dataesr/scientific-paragraphs-categorization huggingface dataset:
Everything is covered by the paper's manual analysis-for example, we had already checked that all code was generating all randomness via randombytes-but the question addressed here is the level of extra assurance provided by the automated analysis. If the code generates randomness such as private keys via RAND_bytes rather than randombytes, then private keys will not be marked as undefined, so valgrind will not track data flow from private keys to branches or to array indices. To address this, the auditor skimmed high-ctidh to check the (very limited) set of C library functions being used, and double-checked the list of functions output by nm checkct512default. If private keys are actually deterministic then they will not be marked as undefined. To address this, the auditor added a step to checkct to mark Alice's private key as undefined before Alice handles Bob's public key.
The auditor also checked examples of private keys and saw them varying. The valgrind analysis is dynamic, tracing through one run of code. Perhaps CSIDH-1024 triggers code paths that are not used by CSIDH-512 and that leak secret data. To address this, the auditor tried all sizes of interest. Different runs could still follow different code paths because of the declassification described below. To address this, the auditor tried many runs of each size, but there is still a risk that all of the runs missed some code path. In theory it should be possible to combine valgrind with static code-coverage analysis for binaries that follow standard calling conventions, but as far as we know no tools are available for this. There are tools for static constant-time analysis of C code, and those tools could be applied to a modified version of high-ctidh that replaces the assembly-language portions with reference C code.
The valgrind analysis checks that all array indices and all branch conditions are defined, but does not check that division inputs are defined. Division instructions take variable time in most CPUs, and should not be modeled as taking constant time. To address this, the auditor skimmed the assembly-language code for any use of division instructions, and skimmed the C code for any operations likely to be compiled into division instructions. Patching valgrind to limit the set of acceptable instructions would reduce risks here. Finally, the high-ctidh package has six crypto_declassify lines explicitly marking certain pieces of data as defined, meaning that valgrind allows branches and array indices derived from that data. Perhaps this declassification leaks secrets. This is the most important risk, the risk that would require advances in automated verification to address.
Comparisons There have been several previous speed reports  [18, 22, 11, 15, 13, 1, 12]  for constant-time CSIDH. CSIDH-512 with a key space of 2 256 vectors is almost always included, and for this size the lowest multiplication count we have found in the literature is 789000: this is from [1, Table  1 , "hvelu", "OAYT-style"], which reports 624000M + 165000S + 893000a. All Skylake cycle counts we have found are above 200 million. The high-ctidh speeds are much faster, and have the added feature of constant-time verification using valgrind. Sometimes the latest software speeds are not fully reflected in the relevant papers, so we downloaded the latest versions of csidh_withstrategies (dated July 2020) from  [13]  and sqale-csidh-velusqrt (dated December 2020) from  [12] , and ran their benchmarking tools-with one modification to change the number of experiments ("its") from 1024 to 65536-on the same Skylake machine that we had used for measuring high-ctidh.
"Mcyc" is millions of Skylake cycles (not shown for Python software); "M" is the number of multiplications not including squarings; "S" is the number of squarings; "a" is the number of additions including subtractions; "1, 1, 0" and "1, 0. The sqale-csidh-velusqrt tools, using BITS=512 STYLE=wd2, reported averages of 190. 921 million cycles (standard deviation 4. 32 million), 626000a (standard deviation 13000), 128000S (standard deviation 5000), and 447000M (standard deviation 9000); i. e. , 575000 multiplications. For comparison, high-ctidh takes 89. 11 million cycles (310945 multiplications) as noted above, plus 4. 09 million cycles for validation. Finally, Table  2  summarizes the measurements listed above for high-ctidh, for the software from  [13] , and for the software from  [12] ; the measurements stated in  [22, 11, 15, 1]  for the software in those papers; and the measurements stated in  [11]  for the software in  [18].
For  [15]  the reported processor is an Intel Core i7-7500k, which is Kaby Lake rather than Skylake, but Kaby Lake cycle counts generally match Skylake cycle counts. The table omits cycle counts for  [1] , which used Python, and  [22] , which used C but had measurements affected by an unknown amount of Turbo Boost. The cost of UniformRandomPoints. The obvious way to generate a point in E A (F p ) is to generate a uniform random x ∈ F p and compute y = ± √ x 3 + Ax 2 + x, trying again if x 3 + Ax 2 + x is not a square. The distribution is not exactly uniform, but one can easily adjust the procedure to correct this (see Section 4. 1]), or simply accept the distribution as being statistically indistinguishable from uniform. The standard way to try to compute a square root, given that p ≡ 3 (mod 4), is to compute a (p + 1)/4 power.
However, the security question for constructive CSIDH applications, namely the order-indistinguishability question, did not arise in  [5]. A measurable deviation in orders could easily have avoided detection by the experiments in  [5]. Elligator was first used for constructive CSIDH applications in  [18]  to generate an element of E A (F p ). It was then used in  [22]  to generate an element of E A (F p ) × ẼA (F p ). Subsequent CSIDH software has also used Elligator. It is conceivable, however, that information about A is leaked via the distribution of orders of the points that are generated by Elligator. Elligator tracking. To directly address the order-distinguishability question, we collected complete data for various small primes p. Specifically, for each k ∈ {1, 2, 3, 4, 5}, we took the smallest prime p ≡ 3 (mod 8) for which (p + 1)/4 factors into exactly k distinct primes.
Zero hazards. The original Elligator paper  [4]  did not define Elligator 2 for A = 0. The application of Elligator to CSIDH attacks in  [5]  suggested handling A = 0 by precomputing a point of full order, or, alternatively, replacing the initial A/(r 2 -1) with r when A = 0. Our CTIDH software (see Section 7) replaces the initial A/(r 2 -1) with 1/(r 2 -1) when A = 0. For constant-time projective computations this seems slightly more efficient than replacing A/(r 2 -1) with r. We included this handling of A = 0 in the computations described above of the total-variation distance. Beware that the alternative of precomputing a point of full order would not generally be safe in constructive applications. This precomputation eliminates failure cases for A = 0, making A = 0 easily distinguishable from other values of A via timing.
This work was carried out while the second and fifth authors were visiting  Academia Sinica. This work was funded in part by the  European Commission  through  H2020   SPARTA , https://www. sparta. eu/,by the  Deutsche Forschungsgemeinschaft (DFG, German Research Foundation ) under Germany's  Excellence Strategy-EXC 2092 CASA-390781972  " Cyber Security in the Age of Large-Scale Adversaries ", by the  Cisco University Research Program , by the  U. S. National Science Foundation  under grant  2037867 , by the  Taiwan's Executive Yuan Data Safety and Talent Cultivation Project  ( AS-KPQ-109-DSTCP ), by  Continental AG and Elektrobit Automotive GmbH , by  Taiwan Ministry of Science and Technology (MoST)  grant  MOST105-2221-E-001-014-MY3 ,  108-2221-E-001-008  and  109-2222-E-001-001-MY3 , by  Academia Sinica Investigator  Award  AS-IA-104-M0 , by the  Netherlands Organisation for Scientific Research (NWO)  under grant  628.
001. 028 (FASOR), by the  German Federal Ministry of Education and Research and the Hessian Ministry of Higher Education, Research, Science  and the Arts within their joint support of the  National Research Center for Applied Cybersecurity ATHENE , by the  French Agence Nationale de la Recherche  through  ANR CIAO  ( ANR-19-CE48-0008 ), and by the  Dutch Research Council (NWO)  through  Gravitation-grant Quantum Software  Consortium  -024. 003. 037. "Any opinions, findings, and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the  National Science Foundation " (or other funding agencies). Permanent ID of this document: 3f5cc78da1af948120b3e69222369fb08aedadf6. Date:  2021. 06. 28.
Conclusion The integrated analysis of early flower development presented here suggests a number of further steps forward. The dataset can be easily extended by adding new expression patterns or expression gradients. By providing a dynamic template, it should be very useful in interpreting single cell sequencing efforts, which are precisely missing this type of detailed spatial information. The online atlas can also be enriched by information of different nature, including for instance cell polarity or mechanical properties. Other templates, coming from different time-series of wild type and mutants, can be added for further quantitative comparison as we show here for lfy. The ultimate aim would be to produce an artificial flower template using average behavior, or a collection of templates providing information on the variability existing in flower development.
Integration of the gene atlas into Morphonet and AtlasViewer For online display and the introduction of expression patterns, Morphonet was used (http://www. morphonet. org). For access see supplemental information. Morphonet is a web-based interactive platform for visualization and sharing of complex morphological data and metadata  (Leggio et al. , 2019). Exploiting its Unity (https://unity. com) 3D visual engine, it offers a vast assortment of possible interactions with 2, 3 and 4D datasets. Through a flexible hierarchical representation of biological structures and dedicated formats for associated metadata, users can follow the dynamics of biological shapes, onto which associated quantitative and qualitative properties can be projected. Cells are represented with meshes in Morphonet, and the meshes generated from the cell segmentation were converted to obj format and uploaded to Morphonet together with lineage information.
For this purpose, we generated a further 60 sets of serial sections with the expression patterns of 20 genes (Original data available online (doi: provided upon acceptance), Supplementary Information). 3. Manual annotation of timepoints. To facilitate interpretation, we used a binary notation (i. e. genes are either on or off). Since often only 2D data in the form of sections were available and published 3D GFP data were usually partial, it was not possible to project directly the patterns automatically on the atlas. Instead, we used a manual protocol using the annotation tool in Morphonet by clicking on the individual cells. Cells potentially expressing a particular gene were identified by manually projecting sections of in situ hybridizations or confocal sections on the different time points of the atlas.
Whenever possible, cell numbers were counted to estimate the size of the expression pattern. For each gene 2-4 datasets available in the literature were identified. We encountered three different cases: i. The patterns of the in situ hybridization and/or GFP were simple to interpret, and zones of expression could be unambiguously identified (Fig  S3 ). In the absence of GFP patterns, the use of serial sections was crucial. ii. There was a conflict between results obtained using GFP expression and in situ hybridizations. In that case, the in situ hybridization results were used (Fig  S4 ). iii. If information on both protein levels and RNA levels were available, the RNA pattern or promoter activity (in case of GFP construct) was retained (Fig S5 ). 4. The obtained patterns were subsequently refined using information of co-expression (Fig.
S5 ) or based on information on mutual regulation (e. g. AG and AP1 mutually inhibit each other). The references and images for each gene are summarized in supplementary file 2. In addition, we integrated the four-dimensional gene expression data together with all segmented and tracked time courses in an open source standalone software platform, called AtlasViewer (available at https://gitlab. com/slcu/teamHJ/publications/refahi_etal_2020/-/tree/master/atlasviewer/atlasviewer). The patterns were imported directly from Morphonet into AtlasViewer. Visualization of combination of gene expressions using AtlasViewer facilitated the identification and correction of annotation errors.
Cell states, clustering and transition graphs After assigning expression values for the 27 genes to individual cells, this boolean element vector is used to define a cell state for each cell (Fig. 4A-B ). Similarities between cell states were calculated using the Hamming distance, i. e. the sum of the absolute differences between the vector elements (Fig. 4C ). The states were clustered using hierarchical agglomerative clustering from SciPy package using Ward's method, which uses Ward variance minimization algorithm, leading to a dendrogram. Manual flipping at the dendrogram nodes and identification of tissue structures were applied to generate the final graph (Fig. 3D ). To illustrate the evolution of cell states over time, cell lineages were used to generate a pattern transition graph whose vertices were cell states.
g. Fig. 7C ): ) = , 𝑔 𝑟 (𝑐, 𝑡 𝑖 (𝑘 𝑚, 𝑡 𝑖-1 → 𝑡 𝑖 + 𝑘 𝑐, 𝑡 𝑖 → 𝑡 𝑖+1 ) / 2 where is the mother cell of. In the cases where only one was available, the reported values are for the   first time point the forward growth calculation and for the last time point the backward growth calculation. 3D growth anisotropy was computed using cell and lineage information by identifying and matching key points on the cell and set of daughter cells' surface. We define key points as the smallest set of points on the cell surface enveloping the cell (Convex Hull, calculated using Python bindings to QHull library, http://www. qhull. org/). The Convex Hulls of each cell and its daughter cells were centred and then mapped according to a nearest neighbour criterion. We then calculated the best (least-squares estimation) linear transformation between the two hulls:  , 𝑌 ‾ = 𝐴 𝑋 ‾ + 𝑏 where is the collection of the selected points for a cell and the collection of corresponding points on  ‾  ‾ the daughter cells' surface.
Acknowledgements The authors would like to thank  Arun Sampathkumar ,  OIivier Hamant  and  Marie Monniaux  for discussion,  Anuradha Kar  for help with MorphoNet. Weibing Yang  provided the lfy mutant and helped with imaging. JT, YR, AA, LV, A-ER and FZ were funded by the  ERC  grant MORPHOGENETICS. This work was also supported by  ANR   BIOMOD  ( ANR-19-CE43-0010 ) grant (to YR. ) and Gene2Shape ERACAPS grant to JT, HJ and AZ. The E. M. M laboratory is funded by the  Howard Hughes Medical Institute , and the work here was supported by the  U. S. National Science Foundation Division of Integrative Organismal Systems  grant  IOS1826567.
Data Availability Confocal z-stacks, segmentation files, cell lineage information, and in situ hybridisation images are available online (doi: provided on acceptance). Software scripts for reproducing the analysis performed in this work is available via the Sainsbury Laboratory gitlab repository (https://gitlab. com/slcu/teamhj/publications/refahi_etal_2019). All data is interactively minable via the MorphoNet ATLAS (http://www. morphonet. org).
Methods Participants. A total of 180 participants (94 male) with a mean age of 28. 5 years (SD = 9. 46, min-max: 18-72-years-old) were recruited through on-line advertisements. All participants were native speakers of French, with no history of neurological impairment, or developmental disorders. The number of participants we recruited was based on the criterion proposed by Brysbaert and Stevens  25  and provided a statistical power of 99. 80% (95% CI 0. 35). Note that we used the SMIR package from Green and MacLeod  26  with 1000 simulations on the semantically correct sentences to find the simple effect of syntax. Prior to the beginning of the experiment, participants were informed that data would be collected anonymously, and they provided informed consent before the experiment was initiated.
Data analysis. We first screened the data and excluded 17 participants prior to further analysis. Two of these participants were excluded due to misunderstanding the instructions (their responses contained several words rather than a single word), three participants did not finish the experiment, and 12 participants were excluded based on their low level of overall accuracy (i. e. , accuracy below 2. 5SD from the grand mean-less than 35. 27%). This left a total of 163 participants (85 males, mean age = 28. 63 years, SD = 9. 49) that were included in the final analysis. Second, in order to provide an objective analysis of participants' responses (i. e. , error categorization), all responses were first checked by an algorithm developed in order to automatize this process  28. Finally, a human observer (one of the authors) checked the output of the algorithm.
A major objective of evolutionary biology is to understand the processes by which organisms have adapted to various environments, and to predict the response of organisms to new or future conditions. The availability of large genomic and environmental data sets provides an opportunity to address those questions, and the R package LEA has been introduced to facilitate population and ecological genomic analyses in this context. By using latent factor models, the program computes ancestry coefficients from population genetic data, and performs genotype-environment association analyses with correction for unobserved confounding variables. In this study, we present new functionalities of LEA, which include imputation of missing genotypes, fast algorithms for latent factor mixed models using multivariate predictors for genotype-environment association studies, population differentiation tests for admixed or continuous populations, and estimation of genetic offset based on climate models.
Introduction Landscape and ecological genomics attempt to characterize geographic processes underlying the responses of organisms to their environments  (Schoville et al. , 2012; Sork et al. , 2013; Manel & Holderegger, 2013; Savolainen, Lascoux, & Merilä, 2013). In these approaches, the recent availability of large genomic and environmental data sets have facilitated the identification of biotic and abiotic factors that influence neutral and adaptive genetic diversity patterns, offering opportunities for researchers to understand those patterns with statistical genetic approaches. Landscape databases include environmental variables such as climate and habitat descriptors which are proxies for geographically heterogeneous selection pressures  (Fenderson, Kovach, & Llamas, 2020). Accounting for the confounding effects of demographic processes, local adaptation can be detected at a genomic level by identifying loci which allele frequency exhibits significant association with those environmental variables.
Thus, ecological genomic studies could anticipate results from translocation experiments or exposure to future conditions by relying on analyses of population structure and genomic signatures of selection. Many methods and computer programs have been developed to this aim  (Rellstab, Gugerli, Eckert, Hancock, & Holderegger, 2015; Hoban et al. , 2016; Forester, Jones, Joost, Landguth, & Lasky, 2016) , and the R package LEA -for Landscape and Ecological Association studies -is one of those programs  (Frichot & François, 2015). Methods in LEA are based on the statistical framework of latent factor models  (Frichot, Schoville, Bouchard, & François, 2013; Frichot, Mathieu, Trouillon, Bouchard, & François, 2014). Latent factors are unobserved variables that represent data generated by processes linked to population history, population structure and technical or statistical artifacts.
With this approach, missing genotypes are replaced by predicted genotypes in a way that agrees with the inference of population structure. The R package LEA also implements algorithms for LFMMs, which are statistical models used in genotype-environment association studies to identify genomic signatures of adaptation to the local environment  (Frichot, Schoville, Bouchard, & François, 2013). LFMMs optimally separate neutral genetic variation -modelled in the latent factors -from adaptive genetic variation modelled in the effect sizes of environmental covariates. Adaptive loci are expected to be associated with non-null effect sizes, that are tested at each locus in the genomic data. Frichot et al. (2013)  used a Bayesian approach and a Markov Chain Monte Carlo (MCMC) algorithm to adjust LFMMs to the data, and this approach was implemented in the lfmm function of LEA  (Frichot & François, 2015).
New program functionalities Imputation of missing data. LEA 3 implements an imputation method based on allele frequencies and ancestry coefficients estimated from its snmf function  (Frichot, Mathieu, Trouillon, Bouchard, & François, 2014). Assuming n diploid organisms genotyped at L loci, the snmf algorithm decomposes the n × L matrix of observed allele frequencies, P , in a product of two probabilistic matrices P ≈ QF , where the coefficients of P take their values in {0, 1/2, 1} for diploid organisms (Note: ploidy can be modified in snmf). The matrix Q is similar to the Q-matrix of STRUC-TURE, representing ancestry coefficients for individuals originating from K source populations  (Pritchard, Stephens, & Donnelly, 2000). The matrix F contains allele frequencies at each locus for each source population.
To create missing genotypes, we removed genotypes at random at a rate, π missing , between 10% and 90%. Ten runs of snmf were performed for each genotypic data set. The best run was retained on the basis of the cross-entropy criterion, and was used for imputation of the missing data. Then we checked whether the removed genotypes were correctly predicted and restored by the deterministic option of the program. The accuracy of reconstruction was measured as the percentage of correctly reconstructed genotypes, and with the root mean squared differences between ancestry estimates computed from the original and reconstructed genotypes. A total of 18,000 program runs for 1,800 data sets were performed. The program snmf was run with K = 2. The regularization parameter of snmf was increased to α = 100 (default value α = 10) to account for the relatively small number of loci in the simulations  (Frichot, Mathieu, Trouillon, Bouchard, & François, 2014).
The new implementation relies on core functions from the base package of R which warrants reproducibility of analyses on the long term. To compare lfmm2 with the MCMC algorithm programmed in lfmm, simulations were performed from the LFMM regression model. The model generates continuous values, and a deterministic link function was added in order to obtain haploid genotypes (negative values corresponded to allele 0 and positive values corresponded to allele 1). Following this model, one hundred genotypic matrices were created for n = 100 individuals genotyped at L = 2, 000 loci. True associations were simulated at 100 loci, with effect sizes between -10 and 10. A Gaussian environmental variable, X, was simulated for each individual, and population structure was modeled by K = 3 Gaussian latent factors, exhibiting various levels of collinearity with the environmental variable.