dataesr/scientific-paragraphs-categorization huggingface dataset:
e. , 𝑏 0 = 𝑏 1. This rule follows the pattern of the unbounded do-while rule defined for simple imperative programs by Maillard et al. [70]. We believe that, with some additional work, their ideas could be used to also support unbounded loops in SSProve (see §5. 5 for details). |𝐴|, |𝐵| < 𝜔 𝑓 : 𝐴 → 𝐵 bijective ∀𝑥. ⊨ { { {𝜙} } } 𝑐 0 𝑥 ∼ 𝑐 1 (𝑓 𝑥) { { {𝜓} } } ⊨ { { {𝜙} } } 𝑎 <$ uniform 𝐴 ; 𝑐 0 𝑎 ∼ 𝑏 <$ uniform 𝐵 ; 𝑐 1 𝑏 { { {𝜓} } } uniform The uniform rule relates sampling from uniform distributions on finite sets 𝐴 and 𝐵 that are in a bijective correspondence. Note how it applies the bijection 𝑓 in the continuation on the right-hand side. 𝐷 : Op 𝑥 ∈ |𝐷 | 𝐷 (𝑥) = 1 ⊨ { { {𝜙} } } 𝑐 0 ∼ 𝑐 1 { { {𝜓} } } 𝑦 ∉ freevar(𝑐 0 ) ⊨ { { {𝜙} } } 𝑦 <$ 𝐷 ; 𝑐 0 ∼ 𝑐 1 { { {𝜓} } } dead-sample The code 𝑦 <$ 𝐷 ; 𝑐 0 samples 𝑦 from the subdistribution 𝐷.
Several put operations are performed, until one can show that the invariant is preserved by all these memory updates. More generally, we define handy tactics to apply these rules immediately, as well as performing the necessary massaging of goals so that they become applicable. As such we have automation for swapping multiple lines at once and checking that the swap was legal. Moreover, these tactics rely on the hints mechanism of Coq and can thus be extended by the user. Organization of the relational program logics rules. The rules of the relational program logic are not canonically derived but a few guidelines have been used to come up with them. These guidelines follow three independent criteria: the algebraic criterion, the historical criterion, and the practical criterion. The algebraic criterion follows the idea that the effects employed in the programming language can be modeled using algebraic structures, e.
g. , monads, and rules corresponding to the standard combinators of this algebraic presentation can be naturally expressed  [70]. In particular, equationally presented monads such as the state monad, the exception monad or the Giry probability monad  [58, 80]  naturally induce reasoning rules corresponding to their equational theory  [57]. The algebraic approach, however, falls short of providing a complete solution accounting for the distinction between one-sided and two-sided rules specific to a particular effect-e. g. , rules for get and set when considering the state monad. For these rules, the historical presentation follows earlier work on (x)pRHL  [22, 26] , providing both one-sided and two-sided rules. Finally, the pragmatics of proving relational properties of programs in SSProve pushed for specific presentations of the rules, well tailored to streamlined applications in practice, in particular when considering the specifics of the Coq hosting environment, such as tactic language and incremental proof derivation through interactive use of existential variables and subgoals generation.
The redundancy between rules created by these different approaches to relational program logic rules' design is not an issue in practice, since each of these rules is proved against the semantic model presented in §5 rather than assumed axiomatically. The question of completeness of the rules is somehow side-stepped in our setting by having an escape hatch using the relational semantics: in any case, if the rules we provide are not suitable to prove a particular judgment, one can always fall back to the underlying semantic model and prove an additional valid rule at that level. Ultimately, we validate the design of the rules present in SSProve via case studies, ensuring that the chosen set of rules are indeed enough to obtain concrete interesting results.
This invariance of the predicate is the reason why 𝜓 appears both as a pre-and postcondition in Theorem 2. 4. Notice that stable predicates do not impose conditions on the intermediate states of each procedure in the interface of Theorem 2. 4, e. g. two related procedures may differ in their internal order of updates, as long as the final results of computations are related. Before giving the proof sketch for Theorem 2. 4, we state a theorem that is also proved in Coq and relates the probabilistic relational program logic with the probabilistic semantics. Theorem 4. 1. Given values 𝑎, 𝑏, if two pieces of code 𝑐 0 , 𝑐 1 are such that ⊨ { { {𝜓} } } 𝑐 0 ∼ 𝑐 1 { { {𝜙} } }, 𝜓 holds on the initial memories, and for all 𝑚 ′ 0 , 𝑚 ′ 1 , 𝑥 and 𝑦 we have that 𝜙 (𝑚 ′ 0 , 𝑥) (𝑚 ′ 1 , 𝑦) =⇒ (𝑥 = 𝑎 ⇐⇒ 𝑦 = 𝑏) , then we have Pr[𝑎 ← 𝑐 0 ] = Pr[𝑏 ← 𝑐 1 ].
Comparing approaches to semantic models for relational program logics We use the semantic framework of Maillard et al. [70]  based on effect observations to obtain a formal and foundational approach to relational program logics for cryptographic code. In this section, we compare this methodology to other approaches for modelling relational program logics. The Foundational Cryptography Framework (FCF)  [78]  develops machine-checked proofs of cryptographic code in the Coq proof assistant. Computations are modelled as elements of a free monad, then interpreted as distributions. This denotational model is subsequently used to derive a program logics using couplings. The approach we take is similar, but we paid special attention to the intermediate monadic structures involved. For instance, FCF distinguishes the type of simple computations Comp 𝑅 with result value in 𝑅 from the type of computations with access to some oracle OracleComp 𝐼 𝑂 𝑅.
The latter provides operations to query an oracle with a given value in 𝐼 and obtain results in 𝑂 of an oracle call that are not found in simple computations. We rely on the genericity of free monads at the level of packages to encode both the simple computations and computations with oracles in a single uniform type of code, using the parameterized operations to provide oracle queries for instance. State passing is done explicitly in FCF, while we prefer a more abstract presentation using a state monad transformer. As a result, we obtain a conceptually comfortable decomposition of our computational monads and specifications, at the price of additional work to define the few components that we need for verification of cryptographic code. Although the implementation of EasyCrypt does not have a proper foundational backend per se, many rules of its probabilistic relational Hoare logic (pRHL) were proved sound in Coq in a project called XHL with respect to a model  [94] , parts of which have been merged into mathcomp-analysis  [4].
4). Note that although the definition of the semantic judgment ⊨ 𝜃 Pr,St 𝑐 0 ∼ 𝑐 1 { 𝑤 } can seem abstract at first, it ultimately reduces to a direct formulation equivalent to the one underlying XHL. CertiCrypt is a predecessor of EasyCrypt embedded directly in Coq and our foundational approach is closer in spirit to CertiCrypt than to its successor. CertiCrypt's Coq code employs an elaborate definition of probabilistic Relational Hoare Logic judgments in terms of approximate couplings, based on the ALEA library  [13, 77] , which directly offers support for bounding the distance between the distributions of two probabilistic programs. It also features a memory model distinguishing between local and global variables, providing the ability to give a direct semantics for first-order procedure calls with local state in the form of "stack frames".
4, i. e. , we show they define equivalent procedures using an appropriate invariant. We detail the invariant and the code comparisons in Appendix A. We now proceed with rest of the proof of Theorem 6. 2. Since PKE-CCA 𝑏 is perfectly indistinguishable from AUX 𝑏 , the inequality  (7)  simplifies to 𝛼 (PKE-CCA 01 ) (A) ≤ 𝛼 (MOD-CCA • (KEM 0 ∥ DEM 0 ) • KEY, MOD-CCA • (KEM 0 ∥ DEM 1 ) • KEY) (A). (8) Using Lemma 2. 3 we replace the right-hand side to derive 𝛼 (PKE-CCA 01 ) (A) ≤ 𝛼 ((KEM 0 ∥ DEM 0 ) • KEY, (KEM 0 ∥ DEM 1 ) • KEY) (A • MOD-CCA). (9) This (right-hand) upper bound corresponds to an instance of the left-hand side of the second inequality of Lemma 6. 1 using A • MOD-CCA as distinguisher, meaning we have the inequality 𝛼 ((KEM 0 ∥ DEM 0 ) • KEY, (KEM 0 ∥ DEM 1 ) • KEY) (A • MOD-CCA) ≤ 𝛼 (KEM-CCA 01 ) (A • MOD-CCA • (ID export(KEM) ∥ DEM 0 )) + 𝛼 (DEM-CCA 01 ) (A • MOD-CCA • (KEM 1 ∥ ID export(DEM) )) + 𝛼 (KEM-CCA 01 ) (A • MOD-CCA • (ID export(KEM) ∥ DEM 1 )).
We formalize the result in SSProve to experiment with leveraging the package laws to build one protocol from another, and compare this result with the construction in CryptHOL in Section 7. 2. 1. The key component of this transformation is the COM package shown in Figure  29. Here, COM is parameterized by the SIGMA scheme. Moreover, COM is meant to be composed with the KEY package, which is responsible for distributing the public and secret keys between the parties, and as such imports Init and Get. The KEY package is shown in Figure  28. Note that the KEY package contains the signing key. We use the KEY package because we need to sample a commitment key which fits the relation of the Σ-protocol without revealing the underlying witness used. Without this package (1) Commit, which uses the public and secret parts of the relation to produce a commitment to the challenge 𝑒.
Simulate (h , m) return (c , o) Ver (c , m , o): h ← Get () v ← Σ. Verify (h , c , m , o) return v Proof of Theorem 7. 4. The HIDE package is introduced in Figure  30. First, let D = A • (ID 𝑒𝑥𝑝𝑜𝑟𝑡𝑠 (HIDE) ∥ KEY). Applying Lemma 2. 2 we obtain: 𝛼 ((HIDE 0 • COM • KEY), (HIDE 1 • COM • KEY)) (D) ≤ 𝛼 ((HIDE 0 • COM • KEY), HIDE 0 • AUX • SHVZK 1 ) (D) + 𝛼 (HIDE 0 • AUX • SHVZK 1 , HIDE 0 • AUX • SHVZK 0 ) (D) + 𝛼 (HIDE 0 • AUX • SHVZK 0 , HIDE 1 • AUX • SHVZK 0 ) (D) + 𝛼 (HIDE 1 • AUX • SHVZK 0 , HIDE 1 • AUX • SHVZK 1 ) (D) + 𝛼 (HIDE 1 • AUX • SHVZK 1 , (HIDE 1 • COM • KEY)) (D) The advantage of moving to and from the AUX package is 0, since AUX consists of COM where the KEY package inlined and the simulator is replaced with calls to the SHVZK package. By Lemma 2. 3: 𝛼 (HIDE 0 • AUX • SHVZK 1 , HIDE 0 • AUX • SHVZK 0 ) (D) = 𝛼 (SHVZK 1 , SHVZK 0 ) (D • HIDE 0 • AUX).
Because our results  hold for any SIGMA package, we obtain a more general notion of security for the hiding property in Theorem 7. 4, where the security bound is directly related to the security of the underlying Σ-protocol. The imperfect game hops are justified by the package theorems of SSProve, which can be seen in the proof of Theorem 7. 4. In particular, this allows us to accumulate the advantage from our game-hops into our final security bound, whatever the respective intermediate advantages may be. Without the ability to reason about the advantage of composed packages, the proof would have had to involve significantly more steps, or make the same assumptions as in  [42]. Namely, if we adopt the same assumption, then the proof of the security bounds can be done entirely within the relational logic itself.
𝛼 ((HIDE 0 • COM • KEY) ∥ KEY, (HIDE 1 • COM • KEY) ∥ KEY) (A) ≤ 𝛼 ((HIDE 0 • AUX • SHVZK 0 ) ∥ KEY, (HIDE 1 • AUX • SHVZK 1 ) ∥ KEY) (A) To finish the proof we show that HIDE 0 • AUX • SHVZK 0 and HIDE 1 • AUX • SHVZK 0 are perfectly indistinguishable using Theorem 2. 4. After inlining package composition and simplification of the if-statement we end up with the code comparison found in Table  3. Because both sides use COM to store the value of e we cannot use equality of heaps as the invariant since the two sides store different values. Instead, we rely on the equality of heaps on all locations except the location of e. With the invariant fixed we now show equivalence between the two programs. Looking at Table  3 , we observe that the random sampling of e in the right-hand program has no counterpart on the left side.
RELATED WORK SSProve is the first verification framework for SSP, yet the formal verification of cryptographic proofs in other styles has been intensely investigated  [15]. In this section we survey the closest related work in this space. CertiCrypt  [26]  is a foundational Coq framework for game-based cryptographic proofs. Cer-tiCrypt does not support modular proofs and is no longer maintained, yet it is seminal work that has inspired many other tools in this space, such as EasyCrypt, FCF, etc. The logic we introduce in §4 is also inspired by the probabilistic relational Hoare logic at the core of CertiCrypt. FCF  [78]  is a more recent foundational Coq framework for cryptographic proofs that was used to verify the HMAC implementations in OpenSSL  [31]  and mbedTLS  [98]. In contrast to CertiCrypt's (and EasyCrypt's) deep embedding of a probabilistic While language, FCF represents code with finite probabilities and non-termination using a monadic embedding, similar to the free monad we use for code in §3.
1. The advantage of such an embedding is that code can be both easily manipulated as a syntactic object (e. g. , to define package composition in §3. 1) and easily lifted to a probability monad when needed ( §3. 2 and §5. 2), all without leaving Gallina, the internal language of Coq. This monadic representation of computational effects could also allow a more modular treatment of programs exhibiting effects of different nature such as communications with an external process  [70]. Building a formalization of SSP on top of FCF may also be possible in principle though, and maybe even more interesting in practice could be rebasing SSProve on a simpler but less modular semantic model in the style of FCF or XHL  [94]  (as discussed in §5. 5). EasyCrypt  [21, 24]  is a proof assistant and verification tool specifically designed for gamebased cryptographic proofs and built from scratch.
EasyCrypt also comes with an ML-style module system  [16] , as well as other abstraction mechanisms such as "theories". The default way of mechanizing proofs in EasyCrypt is, however, quite different than that of SSP. The EasyCrypt abstraction mechanisms were designed for allowing reuse of code and theorems  [21] , but they are rarely used at the moment to provide a modular high-level structure to cryptographic reduction proofs in the style of SSP  [52]. In concurrent work, Dupressoir et al. [52]  show that they can mechanize in EasyCrypt an SSPstyle multi-instance security proof for the Cryptobox  [32]  KEM-DEM  [48]  construction, and they discuss the various trade-offs they had to navigate and the strengths and shortcomings of EasyCrypt for formalizing such SSP-style proofs. Their multi-instance setting comes with specific challenges that do not appear in our mechanized proof from §6, such as the adversarial ability to create corrupt key instances.
Yet despite the different setting, the high-level structure of the proofs seems similar to us. Beyond this case study, we focus on providing a general framework for SSP proofs, including formal definitions of SSP packages, their composition, and the corresponding algebraic laws. Dupressoir et al. [52]  show instead informally, in the context of their example, how SSP concepts can be mapped to existing features in EasyCrypt. In particular, games are mapped to modules, and packages with imports are mapped to ML-style functors  [75] , i. e. , modules parameterized by other modules. Modules and functors are not fully first class in EasyCrypt though: while it is possible to quantify over modules, formulas cannot talk about module equality  [93]. As a result, SSP-style laws cannot be stated or proven, and one has to manually write down all the functors involved in the proof, and argue about equality of the individual procedures instead.
SSP also has a notion of parameterized packages, in particular packages parameterized by crypto schemes or multi-instance packages  [40, Section 5]. For the former, in SSProve we can easily parametrize packages over parameters like crypto schemes using the expressive abstraction mechanisms of Coq's functional programming language, such as functions returning packages. Dupressoir et al. achieve something similar using the module-level abstraction mechanisms of EasyCrypt, choosing between functors and theories on a case by case basis  [52, pg. 7]. The lattermulti-instance packages in SSP-are regular packages for which the names of the procedures (defined or used by the package) are indexed by natural numbers. To support multi-instance packages in SSProve a small technical change is needed: we can parametrize both the packages' memory locations and procedure names by an offset in order to make each instance distinct, which some of the authors have already tried out in ongoing work on formally connecting SSProve and Jasmin  [5, 60].
By contrast, Dupressoir et al. [52]  represent a multi-instance package as a single regular module (or functor) in EasyCrypt, having as state a map from instance indices to the actual state of each instance, and where the procedures also take an explicit instance index as argument. SSProve gives the assert operation from SSP a simple and clearly defined semantics: assertion failure samples from the empty probability subdistribution (the same as entering an infinite loop in EasyCrypt). While this is not the only choice  [29] , this formalizes our understanding of the following informal convention from the paper introducing SSP  [40] : "all our definitions and theorems apply only to code that never violates assertions. " By contrast, Dupressoir et al. [52] , manually encode a different, "oracle silencing" semantics for assertion failures  [84]  in their case study, but without formally providing an assert construct, which seems non-trivial to formalize for their semantics.
A detailed comparison between the HOL-systems and systems like Coq based on dependent type theory is out of scope for the present paper. We merely observe that huge formalizations have been carried out in both traditions. On the narrow topic of SMT-based automation, we mention this is also being developed for Coq  [12, 49] , and any progress on those projects could also profit SSProve. Another key part of the automation in EasyCrypt is the auto tactic, which tries a to apply rules of the program logic based on the structure of the code. We have a similar tactic in SSProve, which moreover, is easily extensible due to Coq's tactic language. IPDL  [56]  is another recent Coq framework for cryptographic proofs. Although their motivation is similar to SSP and their interaction sets are reminiscent of packages, the relation of IPDL to other composable frameworks has not been worked out, and is out of scope for the current paper.
FUTURE WORK The high-level proofs done on paper in the miTLS project  [33, 34, 39, 55]  were the main inspiration for the SSP methodology and it would be an interesting challenge to scale SSProve to mechanizing such large security proofs in the future. This would for a start require more work on proof engineering and automation, as well as implementing a unary logic for reasoning about the probabilities of bad events  [23, 26]. The problem of verifying such large proofs all the way down to low-level efficient executable code is even more challenging, also given the large scale of a complete implementation for a protocol like TLS. Achieving this in Coq would probably require integrating with projects such as Jasmin  [5, 7] , VST  [11] , or FiatCrypto  [53]. Some of the authors have in fact been working on integrating SSProve with Jasmin  [5, 7]  by defining a translation from the Coq representation of Jasmin programs to SSProve programs, while provably preserving semantics  [60].
This allows them to formally connect in Coq security proofs in SSProve to the assembly code produced by the Jasmin verified compiler. An alternative would be to port SSProve to F ★  [95] , where at least functional correctness can be verified at that scale. Still many challenges would remain, including extending F ★ to probabilistic verification, giving F ★ modules first-class status, and extending the SSP methodology to support type abstraction and procedures with specifications. An interesting step in this direction is the preliminary work of Kohbrok et al. [64] , who have implemented vanilla SSP packages in F ★ and attempted to automate state-separating proofs based on a library for partial setoids. Finally, our formalization of Σ-protocols has been used recently to prove the security of the OpenVoteNetwork smart contract  [91].
ACKNOWLEDGMENTS We are grateful to  Arthur Azevedo de Amorim  for his technical support and to  Théo Laurent ,  Sabine Oechsner , and  Ramkumar Ramachandra  for participating in stimulating discussions. We are also grateful to  Markulf Kohlweiss  for pointing out a bug in our modelling of public-key encryption schemes in the ElGamal example, which we quickly fixed as discussed in §2. 4. We also thank  Brzuska et  al. for their prompt fix of the informal proof of security for KEM-DEM [40] which allowed us to complete our formalization. Finally we are also very grateful to the anonymous reviewers of CSF and TOPLAS for their detailed and helpful feedback. This work was in part supported by.
Benthic diatoms are unicellular microalgae that are routinely used as bioindicators for monitoring the ecological status of freshwater. Their identification using light microscopy is a time-consuming and labor-intensive task that could be automated using deep-learning. However, training such networks relies on the availability of labelled datasets, which are difficult to obtain for these organisms. Herein, we propose a method to generate synthetic microscopy images for training. We gathered individual objects, i. e. 9230 diatoms from publicly available taxonomic guides and 600 items of debris from available real images. We collated a comprehensive dataset of synthetic microscopy images including both diatoms and debris using seamless blending and a combination of parameters such as image scaling, rotation, overlap and diatom-debris ratio.
We then performed sensitivity analysis of the impact of the synthetic data parameters for training state-of-the art networks for horizontal and rotated bounding box detection (YOLOv5). We first trained the networks using the synthetic dataset and fine-tuned it to several real image datasets. Using this approach, the performance of the detection network was improved by up to 25% for precision and 23% for recall at an Intersection-over-Union(IoU) threshold of 0. 5. This method will be extended in the future for training segmentation and classification networks.
, 2019; Li et al. , 2021) , and also specifically for benthic diatoms  (Salido et al. , 2020). However, the approaches still suffer from overlapping bounding boxes when diatoms are close to each other. To overcome these difficulties, one can use rotated bounding boxes  (Li et al. , 2020; Zhong and Ao, 2020). By estimating the orientations of objects, rotated bounding boxes are fitted around objects, resulting in minimal overlaps and thus cleaner detection. Training supervised deep-learning networks requires thousands of labelled microscopy images. Most of the time, labelling is performed manually. In addition to being a time-consuming and laborious process, human intervention is also a source of error and bias  (Sager et al. , 2021). Thus, when available labelled data are limited, one can use synthetic datasets for pre-training the network before fine-tuning it with a real dataset  (Li et al.
This offers a unique opportunity for the design of a relevant pre-labelled dataset for bounding boxes, as each individual is already boxed, allowing the training of automatic detection networks. Our method for synthetic data generation closely follows Copy-Paste augmentation as implemented for instance segmentation  (Dwibedi et al. , 2017; Ghiasi et al. , 2021). In Copy-Paste augmentation, the generated images use real images as background, then images of individual objects of interest are pasted at random locations on the real images. However, while pasting, the global consistency of the final images is not considered. This means that an object could be placed at locations where they usually do not occur. This could be detrimental in the case of single-stage architectures such as YOLO, which predicts from full images and hence, takes into account the global context of the images while making predictions.