dataesr/scientific-paragraphs-categorization huggingface dataset:
This type of codes made it possible to build McEliece schemes that can be viewed as the rank metric analogue of NTRU in the Euclidean metric  [43]  or of the MDPC cryptosystem in the Hamming metric  [47] , where the trapdoor is given by small weight vectors which allow efficient decoding. Contrarily to the GPT cryptosystem, this gives a cryptosystem whose security really relies on decoding an unstructured linear code and on distinguishing codes with moderate weight codewords from random linear codes. It can be argued that this second problem is similar in nature to the first one and so we have in a sense a cryptosystem whose security relies solely on the difficulty of generic decoding in the rank metric. This approach led to the design of several cryptosystems:  [37, 39, 7, 8] , and in 2019, four rankbased schemes of this form  [1, 2, 7, 8]  made it to the Second Round of the NIST Post-Quantum Standardization Process and were later merged into  [9, 4].
The advantage of this technique is that it only relies on the hardness of decoding a random linear code: first, the security is well understood, and second one can use a seed to generate the public key. This method has already inspired a long sequence of optimizations and adaptations to the rank metric setting, see for instance  [40, 18, 21]. Rank Decoding and MinRank Problems. Codes used in rank metric cryptography are linear codes over an extension field F q m of degree m of F q. An F q m -linear code of length n is an F q m -linear subspace of F n q m , but its codewords can also be viewed as matrices in F m×n q. Indeed, if (β 1 ,. , β m ) is an F q -basis of F q m , the word x = (x 1 ,. , x n ) ∈ F n q m corresponds to the matrix Mat(x) = (X ij ) i,j ∈ F m×n q , where x j = β 1 X 1j + • • • + β m X mj for j ∈ {1.
This can be done without loss of generality, since we can run the algebraic attacks which follow for increasing values of r ≤ r and since the most costly part corresponds always to r = r. Given s ∈ F n-k q m and H ∈ F (n-k)×n q m a parity-check matrix of an F q m -linear code C, the syndrome version, denoted by RSD for Rank Syndrome Decoding, asks to find e ∈ F n q m such that He T = s T and |e| = r, and it is equivalent to RD. Even if RD is not known to be NP-complete, there is a randomized reduction from RD to an NP-complete problem  [41] , namely to decoding in the Hamming metric. An RD instance can also be viewed as a structured instance of the following inhomogeneous MinRank problem. Problem 2 (Inhomogeneous (m, n, K, r) MinRank problem). The MinRank problem with parameters (m, n, K, r) is given by Input: an integer r ∈ N and K + 1 matrices M 0 , M 1 ,.
MaxMinors and Support-Minors modelings over F q m. In what follows, we always consider RD instances with a unique solution and whose rank weight is exactly r instead of at most r (we may assume this, as trying all the weights smaller than r adds at most a polynomial factor in the total complexity). Let G ∈ F k×n q m be a full-rank generator matrix of a linear code C of length n and dimension k over F q m , and let y ∈ F n q m be the received word affected by an error of weight r. With our assumption, the decoding problem amounts to finding the unique codeword xG such that the weight of xG + y is r. In this section, we analyze the link between the MM-F q m modeling (1), consisting of polynomials P J = CH T y * ,J , and the SM-F q m modeling (4), consisting of polynomials Q I = xG+y C * ,I. To this end, we first separate the polynomials from both systems into different sets by defining for nonnegative integers s and i ∈ {1.
For all these propositions, it will be helpful to notice that Proof. Up to a permutation of the coordinates, we can assume that G is in systematic form G = I k * , and up to the addition of an element in C that y = (0 k * ). As y contains an error of weight r, it is non-zero, so that up to a permutation of the coordinates of the code and up to the multiplication by a constant in F q m , we assume that y has the given shape y = 0 k 1 *. Now, if G y = I k+1 A is a generator matrix of C y in systematic form, then H y := -A T I n-k-1 is suitable. By considering an h linearly independent from the rows of H y and such that yh T = 0, any linear combination between h and the rows of H y still satisfies the same properties. Therefore, we may assume that h = * 0 n-k-1 , and moreover we have yh T = h k+1 = 0.
Following previous work (e. g. [16, 17] ), we assume that the MM-F q polynomials P i,J are generically as linearly independent as possible. In other words, if the matrix H y = * I n-k-1 ∈ F (n-k-1)×n q m is obtained from a random code C of dimension k and length n and from a random vector e ∈ F n q m of weight r below the Gilbert-Varshamov distance, we adopt the following assumption: Assumption 1 The m n-k-1 r linear polynomials P i,J in the n r variables c T generate an F q -vector space of dimension min m n-k-1 r , n r -1. To validate this hypothesis, we have also performed experiments. The code used for these simulations can be found in https://github. com/mbardet/Rank-Decoding-tools. Remark 2. If we consider only one P J polynomial and if we denote by v J the vector of minors of (H y ) * ,J of size r and by µ the vector of minors of C of size r, then P J = v J µ T and the rank of the system {P i,J : 1 ≤ i ≤ m} is exactly the rank of v J in rank metric.
More generally, the number of linearly independent polynomials in {P i,J } i,J is the co-dimension of the subfield subcode of the code generated by the matrix v J J⊂{1. n-k-1},#J=r. On the contrary, we are able to prove this result for the SM-F q polynomials on a specific RD instance. Note that such a statement is not proven for the SM polynomials on a random MinRank instance, so in a way this F q m -linear structure enables one to remove this implicit assumption of  [17]  in the RD case. Proposition 5. The polynomials in Unfold(Q ≥2 ) satisfy LT(Q i,I ) = x i,i1 c I\{i1} with i 1 = min(I) ≤ k. In particular, they are all linearly independent over F q. Proof. This comes from LT(Q I ) = x i1 c I\{i1} = m i=1 β i x i,i1 c I\{i1} , see Proposi- tion 2. Finally, we show that the polynomials from SM-F q are the unfolded polynomials obtained from SM-F q m.
then we can even try at most q ar matrices belonging to the set P :=    P A =   Ir 0 r×(n-a-r) -A 0 (n-a-r)×r In-a-r 0 (n-a-r)×a 0a×r 0 a×(n-a-r) Ia   , A ∈ F r×a q   . ( 17 ) The point is that multiplying by matrices of this form amounts to leave the (n-a) columns in the first two blocks unchanged, but adds to the last a positions of e or the last a columns of E all possible linear combinations of the r first ones. One of them has to be 0 because by assumption, the r first positions/columns form a basis of the subspace e 1 ,. , e n Fq or the column space of E. One could think that this would give a new instance of the MinRank problem associated to the matrices M 0 = M 0 P A , M 1 = M 1 P A ,. , M K = M K P A , or an RD problem associated to the word y = yP A and the code C A = {cP A : c ∈ C}, however the fact that the last columns are equal to 0 has an additional effect, we can namely reduce accordingly the dimension of the matrix code (in the rank metric case) or of the underlying F q m -linear code.
RD instances It turns out that in RD case, when (eP A ) J = 0 a , with a very mild condition on the shortened code at J we obtain a reduction to an RD instance with smaller parameters, namely Proposition 9. Assume that e J = 0. Let Sh J (C) be the code C shortened at J, for some invertible matrix D ∈ F k×k q m. Then G is a generator matrix of C := Sh J (C). Define y := (y) J -y J B. Then (y , C , r) is a valid instance of an RD problem of parameters (m, n -a, k -a, r), from which we can deduce a solution of the initial problem (y, C, r). namely Sh J (C) = {c J : c ∈ C, c J = 0}. Assume that Sh J (C) is of dimension k -a, Proof. The first point is just standard linear algebra. For the second point, let (c, e = yc) be the solution of the RD problem and denote by (x , x ) where x ∈ F k-a q and x ∈ F a q the vector defined by (x , x ) = xD -1 where c = xG.
Observe now that e J = y J -c J = y J -(xG) J = y J -((x , x ) DG) J = y J -x. Since e J = 0 a , this implies y J = x. Therefore e J = y J -c J = y J -x G -x B = y J -y J B y -x G =c ∈C Therefore yc is of rank weight r and the proposition follows. This proposition is used as follows. When we want to solve an instance (y, C, r) of an RD problem of parameters (m, n, k, r), we consider q ar RD instances (y , C , r) of parameters (m, n -a, k -a, r) obtained from all P A ∈ P by computing a generator matrix G A := GA (where G is a generator matrix of C) of the code C A := {cP A : c ∈ C}, then put this matrix in (partial) systematic form on the columns in J by Gaussian elimination and obtain G = J J G 0 (k-a)×a B I a. ( 20 ) The RD instances (y , C , r) are defined from G , y and P A by C := {xG : x ∈ F k-a q m } y := y J -y J B, where y := yP A.
r} A is rank defective is equivalent to the existence of a word of weight ≤ a whose support is spanned by the a last coordinates in the dual of D. Proof. Assume that some A ∈ F r×a q is such that rk G * ,J -G * ,{1. r} A < a. This means that there exists a vector λ A ∈ F a q m such that -G * ,{1. r} Aλ T A + G * ,J λ T A = G * ,{1. r}∪J -Aλ T A λ T A :=v T A = 0. In particular, the vector v A ∈ F a+r q m belongs to D ⊥ , its weight is ≤ a (as the entries of A belong to F q ) and its support is spanned by the a last coordinates. The converse statement is similar by constructing an inverse of the map A → v A. Under the assumption that D behaves as a random code with parameters [a + r, k], one can show that Proposition 10. The probability that there exists in the dual of a random F q mlinear code of parameters [a + r, k] a non zero codeword of weight ≤ a whose support is spanned by the a last coordinates is upper-bounded by Θ q (m+r)a-mk as q → ∞.
Proof. This probability is upper-bounded by the probability that there exists simply a non zero codeword of weight ≤ a in such a code. Let X be the number of such codewords. We use the fact that Pr (X = 0) ≤ E(X) and that the expected number E(X) of non-zero vectors of weight ≤ a in such a code is given by E(X) = B a -1 q mk , where B a is the size of a ball of radius a in F a+r q m in the rank metric. By using [46, Proposition 1] the size of such a ball is of the form Θ q (m+a+r)a-a 2 = Θ q (m+r)a for any nonnegative integer a ≤ m. We deduce the proposition from this.
MinRank instances This reduction sketched for the RD problem also applies to MinRank. Consider a MinRank instance (M 0 ,. , M K ) with target rank r, and denote by E = M 0 + K i=1 x i M i the rank r matrix we are looking for. To explain the form taken by the reduced RD instances we got in Subsection 5. 2, it was convenient to put the generator matrix of the transformed code C A = CP A into systematic form. It will be helpful here to use a similar notion in the MinRank case by viewing a matrix as the vector formed by the concatenation of its rows. To define the relevant systematic form we will use, we bring in the invertible linear map ϕ : F m×n q → F mn q (21) A → (A i,j ) i∈{1. m},j∈{1. n} where the image of ϕ(A) is formed by the entries of A in column-major order (we could equivalently take the row-major order).
Using ϕ we define the generator matrix associated to a MinRank instance as follows. Definition 1. Let M 1 ,. , M K be K matrices in F m×n q , and define L the matrix code generated by the ϕ(M i )'s. Then the following matrix L is a K × mn generator matrix of L: L(M 1 ,. , M K ) :=    ϕ(M 1 ). ϕ(M K )    ∈ F K×mn q. As noted in  [19, §4. 4] , any elementary row operation on L corresponds to linear transformations of the variables x i , i. e. we can always transform the initial MinRank instance to an equivalent one with L in echelon form. From now on, we will assume that L is in echelon form. Definition 2. We say that MinRank instance is in systematic form if its associated generator matrix is. We denote by S the systematic positions.
This cost is compared to the one of the combinatorial attack of  [13]  ("comb") and to the one of the MaxMinors attack ("MM. "). Table  2. Comparison between known attacks on the new ROLLO-I parameters in  [17]  and  [3]  after the 2021-04-21 update. The "*"-symbol means that the best attack is obtained on the derived code from key attack with parameters (m, n, k, r) = (m, 2k -k d , k -k d , d), where d refers to the rank of the moderate weight codewords in the masked LRPC code. Otherwise, the attack is on an RD problem with parameters (m, 2k, k, r). The struck out numbers are the underestimated values from  [17, Table 3]. We also adopt ω = 2, whereas previous values where computed with ω = 2. 81.
Instance q k m r d MM-Fq a p SM-F + q m b a comb   (31, 33, 15)  and weight r between 2 and d RGV = 10, for q = 2 in Fig. 1  and q = 256 in Fig. 2. We can see that for q = 2, the algebraic attacks become less efficient than combinatorial attacks for large r. This justifies the current trend for rank-based proposals to now consider a different regime where the weight r is chosen closer to the rank Gilbert-Varshamow bound d RGV = O(n), see for instance  [5, 24]. Note also that in the scheme of  [5]  which uses LRPC codes, choosing d of the same order as r somehow increases the rank of the moderate weight codewords in the masked LRPC code and therefore may allow to gain confidence in the indistinguishability assumption. This behavior can be explained by the fact that for the combinatorial attacks, the exponential part of the complexity all depends on q, whereas for the MM-F q attack, the cost q ar n-a r ω contains a part depending on q whereas the other part n-a r ω does not depends on q.
This paper is concerned with variational and Bayesian approaches to neuro-electromagnetic inverse problems (EEG and MEG). The strong indeterminacy of these problems is tackled by introducing sparsity inducing regularization/priors in a transformed domain, namely a spatial wavelet domain. Sparsity in the wavelet domain allows to reach "data compression" in the cortical sources domain. Spatial wavelets defined on the mesh graph of the triangulated cortical surface are used, in combination with sparse regression techniques, namely LASSO regression or sparse Bayesian learning, to provide localized and compressed estimates for brain activity from sensor data. Numerical results on simulated and real MEG data are provided, which outline the performances of the proposed approach in terms of localization.
II. PROBLEM STATEMENT AND STATE OF THE ART Given a MEG (magnetoencephalography) dataset consisting in J 0 sensors measurements during L time steps, and summarized in the form of a matrix Z ∈ R J0×L , MEG inverse problem consists in estimating the underlying cortical current densities S ∈ R N ×L explaining (in an "optimal" way) the data. Typical orders of magnitude for the dimensions at stake are J 0 ≈ 250 and N ≈ 15, 000. With a suitable whitening matrix Υ ∈ R J0×J and dimension reduction onto J < J 0 spatial channels, the measurements and cortical sources are connected by the following observation equation Z = GS + B (1) with Z = ΥZ 0 the whitened data, G = ΥG 0 the whitened leadfield matrix, and B the matrix of observation noise and background activity, assumed i. i. d. with zero mean and unit variance (as a result of whitening).
IV. RESULTS The proposed approach is first illustrated on simulated data, numerically generated on a brain geometry based on a MEG dataset acquired by the DYNAMAP group at INS Marseille in an auditory evoked potentials protocol. Available data include sensor data (245 MEG sensors, 180 trials, sampled at 2034. 51 Hz). The dataset also involves a triangulated cortical surface (interface of white and gray matters), with 14995 vertices. 3D coordinates are available, as well as the adjacency matrix of the mesh graph, which permits the computation of graph Gradient and Laplacian. A leadfield matrix G was computed using the OpenMEEG software. A baseline covariance matrix Σ B was estimated from pre-stimulus data, and used for data pre-whitening, and projection onto the subspace spanned by eigenvectors with significant eigenvalues.
V. CONCLUSIONS We described in this paper sgw-SBL, a spatial waveletbased method to the MEG inverse problem, where sparsity is enforced in the spectral graph wavelet domain via a sparse Bayesian learning approach. The goal is to estimate spatially extended brain activity, with quantitatively relevant amplitude. Numerical results on simulated data show that sgw-SBL indeed achieves the best results when the spatial extent of the brain activity is large enough, and even comes as a close second behind MCE for smaller support activity, which are generally better accounted for by approaches favoring more classical spatial sparsity. Such results, well known in image processing, seem to remain true in the non-standard setting considered here (spectral graph wavelets). Due to space limitation, we restricted the discussion to a limited set of methods.
SQUAD The second contribution of our work is SQuad, an optimallyresilient partially synchronous Byzantine consensus protocol with (1) O(n 2 ) worst-case communication complexity, and (2) O( f • δ) worst-case latency complexity. The view core module of SQuad is the same as that of HotStuff; as its view synchronizer, SQuad uses RareSync. The combination of HotStuff's view core and RareSync ensures that C = O(n) and S = O(n 2 ). By the aforementioned complexity formula, SQuad achieves n • O(n) + O(n 2 ) = O(n 2 ) communication complexity. SQuad's linear latency is a direct consequence of RareSync's ability to synchronize processes within O( f • δ) time after GST.
RARESYNC This section presents RareSync, a partially synchronous view synchronizer that achieves synchronization within O( f • δ) time after GST , and has O(n 2 ) worst-case communication complexity. First, we define the problem of view synchronization (Sect. 4. 1). Then, we describe RareSync, and present its pseudocode (Sect. 4. 2). Finally, we reason about RareSync's correctness and complexity (Sect. 4. 3) before presenting a formal proof (Sect. 4. 4).
Proof of correctness In order to prove the correctness of RareSync, we need to prove that RareSync ensures the eventual synchronization property (Sect. 4. 1). We start by establishing some basic properties of Algorithm 2. These are encapsulated by several lemmas (specifically, Lemmas 1-8) which can be verified by simple visual code inspection. As such, we summarize them here but delegate their formal proofs to Appendix B. First, notice that the value of view i variable at a correct process P i is never smaller than 1 or greater than f + 1. Lemma 1 Let P i be a correct process. Then, 1 ≤ view i ≤ f + 1 throughout the entire execution. It is also ensured that, if an invocation of the measure(•) method on dissemination_timer i produces an expiration event, the expiration event immediately follows the invocation in the timer history h i of a correct process P i.
QUAD Quad is a partially synchronous Byzantine consensus protocol satisfying the weak validity property: • Weak validity: If all processes are correct, then a value decided by a process was proposed. Quad achieves (1) quadratic communication complexity, and (2) linear latency complexity. Interestingly, the Dolev-Reischuk lower bound  [6]  does not apply to Byzantine protocols satisfying weak validity; hence, we do not know whether Quad has optimal communication complexity. As explained in Sect. 5. 3, we accompany Quad by a preprocessing phase to obtain SQuad. Quad (Algorithm 3) uses the same view core module as HotStuff  [13] , i. e. , the view logic of Quad is identical to that of HotStuff. Moreover, Quad uses RareSync as its view synchronizer, achieving synchronization with O(n 2 ) communication.
Proof overview The agreement and weak validity properties of Quad are ensured by the view core's implementation. As for the termination property, the view core, and therefore Quad, is guaranteed to decide as soon as processes have synchronized in the same view with a correct leader for = 8δ time at or after GST. Since RareSync ensures the eventual synchro-Algorithm 3 Quad: Pseudocode (for process P i )  O( f • δ). As for the total communication complexity, it is the sum of the communication complexity of (1) RareSync, which is O(n 2 ), and (2) the view core, which is also O(n 2 ). The view core's complexity is a consequence of the fact that: • Each process executes O(1) epochs between GST and the time by which every process decides,.
Acknowledgements The authors would like to thank  Gregory Chockler  and  Alexey Gotsman  for helpful conversations. Funding Open access funding provided by  EPFL Lausanne. This work was supported in part by the  Hasler Foundation  (# 21084 ), by  Singapore MOE  grant  MOE-T2EP20122-0014 , and by the  ARC Future Fellowship  funding scheme (# 180100496 ).
Experimental Evaluation We have implemented a prototype that takes as input a GTA, as given in Definition 1, and applies our reachability algorithm, in the open source tool Tchecker  [29]. To do so, we extend Tchecker to allow clocks to be declared as one of normal, history, prophecy, or timer, and extend the syntax of edges to allow arbitrary interleaving of guards and clock changes (reset/release). Our tool, along with the benchmarks used in this paper, is available and can be downloaded from https://github. com/EQuaVe/GTAReach. We present selected results in Table  1 , with further details in  [2]. First, we consider timed automata models from standard benchmarks  [21, 34, 39]. Despite the overhead induced by our framework (e. g. , maintaining general programs on transitions), we are only slightly worse off wrt.
This work was supported by  UMI ReLaX ,  IRL 2000  and  DST/CEFIPRA/INRIA  Project  EQuaVE. S Akshay  was supported in part by  DST/SERB Matrics  Grant  MTR/2018/000744. Paul Gastin  was partially supported by  ANR  project  Ticktac  ( ANR-18-CE40-0015 ).
80 MITOMATICS uses computerized methods to enable accurate, fast and cost-effective analysis of 81 mitochondrial shape and network architecture from confocal fluorescent images acquired from cultured 82 living cells. Three successive versions of this in-house, proprietary software were produced: MitoShape 83 (2 shape descriptors)  (22) , MitoTouch (31 descriptors) (Charrasse et al. , submitted) and the here within 84 described MitoRadar (104 shape descriptors). This software is easy to use and does not require any 85 special skills in computer science or image processing. In contrast to previous versions, numerous.
152 Next, both nucleus and cell channels undergo a normalization process between 0 and 1 utilizing a 153 quantile normalization approach between quantile 1% and quantile 99%. A trained convolutional 154 network (Cellpose uNet)  (23, 24)  is applied to each channel to perform instance segmentation of cell 155 and nuclei. The uNet produces a probability map and a gradient flow which enables the reconstruction 156 of object instances. This method was proven to be effective for cell segmentation of objects with 157 irregular shapes  (25) (26) (27). To reduce computation time, the images are down-sampled to 224 pixels 158 before entering the neural network and are up-sampled post-analysis using nearest neighbors followed   Here, we sought to validate our fully automated image analysis pipeline on rich datasets gathered from 234 cultured live human cells exposed to specific chemicals known to induce either mitochondrial 235 fragmentation (CCCP, Rot, Ant A)  (29) (30) (31) (32)  or mitochondrial hyperfusion (MDIVI-1, M1)  (33, 34).