dataesr/scientific-paragraphs-categorization huggingface dataset:
Institutional Review Board Statement: The study was conducted in accordance with the Declaration of Helsinki, and received ethical approval from the Comité de Protection des Personnes Sud-Ouest et Outre Mer III (registration numbers: ZIKA-DFA-FE (pregnant women) study DC-2016-2636; ZIKA-DFA-BB (pediatric) study 2016-A00684-47. Both cohort studies are registered with ClinicalTrials. gov under the identifiers: NCT02916732 and NCT02810210. Informed Consent Statement: All study procedures were explained to and informed consent was obtained from the pregnant woman and from a parent or legal guardian of the newborn before enrolment in the study.
Acknowledgments: We would like to thank the women and the infants who participated in this study. We would also like to thank the clinicians, midwives, nurses, clinical research assistants, health officers and epidemiologists who helped conduct this study in each of the study sites in the French Territories of the Americas:  Caroline Callier ,  Christelle Celeste ,  Elvire Couchy ,  Jacqueline Dubois ,  Nathalie Fourcade ,  Jacques Ganaelle ,  Ingrid Vingadassalom  ( INSERM Centre d'Investigation Clinique 1424 site Guadeloupe ),  Joelle Colat-Peyron  (lab technician at Karubiotec™),  Mama Dialo ,  Cécile Herrmann-Strock ,  Eustase Janky ,  Philippe Kadhel ,  Laszlo Kovacic ,  Jean-Marc Rosenthal  ( Centre Hospitalier Universitaire de Pointe-à-Pitre/Abymes, Guadeloupe ),  Sylvie Lubin ,  Marie-Josée Pelczar  ( Centre Hospitalier Basse Terre, Guadeloupe ),  Manon Boullard ,  Isabelle Calmont ,  Sébastien Cavalini ,  Leila Frigere ,  Maelle Monphile ,  Véronique Pelonde  ( INSERM Centre d'Investigation Clinique 1424 site Martinique ),  Nicolas Mediamolle ,  Alice Monthieux ,  Jean-Luc Volumenie  ( Centre Hospitalier Universitaire Martinique, Fort-de-France ),  Fanny Abad ,  Maylis Douine ,  Aniza Fahrasmane ,  Edouard Hallet ,  Hélène Hilderal ,  Frédéric Inglis ,  Justine Krajewski  ( INSERM Centre d'Investigation Clinique 1424 site Guyane ),  Noémie Lachaume ,  Samson Yassinguezo  ( Centre Hospitalier de Cayenne, French Guiana ).
, 2012; Sharif et al. , 2014). Regarding estrogen signaling, we used both duplicates of the estrogen receptor beta erb1 and erb2 (due to the teleost-specific whole genome duplication) and the only known copy for the estrogen alpha receptor era that all have previously been identified in Dicentrarchus labrax  (Halm et al. , 2004) , both genes of membrane G protein-coupled estrogen receptor gpera and gperb identified in Dicentrarchus labrax  (Pinto et al. , 2018)  and the five estrogen receptor-related receptors (erra, errb1 and errb2, errga and errgb) isolated from Dicentrarchus labrax databases.
Statistics Statistical analyses were performed on GraphPad Prism (version 6, GraphPad Software Incorporated, La Jolla, CA 268, USA). Since data did not fit normality or homoscedasticity assumptions, differences between groups were tested using the nonparametric Kruskal-Wallis test followed by Dunn's multiple comparison test. Multiplicity adjusted p-value are given, accounting for familywise error rate due to multiple pairwise comparisons. The strength and direction of the linear relationship between fish standard length and head mineralization level was tested using the nonparametric Spearman correlation test (p<0. 05). To compare the effect of treatment on mineralization levels, nonparametric ANCOVA was performed to test differences between predicted non-linear regression curves using the r package fANCOVA (0.
Acknowledgments Data used in this study were produced using the  High-Debit PCR, Geńotypage-Sequencage (Gen-Seq) and Montpellier Bioinformatics Biodiversity (MBB)  platforms supported by the  LabEx CeMEB , an  ANR  " Investissements d'avenir" program  ( ANR-10-LABX-04-01 ).
Results and discussion The focused coherent field reconstructions, emerging from the SM-A recorded data-set and the proposed optimized OTG recording are displayed in Figs. 4  and 5  for two object's RoIs: PIC and UP respectively. Figure  4  relates to the inspection of the PIC RoI through different SBMIR and data collection approaches. Namely, amplitude and phase images shown on Fig. 4a, d , correspondingly, were recovered from the first m = 5 intensity distributions of the dataset, obtained in SM-A mode, with the following parameters: z 0 = 11. 9 mm, Δz = 2 mm. The use of only the first five input diffraction intensity distributions ensured the optimal quality of the reconstructed images while the inclusion of additional intensity distributions from more distant planes led to a worsening of the reconstruction quality, due to the lack of high spatial frequencies in that region.
In addition, the single-frame captured for each of the measurement planes was extracted from the raw SM-A dataset (that is images before the averaging procedure) to simulate data recorded in SM-S mode. Negligible improvements have been witnessed when averaging over multiple still frames due to the adequacy of the emission power level with respect to the camera noise equivalent power. Fig. 4  Resulting numerical wavefront reconstruction, for amplitude (top rows) and phase (bottom rows) profiles, for 'PIC' RoI after 30 SBMIR iterations. The left column includes the data obtained using SM-A recording with Δz = 2 mm, while the middle and right columns, respectively, display wavefronts recovered using OTG recording with respective longitudinal pitches of Δz = 2 mm and at the optimal value of Δz = 2.
4 mm In the latest proposed OTG configuration, the 25 FPS detection rate of the camera allows for a continuous displacement of the planar array, while preventing any blurring effect during the sensor motion in the input data sets. Indeed, high requirements to the mechanical stability are critical in phase retrieval, implemented with the radiation of visible frequency range where the wavelength is less than the possible detector deviations caused by vibrations. In the THz frequency range, the radiation wavelength is much greater than the detector possible offsets range. That is why data recorded by a sensitive detector in OTG mode do not provide any deterioration of the reconstructed images. Herewith, at the previously mentioned frame rate, the achievable longitudinal pitch, Δz = 400 μ m, remains beyond the required optimal value of recording spacing.
It validated again, that, considering the smallest longitudinal pitch in the collected dataset does not necessarily lead to an optimal quality of the reconstructed images. This aspect has been extensively discussed in  [43]  as algorithmic optimizations have been assessed. From the extensive OTG recordings, sub-datasets fitting the previous parameters, namely Δz = 2 mm, have been employed to reconstruct the wavefront, with amplitude and phase characteristics displayed in Fig. 4b, e. With respect to the slower SM-A recording, it stands out that the suitability of the proposed OTG acquisition mode, complemented with the collection of a decimated dataset selection, leads to the reconstruction of a slightly sharper coherent phase profile while a similar lateral resolution is obtained. The versatility granted through the extensive data-set OTG capture is further highlighted in Fig.
Indeed, an optimal wavefront, depicted in Fig. 5c, f , Fig. 5  Resulting numerical wavefront reconstruction, for amplitude (top rows) and phase (bottom rows) profiles, for 'UP' RoI after 50 iterations. The left and center columns include the data obtained using the SM-A recording method with Δz = 2 mm and Δz = 4 mm respectively while right column displays wavefronts recovered using the OTG recording method with an optimal longitudinal pitch of Δz = 3. 2 mm has been reconstructed from a decimated input data-set featuring Δz = 3. 2 mm. Thus, in the light of the discussed results, it can be concluded, that the short recording longitudinal pitch, obtained through the high acquisition speed is especially suited as a prospective solution to be put to good use for the selection of an optimal SBMIR input data set, while allowing for fast full diffraction field assessment, under 1 second.
Conclusion The tedious multi-plane data collection process, required for the SBMIR algorithmic approach remains a major drawback of such iterative phase retrieval procedures. Through a simplified transmission configuration, featuring a high-power QCL adequately coupled to a highly sensitive camera sensor, a real-time recording with the continuous displacement of the sensor allows OTG acquisition of the full diffraction field, eligible for high-quality reconstruction. Such a fast recording process, ensures the collection of an exhaustive dataset that provides substantial flexibility in the postprocessing extraction steps of the wavefront. Namely, the importance of the selection of the numerical longitudinal pitch, Δ z , on the reconstruction quality has already been highlighted and the OTG recording allows this parameter to undergo an optimization in post-processing operations, preventing time-consuming iterative experimental tasks.
In more detail, we evaluate the robustness of 7 shallow ML-based NIDS including Adaboost, Bagging, Gradient boosting (GB), Logistic Regression (LR), Decision Tree (DT), Random Forest (RF), Support Vector Classifier (SVC) and also a Deep Learning Network, against several adversarial attacks widely used in the state of the art (SOA). In addition, we apply a Gaussian data augmentation defense technique and measure its contribution to improving classifier robustness  [1]. We conduct extensive experiments in different scenarios using the NSL-KDD benchmark dataset [2] and the UNSW-NB 15 dataset  [3]. The results show that attacks do not have the same impact on all classifiers and that the robustness of a classifier depends on the attack and that a tradeoff between performance and robustness must be considered depending on the network intrusion detection scenario.
Preliminaries Generating an adversarial attack involves adding a small perturbation to the input sample so that the output label is misclassified  [14, 15]. This is illustrated in Fig. 1  in the context of NIDS. Formally, let  be the original input data sample,  be the classifier, and  =  () be the label associated with. A data sample  ′ is considered an adverse sample of  when  ′ is close to  under a specific distance metric while  ( ′ ) ≠. Adversarial attacks in network security can be classified along two dimensions: the attacker's knowledge and the attacker's goal: 1. The attacker's knowledge: describes the extent of the adversary's knowledge about the NIDS system. We can characterize three levels of attack danger  [16] : • White-box attacks: the attacker is in the most favorable position where he has full access to all information about the ML-based NIDS.
NSL-KDD data-set [2] The NSL-KDD data-set is derived from the KDDCup 99 data-set and addresses the problems of the latter, namely irrelevant records and data imbalance between normal and abnormal records. A record is defined by 41 features, including 9 basic features of individual TCP connections, 13 content features within a connection, 9 temporal features calculated within a two second time window, and 10 other features. The data-set contains 24 attack types, grouped into 4 categories of attacks, namely denial of service (DoS), remote to local (R2L), user to root (U2R) and probing. The data-set is divided into training and test subsets containing 100. 778 and 25. 195 samples respectively. The original training NSL-KDD Train + and testing NSL-KDD Test + sets of the NSL-KDD data-set are used in this study.
UNSW-NB15 [3] The data-set was created by the cyber security research group at the Australian Centre of Cyber Security (ACCS) in 2015. It contains approximately 100 GB of raw data (normal and malicious traffic). 9 different types of attacks were used to generate the malicious traffic: Fuzzers, Analysis, Backdoors, DoS, Exploits, Generic, Reconnaissance, Shellcode and Worms. Each sample is described by 49 features that were generated by several feature extraction tools. The data-set is divided into training and test subsets containing 175. 341 and 82. 332 samples respectively. The original training UNSW_NB15_training-set and 10% (randomly selected samples) of the testing UNSW_NB15_testing-set are used in this study.
Applying defense techniques In this scenario (see Fig. 4(b) ), we measure the contribution of Gaussian data augmentation to the robustness improvement of NIDS classifiers. Therefore, two new data-set called ''augmented data-sets'' are generated by applying Gaussian data augmentation on KDD Train + and UNSW_NB15_training-set. The performance of the classifiers is then evaluated in the following two scenarios: The obtained results are described in the third and fourth sub-tables of Tables  4  and 5 , for accuracy and FNR respectively. For each sub-table, the first row shows results of scenario 3, and the other rows illustrate the results of scenario 4.
Behavior against white-box attacks • Classifiers are rather robust to FGSM, PGD, BIM and C&W attack also has a very similar effect. • JSMA is the most powerful attack. • Adaboost and RF are the only classifiers that are robust to all white box attacks. • The classifiers were more vulnerable to these attacks on the UNSW-NB15 database than on the NSL-KDD database, for both the accuracy and False Negative Rate.
Scenario 1: measuring the performance in baseline scenario Results in the first rows of the first sub-tables show that almost all the classifiers perform well, the accuracy varies between 74% and 77% on NSL-KDD except for Adaboost that has the worst performance (accuracy 55. 13% on NSL KDD and 60. 6% on UNSW-NB15). DNN is the most efficient with an accuracy of 77. 68% on NSL-KDD and 78. 56% on UNSW-NB15. On the NSL-KDD data-set, these results are confirmed by the False Negative Rates (first raw of the second sub-table). Indeed, Adaboost wrongly classifies 71. 35% of the malicious traffic as benign, while the other classifiers have a FNR varying between 29. 68% and 39. 32%. However, all classifiers have extremely low false negative rates (below 6%) on the UNSW-NB15 database.
Accuracy. Gaussian noise attack: • There are two different behaviors; some classifiers (DT, GB and bagging on UNSW-NB15) are very vulnerable to the attack of Gaussian noise, even at low intensity ( = 0. 01), while the other classifiers are more robust. In particular, for  = 0. 01, the performance of SVC (resp. Logistic regression) remains stable on NSL-KDD, (resp. UNSW-NB15). • For a high-intensity attack ( = 0. 2), the behavior is similar, where, on the NSL-KDD dataset, DT loses almost half of its performance and GB drops to a third of its efficiency. However, the accuracy decrease for the other algorithms ranges from 4. 7% for LR to 11. 5% for Bagging. The results are similar on the UNSW-NB15 database. • Surprisingly, Adaboost, which has the worst baseline performance, is the least vulnerable to Gaussian noise attacks on the NSL-KDD dataset, beating DT and GB when they all face this type of attack.
White-box attacks: • FGSM, PGD and BIM which are attacks of the same family have almost the same impact on the classifiers. • JSMA is the most powerful attack; on NSL-KDD, the decrease in accuracy reaches 36% for GB. C&W is slightly more powerful than the trio of FGSM, PGD, BIM, but these are all weak attacks that result in a drop in accuracy of no more than 4. 7%. • Adaboost and Random Forest are the only classifiers that are robust to all white-box attacks. The decrease in accuracy is limited to 1. 4% and 3. 7% for Adaboost and RF respectively on NSL-KDD. • The classifiers are more vulnerable to these attacks on the UNSW-NB15 database than on the NSL-KDD database.
H. Jmila and M. I. Khedher Gaussian noise attack: • The results show that FNR can decrease after data perturbation, i. e. , malicious data initially classified as illegitimate are misclassified as legitimate after Gaussian noise perturbation. This reflects an improvement in classifier performance, as is the case for Adaboost, GB, LR, and SVC on NSL-KDD data-set. As for the Bagging, DT, DNN, and RF classifiers, the FNR increases by 23%, 13. 2%, 22%, and 11% for a  = 0. 02, reflecting the general decrease in accuracy described in the first sub-table of Table  4. • The GB result on NSL-KDD data-set is particularly interesting because the Gaussian noise has a contradictory impact on the accuracy and the FNR. Indeed, the overall performance of the classifier degraded (accuracy decreased by up to 21.
68% for  = 0. 2), while the FNR also decreased (by 25. 6% for  = 0. 2) which means that more malicious traffic was blocked. Thus, the degradation in overall classifier performance may be due to mis-classifying benign traffic as illegitimate, which causes False Alarms. • We note that in the UNSW-NB15 database, where all classifiers had low false-negative rates in the absence of adversarial attacks, the false-negative rates increase significantly, showing their sensitivity to these attacks, especially for the Bagging and RF classifiers.
Scenario 3: measuring the performance in non adversarial environment with training in augmented data Comparing the performance of the classifiers trained on the augmented database in non adversarial environment (first rows of Tables  4  and 5 ) with their performance when trained on initial training data-sets (first row of the sub-tables 3), we notice that the performance of most of them (Bagging, DT, DNN, RF) has remained stable on NSL-KDD dataset. The performance of Adaboost increased from 55. 13% to 66. 33%, but the performance of LR and SVC decreased from 75% to 67. 27% and from 74. 29% to 65. 36% respectively. The FNR results (first row of Table  4 ) reflect the same conclusions. The performance degradation is more noticeable in the UNSW-NB15 base.
• Gray/black-box attacks: on NSL-KDD data-set, the defense has degraded the robustness of Adaboost against Boundary and Hop-SkipJump (FNR increases by 49% while the increase was limited to 3. 1% before defense). It slightly improved the robustness of Bagging, (DNN,RF). The improvement is more significant for LR and SVC. FNR increased by only 52% and 49% for LR and SVC respectively, compared to an increase by 62% for both without defense. On the UNSW-NB15 data-set, the defense method proved to be effective and significantly improved the robustness of the classifiers in terms of FNR. Behavior against a Gaussian noise attack • The defense technique has improved the robustness of most classifiers. • The robustness of SVC and LR has improved but at the cost of performance degradation. • The robustness of the DNN has been improved on NSL-KDD dataset while maintaining its good performance, thus DNN has the best accuracy under normal and adversarial conditions.
• The defense method decreased the robustness of some algorithms on the UNSW-NB15 (FNR increases more) as is the case for DT, Gradient Boost and Adaboost. Behavior against Gray/black-box attacks • The robustness of Bagging, DT, LR, SVC has improved on NSL-KDD dataset • The robustness of Adaboost has decreased on NSL-KDD dataset • The defense technique has almost no effect on other classifiers. In terms of FNR, the defense method was more effective on the UNSW-NB15 basis, than NSL KDD (FNR rates are lower). Behavior against white-box attacks • The robustness of classifiers against FGSM, PGD, BIM attacks is almost the same since they are already quite robust. • Robustness against JSMA has improved for most classifiers but at the cost of performance degradation for most of them. In terms of FNR, the defense method was not effective on UNSW-NB15 and even degraded the performance of some classifiers (e.
Global conclusions • An attack does not impact all classifiers in the same way. Similarly, the robustness of a classifier depends on the attacks. In the same sense, a defense technique is not effective against all attacks and does not have the same effect on different classifiers (it can improve or decrease the classifier's robustness or be ineffective). Similarly, the behavior of a classifier when faced with an attack or a defense method depends on the database. • The robustness and overall performance of classifiers can be contradictory. As seen in the results on the NSL-KDD data-set, Adaboost is a very robust classifier, but does not have high accuracy Ċonversely, DNN is very efficient but is the most vulnerable to ZOO attack. Therefore, depending on the situation and need of the IDS, robustness or performance can be privileged.
Namely, if the IDS operates in a certain environment, it is natural to favor performance, however, if the environment is uncertain, robustness becomes important. Similarly, defense techniques can improve the robustness of classifiers but at the cost of degrading their performance. Thus, a trade-off between these two objectives must be considered. A good defense technique, improves the robustness of the classifier without degrading its performance. In addition, the effectiveness of a defense method against a database attack can vary from database to database.
Comparison with the state of the art As mentioned in 3. 4, the paper  [41]  is the closest to our work since, like us, the authors evaluate the robustness of shallow classifiers against state of the art adversarial attacks using the NSL-KDD database. Since the hyper-parametric information is unavailable in  [41] , in addition to the difference in the list of classifiers and attacks considered, we opt for qualitative comparison our evaluation framework with the approach presented in  [41]. The authors of  [41]  evaluate the robustness of 3 shallow classifiers (LR, RF, SVM) against three adversarial white-box attacks (FGSM, PDG, L-BFGS) and a black-box attack SPSA, and do not propose a defense method (Cf. Table  1 ). This paper, however, evaluates a richer and more varied collection of ML classifiers (Adaboost, Bagging, DT, GB, LR, RF, SVC), against more varied and numerous adversarial attacks (Gaussian noise, White-box attacks: FGSM, PGD, BIM, C&W, JSMA, Gray/black-box attacks: Zoo, Boundary, HopSkipJump).
Conclusion and future work This paper focuses on the research area of adversarial machine learning. We study the robustness of various widely used ML classifiers In addition, we studied the impact of a defense technique based on Gaussian data augmentation to improve the robustness of different NIDS. For the evaluation, we consider both the accuracy and the false negative rate. The latter measures the percentage of malicious traffic that successfully bypasses the NIDS. The NSL-KDD and UNSW-NB15 data-sets were used for the evaluation. The results show that attacks do not have the same impact on all classifiers and that the robustness of a classifier depends on the attack. Similarly, a defense technique is not effective for all classifiers, nor against all attacks. Furthermore, a defense technique may improve the robustness of a classifier but degrade its overall performance, so a trade-off between performance and robustness must be considered depending on the NIDS application scenario.
• Gray/black-box attacks: The defense technique has different effects depending on the classifier. For example on the NSL-KDD data-set: (i) it contributes to the improvement of the robustness for some classifiers as for LR and SVC whose accuracy decreased, compared to the baseline performance, by only 55. 3% and 53. 8% (resp. )when confronted to a Boundary attack, versus 67% and 66. 8% (resp. ) of decrease before having applied the defense technique. (ii) it degrades the robustness of some algorithms as it is the case for Adaboost whose accuracy decreases by 53% for a Boundary attack instead of 22% without defense. (iii) the defense technique has very little effect on the other classifiers who have kept almost the same level of robustness as before. The behavior of the classifiers is similar in both databases.