dataesr/scientific-paragraphs-categorization huggingface dataset:
Zhang et al. [139]  argued that DNN interpretations were vulnerable to adversarial attacks. They defined adversarial attacks as Adv 2 , which disrupted both the DNN and its interpretation, and succeeded in deliberately designating a prediction and its interpretation. Thus, they could generate adversarial samples, the predictions of which were interpreted as benign samples. Notably, the DNN and its interpretation are nonlinear, which allows an attacker to exploit both. Finally, they explored the possible countermeasures to handle these attacks. They mathematically proved the effectiveness of their proposal, and demonstrated it through experiments performed on the ImageNet  [25]  and ISIC 2018 challenge dataset  [21].
The authors called for further studies on the tradeoff between explicability and privacy. Shokri et al. [113] investigated how explainability, in addition to model predictions, contributed to performing membership inference attack, i. e. , inferring whether a particular data point was present in the training dataset. They studied several types of explainability models and found that some methods, such as perturbation-based explanations (e. g. , SmoothGrad  [119] ), were more robust than backpropagation explanations such as integrated gradient  [122] , although they produced explanation models with lower quality. They also demonstrated that an attacker could reconstruct most of the dataset from the AI model prediction and XAI results (example-based explanation method). Finally, their experiments showed that i) the correlation between explainability and membership varied with the size of the dataset and that it was easier to execute a membership attack using XAI, on high-dimensional datasets, and ii) that minority data were more likely to be revealed.
Miura et al. [84] proposed a data-free model extraction (DFME) attack called MEGEX. The objective of that study was to clone a model without the initial dataset using both the prediction and explanation of the results. The initial hypothesis for cloning a model is that if the dataset used for training is available, the model can be reproduced by requesting the prediction; however, when the dataset is unknown, methods based on generative models that generate data for requested data to the victim model can be chosen. With MEGEX, the authors used the explanation to train a generative model. They compared their method with an existing method, DFME  [127] , and evaluated the test-data accuracy of the clone model from the two methods with the CIFAR-10 [64] and SVHN [91] datasets. They achieved a better result with fewer queries to the victim model.
The XAI method considered was Grad-CAM, and experiments were performed on ImageNet. Shi et al. [112]  presented a variant of the IFGSM [68] attack, which is in turn based on FGSM  [42]. The general idea of the IFGSM is to repeatedly adjust the perturbation direction with a fixed step size. Shi et al. [112]  proposed an adaptative FGSM (Ada-FGSM) attack, where the step was dynamically adjusted to improve the performance. They compared their results with the performance of four other models; in terms of success rate and accuracy metrics, Ada-FGSM performed up to 1% better than the second-best model, IFGSM. They also used visualization techniques to follow the gradient evolution of these iterative algorithms and analyzed the results of their experiments. However, their analysis was limited to a few visual examples and was not applied to the entire dataset of their experiment.
In the second scenario, despite the attacker having full knowledge about the target system, the results showed that the proposed aggregation method was resilient against adversarial examples. In the experiments, they used VGG16  [114] , a deep CNN and the ImageNet  [26]  dataset. Although the study explored multiple explanation methods, it omitted the integrated gradient  [122]  method from the aggregation owing to its computational complexity, thereby indicating a potential scalability issue. Fenoy et al. [69]  proposed a method for evaluating the robustness of XAI algorithms against adversarial noise. They studied the effect of the FGSM adversarial attack on two XAI algorithms: Grad-CAM [108] and SIDU  [89]. These algorithms work on images, so the authors proposed to use a portion of 100 natural images from ImageNet.
However, to assess the robustness of the algorithms, the ground truth of the explanation is required. Hence, Fenoy et al. [69]  collected data from an eye tracker to create a heatmap for each image of the dataset. After collecting all data, they used Grad-CAM and SIDU to obtain a new heatmap, applied an adversarial attack (FGSM) on the data, and measured the Kullback-Leibler divergence between the eye tracker and the XAI algorithms. This method permits assessing and finding highly robust algorithms against adversarial attacks, albeit only on FGSM in Fenoy et al. 's study. A few papers focused on the mathematical proof of the robustness of XAI methods. For example, Kindermans et al. [59]  highlighted the sensitivity of saliency methods (used for XAI) to adversarial attacks. They proposed an axiom called "input variance," which states that these methods must verify to become robust.
They mathematically proved the effectiveness of their method and demonstrated it through experiments on the MNIST database. Malfa et al. [70]  developed a robust method to locally explain decisions made by NNs in NLP. They performed mathematical and experimental demonstrations of their proposal on sentiment analysis datasets. They trained fully connected NNs and CNNs for their experiments, and the results showed that the explanations could detect the words in the sentence that influenced the prediction. Attribution methods assign a score to each feature based on its contribution to the classifier's prediction. Wang et al. [134]  showed that attribution methods were vulnerable to adverse perturbations. They modeled the vulnerability of these methods in terms of the geometry of the targeted model's decision surface and formalized their robustness as a local Lipschitz condition on the mapping.
A good explanation should indicate that the reason for such misclassification is precisely the presence of this trigger. The explanation should indicate it as the region that contributed most to this misclassification. To diversify the evaluation measures, the authors considered several variations of the trigger by varying its color, size, and position in an image. They evaluated their proposal by considering several classifiers and different explainability methods on the ImageNet dataset  [103]. Hooker et al. [52]  proposed a measure of the approximate accuracy of feature importance. They highlighted the challenge of evaluating the reliability of an explanation in the absence of a ground truth. One existing technique is to remove the important features from the input and observe the decrease trend of the classifier accuracy.
However, this method has its drawbacks: it does not comply to one of the assumptions in ML that the training and evaluation data come from the same distribution. To address this issue, the authors proposed to evaluate the XAI methods by assessing the decrease trend of the accuracy of a retrained model as the important features are removed. They named this approach "remove and retrain" (ROAR). The authors also performed a large-scale experiment where they choose the model ResNet-50, six estimators of feature importance, and three renowned open-source image datasets (ImageNet  [24] , Food 101  [18] , and Birdsnap  [16] ). The results reveal that the commonly used base estimators were on par with a random assignment of importance. They concluded that their findings were pertinent to sensitive domains where the accuracy of XAI is crucial.
Privacy vs. explainability tradeoff As discussed in Section 5. 3, few papers have addressed the privacy challenges for XAI methods. Existing works have demonstrated that privacy and the design of an effective XAI method can be contradictory, and that several XAI methods can be useful but not secure. The two cases that have been explored are the "model inversion attack" and the "membership inference attack". However, Liu et al. [75]  covered several other types of privacy attacks orchestrated on AI models, such as "feature estimation attack" (learning some features from the training dataset), "model extraction attack" (learning an approximation of the model), and "model memorization attack" (retrieving the exact values of features). These attacks can also be extended to explainability methods used to interpret AI models, as indicated in  [113, 141].
Most studies on privacy in AI focused on highlighting the possible attacks rather than proposing solutions to them. Nevertheless, a few solutions indeed have been proposed, as indicated in [75], e. g. , i) encryption training data and ML model, ii) reduction of the accuracy of data and model available to an attacker using obfuscation mechanisms, such as noise addition to the output classifier and iii) use of aggregation techniques in the case of collaborative learning to keep collaborating models and datasets private. However, these methods must be adapted to the XAI context and tested to measure their effectiveness in preserving the privacy of models and data. In conclusion, XAI adds an additional layer to the attack surface of the AI pipeline; therefore, its use must be carefully considered-is it wise to use an XAI method to understand an AI model, at the risk of making the system vulnerable, or should it be dispensed with to reduce the attack surface? Thus, the choice of an XAI method offering the best compromise between explanatory quality and confidentiality is crucial.
Conclusion As with any other computer science field, Cybersecurity has been widely studied under the scope of AI. XAI is gaining momentum and might become a legal requirement for various service providers. We surveyed the existing XAI literature related to cybersecurity from two perspectives-XAI for cybersecurity tasks and security of XAI methods. From the first perspective, although the existing literature already has a considerable number of scientific papers, we found a lack of consideration for real scenarios in their approaches. We believe that meaningful scientific contributions should go beyond the application of an XAI method to a cybersecurity dataset, and attempts must be made to bridge the gap between the fields of AI and cybersecurity. From the second perspective, we divided the security issues into multiple classes and addressed the existing literature regarding the attack surface, current attack vectors, and potential countermeasures.
Marino DL, Wickramasinghe CS, Manic M (2018) An adversarial approach for explainable ai in intrusion detection systems. In: IECON 2018-44th annual conference of the IEEE industrial electronics society. IEEE, pp 3237-3243 83. Melis M et al (2022) Do gradient-based explanations tell anything about adversarial robustness to android malware?. In: International journal of machine learning and cybernetics, vol 13. 1, pp 217-232 84. Miura T, Hasegawa S, Shibahara T (2021) MEGEX: Data-free model extraction attack against gradient-based explainable AI. In: arXiv:2107. 08909 85. Molnar C (2018) A guide for making black box models explainable. In: https:// chris tophm. github. io/ inter preta ble-ml-book. Accessed 01 Aug 2022 86. MontazeriShatoori M et al (2020) Detection of doh tunnels using time-series classification of encrypted traffic.
In: 2020 IEEE intl conf on dependable, autonomic and secure computing, intl conf on pervasive intelligence and computing, intl conf on cloud and big data computing, intl conf on cyber science and technology congress (DASC/PiCom/CBDCom/CyberSciTech). IEEE, pp 63-70 87. Moustafa N (2019) New generations of internet of things datasets for cybersecurity applications based machine learning: TON IoT datasets. In: Proceedings of the eResearch Australasia Conference. Brisbane, Australia, pp 21-25 88. Moustafa N, Slay J (2015) UNSW-NB15: a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). In: 2015 military communications and information systems conference (MilCIS). IEEE, pp 1-6 89. Muddamsetty SM et al (2022) Visual explanation of black-box model: Similarity difference and uniqueness (SIDU) method.
In: arXiv:1708. 08296 105. Samek W et al (2021) Explaining deep neural networks and beyond: A review of methods and applications. In: Proceedings of the IEEE, vol 109. 3, pp 247-278 106. Sarhan M, Layeghy S, Portmann M (2021) Evaluating standard feature sets towards increased generalisability and explainability of ML-based network intrusion detection 107. Sarhan M, Layeghy S, Portmann M (2021) Towards a standard feature set for network intrusion detection system datasets. In: Mobile networks and applications, pp 1-14 108. Selvaraju RR et al (2017) Grad-cam: Visual explanations from deep networks via gradientbased localization. In: Proceedings of the IEEE international conference on computer vision, pp 618-626 109. Shahid MR, Debar H (2021) CVSSBERT: Explainable natural language processing to determine the severity of a computer security vulnerability from its description.
Instead, we propose to evaluate each strategy on the pre-trained base model. Thus, the originality and novelty of our work reside in the fact that it provides a framework for choosing the most appropriate sequence of preprocessing steps, as well as the optimal set of features to use in the ML model without high computational demands. Andrew Ng, a leading ML expert, is advertising efforts to do so by proposing a "Data-Centric Artificial Intelligence Competition"  [27] , where an initial dataset and a fixed ML model are provided to the competitors that need to improve the quality of the data by applying data-centric techniques such as handling missing values, correcting labels, or adding new features, in order to maximize the model's performance. The idea is to reverse the classical format of ML challenges where participants are asked to propose a high-performance ML model from a fixed data set.
Data Description The considered data set was provided by a global leading company in the energy sector: Energias De Portugal (EDP). The data set, containing Supervisory Control and Data Acquisition (SCADA) [31] measurements, was made available during a wind turbine competition held in 2019 by EDP, and is now open access  [32] , allowing researchers to develop and compare their PdM strategies on the same framework. The data set contains measurements from a wind farm composed of five turbines, denoted: T 01 , T 06 , T 07 , T 09 , T 11. In accordance with the state-of-the-art, the critical components that are considered for monitoring are the gearbox, generator, generator bearings, transformer and hydraulic group. Each turbine is equipped with sensors, that provide 2-years data (2016, 2017), recorded every 10 min, about generator bearing temperatures, oil temperature, pitch angle, generator rpm, etc.
• Sensors data: For each turbine, measurements such as generator speed, blade pitch angle, wind speed and direction, etc. , were recorded every 10 min. The average, standard deviation, minimum and maximum of these measurements were stored, for a total of 81 variables. Figure  2  shows one of the useful available parameter in the data set, which is the energy produced by each turbine during 2016. It is worth noticing that the quantity of energy produced by the turbine is different and that it varies from month to month. Since the wind turbines have the same characteristics (i. e. , same rated power, wind class, cut-in and cut-out wind speed, etc. ) and the same components (same characteristics for the rotor, tower, gearbox, and generator), this difference in energy production could be explained by their location in the wind farm or by the occurrence of failures.
This study focuses on the development of ARloaded Listening teaching materials. Based on the results of observations and interviews at the Mandarin language education at Universitas Negeri Malang, it was found that some students felt less interested in the learning model that used printed books provided by the school. In addition, teachers of related subjects also stated that the available learning tools were limited. This research and development use the ADDIE model. Observations and interviews were used to collect the initial data of the study. The sample of the trial subjects of this study were students of the State University of Malang. Research data collection was carried out using questionnaires and observation sheets. Based on the results of field trials, this research and development resulted in a product in the form of digital teaching materials with augmented reality (AR) content which was declared very suitable to be used as teaching materials and could be used in the learning process to foster learning activity with a percentage score of 86.
e) Evaluation stage At this stage, the evaluation process of AR teaching materials that have been developed is carried out. This is a stage to see whether the product of this teaching material is to make the product or not. The evaluation of this teaching material uses a questionnaire containing several questions that are shown to media experts, material experts, and students to meet revision needs. The revision aims to improve and refine AR teaching materials if there are errors or deficiencies so that they can meet the expected product criteria. The product trial in this study was conducted to collect data that was used as a basis in determining the feasibility of the product being developed. In this section, the things that must be considered are: (1) trial design, (2) test subjects, (3) types of data, (4) data collection instruments, and (5) data analysis.
RESULT AND DISCUSSION The data analysis technique for the activity test data is to use an observation sheet. Aspects measured on student activity are (1) emotional aspect: students dare to express their opinions in front of the class, (2) listening: students listen when the teacher explains the material and the use of AR teaching materials, (3) mental: students actively work together to solve problems. problems, (4) oral: students ask questions or responses during the learning process, (5) visual: students pay attention to the teacher's explanation about the use of AR teaching materials, (6) writing: students work on assignments in AR teaching materials, and ( 7) metric: students are active in practicum and explore AR teaching materials. This observation sheet is to uses the percentage of activeness of each student.
Calculation of the percentage of student activity data in the learning process is calculated using the following formula : The resulting development is AR Loaded Listening Teaching Materials. Digital Listening Teaching Materials containing AR in the form of a mobile application with a. apk extension. This teaching material was developed using AR technology which can be the application to an android smartphone. This application development uses the ADDIE development model which has been described in the method. The results of the development of AR-loaded Listening digital teaching materials showed in figure  1. The resulting development is AR Content Listening Digital Teaching Materials. Digital Teaching Materials Listening Contains AR in the form of a mobile application with a. apk extension.
This teaching material was developed using AR technology which can be applied to an Android smartphone. This application development uses the ADDIE development model which has been described in the method. The results of the development of AR-loaded Listening digital teaching materials will be explained as follows: Small Group Table  1. The result of Testing in a small group The small group trial was carried out by 15 students who were taken in 2. The trial was carried out using the attached respondent test questionnaire. The data collected is in the form of quantitative data on physical aspects of appearance, The large group trial was carried out by 30 students who were taken in 2. The trial was carried out using the attached respondent test questionnaire. The data collected is in the form of quantitative data on physical aspects of appearance, utilization aspects, technical quality of applications, and content aspects with a total of 20 questions.
AOPs describe and connect data from various sources, i. e. , databases and the scientific literature. Key information used to build AOPs can also be gathered using computational approaches based on artificial intelligence, such as frequent itemset mining and text mining  [256]. AOP-helpFinder is a recent hybrid tool that combines text mining and graph theory, helping identify the existing linkages between variables (e. g. , an obesogen and a biological event) by automatically screening the available scientific abstracts  [257]. Using this tool, it was possible to link exposure to bisphenol S with obesity  [258]. Integrative systems toxicology modeling and text mining can also link obesogens to AOPs, as proposed recently for bisphenol F  [259].
Structured frameworks, such as the integrated approaches to testing and assessment (IATAs), allow categorization of different tests that support the linkage of a chemical with an adverse outcome and with the different events leading to that outcome. IATAs are expected to be used for large scale obesogen testing and appear to be more time-and cost-effective than current approaches  [261]. Additional in vitro tests are needed, including assays that will develop and characterize brown and beige adipocytes to be used to define further the sites and actions of potential and actual obesogens. Approaches like this have been previously attempted using the ToxCast dataset. The National Institute for Environmental Health Sciences (NIEHS) hosted a workshop in 2011 to develop models for predicting obesogenic and/or diabetogenic outcomes using ToxCast and Tox21 data  [262].
Although studies on RBPs and viral genomes point to the importance of RBP interaction networks in viral infections, genome-scale experimental and functional studies are relatively sparse and are cell type and condition specific. In order to support experimental research in this area with computational predictions, we developed SMEAGOL (Sequence Motif Enrichment And Genome annOtation Library), a Python library to analyse RBP binding motifs in nucleic acid sequences. SMEAGOL identifies proteins whose binding motifs are significantly enriched or depleted in a sequence, thus highlighting the interactions that are most likely under evolutionary selection and functionally significant. By applying SMEAGOL to 197 Group IV and Group V viral genomes we have constructed a comprehensive resource for studying ssRNA virus/RBP interactions.
Curation of Viral Genomes The complete genome sequences for viruses (Taxonomy ID: 10239) deposited in the NCBI repository (https://www. ncbi. nlm. nih. gov/genome/browse#!/viruses/) (accessed on 6 November 2020) were retrieved using the following search/filter strategies: only RefSeq entries of specific families of (+)ssRNA and (-)ssRNA viruses known to infect humans (host = "human") were selected. We manually curated these data by adding missing information from additional viral databases ViPR (https://www. viprbrc. org) (accessed on 6 November 2020)  [6]  and ViralZone (https://viralzone. expasy. org/) (accessed on 6 November 2020)  [7]. All information regarding reference strains or the selection of representative strains/genotypes along with excluded genomes can be found in Supplementary Data S1.