grouping strategy is described in Appendix A 
c) Disease: Two types of disease information exist in our EHRs: disease names and disease codes called ICD-10   We did not use any disease names in the inputs for our experiment  Instead, we encoded diseases with the first three letters of the ICD-10 code, because they represent well the higher level concept 
The initial three letters of the ICD-10 codes are arranged in the order of an alphabetic letter, a digit, and a digit, so there are a total of 2,600 ways to encode a disease  In our data, some ICD-10 codes were missing, although all disease names were systematically obtained from the EHR system  For such cases, we converted the disease names into ICD-10 codes using MeCab with the J-MeDic (MANBYO 201905) dictionary 
Also, diseases can be divided into primary and secondary diseases, but we only deal with the primary diseases  d) Length of stay: The length of stay can be obtained mechanically from the EHR system and the maximum value was set to 1,000 days  We set |M | for vanilla, hospital, physician, disease, and length of stay to 1, 5, 485, 2,600, and 1,000, respectively  
The vanilla embedding is prepared for the baseline in our experiment and to equalize the total number of parameters with the other models  The input to our model is the sum of E T , E P and E M   We also prepare an extra model with all features for our experiments  This takes all four feature embeddings (hospital, physician, disease, and length of stay) added to the encoder 

Datasets and Metrics

We evaluated our proposed method on a subset of data from National Hospital Organization (NHO), the largest multiinstitutional organization in Japan  The statistics of our data are shown in Table  , which includes 24,630 cases collected from five hospitals  Each case includes a discharge summary and progress notes for the days of stay 
The data are randomly split into 22,630, 1,000, and 1,000 for train, validation, and test, respectively  Summarization performances are reported in ROUGE-1, ROUGE-2, ROUGE-L and BERTScore in terms of F1  In addition, we also employed BLEURT , which models human judgment 

Architectures and Hyperparameters

Due to our hardware constraints we need a model that is computationally efficient, so we employed the Longformer instead of the conventional transformer  Longformer can    In our model, number of layers, window size, dilation, input sequence length, output sequence length, batch size, learning rate and number of warmup steps are 8, 256, 1, 1024, 256, 4, 3e-5 and 1K, respectively 
Other hyperparameters are the same as in the original Longformer, except for the maximum number of epochs is not fixed and the best epoch  It is selected for each training using the validation data based on ROUGE-1  Also, the original Longformer imports pretrained-BART parameters to initial values, but we do not use pre-trained Japanese BART in this study 
We used three GeForce RTX 2080 TI for our experiments  Our vocabulary for preparing input to Longformer is taken from UTH-BERT , which is pre-trained on the Japanese clinical records  Since the vocabulary of UTH-BERT is trained by WordPiece , we also tokenize our data with WordPiece  However, the vocabulary does not include white space and line breaks, which cannot be handled, so we add those two tokens to the vocabulary, resulting in a total size of 25,002 
The vocabulary has all tokens in full characters, so we normalized full-wdith characters by converting all alphanumeric and symbolic characters to half-width for byte fallback  , we found that all the models with encoded medical meta-information perform better in ROUGE-1, ROUGE-L and BLEURT than the vanilla Longformer 
However, in BERTScore, only hospital and disease models outperform the vanilla  Specifically, disease information is most effective, improving ROUGE-1, ROUGE-2, ROUGE-L, BERTScore and BLEURT by 4 45, 0 73, 3 12, 3 77 and 0 21 points over the vanilla model, respectively  This seems to be because disease information and the ICD-10 ontology efficiently cluster groups with similar representations 
In contrast, in ROUGE-2 and ROUGE-L, the model with physician embedding is inferior to the vanilla model  This seems to be a negative effect of grouping physicians without any consideration of their relevance  It would be better to cluster them by department, physician attributes, similarity of progress notes, etc  Regarding low ROUGE-2 scores in all models, a previous study using the English data set also reported a low ROUGE-2 score of about 5%, which may indicate an inherent difficulty in discharge summary generation 
In BERTScore, the models with the physician and the length of stay did not reach the performance of the vanilla model, suggesting that the system's outputs are semantically inferior  The model with all features performed the lowest of all models in BERTScore  The reason for the low score of the model with all features seems to be that its number of parameters in feature embedding was four times larger than that of the model with the individual feature, and the amount of training data was insufficient 
In BLEURT, all models with meta-information outperform vanilla, which suggests that they are more natural to humans  To analyze the influence of encoded meta-information on the outputs, we evaluate the precisions of the generated text  Specifically, we measure the probability that the generated words are included in the gold summary to investigate if the proper words are generated 
Some previous studies on faithfulness, which also analyze the output of summarization, have employed words or entities -   In this study, we focused on words, not entities, because we wanted to visualize expressions that are not only nouns  The words were segmented by MeCab with the J-MeDic  For each segmented word, the numeral and symbol labels were assigned as parts of speech by MeCab, the morphological analyzer, while the disease and symptom were assigned by the J-Medic dictionary 
The results, shown in Figure , indicate that the encoded disease information leads to generate more proper disease and symptom words  This indicates that the meta-information successfully learns disease-related expressions  The encoded hospital or physician information also improved the precision of symbols generation 
This suggests that different hospitals and physicians have different description habits (e g , bullet points such as "•", "*" and "-", punctuation such as "。" and " ", etc ), which can be grouped by meta-information  In this paper, we conducted a discharge summary generation experiment by adding four types of information to Longformer and verified the impact of the meta-information 
The results showed that all four types of information exceeded the performance of the vanilla Longformer model, with the highest performance achieved by encoding disease information  We found that meta-information is useful for abstractive summarization on discharge summaries  Our limitations are that we used Japanese EHR, the limited number of tested features and not performing human evaluations 
As for the efficacy of the meta-information, we believe that our results are applicable to non-Japanese, but it is left as Fig    The precisions of words in the generated summaries  The vertical axis shows the probability that the words exist in the gold summary  a future work  Other meta-information may be worth verifying such as the patient's gender, age, race, religion and used EHR system, etc 
It is hard to collect a large amount of medical information and process it into meta-information, so we may need to develop a robust and flexible research infrastructure to conduct a more large scale cross-sectional study in the future  In the discharge summary generation task, which demands a high level of expertise, the human evaluation requires a lot of physicians' efforts and it is a very high cost which is unrealistic 
This is a general issue in tasks dealing with medical documents, and this study also could not perform human evaluations  On this research, informed consent and patient privacy are ensured in the following manner  Notices about their policy and the EHR data usage are posted at the hospitals  The patients who disagree with the policies can request opt-out and are excluded from the archive 
In case of minors and their parents, followed the same manner  In the case of minors and their parents are same  To conduct a research on the archive, researchers must submit their research proposals to the institutional review board  After the proposal is approved, the data is anonymized to build a dataset for analysis 
The data is accessible only in a secured room at the NHO headquarters, and only statistics are brought out of the secured room, for protection of patients' privacy  In the present research, the analysis was conducted under the IRB approval (IRB Approval No : Wako3 2019-22) of the Institute of Physical and Chemical Research (RIKEN), Japan, which has a collaboration agreement with the National Hospital Organization 
This data is not publicly available due to privacy restrictions  shows the detailed number of cases handled by physicians  In all hospitals, there is a large difference between the median and the maximum of cases/physician  This indicates that a few physicians handle a large number of cases and many physicians handle fewer cases 
It is impossible to avoid physician IDs first seen at test time without some process that averages the number of cases a physician holds 
Context 2: Brooksley Elizabeth Born (born August 27, 1940) is an American attorney and former public official who, from August 26, 1996, to June 1, 1999, was chair of the Commodity Futures Trading Commission (CFTC), the federal agency which oversees the U S  futures and commodity options markets  During her tenure on the CFTC, Born lobbied Congress and the President to give the CFTC oversight of off-exchange markets for derivatives, in addition to its role with respect to exchange-traded derivatives, but her warnings were ignored or dismissed, and her calls for reform resisted by other regulators <ref name="nytimes">Goodman, Peter S  The Reckoning - Taking Hard New Look at a Greenspan Legacy, The New York Times, October 9, 2008 </ref> Born resigned as chairperson on June 1, 1999, shortly after Congress passed legislation prohibiting her agency from regulating derivatives 

In 2009, Born received the John F  Kennedy Profiles in Courage Award, along with Sheila Bair of the Federal Deposit Insurance Corporation, in recognition of the "political courage she demonstrated in sounding early warnings about conditions that contributed" to the 2007-08 financial crisis 

Early life and education
Born graduated from Abraham Lincoln High School (San Francisco, California) at the age of 16  She then attended Stanford University, where she majored in English and was graduated with the class of 1961   She initially wanted to become a doctor, but a guidance counsellor at Stanford advised her against medicine, so she majored in English literature instead 

She then attended Stanford Law School, one of only seven women in her class   She was the first female student ever to be named president of the Stanford Law Review  She received the "Outstanding Senior" award and graduated as valedictorian of the class of 1964 

Legal career
Immediately after law school Born was selected as a law clerk to judge Henry Edgerton of the U S  Court of Appeals for the District of Columbia Circuit  It was during this time that she met her first husband, Jacob C  Landau, who was a journalist covering the Federal courts at the time  Following her clerkship, she became an associate at the Washington, D C -based international law firm of Arnold & Porter  Born was attracted to Arnold & Porter because it was one of the few major law firms to have a woman partner at that time, Carolyn Agger, who was the head of the tax practice  Born took a two-year leave of absence from Arnold & Porter to accompany her first husband to Boston, where he had received a fellowship  During that time she worked as a research assistant to law professor Alan Dershowitz 

Born's early career at Arnold & Porter focused on international trade law, in which she represented a number of Swiss industries and the government of Switzerland  She developed a practice representing clients in numerous complex litigation and arbitration cases involving financial market transactions  Among her high-profile cases was the matter of the Hunt Brothers attempt to corner the market in silver in the 1970s  She made partner at Arnold & Porter, after moving to a three-day schedule to help raise her second child, and eventually rose to be the head of the firm's derivatives practice 

Born was among the first female attorneys to systematically address inequities regarding how the laws treated women  Born and another female lawyer, Marna Tucker, taught what is considered to have been the first "Women and the Law" course at Catholic University’s Columbus School of Law  The class exclusively concerned prejudicial treatment of women under the laws of the United States, past and present   Born and Tucker were surprised to discover that there was no textbook on the issue at the time   Born is also one of the co-founders of the National Women's Law Center  Born also helped rewrite the American Bar Association rules to make it possible for more women and minorities to sit on federal bench 

During her long legal career, and into her retirement, Born did much pro bono and other types of volunteer work  She was active in the American Bar Association, the largest professional organization of lawyers in the United States   Initially Born was named a member of the governing council of the ABA's Individual Rights Section, eventually becoming chairperson   Born and Tucker founded the ABA Women's Caucus, the first organization of female lawyers in the ABA   She held several other senior positions in the ABA, including being named the first woman member of the ABA's Standing Committee on the Federal Judiciary   As a member of the Judiciary Committee, Born provided testimony and opinion on persons nominated for federal judgeships  In 1980 she was named chair of the committee   As chair of the committee, Born was invited to address the U S  Congress regarding the nomination of Judge Sandra Day O'Connor to the U S  Supreme Court 

In 1993, Born's name was floated as a possible candidate for Attorney General of the United States, but Janet Reno was nominated 

In July 2009, Nancy Pelosi appointed Brooksley Born as a commissioner to the Financial Crisis Inquiry Commission (FCIC) 

Born and the OTC derivatives market
Born was appointed to the CFTC on April 15, 1994, by President Bill Clinton  Due to litigation against Bankers Trust Company by Procter and Gamble and other corporate clients, Born and her team at the CFTC sought comments on the regulation of over-the-counter derivatives, a first step in the process of writing CFTC regulations to supplement the existing regulations of the Federal Reserve System,  the Options Clearing Corporation, and the National Association of Insurance Commissioners  Born was particularly concerned about swaps, financial instruments that are traded over the counter between banks, insurance companies or other funds or companies, and thus have no transparency except to the two counterparties and the counterparties' regulators, if any   CFTC regulation was strenuously opposed by Federal Reserve chairman Alan Greenspan, and by Treasury Secretaries Robert Rubin and Lawrence Summers
Context 3: \section{Introduction\label{sct::intro}}
Symmetric, public-key (asymmetric) and hash-based cryptography constitute a fundamental pillar of modern cryptography  
Symmetric cryptography includes symmetric-key encryption, where a shared secret key is used for both encryption and decryption  Cryptographic hash functions map arbitrarily long strings to strings of a fixed finite length  Currently deployed public-key schemes are
used to establish a common secret key between two remote parties  They are based on factoring large numbers or solving the discrete logarithm problem over a finite group  For more details about modern cryptography the interested reader can consult one of the many excellent references on the topic, e g ~\cite{Katz:2007:IMC:1206501} 

In contrast to asymmetric schemes based on factoring or solving the discrete logarithm problem and which are completely broken by a quantum adversary via Shor's algorithm~\cite{SJC 26 1484}, symmetric schemes and hash functions are less vulnerable to quantum attacks  The best known quantum attacks against them are based on Grover's quantum search algorithm~\cite{PhysRevLett 79 325}, which offers a quadratic speedup compared to classical brute force searching  Given a search space of size $N$, Grover's algorithm finds, with high probability, an element $x$ for which a certain property such as $f(x)=1$ holds, for some function $f$ we know how to evaluate (assuming such a solution exists)  The algorithm evaluates $f$ a total of $\mathcal{O}(\sqrt{N})$ times  It applies a simple operation in between the evaluations of $f$, so the $\mathcal{O}(\sqrt{N})$ evaluations of $f$ account for most of the complexity  In contrast, any classical algorithm that evaluates $f$ in a similar ``black-box'' way requires on the order of $N$ evaluations of $f$ to find such an element 

Any quantum algorithm can be mapped to a quantum circuit, which can be implemented on a quantum computer  The quantum circuit represents what we call the ``logical layer"  Such a circuit can always be decomposed in a sequence of ``elementary 
gates", such as Clifford gates (CNOT, Hadamard etc ~\cite{NC00}) augmented by a non-Clifford gate such as the T gate 

Running a logical circuit on a full fault-tolerant quantum computer is highly non-trivial  The sequence of logical gates have to be mapped to 
sequences of surface code measurement cycles (see e g ~\cite{PhysRevA 86 032324} for extensive details)  By far, the most resource-consuming (in 
terms of number of qubits required and time) is the T gate\footnote{Clifford gates are ``cheap", i e  they require relatively small overhead for implementation in the surface code, but are not universals, hence a non-Clifford gate is required  One such gate is the T gate  There are other possible choices, however all of the non-Clifford gates require special techniques such as magic state distillation~\cite{1367-2630-14-12-123011,PhysRevA 86 052329} and significant overhead (order of magnitudes higher than Clifford gates) to be implemented in the surface code  In fact, to a first order approximation, for the purpose of resource estimation, one can simply ignore the overhead introduced by the Clifford gates and simply focus only on the T gates }  
In comparison with surface code defects and braiding techniques~\cite{PhysRevA 86 032324}, novel lattice surgery 
techniques~\cite{2018arXiv180806709F,1808 02892,1367-2630-14-12-123011} reduce the spatial overhead required for implementing T gates via magic state distillation by approximately a factor of 5, while also modestly improving the running time  

In this paper we first analyze the security of symmetric schemes and hash functions against large-scale fault-tolerant quantum adversaries, using surface code defects and braiding techniques  We take into account the time-space trade-offs with parallelizing quantum search, down to the fault-tolerant layer  Naively, one might hope that $K$ quantum computers (or quantum ``processors'', as we will call them later in the paper) running in parallel reduce the number the circuit depth down to $\mathcal{O}(\sqrt{N})/K$ steps, similar to the classical case of distributing a search space across $K$ classical processors  However quantum searching does not parallelize so well, and the required number of steps
for parallel quantum searching is of the order $\mathcal{O}(\sqrt{N/K})$~\cite{quantph 9711070}  This is a factor of $\sqrt{K}$ larger than $\mathcal{O}(\sqrt{N})/K$   As shown in~\cite{quantph 9711070}, the optimal way of doing parallel quantum search is to partition the search space into $N/K$ parts, and to perform independent quantum searches on each part 

Secondly, we investigate the security of public-key cryptographic schemes such as RSA and ECC against 
quantum attacks, using the latest developments in theory of fault-tolerant quantum error correction, i e  novel lattice surgery 
techniques~\cite{2018arXiv180806709F,1808 02892,1367-2630-14-12-123011} 

The remainder of this paper is organized as follows  In Sec ~\ref{sct::method}, we provide an overview of the methodology used in our analysis  In Sec ~\ref{sct::ciphers} we investigate the security of the AES family of modern symmetric ciphers  In Sec ~\ref{sct::hash} we analyze the security of the SHA family of hash functions  In Sec ~\ref{sct::bitcoin} we investigate the security of Bitcoin's~\cite{satoshi:bitcoin} proof-of-work consensus mechanism  We conclude our investigation of symmetric and hash-based cryptographic schemes in Sec ~\ref{sct::intrinsic_parallel_grover}, where we evaluate the intrinsic cost of running the Grover algorithm with a trivial oracle (i e , an oracle with a unit cost of 1 for each invocation) 

In the subsequent sections  we analyze public-key cryptographic schemes  In Sec ~\ref{sct::rsa} and Sec ~\ref{sct::ecc} we examine the most common public-key establishment schemes, such as RSA and ECC, respectively  In the subsequent sections  we analyze public-key cryptographic schemes  In Sec ~\ref{sct::rsa} and Sec ~\ref{sct::ecc} we examine the most common public-key establishment schemes, such as RSA and ECC, respectively  Finally we summarize our findings and conclude in Sec ~\ref{sct::conclusion} 
\section{Methodology\label{sct::method}}

\subsection{Symmetric cryptography and hash functions\label{sct::symmetric}}
The methodology, sketched in Fig ~\ref{fgr:flowchart_lite} and Fig ~\ref{fgr:full_algorithm}, follows the same lines as the one described in great detail in our earlier paper~\cite{10 1007/978-3-319-69453-5_18}, which we refer the interested reader to for more details 
\begin{figure}[htb]
	\centering
         \includegraphics[width=0 35\textwidth]{figures/flowchart_lite pdf}
         \caption{Analyzing an attack against a symmetric cryptographic function with a fault-tolerant quantum adversary  Our resource estimation methodology takes into account several of the layers between the high level description of an algorithm and the physical hardware required for its execution  Our approach is modular should assumptions about any of these layers change, and hence it allows one to calculate the impact of improvements in any particular layer }
         \label{fgr:flowchart_lite}
\end{figure}
\begin{figure}
	\centering
	 \includegraphics[width=0 46\textwidth]{figures/grover_vertical pdf}
          \caption{Grover searching with an oracle for $f : \{0,1\}^k \rightarrow \{0,1\}^k$  The algorithm makes $\lfloor \frac{\pi}{4} 2^{N/2}\rfloor$ calls to
$G$, the \emph{Grover iteration}, or, if parallelized on $K$ processors, $\lfloor \frac{\pi}{4} 2^{N/(2K)}\rfloor$ calls to $G$  The Grover iteration has two
subroutines  The first, $U_g$, implements the predicate $g : \{0,1\}^k
\rightarrow \{0,1\}$ that maps $x$ to $1$ if and only if $f(x) = y$  Each call to $U_g$ involves two calls to a reversible implementation of $f$ and one call to a comparison circuit that checks whether $f(x) = y$ }
          \label{fgr:full_algorithm}
\end{figure}

We assume a surface-code based fault-tolerant architecture~\cite{PhysRevA 86 032324}, using Reed-Muller distillation schemes~\cite{Fowler:2013aa}  For each scheme we vary the possible physical error rates per gate from $10^{-4}$ to $10^{-7}$  We believe that this range of physical error rates is wide enough to cover both first generation quantum computers as well as more advanced future machines 
In comparison to surface code defects and braiding methods~\cite{PhysRevA 86 032324}, lattice surgery 
techniques~\cite{2018arXiv180806709F,1808 02892,1367-2630-14-12-123011} mostly impact the physical footprint of the fault-tolerant layer required to run a specific quantum algorithm, reducing the distillation overhead by approximately a factor of 5  The temporal overhead (i e  the number of surface code cycles) is reduced less drastically  For this reason, lattice surgery has less significant effects in estimating the security of symmetric schemes or hash functions, reducing the security parameter\footnote{The security parameter is defined as the logarithm base two of the number of fundamental operations (in our case surface code cycles) required to break the scheme } by at most 1 and decreasing the spatial overhead by at most a factor of 5  Therefore when estimating the security of symmetric and hash-based cryptographic schemes we use surface code defects and braiding techniques 

For each cryptographic primitive, we display four plots, in the following order:
\begin{enumerate}
\item We plot the total number of surface code cycles per CPU (where a CPU is a quantum computer capable of executing a single instance of Grover's quantum search algorithm) as a function of the number of CPUs  We directly tie the quantum security parameter to the total number of surface code cycles (see~\cite{10 1007/978-3-319-69453-5_18} for more details)  We also add to the plot the theoretical lower bound achievable by quantum search in the cases of: a) considering the oracle a black box of unit cost (lower line), and b) considering the oracle as composed of ideal quantum gates, each of unit cost (upper line)  Note that the difference between b) and a) represents the intrinsic cost of logical overhead (i e  the overhead introduced by treating the oracle as a logical circuit and not a blackbox), whereas the difference between the upper lines and b) represents the intrinsic cost introduced by the fault-tolerant layer 

\item We plot the total wall-time per CPU (i e  how long will the whole computation take on a parallel quantum architecture) as a function of the number of CPUs  The horizontal dashed line represents the one-year time line, i e  the $x$ coordinate of the intersection point between the ``Total time per CPU'' line and the one-year time line provides the number of processors required to break the system within one year (in $\log_2$ units) 

\item We plot the total physical footprint (number of qubits) per CPU, as a function of the number of CPUs 
\item Finally we plot the total physical footprint (number of qubits) of all quantum search machines (CPUs) running in parallel 
\end{enumerate}

In the following sections we proceed to analyze symmetric ciphers (AES, Sec ~\ref{sct::ciphers}), hash functions (SHA-256, SHA3-256, Sec ~\ref{sct::hash}, Bitcoin's hash function, Sec ~\ref{sct::bitcoin}), and finally the minimal resources required for running Grover's algorithm with a trivial oracle~\ref{sct::intrinsic_parallel_grover} (e g  the identity gate) on search spaces of various sizes 

Note that in some ranges of the plots from sections~\ref{sct::ciphers},~\ref{sct::hash},~\ref{sct::intrinsic_parallel_grover} and~\ref{sct::bitcoin} the total physical footprint increases slightly with the number of processors, which may seem counter-intuitive  This happens due to the fact that with more processors the required code distances decrease, and in some instances one can pipeline more magic states factories in parallel into the surface code, which in effect causes an increase in the overall physical footprint  Note that the total time per CPU is monotonically decreasing, as parallelizing distilleries does not increase the wall time  For more details see~\cite{10 1007/978-3-319-69453-5_18}  

\subsection{Public-key cryptography\label{sct::pk}}

Most of the recent progress in quantum cryptanalysis is related to the fault-tolerant layer in Fig ~\ref{fgr:flowchart_lite}  New methods and techniques
based on surface code lattice surgery~\cite{2018arXiv180806709F,1808 02892,1367-2630-14-12-123011} allow a significant decrease of the overall 
footprint (number of qubits, or space) taken by the quantum computation, and also a relatively modest decrease in time, in comparison with  methods based on surface code defects and braiding~\cite{PhysRevA 86 032324,Fowler:2013aa} 

We consider the best up-to-date optimized logical quantum circuits for attacking RSA and ECC public-key 
schemes~\cite{1706 06752,PhysRevA 52 3457,cuccaro04,Beauregard:2003:CSA:2011517 2011525} then perform a physical footprint resource estimation
analysis using lattice surgery techniques  We remark that the overall time required to run the algorithm depends on the level of parallelization 
for the magic state factories\footnote{Every T gate in the circuit must be implemented by a specialized magic state factory, each of which occupies a 
significant physical footprint  One can implement more magic states in parallel if one is willing to increase the physical footprint of the computation }  

For each public-key cryptogrpric scheme, we analyze the space/time tradeoffs and plot the results on a double logarithmic scale  We fit the data using a third degree 
polynomial\footnote{A third degree polynomial fits the data very precisely, providing a coefficient of determination $R^2$ greater than 0 997 } and obtain an analytical closed-form formula for the relation between the time and the number of qubits required to attack the scheme, in 
the form

\begin{equation}\label{eqn1}
y(x) = \alpha x^3 + \beta x^2 + \gamma x + \delta,
\end{equation}
where $y$ represents logarithm base 2 of the number of qubits and $x$ represents the logarithm base 2 of the time (in seconds)  For example,
the quantity 
\begin{equation}\label{eqn2}
y\left(\log_2(24\times 3600)\right) \approx y(16 3987)
\end{equation}
represents how many qubits are required to break the scheme in one day (24 hours) for a fixed physical error rate per gate $p_g$, assuming a 
surface code cycle time of 200ns  Note that the computation time scales linearly with the surface code cycle time, e g  a 1000ns surface code cycle 
time will result in a computation that is 5 times longer than a $200ns$ surface code cycle time  Therefore, for a specific cryptographic scheme for 
which we plotted the space/time tradeoffs using a surface code cycle time of $200ns$ and a fixed physical error rate per gate $p_g$, the number of 
qubits required to break a specific scheme in a time $t$ using an alternative surface code cycle time $t_c$ is given by

\begin{equation}\label{eqn3}
y\left(\log_2\left(\frac{200ns}{t_c}t\right)\right),
\end{equation}
where $t$ is expressed in seconds and $t_c$ is expressed in nanoseconds 

We assume a surface code cycle time of 200ns, in conformance with~\cite{PhysRevA 86 032324}  For each scheme we analyze, we compare its security using the more conservative (and realistic in the short term) $p_g=10^{-3}$ and also the more optimistic  $p_g=10^{-5}$  Note that assuming the more optimistic assumption from a quantum computing perspective is the more conservative assumption from a cybersecurity perspective 

Furthermore, in this analysis, we are reporting the full physical footprint, including the memory required for magic state distillation 
Using present-day techniques, the memory required for generating these generic input states accounts for a substantial fraction of the total memory cost and thus we are including these in the total cost estimate and will track the impact of improved methods 

\section{Symmetric ciphers\label{sct::ciphers}}
Below we analyze the security of AES family of symmetric ciphers against large-scale fault-tolerant quantum adversaries  We used the highly optimized logical circuits produced in
\cite{10 1007/978-3-319-29360-8_3}  

\subsection{AES-128}

        \includegraphics[width=0 429\textwidth]{figures/AES-128_cycles pdf}
      	\captionof{figure}{AES-128 block cipher  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale)  The bottom brown line (theoretical lower bound, black box) represents the minimal number of queries required
	by Grover's algorithm, the cost function being the total number of queries to a black-box oracle, each query assumed to have unit cost, and a completely error-free circuit  The purple line (ideal grover, non-black-box) takes into consideration the structure of the oracle, the cost function being the total number of gates in the circuit, each gate having unit cost; the quantum circuit is assumed error-free as well  Both brown and magenta lines are displayed only for comparisons; for both of them, the $y$ axis should be interpreted as number of logical queries (operations, respectively) 	
The curves above the purple line show the overhead introduced by fault tolerance (in terms of required surface code cycles, each surface code cycle assumed to have unit cost)  More optimization at the logical layer will shift the purple line down, whereas more optimization at the fault-tolerant layer will move the upper curves closer to the purple line  Similar remarks to the above hold for the remaining plots in this manuscript }
      	\label{fgr:aes_128_cycles}
	
	For example, the plots in Fig ~\ref{fgr:aes_128_cycles} tells us that if we have $2^{50}$ quantum computers running Grover's algorithm in parallel, with no physical errors, then it would take about $2^{63}$ gate calls (where the purple line intersects the vertical line at $50$), where we assume each gate to have unit cost  Still with no errors, a trivial cost for implementing the cryptographic function (oracle) would bring the cost down to about $2^{38}$ oracle calls per quantum computer  Keeping the actual function implementation, but adding the fault-tolerant layer with a physical error rate of $10^{-7}$ (with appropriate assumptions and using state-of-the-art quantum error correction) pushes the cost up to around $2^{76}$ surface code cycles per quantum computer (where now each code cycle is assumed to have unit cost)  Similar remarks hold for the remaining plots in this manuscript 
        \includegraphics[width=0 429\textwidth]{figures/AES-128_time pdf}
      	\captionof{figure}{AES-128 block cipher  Required time per processor, as a function of the  number of processors ($\log_2$ scale)  The horizontal dotted line indicates one year  The $x$-axis is deliberately extended to show the necessary number of CPUs for a total time of one year  Thus the figure shows that it would take, with the stated assumptions, over $2^{80}$ parallel quantum searches to break AES-128 in a year  Similar remarks to the above hold for the remaining plots in this manuscript }
      	\label{fgr:aes_128_time}
        \includegraphics[width=0 429\textwidth]{figures/AES-128_phys pdf}
	\captionof{figure}{AES-128 block cipher  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:aes_128_phys}
        \includegraphics[width=0 429\textwidth]{figures/AES-128_phys_total pdf}
	\captionof{figure}{AES-128 block cipher  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:aes_128_phys_total}

\subsection{AES-192}

	
        \includegraphics[width=0 429\textwidth]{figures/AES-192_cycles pdf}
      	\captionof{figure}{AES-192 block cipher  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:aes_192_cycles}
	
        \includegraphics[width=0 429\textwidth]{figures/AES-192_time pdf}
      	\captionof{figure}{AES-192 block cipher  Required time per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:aes_192_time}
	
        \includegraphics[width=0 429\textwidth]{figures/AES-192_phys pdf}
	\captionof{figure}{AES-192 block cipher  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:aes_192_phys}
	
        \includegraphics[width=0 429\textwidth]{figures/AES-192_phys_total pdf}
	\captionof{figure}{AES-192 block cipher  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:aes_192_phys_total}


\subsection{AES-256}

	
        \includegraphics[width=0 429\textwidth]{figures/AES-256_cycles pdf}
      	\captionof{figure}{AES-256 block cipher  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:aes_256_cycles}
	
        \includegraphics[width=0 429\textwidth]{figures/AES-256_time pdf}
      	\captionof{figure}{AES-256 block cipher  Required time per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:aes_256_time}
	
        \includegraphics[width=0 429\textwidth]{figures/AES-256_phys pdf}
	\captionof{figure}{AES-256 block cipher  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:aes_256_phys}
	
        \includegraphics[width=0 429\textwidth]{figures/AES-256_phys_total pdf}
	\captionof{figure}{AES-256 block cipher  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:aes_256_phys_total}

\section{Hash functions\label{sct::hash}}
In this section we study the effect of parallelized Grover attacks on the SHA-256~\cite{SHA2} snd SHA3-256~\cite{SHA3} family of hash functions  We used the highly optimized logical circuits produced in~\cite{10 1007/978-3-319-69453-5_18} 

\subsection{SHA-256}

        \includegraphics[width=0 429\textwidth]{figures/SHA-256_cycles pdf}
      	\captionof{figure}{SHA-256 cryptographic hash function  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:sha_256_cycles}
        \includegraphics[width=0 429\textwidth]{figures/SHA-256_time pdf}
      	\captionof{figure}{SHA-256 cryptographic hash function  Required time per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:sha_256_time}
        \includegraphics[width=0 429\textwidth]{figures/SHA-256_phys pdf}
	\captionof{figure}{SHA-256 cryptographic hash function  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:sha_256_phys}
        \includegraphics[width=0 429\textwidth]{figures/SHA-256_phys_total pdf}
	\captionof{figure}{SHA-256 cryptographic hash function  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:sha_256_phys_total}


\subsection{SHA3-256}

        \includegraphics[width=0 429\textwidth]{figures/SHA3-256_cycles pdf}
      	\captionof{figure}{SHA3-256 cryptographic hash function  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:sha3_256_cycles}
        \includegraphics[width=0 429\textwidth]{figures/SHA3-256_time pdf}
      	\captionof{figure}{SHA3-256 cryptographic hash function  Required time per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:sha3_256_time}
        \includegraphics[width=0 429\textwidth]{figures/SHA3-256_phys pdf}
	\captionof{figure}{SHA3-256 cryptographic hash function  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:sha3_256_phys}
        \includegraphics[width=0 429\textwidth]{figures/SHA3-256_phys_total pdf}
	\captionof{figure}{SHA3-256 cryptographic hash function  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:sha3_256_phys_total}
\section{Bitcoin~\label{sct::bitcoin}}
In this section we analyze the security of Bitcoin's~\cite{satoshi:bitcoin} proof-of-work protocol, which is based on finding a hash\footnote{The hash function being used by the protocol is H($x$) := SHA-256(SHA-256($x$) } pre-image which that starts
with a certain number of zeros  The latter is dynamically adjusted by the protocol so that the problem is on average solved by
the whole network in 10 minutes  Currently, it takes around $2^{75}$ classical hashing operations~\cite{btc_difficulty} for finding a desired hash pre-image successfully via brute-force search with specialized hardware 
        \includegraphics[width=0 429\textwidth]{figures/SHA-256-Bitcoin_cycles pdf}
      	\captionof{figure}{Bitcoin's cryptographic hash function H($x$) := SHA-256(SHA-256($x$))  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:sha_256_bitcoin_cycles}
        \includegraphics[width=0 429\textwidth]{figures/SHA-256-Bitcoin_time pdf}
      	\captionof{figure}{Bitcoin's cryptographic hash function H($x$) := SHA-256(SHA-256($x$))  Required time per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:sha_256_bitcoin_time}
        \includegraphics[width=0 429\textwidth]{figures/SHA-256-Bitcoin_phys pdf}
	\captionof{figure}{Bitcoin's cryptographic hash function H($x$) := SHA-256(SHA-256($x$))  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:sha_256_bitcoin_phys}
        \includegraphics[width=0 429\textwidth]{figures/SHA-256-Bitcoin_phys_total pdf}
	\captionof{figure}{Bitcoin's cryptographic hash function H($x$) := SHA-256(SHA-256($x$))  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:sha_256_bitcoin_phys_total}


\section{Intrinsic cost of parallelized Grover's algorithm\label{sct::intrinsic_parallel_grover}}

More efficient quantum implementations of AES and SHA imply more efficient cryptanalysis  In this section, we aim to bound how much further optimized implementations of these cryptographic functions could help  We do so by assuming a trivial cost of $1$ for each function evaluation 

\subsection{Searching space of size $2^{56}$}

        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover56bits_cycles pdf}
      	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{56}$  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_56_cycles}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover56bits_time pdf}
      	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{56}$  Required time per processor, as a function of the  number of processors ($\log_2$ scale)  The dotted horizontal line indicates one year  }
      	\label{fgr:minimal_grover_56_time}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover56bits_phys pdf}
	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{56}$  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_56_phys}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover56bits_phys_total pdf}
	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{56}$  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:minimal_grover_56_phys_total}

\subsection{Searching space of size $2^{64}$}

        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover64bits_cycles pdf}
      	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{64}$  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_64_cycles}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover64bits_time pdf}
      	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{64}$  Required time per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_64_time}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover64bits_phys pdf}
	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{64}$  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_64_phys}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover64bits_phys_total pdf}
	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{64}$  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:minimal_grover_64_phys_total}

\subsection{Searching space of size $2^{128}$}

        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover128bits_cycles pdf}
      	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{128}$  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_128_cycles}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover128bits_time pdf}
      	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{128}$  Required time per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_128_time}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover128bits_phys pdf}
	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{128}$  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_128_phys}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover128bits_phys_total pdf}
	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{128}$  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:minimal_grover_128_phys_total}


\subsection{Searching space of size $2^{256}$}

        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover256bits_cycles pdf}
      	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{256}$  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_256_cycles}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover256bits_time pdf}
      	\caption{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{256}$  Required time per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_256_time}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover256bits_phys pdf}
	\caption{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{256}$



ground_truth: Verifying other meta-information such as patient's gender, age, race, etc.

prompt_front: Now, answer the following question based on the text below, only give me the answer and do not output any other words.

Question: When did Born resign as chairperson of the CFTC?

Read the following text and answer briefly.

Context 2:  On May 7, 1998, former SEC Chairman Arthur Levitt joined Rubin and Greenspan in objecting to the issuance of the CFTC's concept release  Their response dismissed Born's analysis and focused on the hypothetical possibility that CFTC regulation of swaps and other OTC derivative instruments could create a "legal uncertainty" regarding such financial instruments,  hypothetically reducing the value of the instruments  They argued that the imposition of regulatory costs would "stifle financial innovation" and encourage financial capital to transfer its  transactions offshore  The disagreement between Born and the Executive Office's top economic policy advisors has been described not only as a classic Washington turf war, but also a war of ideologies,  insofar as it is possible to argue that Born's actions were consistent with Keynesian and neoclassical economics while Greenspan, Rubin, Levitt, and Summers consistently espoused neoliberal, and neoconservative policies 

In 1998, a trillion-dollar hedge fund called Long Term Capital Management (LTCM) was near collapse   Using mathematical models to calculate debt risk, LTCM used derivatives to leverage $5 billion into more than $1 trillion, doing business with fifteen of Wall Street's largest financial institutions   The derivative transactions were not regulated, nor were investors able to evaluate LTCM's exposures   Born stated, "I thought that LTCM was exactly what I had been worried about"   In the last weekend of September 1998, the President's working group was told that the entire American economy hung in the balance   After intervention by the Federal Reserve, the crisis was averted   In congressional hearings into the crisis, Greenspan acknowledged that language had been introduced into an agriculture bill that would prevent CFTC from regulating the derivatives which were at the center of the crisis that threatened the US economy   U S  Representative Maurice Hinchey (D-NY) asked "How many more failures do you think we'd have to have before some regulation in this area might be appropriate?"  In response, Greenspan brushed aside the substance of Born's warnings with the simple assertion that "the degree of supervision of regulation of the over-the-counter derivatives market is quite adequate to maintain a degree of stability in the system"  Born's warning was that there wasn't any regulation of them   Born's chief of staff, Michael Greenberger summed up Greenspan's position this way: "Greenspan didn't believe that fraud was something that needed to be enforced, and he assumed she probably did  And of course, she did "  Under heavy pressure from the financial lobby, legislation prohibiting regulation of derivatives by Born's agency was passed by the Congress   Born resigned on June 1, 1999 

The derivatives market continued to grow yearly throughout both terms of George W  Bush's administration  On September 15, 2008, the bankruptcy of Lehman Brothers forced a broad recognition of a financial crisis in both the US and world capital markets   As Lehman Brothers' failure temporarily reduced financial capital's confidence, a number of newspaper articles and television programs suggested that the failure's possible causes included the conflict between the CFTC and the other regulators Faiola, Anthony, Nakashima, Ellen and Drew, Jill  The Crash: Risk and Regulation - What Went Wrong, The Washington Post, October 15, 2008 

Born declined to publicly comment on the unfolding 2008 crisis until March 2009, when she said: "The market grew so enormously, with so little oversight and regulation, that it made the financial crisis much deeper and more pervasive than it otherwise would have been " She also lamented the influence of Wall Street lobbyists on the process and the refusal of regulators to discuss even modest reforms 

An October 2009 Frontline documentary titled "The Warning"  described Born's thwarted efforts to regulate and bring transparency to the derivatives market, and the continuing opposition thereto  The program concluded with an excerpted interview with Born sounding another warning: "I think we will have continuing danger from these markets and that we will have repeats of the financial crisis -- may differ in details but there will be significant financial downturns and disasters attributed to this regulatory gap, over and over, until we learn from experience "

In 2009 Born, along with Sheila Bair of the FDIC, was awarded the John F  Kennedy Profiles in Courage Award in recognition of the "political courage she demonstrated in sounding early warnings about conditions that contributed" to the 2007-08 financial crisis   According to Caroline Kennedy, "Brooksley Born recognized that the financial security of all Americans was being put at risk by the greed, negligence and opposition of  powerful and well connected interests     The catastrophic financial events of recent months have  proved them [Born and Sheila Bair] right "  One member of the President's working group had a change of heart about Brooksley Born   SEC Chairman Arthur Levitt stated "I've come to know her as one of the most capable, dedicated, intelligent and committed public servants that I have ever come to know", adding that "I could have done much better  I could have made a difference" in response to her warnings 

In 2010, a documentary film Inside Job further alleged that derivatives regulation was ineffective from the Clinton administration on  Along with fellow whistleblower, former IMF Chief Economist Raghuram Rajan, who was also scorned by the economic establishment, Brooksley Born was cited as one of the authorities arguing that financial derivatives increase economic risk 

 Personal life 
Born is married to Alexander E  Bennett (also retired from Arnold & Porter)   She has five adult children - two from a previous marriage to Jacob Landau and three stepchildren  Notably, Born was named a partner at Arnold & Porter while working part-time so she could raise her two young children   When both of her children were school-age, Born returned to practice full-time 

References

External links
Attorney profile at Arnold & Porter
Brooksley Born (2009 Winner) of the Profiles in Courage Award, with acceptance speech transcript and NECN video

Profile at MarketsWiki
Speeches and statements
"Testimony Of Brooksley Born Chairperson of the CFTC Concerning The Over-The-Counter Derivatives Market", before the House Committee On Banking And Financial Services, July 24, 1998 
"The Lessons of Long Term Capital Management L P ", Remarks of Brooksley Born, Chairperson of the CFTC, Chicago-Kent-IIT Commodities Law Institute, Chicago, Illinois, October 15, 1998 
 Interview: Brooksley Born for "PBS Frontline: The Warning", PBS, (streaming VIDEO 1 hour), October 20, 2009 
Articles
Manuel Roig-Franzia  "Credit Crisis Cassandra:Brooksley Born's Unheeded Warning Is a Rueful Echo 10 Years On", The Washington Post, May 26, 2009
 Taibbi, Matt  "The Great American Bubble Machine", Rolling Stone'', July 9–23, 2009

1940 births
American women lawyers
Arnold & Porter people
Clinton administration personnel
Columbus School of Law faculty
Commodity Futures Trading Commission personnel
Heads of United States federal agencies
Lawyers from San Francisco
Living people
Stanford Law School alumni
21st-century American women
Stanford University alumni
Context 3:  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_256_phys}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover256bits_phys_total pdf}
	\caption{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{256}$  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:minimal_grover_256_phys_total}


\section{RSA schemes\label{sct::rsa}}
In the following section we compute the space/time tradeoffs for attacking public-key cryptographic schemes based on factoring large numbers, 
namely RSA-1024, RSA-2048, RSA-3072, RSA-4096, RSA-7680 and RSA-15360 
For each scheme, we plot the space/time tradeoff points then fit it with a third degree polynomial, for $p_g=10^{-3}$ and $p_g=10^{-5}$, respectively 

\subsection{RSA-1024}

\includegraphics[width=0 475\textwidth]{figures/10minus3/RSA1024 png}
\captionof{figure}{RSA-1024 space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 3 01\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $3 01\times 10^{11}$, the corresponding number of logical qubits is 2050, and the total number of surface code cycles is $5 86\times 10^{13}$  The quantity $R^2$ represents the coefficient of determination (closer to 1, better the fitting)  The classical security parameter is approximately 80 bits }
\label{fgr:rsa1024a} 

\includegraphics[width=0 475\textwidth]{figures/10minus5/RSA1024 png}
\captionof{figure}{RSA-1024 space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 2 14\times 10^6$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $3 01\times 10^{11}$, the corresponding number of logical qubits is 2050, and the total number of surface code cycles is $2 93\times 10^{13}$  The classical security parameter is approximately 80 bits }
\label{fgr:rsa1024b}


\subsection{RSA-2048}

\includegraphics[width=0 475\textwidth]{figures/10minus3/RSA2048 png}
\captionof{figure}{RSA-2048 space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 1 72\times 10^8$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $2 41\times 10^{12}$, the corresponding number of logical qubits is 4098, and the total number of surface code cycles is $4 69\times 10^{14}$  The classical security parameter is approximately 112 bits }
\label{fgr:rsa2048a}



\includegraphics[width=0 475\textwidth]{figures/10minus5/RSA2048 png}
\captionof{figure}{RSA-2048 space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 9 78\times 10^6$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $2 41\times 10^{12}$, the corresponding number of logical qubits is 4098, and the total number of surface code cycles is $2 35\times 10^{14}$  The classical security parameter is approximately 112 bits }
\label{fgr:rsa2048b}


\subsection{RSA-3072}

\includegraphics[width=0 475\textwidth]{figures/10minus3/RSA3072 png}
\captionof{figure}{RSA-3072 space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 6 41\times 10^8$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $8 12\times 10^{12}$, the corresponding number of logical qubits is 6146, and the total number of surface code cycles is $1 58\times 10^{15}$  The classical security parameter is approximately 128 bits }
\label{fgr:rsa3072a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/RSA3072 png}
\captionof{figure}{RSA-3072 space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 2 55\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $8 12\times 10^{12}$, the corresponding number of logical qubits is 6146, and the total number of surface code cycles is $7 91\times 10^{14}$  The classical security parameter is approximately 128 bits }
\label{fgr:rsa3072b}


\subsection{RSA-4096}

\includegraphics[width=0 475\textwidth]{figures/10minus3/RSA4096 png}
\captionof{figure}{RSA-4096 space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 1 18\times 10^9$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $1 92\times 10^{13}$, the corresponding number of logical qubits is 8194, and the total number of surface code cycles is $3 75\times 10^{15}$  The classical security parameter is approximatively approximately 156 bits }
\label{fgr:rsa4096a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/RSA4096 png}
\captionof{figure}{RSA-4096 space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 5 70\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $1 92\times 10^{13}$, the corresponding number of logical qubits is 8194, and the total number of surface code cycles is $1 88\times 10^{15}$  The classical security parameter is approximatively approximately 156 bits }
\label{fgr:rsa4096b}


\subsection{RSA-7680}

\includegraphics[width=0 475\textwidth]{figures/10minus3/RSA7680 png}
\captionof{figure}{RSA-7680 space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 7 70\times 10^{10}$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $1 27\times 10^{14}$, the corresponding number of logical qubits is 15362, and the total number of surface code cycles is $2 64\times 10^{16}$  The classical security parameter is approximately 192 bits }
\label{fgr:rsa7680a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/RSA7680 png}
\captionof{figure}{RSA-7680 space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 7 41\times 10^{9}$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $1 27\times 10^{14}$, the corresponding number of logical qubits is 15362, and the total number of surface code cycles is $2 47\times 10^{16}$  The classical security parameter is approximately 192 bits }
\label{fgr:rsa7680b}


\subsection{RSA-15360}

\includegraphics[width=0 475\textwidth]{figures/10minus3/RSA15360 png}
\captionof{figure}{RSA-15360 space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 4 85\times 10^{12}$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $1 01\times 10^{15}$, the corresponding number of logical qubits is 30722, and the total number of surface code cycles is $2 24\times 10^{17}$  The classical security parameter is approximately 256 bits }
\label{fgr:rsa15360a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/RSA15360 png}
\captionof{figure}{RSA-15360 space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 7 64\times 10^{10}$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $1 01\times 10^{15}$, the corresponding number of logical qubits is 30722, and the total number of surface code cycles is $1 98\times 10^{17}$  The classical security parameter is approximately 256 bits }
\label{fgr:rsa15360b}


\section{Elliptic curve schemes\label{sct::ecc}}
In the following section we compute the space/time tradeoffs for attacking public-key cryptographic schemes based on solving the discrete logarithm 
problem in finite groups generated over elliptic curves, namely NIST P-160, NIST P-192, NIST P-224, NIST P-256, NIST P-384 and NIST P-521  For 
each scheme, we plot the space/time tradeoff points then fit it with a third degree polynomial, for $p_g=10^{-3}$ and $p_g=10^{-5}$, respectively  We 
used the logical circuits from~\cite{1706 06752} 

\subsection{NIST P-160}

\includegraphics[width=0 475\textwidth]{figures/10minus3/P160 png}
\captionof{figure}{NIST P-160 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 1 81\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $2 08\times 10^{11}$, the corresponding number of logical qubits is 1466, and the total number of surface code cycles is $4 05\times 10^{13}$  The classical security parameter is 80 bits }
\label{fgr:p160a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/P160 png}
\captionof{figure}{NIST P-160 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 1 38\times 10^6$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $2 08\times 10^{11}$, the corresponding number of logical qubits is 1466, and the total number of surface code cycles is $2 03\times 10^{13}$  The classical security parameter is 80 bits }
\label{fgr:p160b}


\subsection{NIST P-192}

\includegraphics[width=0 475\textwidth]{figures/10minus3/P192 png}
\captionof{figure}{NIST P-192 space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 3 37\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $3 71\times 10^{11}$, the corresponding number of logical qubits is 1754, and the total number of surface code cycles is $7 23\times 10^{13}$  The classical security parameter is 96 bits }
\label{fgr:p192a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/P192 png}
\captionof{figure}{NIST P-192 space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 2 18\times 10^6$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $3 71\times 10^{11}$, the corresponding number of logical qubits is 1754, and the total number of surface code cycles is $3 62\times 10^{13}$  The classical security parameter is 96 bits }
\label{fgr:p192b}


\subsection{NIST P-224}

\includegraphics[width=0 475\textwidth]{figures/10minus3/P224 png}
\captionof{figure}{NIST P-224 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 4 91\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $5 90\times 10^{11}$, the corresponding number of logical qubits is 2042, and the total number of surface code cycles is $1 15\times 10^{14}$  The classical security parameter is 112 bits }
\label{fgr:p224a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/P224 png}
\captionof{figure}{NIST P-224 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 3 24\times 10^6$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $5 90\times 10^{11}$, the corresponding number of logical qubits is 2042, and the total number of surface code cycles is $5 75\times 10^{13}$  The classical security parameter is 112 bits }
\label{fgr:p224b}


\subsection{NIST P-256}

\includegraphics[width=0 475\textwidth]{figures/10minus3/P256 png}
\captionof{figure}{NIST P-256 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 6 77\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $8 82\times 10^{11}$, the corresponding number of logical qubits is 2330, and the total number of surface code cycles is $1 72\times 10^{14}$  The classical security parameter is 128 bits }
\label{fgr:p256a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/P256 png}
\captionof{figure}{NIST P-256 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 4 64\times 10^6$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $8 82\times 10^{11}$, the corresponding number of logical qubits is 2330, and the total number of surface code cycles is $8 60\times 10^{13}$  The classical security parameter is 128 bits }
\label{fgr:p256b}


\subsection{NIST P-384}

\includegraphics[width=0 475\textwidth]{figures/10minus3/P384 png}
\captionof{figure}{NIST P-384 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 2 27\times 10^8$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $3 16\times 10^{12}$, the corresponding number of logical qubits is 3484, and the total number of surface code cycles is $6 17\times 10^{14}$  The classical security parameter is 192 bits }
\label{fgr:p384a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/P384 png}
\captionof{figure}{NIST P-384 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 1 28\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $3 16\times 10^{12}$, the corresponding number of logical qubits is 3484, and the total number of surface code cycles is $3 08\times 10^{14}$  The classical security parameter is 192 bits }
\label{fgr:p384b}

\subsection{NIST P-521}

\includegraphics[width=0 475\textwidth]{figures/10minus3/P521 png}
\captionof{figure}{NIST P-521 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 6 06\times 10^8$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $7 98\times 10^{12}$, the corresponding number of logical qubits is 4719, and the total number of surface code cycles is $1 56\times 10^{15}$  The classical security parameter is 256 bits }
\label{fgr:p521a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/P521 png}
\captionof{figure}{NIST P-521 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 2 30\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $7 98\times 10^{12}$, the corresponding number of logical qubits is 4719, and the total number of surface code cycles is $7 78\times 10^{14}$  The classical security parameter is 256 bits }
\label{fgr:p521b}




\section{Summary and conclusions}\label{sct::conclusion}
We analyzed the security of several widely used symmetric ciphers and hash functions against parallelized quantum adversaries  We computed the security parameter, wall-time and physical footprint for each cryptographic primitive  Our attack model was based on a brute force searching via a parallelized version of Grover's algorithm, assuming a surface-code fault-tolerant architecture based on defects and braiding techniques 

It is worth noting that throughout we are assuming that brute-force search where we treat the cryptographic function as a black-box is essentially the optimal attack against SHA and AES, which is currently believed to be the case 

Some symmetric key algorithms are susceptible in a model that permits ``superposition attacks''~\cite{quantph 1602 05973}  In most realistic instances, these attacks are not practical, however they do shed light on the limitations of certain security proof methods in a quantum context, and remind us that we shouldn't take for granted that non-trivial attacks on symmetric key cryptography may be possible 
For example, very recently, there have been several cryptanalysis results~\cite{1712 06239} and~\cite{1802 03856} that attempt to reduce breaking some symmetric algorithms to solving a system of non-linear equations   Solving these non-linear equations is then attacked using a modified version of the quantum linear equation solver algorithm~\cite{PhysRevLett 103 150502}  The results are heavily dependent on the condition number of the non-linear system, which turns to be hard to compute (it is not known for most ciphers and hash functions such as AES or SHA)  Provided the condition number is relatively small, then one may get an  advantage compared to brute-force Grover search  However at this time it is not clear whether this is indeed the case, and we do not have large-scale quantum computers to experiment with 

The quantum security parameter (based on our assumptions of using state-of-the-art algorithms and fault-tolerance methods) for symmetric and hash-based cryptographic schemes is summarized in Table~\ref{tbl1}  For more details about space/time tradeoffs achievable via parallelization of Grover's algorithm please see the corresponding Sec ~\ref{sct::ciphers}, Sec ~\ref{sct::hash} and Sec ~\ref{sct::bitcoin}, respectively 
\begin{table}[h!]
\begin{tabular}{ll}
\hline
Name    & qs  \\
\hline
AES-128 & 106 \\
AES-192 & 139 \\
AES-256 & 172 \\
\hline
SHA-256 & 166 \\
SHA3-256	 &167 \\
Bitcoin's PoW & 75\\
\hline
\end{tabular}
\caption{Quantum security parameter ($qs$) for the AES family of ciphers, SHA family of hash functions, and Bitcoin, assuming a conservative physical error rate per gate $p_g=10^{-4}$ }
\label{tbl1}
\end{table}

We also analyzed the security of asymmetric (public-key) cryptography, in particular RSA and ECC, in the light of new improvements in fault-tolerant 
quantum error correction based on surface code lattice surgery techniques  We computed the space/time tradeoff required to attack 
every scheme, using physical error rates of $10^{-3}$ and $10^{-5}$, respectively  We fitted the data with a third degree polynomial, which resulted in an analytical formula of the number of qubits required to break the 
scheme as a function of time 

The total number of physical qubits required to break the RSA schemes in 24 hours, together with the required number of $T$ gates, corresponding number of surface code cycles and corresponding classical security parameter is summarized in Table~\ref{tbl2}  For more details about possible space/time tradeoffs please see the corresponding Section~\ref{sct::rsa} of the manuscript 
\begin{table}[]
\begin{tabular}{lllll}
\hline
Name      & nq                    & Tc                    & scc           & s        \\
\hline
RSA-1024  & $3 01 \times 10^7$    & $3 01 \times 10^{11}$ & $5 86 \times 10^{13}$ & 80\\
RSA-2048  & $1 72 \times 10^8$    & $2 41 \times 10^{12}$ & $4 69 \times 10^{14}$ & 112\\
RSA-3072  & $6 41 \times 10^8$    & $8 12 \times 10^{12}$ & $1 58 \times 10^{15}$ & 128\\
RSA-4096  & $1 18 \times 10^9$    & $1 92 \times 10^{13}$ & $3 75 \times 10^{15}$ & 156\\
RSA-7680  & $7 70 \times 10^{10}$ & $1 27 \times 10^{14}$ & $2 64 \times 10^{16}$ & 192\\
RSA-15360 & $4 85 \times 10^{12}$ & $1 01 \times 10^{15}$ & $2 24 \times 10^{17}$ & 256\\
\hline
\end{tabular}
\caption{The total physical footprint ($nq$) required to break the RSA schemes in 24 hours, together with the required number of $T$ gates ($Tc$), the corresponding number of surface code cycles ($scc$), and the corresponding classical security parameter ($s$) 
We assume a very conservative physical error rate per gate $p_g=10^{-3}$, more likely to be achievable by the first generations of fault-tolerant quantum computers }
\label{tbl2}
\end{table}

The total number of physical qubits required to break the ECC schemes in 24 hours, together with the required number of $T$ gates, corresponding number of surface code cycles and corresponding classical security parameter is summarized in in Table~\ref{tbl3}  For more details about possible space/time tradeoffs please see the corresponding Section~\ref{sct::ecc} of the manuscript  As observed before in~\cite{1706 06752}, breaking RSA schemes demands more quantum resources in comparison with elliptic curve-based schemes, for the same level of classical security 
\begin{table}[]
\begin{tabular}{lllll}
\hline
Name  & nq                 & Tc                    & scc          & s          \\
\hline
P-160 & $1 81 \times 10^7$ & $2 08 \times 10^{11}$ & $4 05 \times 10^{13}$ & 80\\
P-192 & $3 37 \times 10^7$ & $3 71 \times 10^{11}$ & $7 23 \times 10^{13}$ & 96\\
P-224 & $4 91 \times 10^7$ & $5 90 \times 10^{11}$ & $1 15 \times 10^{14}$ & 112\\
P-256 & $6 77 \times 10^7$ & $8 82 \times 10^{11}$ & $1 72 \times 10^{14}$ & 128\\
P-384 & $2 27 \times 10^8$ & $3 16 \times 10^{12}$ & $6 17 \times 10^{14}$ & 192\\
P-521 & $6 06 \times 10^8$ & $7 92 \times 10^{12}$ & $1 56 \times 10^{15}$ & 260\\
\hline
\end{tabular}
\caption{The total physical footprint ($nq$) required to break the ECC schemes in 24 hours, together with the required number of $T$ gates ($Tc$), the corresponding number of surface code cycles ($scc$), and the corresponding classical security parameter ($s$)  We assume a very conservative physical error rate per gate $p_g=10^{-3}$, more likely to be achievable by the first generations of fault-tolerant quantum computers }
\label{tbl3}
\end{table}

Recent developments in the theory of fault-tolerant quantum error correction have great impact on evaluating the effective strength of cryptographic
schemes against quantum attacks, as the fault-tolerant layer of a quantum computation is the most resource-intensive part of running a quantum  
algorithm  Therefore, monitoring the advances in the theory of quantum error correction is of crucial importance when estimating the strength (or 
weakness) of a cryptographic scheme against a quantum adversary  This work serves as a benchmark against which the impact of future advances can be compared 

\begin{acknowledgments} 
Most of this work is based on research supported by the Global Risk Institute for its members 
We also acknowledge support from NSERC and CIFAR  IQC and the Perimeter Institute are supported in part by the 
Government of Canada and the Province of Ontario   Vlad Gheorghiu thanks Austin Fowler for helpful discussions 
and clarifications regarding lattice surgery methods 
\end{acknowledgments}

\bibliographystyle{aipnum4-1}





ground_truth: June 1, 1999.

prompt_front: Now, answer the following question based on the text below, only give me the answer and do not output any other words.

Question: What is the security parameter for the AES-256 block cipher?

Read the following text and answer briefly.

Context 4:  The best performing model checkpoint was chosen according to the epoch-wise validation macro-F1 score  5 Experiments and Results

Experiments using Large Language Models

For the task of Dialect Identification we have tried various language specific models like XLM-RoBERTa, BERT, ELECTRA, RoBERTa and GPT- 2  The base variant of all these models were used and all the models were used through the Hugging-Face library  The pooler output of these models was passed through a linear layer and the models were fine-tuned 
First, we experimented with different models for Track-1  All the models were trained for 20 epochs with learning rate 1e-6, weight decay 1e-6 and a batch size of 8  We used XLM-RoBERTa as the baseline for all 3 languages  The best performing models for the English language were RoBERTa and BERT whereas GPT-2 was the worst performing 
Similarly the language specific versions of RoBERTa and BERT performed well for the Spanish and Portuguese respectively  Overall the worst performing model was GPT-2 across all 3 languages  The validation F1 scores are present in Table   The two best-performing models for every language were chosen for Track-2 
The same procedure as specified above was used and the F1 scores are present in Table   The train and validation F1 scores for 2-class classification are higher for all models as compared to the F1 score of the same models for 3-class classification  This was mainly due to the poor representation and accuracy of classification of the third class 
We observed symptoms of overfitting in all models after 12-15 epochs and the best validation F1 score was obtained in the range of 4-8 epochs 

LID experiments

The pipeline for dialect identification is divided into two parts as the sentences in the dataset belong to different languages  The stages are described in Section 4  The XLM-RoBERTa we have used for language classification has a test accuracy of 99 6% meaning it correctly classifies all input sentences and hence, can be considered as a perfect classifier 
For the final pipeline we experimented using the two best performing models for each language in Track-1 and Track-2  For both the tracks we experimented with all 8 (2 3 ) possible combinations of models and calculated the validation F1 score for the combined validation dataset which had sentences belonging to all languages 
The validation scores for Track-1 and Track-2 are shown in Table and Table respectively  For both the tracks, the three pipelines with the best validation F1 scores were chosen for submission 

Using 3-way classifier as a 2-way classifier

In Track-1, participants are expected to train a classifier which classifies amongst 9 classes, and in Track-2, participants are expected to train a classifier which classifies amongst 6 classes  These 6 classes are a proper subset of the 9 classes from Track-1  Thus, an intuitive baseline for Track-2 is to use the model finetuned for Track-1, whilst considering only the relevant classes for the latter task 
The classes EN , ES and P T , i e  the classes without any national dialect associated with them are not included in Track-2 as compared to Track-1  Thus, we calculate the predictions for the Track-2 validation dataset using the models for Track-1 and exclude the metrics for Track-1 specific classes to get the metrics for this "adapted" 2-way classification 
We show the results of this experiment in Table and observe that, as expected, the adapted 2-way classification performs worse compared to the explicitly finetuned variant 

Results for Track-1 and Track-2

We now present our experiments and their performance for both tracks  Our experiments for Track-1 are described in Table and our experiments for Track-2 are described in Table   The participants were allowed three submissions for evaluation on the test set, so we submitted predictions using the three systems which performed the best on the validation set 
As mentioned in Section 5 2, we performed 2 3 , i e  a total of 8 experiments using the two best models for each language  We observed that RoBERTa base on English, Spanish BERT base on Spanish and Portuguese BERT base performed the best on the testing set for Track-1  The same combination, with RoBERTa base for English, worked best for Track-2 
All of our submissions were the top submissions for each track, which surpassed the next best competitors by a margin of 4 5% and 5 6% for Track-1 and Track-2 respectively 

Ablation of best submissions

We hereby make some observations of our submissions and other experiments  To assist this, we plot the confusion matrices of our best submissions for Track-1 and Track-2 in Figures respectively  Note that these confusion matrices have their rows (i e  true labels axes) normalized according to the number of samples in the class 
Here are observations from our experiments: 1  BERT-based models outperform other models across all languages: We observe that BERT-based models outperform ELECTRA-based and GPT-2-based models, as shown in Table   We speculate this is because of the inherent architecture of BERT, which combines semantic learning with knowledge retention 
This combination of traits is particularly useful for this task  2  Common labels perform the worst across all languages: We observe that the common labels EN , ES and P T perform the worst, both in the individual as well as the two-stage setup  We hypothesize this is because of the absence of dialect specific words, or words that are specific to the geographical origin of the national dialect (for example, "Yankees" for EN-US and "Oxford" for EN-GB) 
3  English models work better than models of other languages: It can be noted from Figures 4 and 3 that the English models have the best performance across all classes  This can be attributed to two reasons: absence of national dialect specific words and lesser pretraining data in the case of Portuguese 
4  British English is most correctly classified class: We can observe that the Spanish or Portuguese models make equal number of mistakes in the case of either national dialect, in the case of Track-2 (see Figure )  However, in the case of English, the label EN − GB is correctly classified for more than 95% of the cases 
We speculate this is because British English involves slightly distinctive grammar and semantics, which help the model separate it from other classes  5  The proposed 2-step method is scalable for multiple language dialect classification: We can strongly assert that the novel 2-step deep learning method for multilingual dialect classification is a scalable method for the task due to two specific reasons: firstly, the multilingual models (like XLM-RoBERTa) might not have the vocabulary as well as the learning capabilities to learn the minute differences between individual dialects 
Secondly, this system can be quickly expanded for a new language by simply adding a language specific dialect classifier, provided the language identification model supports that particular language 

Conclusion

In this paper we propose a two-stage classification pipeline for dialect identification for multilingual corpora  We conduct thorough ablations on this setup and provide valuable insights  We foresee multiple future directions for this work  The first is to expand this work to many languages and dialects 
Secondly, it is a worthwhile research direction to distill this multi-model setup into a single model with multiple prediction heads  The obvious limitation of this system is the excessive memory consumption due to the usage of language specific models  For low resource languages this system is difficult to train and scale 
We hope that these problems will be addressed by researchers in future works 



ground_truth: 172.