dataesr/scientific-paragraphs-categorization huggingface dataset:
Instrumentation and data acquisition The instrumentation on-board the D/V Chikyu comprises a NewWave Research UP-213 Nd:YAG deep UV (213 nm) laser ablation system coupled to an Agilent 7500ce quadrupole ICP-MS. First, initial basic tests and parametrization of the operating conditions were performed by the analysis of the well-known reference glasses BHVO-2G and BIR-1G. Analyses were bracketed by repeated analyses of NIST SRM 612 glass (National Institute of Standards and Technology), used as an external reference material following the reference values from  Jochum et al. (2011) ; NIST SRM 610 has been used for the instrument calibration. In addition to 29 Si, analysed as an internal standard for the data reduction (e. g. Longerich et al. , 1996 ; SiO 2 reference values used for  BHVO-2G and BIR-1G after Jochum et al.
Data availability. The whole-rock (ultra-)trace element concentrations obtained by LA-ICP-MS for the pressed powder prepared for the three reference materials BHVO-2, BIR-1a and JP-1 are given in Table  2. The measured elements discussed for the Oman Drilling Project CM gabbros and dunites, both obtained by LA-ICP-MS on-board the D/V Chikyu and replicate analyses after Leg 3, are given in the Supplement.
Hence the motivations of this work: How can we efficiently leverage the knowledge of the masking scheme in an ML-based profiling attack, without relying on the knowledge of random nonces ? The Scheme-Aware Modeling. To address this question, we investigate a new type of SCA adversary that we name scheme-aware. In this threat scenario, the adversary is supposed to have access to the source code of the target implementation. Concretely, this means that the adversary knows the masking scheme and order used to protect the target. Moreover, she is able to localize some Points of Interest (P. o. Is) precisely enough thanks to a careful code analysis. We explain how these assumptions can be taken into account in a DL model. To this end, we introduce GroupRecombine, a simple neural network layer encoding the knowledge of any group-based masking scheme, under the form of a discrete convolution.
We validate our approach on simulations and on public datasets. Our experiments on the ANSSI's SCA Databases (ASCAD) emphasize some use-cases with first-order Boolean masking where very simple scheme-aware models lead to successful attacks, whereas their uninformed counter-part fails. This suggests that a significant part of the efforts spent by the SCA practitioner in an uninformed setting, e. g. by running huge hyper-parameter grid searches, would actually be devoted to finding a DNN architecture that efficiently captures the way to learn the masking scheme. Hence, using GroupRecombine may be seen as an efficient surrogate to this issue. As an example, we also address the challenge left by Bronchain and Standaert as a conclusion of their works at Tches 2020, by showing on simulations how GroupRecombine could be used for profiling in presence of an affine masking scheme, without knowing the random shares to train our model.
The recent literature provides two examples of this approach. First, Masure and Strullu reported a detailed code analysis of the assembly code of the ANSSI's secure software implementation of the AES on an ARM Cortex M4, in order to extract 15, 000 P. o. Is out of 1 million time samples in the raw traces, covering the leakages of the three shares used by the affine masking scheme  [MS21]. Second, Egger et al. verified that the CPOI leakage detection method  [DS16]  could localize the same time windows as with the analysis of the assembly code used in the ANSSI's SCA Databases (ASCAD)-v1 dataset [EST + 22, Fig. 4 ].
Experiments on ASCAD-v1 We start with the ASCAD-v1 dataset, published in 2018 by Benadjila et al. [BPS + 20]. It deals with a first-order masked implementation AES, with a Boolean scheme based on table re-computation. The cryptographic primitive is implemented on an 8-bit ATMega8515 device on which the Electro-Magnetic (EM) field emanations are measured. Two versions of the dataset are proposed: one so-called fixed with measurements acquired on a 700 time samples window using a fixed encryption key, and a variable dataset with measurements on a 1, 400 time samples window using a variable encryption key for profiling traces. Both windows cover the look-up of the re-computed Sbox when applying the SubBytes operation on the third byte of the AES state during the first round. Since on both datasets, the data dimensionality is much higher than in our simulations whereas the number of profiling traces remains of same order of magnitude as in our simulations, the DNNs used in our simulations are more likely to over-fit.
That is why we reduce the number of neurons in the hidden layer of the branches from 1, 000 to 100. Results on Fixed Dataset. We report hereafter the outcomes of our trainings on the fixed dataset. When the threat model assumes to know the P. o. I location, the P. o. I selection has been done by splitting the 700 time samples into two halves, the first 350 time samples containing some leakages about the masked share while the second 350 time samples containing leakages about the mask. This pre-processing is suboptimal compared to a P. o. I selection with SNR, but reflects more what an adversary can do with a visual trace analysis with the help of the source code, and can even be further refined with a thorough code analysis, as argued in Subsection 2. 2. The results are depicted on Figure  8a.
Then, the scheme-aware model leveraging both P. o. I location and knowledge of the masking scheme reaches a PI of 0. 05 bits, whereas the scheme-aware model exploiting the knowledge of the masking scheme only obtains a PI of 0. 02 bits. Finally, the scheme-aware model leveraging the P. o. Is location only and the model in the uninformed setting cannot get a positive PI during the whole training. We validate this observations by reproducing the trainings on a lower number of profiling traces. For each of these trainings, the best PI on the validation loss is reported on Figure  8a. As can be noticed, the previous observations regarding the hierarchy of the threat models remains true. Results on Variable Dataset. We repeated the same experiments on the variable dataset. We first tried by splitting the traces into two contiguous parts of 700 points each, as with the fixed dataset.
Unfortunately, none of the non-worst-case models could succeed in getting a positive PI, which suggests that our P. o. I selection method for our scheme-aware attacks was not sufficient, at least for the amount of traces available in this public dataset. Therefore, we refined the P. o. I selection, by narrowing the windows for the two shares. For the share r out , we selected the range 0, 300 , whereas for the share Y ⊕ r out , we selected the range 900, 1200. This refined P. o. I selection is possible even without knowledge of r out during profiling, thanks to a careful assembly code analysis, similar to the one recently conducted by Egger et al. [EST + 22, Fig. 4 ]. For consistency in our comparisons, we also feed the model in the uninformed setting with the two restricted P. o. I windows, stacked together.
We then report on Figure  8b  the results obtained for this second attempt on the variable dataset. Like with the fixed dataset, we can see that the model uninformed is unable to get a positive PI with the 600 P. o. Is given as an input. On the contrary, it took 70, 000 profiling traces to get a positive PI for our best scheme-aware model (green curve in Figure  8b ). This is much more than for the worst-case model that only required 2, 000 profiling traces (light green curve). Still, the results obtained on both ASCAD-v1 datasets confirm that it is possible to succeed an attack by using small MLPs, provided that the recombination is cleverly done, e. g. with GroupRecombine.
Experiment for Second-Order Masking Provided with the promising results presented in Figure  4  and Figure  6 , and on the good experimental verifications on the ASCAD-v1 datasets, we pushed our experiments one step further by trying to extend our attacks to higher-order masking. To this end, we report positive results on a second-order Boolean masking, and negative results on an affine masking. Results on Clyde. We first report our results obtained on a second-order Boolean masking. To this end, we considered the CHES 2020 CTF dataset. 9 More precisely, we considered the traces depicting the software implementation of Clyde protected with a 3-sharing. Clyde is a bit-slice SPN cipher, whose state is made of four 32-bit words, with a 4-bit Sbox. The authors of the CTF provided the traces with a baseline attack recovering an 8-bit secret chunk, by targeting two bits in each of the secret words.
We propose hereafter to replicate one the 2-bit key recovery with GroupRecombine. To this end, we target the 15 th and 16 th bits of the first word. The dataset is made of 200, 000 traces from which we use 190, 000 of them for training and the remaining 10, 000 for validation. Using the training traces, we first compute the SNR of each share. Then, we keep some contiguous windows around the three main peaks of SNR for each share. 10 This results in 248 P. o. Is for the first share, 153 for the second and 131 for the third share. As argued in Subsection 2. 2, we assume that an adversary without access to the random shares during profiling could have been able to select the same P. o. Is, thanks to a joint analysis of the traces and the source code of the implementation. 11 Then, these P. o.
Is are fed to GroupRecombine, using the same architecture for the branches as the ones used in our experiments on ASCAD-v1. The results are reported in Figure  8c. It shows that the scheme-aware model is able to get a positive PI with less than 20, 000 profiling traces, whereas the uninformed adversary requires around 70, 000 profiling traces. In other words, a scheme-aware adversary can spare some profiling complexity. Attempt on ASCAD-v2. Provided with the promising results presented in Figure  6  on the affine masking, and on the good experimental verifications on the ASCAD-v1 datasets, we pushed our experiments one step further by trying to replicate the attack of affine masking on an actual implementation of the affine masking. To this end, we used the ASCAD-v2 dataset  [MS21]. It is made of 500, 000 traces, each having 15, 000 time samples coming from two contiguous parts of the raw power consumption traces acquired on an STM32 Cortex-M3 device.
There, the authors explain that the first window covers P. o. Is of the multiplicative share only, whereas the second window covers P. o. Is of the additive share and the masked data. Since the implementation also uses shuffling to protect the sensitive data, we artificially deactivate the latter counter-measure, by relabeling the masked data thanks to the knowledge of the random seeds used for permutation. Unfortunately, we could not get effective attacks using scheme-aware models with simple MLPs as branch models, whereas the same model trained in a worst-case scenario could get a positive PI. This negative result should nevertheless been mitigated. Indeed, the authors of  [MS21]  reported some successful worst-case attacks on the dataset, leveraging the knowledge of at least one share during profiling, but did not succeed in attacking the dataset with a model in the uninformed setting.
On the Choice of Architecture for the Branches In our experiments involving scheme-aware attacks, we used the same architecture for the branches of our GroupRecombine model, namely a one-hidden-layer MLP with 100 or 1, 000 neurons. Naturally, better performances could have been obtained by investigating other types of DL architectures. As a consequence, our models in the uninformed setting are not necessarily the best ones. Actually, our results report unsuccessful uninformed attacks with one-hidden-layer MLPs on ASCAD, whereas the literature reports much better results on this dataset, by using deeper MLPs -up to 6 layers according to Benadjila et al. [BPS + 20] -or CNNs [KPH + 19, MDP19b]. Therefore, one might wonder whether our comparison is biased towards GroupRecombine. Hereupon, we stress that all trainable models depicted in Figure  1  and in Figure  3  have been instantiated with the simplest DNN architecture one may use.
The fact that the worst-case models instantiated with such simple branches reached the optimal performances on our simulations, and reached levels of PI close to the state of the art on the ASCAD-v1 dataset. Naturally, it may be possible to use other branch models, such as CNNs, with GroupRecombine. But our experiments suggest that using shallow MLPs is often sufficient for optimal leakage modeling -at least provided that other types of counter-measures are ignored. In other words, this suggests that the main efforts spent by the DL practitioner in designing more complex architectures in an uninformed setting would actually serve at learning how to recombine the information gathered by the first layers of the DNN on each share, according to the masking scheme. Hence, by hard-encoding the masking scheme with GroupRecombine, we expect the DL practitioner to spare a significant amount of time spent, e.
Empirical Verification on Exhaustive Datasets To address these questions, we repeat our simulations for a Boolean masking, by using here a noise-free, exhaustive dataset, i. e. for which the training and validation loss are equalwhich is made possible thanks to the discrete nature of our noise-free leakage model. Thus, the profiling complexity is nullified, allowing to focus only on the optimization complexity. 12 he setting of this simulation is voluntarily much simpler rather than realistic, so that the optimization complexity may be seen as a lower bound of what a real-world adversary could expect. In order to quantitatively measure the optimization complexity, we define the weak learning threshold, set to L (θ) = n -ϵ. The weak learning threshold corresponds to an adversary with an effective model, i.
e. a model wit strictly positive PI, up to an ϵ-margin. More concretely, the weak learning threshold can be used to measure the length of the plateau in the optimization curve. We also define the strong learning threshold, set to L (θ) = MI (Y; L) + ϵ. The strong learning threshold corresponds to an optimal adversary from an information theoretic point of view, up to an ϵ-margin. Hence, the optimization complexity can be measured in terms of the number of epochs required to reach the weak and strong learning thresholds. The results of our simulations with an exhaustive dataset are showed on Figure  9 , for ϵ = 0. 05, and averaged over 5 different seeds. Note that here we fixed the number of neurons in the uninformed setting, so the curves Figure  9a  and Figure  9b  are not directly comparable with each other.
8, 10, 11). During model inversion, the discrepancy between the input and the prediction of the generative model, i. e. the prediction error, are weighted by the corresponding precisions and used to update model estimates in generalized coordinates  (Friston et al. , 2008). We manipulated the precisions for continuous state x and activities of frequency channels v to simulate intact (HP) and impaired (LP) peripheries. The precision for top-down priors from the syllable level, Ps, was kept high for all simulations (see Table  2  for values used in different conditions). The continuous generative model and its inversion were implemented using the ADEM routine in the SPM12 software package  (Neuroimaging, 2014) , which integrates a generative process of action. Because we focus on passive listening rather than interacting with the external world, this generative process was set to identical to the generative model and without an action variable.
P(o(t)|Im) is the likelihood of observing the continuous input o(t) given the m th I and P(o(t)|I) is the averaged likelihood over all possible I vectors. In this way, the model compares the top-down prediction of I and the estimate derived from the bottom-up evidence of integrated acoustic input over 25ms. Detailed explanation of the algorithm can be found in previous studies  (Friston et al. , 2017, Friston and Penny, 2011). The software implementation was also adapted from existing routines in the DEM toolbox of SPM12  (Neuroimaging, 2014).
Since we were interested in comparing the relative contributions of visuo-vestibular and visuo-tactile synchrony/asynchrony, we reasoned that such differences might be smaller than the basic effect of synchronous versus asynchronous visuo-tactile conditions  [10, 16, 32]  and that a larger sample size would also improve the conclusiveness of the Bayesian analyses that we wanted to include to follow-up on the effects of potential similarly strong illusions in two conditions (see further below). For the SCR analyses, we recruited 52 participants but analyzed data from only 50 participants, as two participants did not finish the procedure (23 male, mean age = 24. 52, SD = 3. 82). One of the participants included in the SCR analysis was left-handed, as indicated by the Edinburgh Handedness Questionnaire  [31] , and two left-handers and one ambidextrous people were included in the questionnaire data analysis.
We administered a 7-point Likert scale (from -3 to +3) that is commonly used to investigate the subjective experience in rubber-hand illusion experiments  [2, 25, 38]  as well as in full-body ownership experiments  [16, 30] , where subjects are asked to either affirm or deny the ownership statements. In addition, we used a 10-point visual analog scale (0: "not at all"; 10: "very much") (see Table  2 ) to quantify perceived self-motion. When filling out the questionnaires, the participants removed the HMD. SCR experiment. For the 50 participants who also took part in the threat-evoked SCR (recorded via a Biopac System MP150, Goleta, U. S. A. ), we made a few minor adjustments in the procedures; all other procedures were identical to what is described above for the questionnaire experiment. We used a total of 16 shorter trials (between 59 and 67 seconds) so that we could collect data from multiple threat events.
The experimental conditions S VV S VT , S VV A VT , A VV S VT and A VV A VT were presented in a pseudorandomized order so that every condition was presented equally often at the first, second, third or fourth position within each block of four trials. There were four different randomization possibilities: S VV S VT -A VV A VT -A VV S VT -S VV A VT ; A VV S VT -S VV S VT -S VV A VT -A VV A VT ; S VV A VT -A VV S VT -A VV A VT -S VV S VT ; and A VV A VT -S VV A VT -S VV S VT -A VV S VT. Every participant was assigned to one of these randomization orders, and each order was repeated a total of four times. The whole procedure took approximately 20 minutes, and there was no break between the first 12 trials; during these trials, only SCR data were collected. Questionnaire data were collected once for each condition after the last four trials (trials 13-16) (participants took off the HMD to do so).
Analysis All analyses were performed using Rstudio  [41] , and the alpha level was set to 5%. Mixed effect models were calculated using the clmm2 function of the "ordinal" package (version 2019. 12-10) [42]  and rlmer of the "robustlmm" package  [43]  in R. In addition to p values, we report Bayes factors (BFs) for planned comparisons. BF indicates whether the data support the alternative Hypothesis H 1 or the null Hypothesis H 0. For example, a BF 10 of 5 would indicate that the observed data are 5 times more likely to have happened under H 1 than under H 0  [44]. A BF 10 of 1 indicates neither evidence for H 1 nor H 0. Usually, a BF 10 of 1-3 is termed 'anecdotal' evidence, and a BF 10 larger than 3 is termed 'moderate' evidence  [45]. BFs for planned comparisons were calculated using the "BayesFactor" package for R (version 0.
Graphs were made by the use of the package "ggplot2" for R  [50]. Questionnaire data analysis. The questionnaire ratings were measured using a sevenpoint Likert scale from -3 to +3 (strongly disagree to strongly agree) (for the bodily illusion, S1-S6) and a 10-point visual analog scale (for the self-motion illusion, S7). Data analysis was performed using a cumulative link mixed model for each ordinal questionnaire statement. Maximum likelihood estimates of the parameters were estimated using the adaptive Gauss-Hermite quadrature method (10 nodes)  [42]. Visuo-tactile and visuo-vestibular stimulation (synchronous, asynchronous) were entered as fixed effects, and participant ID was entered as a random effect. Likelihood ratio tests were performed to test the fixed effect while controlling for the remaining variables.
947, and its power was 100%. Wilcoxon signed-rank tests were performed for planned comparisons. We expected that the ownership ratings in S VV S VT should be higher than those in A VV A VT , A VV S VT and S VV A VT. Furthermore, we planned to compare the ratings in A VV S VT and S VV A VT. Descriptive statistics and post hoc questionnaire analyses are provided in 'Supporting Information-Section II, S3 and S4 Tables' in S1 File. SCR data analysis. We analyzed the SCR magnitude induced by means of physical threats to the mannequin's body in the SCR experiment. SCR magnitude has been used in many previous full-body illusion studies  [10, 39, 52]  and is a straightforward approach to obtain a measure of total SCR response to threat stimuli. The average response across multiple trials, including only those where the SCR was elicited (i.
We speculate that it is possible that even if the full-body illusion is slightly reduced on one condition compared to another but still felt to a certain degree (affirmative illusion ratings), it could trigger an automatic emotional defense against physical threats. However, further methodological work is needed to investigate the precise relationship between changes in subjective ownership illusion and graded responses in threat-evoked SCR. For example, in the current data, we found no significant correlation between questionnaire rating S1 and the magnitude of the threat-evoked SCR response with regard to the different measures for S VV S VT and A VV A VT. Therefore, we focus more on the questionnaire data in the current study and consider the SCR findings supplementary, mainly supporting that a bodily illusion was elicited in the S VV S VT , A VV S VT , and S VV A VT conditions compared to the fully incongruent condition (A VV A VT ).
But this would be mistake, for two associated reasons. First, as famously explained by  [34] , the frontier between normative and positive is always blurred, since many issues, theories or approaches that are typically seen as entirely positive in fact have a normative anchorage, and most issues that are typically seen as entirely normative are based on, or influenced by, positive data. Confining ourselves to the positive question is accordingly impossible in practice. In concrete terms, this impossibility stems from the fact that, when designing a scientific project to answer the empirical question above and when analysing the data obtained, we unavoidably take stances on issues that pertain to the normative approach. This is the case, for example, when making decisions on how questions will be formulated to survey individuals, or on how behaviour will be monitored and interpreted.