dataesr/scientific-paragraphs-categorization huggingface dataset:
Discussion The significant improvement of segmentation results using Dense U-Net model combined with Jerman filter compared to other models in the literature such as FCN  [31] , N-Net  [33] , U-Net++  [34]  indicates that it can segment slightly more complete liver vessel trees, when compared to the two U-Net models (3-D Dense U-Net and MultiRes U-Net). On the contrary, the more complex model MultiRes U-Net does not give the best results; this may be due to the data used for training, especially since this type of model requires a large amount of data to generate the best results but still give good results compared to Long et al. [31] , Milletari et al. [33] , Ronneberger et al. [32] , Zhou et al. [34] , Kitrungrotsakul et al. [16]  methods. However, this model has not been experimented on other databases that contain a large amount of data, due to the large memory requirement, which exceeded the available GPU resources at our local server, but still give improved segmentation, compared to the baseline 3-D U-Net.
One aspect that might limit the performance of the three models when using Zhang and RORPO filters is that these filters add a lot of noise to the images compared to the Jerman and Sato filters. Further, our baseline 3-D U-Net does not show significant difference over the state of the art models Ronneberger et al. [32] , Long et al. [31]  tested on IRCAD dataset, even when we use the vesselness filter. This is due to the sensitivity of this model to the noises that the filters generate, contrary to the (3-D Dense U-Net, 3-D MultiRes U-Net) which show a better distinction of the vessels without really losing information. There are opportunities to improve the results using a larger amount of data with better annotations. As Lamy et al. [22]  noted, the groundtruth of the IRCAD dataset is missing some important vessels that can confuse the networks during the learning process.
± 0. 079   = 1. 4   = 2. 4  = 4  = 1. 0 Sato 0. 275 ± 0. 066   = 1. 4   = 2. 4  = 4 ℎ1 = 0. 3 ℎ2 = 1 Jerman 0. 318 ± 0. 081   = 1. 4   = 3. 0  = 4  = 0. 2 RORPO 0. 384 ± 0. 077   = 60   = 1. 2  = 3  = 0 optimization of the filters parameters over a dataset for a specific area of interest.
Key exchange protocols are a crucial part of the internet-based communication between connected devices in IoT. In this regard, Physically Unclonable Function (PUF) has been an enabler to provide intrinsic highly randomized source for key generation without requiring extra storage components. PUF however, is an unstable source. In that sense, Fuzzy Extractor (FE) methods with Error Correction Code (ECC) are used to ensure reliability of the key value. FE methods incorporate publicly available helper data to recreate an originally enrolled encryption key from the PUF in mission mode. It is crucial to ensure that the publicly available helper data leaks no valuable information from the source key value to allow untrusted parties to recreate the key. Here the adversary's work is to modify the helper data to decrease the entropy of the recovered codes by the ECC, and push the communicating parties in generating the key that is known to the adversary as well.
In this work, we propose to protect helper data via a PUF-based masking mechanism with variable positioning. Masking with variable positioning adds a new fold of complexity for the adversary which is capable to considerably increase the guessing entropy. Our experimental results show that for 256-bit helper data, a 16-bit mask value can increase the guessing entropy by 5 folds against a Reed Muller majority logic vote decoder. Moreover, we show that an increased number of masking such as 4 times a 16-bit masking, can increase the guessing entropy against the same Reed Muller decoding function by 20 folds.
Therefore, PUF response should be used with error correction codes to build robust encryption keys  [4] ,  [6] -  [9]. To utilize SRAM PUF in key generation schemes, a mechanism which enables perfect correction of the unstable output of SRAM cells with zero errors is required such as in  [8] ,  [10] ,  [11]. Early encryption key generation methods based on memory-based PUF such as in  [10]  and  [12] , suggest using fuzzy extractor (FE) to generate an originally enrolled secret key from a noisy PUF response. In these methods a registration phase exists where an original secret key is generated with a helper data. Once the key and the helper data are generated, the key is stored and the helper data is shared publicly to be re-queried by the enrolled device for mutual key generation. Since helper data is assumed publicly available, it is prone to risks of being queried and manipulated by adversarial parties as well  [13] -  [16].
Various Helper Data Manipulation (HDM) Attacks exist which aim either at regenerating the original secret key by modifying the helper data and redirecting it to the PUF-enabled device  [17] , or derive the PUF-enabled device to regenerate a key value that is known to the adversary  [18]. The second type of HDM Attack in fact aims to reduce the entropy of the recovered codes by FE while it uses the modified helper data for code recovery. The lowered entropy is also known to the adversary if he knows what ECC is used on the device. Therefore, with an enumerable number of guesses for the recovered code, the adversary can generate a mutual key same as it is generated on the target device. Several countermeasures have been already proposed to protect PUF-based key generation against specific helper data manipulation attacks  [19] -  [21].
However, these methods are designed either for a specific protocol implementation, or only provide manipulation detection of the helper data. Therefore, the overall security of the helper data remains an open problem since powerful HDM Attacks as we discussed above are able to considerably reduce the entropy of the recovered codewords and bias the key generation on the PUFequipped devices. In this work, we propose helper data masking to increase the guessing entropy for HDM Attacks. We propose using the embedded SRAM PUF as the source of mask value generation. This requires to use again the FE and ECC to build robust mask values which can be regenerated in the mission mode. By using PUF as the source of mask values, we assure first that the randomness of mask values is as high as for the generated secret keys.
We show how masking with variable positioning on helper data can drastically decrease the success-rate of HDM Attacks. The contributions delivered in this work are in the following: 1) Introducing a robust SRAM-PUF-based randomized mask value generation scheme. 2) Introducing helper data masking with variable positioning as a countermeasure against a higher-order HDM Attack where the knowledge of the masking with variable positioning is known. 3) Experimental assessment of helper data masking with variable positioning by reproducing the key generation and HDM Attack proposed in  [18]  in MATLAB. The rest of the paper is organized as follows. In section II the preliminary information of PUF based key generation using FE and ECC, as well as HDM Attack are discussed. In section III, we elaborate on our helper data masking with the proposed variable positioning technique.
In the string, the mask vector is shifted n times from the beginning of the string to be placed in the required address for masking. The output string then can be XORed with the helper data to produce masked helper data. 1 [2] w[2] x 1 [2] s 1 [m] w[m] x 1 [m] x 2 s 2 address checker Ms 1 [i] s 1 [1] s 1 [2] s 1 [m] Following this construction, the address of the target block depends on the true value of the mask vector. In specific, it is depended on the part of the mask vector which the address is extracted from. Moreover, to break the key from a key generation procedure protected with masking with variable positioning, the HDM Attack model needs to adapt as well. In the following we explain the HDM Attack that has knowledge of masking with variable positioning.
C. VULNERABILITY OF MASKING AGAINST HDM ATTACK With the application of masking over helper data, the HDM Attack as proposed by  [18]  will not be applicable anymore to break the key. However realistically, we can assume that at some point the adversary will obtain knowledge that the helper data is masked. We assume here the worst case in which the mechanism of helper data masking with variable positioning is known to the adversary. Thus, the adversary will try at the same time to find a combination of guessable values for the codeword with reduced entropy for mask value regeneration, the position where the mask is applied on the masked helper data, and the codewords with reduced entropy for the regeneration of the encryption key. The key point here is that with reducing the entropy of guessable codeword to break the mask value, the adversary is still faced with the same entropy of guessing the position of the masked region on the helper data.
In other words, since the position of the masked region is dependent on the true value of the mask, its entropy will stay the same even after modifying the helper data by the adversary. In the following, we explain in details the threat model against masked helper data. The new threat model of HDM Attack which is a derivative of Becker's HDM Attack proposed in  [18]  is shown in VOLUME 4, 2016 FIGURE. 4. The primary phase of the new HDM Attack is to modify the mask value. At this phase the adversary first elects an error vector e i and accordingly a X a,i form a reduced set of codewords with k possible codewords, accordingly {X a,1 ,. , X a,k }. The helper data s 2 for the mask value is then XORed with the elected e i and Xa j. At this stage the adversary's modified mask value wa 2 is generated.
wa 2 is then passed into a mask stream generator function which takes in addition an elected Addr i which is a number indicating the position of the mask on the stream. The mask stream is then XORed with the received masked helper data M s. The product of the last XOR is an elected demasked helper data dmsa which goes into a phase two of modification which is similar to that as discussed in section II. B. As can be seen, in this model, two guessing fields in phase 1 are similar to that of phase 2. Specifically, the guessing field for electing an error vector and a codeword. However, an additional guessing field is also needed to elect the address of the mask. Noting that the guessing field for the address of the mask cannot be reduced similar to the guess field for the reduced codewords to elect a Xa i.
This is due to the fact that the address of the masked region depends on the original value of the mask. Recalling that we proposed to define the address space within the mask value itself (e. g. , the first n bits of the mask value). Therefore at any case, the adversary needs to brute-force the guessing of the address value. This means that if a user initially defines a large address space for masking the helper data, the guessing field for the address value on the adversary's side would consequently be large proportionally. We recall that the intention of masking the helper data is for further randomization of the helper data stream. However, at some point, the mask value could result in a neutralized product which could make the masking ineffective. Such a case can appear if the product of the mask vector on the specified region of the helper data would yield a product where the affected codeword(s) of that region are new codewords.
D. DETECTION OF WEAK MASK VECTOR In a noise-free setting for the SRAM PUF source for mask vector generation, the first milestone is the selection of mask vectors. In the specific case against HDMA, not any arbitrary value for a mask vector is secure. Potentially against HDMA, certain values of mask vectors would still allow HDMA the equal chance of success as in the case of no masking, if they fit in the equation brought in  (1). We refer to these mask vectors as weak mask vectors. Against such mask vectors, the adversary can yield success without attempting to demask the helper data. Accordingly, he first queries the server, receiving a masked helper data M s and a verification hash value h. Then, XORs error vector e with the masked helper data to create M sa. Noting that the adversary has no knowledge of helper data being masked.
In XORing a candidate codeword Xa i with M sa, the adversary then creates a predictable PUF response w a which then is passed to Hash function H1 to produce adversary's verification hash value h a. C a ⊂ C ∀c i ∈ C a , ∃m ⇒ m ⊕ c i = c i ; c i ∈ C a (1) On the PUF-enabled device, the pair of M s a and h a are given. Primarily, the helper data is demasked by XORing the locally regenerated mask vector m, and adversary's helper data s a is resulted. Then, the helper data is XORed with captured PUF response w and noisy code x is produced which is then passed to the decoder function to produce recovered codeword x. At this point, the mask vector will be called weak, if the recovered codeword x, assuming to be one of the guessable codewords by the adversary, is itself a combination of the mask vector and a codeword guessable by the adversary.
In this case, after the final XORing of helper data s a and the codeword to generate recovered PUF response, it will result in the same w a computed on adversary's side, which will lead to producing the same verification h a as sent by the adversary to the PUF-enabled device. Therefore at the end, a mutual key will be generated between the adversary and PUF-enabled device, despite using helper data masking to prevent it. There in helper data masking, it would be necessary to avoid considering a potential weak mask vector. Going back to (1) to identify the weak mask vectors, the equation in fact simply suggests that if a candidate mask vector in XORing with a predicable codeword from C a lead to another predictable codeword from the same set, then the mask application on Helper Data is not effective against first order HDM Attack.
Using this alternative equation however, may come with the cost of reducing the chance of graduating a mask vector. To experimentally assess the rate of mask vector rejection in our case, and to see how many candidate mask vectors are rejected according to (1), we took an statistical analyis over each of our SRAM-PUF dataset, considering each one at a time being a source of mask vector generation. Results of this statistical check are brought in Table  1. In comparison, we also brought the statistical analysis of mask vector rejection according to the relaxed equation (2), in Table  2.
IV. THEORETICAL ANALYSIS OF MASKING WITH VARIABLE POSITIONING In theory, one can measure the min-entropy of the PUF responses w 1 and w 2 used for secret key generation and mask vector generation, respectively. Let us first discuss the measurement of uncertainty for an adversary w. r. t to correctly guessing the address of a given masked block within the masked primary helper data. We note that our formulation of the min-entropy is considered in a noise-free case. Let us first denote the probability of masking a subdivision of a given helper data s as P (s) with a given mask vector w 2. We can then define the entropy of the address to a masked sub-division for a given mask vector, H(Addr), as shown in  (3). H(Addr) = x i=1 P (s) i × (log 2 1 P (s) i ) ( 3 ) where x is the number of sub-divisions in the given helper data s that can be addressed for masking.
Noting that in this formulation, we assume that the starting point of the address in the given mask vector w 2 is already known by the adversary. Now we can consider a specification for P (s), by defining the total number of sub-divisions in a given helper data s as x = l k where k is the size of a given mask vector and l is the size of the helper data vector. If we consider that P (s) is equally distributed for all sub-divisions, we can then define the entropy of the address to a masked sub-division for a given mask vector as in  (4). H(Addr) = -log 2 k l (4) we can also develop (4) for cases in which two or more mask vectors are considered. Let us denote in masking with variable positioning, using m mask vectors, the length of the ith mask vector by k i , and the length of the helper data vector by l.
Accordingly, the min-entropy for which we used 1 mask vector to mask a 256-bit helper data would increase by 5. This comprises the min-entropy of mask vector which is 1. Recalling that the maximum probability after error vector is applied to a  [16, 5, 8]  Reed Muller code (w. r. t the notation [n, k, t], where n is the size of the codeword, k is the size of the binary random number and t is the order of the code) with majority logic vote decoder is 1 2 , and the minentropy of the masking address is 4. Likewise for 2 mask vectors and 4 mask vectors to mask a 256-bit primary helper data, the min-entropy is increased by 10 and 20, respectively. We can also define the total min-entropy, which comprises the sum of the min-entropy of PUF response w 1 and min-entropy of masking. We would define it as H ∞ (w 1 , w 2 , Addr): H ∞ (w 1 , w 2 , Addr) = -(log 2 n i=1 M ax(P r _α i )+ log 2 m i=1 M ax(P r _β i ) + log 2 m i=1 k i l ) (7) where M ax(P r _α i ) is the maximum probability of recovering one of the predictable codewords for the i th block of the n blocks of the primary SRAM-PUF response (i.
e. , the source of encryption key generation), during the recovery phase. Noting that this specification of min-entropy is not bound to the limits of the primary specifications of our helper data masking with variable positioning scheme. One for instance can expand the address space of adaptive masking, but should however mind that it will then require more bits of the mask vector to define the address. In a noise-free setting, for S number of available maskable regions on primary helper data, the min-entropy of the HDMA against the key generation scheme would be: H ∞ (w 1 , w 2 , Addr) = -(log 2 n i=1 M ax(P r_α i )+ log 2 m i=1 M ax(P r_β i ) + log 2 ( 1 S ) m ) (8) To theoretically analyze the efficiency of our helper data masking, we compare 3 approaches in strengthening the security of an FE based key generation scheme.
At one approach, the w 1 string is extended without considering to mask the helper data. At another approach, the w 2 string which is the mask value, is extended and the positioning step is defined to be bit-wise. Therefore, the number of possible positions of the mask over the helper data string for w 1 is n -m + 1, where n is the size of w 1 and and m is the size of w 2. The other approach here is to consider for each added extension block for w 2 , the positioning step to be the size of the added block. Therefore, the total number of possible positions of the mask over helper data s would be size of(w 1 ) size of(w 2 ). Given equation (  8   Reed Muller code and a majority logic vote (MLV) decoder. Initially when encoding, the number of possible codewords are 32 given the specification above.
However, as discussed in  [18] , HDM Attack can reduce it to 2 possible codewords after modifying the helepr data. We consider the initial size of the key to be 128 bits. FIGURE. 5a shows the increase in the min entropy for the three approaches with respect to extending the helper data string. It is apparent that the ' FE + masked Helper Data' with 1 bit positioning step size has the lead compared to the other two. The ' FE + masked Helper data' with 16-bits positioning step also has a significant lead compared to the baseline FEs. Recalling that in baseline FE we just increase the size of the w 1 sting which is the source value for generating the encryption key. We can also assess the probability of success of HDM Attack. The probability of success can also be defined as in k i l (9) where M ax(P r _α i ) is the maximum probability of recovering one of the predictable codewords for the ith block of the n blocks of the primary SRAM-PUF response.
And M ax(P r _β i ) is the maximum probability of recovering one of the predictable codewords for the ith vector of the m mask vectors during the recovery phase. In FIGURE. 5b, we can observe the decreasing probability of success for the HDM Attack with respect to extending the helper data string. It can be seen that overall the ' FE + masked Helper Data' with 1 bit positioning step size is the strongest countermeasure. Nonetheless, ' FE + masked Helper Data' with 16 bits positioning step size has a similar characteristic. Nonetheless, both masking approaches seem to be considerably stronger compared to the baseline FE. This suggests ultimately that masking helper data using PUF data seem to be a reliable and strong countermeasure. Thus at the end that considering to use a part of w 1 to construct a w 2 mask value and mask the helper data, can lead to a stronger FE based key generation scheme.
Here the results show that using our helper data masking masking mechanism overall increases the entropy of the codeword. One can observe here that the entropy of codeword after using HDM Attack on decoders such as on SDML soft-decision, where the reliability is not 100%, is considerably high. Therefore the use-case of our masking mechanism, although it adds to the overall entropy, may not be justified for such cases. On the other hand, the increase in entropy is relatively high using our helper data masking mechanism for cases such as Soft Decision Hackett at 100% reliability, Majority Decoding at both 100% and 85% reliability and GMC decoder at 100% reliability. We can assume here that masking helper data can in turn be accounted as an effective countermeasure against HDM Attack where the overall entropy of the codes are low.
C. IMPLEMENTATION OF BECKER HDM ATTACK For our experiments, we used MATLAB to build an emulation of Helper Data based RFE-like construction for PUFbased key generation, and Becker's HDM Attack as the adversary. For the encoding function in registration phase, we used Reed Muller encoding algorithm. For encoding, we use the specification of  [16, 5, 8] (w. r. t the notation [n,k,t], where n is the size of the codeword, k is the size of the binary random number and t is the order of the code). Consequently, the encoded codewords are 16-bits sized. Noting that in this scheme, we use concatenated codes. Thus in an iterative fashion, to construct a helper data s, we XOR a 16-bit codeword x, where x is the encoded codeword of a randomly generated binary number rnd, over the entire PUF response w wherein the size of w should be greater than or equal to 16 bits.
During the registration phase, we also generate a verification hash value h and an encryption key r using the two hash functions H1 and H2, respectively. To create the hash values, we used an existing MATLAB library to generate MD5 128-bits hash values. All the generated data will then be saved for a given SRAM device, for a given memory address. In implementing the recovery phase, we used Reed Muller Majority Logic Vote. Our MATLAB-based implementation of Becker's HDM Attack is the following. The adversary first intervenes in the query of PUF-enabled device, by receiving the query from the device and passing it to the server, and in return, awaits the response from the server, instead of the device (i. e adversary as a man in the middle). After receiving the public data, using the error vector e [0 1 1 0 1 0 1 0 1 1 0 0 0 0 0 0], the adversary builds first his helper data s a by XORing the error vector e with all the sub blocks of the helper data s which the adversary has received from the server.