dataesr/scientific-paragraphs-categorization huggingface dataset:
Secure data history with trusted hardware The added value of blockchain technology to meet the specific features of a smart manufacturing use case has been shown in  [6]. Compared to a centralized solution based on digital certificates and PKI, the Ethereum-based solution offers a more refined management of security and privacy at the expense of performance. In  [2] , HistoTrust demonstrates that performance can meet the needs of a real-time usage when using a blockchain. The EmLog framework  [7]  is presented as "the first attempt at preserving off-the-shelf ARM development board hosting OP-TEE". EmLog implements a secure logging system from end-to-end between embedded constraint devices and a remote database. HistoTrust introduces an architecture design and an on-board implementation design using off-the-shelf secure hardware components, as OP-TEE and TPM 2.
0  [8] , that goes beyond EmLog solution and achieves the EmLog perspectives. Preserving forward security thanks to the one-way hash chain scheme introduced by Shneier and Kelsey  [9] , EmLog and SGX-Log  [10]  are not designed for multi-stakeholders contexts and may suffer of data losses in case of power failure. In the Logs system EngraveChain detailed in the paper  [11] , the data history is ciphered, then registered in an Hyperledger Fabric ledger. This implementation lacks agility because the blockchain is not designed to store large volumes of data, nor confidential data even encrypted. Moreover, the ciphering of recorded data in a ledger implies a complex key management. The blockchain technology provides by design the tamper-resistance of the recorded transactions history forming the ledger.
HistoTrust provides an attestation scheme securing the history of data issued from distributed devices. An Ethereum ledger maintains the history of cryptographic attestations of data produced by distributed devices owned by multiple stakeholders. The blockchain technology allows to share these cryptographic evidences between the stakeholders, ensuring mutual trust. In addition, the raw data is kept by its owner who ensures its persistence and confidentiality. Based on an Ethereum blockchain, BlockPro  [12]  presents a decentralized architecture of IoT devices. The authenticity of the data-emitting devices is achieved through a challenge to the IoT device submitted to its PUF (Physical Unclonable Function). But it is not mentioned how the address of the account issuing the transactions is built and how it is linked to the PUF.
Digit recognition Smart robots are often equipped with cameras that allow them to photograph the part of the product on which they  will operate. The image is then analyzed, potentially with a classifier, and depending on the patterns recognized, the action is determined. For this work, we use a classical digit recognition task with the MNIST dataset  [18]  as it represents one of the most popular benchmarks in the ML literature with which many architectures can be tested (from shallow fully-connected networks to deeper convolutional NN). MNIST is composed of 60,000 training images of grayscale handwritten digits and 10,000 examples for test. Each sample is a grayscale 28x28 image (784 pixels) with the associated label "0" from "9". This dataset offers a school case with a known and qualified open-source model.
Neural network Two different architectures of model working on MNIST dataset have been used, a MLP and a CNN. Both needed to be small to fit hardware material limitations. As such, MLP is composed of an input (784 points due to the fact that the images must be flattened to be used ) and an output layer (10 neurons corresponding to number of label). This model has only 7850 trainable parameters which makes it a quite small model compared to others doing same task with additional intermediate hidden layers. However, model accuracy is just below 92%. Despite that state-ofthe-art MLP model can reach higher accuracy on MNIST classification, this accuracy remains acceptable in light of model reduced architecture. On the other hand, a CNN is also considered. This kind of model is divided in two parts with distinct goals.
Learning In order to implement deep NN models on microcontrollers such as STM32, we previously generate the model with Google Tensorflow  [20]. The model architecture (number of neurons, layers, used activation functions) is created according to the target specification, an ARM Cortex-M4. Then, an empty model is trained with labelled data corresponding to the task to perform, the digit recognition, following a supervised learning paradigm. Validation and test of the dataset complete the training. The validation adjusts the hyper-parameters value and distinguish overfitting. The test qualifies the model performance with examples that have not been seen during the training phase. This allows the simulation of real model behavior while having ground-truth class for each example of the dataset.
Attestations to ledger The attestation scheme follows the 3 phases depicted in Fig. 4:  1. The secrets and the trusted applications (apps) are provisioned in the embedded device by the device's owner in its private office. Once the secrets protected by secure hardware, the device is delivered to the factory. 2. On the factory floor, during the execution, the device is supervised by an operator. It produces data attested by a trusted app to a distributed ledger. 3. Any stakeholder may perform the verification of the authenticity of the involved devices, thanks to the information registered in the shared ledger, available to all. An accredited and independent auditor may also verify the tamper-resistance of the data produced.
Provisioning of the trusted apps The Ethereum technology requires that the incoming transactions are signed with a private key of the elliptic curve family secp256k1. However, this asymmetric cryptosystem is not supported by the TPM 2. 0 standard and is not integrated in the TPM crypto-accelerator. That's why, for HistoTrust, the cryptographic functions, dedicated to the compliance with Ethereum technology, are implemented in TrustZone of an ARM microcontroller. Two trusted apps are developed in HistoTrust: • industrial app: This application is the "business" application as it realizes the task required. It produces digital data that may be a huge value. • attestation app: This application builds the cryptographic elements included in the transactions sent to the Ethereum blockchain to attest the data produced.
Attestation of the data produced During the production phase, the cryptographic attestations are registered in Ethereum ledger through a smart contract. The attestation process, detailed in Fig. 5 , consists in computing the fingerprint of the latter dataset produced, which is included in the data field of an Ethereum transaction (Fig. 12 ). This transaction is signed in the TrustZone with sk which is also used to build the account address of the issuer device. To achieve the signature, the private key sk c is accessed in the TPM permanent memory through the SPI bus and is deciphered in the TrustZone. The signed transaction is sent to the blockchain and a receipt is returned if the registration in the ledger is confirmed. The implementation of this attestation process is tricky because it must respect both temporal constraints and the real-time of the industrial app that produces new data.
Verification The attestation history is available in the shared ledger and transparent to all stakeholders. It does not include confidential information, only cryptographic attestations enabling the verification. Each record is a transaction signed with sk, emitted from the account of the issuing device, and sent to the smart contract. It includes the fingerprint of the attested dataset. Two types of verifiers are distinguished: • involved stakeholder: any actor is able to access the information present in the shared ledger. The registered attestations enable to authenticate the acting devices and their owner in a given time interval. • independent auditor: an independent auditor, such as an insurance expert or a bailiff, may be accredited to request the raw data, to the authenticated device's owner, from the information registered in the shared ledger.
Integration The integration consists to make the industrial app and the attestation app working together in the SoM as depicted in Fig. 5 , while respecting the real-time constraint of the industrial app. The industrial app is embedded in the normal world operating on a linux kernel as rich OS of the ARM Cortex-A7, with a part including the NN insulated in the ARM Cortex-M4. It handles the pictures coming from the attached camera in the ARM Cortex-A7. The pictures are transmitted to the NN in the ARM Cortex-M4, to request an inference. As output, the NN provides 10 heuristics, one by digit from "0" to "9". The heuristics are carried to the ARM Cortex-A7. Generally, the recognized digit corresponds to the highest probability. The communication protocol between the ARM Cortex-A7 and the ARM Cortex-M4 microcontrollers is suggested by STMicroelectronics in  [21].
[index timestamp url hash inf erence] The field url is a pointer to the raw data in entry of the NN, while the field hash is the hash of the raw data. The field inference is composed of the 10 values of heuristic, one for each digit from "0" to "9". Each heuristic is a floating value coding a probability between 0 and 1. The industrial app writes in real-time in the file #1 all the data produced that needs to be attested. The size of this buffer is not limited, as it is stored on an SD card of several GB. Only the industrial app is authorized to write in this file, while attestation app is authorized to read it. The receipt received from the blockchain confirms the registration of the attestation of the previous dataset in the ledger. This receipt triggers the read of the next dataset in the file #1.
Deployment All the devices are distributed on a local network following a star topology around an access point. A proxy allows the communication with the outside to enable raw data ex-filtration. A consortium Ethereum blockchain is locally deployed. Each stakeholder of the use case owns a validator node with a complete copy of the ledger, and has one vote in the consensus protocol. The validator nodes are depicted with a computer in Fig. 6. Thus, the governance of the system is ensured with equity and fairness by all the stakeholders. The devices acting in the production line, are provided with the embedded apps, enabling to send transactions to the validator nodes. Thus, each device is the root-oftrust of the data it produces, forming a distributed rootof-trust network. The provisioning is done, independently by each device's owner, prior to the deployment of the hardware in the factory.
Performances The blockchain is a time-stamping system consisting of a sequence of blocks spaced out in time. The recording of new transactions in the ledger is performed at low rate. We want to show that with our implementation of HistoTrust, the security and privacy properties brought thanks to the use of the blockchain have no impact on the industrial process flow and on the rate of inferences of the embedded NN. To carry out the performance measurements, we consider the processing time of a transaction and its recording in the ledger by using the Ethereum Ganache simulator configured in automining, i. e. , the transaction is recorded as soon as it arrives, without any latency due to the consensus protocol between the network validator nodes. The processing time of a transaction from the computing of the hash of the dataset to the receipt of the registration proof is estimated at 156ms.
Security and privacy review R1: AI explainability. Explaining the behavior of an AI requires measures to be implemented at the design stage. The blockchain technology provides obviously and by design the property of traceability. However, the blockchain does not manage the confidentiality of the traced data. This is why HistoTrust proposes a scheme combining the use of a blockchain to transparently guarantee the properties of immutability, authenticity and ordering, and the use of private storage of raw data, under the responsibility of their owner. R2: forward integrity. The blockchain ensures by design the forward integrity of the information recorded in the ledger. The ledger maintains the history of cryptographic attestations, each one being a pointer to a raw dataset stored outside the blockchain.
Thus, any tampering or removal of raw data is detectable. R3: public authentication. The recorded attestation authenticates the device issuer, and all genuine devices are endorsed by their owner. The consultation of the ledger allows any stakeholder to know the devices acting in a given time interval, and the order of the performed actions. R4: power failure. Resilience when a power failure occurs implies that no raw data or cryptographic attestations are lost. The use of a file buffer stored in permanent memory ensures data persistence in case of power failure. R5: privacy-preserving data. This requirement covers raw data at storage and during transportation. The physical protection of the device in the factory makes access to the board peripherals difficult and detectable. The ex-filtration of the raw data is performed through VPN.
Traceability of the events The blockchain provides an immutable history, shared among all stakeholders, of all past events. Figures 10 and 11  Each block includes a tree of recorded transactions, as shown in Fig. 12. The sender address authenticates the issuer device, while the contract address authenticates the recipient smart contract. The field data includes the fingerprint of the raw dataset produced by the issuing device at the given time, whereas the field gas indicates the computing power required to execute the targeted smart contract in the blockchain. This value is an indicator of the energy consumed to execute an instance of the smart contract. Until the request of personal data, any stakeholder member of the ecosystem can achieve the verification. The first step consists to get the recorded attestations of the considered time interval in the shared ledger.
Conclusion This paper introduces HistoTrust, a robust scheme using TEE and TPM secure components to trace the behavior of embedded AI. It begins with the challenge of embedding a learnt NN in an ARM Cortex-M4 microcontroller. Next, based on an attestation scheme to an Ethereum ledger, an embedded design is proposed to secure the NN, ensure its robustness and enable the explainability of its behavior. Then, several devices, following a distributed architecture, are deployed around a blockchain. The security analysis and the audit process provide verification tools that brings trust and fairness between the stakeholders involved in the use case. In future work, the preservation of data privacy will be deepened, and some cryptographic process will be ported to the TPM.
Our main contributions are: 1) We designed a primal-dual network based on the idea of deep unfolding, and compared it with state-of-the-art DL segmentation methods and DeAN. 2) We used a private color Doppler echocardiographic dataset acquired in apical three-chamber view (45 patients, 1,338 aliased and 2,379 non-aliased frames) to train the neural networks and analyze their performance. 3) We investigated the value of adding Doppler power as input information to improve dealiasing. 4) We introduced a data augmentation strategy that generates synthetic aliasing, which solved the class imbalance problem and improved dealiasing performance on difficult color Doppler images.
a deep unfolding network based on a primal-dual optimization scheme  [13]. Given a general inverse problem aiming to obtain the solution f from the measurement g with the forward operator K: g = K(f ), (5) the outline of OriPDNet to solve this problem is presented in Algorithm 1. Algorithm 1 OriPDNet: Original primal-dual network Initialize f 0 , h 0 = [0, 0, 0, 0, 0] ∈ R M ×N ×5 for i = 1, • • • , I do h i ← Γ θ d i (h i-1 , K(f (2) i-1 ), g) f i ← Λ θ p i (f i-1 , [∂K(f (1) i-1 )] * (h i )) end for return f (1) I OriPDNet involves several variables and operators, including the forward operator K, the adjoint of its Fréchet derivative [∂K] * , the input measured data g, the primal and dual variables f i and h i , and the learned primal and dual proximal operators Λ θ p i and Γ θ d i. Convolutional layers are used to learn these proximal operators.
C. Segmentation Networks for Color Doppler Dealiasing nnU-Net is currently one of the best performing approaches for medical image segmentation  [15]. This model is based on the U-Net architecture and implements several successful DL tricks, such as automatic hyperparameter search of the U-Net architecture to increase accuracy, a patch-wise approach to preserve image resolution, a deep supervision strategy to maintain accuracy at all scales, and data augmentation during both training and inference to enforce generalization. In this study, we addressed the dealiasing of color Doppler as a 3class segmentation problem with nnU-Net, where each class corresponded to a Nyquist number n N ∈ {-1, 0, 1}. Our network included four stages in the encoder/decoder parts and had an input size of 192 × 40 pixels, which was the median image size of our dataset.
D. Input Data Strategy Color Doppler echocardiography produces two types of information: i) Doppler velocity, which can be corrupted by aliasing in regions of high blood speed, and ii) Doppler power, which provides insight into the regions where velocity measurements are reliable. Using both Doppler power and velocity as input to DL models allowed them to learn how to limit the dealiasing process in regions of interest and identify ambiguous areas. Therefore, we performed an ablation study to evaluate the potential improvement provided by Doppler power. This study was conducted using the nnU-Net architecture, known for its stability in training and optimal configurations. Specifically, three nnU-Net models were trained with three combinations of input data: 1) nnU-Net #1 trained with Doppler velocity only, 2) nnU-Net #2 trained with the concatenation of Doppler velocity with Doppler power, and 3) nnU-Net #3 trained with the multiplication of Doppler velocity by Doppler power.
E. Artificial Aliasing Augmentation Strategy Color Doppler images may exhibit aliasing only in localized regions or frames, resulting in datasets that are often imbalanced, with most pixels belonging to the background class (i. e. , without aliasing). To address this issue, we used standard data augmentation techniques such as rotation, flipping etc. , during training. We also proposed an additional data augmentation technique, which we called artificial aliasing augmentation, to improve the generalizability of our algorithms. This technique involved identifying regions with high Doppler velocity and power on alias-free Doppler images, and applying a wrapping function defined by (3) with a lower Nyquist velocity to create artificial aliasing artifacts, followed by a normalization. The ground-truth references of these artificially aliased frames were created on the fly by comparing the Doppler velocities before and after this augmentation.
The first classification metric was the balanced accuracy score, which is more suitable for unbalanced datasets than the classical accuracy score. It was calculated using the following formula: Accuracy = 1 2 × TP TP + FN + TN TN + FP ( 7 ) where TP, FN, TN and FP refer to true positives, false negatives, true negatives, and false positives, respectively. Besides, the classical recall ( TP TP+FN ) and precision ( TP TP+FP ) metrics were also computed to evaluate the overall performance of the methods. To ensure the reliability and relevance of the results, we conducted a 9-fold cross-validation to compute the scores presented in each table in Section III-B. For each fold, we split the dataset into training, validation, and test sets using a ratio of 36/4/5 patients. This resulted in an average of 2,974, 330, and 413 color Doppler frames for the training, validation, and test sets, respectively.
A. Dataset and Training Strategies 1) Color Doppler dataset: To evaluate the performance of our methods, we used a color Doppler echocardiographic dataset of 45 patients that were acquired using a Vivid 7 ultrasound system (GE Healthcare, USA) and a GE 5S cardiac sector probe (bandwidth = 2-5 MHz). Doppler velocity and power data prior to scan conversion were extracted into HDF formats using EchoPAC software (GE Healthcare). The EchoPAC software returned unitless power data in the range of 1-100. The power data, P , were compressed by taking the logarithm and then scaled to [0,1]: log(P )/2 ← P. The cardiologist used the default settings (center frequency, pulse length, pulse repetition frequency, packet size, clutter filter, etc. ). These proprietary parameters are masked and could not be extracted.
In most cases, the Nyquist velocity was about 0. 6 m/s. Assuming a center frequency of 3 MHz, the pulse repetition frequency was approximately 4500 Hz. These anonymized data came from a previous published study  [18]. The patients were examined in the echocardiography laboratory under standard medical conditions. As a result, some patients had significant heart disease, while others had no visible pathology. The random selection of patients and their anonymization prevent us from knowing their demographic and pathological status. The sequences were acquired in the apical three-chamber view and included both Doppler velocity and power information. Each sequence covered at least one complete cardiac cycle, resulting in a total of 1,338 aliased frames and 2,379 non-aliased frames. Since color Doppler has a relatively low frame rate of 10 to 15 frames per second in clinical echocardiography, we considered each frame to be independent.
2) Training strategies: To train the deep learning (DL) methods described in Section II, we performed supervised learning using the ground-truth segmentations from our inhouse dataset. Besides applying the data augmentation strategies mentioned in Section II-E, we further addressed the class imbalance of our dataset by ensuring that each batch contained at least one aliased image, whether real or synthetic. The BATFormer model was designed using the official implementation proposed in its GitHub repository  1. This model took color Doppler images resized to 256 × 256 pixels as input and was trained for 400 epochs. On the other hand, nnU-Net and PDNet were implemented using the ASCENT framework  2. For these two approaches, we used a patch-wise approach to preserve the resolution of the input data.
B. Experimental Results 1) Doppler power information was useful in dealiasing difficult case: Table  II  reports the results of the ablation study aimed at identifying the optimal combination of input data. The results indicate that the three nnU-Net models performed similarly across all metrics, implying that incorporating Doppler power information in the input data did not substantially improve the models' performance. However, upon evaluation on a challenging test set (right part of Table  II ), the model that was trained with the multiplication of Doppler velocity and Doppler power (nnU-Net #3) demonstrated better performance for all metrics except precision. The last two columns of Fig. 4  show two samples taken from the difficult fold, where the aliased and non-aliased regions had similar hues.