dataesr/scientific-paragraphs-categorization huggingface dataset:
Data from this device is stored in his home system and also flows to a process in the hospital's system, which carries out an analysis of his condition. Because Bob's health data is private, the heart monitor and data are labelled with S = {medical , bob}. In order to receive this data, the hospital process's S label must also include the tags medical and bob. Example -integrity: The hospital process is only allowed to receive data from a hospital-issued device and to achieve this is labelled I = {hospital-issued}. In order to send data to the hospital process, Bob's device and data must also be labelled I = {hospital-issued}. Suppose Bob's heart monitor is capable of remote actuation, e. g. to change the sampling rate if analysis detects a possible health problem. The device must only accept actuation commands from authorised sources, e.
Such a process may be involved in data format conversion if non-standard data came from a remote source. A similar endorsement process can be used for many kinds of input data such as PhP scripts, downloaded software, indeed, any input amenable to a validation process. In our hospital example, the patient may have received some treatment in another hospital or clinic and have a treatment record there, where the data format may differ. A process is charged with checking the patient's identity and verifying the data, including reformatting. The data is then output with tag valid data and can be safely processed within the hospital domain. Integrity tags may need to be removed after an anonymisation process, as the quality of data may have been degraded by the process. For example, if detailed information is removed, the data may no longer be proper to use as the source of an actuation command.
} and some data (e. g. files) are labelled PfizerData[S = {Pfizer }, I = ∅] and RocheData[S = {Roche}, I = ∅]. The CoI described ensures that it is not possible for a single entity (e. g. an application instance) to have access to both RocheData and PfizerData either simultaneously or sequentially, i. e. enforcing that Rocheowned data and Pfizer-owned data are processed in isolation.
IV. MOTIVATING USE CASES In this section we motivate the use of two-component tags in FlowK2's label model. Our model is designed for a distributed system or cloud platform where there is likely to be a large amount of user data stored with persistent labels in files, databases, key-value stores, etc. In a company context, data records may relate to individual employees; in a public health context, data may represent the medical records of patients; in an educational context, data may relate to students, staff etc. Specifying and enforcing access to all, some specified subgroup or only one data record of a given type is a universal requirement, discussed in the literature on policy. Suppose a principal is allowed access to a subset of records, e. g. doctors may be able to access only the records of the patients they are currently treating.
Temporally separated processes are likely, i. e. to deal with one patient's records at a time. Each time, current authorisation policy is enforced and is translated into labels to ensure correct behaviour at runtime. Note that as a doctor's group of patients under treatment changes, a lookup of current patients at the authorisation point in the application will ensure that labels are created only for current patients, selected at runtime from the entire database. The first use case below arises from the need of certain software to perform computations on all health records of a given type, whereas other software is authorised only to access records on behalf of a single individual. The second considers a system log containing records from all running applications relating to large numbers of principals.
A. Data Analysis In the healthcare domain, statistical analysis of the medical records of patients is needed for various purposes including public health, environmental concerns, clinical practice etc. We are concerned with the privacy and confidentiality of medical data and will therefore discuss the construction of the IFC secrecy label for a statistical analysis program. In the standard atomic tag model a tag represents a single security concern. To express the idea of Bob's medical data, we would use two tags bob data and medical data. The entity carrying out the statistical analysis of the medical data would then need to have not only the medical data tag, but also a tag corresponding to every patient's data, for rule (1) to be satisfied. This makes the use of IFC infeasible for such purposes: (1) The performance implications are significant.
We have shown  [2]  that the processing overhead induced by the number of tags in labels is not insignificant (especially at such a scale). (  2 ) Enumerating "all" tags would be prone to error as the database state changes, with records being added and removed. (3) This entity would be over-privileged by the PoLP, being able to receive any data labelled only with the tag bob data although our intention was for it only to be concerned with medical data. It would also be privileged to declassify, see §III-C, over all the patients' personal tags and trusted not to leak information about any patient. An alternative would be to define different tags for every category of user data such as bob medical data, bob tax data, bob home data and many more. The performance issues caused by huge numbers of tags would still hold.
Also, an entity running on behalf of Bob could not simply have a label with a single tag bob data but would have to enumerate all the particular types of Bob's data it could process. The problems are solved by using two-component tags, where a tag is of the form concern, specifier. In Fig. 1 , we illustrate how such IFC tags can be used to constrain the flow of data within a 'big data' computation graph. The first computation phase aggregates medical and private information belonging to individual patients. The second phase anonymises these aggregates and the third generates statistical data from the anonymised data. In detail, suppose each input record has an S label containing a tag such as medical, patient id or private, patient id. We express that the first phase processing components can access all data belonging to a patient by including the tag * , patient id in their S labels, where * indicates all records with specifier patient id.
V. TWO-COMPONENT TAG MODEL A major aim for FlowK (our prototype cloud-IFC implementation using atomic tags  [2] ) was simplicity, for ease of understanding and verification, and efficient enforcement. This section presents the formal notation for the two-component tag model (implemented in FlowK2), as motivated in §IV. We will show that policy, particularly for large-scale data processing, is expressed more concisely using the FlowK2 tag model and is easier to maintain. Also, tag-checking overhead is comparable for small-scale processing and is reduced for large-scale processing. We propose to decompose a tag t into a pair c, s with c the concern of type C and s a specifier of type S. For example, the pair medical, bob represent Bob's medical data. A statistical analysis over a set of patients' medical data is represented as medical, statistical analysis and anonymised medical records as medical, anonymised.
As we saw in §IV, a major requirement is to be able to specify all data records of a certain kind without enumerating all possible tags, as required by current models. Therefore for any concern c and specifier s we establish the following subtyping relation: c, s * , s c, * * , * That is, a tag t = c, s is a subtype of t = c, * and t = * , s which are themselves subtypes of t = * , *. For instance, medical, bob (Bob's medical data) is a subtype of medical, * (medical data) and a subtype of * , bob (Bob's data) which are each subtypes of * , * (all data in the current naming domain).
This overhead is reduced by using the single 2D tag medical, *. Example -integrity: Consider a home control (domotic) system. An entity A labelled I(A) = { actuator, * } is able to send data (an actuation instruction) to an entity B labelled I(B) = { actuator, alarm } or an entity C labelled I(C) = { actuator, light }. The entity A could represent the central domotic control system with B and C being actuators in the house. In a patient monitoring context the controller might be sending actuation commands to a variety of patient monitoring devices, e. g. , to start, stop or change the monitoring intervals or thresholds. Since actuation affects the physical world, including people's health and safety, it is important that the authority of the actuation command is established.
VI. EVALUATION Our IFC platform comprises a local OS IFC enforcement system  [2]  and a messaging middleware for inter-process communication  [30]. Above these components it is possible to build a PaaS (and by extension SaaS) platform as discussed in  [2] ,  [3]. Performance evaluation of FlowK was carried out on a quad-core 2. 2Ghz Intel i7 with 6GiB of RAM running Fedora 20 (kernel version 3. 14). Our aim here is strictly to compare the impact on performance of the two-component tag model compared with atomic tags and not to evaluate a specific implementation, already available in  [2]. Suppose a data analysis worker needs to be given access to the data belonging to several users (see §IV). We assume each user's data is uniquely labelled. To run under IFC, the number of tags needed by the analyser increases linearly with the number of users.
First, we run the atomic tag model's IFC constraints algorithm over an increasing number of secrecy tags: users would have data labelled S = {medical, alice}, S = {medical, bob} etc. and the analysing process S = {medical, alice, bob,. }. Secondly, we run the two-component tag model in atomic tag compatibility mode (see §V-D); i. e. the medical tag is translated as ∅, medical and personal tags as e. g. ∅, alice etc. Therefore the analysing process is labelled S = { ∅, medical ∅, alice , ∅, bob ,. }. Finally, we use the full power of our proposed two-component tag model. That is, the data to be analysed is labelled S = { medical, alice } etc. , and the analysing process S = { medical, * }. The normalised overhead measured for each of the above is shown in Fig. 2. We take an analysis process with a label size varying from 0 to 100 tags, the data label is taken from the tags present in the process's label.
VII. CONCLUSION AND FUTURE WORK The feasibility of IFC has been demonstrated in practical systems: in the database domain  [25] ,  [31] , for webapplications  [32] , for cloud-service composition  [16] , within operating systems  [2] ,  [33] , across distributed systems  [30] ,  [34] , for PaaS  [3] , for networks  [35]  and for hypervisors  [36]. It has been shown that, with careful design, IFC does not require changes to cloud tenant applications  [2] ,  [17] , but would require some engineering effort by the cloud provider. The benefit of providing IFC as part of cloud services is that IFC supports both application isolation and data sharing between applications as required. Cross-application data sharing, as opposed to strong isolation, is of increasing importance, particularly when cloud services form part of IoT architectures.
These seasonal biases were reflected in the seasonal cycle amplitudes. In this paper, we continue the evaluation of the GOSAT seasonal cycle from  Kulawik et al. (2015). Five years of GOSAT observations and the updated TCCON GGG2014 retrievals lengthen the co-located time series sufficiently to evaluate the seasonal cycles regionally at 12 TCCON sites in the Northern Hemisphere and four sites in the Southern Hemisphere. We extend the seasonal cycle analysis to four other retrieval algorithms to identify potential biases characteristic to the ACOS retrievals. Although the emphasis of the study is on these TCCON comparisons, we also compare the GOSAT seasonal cycle against models that assimilate in situ data; because of their connection to measurements, models may be a reasonable representation of the truth in areas with high assimilated data density, such as North America or western Europe.
GOSAT GOSAT, developed by Japan Aerospace Exploration Agency (JAXA), was launched in January 2009 to make near-global greenhouse gas measurements from a polar orbit  (Yokota et al. , 2009). GOSAT measures reflected solar near-infrared radiation with a Fourier transform spectrometer (TANSO-FTS;  Kuze et al. , 2009). The diameter of a GOSAT sounding footprint is approximately 10 km, and the soundings repeat in a 3-day cycle. We used GOSAT data taken in two primary modes: glint over oceans and nadir view over land. Nadir data over land have two gain states: high gain (H) for most of the data and medium (M) over bright surfaces, such as deserts. Several retrieval algorithms have been developed for retrieving the column-averaged CO 2 from the GOSAT nearinfrared measurements; these algorithms have been recently reviewed and compared by  Oshchepkov et al.
(2013a)  and  Reuter et al. (2013). In this paper, we concentrate on the evaluation of the Atmospheric CO 2 Observations from Space build 3. 5 (ACOS B3. 5) retrieval algorithm  (Crisp et al. , 2012). The ACOS retrieval algorithm is described in detail by  O'Dell et al. (2012). The most significant subsequent updates and improvements to the operational algorithm include updated spectroscopy for the 1. 6 and 2. 1 µm CO 2 absorption bands, moving from static to dynamic vertical pressure levels, an improved prior profile of CO 2 , and a complete change in the treatment of aerosol and cloud scattering. Instead of a globally constant aerosol model that was incorporated in ACOS B3. 4 and earlier versions, B3. 5 uses Modern-Era Retrospective Analysis for Research and Applications (MERRA) reanalysis data of five aerosol types (mineral dust, sea salt, black carbon, sulphates, and organic carbon) to determine two most common types at a given GOSAT sounding location and applies their respective optical properties in the retrieval.
, 2011; Keppel-Aleks et al. , 2012; Wunch et al. , 2013) , though in principle sub-ppm seasonal biases could remain. For instance, the TCCON retrieval performs a post hoc air-mass bias correction  (Wunch et al. , 2011a) , errors in which could lead to small but nontrivial differences in the TCCON seasonal cycle. In fact, we tested this for Lamont TCCON station (because of its large data volume) by considering only data obtained at a similar air mass and found that the differences in the XCO 2 seasonal cycle amplitude were less than 0. 3 ppm compared to the amplitude derived using the full data set. For the GOSAT seasonal cycle evaluation, we used data from all TCCON sites that had (1) at least 2 years of coincidental measurements with GOSAT and (2) enough colocated data (see Sect. 4. 1) to evaluate a seasonal cycle, i.
e. both ACOS and TCCON observations available at the proximity of the site through most seasons. The first criterion eliminated the Ascension, Four Corners, and Caltech/Pasadena sites, while the second eliminated the northernmost sites of Ny Ålesund and Eureka which have very little co-located data due to the high latitude. We decided to focus our analysis on the Northern Hemisphere which has both a larger seasonal cycle amplitude and a larger quantity of TC-CON stations against which to compare. The seasonal cycles at the southern hemispheric sites were also evaluated, and we found that the seasonal changes in XCO 2 in the South-H. Lindqvist et al. : Does GOSAT capture the true seasonal cycle of carbon dioxide? ern Hemisphere were minor with an amplitude of around 1. 0 ppm and captured by GOSAT/ACOS to within 0.
2 ppm except at Réunion where the satellite data showed a stronger seasonal cycle of 1. 8 ppm. However, because the seasonal variability in XCO 2 at the southern hemispheric sites is of a similar magnitude than the single-sounding errors in the GOSAT/ACOS retrievals, the definition of an average seasonal cycle becomes ambiguous and sensitive to interannual variability. Therefore, these four southern hemispheric TC-CON sites were not analysed in more detail. All TCCON sites that were used in this study are shown in Fig. 1. We analysed all co-located data between 23 April 2009 and 31 December 2013. We used the newest available GGG2014 TCCON retrievals for each site: Bialystok  (Messerschmidt et al. , 2012; Deutscher et al. , 2014) , Bremen  (Notholt et al. , 2014) , Darwin  (Griffith et al. , 2014a) , Garmisch  (Sussmann and Rettinger, 2014) , Izaña  (Blumenstock et al.
, 2014) , JPL  (Wennberg et al. , 2014a) , Karlsruhe  (Hase et al. , 2014) , Lamont  (Wennberg et al. , 2014c) , Lauder  (Sherlock et al. , 2014) , Orleans  (Warneke et al. , 2014 ), Park Falls (Washenfelder et al. , 2006; Wennberg et al. , 2014b ), Réunion (De Maziere et al. , 2014 ), Saga (Kawakami et al. , 2014) , Sodankylä  (Kivi et al. , 2014) , Tsukuba  (Ohyama et al. , 2009; Morino et al. , 2014) , and Wollongong  (Griffith et al. , 2014b). TCCON data were obtained from the TCCON Data Archive website at http://tccon. ornl. gov/.
Model CO 2 data Because evaluation against TCCON is limited to 12 sites in the Northern Hemisphere, another validation source is necessary for obtaining a more thorough view of the accuracy of the GOSAT seasonal cycle. Therefore, we also analysed XCO 2 from three models that assimilate in situ CO 2 measurements to optimize their fluxes. The models were CarbonTracker (CT2013B;  Peters et al. , 2007,  with updates documented at http://carbontracker. noaa. gov), MACC 13. 1  (Chevallier et al. , 2010, documentation  and data available at http://macc. copernicus-atmosphere. eu/catalogue), and the University of Edinburgh model (UoE;  Feng et al. , 2009 Feng et al. , , 2011 , http://www. palmergroup. org). Relevant model properties are listed in Table  1. The models were resampled at GOSAT/ACOS observations in latitude, longitude, and time and integrated over all atmospheric layers to form the column-averaged CO 2.
The ACOS averaging kernel correction was first considered for CT2013B, but as it had only a very minor effect on the total column (generally < 0. 1 ppm difference in monthly averages), it was subsequently neglected for all models. However, seasonal effects of the averaging kernel correction are briefly assessed in Sect. 5. 3. All model results were available from the beginning of GOSAT data (23 April 2009) but have different end dates: UoE and CT2013B run until the end of December 2012, and MACC 13. 1 is available until the end of December 2013.
Acknowledgements. H. Lindqvist and  C. W. O'Dell  wish to acknowledge support from the  NASA Jet Propulsion Laboratory  and the OCO-2 project, via JPL subcontract number  1439002. H. Lindqvist also acknowledges funding from the  Academy of Finland , via project number  285421. H. Boesch  and  R. Parker  acknowledge the  National Centre for Earth Observation NCEO  and the  ESA GHG-CCI  project. F. Chevallier acknowledges the  European Commission  (grant agreement no. 630080 , MACC III). We wish to thank the referees ( Susan Kulawik  and an anonymous referee), the editor  Paul Wennberg , and  Andy Jacobson  for their comments and constructive feedback to the manuscript. We also gratefully acknowledge all the data providers. The following TCCON PIs are acknowledged for providing their XCO 2 data:  David Griffith  ( Darwin and Wollongong ),  Martine De Maziere  (Réunion), and  Vanessa Sherlock  (Lauder).
, i + m} forming an α helix, for any pair of residues (i -4, i) belonging to I α , the lower and upper bounds on the distance between the carboxylic oxygen O i-4 and the amide hydrogen H i should be compatible with the formation of an hydrogen bond. The upper and lower bounds are defined in an input parameter file of iBP, and were set to 1. 9 and 3. 0 Å in the present work. The condition checking the alignment of atoms involved in the hydrogen bond is implemented by calculating a local energy information defined in the DSSP package  [40] : q 1 q 2 1 d O i-4 N i + 1 d C i-4 H i - 1 d O i-4 H i - 1 d C i-4 N i • f < -0. 5, (13) with q 1 = 0. 42, q 2 = 0. 2 and f = 332, and d AB correspond to the distance between atoms A and B. The last criterion enforces the angles θ , θ ', θ " to be respectively into the interval values 0/70°, 0/90°and 110/180°.
For the proteins studied here, if one includes the ensemble of NMR interval distance constraints stored in the. mr file at the Protein Data Bank (PDB)  [57]  as well as all pruning devices described above, all solutions are pruned out, indicating that no solution to the distance geometry problem exists with the deposited data. This is not really surprising, since the optimization algorithms generally used in NMR structure determination are based on optimization of a target function or hybrid energy rather than on strict constraint satisfaction. That is, there is always a phase where the algorithm tries to find a trade-off when inconsistencies exist between constraints. The optimization thus produces solutions in which chemical and NMR constraints are optimized, but in which small violations are always present.
These inconsistencies are present in any structure determination, in particular because distance constraints are imprecise, due to experimental limitations. Since the data in the PDB for the examples presented here were not pre-processed the way our algorithm requires, we decided to use a subset of the stored data sets: the definition of α-helix regions and a few long-range distance constraints arbitrary selected from the set of NMR constraints for structures with more than one α-helix. In order to further reduce the risk of all solutions being pruned, we used tolerance values for atomic positions and angles between atoms (Table  2 ). The three examples we chose to illustrate the algorithm display an increasing structural complexity: (i) a single α helix, corresponding to the structure of peptide CM15 determined in micelles (PDB id: 2JMY  [58] ), (ii) an α helical hairpin (PDB id: 2KXA  [59] ), (iii) the insecticidial toxin TAITX-1a, formed as a bundle of four α helices, restrained by three disulphide bridges (PDB id: 2KSL).
For the 2KXA and 2KSL calculations, 10000 conformations were obtained in about 30 mins of calculation. Large total numbers of conformations were generated: this number increases from ∼634,000 (2JMY_1) up to ∼3,400,000 (2KXA) with the size of the considered problem, depending on the number of residues and on the number of constraints. Despite 2KSL being the largest example, the second smallest number of conformations was generated, which is the sign of a severe pruning arising from a rather restricted conformational space. The reliability of the obtained conformations was checked in three ways. First, the whole set of NMR constraints deposited along with the PDB entries and involving backbone hydrogens, were probed on the conformations. Second, the quality of the obtained disall. residues (%) 0 0.
These RMSD values lay in the 1. 3-3. 2 Å range for 2JMY_1, in the 2. 4-4. 9 Å range for 2JMY_2, in the 1. 5-4. 0 Å range for 2KXA, and in the 3. 2-6. 0 Å for 2KSL. In the SOMs for the four calculations (Figure  6 ), the RMSD values are colored according to their RMSD from the PDB entry, violet color indicating values smaller than the median value of the sampled RMSD value, green color indicating RMSD values larger than this median value. For 2JMY_1, 2KXA and 2KSL, a larger number of neurons of the SOMs belongs to the second group, which is the sign of an enhanced sampling of the conformational space with respect to the region sampled by simulated annealing. For 2JMY_2, the inverse picture is observed, which may arise from the more limited conformational space available to be sampled for a unique α-helix.
Acknowledgments TM, MN, BB thank the  Institut Pasteur  and the  CNRS  for support. This work was funded by the  European Union  ( FP7-IDEAS-ERC 294809  to MN), the " investissement d'avenir" program  (grant bip:bip to MN and LL), and the  Brazilian Research Agencies FAPESP  and  CNPq  (to CL and RA).