dataesr/scientific-paragraphs-categorization huggingface dataset:
Methods A single-centre, prospective observational study was performed at Imperial College Healthcare NHS Trust (London, UK). Ethical approval was gained from South East London Research Ethics Committee Reference 11/LO/0686, the East of England -Cambridge East Research Ethics Committee Reference 14/EE/0024 and the project was registered under the Imperial College Tissue Bank. Patients (>18 years of age) undergoing breast surgery for benign and malignant disease were recruited. Data were only obtained on patients who had consented to utilization of tissue for research. Demographic and clinicopathological details included age, operation type, neoadjuvant treatment, post-operative histopathological data including grade (1-3), tumour histological subtype (invasive ductal carcinoma (IDC), invasive lobular carcinoma (ILC), invasive mucinous carcinoma (IMC) or ductal carcinoma in situ (DCIS)), oestrogen receptor (ER) and progesterone receptor (PR) status and human epidermal growth factor receptor 2 (HER2) status (Additional file 1: Table  S1 ).
Construction of the histologically assigned spectral database: spectral processing, bioinformatics and statistical analysis To ensure only samples with adequate spectra and representative of true pathological change were used to build the tissue-type MS database, strict inclusion and exclusion criteria were determined (detailed in Additional file 2: Table  S2 ); 40 specimen data files were excluded from a total of 399, leaving 359 for analysis of normal (B1 and B2) versus tumour (B5a and B5b). Raw mass spectrometric data were processed with Offline Model Builder (OMB-v29, Waters Research Centre, Hungary) with a bin of 0. 01 m/z with background subtraction and lock mass correction (699. 497 m/z). Spectra acquired from all sample burns were averaged to produce a single mass spectrum per sample.
The mass spectra from all samples were imported into Matlab 2014a (Mathworks, MA, USA) and profile mode alignment  [44]  was applied prior to peak picking. The data were median fold change normalised and log transformed prior to multivariate statistical analysis. Principal component analysis (PCA) was used to identify trends in the data. Linear discriminant analysis (LDA) was used to identify spectral differences between cancer and normal tissue. Classification performance was recorded for each model with a leave-one-patient-out cross-validation scheme.
Lipid phenotyping of normal and cancerous human breast tissue with REIMS A sub-set of high-density (90-100%) cancer samples (n = 17) was compared to randomly selected normal breast tissue (n = 17) to determine the differences in peak intensities between cancerous and normal tissue. Total intensity normalization was performed prior to univariate analysis. The Mann-Whitney U test was performed, with Benjamini-Hochburg-Yekutieli false discovery rate correction accounting for multiple testing (p < 0. 05). Isotope peaks were excluded. Thawed frozen normal (n = 2) and cancerous (n = 2) breast tissues were sampled in cut mode for 10-15 seconds to allow fragmentation of ions and collection of tandem MS (MS/MS) data. Tentative ion identification was performed by searching peak m/z values in the METLIN metabolite database and with LIPID MAPS® online tools  [45, 46] , which was refined using the MS/MS data.
Ex-vivo iKnife validation The accuracy of the combined cut and coag ex-vivo model was tested by exporting the OMB statistical model data into purpose-built OMB recognition software (V29, Waters Research Centre, Hungary). The following parameters were set: mass range 600-1000 m/z, 0. 1 bin, background subtraction on and lock mass correction to 699. 497 m/z (phosphatidic acid (PA) (36:2)). REIMS analysis was performed in cut and coag modalities on new fresh and defrosted, normal and tumour breast tissues with both macro and microscopic histological agreement of tissue type. The validation spectra were pre-processed as previously described, then transformed to the linear discriminant space and classified to the closest class (i. e. normal or tumour) within the space using Mahalanobis squared distances.
Intraoperative iKnife -proof of principle To determine if the ex-vivo method was applicable to the intraoperative environment we ran an intraoperative proof-of-principle study. A modified Xevo G2-XS mass spectrometer (Waters, UK) was installed in the operating theatre and a commercially available sterile (Surg-N-Vac or AccuVac, Covidien, UK) hand-piece was connected to the instrument. Aerosol produced as a result of electrosurgical tissue manipulation was continuously aspirated into the instrument throughout the operation. Video footage was simultaneously recorded, capturing all activities occurring at the operative scene (GoPro, CA, USA) in a time-synchronized manner with the acquisition of spectral data. Video recordings enabled retrospective orientation of spectral data with regard to three-dimensional margins.
Ex-vivo validation of iKnife New frozen and fresh breast specimens (n = 260) not previously used for ex-vivo model creation were subjected to iKnife analysis using both cut and coag modalities, employing an identical ex-vivo methodology combined with interpretation by bespoke iKnife recognition software (OMB V29). For the cut modality there were 79 normal and 48 tumour specimens and for the coag modality there were 82 normal and 51 tumour samples. Recognition software was concordant with final histopathological assessment in 249 out of 260 specimens, producing an overall model accuracy of 95. 8% with a sensitivity of 90. 9% and specificity of 98. 8% (Fig. 6 ). Finally, the iKnife was used to perform a continuous dissection line through the tissue in cut and coag mode from normal, through tumour returning to normal tissue, in a case series of three whole mastectomy slices with large tumours (>3 cm).
Discussion A REIMS-based histological identification method has been successfully optimised for the real-time analysis of heterogeneous breast tissues. The construction of an exvivo database from fresh breast tissues demonstrated significant differences in spectra related to disparity in lipid metabolism between normal breast tissues and breast cancer. Spectral differences observed between cut and coag electrosurgical modalities have been combined to create a multivariate statistical model allowing the use of both modes interchangeably. Leave-one-patient-out cross-validation demonstrates this model can detect tumour with a sensitivity of 94. 9% and exclude tumour with a specificity of 93. 4%, results that rival other IMA techniques  [34]. MS/MS has been used to characterise key lipid species present in normal and cancerous breast tissue.
Significant advances in software development have enabled real-time analysis of tissue composition and rapid comparison against the multispectral database of Fig. 5  Intensities of five significant features that had higher intensities in cancer samples (a) and five significant features that had higher intensities in normal samples (b). The features are the most significant ones identified by univariate analysis (see Fig. 4  and Additional file 5: Table  S3 ). The bottom and top of the coloured band represent, respectively, the 25th and 75th percentiles of the group, with the median denoted by the black line. The individual intensities for each group have been scattered with a random amount of x-axis positional variation ex-vivo tissues. Specifically, we were clearly able to observe spectra obtained in real time with onscreen classification.
Prospective ex-vivo validation with bespoke recognition software provides evidence that the statistical model is fit for purpose with high diagnostic accuracy demonstrated (90. 9% sensitivity, 98. 8% specificity) for both fresh and defrosted breast tissues. Logistical barriers have been overcome and the iKnife has now been successfully introduced to the operating  theatre, with a method that has been demonstrated as a proof of concept, to function well during breast surgery. Despite additional factors to consider such as blood flow and body temperature, high intensity mass spectral data were obtained during breast surgery, comparable to data obtained in the ex-vivo setting. An ex-vivo classification model was able to recognize a very high proportion of intraoperative spectra (>99%), which suggests that ex-vivo models trained on tissue type will be able to guide intraoperative analysis.
Conclusion A mass spectrometric method for the rapid analysis of heterogeneous breast tissues has been developed. REIMS analysis can be performed in both the cut and coag modes, which allows the surgeon to alternate between modes as clinically necessary. Preliminary data suggest the iKnife is capable of accurately separating breast tissue types by interpretation of the cellular chemical constituents. Recognition software enables real-time analysis of both ex-vivo and in-vivo breast tissue. The iKnife method has been optimised and further work will focus on determining the accuracy of the tool for intraoperative classification of resection margins.
Acknowledgements We would like to thank the  Imperial College Tissue Bank  for their help with sample collection and storage. We thank the  histopathology laboratory at Charing Cross  for their time, skills and resources. Finally, we thank all those who have helped with the mass spectrometer instrumentation, including  Emma White ,  Adele Savage ,  Louise Gildea ,  Hui-Yu Ho ,  Luisa Doria  and  Dipa Gurung. This work has been presented, in part, at the: Association of Breast Surgeons annual conference, Belfast, UK. May 2017.
Funding This work was supported by project grants from the  Association of Breast Surgeons (UK)  and  Waters Corporation. The research leading to these results has received funding from the  European Research Council  under the European Union's  Seventh Framework Programme  ( FP7/2007-2013)  /  ERC  grant agreement  n°617896. Support was also obtained from the  Imperial NIHR Biomedical Research Centre and Imperial Cancer Research UK   Centre. Edward St John received a one-year research Fellowship  from the  Royal College of Surgeons of England.
We present a high-assurance software stack for secure function evaluation (SFE). Our stack consists of three components: i. a verified compiler (CircGen) that translates C programs into Boolean circuits; ii. a verified implementation of Yao's SFE protocol based on garbled circuits and oblivious transfer; and iii. transparent application integration and communications via FRESCO, an open-source framework for secure multiparty computation (MPC). CircGen is a general purpose tool that builds on CompCert, a verified optimizing compiler for C. It can be used in arbitrary Boolean circuit-based cryptography deployments. The security of our SFE protocol implementation is formally verified using EasyCrypt, a tool-assisted framework for building high-confidence cryptographic proofs, and it leverages a new formalization of garbled circuits based on the framework of Bellare, Hoang, and Rogaway (CCS 2012).
INTRODUCTION Cryptographic engineering is the domain-specific area of software engineering that brings cryptography to practice. It encompasses projects that maintain widely used cryptographic libraries such as OpenSSL, 1 s2n 2 and Bouncy Castle, 3 as well as prototyping frameworks such as CHARM  [1]  and SCAPI  [31]. More recently, a series of groundbreaking cryptographic engineering projects have emerged, that aim to bring a new generation of cryptographic protocols to real-world applications. In this new generation of protocols, which has matured in the last two decades, secure computation over encrypted data stands out as one of the technologies with the highest potential to change the landscape of secure ITC, namely by improving cloud reliability and thus opening the way for new secure cloud-based applications.
The implementation is proved secure relative to standard assumptions: the Decisional Diffie-Hellman problem, and the existence of entropy-smoothing hash functions and pseudorandom functions. The higher-level component of our stack is a verified optimizing compiler from C programs to Boolean circuits that we call CircGen. Our compiler is mechanically verified using the Coq proof assistant, and builds on top of CompCert  [43] , a verified optimizing compiler for C programs. It reuses the front-and middle-end of CompCert (introducing an extra loop-unrolling optimization) and it provides a new verified back-end producing Boolean circuits. The back-end includes correctness proofs for several program transformations that have not previously been formally verified, including the translation of RTL programs into guarded form and a memory-agnostic static single assignment (SSA) form.
Our proof of semantic preservation is conditioned on the existence of an external oracle that provides functionally correct Boolean circuits for basic operations in the C language, such as 32-bit addition and multiplication. The low-level circuits used in our current implementation for these operations have not been formally verified and are hence part of our trusted computing base. Verifying Boolean circuits for native C operations can be done either in Coq or using other verification techniques and it is orthogonal to the reported verification effort. The Boolean circuits generated by CircGen compare well with alternative unverified solutions, namely CBMC-GC  6   [34] , although they are slightly less efficient (as would be expected). To widen the applicability of CircGen to scenarios where speed is more important than assurance, we also implement some (yet unverified) global post-processing optimizations that make CircGen a good alternative to CBMC-GC for high-speed applications.
Formalizing the proof of security for our SFE protocol in EasyCrypt involved formalizing two generic proof techniques that had not previously been considered: hybrid arguments and simulation-based security proofs. In contrast to other standard techniques, which remain within the realm of the relational program logic that forms the core of EasyCrypt (i. e. , it is used to verify transitions between successive games), hybrid arguments and simulation-based proofs lie at the interface between this relational program logic and the higher-order logic of EasyCrypt in which security statements are expressed and proved. Specifically, hybrid arguments combine induction proofs and proofs in the relational program logic. Similarly, simulationbased security proofs intrinsically require existential quantification over adversarial algorithms and the ability to instantiate security models with concrete algorithms (the simulators) that serve as witnesses as to the validity of the security claims.
These two forms of reasoning excercise the expressive power of EasyCrypt's ambient logic, and are thus markedly distinct from the simple security arguments typically addressed by other similar tools like Cryp-toVerif  [19]. Secure function evaluation is also a challenging test case in terms of its scale. Indeed, EasyCrypt had so far been used primarily for primitives and to a lesser extent for (components) of protocols. While these examples can be intricate to verify, there is a difference of scale with more complex cryptographic systems, such as SFE, which involve several layers of cryptographic constructions. Realizing our broader goal required several improvements to the EasyCrypt tool. In particular, the complexity and scale of the proof developed here guided several aspects of EasyCrypt's development to support compositional simulation-based proofs, and the aim of producing executable code from machine-checked specifications served as initial motivation for EasyCrypt's code extraction mechanism.
CircGen fills this gap from both a high-assurance cryptography perspective-verified outputs incur a small performance penaltyand a cryptographic engineering perspective-it supports unverified optimizations for speed-critical applications. Highlights of our technical contributions at this level include: (1) the addition of a loop unrolling transformation to the CompCert middle-end that permits converting those programs that can be expressed as circuits into a loop-free form; (2) new intermediate languages in CompCert with corresponding transformations semantics preservation theorems that permit converting loop-free programs gradually into a circuit representation-this includes a new domain-specific transformation into Static Single Assignment (SSA) form; and (3) the formalization of a new target language that captures the semantics of Boolean circuits and permits stating and proving a semantics preservation theorem relating the I/O behavior of an input C program to that of a generated circuit.
Access to the development. The EasyCrypt formalisation of Yao's protocol, as well as its extracted code, can be found at https: //ci. easycrypt. info/easycrypt-projects/yao. The code for CircGen can be found at https://github. com/haslab/circgen. Structure of the paper. In Section 2 we describe the EasyCrypt formalization and the verified implementation of Yao's protocol. In Section 3 we present CircGen, our certified Boolean circuit compiler. In each of these sections, we give micro-benchmarks for the related software component. We then present an overall performance evaluation of the software stack in Section 4. In Section 5 we discuss related work, before making some concluding remarks in Section 6. Limitations. Our approach covers a comfortable subset of C, but some features are excluded (see Table  2 ); some of these features will be added in future work, while others are traditionally out of reach for SFE.
This is a   [12]. (lower-level) SFE protocol for a very simple functionality that allows Alice to obtain the labels that encode x 1 from Bob, without revealing anything about x 1 and learning nothing more than the labels she requires. 7 The protocol is completed by Alice evaluating the circuit, recovering the output, and providing the output value back to Bob. Excellent descriptions of Yao's SFE protocol with slightly different security proofs can be found in  [12, 44]. A modular proof of security. Our starting point for producing a formally verified implementation of Yao's protocol is to transpose to EasyCrypt the modular security proof by Bellare, Hoang and Rogaway  [12]  (BHR). The central component in this proof is a new abstraction called a garbling scheme that captures the functionality and security properties of the circuit garbling technique that is central to Yao's SFE protocol.
Such steps are critical in making our main Theorem (Theorem 2. 1 below) apply to a concrete and efficient implementation of Yao's protocol that can readily be extracted in to OCaml code from its EasyCrypt description. To obtain such a result our formalization needs to explicitly include theorems that instantiate abstract security results into concrete security bounds for the implementation. More precisely, one needs to prove i. that the implementation is functionally equivalent to the composition of a concrete oblivious transfer and garbling schemes; and ii. that this implies that the security bound for the generic SFE security theorem (4 in the figure) can be instantiated into a concrete overall bound by plugging in security bounds obtained by instantiating all intermediate results all the way down to the PRF, DDH and entropy smoothing assumptions.
c, or to the memories of B and O b ; this is denoted by the notation Adv Hy {C,B,O b } in the EasyCrypt code. Other lemmas shown in this paper also have such restrictions in their formalizations, but they are as expected (that is, they simply enforce a strict separation of the various protocols', simulators' and adversaries' memory spaces) and we omit them for clarity. The construction of B is generic in the underlying adversary A, which can remain completely abstract. We underline that, for all A implementing module type Adv Hy , the partially-applied module B(A) implements Adv Hy as well and can therefore be plugged in anywhere a module of type Adv Hy is expected. This ability to generically construct over abstract schemes or adversaries is central to handling modularity in EasyCrypt. ; if (l 0 < l) r = O b.
Extraction and Micro Benchmarks. Our verified implementation of Yao's protocol is obtained via the extraction mechanism included in recent versions of EasyCrypt. The only exceptions to this are the low-level operations left abstract in the formalisation, namely: i. abstract core libraries for randomness generation, the cyclic group algebraic structure, a PRF relying on AES and the entropy-smoothing hash of SomeOT. These are implemented using the CryptoKit library; 9 and ii. a wrapper that handles parameter passing (circuits, messages and input/output) and calls the extracted SFE code. We fix the bound c on circuit sizes to be the largest OCaml integer (2 k -1 -1 on a k-bit machine) allowing us to represent circuits without having to use arbitrary precision arithmetic whilst remaining large enough to encode all practical circuits.
We use this same value to instantiate n. We conclude this section with microbenchmarking results focusing only on the extracted OCaml implementation. Our results show that, whilst being slower than (unverified) optimized implementations of SFE that use similar cryptographic techniques [11, 35, 40,   9 See http://forge. ocamlcore. org/projects/cryptokit/ 56], the performance of the extracted program is compatible with real-world deployment, providing evidence that the (unavoidable) overhead implied by our code extraction approach is not prohibitive. The overhead of our solution is not intrinsic to the verification and extraction methodology. Indeed, the more modern (unverified) implementations showing significant improvements rely on either cryptographic optimizations  [35]  or on new SFE protocols  [56].
CERTIFIED BOOLEAN CIRCUIT COMPILER In this section we describe a new certified compiler called CircGen that can convert (a large subset of) C programs into Boolean circuit descriptions. This is a self-contained, standalone tool that can be used in arbitrary contexts where computation needs to be specified as Boolean circuits. By a certified compiler we mean a compiler that is coupled with a formal proof asserting that the semantics of the source program is preserved through the compilation process. In other words, whenever the source program exhibits a well-defined behavior on some input, the behavior of the target program will match it. The tool is based on the CompCert certified compiler  [43] , ensuring the adoption of a widely accepted formal semantics for the C language. Relevant CompCert features.
CompCert is in fact a family of compilers for implementations of the C programming language for various architectures (PowerPC, ARM, x86). It is moderately optimizing, sometimes compared to GCC at optimization level 1 or 2. It is formally verified: the semantics of the programming languages involved in the compiler (in particular C and the assembly languages) are formally specified; and correctness theorems are proved. The correctness of a compiler is stated as a behavior inclusion property: each possible behavior of the target program is a possible behavior of the source program. A behavior of a program is a (maybe infinite) sequence of events that describe the interactions of the program with its environment. For the current prototype we have adapted the 2. 5 distribution of CompCert. 11.