dataesr/scientific-paragraphs-categorization huggingface dataset:
Training models not only require large datasets, but are also in need of constant updates both to the ML APIs as well as the data itself. As Chen et al. note, the predictive performance of ML APIs can grow "significantly worse over time" even when they rely on the same datasets. 30 Routine updates both to the API (by the cloud-based provider) and the training data are crucial to the model's effective performance. Unfortunately, such a highly dynamic environment also increases the chances for MITM attacks that may be carefully disguised as API updates or requests for new data. Cloud service providers have been criticized in the past for considering security as an "externality," and shifting the loss from cyber attacks on to the users. 31 If they adopt the same approach with respect to ML APIs, especially those that 'call' public infrastructure, states may be constrained to address cyber attacks on their infrastructure and AI-enabled services quickly and effectively.
Background Among developing countries and middle powers, Brazil stands out as a pioneer in the 'informatization' of national healthcare services. Brazil's Unified Health System (SUS), a universal healthcare program established in 1988, is among the largest of its kind in the world. 33 Since 1993, Brazil has created several specialized national databases pertaining to vaccinations, cancer screening and treatments, infectious disease surveillance, movement of restricted drugs, patient visits, and social security benefits. However, it has struggled to digitize these databases and make them interoperable across sectors and healthcare providers. 34 Consequently, private players have stepped in to build their own algorithms for data retrieval and linkage from these databases. Given some of these databases have no anonymization features, 35 the involvement of private actors has raised concerns around privacy and cybersecurity.
The Guidelines call on software developers to ensure, among others: 55 a Use of proper authentication protocols, both at the device and API levels; b Development of "layered authorization models" to differentiate privilege levels for users and devices; c Encryption for data at rest and transit; and d Deployment of network monitoring and intrusion detection systems. Notably, the Guidelines also specify regulatory requirements for AI-enabled medical devices and services. AI/ML services that rely on 'static' datasets as well as continuous learning are required to submit descriptions of data attributes, labels, training models, built-in audit processes, and security features, prior to their registration with Singapore's Health Sciences Authority.
Through the creation in 2017 of a centralized API Exchange (APEX), Singapore brought its 'whole-government' APIs under an umbrella framework. APEX allows government agencies to share data with each other as well as the broader public, allowing, for instance, private services to retrieve user data previously authenticated by the state, or citizens to submit governance proposals that are then channeled to the appropriate entity. 59 Given its extensive interface with government portals and sensitive data, agencies and third parties are required to undergo a training session and test application-layer security protocols before APEX onboarding is complete. 60 ore pertinent to the context at hand, Singapore has also created a portal called 'data. gov. sg' that offers third parties access to public datasets through APIs.
61 Set up in 2011, the portal was criticized in its initial years for being a "data dump" of files in PDF and CSV format that had to be manually downloaded. 62 In recent years, it has undergone a comprehensive transformation, and while data files may still be downloaded, it is through APIs that the outside world engages with 'data. gov. sg. ' Most importantly, the portal also makes available APIs that allow for the retrieval of real-time data in such domains as meteorology and transport. 'Data. gov. sg' hosts over 100 datasets pertaining to health. 63 These include data on infectious disease prevalence, incidence of cancer among the population, preventive health screening results, prevalence of so-called 'lifestyle' diseases such as hypertension, diabetes, cholesterol and obesity, hospital facilities and physicians by secondary and tertiary sectors, immunization statistics, and of course, COVID-19-related information.
"  68 lthough the Guidelines are notable for their level of detail and specifications with respect to cybersecurity as well as algorithmic decision-making, it is unclear how its non-binding recommendations will be enforced by the Singaporean government. The AIHGle recommends developers and implementers enter into Service Level Agreements (SLAs) that demarcate their respective responsibilities for the training and implementation lifecycle. 69 iven the Guidelines are only a few months old at the time of writing, it is not clear how they apply to health data retrieved through 'data. gov. sg,' especially in the case of dynamic datasets. Notably, the Singapore government uploaded 40 health datasets onto the portal two weeks after the AIHGle was published, perhaps ref lecting its interest in leveraging public data to promote AI/ML innovation.
Examples include the Unified Payments Interface (a common railroad for instantaneous money transfers domestically), the Bharat Bill Payment System (an API-driven gateway for utilities payment), the Goods and Services Tax Network (for collecting GST accrued to both the federal and local governments), etc. 71  Since 2017, following its publication of a National Health Policy, the Indian government has sought also to incubate a "federated national health information architecture to roll out and link systems across public and private healthcare providers. "  72 In 2018, India published a strategy paper on a National Health Stack (NHS), described as a "collection of cloud-based services" that run on open and interoperable APIs. 73 The strategy paper also mooted the creation of a digital health ID, a unique identifier that would allow Indian citizens to not only obtain longitudinal health records from a federated database, but also share it with healthcare providers anywhere in the country.
APIs, AI insecurities, and middle power diplomacy The middleware architecture proposed or implemented by Brazil, Singapore, and India to digitize health data and render it available for training AI/ML models reveals the extent to which developing countries are reliant on APIs. Indeed, the three 'models' presented in this chapter are likely to be adopted by others states to jumpstart the development of AI-enabled services not only in health but also other sectors. States that have already made significant strides towards digitizing public datasets may opt, like Singapore, to make such data available via APIs but leave the selection of data and training of ML models to third parties. Those countries that have lagged behind in digitization may develop APIs to facilitate the standardized input of electronic records and the integration, subsequently, of national databases, as Brazil has done.
In such cases, the respective entities responsible for digitizing health records may offer secondary APIs to facilitate third-party access. In yet other cases, states may not only standardize the creation of electronic records but lay down strict policies and technical specifications -as India proposes -to determine how such data is shared with public and private actors alike. All three approaches present security concerns for AI/ML services that may be exploited by strategic adversaries. Developing countries that make datasets available for third-party use may not have the regulatory capacity of a small, and relatively wealthy country like Singapore to monitor or enforce guidelines like the AIHGle. The use of APIs available on 'data. gov. sg' is governed by Terms of Service under Singapore's Open Data License, which not only restrict the use of such APIs to specific purposes but also prohibit downstream sub-licensing by third parties.
81 The Singapore model places a lot of trust in self-regulation by the market. For most emerging markets, however, a strong cybersecurity or data protection regulator is essential to monitor malicious ICT activity, because an infant private sector may have even lesser resources than the state to mitigate them. Cyber attacks by state or state-sponsored actors could specifically target API vulnerabilities to manipulate or destroy information in public databases, with a view to compromising AI-enabled services that rely on them. Additionally, poor API security on the part of private actors could have serious and adverse consequences for the integrity of the same training model data that is subsequently used by other developers for their respective services. Finally, the challenges of securing AI-enabled services grow in complexity when they rely on real-time APIs that provide 'live' data.
At the time of writing, most datasets uploaded onto 'data. gov. sg' are static in nature. But as Singapore (and other countries) develop real-time APIs, regulators will need to find mechanisms that instantaneously identify and remedy serious cyber attacks on dynamic datasets, failing which they may cause lasting and widespread damage on AI-enabled services that rely on the same data. The risks associated with ML APIs and Man-in-the-Middle attacks have already been documented in this chapter, and they apply in particular to the Singapore model. Brazil's API strategy is aimed at integrating electronic health records across the country, and making them available for governments at the federal, state, and local levels. As a result, AI/ML innovation in Brazil and other countries that follow its path may be more decentralized.
Municipalities and local healthcare providers may tie up with research institutions and market actors to pilot AI-enabled services in provinces by granting them access to public data through their own APIs. The challenge inherent in this approach lies in testing and auditing the security of locally developed APIs that grant thirdparty access to national databases. Local governments may not spend as much time and resources reviewing their APIs for security f laws as a national regulator or agency. The cybersecurity of national infrastructure is only as strong as its weakest link. If security considerations are not adequately baked into the design lifecycle of such local APIs, states will be confronted with the same challenges identified above with respect to AI/ML services. India's approach to standardizing electronic records and specifying rules for their sharing via APIs may seem tightly controlled, but presents its own set of problems.
Government control of API design and implementation, even in a democracy, can result in the API development process being opaque and unaccountable to outside stakeholders. Admittedly, this is a problem with the API-fication of public databases everywhere. However, India's wielding of executive power to force the adoption of DPI like Aadhaar  82  and Aarogya Setu, and the non-responsiveness of its bureaucracy to serious security incidents  83  raises the concern that a powerful government apparatus may be less receptive and agile to innovation. Additionally, with the state being the ultimate arbiter of key API decisions such as data labeling and the granularity of data sharing, its unaccountability vis-à-vis the research community and market actors can hamper investigations into security breaches of AI-enabled services.
The three countries whose plans for digital healthcare have been reviewed here not only stand out for contrasting API-led approaches to data sharing with third parties. They are also inf luential middle powers and democracies, whose successes in digitalizing their economies will be closely observed by regional and global actors alike. As they emulate attempts by these countries to open up public databases to third parties, states may, in the process, also replicate poor cybersecurity practices with respect to APIs. Whatever the model, APIs are likely to emerge as vectors of cyber attacks on AI-enabled middleware services in middle powers. The COVID-19 pandemic has accelerated the digital transformation of their economies and societies, but attendant cyber risks have also risen. If the SingHealth system suffered a cyber attack in 2018, API-driven infrastructure in other middle powers, such as India's biometric ID system  84  and Brazil's Conecte-SUS platform  85  already suffered serious breaches during the pandemic.
As governments rush to share data with the market through APIs for AI/ML innovation, they can also open a gateway for malicious actors. Handling as they do large volumes of information, APIs could be used to corrupt strategic information in databases about the demographic make-up of a country. Then there is the possibility of attack on the AI-enabled service itself. The damage caused by cyber attacks on training data and ML models will not only be economic, but political and psychological. Such attacks can erode trust in AI-enabled services among states and societies alike. In sensitive sectors such as health or transportation where real-time data is involved, cyber attacks can have catastrophic consequences, leading to human casualties. How are middle powers likely to respond in geopolitical terms to this middleware dilemma? The first possibility is that middle powers, including those states that have been traditionally reluctant to join alliances or plurilateral security arrangements, may seriously evaluate the possibility of collective measures to defend and even respond to cyber attacks on middleware infrastructure.
Many middle powers are constrained by resources to build serious offensive and cyber capabilities. As a result, they have "over-invested" in publicly observable efforts to build institutional cyber capacity (policies, regulatory agencies, etc. ) with little deterrent effect to show for the same. 86 Were these states to open their databases and middleware infrastructure to AI-enabled services, whose security policies as well as algorithmic models are not always fully transparent, they would have even less control or oversight over their digital networks. To detect, prevent, and mitigate cyber attacks on critical resources, therefore, states may seek assistance from countries with more advanced capabilities. In particular, middle powers may enter into agreements with other states, including Great Powers, to protect their infrastructure from malicious cyber operations.
If purpose and goals are obscured, it is difficult to detect the malware. At the Black Hat USA 2018 conference, IBM researchers presented 'a new breed of highly targeted and evasive attack tools powered by AI' called Deeplocker. 45 The malware 'conceals its intent until it reaches a specific victim' and 'it unleashes its malicious action as soon as the AI model identifies the target through indicators like facial recognition, geolocation and voice recognition. ' 46 What made the Deeplocker malware extraordinary was the complex nature of the neural network that allowed it to conceal information about its target and the purpose deep in the code (hence the name). Moreover, Yu et al. underlines that 'even if the malware had been found, it would be very difficult for malware analysts to determine who or what the malware was searching for.
The observables of LoA ethics are, for any given purpose, the aspects of the design, development and deployment of AI that may lead to un/ethical consequences. It is worth stressing that the purpose is not the function of a specific technological artefact, an artefact with the same function may pose different ethical problems when deployed for different purposes. For example, consider a hypothetical AI image recognition system working on different databases. In one implementation the system may be used to grant access to a facility, while in other it may be deployed to identify targets of the battlefield. While the function -recognising images -of the system remains the same, the purpose changes and with it the ethical implications to consider. The choice to focus on purposes of use rather than on the function of the technology rests on two reasons: the malleability of digital technologies and the goal of the analysis that we provide in this chapter.
Adversarial and kinetic uses of AI When considering the ethical implications of aggressive and kinetic uses of AI for defence and security, the main focus of analysis has been the combination of AI with machinery that can cause lethal harm to humans and destruction to physical objects in a completely autonomous way. However, the use of AI for aggressive and kinetic purposes varies, ranging from automating various functions of a weapon system to systems that follow the pre-programmed instructions of a human, to full autonomy, when the weapons system will identify, select, and engage targets without any human input. Consider for example, a system developed for the Royal Navy called STARTLE 50 which supports human decision making with situational awareness software that monitors and assesses potential threats using a combination of AI techniques.
26 It is unclear if autonomy only refers to "fully autonomous" cyber systems or if advanced automated system could in a sense also be view as autonomous. Fully autonomous systems that could activate and (re)program itself and replace cyber human specialist are far from existing yet 27 and Stuxnet was clearly not one of them. 28 One of the reasons is that great part of cyber activities still need humans and can't be automated, although more and more are. 29 Given the increasingly automation of cyber capabilities and the uncertain point that distinguish automation from autonomy, authors have suggested broader definitions of autonomy. An autonomous system has been described as a system that "generates the rules by which it operates in its environment, and that no other entity generates the rules by which the system operates" 30 or the ability of a system "to perform some task without requiring real-time interaction with a human operator.
Many authors consider that Stuxnet had a certain degree of autonomy. 122 Indeed, due to the specific circumstances, Stuxnet acted on the local network which was not connected to internet and therefore without any direct and external human intervention. It executed critical functions (propagate, identify, infect and control the target, self-update) by itself to achieved its assigned objective. Therefore, the absence of human control as well as its ability to interact with its environment lead to characterize Stuxnet as an autonomous system. This lack of human control is consistent with the previously mentioned example of fully autonomous system definitions provided by some States. Nevertheless, some authors underlined that Stuxnet was not autonomous but rather automated. 123 Indeed, Stuxnet did not act autonomously insofar it merely followed steps programmed into its code to execute human determined objectives.
More broadly, discussions surrounding the characterization of Stuxnet as automated or autonomous illustrates the limits of this semantic debate. The novelty, complexity and variety of tasks executed by Stuxnet have created confusion on its nature and its potential autonomous features. However, whether the system is autonomous or automated, it may lead to critical results and unlawful actions. Therefore, the way the CCW parties will define autonomy will be crucial because it might exclude automated systems that could have unlawful consequences. In any case, regarding the characterization of cyber capabilities as LAWS, whatever the definition of autonomy adopted by the CCW, some cyber systems will always seem capable to fit such definition due to the software based of such systems. If the autonomy is somewhere in a system or a function, it will partly come from the software and therefore linked to cyber characteristics.
With respect to the timing the review should take place, cyber AWS reviewer will have to deal with the recurrent updates of the cyber AWS software, probably more than physical ones. The self-learning and self-adaptative algorithms that may be used in cyber AWS are also of concerns. 174 For instance, if a cyber AWS changes its own code, it should probably be reviewed again. 175 Therefore, a cyber AWS acting without direct human intervention, like Stuxnet, should not have such capabilities because a review would be required but impossible. 176.
Funding information Mariarosaria Taddeo and Alexander Blanchard's work on this article has been funded by the Dstl Ethics Fellowship held at the Alan Turing Institute. The research underpinning this work was funded by the UK Defence Chief Scientific Advisor's Science and Technology Portfolio, through the Dstl Autonomy Programme, grant number R-DST-TFS / D026. This paper is an overview of UK Ministry of Defence (MOD) sponsored research and is released for informational purposes only. The contents of this chapter should not be interpreted as representing the views of the UK MOD, nor should it be assumed that they ref lect any current or future UK MOD policy. The information contained in this chapter cannot supersede any statutory or contractual requirements or liabilities and is offered without prejudice or commitment.
The SAXS signal originates from the Fourier transform of the electron-density profile of the lipid bilayer, so that any electron-density variation is mapped onto the experimental SAXS intensity recorded as a function of the scattering angle. The analysis of SAXS data can be carried out through different levels of approximation. In the simplest approach, which is the most common reported in the literature  (Luzzati, 1968; Guinier, 1963; Feigin & Svergun, 1987; Lindner & Zemb, 2002) , the lipid bilayer thickness and the electron densities of both polar and hydrophobic domains are considered free parameters that can be determined by the best fit to the experimental SAXS curve. However, for many techniques based on scattering, different sets of parameters can lead to a similar SAXS signal. Therefore, some constraints must be imposed on the fitting parameters, for example exploiting the known physicochemical and structural properties of the lipids used.
In particular, we simulate SAXS and SANS profiles for lipid bilayers containing DOPC and DPPC phospholipids and a certain number of laterally correlated SLD inhomogeneities (hereafter referred to as 'islands'), defined as cylindrical entities representing lipid domains, pores, aqueous channel-forming proteins, anchored proteins, or partially immersed or transmembrane proteins, taking into account their SLDs. The resulting SLD inhomogeneity model has been integrated into the GENFIT software  (Spinozzi et al. , 2014) , freely available at https://sites. google. com/site/genfitweb/, and was used to fit the simulated curves. The good agreement between fitted and simulated profiles obtained in the different investigated cases confirms the robustness of the method. The model also includes the possibility of bilayer stacking with no correlation between horizontal and vertical order.
S3 ). As a consequence, a combined SAXS/SANS analysis can give strong support to the structural parameters obtained from lipid-domain-containing bilayers. As an example, we present the consistency of the combined SAXS/SANS data analysis performed by the GENFIT software from a lipid bilayer composed of DOPC: DPPC in a 1 : 1 molar ratio, with input parameters a = 150 A ˚, R 1 = 60 A ˚and g a = 0. 3 (see Fig. 4  and Table  2 ). Note that the output parameters are quite similar to the ones considered as input parameters. -S8. In all cases, the simulations have been done at 3 mM DPPC and with a unique island-island distortion factor g a = 0. 3. Corresponding SANS simulations at x D = 1 are shown in Fig. S9.