dataesr/scientific-paragraphs-categorization huggingface dataset:
With these scenarios, we represent the known sample S by choosing randomly plaintext documents from DB. Model. In the first step, each plaintext of S is associated to its protected information in EDB. This step is performed using statistical properties that can be computed independently from the plaintexts themselves or from the associated leakage given in EDB. The performance of this association step heavily depends on the statistic capacity to give unique results over the data set. Assume we are in the case of a data set of books and there is one known best-seller in the data set. An attacker can try to find its identifier in the encrypted database by checking, for example, if there is an unique identifier sharing the length of the known best-seller (L4-SSE schemes) or if there is an unique identifier sharing the same number of distinct keywords (L3-SSE schemes).
√ #DB is a good approximation of these values. Mask Attack. For each known document d of S, the Mask Attack computes masks for all candidates of d, i. e. M L4 masks computation for each document d. Hence the total complexity for the Mask Attack is O #S • M L4 mask computations. Co-Mask Attack. The Co-Mask Attack starts with the construction of A 2 , i. e. the set of all identifiers pairs of the encrypted database sharing the same comask of the two chosen known documents of S. O M 2 L23 + #S • M L23 co-mask computations. PowerSet Attack. The analysis is much more complex. As the Co-Mask Attack, the PowerSet Attack starts with the construction of A 2 , i. e. the set of all identifiers pairs sharing the same number of keywords of the two chosen known documents of S. Hence, constructing A 2 costs M 2 L23 intersections cardinals computations since we check all candidate pairs for the initial cardinal intersection.
EXPERIMENTAL RESULTS Real-World Data Sets. We implemented and ran the attacks presented in Section 4 on four different realworld data sets to evaluate their practical efficiency. The first data set is the email data set from the Enron corporation, available online ¶. Islam et al. (Islam et al. , 2012)  and Cash et al. (Cash et al. , 2015)  consider emails from each employee's sent mail. Here, we choose to took all 490,369 emails of the data sets, including mails sent from the outside of Enron. The second and third data sets are mailing lists from the Apache foundation, namely Apache Commons and Apache Lucene which is used too in  (Cash et al. , 2015; Islam et al. , 2012). The last data set is the Project Gutenberg * *. We summarize characteristics of used data sets in Tab. 1. One email message, one article or one book is considered as one document.
For each document, stopwords have been removed. Moreover, we use the stan- ¶ cs. cmu. edu/˜. /enron/ mail-archives. apache. org/mod mbox/commons-user/ * * gutenberg. org/wiki/Main Page dard Porter stemming algorithm  (Porter, 1980)  to find the root of each word of data set documents. We stress that all processing steps on keywords have been done considering the result given by the Porter's algorithm. Efficiency Measures. We ran our attacks for different sizes of S using steps of 1% until 10% then steps of 10% from 10% to 100%. Here 1% is 1% of the pairs (d, w) of the data set; this allows us to perform a fairer comparison between data sets than the usual per-document measure, as knowing a long document do not have the same impact as knowing a short one. The measured success rate is the ratio of keywords-tokens associations over the set of keywords of S.
Then, these correspondences are spread back into EDB in order to evaluate their impact on other documents of the data set. In particular, we measured the rate of documents of the data set whose keywords are recovered at 70%, 80%, 90% and 100%. Experimental Results on Lucene. We expose here the results of our attacks on the Lucene data set. All timings are measured on a Core i7 using 16 Gb RAM. Our attacks have a huge impact. If the server only knows 1% of the Lucene data set, the Mask attack (resp. the Co-Mask attack) can recover 99% of keywords present in this sample in 72 seconds (resp. 284 seconds) whereas the PowerSet Attack can even so recovers 21% of keywords in 489 seconds. The impact on the knowledge of the protected data is illustrated with graphs in Figure  1. For the Mask and the Co-Mask attacks, the recovering of the 99% of keywords present in the 1% of the data set allows us to recover 50% of the protected data at 90%.
For the Power-Set Attack, the recovering of the 21% of keywords present in the 1% of the data set allows to recover 25% of the protected data at 90%. Details are presented in Tab. 2. We precise that the impact of our attacks is the same on the others chosen data sets (Commons, Enron and Gutenberg). Results are presented in Appendix 8. Mask Attack. Over 98% of documents have a unique mask in Lucene data set. This translates into over 99% keyword-token association rate over the set S in all cases. Moreover, knowing only 1% of the data set already allows the server to recover 70% of the keywords close to all documents; and 3,146 of them are completely recovered. Co-Mask Attack. Experiments show that despite the loss of the frequency information, it remains as effective as the Mask Attack. PowerSet Attack.
It suffers widely from the loss of keyword order. Hence, while the documentsidentifiers association performs equally well, the exact association between keywords and tokens plateau around 20%. Still, the knowledge of 1% of the data set already allows to recover 80% of the keywords of more than 70% of the database documents. Practical Impact. As noted in  (Cash et al. , 2015) , this reconstruction allows to reveal sensitive information even if the order of keywords is not preserved. Human inspection of the output of our attacks gives a clear idea of the sense of each document.
Complexity-wise, the Count Attack is orders of magnitude faster than the IKK Attack since we leverage the extraneous auxiliary information to avoid doing any numerical optimization step. Shadow Nemesis Attack. The Shadow Nemesis Attack from Pouliot and Wright in  (Pouliot and Wright, 2016)  presents also a passive query recovery attack on SSE schemes. First, it uses a training set to build an approximate co-occurrence matrix C W. Then, it build a second co-occurrence matrix C W from the encrypted database with keywords that has been queried. From C W (resp. C W ), they construct the weighted graph G (resp. H). Pouliot and Wright compare these two cooccurrence matrix by reducing them to the combinatorial optimization problem of weighted graph matching. The problem is to find the permutation X that relabels the nodes in H so that the permuted graph most closely resembles G.
We consider the database DB as a binary matrix M of size m • n, where M i, j = 1 if w i ∈ d j and M i, j = 0 if w i ∈ d j. Since the PowerSet Attack is performed only on the encrypted database and does not require any query, we modify the matrix M such that for each column there exist α -1 similar columns. We authorize only false-positive that is modify a 0 to a 1. Then our aim is to minimize the number of false-positive, so we use an algorithm of agglomerative hierarchical clustering with average distance and the cosine distance as distance measure  (Berkhin, 2006). When each cluster have at least α documents, if there is at least one column having 1 to its j-th then we put 1 into the j-th row of all columns of the cluster. This countermeasure preserves the size of the original database at the cost of false-positives.
As in  (Islam et al. , 2012) , we define cost as the ratio of number of documents returned by the new encrypted database (denoted by q) to the number of documents returned by the old encrypted database (denoted by p). That is cost = (qp)/p. Fig. 3  shows the evolution of the cost of the countermeasure for different α values when the presented countermeasure is performed on a sample of 1 000 documents from the data set Commons. The stages of the cost are explained by the number of documents in each cluster. In fact, when α = 3, each cluster have already 5 documents, hence clusters do not change when α changes from 3 to 5. Countermeasure for the Co-Mask Attack. The Co-Mask Attack targets L3-SSE. These schemes leak the order of keywords first appearance. Assume we want to keep the relative order of keywords in documents to allow the scheme to sort replies from the server in function of the queried keyword position.
As the countermeasure for the PowerSet Attack, we authorize false positives. The idea is to add a keyword of W which is not in the initial document. Its position is randomly chosen when the client builds the encrypted database. Hence, an adversary knowing this countermeasure and a sample S of plain documents has on one hand a low probability to choose the same keyword, and on the other hand has a low probability to choose the same position. This countermeasure decreases the chance to have a match between comask computed by the adversary from S and those which are computed directly from the encrypted database. Moreover, we only add one false positive by document. Countermeasure for the Mask Attack. The Mask Attack targets L4-SSE schemes. Assume we want to keep information on occurrence and order of keywords for the same reason as above.
Again, we authorize false positives. Hence we can add a random keyword at a random position in each document. In this way, the mask of the original document does not correspond to those of the new document. Moreover, if the adversary tries to find the correct identifier of a document in the encrypted database, it has a low probability to find the added keyword and its position. A possible alternative to not add false positive is to choose the added keyword among those of the original document. This increases the chance for the adversary to guess the added keyword.
16 0. 95 0. 71 0. 15 30 0. 99 0. 99 0. 92 0. 57 0. 99 0. 99 0. 92 0. 57 0. 16 0. 96 0. 75 0. 19 40 0. 99 0. 99 0. 94 0. 66 0. 99 0. 99 0. 94 0. 66 0. 16 0. 97 0. 77 0. 22 50 0. 99 0. 99 0. 96 0. 74 0. 99 0. 99 0. 96 0. 74 0. 16 0. 97 0. 79 0. 25 Success Rate Success Rate Success Rate 1 1 1 0. 9 0. 9 0. 9 0. 8 0. 8 0. 8 0. 7 0. 7 0. 7 0. 6 0. 6 0. 6 0. 5 0. 5 0. 5 PowerSet Attack 0. 4 Mask Attack 0. 4 Co-Mask Attack 0. 4 0. 3 0. 3 0. 3 0. 2 0. 2 0. 2 0. 1 0. 1 0. 1 0 0 20 40 60 80 100 0 0 20 40 60 80 100 0 0 20 40 60 80 100 % of known dataset % of known dataset % of known dataset Keyword/token associations over the dataset Keyword/token associations over I Document recovered >80% Document recovered >90% Documents fully ecovered.
Most commons keywords recovery rates. Lucene data set, 1 500 keywords, 150 chosen uniformly. resistant to recover client queries. If the adversary only knows 5% of the data set, our attack can recover 100% of the 150 keywords while the Shadows Nemesis Attack recovers only 5% of them and whereas IKK and Count attacks need to know more than 60% of data set to recover keywords. PowerSet vs. IKK/Count/Shadow Nemesis Success Rate 1 0. 9 0. 8 0. 7 0. 6 0. 5 0. 4 0. 3 0. 2 0. 1 0 0 20 40 60 80 100 % of known dataset PowerSet Attack Count Attack Shadow Nemesis Attack IKK Attack Figure 2:.
All PC and PE standards were dissolved in methanol. The sphingomyelin (SM) standard SM (d18:1/12:0) was purchased as an ethanolic solution from Avanti Polar Lipids through Stratech Scientific Ltd. (Newmarket, UK). Table  1  lists all standards used in this work. Analysis was performed using a Synapt G2-Si HDMS mass spectrometer (Waters Corporation, Wilmslow, UK) equipped with an in-house developed AP-(MA)LDI source, featuring a Waters Research Enabled Software (WREnS)-controlled XY-stage. This setup has been previously reported  [1]. In brief, an MNL100 nitrogen laser (LTB Lasertechnik Berlin, Berlin, Germany) with a wavelength of 337 nm, maximum pulse rate of 30 Hz, and a pulse width of approximately 3 ns was attenuated by a neutral density filter to 20-30 μJ/pulse for MALDI MS measurements.
A higher sample loading (100 pmol per droplet) was used to compensate for smaller ion current due to the additional fragmentation step. The BaCl 2 amount was kept at 500 pmol as an increase into the nmol range proved detrimental to [L+Ba] 2+ signal intensity. Data were collected for 5 min with consistent, stable ion current and low sample consumption. From the spectra shown in Fig. 4 , evidence of charge-remote fragmentation of the acyl chain is evident, as peaks with a difference of m/z 14 are clearly visible, starting at m/z 209. Mechanisms for MS 3 product ion formation are suggested in Fig. 5 , including the radical ion at m/z 196  [43, 44]. The location of double bonds is easily revealed by the characteristic differences of m/z 40 between the acyl chain fragment ion signals. Surprisingly, the detection of m/z 333.
Data references This journal encourages you to cite underlying or relevant datasets in your manuscript by citing them in your text and including a data reference in your Reference List. Data references should include the following elements: author name(s), dataset title, data repository, version (where available), year, and global persistent identifier. Add  [dataset]  immediately before the reference so we can properly identify it as a data reference. The [dataset] identifier will not appear in your published article. Reference management software Most Elsevier journals have their reference template available in many of the most popular reference management software products. These include all products that support Citation Style Language styles, such as Mendeley. Using citation plug-ins from these products, authors only need to select the appropriate journal template when preparing their article, after which citations and bibliographies will be automatically formatted in the journal's style.
Mendeley Data This journal supports Mendeley Data, enabling you to deposit any research data (including raw and processed data, video, code, software, algorithms, protocols, and methods) associated with your manuscript in a free-to-use, open access repository. During the submission process, after uploading your manuscript, you will have the opportunity to upload your relevant datasets directly to Mendeley Data. The datasets will be listed and directly accessible to readers next to your published article online. For more information, visit the Mendeley Data for journals page. To maximise the visibility of your data, authors are invited to add a citation to their datasets by including a data reference in their Reference List as per the 'Data References' instructions elsewhere on this page.
An additional search was conducted to retrieve this information (see Appendix A, Section A. 1). The literature search was performed in May 2016 (March 2017 for information on coffee). Web of Science 17  and PubMed 18  were identified as databases appropriate for retrieving literature for the present evaluation. The references resulting from the literature search were imported and saved using a software package (EndNote 19  ), which allows effective management of references and citations. Additionally, reviews and relevant scientific evaluations by national or international bodies were considered for the current risk assessment, i. e. IARC (1995 ), NAS, 2000 , FDA (2004a) , FAO/WHO (2011) and VKM, 2012. When relevant papers were identified during the risk assessment process (e. g. from other studies or reviews), they were also considered.
The references obtained were screened using title and abstract to identify relevant literature. The VCF database 20  on volatile compounds in food was consulted to identify papers on the occurrence of methylfurans. EFSA also organised an Info Session with invited stakeholders to support the work of the CONTAM Panel and its working group in drafting this scientific opinion. The aim of this meeting was to collect information and data which are not readily available in the public domain regarding dietary exposure, home-cooking and toxicity. Further information is available in EFSA's Register of Questions. 21.
In addition to the literature searches outsourced by EFSA, a search for studies regarding the toxicity of 2,5-dimethylfuran and the genotoxicity of BDA was conducted (see Appendix A, Section A. 2). The literature search was performed in June 2016 using Web of Science 17 and PubMed. 18  The references resulting from the literature search were imported and saved using a software package (EndNote 19 ), which allows effective management of references and citations. It was regularly checked (last check May 2017) whether new papers had become available during the development of this scientific opinion. Reviews, relevant scientific evaluations and toxicity studies by national or international bodies were also considered for the current risk assessment (see  Section 2. 1. 1). When relevant papers were identified during the risk assessment process (e.
Data collection and validation At the time of receiving the request for the scientific opinion from the European Commission, data on 2-methylfuran and 3-methylfuran were not available in the EFSA Chemical Occurrence database, and available data on furan were limited. The EFSA Evidence Management Unit (DATA Unit) initiated an ad hoc collection of data to compile occurrence data on furan, 2-methylfuran and 3-methylfuran levels in food. 22 The European national food authorities and similar bodies, research institutions, academia and food business operators were invited to submit data. As 2,5-dimethylfuran was not included in the initial request from the European Commission, the submission of occurrence data for 2,5-dimethylfuran was not requested by EFSA. The data submission to EFSA followed the requirements of the EFSA Guidance on Standard Sample Description for Food and Feed (EFSA, 2010a); occurrence data were managed following the EFSA standard operational procedures (SOPs) on 'Data collection and validation' and on 'Data analysis of food consumption and occurrence data'.
In accordance with Commission Recommendation 2007/196/EC 13 on the monitoring of the presence of furan in foodstuffs, data providers were also requested to indicate whether commercial foodstuffs were analysed as purchased, disregarding any further preparation, or whether they were analysed as consumed after further preparation in the laboratory. All data on furan and its methyl analogues in food available in the EFSA database by the end of November 2016 were used for the present assessment. Data received after this date were not included.
Food consumption data The EFSA Comprehensive European Food Consumption Database (Comprehensive Database) provides a compilation of existing national information on food consumption at individual level. It was first built in 2010  (EFSA, 2011a; Huybrechts et al. , 2011; Merten et al. , 2011). Details on how the Comprehensive Database is used are published in the Guidance of EFSA  (EFSA, 2011a). The latest version of the Comprehensive Database 23 was used with subjects classified in different age classes as follows: 22 http://www. efsa. europa. eu/en/data/call/160216b 23 http://www. efsa. europa. eu/en/datexfoodcdb/datexfooddb • Infants: < 12 months old • Toddlers: ≥ 12 months to < 36 months old • Other children: ≥ 36 months to < 10 years old • Adolescents: ≥ 10 years to < 18 years old • Adults: ≥ 18 years to < 65 years old • Elderly: ≥ 65 years to < 75 years old • Very elderly: ≥ 75 years old.
Two additional surveys provided information on specific population groups: 'Pregnant women' (≥ 15 years to ≤ 45 years old; Latvia) and 'Lactating women' (≥ 28 years to ≤ 39 years old; Greece). Overall, the food consumption data gathered by EFSA in the Comprehensive Database are the most complete and detailed data currently available in the EU. Consumption data were collected using single or repeated 24-or 48-h dietary recalls or dietary records covering from 3 to 7 days per subject. As a result of the differences in the methods used for data collection, direct country-to-country comparisons can be misleading.
Exposure assessment The CONTAM Panel considered that only chronic dietary exposure had to be assessed. As suggested by the EFSA WG on Food Consumption and Exposure (EFSA, 2011a), dietary surveys with only 1 day per subject were excluded from the current assessment because they are not adequate to assess repeated exposure. Similarly, subjects who participated only 1 day in the dietary studies, when the protocol prescribed more reporting days per individual, were also excluded from the chronic exposure assessment. When, for one particular country and age class, two different dietary surveys were available only the most recent one was used. For calculating the chronic dietary exposure, food consumption and body weight data at the individual level were accessed in the Comprehensive Database. Occurrence data and consumption data were linked at the relevant FoodEx level (see also  Section 2.
g. cappuccino) was prepared from an instant powder, this consumption event was reclassified to the instant coffee beverages as this is considered more appropriate in the framework of the current assessment. • Legume vegetables, which are normally part of the vegetables and vegetable products, were reclassified to legumes (dried or green) in order to better match the available occurrence data for furan. • Human milk was not considered for the assessment due to lack of data available. All analyses were made using the SAS Statistical Software (SAS enterprise guide 5. 1).
Observations in humans In a study in Korea, blood  (Lee et al. , 2009)  and urine  (Jun et al. , 2008)  samples were collected from 100 volunteers (49% males, 51% males age ranging from 30 to 70 years; see also  Section 3. 1. 1. 6). The authors in the two study reports stated that the participants consumed a regular Korean diet and avoided large amounts of furan-rich foods. However, they also stated that: 'Since a database on amounts of furan in the typical foods is not available so far, an actual intake of furan per individual was not shown in this study. Also, other factors such as smoking were not considered for actual intake of furan'. Furan could be detected in 56 urine samples out of 100 samples collected with average values of 0. 5-1. 3 lg/L, with a concentration above the LOQ (1. 0 lg/L) in 15 volunteers.
Furihata et al. (2016)  were able to discriminate furan from 8 genotoxic carcinogens based on the hepatic gene expression profile of 100 candidate marker genes at 4 and 48 h after an i. p. dosage (30 mg/kg bw) in B6C3F1 male mice. These two studies do not support a direct genotoxicity of furan. A computational analysis sought significant disease associations with either furan or 2,5-dimethylfuran using data from the Comparative Toxicogenomics Database. There were inferred associations between furan and lung neoplasms, liver injury and cirrhosis based on 21 gene interactions. There were no detected direct associations between 2,5-dimethylfuran and disease  (Phuong et al. , 2012). In human lung alveolar epithelial cells, 2,5-dimethylfuran at concentrations up to 2 mM showed no effect on viability or changes in gene expression as assessed using a human microarray platform  (Cheah et al.
Previously reported occurrence data in the open literature EFSA and JECFA reviewed occurrence data on furan in foods up to 2010 (EFSA, 2011d; FAO/WHO, 2011). A literature search for recent reviews was conducted. However, since the occurrence of methylfurans was not addressed in the identified reviews, a separate search to identify papers regarding the occurrence of 2-methylfuran, 3-methylfuran and 2,5-dimethylfuran was conducted. In addition, the VCF database 20 on volatile compounds in food was consulted to identify papers on methylfurans. There are numerous citations reporting the occurrence of furan and methylfurans in the aroma profiles of foods, of which some examples are presented below. These studies refer mainly to commercially heat-processed foods, however, some report the natural occurrence of furan and methylfurans in unprocessed foods.