dataesr/scientific-paragraphs-categorization huggingface dataset:
Performance Analysis in Terms of Accuracy and Robustness Our best AGR system trained conventionally achieves state-of-the-art performance  [2, 30, 41] , of over 99% accuracy for the first two datasets, around 86% in the case of the 24-gestures dataset  [23, 46]  and around 88. 5% in the case of 53-gestures dataset  [55]. A more detailed comparison with other new sEMG-based AGR systems is presented in Table  1  where we show comparisons with other recent works proposing neural-network solutions on the same datasets. Since, in this case, the weights are not guaranteed to be positive, the lower bound introduced in Proposition 2. 2 does not constitute a valid Lipschitz constant. Computing the exact Lipschitz constant θ m of the system is a very difficult task  [18] , but we can easily bound θ m between the estimate given by (  6 ) and the spectral norm of the product of all the weight matrices from the EMG-Based AGR Using Lipschitz-Regularized Neural Networks 26:13 The training time is computed for an epoch, with a batch size=2048.
On the other hand, it can affect its approximation capability and potentially lead to a performance decay. To further study the effect of other regularization techniques from a dual performance-robustness perspective, we trained several models for 1000 iterations using common regularization methods, such as Dropout, 1 / 2 Regularization, and Batch Normalization. Such comparisons were also featured in other works like  [28]. The results for the 7-gesture dataset are summarized in Table  2. As expected, employing regularization techniques during the training phase improves the overall performance of the baseline classifiers. While the positive impact of regularization techniques on enhancing neural network model performance by mitigating overfitting has been extensively researched and validated, the exploration of their influence on system robustness remains an understudied area.
e. , 98. 68%, 97. 21%, 85. 12%, and 87. 03% for the 7-gesture, 13-gesture, 24-gesture, and 53-gesture datasets, respectively. Furthermore, compared with the unconstrained models, we managed to maintain a high performance while improving the robustness with respect to unconstrained training, i. e. , θ m = 1. 02 × 10 11 for the 7-classes dataset, θ m = 9. 96 × 10 10 for the 13-classes dataset, θ m = 4. 24 × 10 11 for the 24-classes dataset, and θ m = 3. 15 × 10 11 for the 53classes dataset. We can however conclude from these tests that imposing the nonnegativity of the weight coefficients is not sufficient to reach satisfactory robustness. To further control the robustness of the systems, we have to manage the Lipschitz constant of the networks by training them under additional spectral norm constraints, as described by Equation  (11).
For comparison, for each of the proposed constraints, we also evaluated the use of an inexact projection, designated by P (see Section 3. 3). It can be observed that using an exact projection yields significantly better results. By combining tight constraints and exact projection techniques, we observe that the robustness of the network can be properly ensured while keeping a good accuracy in both cases. Indeed, we succeeded in ensuring a Lipschitz constant around 1 for a 95% accuracy for the first two datasets. The observed loss in accuracy with respect to a standard training is consistent with the "no free lunch theorem"  [54]. Training neural networks subject to tight spectral norm constraints can be challenging,  3  and the cost of obtaining a good performance is the training time. We used a learning rate scheduler strategy during training, reducing the learning rate by a factor of 2 if the performance does not improve for 1000 epochs.
From this quantity, we can derive an empirical estimate of the standard deviation by multiplying MAD with a factor equal to 1. 4826. The latter estimate is known to be more robust to outliers for Gaussian distributed data, especially EMG-Based AGR Using Lipschitz-Regularized Neural Networks 26:15 in the case of small populations. The results are summarized in Table  4. It can be observed that the empirical standard deviation is below 1. 6% and the robust estimate of it is below 1. 1% for all four datasets. These deviations values are normal considering the size of the dataset and shows that the presented results are relevant and consistent. Next, we have also evaluated how the positivity constraint impacts the overall accuracy of our system. We trained a robust network by allowing the weights to have arbitrary signs.
For this purpose, we control individually the Lipschitz constant of each layer i ∈ {1,. ,m} to be less than a given value ϑ 1/m. The exact projection onto C i , P C i , as well as the approximate one P C i were computed as described previously. In this case, ϑ represents an upper bound on the Lipschitz constant of the system. Table  5  summarizes the results for different values of ϑ , for two datasets. We compare our method for dealing with Lipschitz constraints with the approach proposed in Reference  [51]. This approach, which is implemented in the deel-lip library allows the user to train robust networks in a convenient manner, offering a robustness certificate by performing a spectral normalization for each layer. It can be observed on these datasets that our method yields similar results when using the approximate projection, but better ones when using the exact projection.
Sensitivity to Adversarial Attacks We evaluate our robust model on purposely designed perturbations, by studying their influence on the overall performance of the system. We lead attacks on our best robust model in terms of accuracy and robustness achieving 92. 95% accuracy and a Lipschitz constant ϑ = 0. 87 for the 7gesture dataset. We compare the results with two conventionally trained models: the best one in terms of performance, which achieves 99. 78% prediction accuracy on non-adversarial data, and another one trained to have similar performance as our robust model reaching 92. 99% accuracy on the original test set. To create the adversarial samples, we used some of the most popular attackers, namely: -Fast gradient sign method (FGSM)  [27] -generates adversarial data based on the gradient of the cost function with respect to the input data; -Jacobian Saliency Map Attacker (JSMA)  [44] -computes a perturbation based on 2 distance metric by iteratively selecting the input sample that will increase the chance of missclassification; -Projected gradient descent (PGD)  [39] -uses local first order information about the network to create adversarial examples; -Carlini and Wagner (C&W)  [8] -uses 2 distance to compute the optimal adversarial perturbation.
-Gradient Matching (GM)  [26] -this is a data-poisoning black-box attack. In this case, the attacker does not have access to the victim model parameters, but instead is trying to match the gradient direction for adversarial examples. We also show a comparison with another popular technique of ensuring the robustness of neural network-based models, namely Adversarial training. This implies training an extended version of the dataset, containing the original training data together with a perturbed version of the samples in an effort to increase the system stability against adversarial inputs. Note that this method is purely empirical and gives no theoretical robustness certificates. We implemented an adversarial training strategy detailed in Reference  [39] , training the system using an augmented version of the dataset which was updated every 25 epochs.
The probability of peaks p ∈ [0, 1] is also adjusted to simulate more or less severe scenarios in terms of outliers. From the resulting noisy signals, we extract the features described in Section 4 and pass them to the classifier, using our robust models reaching an accuracy of 92. 95% (ϑ = 0. 87) for the 7gestures dataset, and 93. 05% (ϑ = 0. 98) in the case of the 13-gestures dataset, trained with nonaltered data. We compared the results achieved with our robust training with those obtained with (i) classical training and (ii) adversarial training. In this case, the adversarial training was performed by generating an extended dataset, containing the original data and corrupted versions of them by additive noise following the Gaussian mixture law described above, where the parameters p and α were drawn randomly in a uniform manner on [0.
15, 0. 45] and [0, 2], respectively. In the absence of noise, a similar performance in terms of accuracy was obtained: 7-gestures dataset-92. 99%, and 92. 97%, 13-gestures dataset-93. 03% and 92. 98% for baseline and the adversarial training, respectively. The experimental results obtained on two datasets are depicted in Figure  5. The red, blue, and green lines correspond to the unconstrained, constrained, and adversarial models, respectively. We observe that the constrained model is significantly less affected by the presence of noise in the inputs than the one trained without robustness guarantees. It is also worth noting that training with adversarial inputs also leads to satisfactory results, although usually slightly less accurate. The Lipschitz lower and upper bounds computed for the networks trained in an adversarial manner are indeed much lower than those with standard training, but they remain quite large ((1845.
CONCLUSION This work has shown the usefulness of designing robust feed-forward neural networks for AGR based on sEMG physiological signals. More precisely, we proposed to finely control the Lipschitz constant of these nonlinear systems by considering positively weighted neural architectures. To offer robustness certificates, we also developed new optimization techniques for training classifiers subject to spectral norm constraints on the weights. We studied various constrained formulations and showed that robustness can be secured without sacrificing accuracy when using a combination of tight constraints and exact projections. We also provide several lower-complexity solutions, which reduce the training time significantly. Experiments on four distinct datasets illustrated the good performance of our approach.
We further demonstrated the effectiveness of our robust classifier, compared with classically trained ones, when facing white-box and black-box attacks. We also want to highlight that one of the key advantages of our research was the ability to conduct real-life experiments. This was made possible because we had access to a specialized acquisition module tailored for capturing gesture data. The availability of this acquisition module allowed us to gather real-world gesture data in a controlled setting, which closely mimics practical scenarios. By conducting experiments with real users and their gestures, we could thoroughly evaluate the performance and accuracy of our proposed methodology. This real-life experimentation not only provided us with invaluable insights into the effectiveness of our approach, but also demonstrated its feasibility and potential for implementation in real-world applications.
• The robustness study face to attacks of the proposed schemes, especially when the protection key is known by the attacker. • The qualitative analysis of the proposed scheme according to 11 criteria associated to privacy and security trends. This paper is organized as follows. Section 2 describes the security and privacy threat model we designed for this work. We present in Section 3 the related works in this topic. Section 4 is dedicated to the proposal of the generation method of one-time biometric protected features. Section 5 concerns the experimental protocol and presents the used biometric datasets. Section 6 concerns the validation of the proposed method through a quantitative and qualitative analysis. Experimental results have been obtained on two significant biometric datasets. Finally, we conclude and give some perspectives in section 7.
Security and privacy threat model In this paper, we consider the same environment as the framework proposed in  Huang et al. (2011) , with authentication between a client and a service/identity provider. The authentication is then realized online and not locally on a physical device possessed by the client. This requirement implies a biometric database, which is complex to manage considering privacy. We do not want to encourage the use of a centralized biometric database, but we think that this assumption is realistic. In this case, a strong attention is required on the security of biometric 1 https://fidoalliance. org /specs /biometric /requirements/. data, against external attackers but also against a much too curious or corrupted service provider. The following requirements are expected in most of the strong authentication schemes.
We refer the reader to previous references for technical details. One of the main drawbacks of all these papers is that the mobile is assumed to be secure. The implementation of these algorithms on a secure element is not possible. Sun et al. (2022)  define a face security authentication system based on deep learning and homomorphic encryption. In this case, the identity verification is realized by the identity/service provider while obtaining on the LFW dataset an identification accuracy of 98. 7%. Meden et al. (2021)  propose a very interesting comprehensive review on privacyrelated research in the area of Privacy-Enhancing Techniques (PET) applied to face biometrics. Fig. 1  provides a taxonomy of existing algorithmic solutions for preserving privacy for face recognition. These algorithms can be used at 3 levels: image, representation and inference.
At the image level, the aim is to alter the image sufficiently to preserve privacy while maintaining good recognition performance. At the representation level, we only have the extracted features and not the original capture: the objective is either to extract only non-sensitive information useful for recognition, or to protect the extracted information. At the inference level, we need to prevent the reconstruction of features from the final decision. Liu et al. (2021)  proposed privacy by design solutions for face identification. A cryptographic protocol is used for making privacy query to a database. The identification performance on small face datasets is good (97% of correct recognition) even used face features are eigenfaces (that are well known and provide poor results in general). Performance for user authentication is not given in the paper.
Liu et al. (2022)  propose a privacy preserving solution for face recognition based on federated learning. Given a pre-trained face model, authors aim to simultaneously improve the generic face representation at the server side, and produce an optimized model for each client without transmitting any private identities' images or features from local devices. Wang et al. (2022)  propose a new approach called FaceMAE dealing privacy with deep architectures. This framework generates synthetic samples that reduce the privacy leakage. It also maintains recognition performance simultaneously. Performance on face recognition is very good (99. 2% on the LFW dataset). Recently,  Rathgeb et al. (2022)  proposed a privacy compliant face feature generator based on fuzzy vault. The performance on FERET and FRGCv2 databases (subsets) for authentication is very good (< 1% FNMR at < 0.
Transformation based template protection We focus in this part on biometric template protection schemes based on the transformation of biometric data, called feature transformation  (Ratha et al. , 2001). For more details, we refer the reader to the surveys  (Rathgeb and Uhl, 2011; Nagar et al. , 2010). A feature transformation is a function 𝑓 using a secret key 𝑘 applied to a biometric template 𝑏. During enrollment, the transformed template 𝑓 (𝑏, 𝑘), the reference BioCode, is stored in a centralized database or in a decentralized database as a personal device. During the authentication, the same transformation 𝑓 (𝑏 ′ , 𝑘), the captured BioCode, is performed to the query fresh template 𝑏 ′ with the same key 𝑘. Ultimately, a comparison is realized between 𝑓 (𝑏, 𝑘) and 𝑓 (𝑏 ′ , 𝑘) by verifying if 𝐷 𝑇 (𝑓 (𝑏, 𝑘), 𝑓 (𝑏 ′ , 𝑘)) ≤ 𝜖, where 𝐷 𝑇 is a distance function in the transformed domain, 𝜖 is the threshold value set by the system administrator.
BioHashing algorithm The BioHashing algorithm is a feature transformation defined in  Teoh et al. (2004). The distance 𝐷 𝑇 used to evaluate the similarity between two transformed templates (the reference BioCode and the captured BioCode) is the Hamming distance. This algorithm is generic and can be applied to any biometric modalities, as long as features can be extracted and represented as a fixed-size vector. 𝑡 𝑖 = { 0 if 𝑥 𝑖 < 𝜏 1 if 𝑥 𝑖 ≥ 𝜏, ( 2 ) where 𝜏 is a given threshold, generally equal to 0. The performance of this algorithm is ensured by the scalar products with the orthonormal vectors, as detailed in  Teoh et al. (2008). The projection of the template in a lower dimension (𝑛 ≥ 𝑚) and the threshold binarization ensures the non-invertibility of the data, especially if the secret is unknown.
Datasets In this work, we consider two well-known and largely used common biometric modalities: face and digital fingerprint. Note that the proposed solution can be applied by any biometric modality, as long as features can be extracted in the form of a fixed-size vector, which is becoming increasingly common thanks to deep learning. In this study, we used a large and significant biometric dataset called Labeled Faces in the Wild (LFW)  (Huang et al. , 2007). This database of face photographs has been produced for studying the problem of unconstrained face recognition. The data set contains more than 13,000 images of faces collected from the web. This dataset contains images from 5749 "famous" individuals. Image resolution is low as each sample  We used in this work a dataset from the FVC competition in 2002  (Maio et al.
• We considered two scenarios for testing the robustness of the proposed method. In both scenarios, we assume that the encryption key 𝑆𝑘 is known by the attacker (worst case). In scenario 1, we suppose the impostor does not know the secret/password (ℎ_𝑟 value) and uses its own biometric data (Zero effort attack) to impersonate Bob. In scenario 2, we assume the impostor also knows the ℎ_𝑟 secret value (side-channel attack). In the experiments, we set ℎ_𝑟 to the same value for each user in the dataset, to estimate the performance in this scenario. • We run a simulation with 1000 different values of 𝑅, and therefore also the secret key ℎ_𝑟, to demonstrate the variability of BioCodes for the same individual (privacy protection).
Performance with raw features First, we analyze the performance of raw biometric features without any template protection in a static context. In order to show the capability to discriminate individuals with deep features, we plot in Fig. 9  their projection in 2D. This projection has been obtained by using the t-Distributed Stochastic Neighbor Embedding algorithm (  Van der Maaten and Hinton, 2008). Fig. 9  (a) demonstrates the ability of used face features to distinguish the 5749 individuals in the LFW dataset. We compute first the accuracy of face recognition (identification context) when using deep face features. We use the cosinus distance for the comparison between the reference templates and the probe one. We obtain the accuracy of 98. 97% showing the efficiency of used features. We now consider the authentication context by measuring the EER value equal to 1.
1%. Concerning fingerprint features, we plot in Fig. 9  (c) their projection in 2D with the t-SNE method. This figure demonstrates the ability of used fingerprint features to distinguish the 100 individuals in the FVC2002 DB4 dataset. We compute first the accuracy of fingerprint recognition (identification context) when using the proposed deep fingerprint features. We use the cosinus distance for the comparison between the reference templates and the probe one. We obtain the accuracy of 99. 78% showing the significance of used features. We now consider the authentication context by measuring the EER value equal to 1. 8%. Fig. 10(c ) shows the distribution of legitimate and impostor scores. Fig. 10(d ) presents the obtained ROC curve. These results demonstrate the efficiency of the proposed fingerprint features.
Scenario 2: attack context Now, we consider the scenario 2, i. e. , the impostor knows the secret. In this case, we do the same experiments with the same secret for all users in the dataset. The accuracy for face identification remains  high with 98. 2% and the EER value is 1. 76% in this context. For fingerprints, the accuracy for identification remains high with 99. 6% and the EER value is 3. 3% in this context. Fig. 12(a-c ) shows the distribution of legitimate and impostor scores. Fig. 12(b-d ) presents the obtained ROC curve. Once again, in this scenario, we obtain excellent results. The proposed solution remains efficient even in case of attack.
The results of scenario 2 show that even when the secret key is known, which may be the case if the password and 𝑥𝑜𝑟_𝑟 are known, the scheme is robust. Nevertheless, it should be possible to see directly the password typed during the authentication and consequently the security should not be based on it. Mutual authentication and non-repudiation are not considered in this paper to simplify the design of the scheme. Nevertheless, if it is required, it could be added, for example, with a public cryptographic key (requirement 𝑆 1 ). Finally, it is recommended to the service provider to encrypt the entire biometric database with its own secret key and to decrypt the data only for authentication purpose. This problem is related to database encryption and is not described here. Nevertheless, if the service provider is compromised, the anti-replay token 𝑆𝑘 or the reference BioCode used during the verification step could be compromised (the raw biometric data cannot be recovered anyway).
Security with non compromised secret keys The proposed authentication scheme combines many authentication factors i. e. , two secret keys, a biometric data, a password and a device (a smartphone in our use case). We assume in a first time that the secret keys ℎ_𝑟 and anti-replay token 𝑆𝑘 cannot be compromised. Thus, if the server database is compromised, then an attacker cannot use the reference BioCode, without the knowledge of the secret key, to recover the original biometric data in order to spoof the system. Moreover, the server is not able to recover the biometric data because it does not know the secret key used by the template transformation (requirement 𝐵 5 ). Furthermore, if the authentication data are eavesdropped by an attacker during the authentication step, these data cannot be decrypted by the attacker without the knowledge of the 𝑆𝑘.
Security with compromised factors The security of strong authentication schemes is generally evaluated with an attacker possessing all previous communications between the client and the server and with the knowledge (or the possession) of two and only two factors. The objective of the attacker is to be authenticated by the server or to recover the original biometric data of the client (if unknown). If the attacker, with the knowledge of 𝑃 𝑤𝑑, steals the device and recovers the keys 𝑆𝑘 and ℎ_𝑟 with side-channel attacks or physical attacks on the device, he/she cannot use 𝑆𝑘' to decrypt the previous exchanged data between the client and the server because 𝑆𝑘 has been updated in 𝐻(𝑆𝑙). Consequently, the attacker has no access to 𝑓 (𝑏, ℎ_𝑟) or 𝑓 (𝑏 ′ , ℎ_𝑟) and consequently cannot recover 𝑏 (or 𝑏 ′ ) and cannot be authenticated by the server (recalling that 𝑓 (𝑏, ℎ_𝑟) is not stored on the device).