prompt_front: Now, answer the following question based on the text below, only give me the answer and do not output any other words.

Question: What is the security parameter for the AES-256 block cipher?

Read the following text and answer briefly.

Context 1: \section{Introduction\label{sct::intro}}
Symmetric, public-key (asymmetric) and hash-based cryptography constitute a fundamental pillar of modern cryptography  
Symmetric cryptography includes symmetric-key encryption, where a shared secret key is used for both encryption and decryption  Cryptographic hash functions map arbitrarily long strings to strings of a fixed finite length  Currently deployed public-key schemes are
used to establish a common secret key between two remote parties  They are based on factoring large numbers or solving the discrete logarithm problem over a finite group  For more details about modern cryptography the interested reader can consult one of the many excellent references on the topic, e g ~\cite{Katz:2007:IMC:1206501} 

In contrast to asymmetric schemes based on factoring or solving the discrete logarithm problem and which are completely broken by a quantum adversary via Shor's algorithm~\cite{SJC 26 1484}, symmetric schemes and hash functions are less vulnerable to quantum attacks  The best known quantum attacks against them are based on Grover's quantum search algorithm~\cite{PhysRevLett 79 325}, which offers a quadratic speedup compared to classical brute force searching  Given a search space of size $N$, Grover's algorithm finds, with high probability, an element $x$ for which a certain property such as $f(x)=1$ holds, for some function $f$ we know how to evaluate (assuming such a solution exists)  The algorithm evaluates $f$ a total of $\mathcal{O}(\sqrt{N})$ times  It applies a simple operation in between the evaluations of $f$, so the $\mathcal{O}(\sqrt{N})$ evaluations of $f$ account for most of the complexity  In contrast, any classical algorithm that evaluates $f$ in a similar ``black-box'' way requires on the order of $N$ evaluations of $f$ to find such an element 

Any quantum algorithm can be mapped to a quantum circuit, which can be implemented on a quantum computer  The quantum circuit represents what we call the ``logical layer"  Such a circuit can always be decomposed in a sequence of ``elementary 
gates", such as Clifford gates (CNOT, Hadamard etc ~\cite{NC00}) augmented by a non-Clifford gate such as the T gate 

Running a logical circuit on a full fault-tolerant quantum computer is highly non-trivial  The sequence of logical gates have to be mapped to 
sequences of surface code measurement cycles (see e g ~\cite{PhysRevA 86 032324} for extensive details)  By far, the most resource-consuming (in 
terms of number of qubits required and time) is the T gate\footnote{Clifford gates are ``cheap", i e  they require relatively small overhead for implementation in the surface code, but are not universals, hence a non-Clifford gate is required  One such gate is the T gate  There are other possible choices, however all of the non-Clifford gates require special techniques such as magic state distillation~\cite{1367-2630-14-12-123011,PhysRevA 86 052329} and significant overhead (order of magnitudes higher than Clifford gates) to be implemented in the surface code  In fact, to a first order approximation, for the purpose of resource estimation, one can simply ignore the overhead introduced by the Clifford gates and simply focus only on the T gates }  
In comparison with surface code defects and braiding techniques~\cite{PhysRevA 86 032324}, novel lattice surgery 
techniques~\cite{2018arXiv180806709F,1808 02892,1367-2630-14-12-123011} reduce the spatial overhead required for implementing T gates via magic state distillation by approximately a factor of 5, while also modestly improving the running time  

In this paper we first analyze the security of symmetric schemes and hash functions against large-scale fault-tolerant quantum adversaries, using surface code defects and braiding techniques  We take into account the time-space trade-offs with parallelizing quantum search, down to the fault-tolerant layer  Naively, one might hope that $K$ quantum computers (or quantum ``processors'', as we will call them later in the paper) running in parallel reduce the number the circuit depth down to $\mathcal{O}(\sqrt{N})/K$ steps, similar to the classical case of distributing a search space across $K$ classical processors  However quantum searching does not parallelize so well, and the required number of steps
for parallel quantum searching is of the order $\mathcal{O}(\sqrt{N/K})$~\cite{quantph 9711070}  This is a factor of $\sqrt{K}$ larger than $\mathcal{O}(\sqrt{N})/K$   As shown in~\cite{quantph 9711070}, the optimal way of doing parallel quantum search is to partition the search space into $N/K$ parts, and to perform independent quantum searches on each part 

Secondly, we investigate the security of public-key cryptographic schemes such as RSA and ECC against 
quantum attacks, using the latest developments in theory of fault-tolerant quantum error correction, i e  novel lattice surgery 
techniques~\cite{2018arXiv180806709F,1808 02892,1367-2630-14-12-123011} 

The remainder of this paper is organized as follows  In Sec ~\ref{sct::method}, we provide an overview of the methodology used in our analysis  In Sec ~\ref{sct::ciphers} we investigate the security of the AES family of modern symmetric ciphers  In Sec ~\ref{sct::hash} we analyze the security of the SHA family of hash functions  In Sec ~\ref{sct::bitcoin} we investigate the security of Bitcoin's~\cite{satoshi:bitcoin} proof-of-work consensus mechanism  We conclude our investigation of symmetric and hash-based cryptographic schemes in Sec ~\ref{sct::intrinsic_parallel_grover}, where we evaluate the intrinsic cost of running the Grover algorithm with a trivial oracle (i e , an oracle with a unit cost of 1 for each invocation) 

In the subsequent sections  we analyze public-key cryptographic schemes  In Sec ~\ref{sct::rsa} and Sec ~\ref{sct::ecc} we examine the most common public-key establishment schemes, such as RSA and ECC, respectively  In the subsequent sections  we analyze public-key cryptographic schemes  In Sec ~\ref{sct::rsa} and Sec ~\ref{sct::ecc} we examine the most common public-key establishment schemes, such as RSA and ECC, respectively  Finally we summarize our findings and conclude in Sec ~\ref{sct::conclusion} 
\section{Methodology\label{sct::method}}

\subsection{Symmetric cryptography and hash functions\label{sct::symmetric}}
The methodology, sketched in Fig ~\ref{fgr:flowchart_lite} and Fig ~\ref{fgr:full_algorithm}, follows the same lines as the one described in great detail in our earlier paper~\cite{10 1007/978-3-319-69453-5_18}, which we refer the interested reader to for more details 
\begin{figure}[htb]
	\centering
         \includegraphics[width=0 35\textwidth]{figures/flowchart_lite pdf}
         \caption{Analyzing an attack against a symmetric cryptographic function with a fault-tolerant quantum adversary  Our resource estimation methodology takes into account several of the layers between the high level description of an algorithm and the physical hardware required for its execution  Our approach is modular should assumptions about any of these layers change, and hence it allows one to calculate the impact of improvements in any particular layer }
         \label{fgr:flowchart_lite}
\end{figure}
\begin{figure}
	\centering
	 \includegraphics[width=0 46\textwidth]{figures/grover_vertical pdf}
          \caption{Grover searching with an oracle for $f : \{0,1\}^k \rightarrow \{0,1\}^k$  The algorithm makes $\lfloor \frac{\pi}{4} 2^{N/2}\rfloor$ calls to
$G$, the \emph{Grover iteration}, or, if parallelized on $K$ processors, $\lfloor \frac{\pi}{4} 2^{N/(2K)}\rfloor$ calls to $G$  The Grover iteration has two
subroutines  The first, $U_g$, implements the predicate $g : \{0,1\}^k
\rightarrow \{0,1\}$ that maps $x$ to $1$ if and only if $f(x) = y$  Each call to $U_g$ involves two calls to a reversible implementation of $f$ and one call to a comparison circuit that checks whether $f(x) = y$ }
          \label{fgr:full_algorithm}
\end{figure}

We assume a surface-code based fault-tolerant architecture~\cite{PhysRevA 86 032324}, using Reed-Muller distillation schemes~\cite{Fowler:2013aa}  For each scheme we vary the possible physical error rates per gate from $10^{-4}$ to $10^{-7}$  We believe that this range of physical error rates is wide enough to cover both first generation quantum computers as well as more advanced future machines 
In comparison to surface code defects and braiding methods~\cite{PhysRevA 86 032324}, lattice surgery 
techniques~\cite{2018arXiv180806709F,1808 02892,1367-2630-14-12-123011} mostly impact the physical footprint of the fault-tolerant layer required to run a specific quantum algorithm, reducing the distillation overhead by approximately a factor of 5  The temporal overhead (i e  the number of surface code cycles) is reduced less drastically  For this reason, lattice surgery has less significant effects in estimating the security of symmetric schemes or hash functions, reducing the security parameter\footnote{The security parameter is defined as the logarithm base two of the number of fundamental operations (in our case surface code cycles) required to break the scheme } by at most 1 and decreasing the spatial overhead by at most a factor of 5  Therefore when estimating the security of symmetric and hash-based cryptographic schemes we use surface code defects and braiding techniques 

For each cryptographic primitive, we display four plots, in the following order:
\begin{enumerate}
\item We plot the total number of surface code cycles per CPU (where a CPU is a quantum computer capable of executing a single instance of Grover's quantum search algorithm) as a function of the number of CPUs  We directly tie the quantum security parameter to the total number of surface code cycles (see~\cite{10 1007/978-3-319-69453-5_18} for more details)  We also add to the plot the theoretical lower bound achievable by quantum search in the cases of: a) considering the oracle a black box of unit cost (lower line), and b) considering the oracle as composed of ideal quantum gates, each of unit cost (upper line)  Note that the difference between b) and a) represents the intrinsic cost of logical overhead (i e  the overhead introduced by treating the oracle as a logical circuit and not a blackbox), whereas the difference between the upper lines and b) represents the intrinsic cost introduced by the fault-tolerant layer 

\item We plot the total wall-time per CPU (i e  how long will the whole computation take on a parallel quantum architecture) as a function of the number of CPUs  The horizontal dashed line represents the one-year time line, i e  the $x$ coordinate of the intersection point between the ``Total time per CPU'' line and the one-year time line provides the number of processors required to break the system within one year (in $\log_2$ units) 

\item We plot the total physical footprint (number of qubits) per CPU, as a function of the number of CPUs 
\item Finally we plot the total physical footprint (number of qubits) of all quantum search machines (CPUs) running in parallel 
\end{enumerate}

In the following sections we proceed to analyze symmetric ciphers (AES, Sec ~\ref{sct::ciphers}), hash functions (SHA-256, SHA3-256, Sec ~\ref{sct::hash}, Bitcoin's hash function, Sec ~\ref{sct::bitcoin}), and finally the minimal resources required for running Grover's algorithm with a trivial oracle~\ref{sct::intrinsic_parallel_grover} (e g  the identity gate) on search spaces of various sizes 

Note that in some ranges of the plots from sections~\ref{sct::ciphers},~\ref{sct::hash},~\ref{sct::intrinsic_parallel_grover} and~\ref{sct::bitcoin} the total physical footprint increases slightly with the number of processors, which may seem counter-intuitive  This happens due to the fact that with more processors the required code distances decrease, and in some instances one can pipeline more magic states factories in parallel into the surface code, which in effect causes an increase in the overall physical footprint  Note that the total time per CPU is monotonically decreasing, as parallelizing distilleries does not increase the wall time  For more details see~\cite{10 1007/978-3-319-69453-5_18}  

\subsection{Public-key cryptography\label{sct::pk}}

Most of the recent progress in quantum cryptanalysis is related to the fault-tolerant layer in Fig ~\ref{fgr:flowchart_lite}  New methods and techniques
based on surface code lattice surgery~\cite{2018arXiv180806709F,1808 02892,1367-2630-14-12-123011} allow a significant decrease of the overall 
footprint (number of qubits, or space) taken by the quantum computation, and also a relatively modest decrease in time, in comparison with  methods based on surface code defects and braiding~\cite{PhysRevA 86 032324,Fowler:2013aa} 

We consider the best up-to-date optimized logical quantum circuits for attacking RSA and ECC public-key 
schemes~\cite{1706 06752,PhysRevA 52 3457,cuccaro04,Beauregard:2003:CSA:2011517 2011525} then perform a physical footprint resource estimation
analysis using lattice surgery techniques  We remark that the overall time required to run the algorithm depends on the level of parallelization 
for the magic state factories\footnote{Every T gate in the circuit must be implemented by a specialized magic state factory, each of which occupies a 
significant physical footprint  One can implement more magic states in parallel if one is willing to increase the physical footprint of the computation }  

For each public-key cryptogrpric scheme, we analyze the space/time tradeoffs and plot the results on a double logarithmic scale  We fit the data using a third degree 
polynomial\footnote{A third degree polynomial fits the data very precisely, providing a coefficient of determination $R^2$ greater than 0 997 } and obtain an analytical closed-form formula for the relation between the time and the number of qubits required to attack the scheme, in 
the form

\begin{equation}\label{eqn1}
y(x) = \alpha x^3 + \beta x^2 + \gamma x + \delta,
\end{equation}
where $y$ represents logarithm base 2 of the number of qubits and $x$ represents the logarithm base 2 of the time (in seconds)  For example,
the quantity 
\begin{equation}\label{eqn2}
y\left(\log_2(24\times 3600)\right) \approx y(16 3987)
\end{equation}
represents how many qubits are required to break the scheme in one day (24 hours) for a fixed physical error rate per gate $p_g$, assuming a 
surface code cycle time of 200ns  Note that the computation time scales linearly with the surface code cycle time, e g  a 1000ns surface code cycle 
time will result in a computation that is 5 times longer than a $200ns$ surface code cycle time  Therefore, for a specific cryptographic scheme for 
which we plotted the space/time tradeoffs using a surface code cycle time of $200ns$ and a fixed physical error rate per gate $p_g$, the number of 
qubits required to break a specific scheme in a time $t$ using an alternative surface code cycle time $t_c$ is given by

\begin{equation}\label{eqn3}
y\left(\log_2\left(\frac{200ns}{t_c}t\right)\right),
\end{equation}
where $t$ is expressed in seconds and $t_c$ is expressed in nanoseconds 

We assume a surface code cycle time of 200ns, in conformance with~\cite{PhysRevA 86 032324}  For each scheme we analyze, we compare its security using the more conservative (and realistic in the short term) $p_g=10^{-3}$ and also the more optimistic  $p_g=10^{-5}$  Note that assuming the more optimistic assumption from a quantum computing perspective is the more conservative assumption from a cybersecurity perspective 

Furthermore, in this analysis, we are reporting the full physical footprint, including the memory required for magic state distillation 
Using present-day techniques, the memory required for generating these generic input states accounts for a substantial fraction of the total memory cost and thus we are including these in the total cost estimate and will track the impact of improved methods 

\section{Symmetric ciphers\label{sct::ciphers}}
Below we analyze the security of AES family of symmetric ciphers against large-scale fault-tolerant quantum adversaries  We used the highly optimized logical circuits produced in
\cite{10 1007/978-3-319-29360-8_3}  

\subsection{AES-128}

        \includegraphics[width=0 429\textwidth]{figures/AES-128_cycles pdf}
      	\captionof{figure}{AES-128 block cipher  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale)  The bottom brown line (theoretical lower bound, black box) represents the minimal number of queries required
	by Grover's algorithm, the cost function being the total number of queries to a black-box oracle, each query assumed to have unit cost, and a completely error-free circuit  The purple line (ideal grover, non-black-box) takes into consideration the structure of the oracle, the cost function being the total number of gates in the circuit, each gate having unit cost; the quantum circuit is assumed error-free as well  Both brown and magenta lines are displayed only for comparisons; for both of them, the $y$ axis should be interpreted as number of logical queries (operations, respectively) 	
The curves above the purple line show the overhead introduced by fault tolerance (in terms of required surface code cycles, each surface code cycle assumed to have unit cost)  More optimization at the logical layer will shift the purple line down, whereas more optimization at the fault-tolerant layer will move the upper curves closer to the purple line  Similar remarks to the above hold for the remaining plots in this manuscript }
      	\label{fgr:aes_128_cycles}
	
	For example, the plots in Fig ~\ref{fgr:aes_128_cycles} tells us that if we have $2^{50}$ quantum computers running Grover's algorithm in parallel, with no physical errors, then it would take about $2^{63}$ gate calls (where the purple line intersects the vertical line at $50$), where we assume each gate to have unit cost  Still with no errors, a trivial cost for implementing the cryptographic function (oracle) would bring the cost down to about $2^{38}$ oracle calls per quantum computer  Keeping the actual function implementation, but adding the fault-tolerant layer with a physical error rate of $10^{-7}$ (with appropriate assumptions and using state-of-the-art quantum error correction) pushes the cost up to around $2^{76}$ surface code cycles per quantum computer (where now each code cycle is assumed to have unit cost)  Similar remarks hold for the remaining plots in this manuscript 
        \includegraphics[width=0 429\textwidth]{figures/AES-128_time pdf}
      	\captionof{figure}{AES-128 block cipher  Required time per processor, as a function of the  number of processors ($\log_2$ scale)  The horizontal dotted line indicates one year  The $x$-axis is deliberately extended to show the necessary number of CPUs for a total time of one year  Thus the figure shows that it would take, with the stated assumptions, over $2^{80}$ parallel quantum searches to break AES-128 in a year  Similar remarks to the above hold for the remaining plots in this manuscript }
      	\label{fgr:aes_128_time}
        \includegraphics[width=0 429\textwidth]{figures/AES-128_phys pdf}
	\captionof{figure}{AES-128 block cipher  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:aes_128_phys}
        \includegraphics[width=0 429\textwidth]{figures/AES-128_phys_total pdf}
	\captionof{figure}{AES-128 block cipher  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:aes_128_phys_total}

\subsection{AES-192}

	
        \includegraphics[width=0 429\textwidth]{figures/AES-192_cycles pdf}
      	\captionof{figure}{AES-192 block cipher  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:aes_192_cycles}
	
        \includegraphics[width=0 429\textwidth]{figures/AES-192_time pdf}
      	\captionof{figure}{AES-192 block cipher  Required time per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:aes_192_time}
	
        \includegraphics[width=0 429\textwidth]{figures/AES-192_phys pdf}
	\captionof{figure}{AES-192 block cipher  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:aes_192_phys}
	
        \includegraphics[width=0 429\textwidth]{figures/AES-192_phys_total pdf}
	\captionof{figure}{AES-192 block cipher  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:aes_192_phys_total}


\subsection{AES-256}

	
        \includegraphics[width=0 429\textwidth]{figures/AES-256_cycles pdf}
      	\captionof{figure}{AES-256 block cipher  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:aes_256_cycles}
	
        \includegraphics[width=0 429\textwidth]{figures/AES-256_time pdf}
      	\captionof{figure}{AES-256 block cipher  Required time per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:aes_256_time}
	
        \includegraphics[width=0 429\textwidth]{figures/AES-256_phys pdf}
	\captionof{figure}{AES-256 block cipher  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:aes_256_phys}
	
        \includegraphics[width=0 429\textwidth]{figures/AES-256_phys_total pdf}
	\captionof{figure}{AES-256 block cipher  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:aes_256_phys_total}

\section{Hash functions\label{sct::hash}}
In this section we study the effect of parallelized Grover attacks on the SHA-256~\cite{SHA2} snd SHA3-256~\cite{SHA3} family of hash functions  We used the highly optimized logical circuits produced in~\cite{10 1007/978-3-319-69453-5_18} 

\subsection{SHA-256}

        \includegraphics[width=0 429\textwidth]{figures/SHA-256_cycles pdf}
      	\captionof{figure}{SHA-256 cryptographic hash function  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:sha_256_cycles}
        \includegraphics[width=0 429\textwidth]{figures/SHA-256_time pdf}
      	\captionof{figure}{SHA-256 cryptographic hash function  Required time per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:sha_256_time}
        \includegraphics[width=0 429\textwidth]{figures/SHA-256_phys pdf}
	\captionof{figure}{SHA-256 cryptographic hash function  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:sha_256_phys}
        \includegraphics[width=0 429\textwidth]{figures/SHA-256_phys_total pdf}
	\captionof{figure}{SHA-256 cryptographic hash function  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:sha_256_phys_total}


\subsection{SHA3-256}

        \includegraphics[width=0 429\textwidth]{figures/SHA3-256_cycles pdf}
      	\captionof{figure}{SHA3-256 cryptographic hash function  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:sha3_256_cycles}
        \includegraphics[width=0 429\textwidth]{figures/SHA3-256_time pdf}
      	\captionof{figure}{SHA3-256 cryptographic hash function  Required time per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:sha3_256_time}
        \includegraphics[width=0 429\textwidth]{figures/SHA3-256_phys pdf}
	\captionof{figure}{SHA3-256 cryptographic hash function  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:sha3_256_phys}
        \includegraphics[width=0 429\textwidth]{figures/SHA3-256_phys_total pdf}
	\captionof{figure}{SHA3-256 cryptographic hash function  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:sha3_256_phys_total}
\section{Bitcoin~\label{sct::bitcoin}}
In this section we analyze the security of Bitcoin's~\cite{satoshi:bitcoin} proof-of-work protocol, which is based on finding a hash\footnote{The hash function being used by the protocol is H($x$) := SHA-256(SHA-256($x$) } pre-image which that starts
with a certain number of zeros  The latter is dynamically adjusted by the protocol so that the problem is on average solved by
the whole network in 10 minutes  Currently, it takes around $2^{75}$ classical hashing operations~\cite{btc_difficulty} for finding a desired hash pre-image successfully via brute-force search with specialized hardware 
        \includegraphics[width=0 429\textwidth]{figures/SHA-256-Bitcoin_cycles pdf}
      	\captionof{figure}{Bitcoin's cryptographic hash function H($x$) := SHA-256(SHA-256($x$))  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:sha_256_bitcoin_cycles}
        \includegraphics[width=0 429\textwidth]{figures/SHA-256-Bitcoin_time pdf}
      	\captionof{figure}{Bitcoin's cryptographic hash function H($x$) := SHA-256(SHA-256($x$))  Required time per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:sha_256_bitcoin_time}
        \includegraphics[width=0 429\textwidth]{figures/SHA-256-Bitcoin_phys pdf}
	\captionof{figure}{Bitcoin's cryptographic hash function H($x$) := SHA-256(SHA-256($x$))  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:sha_256_bitcoin_phys}
        \includegraphics[width=0 429\textwidth]{figures/SHA-256-Bitcoin_phys_total pdf}
	\captionof{figure}{Bitcoin's cryptographic hash function H($x$) := SHA-256(SHA-256($x$))  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:sha_256_bitcoin_phys_total}


\section{Intrinsic cost of parallelized Grover's algorithm\label{sct::intrinsic_parallel_grover}}

More efficient quantum implementations of AES and SHA imply more efficient cryptanalysis  In this section, we aim to bound how much further optimized implementations of these cryptographic functions could help  We do so by assuming a trivial cost of $1$ for each function evaluation 

\subsection{Searching space of size $2^{56}$}

        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover56bits_cycles pdf}
      	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{56}$  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_56_cycles}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover56bits_time pdf}
      	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{56}$  Required time per processor, as a function of the  number of processors ($\log_2$ scale)  The dotted horizontal line indicates one year  }
      	\label{fgr:minimal_grover_56_time}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover56bits_phys pdf}
	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{56}$  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_56_phys}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover56bits_phys_total pdf}
	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{56}$  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:minimal_grover_56_phys_total}

\subsection{Searching space of size $2^{64}$}

        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover64bits_cycles pdf}
      	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{64}$  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_64_cycles}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover64bits_time pdf}
      	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{64}$  Required time per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_64_time}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover64bits_phys pdf}
	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{64}$  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_64_phys}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover64bits_phys_total pdf}
	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{64}$  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:minimal_grover_64_phys_total}

\subsection{Searching space of size $2^{128}$}

        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover128bits_cycles pdf}
      	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{128}$  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_128_cycles}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover128bits_time pdf}
      	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{128}$  Required time per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_128_time}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover128bits_phys pdf}
	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{128}$  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_128_phys}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover128bits_phys_total pdf}
	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{128}$  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:minimal_grover_128_phys_total}


\subsection{Searching space of size $2^{256}$}

        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover256bits_cycles pdf}
      	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{256}$  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_256_cycles}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover256bits_time pdf}
      	\caption{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{256}$  Required time per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_256_time}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover256bits_phys pdf}
	\caption{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{256}$  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_256_phys}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover256bits_phys_total pdf}
	\caption{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{256}$  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:minimal_grover_256_phys_total}


\section{RSA schemes\label{sct::rsa}}
In the following section we compute the space/time tradeoffs for attacking public-key cryptographic schemes based on factoring large numbers, 
namely RSA-1024, RSA-2048, RSA-3072, RSA-4096, RSA-7680 and RSA-15360 
For each scheme, we plot the space/time tradeoff points then fit it with a third degree polynomial, for $p_g=10^{-3}$ and $p_g=10^{-5}$, respectively 

\subsection{RSA-1024}

\includegraphics[width=0 475\textwidth]{figures/10minus3/RSA1024 png}
\captionof{figure}{RSA-1024 space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 3 01\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $3 01\times 10^{11}$, the corresponding number of logical qubits is 2050, and the total number of surface code cycles is $5 86\times 10^{13}$  The quantity $R^2$ represents the coefficient of determination (closer to 1, better the fitting)  The classical security parameter is approximately 80 bits }
\label{fgr:rsa1024a} 

\includegraphics[width=0 475\textwidth]{figures/10minus5/RSA1024 png}
\captionof{figure}{RSA-1024 space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 2 14\times 10^6$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $3 01\times 10^{11}$, the corresponding number of logical qubits is 2050, and the total number of surface code cycles is $2 93\times 10^{13}$  The classical security parameter is approximately 80 bits }
\label{fgr:rsa1024b}


\subsection{RSA-2048}

\includegraphics[width=0 475\textwidth]{figures/10minus3/RSA2048 png}
\captionof{figure}{RSA-2048 space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 1 72\times 10^8$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $2 41\times 10^{12}$, the corresponding number of logical qubits is 4098, and the total number of surface code cycles is $4 69\times 10^{14}$  The classical security parameter is approximately 112 bits }
\label{fgr:rsa2048a}



\includegraphics[width=0 475\textwidth]{figures/10minus5/RSA2048 png}
\captionof{figure}{RSA-2048 space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 9 78\times 10^6$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $2 41\times 10^{12}$, the corresponding number of logical qubits is 4098, and the total number of surface code cycles is $2 35\times 10^{14}$  The classical security parameter is approximately 112 bits }
\label{fgr:rsa2048b}


\subsection{RSA-3072}

\includegraphics[width=0 475\textwidth]{figures/10minus3/RSA3072 png}
\captionof{figure}{RSA-3072 space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 6 41\times 10^8$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $8 12\times 10^{12}$, the corresponding number of logical qubits is 6146, and the total number of surface code cycles is $1 58\times 10^{15}$  The classical security parameter is approximately 128 bits }
\label{fgr:rsa3072a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/RSA3072 png}
\captionof{figure}{RSA-3072 space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 2 55\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $8 12\times 10^{12}$, the corresponding number of logical qubits is 6146, and the total number of surface code cycles is $7 91\times 10^{14}$  The classical security parameter is approximately 128 bits }
\label{fgr:rsa3072b}


\subsection{RSA-4096}

\includegraphics[width=0 475\textwidth]{figures/10minus3/RSA4096 png}
\captionof{figure}{RSA-4096 space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 1 18\times 10^9$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $1 92\times 10^{13}$, the corresponding number of logical qubits is 8194, and the total number of surface code cycles is $3 75\times 10^{15}$  The classical security parameter is approximatively approximately 156 bits }
\label{fgr:rsa4096a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/RSA4096 png}
\captionof{figure}{RSA-4096 space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 5 70\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $1 92\times 10^{13}$, the corresponding number of logical qubits is 8194, and the total number of surface code cycles is $1 88\times 10^{15}$  The classical security parameter is approximatively approximately 156 bits }
\label{fgr:rsa4096b}


\subsection{RSA-7680}

\includegraphics[width=0 475\textwidth]{figures/10minus3/RSA7680 png}
\captionof{figure}{RSA-7680 space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 7 70\times 10^{10}$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $1 27\times 10^{14}$, the corresponding number of logical qubits is 15362, and the total number of surface code cycles is $2 64\times 10^{16}$  The classical security parameter is approximately 192 bits }
\label{fgr:rsa7680a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/RSA7680 png}
\captionof{figure}{RSA-7680 space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 7 41\times 10^{9}$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $1 27\times 10^{14}$, the corresponding number of logical qubits is 15362, and the total number of surface code cycles is $2 47\times 10^{16}$  The classical security parameter is approximately 192 bits }
\label{fgr:rsa7680b}


\subsection{RSA-15360}

\includegraphics[width=0 475\textwidth]{figures/10minus3/RSA15360 png}
\captionof{figure}{RSA-15360 space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 4 85\times 10^{12}$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $1 01\times 10^{15}$, the corresponding number of logical qubits is 30722, and the total number of surface code cycles is $2 24\times 10^{17}$  The classical security parameter is approximately 256 bits }
\label{fgr:rsa15360a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/RSA15360 png}
\captionof{figure}{RSA-15360 space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 7 64\times 10^{10}$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $1 01\times 10^{15}$, the corresponding number of logical qubits is 30722, and the total number of surface code cycles is $1 98\times 10^{17}$  The classical security parameter is approximately 256 bits }
\label{fgr:rsa15360b}


\section{Elliptic curve schemes\label{sct::ecc}}
In the following section we compute the space/time tradeoffs for attacking public-key cryptographic schemes based on solving the discrete logarithm 
problem in finite groups generated over elliptic curves, namely NIST P-160, NIST P-192, NIST P-224, NIST P-256, NIST P-384 and NIST P-521  For 
each scheme, we plot the space/time tradeoff points then fit it with a third degree polynomial, for $p_g=10^{-3}$ and $p_g=10^{-5}$, respectively  We 
used the logical circuits from~\cite{1706 06752} 

\subsection{NIST P-160}

\includegraphics[width=0 475\textwidth]{figures/10minus3/P160 png}
\captionof{figure}{NIST P-160 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 1 81\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $2 08\times 10^{11}$, the corresponding number of logical qubits is 1466, and the total number of surface code cycles is $4 05\times 10^{13}$  The classical security parameter is 80 bits }
\label{fgr:p160a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/P160 png}
\captionof{figure}{NIST P-160 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 1 38\times 10^6$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $2 08\times 10^{11}$, the corresponding number of logical qubits is 1466, and the total number of surface code cycles is $2 03\times 10^{13}$  The classical security parameter is 80 bits }
\label{fgr:p160b}


\subsection{NIST P-192}

\includegraphics[width=0 475\textwidth]{figures/10minus3/P192 png}
\captionof{figure}{NIST P-192 space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 3 37\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $3 71\times 10^{11}$, the corresponding number of logical qubits is 1754, and the total number of surface code cycles is $7 23\times 10^{13}$  The classical security parameter is 96 bits }
\label{fgr:p192a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/P192 png}
\captionof{figure}{NIST P-192 space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 2 18\times 10^6$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $3 71\times 10^{11}$, the corresponding number of logical qubits is 1754, and the total number of surface code cycles is $3 62\times 10^{13}$  The classical security parameter is 96 bits }
\label{fgr:p192b}


\subsection{NIST P-224}

\includegraphics[width=0 475\textwidth]{figures/10minus3/P224 png}
\captionof{figure}{NIST P-224 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 4 91\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $5 90\times 10^{11}$, the corresponding number of logical qubits is 2042, and the total number of surface code cycles is $1 15\times 10^{14}$  The classical security parameter is 112 bits }
\label{fgr:p224a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/P224 png}
\captionof{figure}{NIST P-224 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 3 24\times 10^6$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $5 90\times 10^{11}$, the corresponding number of logical qubits is 2042, and the total number of surface code cycles is $5 75\times 10^{13}$  The classical security parameter is 112 bits }
\label{fgr:p224b}


\subsection{NIST P-256}

\includegraphics[width=0 475\textwidth]{figures/10minus3/P256 png}
\captionof{figure}{NIST P-256 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 6 77\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $8 82\times 10^{11}$, the corresponding number of logical qubits is 2330, and the total number of surface code cycles is $1 72\times 10^{14}$  The classical security parameter is 128 bits }
\label{fgr:p256a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/P256 png}
\captionof{figure}{NIST P-256 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 4 64\times 10^6$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $8 82\times 10^{11}$, the corresponding number of logical qubits is 2330, and the total number of surface code cycles is $8 60\times 10^{13}$  The classical security parameter is 128 bits }
\label{fgr:p256b}


\subsection{NIST P-384}

\includegraphics[width=0 475\textwidth]{figures/10minus3/P384 png}
\captionof{figure}{NIST P-384 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 2 27\times 10^8$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $3 16\times 10^{12}$, the corresponding number of logical qubits is 3484, and the total number of surface code cycles is $6 17\times 10^{14}$  The classical security parameter is 192 bits }
\label{fgr:p384a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/P384 png}
\captionof{figure}{NIST P-384 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 1 28\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $3 16\times 10^{12}$, the corresponding number of logical qubits is 3484, and the total number of surface code cycles is $3 08\times 10^{14}$  The classical security parameter is 192 bits }
\label{fgr:p384b}

\subsection{NIST P-521}

\includegraphics[width=0 475\textwidth]{figures/10minus3/P521 png}
\captionof{figure}{NIST P-521 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 6 06\times 10^8$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $7 98\times 10^{12}$, the corresponding number of logical qubits is 4719, and the total number of surface code cycles is $1 56\times 10^{15}$  The classical security parameter is 256 bits }
\label{fgr:p521a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/P521 png}
\captionof{figure}{NIST P-521 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 2 30\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $7 98\times 10^{12}$, the corresponding number of logical qubits is 4719, and the total number of surface code cycles is $7 78\times 10^{14}$  The classical security parameter is 256 bits }
\label{fgr:p521b}




\section{Summary and conclusions}\label{sct::conclusion}
We analyzed the security of several widely used symmetric ciphers and hash functions against parallelized quantum adversaries  We computed the security parameter, wall-time and physical footprint for each cryptographic primitive  Our attack model was based on a brute force searching via a parallelized version of Grover's algorithm, assuming a surface-code fault-tolerant architecture based on defects and braiding techniques 

It is worth noting that throughout we are assuming that brute-force search where we treat the cryptographic function as a black-box is essentially the optimal attack against SHA and AES, which is currently believed to be the case 

Some symmetric key algorithms are susceptible in a model that permits ``superposition attacks''~\cite{quantph 1602 05973}  In most realistic instances, these attacks are not practical, however they do shed light on the limitations of certain security proof methods in a quantum context, and remind us that we shouldn't take for granted that non-trivial attacks on symmetric key cryptography may be possible 
For example, very recently, there have been several cryptanalysis results~\cite{1712 06239} and~\cite{1802 03856} that attempt to reduce breaking some symmetric algorithms to solving a system of non-linear equations   Solving these non-linear equations is then attacked using a modified version of the quantum linear equation solver algorithm~\cite{PhysRevLett 103 150502}  The results are heavily dependent on the condition number of the non-linear system, which turns to be hard to compute (it is not known for most ciphers and hash functions such as AES or SHA)  Provided the condition number is relatively small, then one may get an  advantage compared to brute-force Grover search  However at this time it is not clear whether this is indeed the case, and we do not have large-scale quantum computers to experiment with 

The quantum security parameter (based on our assumptions of using state-of-the-art algorithms and fault-tolerance methods) for symmetric and hash-based cryptographic schemes is summarized in Table~\ref{tbl1}  For more details about space/time tradeoffs achievable via parallelization of Grover's algorithm please see the corresponding Sec ~\ref{sct::ciphers}, Sec ~\ref{sct::hash} and Sec ~\ref{sct::bitcoin}, respectively 
\begin{table}[h!]
\begin{tabular}{ll}
\hline
Name    & qs  \\
\hline
AES-128 & 106 \\
AES-192 & 139 \\
AES-256 & 172 \\
\hline
SHA-256 & 166 \\
SHA3-256	 &167 \\
Bitcoin's PoW & 75\\
\hline
\end{tabular}
\caption{Quantum security parameter ($qs$) for the AES family of ciphers, SHA family of hash functions, and Bitcoin, assuming a conservative physical error rate per gate $p_g=10^{-4}$ }
\label{tbl1}
\end{table}

We also analyzed the security of asymmetric (public-key) cryptography, in particular RSA and ECC, in the light of new improvements in fault-tolerant 
quantum error correction based on surface code lattice surgery techniques  We computed the space/time tradeoff required to attack 
every scheme, using physical error rates of $10^{-3}$ and $10^{-5}$, respectively  We fitted the data with a third degree polynomial, which resulted in an analytical formula of the number of qubits required to break the 
scheme as a function of time 

The total number of physical qubits required to break the RSA schemes in 24 hours, together with the required number of $T$ gates, corresponding number of surface code cycles and corresponding classical security parameter is summarized in Table~\ref{tbl2}  For more details about possible space/time tradeoffs please see the corresponding Section~\ref{sct::rsa} of the manuscript 
\begin{table}[]
\begin{tabular}{lllll}
\hline
Name      & nq                    & Tc                    & scc           & s        \\
\hline
RSA-1024  & $3 01 \times 10^7$    & $3 01 \times 10^{11}$ & $5 86 \times 10^{13}$ & 80\\
RSA-2048  & $1 72 \times 10^8$    & $2 41 \times 10^{12}$ & $4 69 \times 10^{14}$ & 112\\
RSA-3072  & $6 41 \times 10^8$    & $8 12 \times 10^{12}$ & $1 58 \times 10^{15}$ & 128\\
RSA-4096  & $1 18 \times 10^9$    & $1 92 \times 10^{13}$ & $3 75 \times 10^{15}$ & 156\\
RSA-7680  & $7 70 \times 10^{10}$ & $1 27 \times 10^{14}$ & $2 64 \times 10^{16}$ & 192\\
RSA-15360 & $4 85 \times 10^{12}$ & $1 01 \times 10^{15}$ & $2 24 \times 10^{17}$ & 256\\
\hline
\end{tabular}
\caption{The total physical footprint ($nq$) required to break the RSA schemes in 24 hours, together with the required number of $T$ gates ($Tc$), the corresponding number of surface code cycles ($scc$), and the corresponding classical security parameter ($s$) 
We assume a very conservative physical error rate per gate $p_g=10^{-3}$, more likely to be achievable by the first generations of fault-tolerant quantum computers }
\label{tbl2}
\end{table}

The total number of physical qubits required to break the ECC schemes in 24 hours, together with the required number of $T$ gates, corresponding number of surface code cycles and corresponding classical security parameter is summarized in in Table~\ref{tbl3}  For more details about possible space/time tradeoffs please see the corresponding Section~\ref{sct::ecc} of the manuscript  As observed before in~\cite{1706 06752}, breaking RSA schemes demands more quantum resources in comparison with elliptic curve-based schemes, for the same level of classical security 
\begin{table}[]
\begin{tabular}{lllll}
\hline
Name  & nq                 & Tc                    & scc          & s          \\
\hline
P-160 & $1 81 \times 10^7$ & $2 08 \times 10^{11}$ & $4 05 \times 10^{13}$ & 80\\
P-192 & $3 37 \times 10^7$ & $3 71 \times 10^{11}$ & $7 23 \times 10^{13}$ & 96\\
P-224 & $4 91 \times 10^7$ & $5 90 \times 10^{11}$ & $1 15 \times 10^{14}$ & 112\\
P-256 & $6 77 \times 10^7$ & $8 82 \times 10^{11}$ & $1 72 \times 10^{14}$ & 128\\
P-384 & $2 27 \times 10^8$ & $3 16 \times 10^{12}$ & $6 17 \times 10^{14}$ & 192\\
P-521 & $6 06 \times 10^8$ & $7 92 \times 10^{12}$ & $1 56 \times 10^{15}$ & 260\\
\hline
\end{tabular}
\caption{The total physical footprint ($nq$) required to break the ECC schemes in 24 hours, together with the required number of $T$ gates ($Tc$), the corresponding number of surface code cycles ($scc$), and the corresponding classical security parameter ($s$)  We assume a very conservative physical error rate per gate $p_g=10^{-3}$, more likely to be achievable by the first generations of fault-tolerant quantum computers }
\label{tbl3}
\end{table}

Recent developments in the theory of fault-tolerant quantum error correction have great impact on evaluating the effective strength of cryptographic
schemes against quantum attacks, as the fault-tolerant layer of a quantum computation is the most resource-intensive part of running a quantum  
algorithm  Therefore, monitoring the advances in the theory of quantum error correction is of crucial importance when estimating the strength (or 
weakness) of a cryptographic scheme against a quantum adversary  This work serves as a benchmark against which the impact of future advances can be compared 

\begin{acknowledgments} 
Most of this work is based on research supported by the Global Risk Institute for its members 
We also acknowledge support from NSERC and CIFAR  IQC and the Perimeter Institute are supported in part by the 
Government of Canada and the Province of Ontario   Vlad Gheorghiu thanks Austin Fowler for helpful discussions 
and clarifications regarding lattice surgery methods 
\end{acknowledgments}

\bibliographystyle{aipnum4-1}


Context 2: Paper Info

Title: Deep Spiking Neural Networks with High Representation Similarity Model Visual Pathways of Macaque and Mouse
Publish Date: 22 May 2023
Author List: Zhengyu Ma (from Department of Networked Intelligence, Peng Cheng Laboratory), Yu Liutao (from Department of Networked Intelligence, Peng Cheng Laboratory), Huihui Zhou (from Department of Networked Intelligence, Peng Cheng Laboratory), Allen Brain
Author Affiliation: CORNet-S ConvNeXt-Tiny ConvNeXt-Small EfficientNet, AlexNet RegNetY, ResNet34 ConvNeXt-Base CORNetSEW, ResNet8 ResNet101 SEW-ResNet18 ViT-L, GoogLeNet SEW-ResNet34 SEW-ResNet8 Wide

Figure

Figure 1: To conduct neural representation similarity experiments, we apply three similarity metrics to a layer-by-layer comparison between the responses of models and the neural activities of visual cortex 
Figure 2: For three datasets and three similarity metrics, each point indicates the final representation similarity score of a model Each pair of SEW ResNet and ResNet with the same depth are linked by a gray solid line In almost all conditions, SEW ResNet outperforms ResNet by a large margin 
Figure3: For three datasets and three similarity metrics, we plot the trajectories of similarity score with model layer depth The models are divided into two groups: ResNet and SEW ResNet The normalized layer depth ranges from 0 (the first layer) to 1 (the last layer) Because the depths of models are not the same, we first discretize the normalized depth into 50 bins, and then apply the cubic spline interpolation to the scores of each model, yielding the smooth trajectories shown in the plot The fine, semitransparent lines are the trajectories of each model The thick lines are the average trajectories among each group 
Figure 5: For Macaque-Synthetic dataset, trajectories of similarity score with model layer depth are plotted The models are divided into two groups: ViT and CNN&SNN The normalized layer depth ranges from 0 (the first layer) to 1 (the last layer) The calculation and plotting of the trajectories are the same as Figure 3 
Figure6: The basic block of SpikingMobileNet "PW CONV" is the pointwise convolution and "DW CONV" is the depthwise convolution "SN" is the spiking neuron 
Figure 7: Overall model rankings of the similarity scores on Allen Brain mouse dataset The similarity scores of CNNs, SNNs and vision transformers are shown by blue, green and orange bars, respectively 
Figure 9: Overall model rankings of the similarity scores on Macaque-Synthetic dataset 
Figure 10: The Spearman's rank correlation between the overall model rankings of different metrics There is a strong correlation between SVCCA and TSVD-Reg, but RSA has weaker correlations with them 
The correlation between the similarity scores and the model depth r is Spearman's rank correlation coefficient "-" indicates that there is no significant correlation 
Architectures of SNNs "sn" denotes the spiking neuron "g = 32" denotes the grouped convolutions with 32 groups The hyper-parameters of the spike-element-wise block are shown in the brackets with the number of stacked blocks outside 

abstract

Deep artificial neural networks (ANNs) play a major role in modeling the visual pathways of primate and rodent  However, they highly simplify the computational properties of neurons compared to their biological counterparts  Instead, Spiking Neural Networks (SNNs) are more biologically plausible models since spiking neurons encode information with time sequences of spikes, just like biological neurons do 
However, there is a lack of studies on visual pathways with deep SNNs models  In this study, we model the visual cortex with deep SNNs for the first time, and also with a wide range of state-of-the-art deep CNNs and ViTs for comparison  Using three similarity metrics, we conduct neural representation similarity experiments on three neural datasets collected from two species under three types of stimuli 
Based on extensive similarity analyses, we further investigate the functional hierarchy and mechanisms across species  Almost all similarity scores of SNNs are higher than their counterparts of CNNs with an average of 6 6%  Depths of the layers with the highest similarity scores exhibit little differences across mouse cortical regions, but vary significantly across macaque regions, suggesting that the visual processing structure of mice is more regionally homogeneous than that of macaques 
Besides, the multi-branch structures observed in some top mouse brain-like neural networks provide computational evidence of parallel processing streams in mice, and the different performance in fitting macaque neural representations under different stimuli exhibits the functional specialization of information processing in macaques 
Taken together, our study demonstrates that SNNs could serve as promising candidates to better model and explain the functional hierarchy and mechanisms of the visual system  Originally, the prototype of deep neural networks is inspired by the biological vision system   To date, deep neural networks not only occupy an unassailable position in the field of computer vision , but also become better models of the biological visual cortex compared to traditional models in the neuroscience community (Khaligh-Razavi and Kriegeskorte 2014;  
They have been successful at predicting the neural responses in primate visual cortex, matching the hierarchy of ventral visual stream (Güc ¸lü and van Gerven 2015; , and even controlling neural activity   Moreover, as training paradigms of mice and techniques for collecting neural activity (de Vries et al  2020) have been greatly improved, there is a strong interest in exploring mouse visual cortex 
Deep neural networks also play an important role in revealing the functional mechanisms and structures of mouse visual cortex   Compared to biological networks, Artificial Neural Networks discard the complexity of neurons   Spiking Neural Networks, incorporating the concept of time and spikes, are more biologically plausible models  
To be more specific, because of their capabilities of encoding information with spikes, capturing the dynamics of biological neurons, and extracting spatio-temporal features, deep SNNs are highly possible to yield brain-like representations )  However, deep SNNs have not been employed to model visual cortex due to the immaturity of training algorithms 
Recently, a state-ofthe-art directly trained deep SNN , makes it possible to use deep SNNs as visual cortex models  Contributions  In this work, we conduct large-scale neural representation similarity experiments on SNNs and other high-performing deep neural networks to study the brain's visual processing mechanisms, with three datasets and three similarity metrics (Figure ) 
Specifically, to the best of our knowledge, we are the first to use deep SNNs to fit complex biological neural representations and explore the biological visual cortex  We summarize our main contributions in four points as follows  • We find that SNNs outperform their counterparts of CNNs with the same depth and almost the same architectures in almost all experiments 
In addition, even with very different depths and architectures, SNNs can achieve top performance in most conditions  • By making a more direct comparison between macaques and mice for the first time, we reveal the differences in the visual pathways across the two species in terms of the homogeneity of visual regions and the increases of receptive field sizes across cortical visual pathways, which is consistent with previous physiological work 
• The multi-branch structures in neural networks benefit neural representation similarity to mouse visual cortex, providing computational evidence that parallel information processing streams are widespread between cortical regions in the mouse visual system  • Comparing the results of two macaque neural datasets under different stimuli, we reveal that the macaque vision system may have functional specialization for processing human faces and other natural scenes 
Altogether, as the first work to apply deep SNNs to fit neural representations, we shed light on visual processing mechanisms in both macaques and mice, demonstrating the potential of SNNs as a novel and powerful tool for research on the visual system  Our codes and appendix are available at https://github com/Grasshlw/SNN-Neural-Similarity 
There are plenty of computational models of macaque and mouse visual systems for exploring the visual processing mechanisms recently  We summarize some of the outstanding work in the following  The network models of macaque visual system  In the early days, studies basically used simple feedforward neural networks as the models of the macaque visual system (Khaligh-Razavi and Kriegeskorte 2014;  
Recently, some bio-inspired or more complex models achieved better performance in fitting the neural representations of macaque visual cortex   proposed a brainlike shallow CNN with recurrent connections to better match the macaque ventral visual stream  By mimicking the primary stage of the primate visual system, VOneNets ) performed more robustly in image recognition while better simulating macaque V1 
Moreover, the representations learned by unsupervised neural networks ) also effectively matched the neural activity of macaque ventral visual stream  Although the above work developed many bio-inspired structures, the networks are still traditional ANNs in nature  Our work introduces deep SNNs for the first time to explore the visual processing mechanisms of macaque visual system 
The network models of mouse visual system  Largescale mouse neural dataset provided an experimental basis for model studies of mouse visual system (de Vries et al  2020;   conducted comparisons between the representations of mouse visual cortex and the VGG16 trained on the Im-ageNet dataset  In , they developed a single neural network to model both the dorsal and ventral pathways with showing the functional specializations 
What's more, a large survey of advanced deep networks ) revealed some hierarchy and functional properties of mice  Similar to the studies of macaque visual system, deep SNNs have never been used to model the mouse visual system  In this work, we not only use SNNs as one of the candidates to fit the representations of mouse visual cortex, but also conduct direct comparisons between macaques and mice to further investigate the functional hierarchy and mechanisms of the two species 
Our work is conducted with three neural datasets  These datasets are recorded from two species under three types of stimuli  More specifically, there are neural responses of mouse visual cortex to natural scene stimuli, and responses of macaque visual cortex to face image and synthetic image stimuli  Allen Brain mouse dataset 
It is part of the Allen Brain Observatory Visual Coding dataset ) col-lected using Neuropixel probes from 6 regions simultaneously in mouse visual cortex  Compared to two-photon calcium imaging, Neuropixel probes simultaneously record the spikes across many cortical regions with high temporal resolution 
In these experiments, mice are presented with 118 250-ms natural scene stimuli in random orders for 50 times  Hundreds to thousands of neurons are recorded for each brain region  To get the stable neurons, we first concatenate the neural responses (average number of spikes in 10-ms bins across time) under 118 images for each neuron, and then preserve the neurons whose split-half reliability across 50 trials reaches at least 0 8 
Macaque-Face dataset  This dataset ) is composed of neural responses of 159 neurons in the macaque anterior medial (AM) face patch under 2,100 real face stimuli, recorded with Tungsten electrodes  For this dataset, we compute the average number of spikes in a time window of 50-350ms after stimulus onset and exclude eleven neurons with noisy responses by assessing the neurons' noise ceiling 
The details of the preprocessing procedure are the same as   Macaque-Synthetic dataset  This dataset is also about macaque neural responses which are recorded by electrodes under 3,200 synthetic image stimuli, and used for neural prediction in the initial version of Brain-Score   The image stimuli are generated by adding a 2D projection of a 3D object model to a natural background 
The objects consist of eight categories, each with eight subclasses  The position, pose, and size of each object are randomly selected  88 neurons of V4 and 168 neurons of IT are recorded  The neural responses are preprocessed to the form of average firing rate and can be downloaded from Brain-Score  Since the core visual function of macaque and mouse visual cortex is to recognize objects, the basic premise of model selection is that the model has good performance on object recognition tasks (e g 
classification on ImageNet)  Based on this premise, we employ 12 SNNs, 43 CNNs, and 26 vision transformers, all of which are pretrained on the Ima-geNet dataset and perform well in the classification task  As for SNNs, we use SEW ResNet as the base model, which is the deepest and SOTA directly trained SNN  
Furthermore, by combining the residual block used in SEW ResNet and the hierarchy of the visual cortex, we build several new SNNs and train them on the ImageNet using SpikingJelly ) (see Appendix A for model structures and the details of model training)  As for CNNs and vision transformers, we use 44 models from the Torchvision model zoo , 22 models from the Timm model zoo ) and 3 models from the brain-like CNNs, CORnet family ) 
In the feature extraction procedures of all models, we feed the same set of images used in biological experiments to the pretrained models and obtain features from all chosen layers  Different from CNNs and vision transformers, the features of SNNs are spikes in multiple time steps  To obtain the representation similarity between biological visual cortex and computational models, we apply three similarity metrics to computing similarity scores: representational similarity analysis (RSA) , regression-based encoding method and singular vector canonical correlation analysis (SVCCA)  
RSA has already been widely used to analyze neural representations of a model and a brain to different stimuli at the population level, while the regression-based encoding method directly fits the model features to neural activity data  SVCCA is originally proposed to compare features of deep neural networks, and then Buice 2019) used it to compare representation matrices from mouse visual cortex and DNNs, which demonstrated its effectiveness 
With the same model and same cortical region, we use these metrics for a layer-by-layer comparison to compute the similarity scores  The maximum similarity score across layers for a given cortical region is considered to be the level of representation similarity between the model and the cortical region 
Finally, in a given dataset, we take the average score of all cortical regions as the final similarity score for each model, which gives the overall model rankings  The implementation of each similarity metric is as follows  RSA  For two response matrices R ∈ R n×m from each layer of models and each cortical region, where n is the number of units/neurons and m is the number of stimuli, we calculate the representational similarity between the responses to each pair of image stimuli using the Pearson correlation coefficient r, yielding two representational dissimilarity matrices (RDM ∈ R m×m , where each element is the correlation distance 1 − r) 
Then, the Spearman rank correlation coefficient between the flattened upper triangles of these two matrices is the metric score  Regression-Based Encoding Method  Firstly, we run truncated singular value decomposition (TSVD) to reduce the feature dimension of model layers to 40  Secondly, the features after dimensionality reduction are fitted to the representations of each neuron by ridge regression 
Finally, we compute the Pearson correlation coefficient between the predicted and ground-truth representations of each neuron and take the mean of all correlation coefficients as the metric score  More specifically, we apply leave-one-out crossvalidation to obtain predicted representations of each neuron 
For simplicity, we name this method 'TSVD-Reg'  SVCCA  For both the responses of model layers and cortical regions, we use TSVD to reduce the dimension of unit/neuron to 40, yielding two reduced representation matrices  Then we apply canonical correlation analysis (CCA) to these two matrices to obtain a vector of correlation coefficients (the length of the vector is 40) 
The metric score is the mean of the vector  Because of the invariance of CCA to affine transformations , in this procedure, we only need to ensure that the stimulus dimension is consistent and aligned, even if the unit/neuron dimension is different  Dimensionality reduction plays an important role in this method to make the number of model features comparable to the number of neurons in cortical regions, since the former usually far exceeds the latter 
In addition, dimensionality reduction helps to determine which features are important to the original data, while CCA suffers in important feature detection  Using just CCA performs badly, which has been proven by   To check how similar the models are to the visual cortex's mechanisms in visual processing, we rank the final similarity scores of all models and conduct comparisons among three types of models (CNNs, SNNs, and vision transformers) 
Specially, we focus on comparing SNN (SEW ResNet) and CNN (ResNet) with the same depth and almost the same architectures (Figure )  The final similarity score of a model is the average similarity score across all cortical regions  (The overall rankings can be found in Appendix B and the comparisons among three types of models are shown in Appendix C )
Allen brain mouse dataset  No single model achieves the highest final similarity scores with all three metrics  For a fair comparison, we apply the paired t-test to SEW ResNet and ResNet with the same depth  For all three metrics, SEW ResNet performs better than ResNet by a large margin (t = 5 857, p = 0 004; t = 7 666, p = 0 002; t = 7 592, p = 0 002) 1   1 The results of the three similarity metrics are separated by semicolons, in the order of SVCCA, TSVD-Reg, and RSA 
Other Macaque-Face dataset  For both SVCCA and TSVD-Reg, Wide-SEW-ResNet14 and Wide-SEW-ResNet8 achieve the first and second highest final similarity scores respectively  But for RSA, TNT-S and Inception-ResNet-V2 take their place and outperform other models by a large margin  As for SEW ResNet and ResNet, the former performs significantly better than the latter for both SVCCA and TSVD-Reg (t = 8 195, p = 0 001; t = 7 528, p = 0 002) 
However, the difference is not significant for RSA (t = 1 117, p = 0 327)  Specifically, the similarity score of SEW ResNet152 is only slightly higher than that of ResNet152, and at the depth of 50 and 101, SEW ResNet's scores are lower than ResNet's  Macaque-Synthetic dataset  Similar to the results of Allen Brain dataset, no model performs best for all three metrics 
SEW ResNet performs moderately better than ResNet (t = 3 354, p = 0 028; t = 3 824, p = 0 019; t = 2 343, p = 0 079)  The only contrary is that SEW ResNet18 performs worse than ResNet18 for RSA  Further, to check the details of comparison between the SNNs and their CNN counterparts, we analyze the trajectories of similarity score across model layers (Figure ) 
As for ResNet and SEW ResNet with the same depth, the trends of their similarities across model layers are almost the same, but the former's trajectory is generally below the latter's  In other words, the similarity scores of SEW ResNet are higher than those of ResNet at almost all layers  Taken together, the results suggest that when the overall results that appear below also correspond to the three metrics in this order, unless the correspondence is stated in the text 
architectures and depth are the same, SNNs with spiking neurons perform consistently better than their counterparts of CNNs with an average increase of 6 6%  Besides, SEW ResNet14 also outperforms the brain-like recurrent CNN, CORnet-S, with the same number of layers (see more details in Appendix B)  Two properties of SNNs might contribute to the higher similarity scores 
On the one hand, IF neurons are the basic neurons of spiking neural networks  The IF neuron uses several differential equations to roughly approximate the membrane potential dynamics of biological neurons, which provides a more biologically plausible spike mechanism for the network  On the other hand, the spiking neural network is able to capture the temporal features by incorporating both time and binary signals, just like the biological visual system during information processing 
To figure out the distinctions in the functional hierarchy between macaques and mice, for each cortical region, we obtain the normalized depth of the layer that achieves the highest similarity score in each model  Then, we divide models (excluding vision transformers) into two groups based on their depths and conduct investigations on these two groups separately 
A nonparametric ANOVA is applied to each group for testing whether layer depths change significantly across cortical regions  For mouse visual cortex (Figure (a)), taking the deep model group as an example, ANOVA shows overall significant changes in depth across cortical regions for TSVD-Reg and RSA (Friedman's χ 2 = 49 169,
p = 2 0 × 10 −9 ; χ 2 = 19 455, p = 0 002)  But there is no significant change for SVCCA (χ 2 = 8 689, p = 0 122)  According to these results, the differences in depth across regions are indeterminacy and irregular  Meanwhile, the trends of layer depth between some regions contradict the hierarchy observed in physiological experiments of mice (those between VISp and VISrl for TSVD-Reg and between VISal and VISpm for RSA) 
However, for macaque visual cortex (Figure (b)), there are significant differences (t = −5 451, p = 6 5 × 10 −6 ; t = −8 312, p = 2 8 × 10 −9 ; t = −3 782, p = 6 9 × 10 −4 , also taking the deep model group as an example) between V4 and IT, and the trend is consistent with the information processing hierarchy in primate visual cortex 
The comparative analyses of the best layer depths of the shallow and deep model groups also exhibit the differences between macaques and mice  For mouse visual cortex, the best layer depths of shallow models are significantly higher than those of deep models  Compared to deep models, most shallow models achieve the top similarity scores in intermediate and even later layers 
Differently, for macaque visual cortex, the depth of models has little effect on the depth of the most similar layer  What's more, we find that the most similar layer of mouse visual cortex always occurs after the 28 × 28 feature map is downsampled to 14 × 14, which leads to the layer depths' difference between shallow and deep models 
Nevertheless, the best layer of macaque IT appears in the last part of networks, where the feature map has been downsampled more times  In summary, our results might reveal two distinctions in the functional hierarchy between macaques and mice  First, there is a distinct functional hierarchical structure of macaque ventral visual pathway, while there might be no clear sequential functional hierarchy in mouse visual cortex 
One explanation is that the mouse visual cortex is organized into a parallel structure and the function of mouse cortical regions are more generalized and homogeneous than those of macaques  Another possibility would be that even though the sequential relations exist among mouse cortical regions as proposed in anatomical and physiological work, they are too weak for the current deep neural networks to capture 
Additionally, mice perform more complex visual tasks than expected with a limited brain capacity   Consequently, the neural responses of mouse visual cortex may contain more information not related to object recognition that neural networks focus on  Secondly, it is well known that the units in the neural networks get larger receptive fields after downsampling, and through the analyses of differences between two groups of models based on depth, we find the feature map of the best layer for mouse is downsampled fewer times than that for macaque 
Based on these results, we provide computational evidence that the increased ratio of the receptive field size in cortical regions across the mouse visual pathway is smaller than those across the macaque visual pathways, which echoes some physio- Macaque-Face dataset --- Table : The correlation between the similarity scores and the number of parameters 
r is Spearman's rank correlation coefficient  "-" indicates that there is no significant correlation  To explore the processing mechanisms in the visual cortex of macaques and mice, we investigate the model properties from the whole to the details  As shown in Table and 2, we first measure the correlation between the similarity scores and the sizes (i e  the number of trainable parameters and the depth) of network models 
For Allen Brain mouse dataset, there are significant negative correlations between the similarity scores and the number of parameters for three metrics while there is no correlation with the depth  Conversely, for the two macaque neural datasets, the similarity scores are highly correlated with the depth of networks, but not with the number of parameters 
Specifically, there is a positive correlation for Macaque-Face dataset while a negative correlation for Macaque-Synthetic dataset  (We also apply the linear regression to analyze the correlation between the similarity scores and the model size  The results are consistent with Spearman's rank correlation and are shown in Appendix E) 
Based on these results, we further investigate more detailed properties of neural networks to explain the processing mechanisms in the visual cortex  For the mouse dataset, on the one hand, the best layer depths show non-significant changes across the mouse cortical regions as mentioned in the previous section 
On the other hand, the similarity scores of the mouse dataset are only correlated with the number of model parameters but not with the depth of models  It calls into the question whether any detailed structures in the neural networks help to reduce the number of parameters and improve its similarity to mouse visual cortex 
Therefore, we explore the commonalities between models that have the top 20% representation similarities (see Appendix D) for Allen Brain dataset  As expected, the top models contain similar structures, such as fire module, inception module, and depthwise separable convolution  All these structures essentially process information through multiple branches/channels and then integrate the features from each branch 
The models with this type of structure outperform other models (t = 2 411, p = 0 024; t = 3 030, p = 0 007; t = 1 174, p = 0 247)  Moreover, we apply the depthwise separable convolution to SNNs, which yields a positive effect  The representation similarity of Spiking-MobileNet is higher than SEW-ResNet50 with a similar depth (+0 8%; +3 9%; +12 1%) 
In fact, some studies using multiple pathways simulate the functions of mouse visual cortex to some extent   Our results further suggest that not only the mouse visual cortex might be an organization of parallel structures, but also there are extensive parallel information processing streams between each pair of cortical regions  
For the two macaque datasets with different stimuli, not only are the model rankings significantly different, but also the correlations between the similarity scores and the model depth are totally opposite  These results corroborate the following two processing mechanisms in macaques: the ventral visual stream of primate visual cortex possesses canonical coding principles at different stages; the brain exhibits a high degree of functional specialization, such as the visual recognition of faces and other objects, which is reflected in the different neural responses of the corresponding region (although the face patch AM is a sub-network of IT, they differ in the neural representations) 
Besides, as shown in Figure , The calculation and plotting of the trajectories are the same as Figure   the similarity scores of vision transformers reach the maximum in the early layers and then decrease  Differently, the scores of CNNs and SNNs keep trending upwards, reaching the maximum in almost the last layer 
On the other hand, Appendix C shows that vision transformers perform well in Macaque-Face dataset but poorly in Macaque-Synthetic dataset  Considering the features extraction mechanism of vision transformers, it divides the image into several patches and encodes each patch as well as their internal relation by self-attention 
This mechanism is effective for face images that are full of useful information  However, the synthetic image consists of a central target object and a naturalistic background  When vision transformers are fed with this type of stimuli, premature integration of global information can lead to model representations containing noise from the unrelated background 
What's more, when we take all models with the top 20% representation similarities as a whole for analyses, as described in the above paragraph, the properties that enable networks to achieve higher neural similarity are not yet clear  Taken together, the computational mechanism of the better models may reveal core processing divergence to different types of stimuli in the visual cortex 
In this work, we take large-scale neural representation similarity experiments as a basis, aided by analyses of the similarities across models and the visual cortical regions  Compared to other work, we introduce SNNs in the similarity analyses with biological neural responses for the first time, showing that SNNs achieve higher similarity scores than CNNs that have the same depth and almost the same architectures 
As analyzed in Section 3 1, two properties of SNNs might serve as the explanations for their high similarity scores  The subsequent analyses of the models' simulation performance and structures indicate significant differences in functional hierarchies between macaque and mouse visual cortex  As for macaques, we observed a clear sequential hi-erarchy 
However, as for mouse visual cortex, some work ) exhibits that the trend of the model feature complexity roughly matches the processing hierarchy, but other work suggests that the cortex ) is organized into a parallel structure  Our results are more supportive of the latter  Furthermore, we provide computational evidence not only that the increased ratio of the receptive field size in cortical regions across the mouse visual pathway is smaller than those across the macaque visual pathway, but also that there may be multiple pathways with parallel processing streams between mouse cortical regions 
Our results also clearly reveal that the processing mechanisms of macaque visual cortex differ to various stimuli  These findings provide us with new insights into the visual processing mechanisms of macaque and mouse, which are the two species that dominate the research of biological vision systems and differ considerably from each other 
Compared to CNNs, the study of task-driven deep SNNs is just in its initial state  Although we demonstrate that SNNs outperform their counterparts of CNNs, SNNs exhibit similar properties as CNNs in the further analyses  In this work, we only build several new SNNs by taking the hints from the biological visual hierarchy, while many well-established structures and learning algorithms in CNNs have not been applied to SNNs yet 
In addition, the neural datasets used in our experiments are all collected under static image stimuli, lacking rich dynamic information to some certain, which may not fully exploit the properties of SNNs  Given that SNNs perform well in the current experiments, we hope to explore more potential of SNNs in future work 
In conclusion, as more biologically plausible neural networks, SNNs may serve as a shortcut to explore the biological visual cortex  With studies on various aspects of SNNs, such as model architectures, learning algorithms, processing mechanisms, and neural coding methods, it's highly promising to better explain the sophisticated, complex, and diverse vision systems in the future 

Implementation Details of SNNs Spiking Neuron Model

For all SNNs, we use the Integrate-and-Fire (IF) model as the spiking neuron model, which acts as the activation layer in neural networks  As mentioned in , V t , X t and S t denote the state (membrane voltage), input (current) and output (spike) of the spiking neuron model respectively at time-step t, and the dynamics of the IF model can be described as follows:
(1) (2) (3) While V t is the membrane voltage after the trigger of a spike, H t is also the membrane voltage, but after charging and before a spike firing  Θ(x) is the unit step function, so S t equals 1 when H t is greater than or equal to the threshold voltage V thresh and 0 otherwise  Meanwhile, when a spike fires, V t is reset to V reset  
Here, we set V thresh = 1 and V reset = 0  In addition, because Θ(x) is non-differentiable at 0, the surrogate gradient method is applied to approximate the derivative function during back-propagation  Here, we use the inverse tangent function as the surrogate gradient function and the derivative function is
(5) In our experiments on SNNs, we not only use SEW ResNet proposed by ), but also build several new SNNs  On the one hand, we improve the spike-elementwise block in SEW ResNet with new architectures referring to studies on ResNet , as shown in Table   On the other hand, as the multi-branch structures in CNNs increase neural representation similarity to mouse visual cortex, we use depthwise separable convolutions and follow the overall architecture of MobileNetV2 to build the SpikingMobileNet, the basic block of which is shown in Figure  
Our implementation is based on SpikingJelly , an open-source framework of deep SNN  We use the ImageNet dataset to pre-train the new SNNs  Following the settings for training SEW ResNet , we train the models for 320 epochs on 8 GPUs (NVIDIA V100), using SGD with a mini-batch size of 32  The momentum is 0 9 and the weight decay is 0  The initial learning rate is 0 1 and we decay it with a cosine annealing, where the maximum number of iterations is the same as the number of epochs 
For all SNNs, we set the simulation duration T = 4 

Overall model rankings

The results of model rankings are shown in Figure , 8 and 9  We also apply the Spearman's rank correlation to the overall model rankings of different metrics, which is shown in Figure  

Score Comparisons among Model Groups

We conduct comparisons of similarity scores among CNNs, SNNs, and vision transformers  The results are shown in Figure  

Overall CNN rankings

The results of CNN rankings are shown in Figure , 13 and 14 

Correlations between the Model Sizes and the Similarity Scores

The results of linear regression to model sizes and the similarity scores are shown in Figure , 16 and 17 

The ImageNet Accuracy and the Similarity Scores

The results are shown in Figure  



ground_truth: 172.

prompt_front: Now, answer the following question based on the text below, only give me the answer and do not output any other words.

Question: What is the potential of SNNs in modeling the visual system?

Read the following text and answer briefly.

Context 3: \section{Introduction}\label{S1}

The multiple access interferences (MAI) is the root of user
limitation in CDMA systems \cite{R1,R3}  The parallel least mean
square-partial parallel interference cancelation (PLMS-PPIC) method
is a multiuser detector for code division multiple access (CDMA)
receivers which reduces the effect of MAI in bit detection  In this
method and similar to its former versions like LMS-PPIC \cite{R5}
(see also \cite{RR5}), a weighted value of the MAI of other users is
subtracted before making the decision for a specific user in
different stages \cite{cohpaper}  In both of these methods, the
normalized least mean square (NLMS) algorithm is engaged
\cite{Haykin96}  The $m^{\rm th}$ element of the weight vector in
each stage is the true transmitted binary value of the $m^{\rm th}$
user divided by its hard estimate value from the previous stage  The
magnitude of all weight elements in all stages are equal to unity 
Unlike the LMS-PPIC, the PLMS-PPIC method tries to keep this
property in each iteration by using a set of NLMS algorithms with
different step-sizes instead of one NLMS algorithm used in LMS-PPIC 
In each iteration, the parameter estimate of the NLMS algorithm is
chosen whose element magnitudes of cancelation weight estimate have
the best match with unity  In PLMS-PPIC implementation it is assumed
that the receiver knows the phases of all user channels  However in
practice, these phases are not known and should be estimated  In
this paper we improve the PLMS-PPIC procedure \cite{cohpaper} in
such a way that when there is only a partial information of the
channel phases, this modified version simultaneously estimates the
phases and the cancelation weights  The partial information is the
quarter of each channel phase in $(0,2\pi)$ 

The rest of the paper is organized as follows: In section \ref{S4}
the modified version of PLMS-PPIC with capability of channel phase
estimation is introduced  In section \ref{S5} some simulation
examples illustrate the results of the proposed method  Finally the
paper is concluded in section \ref{S6} 

\section{Multistage Parallel Interference Cancelation: Modified PLMS-PPIC Method}\label{S4}

We assume $M$ users synchronously send their symbols
$\alpha_1,\alpha_2,\cdots,\alpha_M$ via a base-band CDMA
transmission system where $\alpha_m\in\{-1,1\}$  The $m^{th}$ user
has its own code $p_m( )$ of length $N$, where $p_m(n)\in \{-1,1\}$,
for all $n$  It means that for each symbol $N$ bits are transmitted
by each user and the processing gain is equal to $N$  At the
receiver we assume that perfect power control scheme is applied 
Without loss of generality, we also assume that the power gains of
all channels are equal to unity and users' channels do not change
during each symbol transmission (it can change from one symbol
transmission to the next one) and the channel phase $\phi_m$ of
$m^{th}$ user is unknown for all $m=1,2,\cdots,M$ (see
\cite{cohpaper} for coherent transmission)  According to the above
assumptions the received signal is
\begin{equation}
\label{e1} r(n)=\sum\limits_{m=1}^{M}\alpha_m
e^{j\phi_m}p_m(n)+v(n),~~~~n=1,2,\cdots,N,
\end{equation}
where $v(n)$ is the additive white Gaussian noise with zero mean and
variance $\sigma^2$  Multistage parallel interference cancelation
method uses $\alpha^{s-1}_1,\alpha^{s-1}_2,\cdots,\alpha^{s-1}_M$,
the bit estimates outputs of the previous stage, $s-1$, to estimate
the related MAI of each user  It then subtracts it from the received
signal $r(n)$ and makes a new decision on each user variable
individually to make a new variable set
$\alpha^{s}_1,\alpha^{s}_2,\cdots,\alpha^{s}_M$ for the current
stage $s$  Usually the variable set of the first stage (stage $0$)
is the output of a conventional detector  The output of the last
stage is considered as the final estimate of transmitted bits  In
the following we explain the structure of a modified version of the
PLMS-PIC method \cite{cohpaper} with simultaneous capability of
estimating the cancelation weights and the channel phases 

Assume $\alpha_m^{(s-1)}\in\{-1,1\}$ is a given estimate of
$\alpha_m$ from stage $s-1$  Define
\begin{equation}
\label{e6} w^s_{m}=\frac{\alpha_m}{\alpha_m^{(s-1)}}e^{j\phi_m} 
\end{equation}
From (\ref{e1}) and (\ref{e6}) we have
\begin{equation}
\label{e7} r(n)=\sum\limits_{m=1}^{M}w^s_m\alpha^{(s-1)}_m
p_m(n)+v(n) 
\end{equation}
Define
\begin{subequations}
\begin{eqnarray}
\label{e8} W^s&=&[w^s_{1},w^s_{2},\cdots,w^s_{M}]^T,\\
\label{e9}
\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!X^{s}(n)\!\!\!&=&\!\!\![\alpha^{(s-1)}_1p_1(n),\alpha^{(s-1)}_2p_2(n),\cdots,\alpha^{(s-1)}_Mp_M(n)]^T 
\end{eqnarray}
\end{subequations}
where $T$ stands for transposition  From equations (\ref{e7}),
(\ref{e8}) and (\ref{e9}), we have
\begin{equation}
\label{e10} r(n)=W^{s^T}X^{s}(n)+v(n) 
\end{equation}
Given the observations $\{r(n),X^{s}(n)\}^{N}_{n=1}$, in modified
PLMS-PPIC, like the PLMS-PPIC \cite{cohpaper}, a set of NLMS
adaptive algorithm are used to compute
\begin{equation}
\label{te1} W^{s}(N)=[w^{s}_1(N),w^{s}_2(N),\cdots,w^{s}_M(N)]^T,
\end{equation}
which is an estimate of $W^s$ after iteration $N$  To do so, from
(\ref{e6}), we have
\begin{equation}
\label{e13} |w^s_{m}|=1 ~~~m=1,2,\cdots,M,
\end{equation}
which is equivalent to
\begin{equation}
\label{e14} \sum\limits_{m=1}^{M}||w^s_{m}|-1|=0 
\end{equation}
We divide $\Psi=\left(0,1-\sqrt{\frac{M-1}{M}}\right]$, a sharp
range for $\mu$ (the step-size of the NLMS algorithm) given in
\cite{sg2005}, into $L$ subintervals and consider $L$ individual
step-sizes $\Theta=\{\mu_1,\mu_2,\cdots,\mu_L\}$, where
$\mu_1=\frac{1-\sqrt{\frac{M-1}{M}}}{L}, \mu_2=2\mu_1,\cdots$, and
$\mu_L=L\mu_1$  In each stage, $L$ individual NLMS algorithms are
executed ($\mu_l$ is the step-size of the $l^{th}$ algorithm)  In
stage $s$ and at iteration $n$, if
$W^{s}_k(n)=[w^s_{1,k},\cdots,w^s_{M,k}]^T$, the parameter estimate
of the $k^{\rm th}$ algorithm, minimizes our criteria, then it is
considered as the parameter estimate at time iteration $n$  In other
words if the next equation holds
\begin{equation}
\label{e17} W^s_k(n)=\arg\min\limits_{W^s_l(n)\in I_{W^s}
}\left\{\sum\limits_{m=1}^{M}||w^s_{m,l}(n)|-1|\right\},
\end{equation}
where $W^{s}_l(n)=W^{s}(n-1)+\mu_l \frac{X^s(n)}{\|X^s(n)\|^2}e(n),
~~~ l=1,2,\cdots,k,\cdots,L-1,L$ and
$I_{W^s}=\{W^s_1(n),\cdots,W^s_L(n)\}$, then we have
$W^s(n)=W^s_k(n)$, and therefore all other algorithms replace their
weight estimate by $W^{s}_k(n)$  At time instant $n=N$, this
procedure gives $W^s(N)$, the final estimate of $W^s$, as the true
parameter of stage $s$ 

Now consider $R=(0,2\pi)$ and divide it into four equal parts
$R_1=(0,\frac{\pi}{2})$, $R_2=(\frac{\pi}{2},\pi)$,
$R_3=(\pi,\frac{3\pi}{2})$ and $R_4=(\frac{3\pi}{2},2\pi)$  The
partial information of channel phases (given by the receiver) is in
a way that it shows each $\phi_m$ ($m=1,2,\cdots,M$) belongs to
which one of the four quarters $R_i,~i=1,2,3,4$  Assume
$W^{s}(N)=[w^{s}_1(N),w^{s}_2(N),\cdots,w^{s}_M(N)]^T$ is the weight
estimate of the modified algorithm PLMS-PPIC at time instant $N$ of
the stage $s$  From equation (\ref{e6}) we have
\begin{equation}
\label{tt3}
\phi_m=\angle({\frac{\alpha^{(s-1)}_m}{\alpha_m}w^s_m}) 
\end{equation}
We estimate $\phi_m$ by $\hat{\phi}^s_m$, where
\begin{equation}
\label{ee3}
\hat{\phi}^s_m=\angle{(\frac{\alpha^{(s-1)}_m}{\alpha_m}w^s_m(N))} 
\end{equation}
Because $\frac{\alpha^{(s-1)}_m}{\alpha_m}=1$ or $-1$, we have
\begin{eqnarray}
\hat{\phi}^s_m=\left\{\begin{array}{ll} \angle{w^s_m(N)} &
\mbox{if}~
\frac{\alpha^{(s-1)}_m}{\alpha_m}=1\\
\pm\pi+\angle{w^s_m(N)} & \mbox{if}~
\frac{\alpha^{(s-1)}_m}{\alpha_m}=-1\end{array}\right 
\end{eqnarray}
Hence $\hat{\phi}^s_m\in P^s=\{\angle{w^s_m(N)},
\angle{w^s_m(N)+\pi, \angle{w^s_m(N)}-\pi}\}$  If $w^s_m(N)$
sufficiently converges to its true value $w^s_m$, the same region
for $\hat{\phi}^s_m$ and $\phi_m$ is expected  In this case only one
of the three members of $P^s$ has the same region as $\phi_m$  For
example if $\phi_m \in (0,\frac{\pi}{2})$, then $\hat{\phi}^s_m \in
(0,\frac{\pi}{2})$ and therefore only $\angle{w^s_m(N)}$ or
$\angle{w^s_m(N)}+\pi$ or $\angle{w^s_m(N)}-\pi$ belongs to
$(0,\frac{\pi}{2})$  If, for example, $\angle{w^s_m(N)}+\pi$ is such
a member between all three members of $P^s$, it is the best
candidate for phase estimation  In other words,
\[\phi_m\approx\hat{\phi}^s_m=\angle{w^s_m(N)}+\pi \]
We admit that when there is a member of $P^s$ in the quarter of
$\phi_m$, then $w^s_m(N)$ converges  What would happen when non of
the members of $P^s$ has the same quarter as $\phi_m$? This
situation will happen when the absolute difference between $\angle
w^s_m(N)$ and $\phi_m$ is greater than $\pi$  It means that
$w^s_m(N)$ has not converged yet  In this case where we can not
count on $w^s_m(N)$, the expected value is the optimum choice for
the channel phase estimation, e g  if $\phi_m \in (0,\frac{\pi}{2})$
then $\frac{\pi}{4}$ is the estimation of the channel phase
$\phi_m$, or if $\phi_m \in (\frac{\pi}{2},\pi)$ then
$\frac{3\pi}{4}$ is the estimation of the channel phase $\phi_m$ 
The results of the above discussion are summarized in the next
equation
\begin{eqnarray}
\nonumber \hat{\phi}^s_m = \left\{\begin{array}{llll} \angle
{w^s_m(N)} & \mbox{if}~
\angle{w^s_m(N)}, \phi_m\in R_i,~~i=1,2,3,4\\
\angle{w^s_m(N)}+\pi & \mbox{if}~ \angle{w^s_m(N)}+\pi, \phi_m\in
R_i,~~i=1,2,3,4\\
\angle{w^n_m(N)}-\pi & \mbox{if}~ \angle{w^s_m(N)}-\pi, \phi_m\in
R_i,~~i=1,2,3,4\\
\frac{(i-1)\pi+i\pi}{4} & \mbox{if}~ \phi_m\in
R_i,~~\angle{w^s_m(N)},\angle
{w^s_m(N)}\pm\pi\notin R_i,~~i=1,2,3,4 \\
\end{array}\right 
\end{eqnarray}
Having an estimation of the channel phases, the rest of the proposed
method is given by estimating $\alpha^{s}_m$ as follows:
\begin{equation}
\label{tt4}
\alpha^{s}_m=\mbox{sign}\left\{\mbox{real}\left\{\sum\limits_{n=1}^{N}
q^s_m(n)e^{-j\hat{\phi}^s_m}p_m(n)\right\}\right\},
\end{equation}
where
\begin{equation} \label{tt5}
q^{s}_{m}(n)=r(n)-\sum\limits_{m^{'}=1,m^{'}\ne
m}^{M}w^{s}_{m^{'}}(N)\alpha^{(s-1)}_{m^{'}} p_{m^{'}}(n) 
\end{equation}
The inputs of the first stage $\{\alpha^{0}_m\}_{m=1}^M$ (needed for
computing $X^1(n)$) are given by
\begin{equation}
\label{qte5}
\alpha^{0}_m=\mbox{sign}\left\{\mbox{real}\left\{\sum\limits_{n=1}^{N}
r(n)e^{-j\hat{\phi}^0_m}p_m(n)\right\}\right\} 
\end{equation}
Assuming $\phi_m\in R_i$, then
\begin{equation}
\label{qqpp} \hat{\phi}^0_m =\frac{(i-1)\pi+i\pi}{4} 
\end{equation}
Table \ref{tab4} shows the structure of the modified PLMS-PPIC
method  It is to be notified that
\begin{itemize}
\item Equation (\ref{qte5}) shows the conventional bit detection
method when the receiver only knows the quarter of channel phase in
$(0,2\pi)$  \item With $L=1$ (i e  only one NLMS algorithm), the
modified PLMS-PPIC can be thought as a modified version of the
LMS-PPIC method 
\end{itemize}

In the following section some examples are given to illustrate the
effectiveness of the proposed method 

\section{Simulations}\label{S5}

In this section we have considered some simulation examples 
Examples \ref{ex2}-\ref{ex4} compare the conventional, the modified
LMS-PPIC and the modified PLMS-PPIC methods in three cases: balanced
channels, unbalanced channels and time varying channels  In all
examples, the receivers have only the quarter of each channel phase 
Example \ref{ex2} is given to compare the modified LMS-PPIC and the
PLMS-PPIC in the case of balanced channels 

\begin{example}{\it Balanced channels}:
\label{ex2}
\begin{table}
\caption{Channel phase estimate of the first user (example
\ref{ex2})} \label{tabex5} \centerline{{
\begin{tabular}{|c|c|c|c|c|}
\hline
\multirow{6}{*}{\rotatebox{90}{$\phi_m=\frac{3\pi}{8},M=15~~$}} & N(Iteration) & Stage Number& NLMS & PNLMS  \\
&&&&\\
\cline{2-5} & \multirow{2}{*}{64}& s = 2 &  $\hat{\phi}^s_m=\frac{3 24\pi}{8}$ & $\hat{\phi}^s_m=\frac{3 18\pi}{8}$ \\
\cline{3-5} & & s = 3 & $\hat{\phi}^s_m=\frac{3 24\pi}{8}$ & $\hat{\phi}^s_m=\frac{3 18\pi}{8}$ \\
\cline{2-5} & \multirow{2}{*}{256}& s = 2 &  $\hat{\phi}^s_m=\frac{2 85\pi}{8}$ & $\hat{\phi}^s_m=\frac{2 88\pi}{8}$ \\
\cline{3-5} & & s = 3 & $\hat{\phi}^s_m=\frac{2 85\pi}{8}$ & $\hat{\phi}^s_m=\frac{2 88\pi}{8}$ \\
\cline{2-5} \hline
\end{tabular} }}
\end{table}
Consider the system model (\ref{e7}) in which $M$ users
synchronously send their bits to the receiver through their
channels  It is assumed that each user's information consists of
codes of length $N$  It is also assumd that the signal to noise
ratio (SNR) is 0dB  In this example there is no power-unbalanced or
channel loss is assumed  The step-size of the NLMS algorithm in
modified LMS-PPIC method is $\mu=0 1(1-\sqrt{\frac{M-1}{M}})$ and
the set of step-sizes of the parallel NLMS algorithms in modified
PLMS-PPIC method are
$\Theta=\{0 01,0 05,0 1,0 2,\cdots,1\}(1-\sqrt{\frac{M-1}{M}})$,
i e  $\mu_1=0 01(1-\sqrt{\frac{M-1}{M}}),\cdots,
\mu_4=0 2(1-\sqrt{\frac{M-1}{M}}),\cdots,
\mu_{12}=(1-\sqrt{\frac{M-1}{M}})$  Figure~\ref{Figexp1NonCoh}
illustrates the bit error rate (BER) for the case of two stages and
for $N=64$ and $N=256$  Simulations also show that there is no
remarkable difference between results in two stage and three stage
scenarios  Table~\ref{tabex5} compares the average channel phase
estimate of the first user in each stage and over $10$ runs of
modified LMS-PPIC and PLMS-PPIC, when the the number of users is
$M=15$ 
\end{example}

Although LMS-PPIC and PLMS-PPIC, as well as their modified versions,
are structured based on the assumption of no near-far problem
(examples \ref{ex3} and \ref{ex4}), these methods and especially the
second one have remarkable performance in the cases of unbalanced
and/or time varying channels 

\begin{example}{\it Unbalanced channels}:
\label{ex3}
\begin{table}
\caption{Channel phase estimate of the first user (example
\ref{ex3})} \label{tabex6} \centerline{{
\begin{tabular}{|c|c|c|c|c|}
\hline
\multirow{6}{*}{\rotatebox{90}{$\phi_m=\frac{3\pi}{8},M=15~~$}} & N(Iteration) & Stage Number& NLMS & PNLMS  \\
&&&&\\
\cline{2-5} & \multirow{2}{*}{64}& s=2 &  $\hat{\phi}^s_m=\frac{2 45\pi}{8}$ & $\hat{\phi}^s_m=\frac{2 36\pi}{8}$ \\
\cline{3-5} & & s=3 & $\hat{\phi}^s_m=\frac{2 71\pi}{8}$ & $\hat{\phi}^s_m=\frac{2 80\pi}{8}$ \\
\cline{2-5} & \multirow{2}{*}{256}& s=2 &  $\hat{\phi}^s_m=\frac{3 09\pi}{8}$ & $\hat{\phi}^s_m=\frac{2 86\pi}{8}$ \\
\cline{3-5} & & s=3 & $\hat{\phi}^s_m=\frac{2 93\pi}{8}$ & $\hat{\phi}^s_m=\frac{3 01\pi}{8}$ \\
\cline{2-5} \hline
\end{tabular} }}
\end{table}
Consider example \ref{ex2} with power unbalanced and/or channel loss
in transmission system, i e  the true model at stage $s$ is
\begin{equation}
\label{ve7} r(n)=\sum\limits_{m=1}^{M}\beta_m
w^s_m\alpha^{(s-1)}_m c_m(n)+v(n),
\end{equation}
where $0<\beta_m\leq 1$ for all $1\leq m \leq M$  Both the LMS-PPIC
and the PLMS-PPIC methods assume the model (\ref{e7}), and their
estimations are based on observations $\{r(n),X^s(n)\}$, instead of
$\{r(n),\mathbf{G}X^s(n)\}$, where the channel gain matrix is
$\mathbf{G}=\mbox{diag}(\beta_1,\beta_2,\cdots,\beta_m)$  In this
case we repeat example \ref{ex2}  We randomly get each element of
$G$ from $[0,0 3]$  Figure~\ref{Figexp2NonCoh} illustrates the BER
versus the number of users  Table~\ref{tabex6} compares the channel
phase estimate of the first user in each stage and over $10$ runs of
modified LMS-PPIC and modified PLMS-PPIC for $M=15$ 
\end{example}

\begin{example}
\label{ex4} {\it Time varying channels}: Consider example \ref{ex2}
with time varying Rayleigh fading channels  In this case we assume
the maximum Doppler shift of $40$HZ, the three-tap
frequency-selective channel with delay vector of $\{2\times
10^{-6},2 5\times 10^{-6},3\times 10^{-6}\}$sec and gain vector of
$\{-5,-3,-10\}$dB  Figure~\ref{Figexp3NonCoh} shows the average BER
over all users versus $M$ and using two stages 
\end{example}


\section{Conclusion}\label{S6}

In this paper, parallel interference cancelation using adaptive
multistage structure and employing a set of NLMS algorithms with
different step-sizes is proposed, when just the quarter of the
channel phase of each user is known  In fact, the algorithm has been
proposed for coherent transmission with full information on channel
phases in \cite{cohpaper}  This paper is a modification on the
previously proposed algorithm  Simulation results show that the new
method has a remarkable performance for different scenarios
including Rayleigh fading channels even if the channel is
unbalanced 





ground_truth: SNNs have the potential to better model and explain the functional hierarchy and mechanisms of the visual system.

prompt_front: Now, answer the following question based on the text below, only give me the answer and do not output any other words.

Question: What algorithm is engaged in the PLMS-PPIC method?

Read the following text and answer briefly.

Context 4: 

Margaret died on the 10th of August 2022 in Cleveland, Queensland 

Bibliography

Single Novels
King Country (1970)
Blaze of Silk (1970)
The Time of the Jacaranda (1970)
Bauhinia Junction (1971)
Man from Bahl Bahla (1971)
Summer Magic (1971)
Return to Belle Amber (1971)
Ring of Jade (1972)
Copper Moon (1972)
Rainbow Bird (1972)
Man Like Daintree (1972)
Noonfire (1972)
Storm Over Mandargi (1973)
Wind River (1973)
Love Theme (1974)
McCabe's Kingdom (1974)
Sweet Sundown (1974)
Reeds of Honey (1975)
Storm Flower (1975)
Lesson in Loving (1975)
Flight into Yesterday (1976)
Red Cliffs of Malpara (1976)
Man on Half-moon (1976)
Swan's Reach (1976)
Mutiny in Paradise (1977)
One Way Ticket (1977)
Portrait of Jaime (1977)
Black Ingo (1977)
Awakening Flame (1978)
Wild Swan (1978)
Ring of Fire (1978)
Wake the Sleeping Tiger (1978)
Valley of the Moon (1979)
White Magnolia (1979)
Winds of Heaven (1979)
Blue Lotus (1979)
Butterfly and the Baron (1979)
Golden Puma (1980)
Temple of Fire (1980)
Lord of the High Valley (1980)
Flamingo Park (1980)
North of Capricorn (1981)
Season for Change (1981)
Shadow Dance (1981)
McIvor Affair (1981)
Home to Morning Star (1981)
Broken Rhapsody (1982)
The Silver Veil (1982)
Spellbound (1982)
Hunter's Moon (1982)
Girl at Cobalt Creek (1983)
No Alternative (1983)
House of Memories (1983)
Almost a Stranger (1984)
A place called Rambulara (1984)
Fallen Idol (1984)
Hunt the Sun (1985)
Eagle's Ridge (1985)
The Tiger's Cage (1986)
Innocent in Eden (1986)
Diamond Valley (1986)
Morning Glory (1988)
Devil Moon (1988)
Mowana Magic (1988)
Hungry Heart (1988)
Rise of an Eagle (1988)
One Fateful Summer (1993)
The Carradine Brand (1994)
Holding on to Alex (1997)
The Australian Heiress (1997)
Claiming His Child (1999)
The Cattleman's Bride (2000)
The Cattle Baron (2001)
The Husbands of the Outback (2001)
Secrets of the Outback (2002)
With This Ring (2003)
Innocent Mistress (2004)
Cattle Rancher, Convenient Wife (2007)
Outback Marriages (2007)
Promoted: Nanny to Wife (2007)
Cattle Rancher, Secret Son (2007)
Genni's Dilemma (2008)
Bride At Briar Ridge (2009)
Outback Heiress, Surprise Proposal (2009)
Cattle Baron, Nanny Needed (2009)

Legends of the Outback Series
Mail Order Marriage (1999)
The Bridesmaid's Wedding (2000)
The English Bride (2000)
A Wife at Kimbara (2000)

Koomera Crossing Series
Sarah's Baby (2003)
Runaway Wife (2003)
Outback Bridegroom (2003)
Outback Surrender (2003)
Home to Eden (2004)

McIvor Sisters Series
The Outback Engagement (2005)
Marriage at Murraree (2005)

Men Of The Outback Series
The Cattleman (2006)
The Cattle Baron's Bride (2006)
Her Outback Protector (2006)
The Horseman (2006)

Outback Marriages Series
Outback Man Seeks Wife (2007)
Cattle Rancher, Convenient Wife (2007)

Barons of the Outback Series Multi-Author
Wedding At Wangaree Valley (2008)
Bride At Briar's Ridge (2008)

Family Ties Multi-Author
Once Burned (1995)

Hitched! Multi-Author
A Faulkner Possession (1996)

Simply the Best Multi-Author
Georgia and the Tycoon (1997)

The Big Event Multi-Author
Beresford's Bride (1998)

Guardian Angels Multi-Author
Gabriel's Mission (1998)

Australians Series Multi-Author
7  Her Outback Man (1998)
17  Master of Maramba (2001)
19  Outback Fire (2001)
22  Mistaken Mistress (2002)
24  Outback Angel (2002)
33  The Australian Tycoon's Proposal (2004)
35  His Heiress Wife (2004)

Marrying the Boss Series Multi-Author
Boardroom Proposal (1999)

Contract Brides Series Multi-Author
Strategy for Marriage (2002)

Everlasting Love Series Multi-Author
Hidden Legacy (2008)

Diamond Brides Series Multi-Author
The Australian's Society Bride (2008)

Collections
Summer Magic / Ring of Jade / Noonfire (1981)
Wife at Kimbara / Bridesmaid's Wedding (2005)

Omnibus in Collaboration
Pretty Witch / Without Any Amazement / Storm Over Mandargi (1977) (with Lucy Gillen and Margaret Malcolm)
Dear Caliban / Heart of the Eagle / Swans' Reach (1978) (with Jane Donnelly and Elizabeth Graham)
The Bonds of Matrimony / Dragon Island / Reeds of Honey (1979) (with Elizabeth Hunter and Henrietta Reid)
The Man Outside / Castles in Spain / McCabe's Kingdom (1979) (with Jane Donnelly and Rebecca Stratton)
Winds From The Sea / Island of Darkness / Wind River (1979) (with Margaret Pargeter and Rebecca Stratton)
Moorland Magic / Tree of Idleness / Sweet Sundown (1980) (with Elizabeth Ashton and Elizabeth Hunter)
The Shifting Sands / Portrait of Jaime / Touched by Fire (1982) (with Jane Donnelly and Kay Thorpe)
Head of Chancery / Wild Heart / One-Way Ticket (1986) (with Betty Beaty and Doris Smith)
Heart of the Scorpion / The Winds of Heaven / Sweet Compulsion (1987) (with Janice Gray and Victoria Woolf)
One Brief Sweet Hour / Once More With Feeling / Blue Lotus (1990) (with Jane Arbor and Natalie Sparks)
Marry Me Cowboy (1995) (with Janet Dailey, Susan Fox and Anne McAllister)
Husbands on Horseback (1996) (with Diana Palmer)
Wedlocked (1999) (with Day Leclaire and Anne McAllister)
Mistletoe Magic (1999) (with Betty Neels and Rebecca Winters)
The Australians (2000) (with Helen Bianchin and Miranda Lee)
Weddings Down Under (2001) (with Helen Bianchin and Jessica Hart)
Outback Husbands (2002) (with Marion Lennox)
The Mother's Day Collection (2002) (with Helen Dickson and Kate Hoffmann)
Australian Nights (2003) (with Miranda Lee)
Outback Weddings (2003) (with Barbara Hannay)
Australian Playboys (2003) (with Helen Bianchin and Marion Lennox)
Australian Tycoons (2004) (with Emma Darcy and Marion Lennox)
A Mother's Day Gift (2004) (with Anne Ashley and Lucy Monroe)
White Wedding (2004) (with Judy Christenberry and Jessica Steele)
A Christmas Engagement (2004) (with Sara Craven and Jessica Matthews)
A Very Special Mother's Day (2005) (with Anne Herries)
All I Want for Christmas    (2005) (with Betty Neels and Jessica Steele)
The Mills and Boon Collection (2006) (with Caroline Anderson and Penny Jordan)
Outback Desire (2006) (with Emma Darcy and Carol Marinelli)
To Mum, with Love (2006) (with Rebecca Winters)
Australian Heroes (2007) (with Marion Lennox and Fiona McArthur)
Tall, Dark and Sexy (2008) (with Caroline Anderson and Helen Bianchin)
The Boss's Proposal (2008) (with Jessica Steele and Patricia Thayer)
Island Heat / Outback Man Seeks Wife / Prince's Forbidden Virgin / One Night Before Marriage / Their Lost-and-found Family / Single Dad's Marriage Wish (2008) (with Robyn Donald, Marion Lennox, Carol Marinelli, Sarah Mayberry and Anne Oliver)
Australian Billionaires (2009) (with Jennie Adams and Amy Andrews)
Cattle Baron : Nanny Needed / Bachelor Dad on Her Doorstep (2009) (with Michelle Douglas)

External links
Margaret Way at Harlequin Enterprises Ltd

Australian romantic fiction writers
Australian women novelists
Living people
Year of birth missing (living people)
Women romantic fiction writers



ground_truth: The normalized least mean square (NLMS) algorithm.