dataesr/scientific-paragraphs-categorization huggingface dataset:
Second, a set of 17 queries is provided, 14 of them are select queries, 3 are ask queries. The set of queries does not contain construct nor describe queries because they are build upon the core evaluation of select queries with a post-processing step  (Schmidt et al. 2010). Some of them are simple (q1, q2, q3a, q3b, q3c, q8, q9, q10, q11, q12a, q12b, q12c) and some can be considered as more complex (q4, q5a, q5b, q6, q7) because they use various expressions of SPARQL such as union, option and filters. Our implementation parses these SPARQL queries and the RDF files, then translates them into our model. We generated a database with 2 million triples. Tests have been done on an Intel Core i7-1165G7, 16 GB RAM under GNU/Linux Debian 11. 6 with: Apache Fuseki version 4. 7. 0, as a standalone server, with OpenJDK Runtime Environment 11.
0. 18 ; Openlink Virtuoso (Opensource edition) version 7. 2. 8. 3235 ; Corese version 4. 3. 0 (core), with OpenJDK 11. 0. 18 ; Our implementation based on Cogitant version 5. 3. 2, compiled with GNU C++ 10. 2. 1. On the 2 million triples database (Table  1 ), our prototype competes with Virtuoso even if the execution times may vary, sometimes in favor of Virtuoso, sometimes in favor of our CGQL implementation and for most queries, our implementation is faster than Fuseki and Corese. For complex queries, our implementation is the fastest. For simple queries, the efficiency of indexes is the key. Also on this point Virtuoso is very efficient. The execution times are extremely variable depending on the queries, with a ratio of 24 to one (q12b: 0. 03 vs 0. 73). However the results of our CGQL implementation are good and it is the only tool without any execution time that exceeds 15 seconds.
Conclusion We presented in this paper a new way to query conceptual graphs: CGQL. It is a language inspired by SPARQL but remains in the graph model since the query is graphical, the result is graphical and the query operations are performed thanks to graph operations. CGQL answers to three main lacks in the conceptual graph querying method: it is possible to express a "or", to filter values, and to extract specific knowledge from the answer of the query. It is, to our knowledge, the first general query language in the conceptual model that is powerful enough to be compared to SPARQL performances. A formal comparison between SPARQL and CGQL is relevant. This comparison requires first to study similarities and differences between conceptual graphs and RDF, and then to compare SPARQL queries with CGQL queries.
Especially, we found an attack not taken into account in a recently proposed patch  [63] , and proposed a new patch to the developers. This work is a first step in designing efficient program analysis techniques able to take into account advanced attackers. The approach is generic enough to accommodate many common fault models, including the bit flip from RowHammer, test inversion or arbitrary data modification; still, instruction skips or modifications are currently out of reach. Also, while we investigate the bug finding side of the problem (underapproximation), the verification side (overapproximation) is interesting as well. These are exciting directions for future research. Our dataset and benchmark infrastructure are made available through artifact 2  for reproducibility purpose, and the code is open-sourced 3.
Motivating Example The motivating example in Figure  1  is a simple unrolled program inspired by the VerifyPIN benchmark  [42] , from the domain of hardware fault injection and smart cards. The user PIN digits u1 to u4 are checked against the reference digits ref 1 to ref 4, using the accumulator res. The attacker seeks to be authenticated (validate the assert l. 16) without knowing the right digits (l. 14). a s s e r t ( g _ a u t h e n t i c a t e d == t r u e ) ; / * S e c u r i t y o r a c l e * / 17 } Fig. 1 : Motivating example, inspired by VerifyPIN  [42]  Here, the attacker indeed cannot succeed by only crafting legitimate inputs. However, an advanced attacker can leverage more powerful attack vectors to inject faults into the program in order to succeed. For instance, corrupting g_authenticated to true at l.
10 achieves the attacker goal. It could be obtained for example through a physical-or Rowhammer-attack. Program Analysis As expected, standard symbolic execution tools such as Klee  [22] , angr  [84]  or BINSEC  [38]  do not report any violation here, as they consider the simplest possible attacker. We can try to use SWiFI techniques  [76, 15, 20, 63]  (detailed in Section 3. 1) from high-security system evaluation. Yet, the standard forking approach does not scale with multiple faults: here, 166 paths are explored in 0. 6 seconds for 1 fault, 2994 paths in 11 seconds for 2 faults, and it keeps on adding a factor x10 in explored paths and analysis time for each extra fault, until the analysis timeouts (12 hours) above 4 faults. On the contrary, our forkless algorithm presented in Section 5 simulates fault injection without creating new paths and, in this example, shows a constant runtime as the number of faults increases from 1 to 10 -we explore 9 paths in 0.
Background We provide in this section background information on software-implemented fault injection, standard reachability and symbolic execution. SWiFI tools  [28, 76, 79, 15, 49, 25, 20, 50, 63, 68]  have been developed in the community of high-secure systems to ease hardware fault injection campaigns, which are time consuming and require special equipment. SWiFI evaluates a program with the transformations induced by the effects of hardware faults, in order to find interesting attack paths. We distinguish two main SWiFI techniques. First, the Mutant generation approach  [28, 79, 49, 25, 50]  consists in analyzing slightly modified versions of the program (named mutants), each of them embedding a different faulty instruction. Each mutant is then analyzed on its own. The main limitation of mutant generation is the explosion of mutants, in particular for multiple faults.
Modelling Faults via Forkless Encoding The forkless encoding aims to address the path explosion induced by the forking treatment of fault injection in prior works. It is designed mainly for data faults and consists of wrapping arithmetically an assignment right-hand side, as shown in Figure  3  for an arbitrary data fault. The activation of this fault location is determined by the symbolic Boolean value f ault_here, and the corrupted value of x is the fresh variable f ault_value. The point is to embed the fault injection as an expression inside the logical formula, without any explicit path forking at the analysis top-level, in order to let the analyzer reason about both legit executions and faulty executions at the same time -this is akin to path merging in some ways, except that we do it only for the treatment of fault injection (we could also see the approach as avoiding undue path splits).
Implementation We now provide details about our forkless adversarial symbolic execution (FASE) implementation, named BINSEC/ASE, for Adversarial Symbolic Execution. The code is made open-source  7. Binary-level Fault Injection. While our method works for any program abstraction level, we choose to implement it for the binary level, which makes more sense in many security scenarios. We implement our forkless adversarial symbolic execution on top of the BINSEC symbolic engine  [38, 40, 10]. It has already been used in a number of significant case studies  [9, 81, 80, 36, 37] , and it is notably able to achieve bounded verification (k-completeness) and to reasonably deal with symbolic pointers  [44]. We modified the path predicate computation of BINSEC 0. 4. 0 as described in Section 5, and implemented our dedicated optimizations FASE-EDS, FASE-IOD and FASE EDS+IOD.
BINSEC consists of 60kloc of Ocaml and our modifications add 6kloc. The attacker goal is specified as a local predicate to reach, using BINSEC directives. We currently support data faults such as arbitrary modification, bit-flip and reset. Test inversion is emulated through faulting the condition of conditional jumps. We let the user define an injection target range, made of multiple code address intervals. For large programs, it enables focusing on the security critical sections. Finally, we also provide a blacklist for some memory locations which will never be faulted. The blacklist is mostly used for the stack register (esp in x86, which is concretized in the analysis) and the program counter, as our fault model does not include tampering with the stack nor arbitrary control faults. Details.
We added 2 manually unrolled versions of the unprotected VerifyPIN, with a PIN size of 4 and 16, to add diversity in the benchmarks with programs without loops. An oracle is provided by FISSC, checking if the user PIN truly corresponds to the reference PIN. Second, we take the 2 versions of the npo2 program from Le et al. [65] , together with their oracles. Npo2 is a program computing an integer's upper power of two. The attacker's goal is to perform a silent data corruption, i. e. change the end result without triggering countermeasures. One version is vulnerable to one arbitrary data fault, the second is resistant due to extra arithmetic checks. Compilation. The benchmarks are written in C and have been compiled with gcc for the Intel x86-32 architecture, using the flag "-O0" to preserve countermeasures.
For BINSEC compatibility, we use the "-static" flag to include the necessary library functions directly in the binary. BINSEC Settings. We limit the maximal depth of an analysis to the depth necessary to perform an exhaustive non-faulty analysis, rounded to the upper hundred. We exhaustively explore all the possible paths up to this bound and do not stop at the first identified attack, in order to have comparable results. We set the global analysis timeout for 1 day. We fault values and not addresses, we do not directly fault the stack pointer nor the program counter, and we do not fault the status flags unless explicitly specified.
Correctness and Completeness in Practice (RQ1) We first show that our tool works as expected on several codes with known ground truth. (1)  We check that indeed, with no fault allowed, no attack is found in any of the benchmarks;  (2)  We check that indeed the insecure npo2 program is vulnerable to a single arbitrary data fault while the secure version is not -it can still be exploited with two faults; (3) According to their authors, the VerifyPIN versions 0 to 4 are vulnerable to one test inversion, while VerifyPIN 5 to 7 are resistant to it. We indeed reproduce these results. When allowing two faults, all VerifyPIN become vulnerable; (4) When using one arbitrary data fault against the VerifyPINs, all versions are found vulnerable. We manually check that indeed the identified attack paths make sense; (5) Our manually unrolled versions of VerifyPINs do not contain conditional branching instructions in the targeted function, making them resistant to test inversion.
Case Study: the WooKey Bootloader We now confront our tool to a real-life security system, WooKey. Presentation of WooKey. First presented in 2018 by ANSSI, the French system security agency, the WooKey platform  [14, 89]  is "a custom STM32-based USB thumb drive with mass storage capabilities designed for user data encryption and protection, with a full-fledged set of in-depth security defenses". Their choice to be open source and open hardware makes WooKey a relevant case study: it is a real-life, complex device, security focused and available for reproducibility. Note also that Wookey has been extensively analyzed, as it was the target of an ANSSI cybersecurity challenge for security professionals  [5]. Security Scenario and Goal of our Study. We focus on WooKey bootloader, a dual-bank system enabling hot firmware updates.
The system is hardened, especially redundant test protections are present in critical sections to protect against test inversion faults. We consider the same attacker model as the ANSSI challenge did  [5] : the attacker seeks to manipulate the bootloader logic to boot on the older firmware, more likely to contain security vulnerabilities. We also consider an attacker able to perform a single arbitrary data fault. We see in Table  2  that WooKey bootloader size is orders of magnitude larger than the programs used for evaluation in Section 7. Wookey is available as C code. We compile it like we did for the evaluation benchmarks (Section 7. 1). We conduct the following three analyses: 1. automatically analyze WooKey at binary-level to check whether we are able to find previously known faults  [63] , and/or new ones: we are indeed able to find the two faults identified by prior work  [63]  (A1, A2), as well as an attack they do not mention (A3); 2.
We are able to find both attacks, linking faults back to their locations in the C code with debug information. We also find an additional attack, faulting another part of the loader_exec_req_f lashlock function (A3). Analyze a Security Patch of WooKey. We now evaluate the protection scheme proposed by Lacombe et al. [63]  for these attacks. It consists of four extra counter-measures named from CM1 to CM4. We found indeed that the full protection prevents attacks A1 and A2, as claimed by the authors of the patch. Yet, our analysis shows that the protection does not prevent the new attack A3. Propose a New Patch and Evaluate It. We manually inspect these different analysis results to understand what happens. We have especially been able to identify the root cause of A3 and propose a dedicated countermeasure for it (named CMA).
Also, by analyzing each counter-measure in isolation, we have been able to understand that counter-measures CM1 and CM3 do not block any attack path as they are redundant with other tests in the code and can be safely removed. Overall, our new patch (CMA + refined former patch) is shown by our tool to protect against all the attacks, for an attacker able to perform one arbitrary data fault (Table  3 ). Legend -: attack path found by our tool / : no attack found Other Attacks on WooKey. We were also able to find two other known attacks on Wookey. (Attack vector combination) The iso8716 library, used in WooKey for secure communication, presents a vulnerability to fault injection which enables a software buffer-overflow in function SC_get_AT R  [63]. Using an attacker with a single arbitrary data fault, we were able to reproduce this attack; (Faulty redundant test) Martin et al.
Robustness Analysis. SWiFI is also used for robustness evaluation  [64, 74, 56, 88, 65, 72, 32, 90] , in order to verify the correct behavior of error handling mechanisms. They rely also on forking or mutant techniques. The fault models are similar to hardware fault injection, yet multi-fault is not really an issue there, as faults are supposed to originate from safety issues (e. g. cosmic rays) and have no reason to accumulate unreasonably. Formalizations and Fault Models. While it is common in the field of automated formal verification of cryptographic protocols to consider models of attackers (typically, extensions of the "Dolev-Yao" model) -either by specifying what the attackers can do  [2]  or what they cannot do  [7] , only very few formalizations of software-level attacker capabilities have been proposed so far.
Conclusion We formalize the concept of adversarial reachability, extending standard reachability to include the presence of an advanced attacker in program analysis, and we propose a dedicated symbolic algorithm for adversarial reachability, integrating a novel forkless encoding of faults together with dedicated optimizations. Our technique is shown to significantly reduce the number of paths to explore, and scales up to 10 faults on a standard SWiFI benchmark, where prior forking attempts timeout for 3 faults. Also, we show that our method scale to realistic size examples, such as the WooKey project where we have been able to replay known fault attacks and to even find a vulnerability not mentioned in a recently proposed countermeasure patch.
Moreover, bioinformatic tools have been developed that can separate a wide range of possible MGEs from microbial hosts  [42] -  [49]. Although such tools allow differentiation of chromosomal DNA from phages, plasmids, and other MGEs, discovery of MGEs is constrained by existing databases and training sets that are based on known MGEs. Moreover, metagenomic detection of MGEs per se does not directly yield insights into the ecological relevance of the element. In summary, unbiased detection and characterisation of unknown MGEs remains a major challenge. Recently, Quistad et al. reported an experimental approach to investigate the impact of MGEs on the ecology and functioning of complex microbial communities  [50]. In the experiment, MGE cocktails were routinely collected from independent compost communities, pooled, and then redistributed across mesocosms (see Figure  1a ).
This simple manipulation resulted in MGEs being repeatedly exposed to new hosts thus enhancing their evolutionary potential and facilitating horizontal dissemination of ecologically relevant genes. The affected communities were labelled "horizontal" and contrasted with a paired set of "vertical" communities that received no MGE cocktail. Communities were then subjected to metagenomic sequencing, which -by virtue of the experimental design -allowed the identification of sequences in the horizontal communities that were not detected in the respective ancestral communities (hereafter referred to as "unique sequences"), and therefore likely represent MGEs derived from allopatric mesocosms. While many of these unique elements were shown to be phage-like, their detection was not dependent on matches to existing databases, but rather, appearance among the set of "unique sequences".
However, as pointed out in the original study, many "unique sequences" did not show features typical of phages or other known MGEs, leaving open the possibility that these candidate sequences had no history of horizontal dissemination. Instead, these sequences may have been rare elements that were selected for simply due to changes in species composition. For example, sequences may become detectable (and thus classified as unique), solely through an increase in frequency placing them above the threshold for metagenomic detection. While the study by Quistad et al. marked a significant conceptual advance in evolutionary thinking regarding microbial communities, much remained unexplored with respect to the identity of unique sequences. Here, we describe a broadly applicable pipeline (github. com/bramvandijk88/xenoseq) that takes as input, raw sequencing reads from time series experiments, and detects newly introduced sequences.
Bioinformatic pipeline to detect transfer events The xenoseq pipeline (https://github. com/bramvandijk88/xenoseq, Figure  1c-e ) is a wrapper that combines read trimming, assembly, read mapping, read filtering, and local alignment to seek evidence of horizontal transfer between communities. This pipeline takes as input raw (untrimmed) fastq files containing shotgun metagenomic data of derived samples (query, in which to look for newly introduced sequences) and datasets from ancestral samples (reference). Query reads are trimmed using fastp 55 (v0. 23. 2), mapped against the corresponding reference contigs using BWA  [51] ,  [52]  (v0. 7. 17) using default options, and samtools  [53]  (v1. 15. 1) is used with the flag "-4" to extract unmapped reads. These reads are assembled into "unique contigs" using Megahit  [54]  (v1.
2. 9) (xenoseq_find, Figure  1c ). Next, these unique contigs are blasted against a local database using NCBI Blast  [55]  (v. 2. 13. 0) of all other reference communities to link the emergence of unique contigs to allopatric "donor" communities. Linked contigs are extracted from the unique contigs using Seqkit  [56]  (v. 2. 3. 0) (xenoseq_link, Figure  1d ). By default, contigs are linked to a donor when blast has at least one high-scoring segment with a minimum length of 300 with at least 99% nucleotide identity. While the algorithm and cut-offs limit the sensitivity of the algorithm at larger evolutionary distances, they are designed to detect sequences that have recently diverged and are still largely identical. The contigs that match target sequences in an allopatric community are referred to as "xenotypic contigs".
Xenoseq benchmark To benchmark the pipeline, the introduction of MGEs into mock-communities was simulated (see Supplementary Material I full details). Six bacterial genome sequences were downloaded from RefSeq. Then, two mock-communities were generated, one with an even taxon distribution (easy dataset), and one with a highly skewed taxon distribution (hard dataset). Simulated MGE sequences were either i) randomly inserted into genome sequences, representing integrative elements, or ii) included as separate replicons linked to a single host genome by adding them to the genome fasta file as a separate contig. Illumina sequencing was simulated from the resulting "communities" with ART 62 , using both default and tenfold elevated error rates, which were used as input to benchmark the pipeline.
7  [53]. Contigs were binned using metaBAT2 v2. 12. 1  [60]  and MAG quality was assessed with CheckM v1. 1. 3  [61]. All MAGs and contigs were annotated using BAT and CAT (Bin/Contig Annotation Tool, respectively, v. 5. 1. 2)  [62] , which uses prodigal  [63]  to predict open reading frames and diamond  [64]  to query open reading frames against the NR database  [65]. When BAT or CAT could not reliably assign a taxon due to conflicting annotations between ORFs, we assigned a higher order taxonomic rank to the MAG: that is, to genus level if species identity could not be assigned, family level if genus could not be assigned, etc. CAT was called using parameters "--index_chunk 1 --block_size 5 --top 11" using the CAT database and taxonomy constructed on 2021-04-30. Read mapping of samples from individual time points (above) was used to study the relative abundance of individual MAGs.
Extracted DNA was then sequenced using a NextSeq MidOutput 300 cycle run resulting in 2x150 bp paired-end reads (see Supplementary Table  I ). Reads were aligned to the non-redundant (NR) protein database  [65]  with Diamond 54 using the blastx subroutine, where the top hit was used to identify the read as being either P. fluorescens, E. coli, or "other" (the latter representing either species present in the communities or erroneously assigned reads).
IS elements were predicted with ISEscan (v1. 7. 2. 3)  [49]. Integrons were predicted using Integronfinder2 (v2. 0rc6)  [48]. All open reading frames on MGEs were annotated with prokka  [68]  with both the default database and the PHROG  [69]  database for identification of viral genes. All tools were run with default options, results are shown in Supplementary Table  1 , Sheet 3.
Protein sequences were extracted from the Uniprot database (keywords: "endoglucanase", "cellobiosidase", "nitrate reductase", "nitrite reductase", and "nitrogenase", all with the additional query "reviewed:true") and aligned to the MAGs using diamond blastx  [64]  with default settings. A score was assigned to each MAG by calculating the fraction of queries hit. For example, when one out of two cellobiosidases from Uniprot gave a significant hit, a score of 0. 5 was assigned. All scores are given in Supplementary Table  1 , Sheet 5. For Figure  5b , a metabolic function was assigned when the score was greater than 0. 1. When two MAGs with the same CAT annotation occurred in multiple communities, but the metabolic scores were not identical due to differences in genomic coverage, the highest score was used.