dataesr/scientific-paragraphs-categorization huggingface dataset:
In a fitness tracking use case, the GATT server is the tracker device (e. g. , wristband) and the GATT client is a smartphone application. The server exposes fitness data, such as heart rate and step count, while the client can periodically query such data. BLE data is exchanged using a hierarchical and object-oriented format defined in  [SIG19, p. 284]. The top-level of the hierarchy is a profile, and it contains a set of services. Each service provides characteristics or other services. A characteristic provides a value field with optional fields, such as descriptors and properties. Each characteristic can be configured with access-control flags (e. g. , read-only, write-only, or read-write). BLE provides pairing and secure session establishment protocols to secure the link-layer. Before exchanging data over GATT, the client and the server can pair to agree upon a long-term pairing key and use it to establish a secure session (e.
Attacker Model Our attacker targets Xiaomi Pairing, Authentication, and Communication protocols as the vulnerabilities in these protocols can be exploited regardless of the hardware and software details of the target tracker and app. In other words, she is looking for Xiaomi-compliant vulnerabilities. The attacker only knows public information advertised by the tracker over BLE (e. g. , the public BLE address of the tracker), and she has no physical access to the target devices. Hence the attacker does not know any pre-shared secret between the victims (e. g. , pairing keys) and cannot tamper with the devices' operating system and firmware. The attacker has four goals: (i) she aims at impersonating the tracker to the app and (ii) the app to the tracker; (iii) she wants to establish a MitM position between the tracker and the app; (iv) she desires to eavesdrop the data exchanged between the tracker and the app.
Protocol Dissector Module Our toolkit, breakmi, includes a protocol dissection module capable of speaking Pairing v1/v2, Authentication, and Communication protocols (presented in Section 3). The dissectors module can detect and craft any Xiaomi proprietary message given a capture. We develop the dissectors as an aid for RE. We implement the module defining fifteen custom dissection classes for scapy  [BtSC21] , an interactive packet manipulation program. Each class encodes a message type using a specific binary layout. the packet contains a leading 0100 and then Key. Pairing v1/v2 messages are managed by Xiaomi's custom Auth GATT characteristic (00:00:00:09:00:00:35:12:21:18:00:09:AF:10:07:00), which can be found under Xiaomi's custom GATT service 0xFEE1. The dissectors extract capture packets with Pyshark [New21], a Python API for Wireshark  [Wir21] , and label them as v1 or v2.
For Pairing v2, they also look for the Signature transmitted on Xiaomi's custom Chunked Transfer characteristic (00:00:00:20:00:00:35:12:21:18:00:09:AF:10:07:00), under Xiaomi's 0xfee1 service. The Auth characteristic also serves Authentication messages. The dissectors monitor the status of Authentication and the challenge-response. In our experiments, we crafted Authentication messages with different opcodes and noticed that MB 4/5/6 accept opcodes used by MB 2/3, as shown in Table  2. The Communication protocol involves several characteristics, but we focused on the standard Heart Rate Measurement (00:00:2A:37:00:00:10:00:80:00:00:80:5F:9B:34:FB) and the custom Steps (00:00:00:07:00:00:35:12:21:18:00:09:AF:10:07:00). The dissectors decode the custom data format and display the effective value transmitted from the tracker to the app.
Attacks Module The OTA tracker impersonation attack, presented in Figure  6 , was implemented using Bleno  [Mis21a] , an open-source BLE peripheral written in Node. js. Our Bleno script imitates any Xiaomi tracker by exposing the same BLE features (e. g. , BLE advertisements and GATT server) collected by an extensive study of legitimate Mi Band 2/3/4/5/6, as shown in Table  6  and Table  7  in the Appendix. It was challenging to collect this information from all trackers and make sense of the (proprietary) characteristics and services exposed by the trackers. Once a victim app finds our Bleno tracker, we can complete Pairing v1 and Authentication as a trusted device, and we expose a malicious GATT server to the app during Communication. The OTA app impersonation attack, presented in Figure  7 , was implemented using Noble  [Mis21b] , an open-source BLE central, and by re-using the tracker impersonation described above.
Android classifies these permissions as normal, so they are granted during installation without triggering any user prompt. SB eavesdropping and SB app impersonation utilize the same setup that periodically checks active BLE connections using Android getConnectedDevices API and waits for a Xiaomi tracker to appear. As soon as a tracker connects, the malicious app launches the attack. During SB eavesdropping, our app subscribes to relevant characteristics and can eavesdrop on all BLE data coming from the tracker, including sensor readings, commands, pairing key seeds, and authentication challenges. During app impersonation, our app starts a new pairing session with the tracker by sending a Pairing Init without disrupting the communication between the tracker and the legitimate app. The malicious app eventually negotiates a new pairing key as in the right part of Figure  8  and gains access to protected data.
Evaluation This section describes the evaluation of the attacks (presented in Section 4) using breakmi (described in Section 5). Our evaluation confirms that all Xiaomi trackers since 2016 and the most recent version of Xiaomi companion apps are vulnerable to our protocol-level attacks. In addition, it proves that breakmi works in practice and is cheap to deploy. As a result, millions of Xiaomi users are potential targets, and their sensitive health and personal data can be leaked and manipulated by bad actors.
Since Android 12 was recently released in October 2021, statistical market share data is not available yet. We highlight that, up until Android 11, our attacks only ask for standard Bluetooth permissions as a requirement to access the getConnectedDevices method (that we exploit). Android 12 introduces the BLUETOOTH_CONNECT dangerouslevel runtime permission, which must be declared to access getConnectedDevices. As a consequence, on Android 12, our malicious app must show the user a Nearby Devices dialog that explicitly states our intent to find, connect to and determine the location of nearby devices.
In our evaluation, we successfully attacked all Xiaomi trackers released since 2016 (e. g. , MB 2/3/4/5/6, Cor 2) and the up-to-date versions of the Mi Fit (v 4. 8. 1) and Zepp (v 5. 9. 2) companion apps. We also positively test our remote attacks on six popular Android versions (i. e. , Android 6/8/9/10/11/12), covering at least 90. 22% of Android devices in the market, according to  [Sta21]. We develop breakmi, a modular toolkit that automates RE experiments and attacks. breakmi includes protocol dissector, security mechanisms, and attacks modules. It is based on open-source software and requires cheap and available hardware. We test our toolkit on the Xiaomi ecosystem, and we extend it to also work on Fitbit. We will open-source breakmi. We propose five effective countermeasures that fix the presented vulnerabilities and attacks.
Acknowledgements We thank our anonymous reviewers for their constructive feedback. This project has received funding from the  European Research Council (ERC)  under the European Union's  Horizon 2020 research and innovation program  (grant agreement No. 850868 ) and  DARPA  under  HR001119S0089-AMP-FP-034. Any opinions, findings, and conclusions or recommendations expressed in this material are those of the authors and do not necessarily reflect the views of our sponsors.
Note that the four LEDs are successively activated by the MCU. They are illuminated at a period of 4 ms and operate in pulsed mode with a reduced high state (10 μs) in order to minimize consumption and heating. Thus, we have 1 kSps for each wavelength on both photodetectors with an additional measurement of darkness, when no LED is active. After reception, offline analysis of signals was performed with MATLAB, Math-Works, on the base station to improve the data quality and extract relevant information, which are for us ENG, Breath Rate (BR), Heart Rate (HR), the chromophore concentration changes (Δ[X]) and the oxygen level evolution (ΔSpO2). In particular, high-order filters were used to improve the Signal-to-Noise Ratio (SNR), while minimizing group delay and with flat response in the passband, which could deform the signals' shape  [20].
After reception, offline analysis of signals was performed with MATLAB, MathWorks, on the base station to improve the data quality and extract relevant information, which are for us ENG, Breath Rate (BR), Heart Rate (HR), the chromophore concentration changes (∆[X]) and the oxygen level evolution (∆SpO 2 ). In particular, high-order filters were used to improve the Signal-to-Noise Ratio (SNR), while minimizing group delay and with flat response in the passband, which could deform the signals' shape  [20]. As illustrated by Figure  7 , from raw signals, ENG is directly observed after High-Pass Filter (HPF). It is a 2000-order Hamming Finite Impulse Response (FIR) with a cut-off frequency of 100 Hz. Additional LPF has no positive effect on parasitic signals and intrinsic noise. Concerning PPG signals, the pre-processing to obtain the BR only requires the removal of the Direct Current (DC) component.
The electrostimulation system used was a STIMOLA device, from Biopac ®. It is controlled using the AcqKnowledge 5. 0 software and monitored in parallel with our system by the data acquisition system MP36R of Biopac ®. The pulse trains were pre-programmed to deliver current pulses of 10 mA lasting 100 µs under 1 V, with rise and fall times of 20 µs and a minimum deviation of 3 ms between two successive pulses.
Physiologically, signals measured in transmission mode ensure the majority of the photons go through all the vascular network of the SC section and capture an informative depth-related BF signal from the spine, contrary to the reflection signals. Indeed, the results confirm this observation with a greater pulsatile response. This characteristic gives a higher SNR when considering the AC portion for feature extraction (HR, blood pressure, respiration). Moreover, in our study, special care had to be taken to reduce the autoglare by using 3D printed windows. The problem of self-glare was taken into account in the design of this reflection probe. For this, we used 3D printing technology to manufacture a mask, with custom windows, designed with the FreeCAD ® software (Figure  5C ). The height of this optical mask is a crucial parameter in the performance of such a device.
Acknowledgments: The authors also would like to thank  J. Zyss , neurophysiologist at APHP and the CRBM team of ENVA:  M. Manassero ,  B. Lecuelle  and  T. Lilin , for the numerous discussions and assistance during the animal experimentation. We also thank  S. Viateur  at  Polytech Sorbonne  and  A. Rhouni  at  LIP6  for their help in the design of the prototype.
MFM digital system To improve the performance of measurements, the reproducibility of evaluations and patient participation, and after a to long time collaborative work with therapists, an MFM digital system, based on accessible technologies, is proposed to therapists  (Coton et al. , 2017). The system is developed along four research axes: (1) the choice of a 3D motion sensor, (2) the development of software on a Tablet for the assessment of fine motor skills, in 2D, (3) the proposal of a playful environment (serious game) to motivate the young patients during the evaluations and (4) proposals to integrate the tool into the current practices of the therapists. This working context suggests the use of a user-centred design approach (UCD), in which therapists and patients are asked to express their needs at each stage of the design process: As results (Figure  4 ), the Microsoft Kinect sensor was chosen as the best low-cost 3D motion sensor adapted to the observation needed (controlled on a tablet with the KiMe2 software).
Technical implementation of serious game The animations developed for tablet support have been implemented on Animaker and Adobe Premiere Pro / Adobe After Effects software. Animaker is a freemium (partially free), cloud-based DIY (Do it yourself) video animation software (availability of computer system resources on demand) that allows users to create animated videos using characters and models pre-created. Adobe Premiere Pro is video editing software, and After Effects is graphics animation, visual effects, and digital composition software. These last two software are often used together for reasons of complementarity of functions. The animations related to the three items 18, 19 and 22 were implemented individually, with a focus on the actions proposed in the scenario and the visual and audio feedbacks associated with the story.
The MFM items which assess all body movements require a different approach to animation development than tablet development. In the digital environment offered to the patient, a main actor must therefore be defined. It represents the patient in the contextual environment through the game scenario. To implement the items associated with the motion sensor, the Blender software was used. Interfaces developed into the MFM-animation for items 22 and 23. Thanks to a digital scoring sheet designed from the current scoring sheet (Figure  2 ), the physiotherapist can control all the components of MFM Digital tool (Figure  4 ), score the items in real time, using or not the automatic score proposed by and KiMe2 and manage animations and feedbacks. 7. Discussions  (Lv et al. , 2017)  proposed an assistive tool that employs serious games as the attractive logic part, and running on the tablet with normal microphone and/or Kinect2 as voice input device.
As for the adaptability of the game, a database of global patient profiles was not developed yet. A request from therapists is the development of stories, scenarios and characters adapted to each age group and each gender. Complementary to this, an objective is also to create levels of challenges corresponding to the motor capacities of the patients. Instructions and demonstrations would be functions of the scores achievable by the patient. This step is imagined relatively complex in terms of movements modelling, because it is quite variable and specific to patients and their pathologies. Design principles have been proposer based on the MFM context. The majority of serious games are developed for patient rehabilitation. Designing serious game for patient rehabilitation or for evolution diseases assessment is very different.
0  31  and shotgun sequenced all libraries (initial and captured) using the Illumina HiSeq 4000 and NovaSeq 6000. A total of 16,882,114,068 reads were sequenced, which after adaptor trimming, filtering for ≥30 bp and a minimum phred quality of 30 and duplicate removal resulted in 2,873,998,429 reads. These were analysed for k-mer comparisons using simka  32  (Supplementary Information, section 6) and then parsed for taxonomic classification using competitive mapping with HOLI (https://github. com/miwipe/ KapCopenhagen. git), which includes a recently published dataset of more than 1,500 genome skims of Arctic and boreal plant taxa  33, 34  (Methods and Supplementary Information, section 6). Considering the age of the samples and thus the potential genetic distance to recent reference genomes, we allowed each read to have a similarity between 95-100% for it to be taxonomically classified using ngsLCA  35.
The metaDMG (v. 0. 14. 0) program  36  was subsequently used to quantify and filter each taxonomic node for postmortem DNA damage for all the metagenomic samples (Methods). This method estimates the average damage at the termini position (D-max) and a likelihood ratio (λ-LR) that quantifies how much better the damage model (that is, more damage at the beginning of the read) fits the data compared with a null model (that is, a constant amount of damage; see Supplementary Information, section 6). We found the DNA damage to be highly increased, especially for eukaryotes (mean D-max = 40. 7%, see Supplementary Information, section 6). From this we set D-max ≥25% as a filtering threshold for a taxonomic node to be parsed for further downstream analysis as well as a λ-LR higher or equal to 1. 5.
org/), but these were only distinguished to family level in the pollen analysis and only one Poaceae macrofossil was found. There were 24 taxa that were recorded only as DNA. These included the boreal tree Populus and a few shrubs and dwarf shrubs, but mainly herbaceous plants. Of the 73 plant genera recovered as macrofossils  10, 15  , only 24 were not detected in the DNA analysis. Because macrofossils and DNA have similar taphonomies-as both are deposited locally-more overlap is expected between them than between DNA and pollen, which is typically dispersed regionally  44. Nine of the taxa absent in DNA were bryophytes, probably owing to poor representation of this group within the genomic reference databases. Furthermore, the extinct taxon Araceae is not present in the reference databases.
Mitochondrial reads assigned to Cricetidae cover only one informative transversion SNP, which places them as deriving from the subfamily Arvicolinae (voles, lemmings and muskrats) (Extended Data Fig. 6 ). For the only avian taxon represented in our dataset-Anatidae, the family of geese and swans-we found a robust basal placement to the genus Branta of black geese, supported by three transversion SNPs with read depths ranging between two and four (Extended Data Fig. 5 ). The refined vertebrate assignments based on mitochondrial references are more biogeographically conserved than for plants. Dicrostonyx-specifically Dicrostonyx groenlandicus (the Nearctic collared lemming)-is the only genus of the Cricetidae native to Greenland today, just as Rangifer-specifically Rangifer tarandus groenlandicus (the barren-ground caribou)-is the only member of the Cervidae.
Ancient DNA from marine organisms The other metazoan taxa identified in the DNA record were a single reef-building coral (Merulinidae) and several arthropods, with matches to two insects-Formicidae (ants) and Pulicidae (fleas)-and one marine family-Limulidae (horseshoe crabs). This is somewhat unexpected, given the rich insect macrofossil record from the Kap København Formation, which comprises more than 200 species, including Formica sp. The marine taxa are less abundant than the terrestrial taxa, and no mitochondrial DNA was identified from marine metazoans. The read lengths, DNA damage and the fact that the reads assigned distribute evenly across the reference genomes suggests that these are not artefacts but may be over-matched DNA sequences of closely related, potentially extinct species within the families that are currently absent from our reference databases owing to poor taxonomic representation.
3° and of the antiscatter slit 3°. Primary and secondary Soller slits had an opening of 2. 5° and the opening of the detector window was 2. 71°. For the Rietveld analysis, we used the Profex interface for the BGMN software  66, 67. The instrumental parameters and peak broadening were determined by the fundamental parameters ray-tracing procedure  68. A detailed description of identification of clay minerals can be found in the supporting information.
To increase resolution and sensitivity of our taxonomic assignment, we supplemented the RefSeq (92 excluding bacteria) and the nucleotide database (NCBI) with a recently published Arctic-boreal plant database (PhyloNorway) and Arctic animal database  34  as well as searched the NCBI SRA for 139 genomes of boreal animal taxa (March 2020) of which 16 partial-full genomes were found and added (Source Data 1, sheet 4) and used the GTDB microbial database version 95 as decoy. All alignments were hereafter merged using samtools and sorted using gz-sort (v. 1). Cytosine deamination frequencies were then estimated using the newly developed metaDMG, by first finding the lowest common ancestor across all possible alignments for each read and then calculating damage patterns for each taxonomic level  36  (Supplementary Information, section 6).
Marine eukaryotic metagenome We sought to identify marine eukaryotes by first taxonomically labelling all quality-controlled reads as Eukaryota, Archaea, Bacteria or Virus using Kraken 2  76  with the parameters '--confidence 0. 5 --minimum-hit-groups 3' combined with an extra filtering step that only kept those reads with root-to-leaf score >0. 25. For the initial Kraken 2 search, we used a coarse database created by the taxdb-integration workflow (https://github. com/aMG-tk/taxdb-integration) covering all domains of life and including a genomic database of marine planktonic eukaryotes  63  that contain 683 metagenome-assembled genomes (MAGs) and 30 single-cell genomes (SAGs) from Tara Oceans 77 , following the naming convention in Delmont et al. 63  , we will refer to them as SMAGs. Reads labelled as root, unclassified, archaea, bacteria and virus were refined through a second Kraken 2 labelling step using a high-resolution database containing archaea, bacteria and virus created by the taxdb-integration workflow.
We used the same Kraken 2 parameters and filtering thresholds as the initial search. Both Kraken 2 databases were built with parameters optimized for the study read length (--kmer-len 25 --minimizer-len 23 --minimizer-spaces 4). Reads labelled as eukaryota, root and unclassified were hereafter mapped with Bowtie2 78 against the SMAGs. We used MarkDuplicates from Picard (https://github. com/broadinstitute/picard) to remove duplicates and then we calculated the mapping statistics for each SMAG in the BAM files with the filterBAM program (https://github. com/ aMG-tk/bam-filter). We furthermore estimated the postmortem damage of the filtered BAM files with the Bayesian methods in metaDMG and selected those SMAGs with a D-max ≥ 0. 25 and a fit quality (λ-LR) higher than 1. 5. The SMAGs with fewer than 500 reads mapped, a mean read average nucleotide identity (ANI) of less than than 93% and a breadth of coverage ratio and coverage evenness of less than 0.
Comparison of DNA, macrofossil and pollen To allow comparison between records in DNA, macrofossil and pollen, the taxonomy was harmonized following the Pan Arctic Flora checklist  43  and NCBI. For example, since Bennike (1990)   18  , Potamogeton has been split into Potamogeton and Stuckenia, Polygonym has been split to Polygonum and Bistorta, and Saxifraga was split to Saxifraga and Micranthes, whereas others have been merged, such as Melandrium with Silene 40. Plant families have changed names-for instance, Gramineae is now called Poaceae and Scrophulariaceae has been re-circumscribed to exclude Plantaginaceae and Orobancheae  80. We then classified the taxa into the following: category 1 all identical genus recorded by DNA and macrofossils or pollen, category 2 genera recorded by DNA also found by macrofossils or pollen including genus contained within family level classifications, category 3 taxa only recorded by DNA, category 4 taxa only recorded by macrofossils or pollen (Source Data 1).