dataesr/scientific-paragraphs-categorization huggingface dataset:
Angular momentum transport The stellar models used in this study have been computed with the cestam evolution code which originates from the cesam code  Morel (1997) ;  Morel & Lebreton (2008) , where rotationally induced transport has been implemented  (Marques et al. 2013). In convective zones, although there is differential rotation in latitude, the mean rotation at a given radius weakly depends on the radius. Therefore, in cestam models, that are one-dimensional, we assumed that convective zones rotate as solid bodies. In radiative zones, the transport of angular momentum and chemical elements is modelled following the formalism of  Zahn (1992)  (hereafter Z92), refined in  Maeder & Zahn (1998). According to these studies, because of the stable stratification in radiative zones, turbulence is much stronger in the horizontal than in the vertical direction.
The youngest, NGC2264 has an age around 3 Myrs  (Affer et al. 2013 , and references therein), its stellar surface rotation periods have been measured by rotational signature in the stellar light-curves by  Venuti et al. (2017). NGC2362 is about 5 Myrs old, and the rotational data have been taken from  Irwin et al. (2008). Finally hPer (NGC869) is around 13 Myr old, and its stellar surface rotations have been measured by  Moraux et al. (2013). We have Fig. 1. Surface rotation distributions in the three selected clusters NGC2264, NGC2362 and hPer, as a function of age. The colour codes for the stellar mass (from 1. 3 to 1. 9 M ). The solid lines are given by evolutionary models of 1. 4 (in blue), 1. 6 (in green) and 1. 8 M (in red). The grey coloured areas symbolize the uncertainty on the age of the clusters which is of around 1 Myr.
We present a high-assurance and high-speed implementation of the SHA-3 hash function. Our implementation is written in the Jasmin programming language, and is formally verified for functional correctness, provable security and timing attack resistance in the EasyCrypt proof assistant. Our implementation is the first to achieve simultaneously the four desirable properties (efficiency, correctness, provable security, and side-channel protection) for a non-trivial cryptographic primitive. Concretely, our mechanized proofs show that: 1) the SHA-3 hash function is indifferentiable from a random oracle, and thus is resistant against collision, first and second preimage attacks; 2) the SHA-3 hash function is correctly implemented by a vectorized x86 implementation. Furthermore, the implementation is provably protected against timing attacks in an idealized model of timing leaks.
Our use case is the SHA-3 standard. Our choice is guided by two main considerations. Firstly, the SHA-3 standard will likely be used to protect real-world applications for many years to come. Secondly, its security proof is intricate, and involves techniques that are not routinely addressed in machine-checked security proofs. Concretely, our implementation is written in Jasmin  [1, 5] , a framework that targets high-assurance and high-speed implementations using "assembly in the head" (a mixture of high-level and low-level, platform-specific, programming) and a formally verified, predictable, compiler which empowers programmers to write highly efficient fine-tuned code. The generated (verified) x86-64 assembly code matches in performance the best available implementations for this primitive, including for example a current OpenSSL version.
Comparison with  [1, 5]. Jasmin  [1]  is an assembly-like language, which gives the developer full control over low-level implementation details, but also provides support for functional verification, and a certified compiler. Almeida et al. [5]  extend its toolset to support the verification of local optimizations, by extracting optimized and non-optimized code to EasyCrypt, where they are proved functionally equivalent. The extraction mechanism is also used to prove that the code does not address memory or branch based on secret inputs. In this paper, we further exploit this extraction mechanism, and bring together Jasmin and EasyCrypt to demonstrate FCF + VST [35] ✓ ✓(specific) ✗ ✗ EasyCrypt + Frama-C + CompCert [2, 3] ✓ ✓ ✓ ✗ Fiat Cryptography [24] ✓(source-level) ✗ ✗(limited) ✓(vs GMP) HACL*  [29, 36]  ✓(source-level) ✗ ✓(source-level) ✓(vs OpenSSL) Cryptol + SAW  [34]  ✓(source-level) ✗ ✗ ✓ Jasmin [1, 5] ✓ ✗ ✓ ✓ This paper ✓ ✓ ✓ ✓ that a single toolchain that addresses all four desirable propertiesincluding in contexts where provable security is non-trivial-is possible today.
Other proofs part of larger projects are discussed below. Other related work. There is a growing body of work on highassurance and high-performance cryptographic implementations. We briefly review it against the four desirable properties desirable of such formal approaches as applied to the production of reference implementations for cryptographic standards (see Table  1 ). Beringer et al. [13]  leverage the Coq-based Foundational Cryptography Framework (FCF)  [27]  for machine-checked cryptographic proofs and the Coq-based Verified Software Toolchain (VST)  [6]  for the verification of C programs to formally relate a version of OpenSSL's implementation of HMAC to a machine-readable specification that is proved secure following  [12]. Ye et al. [35]  extend this result to the OpenSSL implementation of HMAC-DRBG.
2's notorious MAC-then-Encode-then-CBC-Encrypt (TLS-MEE-CBC) against timing-aware attackers. The combination of tools used significantly increases the Trusted Computing Base for the framework, and requires care when transitioning from one tool to the other in the toolchain. However, EasyCrypt provides more flexibility than FCF in proving cryptographic security, and the ability to develop specialized static analyses for timing leaks provides additional guarantees-albeit at a slightly lower level of assurance than that obtained by Ye et al. [35] , for example. Since semantics preservation down to compiled code requires the use of CompCert, this approach suffers the same performance issues as Ye et al. 's. Erbsen et al. [24]  propose Fiat Cryptography, a Coq-based framework for developing proofs of functional correctness for implementations of mathematical operations commonly used in cryptography.
Their framework produces C code which performs much better than existing libraries, but only guarantees correctness at source level. Further, they do not consider provable security, and cover timing channels by compiling only to straight-line code that uses constant-time arithmetic operations, which limits the kind of primitives their framework can consider. Zinzindohoué et al. [36]  leverage the techniques developed by Protzenko et al. [29]  to prove safety and functional correctness of assembly-like programs written in the F ⋆ programming language  [33]. Their focus is on functional correctness and efficiency, and they obtain partial guarantees on side-channel security through the use of abstract types. Their verified code compiles to C, which is where high-assurance guarantees are given.
The code they produce rivals OpenSSL in performance, and has been deployed in Mozilla's NSS library  [15]. EverCrypt  [28]  is a more complete cryptographic library that combines source-level and target-level implementations. As noted by the authors, formal verification in EverCrypt is for now primarily confined to functional correctness and side-channel resistance. Moreover, for source code implementations, there is a trade-off between using verified compilers that carry guarantees to assembly code or off-the-shelf compilers that deliver efficient assembly. Tomb  [34]  describes the use of the Cryptol and SAW tools to prove functional correctness of "real-world cryptographic implementations". The approach focuses on establishing functional correctness at source level in a variety of languages, and his focus on existing implementations does guarantee satisfactory performance.
The distinguisher and simulator are restricted to queries to the ideal functionality of the form (m, ℓ), matching the syntax of the Sponge interface; these queries return prefixes of size ℓ of the random oracle F outputs (denoted using F ℓ notation in the security games). In our formalization we consider a random function f ∈ Z 2 * × N → Z 2 and construct the observable prefix of length ℓ of the infinite random oracle F as follows: F (m, ℓ) = f (m, 0) ∥ f (m, 1) ∥. ∥ f (m, ℓ -1) We actually implement f lazily: representing it as a finite map from Z * 2 × N to Z 2 to which we add new input/output pairs as needed. Our machine-checked proof establishes the following security result for the EasyCrypt specification of the Sponge, which corresponds to the pseudo code described in Figure  2. Theorem 2.
Background on EasyCrypt EasyCrypt  [11]  is an interactive proof assistant, which also embeds a simple probabilistic programming language, pWhile, used to model cryptographic primitives, schemes, oracles and experiments, as well as program logics for bounding the probability of events in programs, and for proving equivalences or approximate equivalences between programs. Although EasyCrypt was initially designed to capture Shoup's code-based game-based proof methodology  [32] , it has since successfully been applied to simulationbased proofs, and to a growing body of standard symmetric primitives  [3, 8, 9]. Both of these make it a suitable candidate for this formalization effort. The pWhile language is a simple imperative programming language with assignments, conditionals (if-then-else) and while loops, as well as the ability to sample a value-stored in a variable, say x-from an arbitrary (sub-)distribution d, denoted x ←$ d.
As mentioned, program logics in EasyCrypt can be used to prove three kinds of statements over programs (or pairs of programs). We use only two in this paper, although the third (approximate equivalence between two programs) is used extensively in the proofs: (1) perfect equivalence between two programs c 1 and c 2 , denoted c 1 ∼ c 2 , indicates that if c 1 and c 2 are run on the same initial memory configuration, then they either both diverge, or both terminate with final memory configurations that follow the same distribution; (2) bounds or equality on the probability for an event E to occur during execution of a program c, denoted with Pr[c : E ].
MACHINE-CHECKED CORRECTNESS Jasmin  [1]  is a language for high-assurance and high-speed cryptography, Jasmin implementations are predictably transformed into assembly programs by the Jasmin compiler. Indeed, the Jasmin   language is designed to support "assembly in the head" programming, i. e. , it smoothly combines high-level (structured control-flow, variables, etc. ) and low-level (assembly instructions, flag manipulation, etc. ) constructs. Predictability empowers Jasmin programmers to develop optimized implementations with essentially the same level of control as if they were using assembly or domain-specific languages such as qhasm. Recently  [5] , the Jasmin framework has been extended with a formal verification back-end based on EasyCrypt. This back-end makes it possible to reason about the correctness of Jasmin implementations by automatically extracting them into EasyCrypt programs whose semantics is formally defined by an embedding of the Jasmin semantics in the EasyCrypt logic.
The EasyCrypt proof assistant supports program logics for reasoning about correctness and equivalence of imperative programs. The approach proposed in  [5]  takes advantage of this relational reasoning to carry out functional correctness proofs in the "game-hopping" style: one starts from a reference implementation, which is proved correct with respect to a high-level specification, and gradually modifies it until equivalence to high-speed code is trivial to prove. Crucially, this approach mimics the optimization process adopted by cryptographers when writing high-speed code, which means that the intermediate implementations required to bridge reference and target code are side-effects of the optimization procedure itself. 7 The Jasmin compiler is certified via a proof formalized in the Coq proof assistant, thus guarantees are carried to assembly code.
In this paper we build on the work of  [5]  to show that the embedding into EasyCrypt opens a way for a new type of formal guarantee: in addition to correctness of high-speed implementations, we can connect high-speed implementations to provable security results for the high-level specifications. Equivalence proofs. In Figure  14  we show the general structure of our correctness proofs. At the top we show the standard connected by arrows that represent correctness by inspection to three artefacts: i. the Sponge specification that was proved indifferentiable from a random oracle in EasyCrypt; ii. the reference implementation of the Sponge construction; and iii. the reference implementation of Keccak-p. The latter two implementations are shown as rounded rectangles to denote Jasmin as the implementation language.
All equivalence proofs are carried out over EasyCrypt code extracted from the Jasmin implementations. The permutation code does not perform memory write operations, as the entire state is maintained in the stack and registers. This greatly simplifies proofs, as stack arrays are treated in the Jasmin semantics as applicative arrays. The main challenges at this level are therefore related with the semantics of low-level optimizations, including vectorization, instruction selection, spilling, and instruction scheduling. Conversely, the main challenges in proving the full implementations are related to memory accesses. Concretely, some of the permutation implementations rely on memory tables to keep global constants, which means that one must prove that the memory write operations performed by the squeeze stage do not overwrite these memory regions.
Safety verification and side channels. The extended Jasmin framework of  [5]  also includes a mechanism for the automatic verification of safety-safety is a necessary condition for the soundness of the embedding of Jasmin in EasyCrypt-and another mechanism to check for the absence of timing side-channels. We have checked our implementations for both safety and absence of timing leaks in the constant-time model (input and output lengths are assumed to be public). The constant-time proofs consist of extracting the optimized Jasmin implementations to EasyCrypt using the mechanism introduced in  [5] , and then proving that the leakage trace explicitly constructed by the extracted code is independent from (or, formally, non-interfering with) the application data processed by the hash function. The leakage trace constructed by the implementation exactly maps the formal definition of constant-time leakage, as defined for example in  [4].
PERFORMANCE EVALUATION In this section we demonstrate the efficiency of our Jasmin implementation of SHA-3. We use SHAKE256 for concreteness, but note that for all the other SHA-3 functions the comparison to other libraries yields similar results, as they all share the same base implementations of the Sponge construction and Keccak-p. Benchmarking Environment. The performance evaluation of the Jasmin implementations of SHAKE256 was performed using supercop, v. 20190110. All measurements were taken on an Intel i7-6500U (Skylake) processor clocked at 2. 5GHz, with Turbo Boost disabled, Ubuntu 16. 04, kernel release 4. 15. 0-46-generic and gcc 8. 1. We compare our code with OpenSSL 9 and HACL* 10. We configured three different versions of OpenSSL: i. with the no-asm flag to exclude all assembly implementations; ii.
ACKNOWLEDGMENTS This work received support from the  National Institute of Standards and Technologies  under agreement number  60NANB15D248. This work was partially supported by  Office of Naval Research  under projects  N00014-12-1-0914 ,  N00014-15-1-2750  and  N00014-19-1-2292. This work was partially funded by national funds via the  Portuguese Foundation for Science and Technology (FCT)  in the context of project  PTDC/CCI-INF/31698/2017. Manuel Barbosa  was supported by grant  SFRH/BSAB/143018/2018  awarded by the  FCT. This work was supported in part by the  National Science Foundation  under grant number  1801564. This work was supported in part by the  FutureTPM project of the Horizon 2020 Framework Programme  of the  European Union , under GA number  779391. This work was supported by the  ANR   Scrypt  project, grant number  ANR-18-CE25-0014.
It is challenging to detect the anomaly in crowded scenes for quite a long time. In this paper, a selfsupervised framework, abnormal event detection network (AED-Net), which is composed of PCAnet and kernel principal component analysis (kPCA), is proposed to address this problem. Using surveillance video sequences of different scenes as raw data, PCAnet is trained to extract high-level semantics of crowd's situation. Next, kPCA, a oneclass classifier, is trained to determine anomaly of the scene. In contrast to some prevailing deep learning methods, the framework is completely self-supervised because it utilizes only video sequences in a normal situation. Experiments of global and local abnormal event detection are carried out on UMN and UCSD datasets, and competitive results with higher EER and AUC compared to other state-of-the-art methods are observed.
Furthermore, a one-class classifier which handles the extracted highdimension feature is used to determine the abnormality of frames. To be specific, this new self-supervised network uses the optical flow maps as the input, because these maps represent motion in a better way. Then we can extract high-level semantics of crowd's situation from PCAnet. Next, a simple but effective one-classifier, kernel principal component analysis (kPCA)  [35]  is used to classify the high-dimensional feature. Having merits from both networks, AED-Net is trained to understand each frame and conduct the detection. More importantly, Local Response Normalization layer (LRN layer), a trick used in CNN to aid generalization, is combined with the AED-Net for improvement. It should be worth noting that this new network can be trained with unlabeled data and perform better by comparing with the state-of-the-art methods in an abnormal detection task and our new self-supervised network can effectively detect abnormal events even in crowded situations, which improves the detection results according to the experiments tested on the public UMN dataset and UCSD dataset.
The rest of this paper is organized as follows. In Section2, related works are reviewed briefly. Section 3 reviews the basic algorithms of our framework, PCAnet and kPCA. Then the whole architecture of AED-Net will be elaborated in Section 4, and our improvement to it is also introduced in this section. Then, in Section 5, the experimental results of datasets,  UMN [30]  and UCSD  [31]  are illustrated and discussed. Finally, conclusions are presented in Section 6. The introduction of notations used in this paper is shown in table  1.
The common idea in one-class classification task is to train a classifier that encloses the training data, i. e. , the normal data, and in such way separate abnormal data from normal data. The support vector domain description (SVDD) classifier is a good example of this method. However, this classifier often generates a too large decision boundary to perform well enough. Using Gaussian process priors,  [35]  build model for one-class classification. It uses different measures derived from Gaussian process regression and approximate Gaussian classification. However, it strongly relies on hyperparameter-tuning of the re-parameterized kernel function. On the contrary, learning the distribution of data which is usually non-linear, kPCA classifier[36] can generate a decision boundary smoothly follow the distribution of data and tends to classify more accurately.
Finally, utilizing the block-wise histograms as classification features extracted by PCAnet, kPCA is trained to learn non-linear data distribution of normal scenes and determine the max normality score as the threshold computing by reconstruction error. During test time, to minimize the influence of frames that carry little relevant information, the foreground detection is firstly performed and frames in test video clip that contain few people are removed. Then k block-wise features are extracted by the PCAnet trained previously, and a test score is computed for every frame by kPCA. Finally, the test score is used to determine whether the frame is abnormal by comparing to the max normality score.
In AED-Net, we could not find ways to train these parameters. Besides, we will not feed data by mini-batches in our method. But, local response normalization (LRN), a light-weight normalization trick with no trainable parameters, is applicable to our task and achieved good results in the experiments. 𝑃𝑃 𝑗𝑗 (ℱ 𝑖𝑖 ) = ∑ 𝛼𝛼 𝑖𝑖 𝑗𝑗 𝑁𝑁 𝑖𝑖=1 �𝐾𝐾 𝑧𝑧𝑖𝑖 - 1 𝑁𝑁 ∑ 𝐾𝐾 𝑖𝑖𝑎𝑎 𝑁𝑁 𝑎𝑎=1 - 1 𝑁𝑁 ∑ 𝐾𝐾 𝑧𝑧𝑏𝑏 𝑁𝑁 𝑎𝑎=1 + 1 𝑁𝑁 2 ∑ 𝐾𝐾 𝑎𝑎𝑏𝑏 𝑁𝑁 𝑎𝑎,𝑏𝑏=1 � 28. if 𝑅𝑅(ℱ 𝑖𝑖 ) > 𝑝𝑝ℎ𝑟𝑟𝑣𝑣𝑠𝑠ℎ𝑎𝑎𝑙𝑙𝑎𝑎, do 29 Proposed by  Krizhevsky et al. [40] , LRN scheme is found to aid generalization ability of the model. Response competition among contiguous outputs having the same spatial position is introduced. For an output value   on the -th feature map, the normalized output   can be calculated as, 𝑞𝑞 𝑖𝑖 = 𝑝𝑝 𝑖𝑖 �𝛼𝛼 + 𝛿𝛿 ∑ �𝑝𝑝 𝑗𝑗 � 𝑗𝑗∈𝑛𝑛𝑏𝑏(𝑖𝑖,𝑛𝑛) � 𝜃𝜃 𝑎𝑎𝑛𝑛(𝑖𝑖, 𝑎𝑎) = �𝑗𝑗�𝑗𝑗 = max �0, 𝑖𝑖 -𝑎𝑎 2 � … min (𝑁𝑁 -1, 𝑖𝑖 + 𝑎𝑎 2 )� (16) where , , ,  are configurable parameters.
Experiments We carry out experiments on  UMN[41]  dataset and UCSD Ped1 and Ped2[42] datasets for local abnormal event detection. These public datasets that are open to all of research community are used to evaluate the proposed AED-Net with different criteria: frame-level criterion and pixel-level criterion, in which UMN dataset evaluate the model's capacity in frame-level, UCSD Ped1 in pixel-level, frame-level and Ped2 in pixel-level. Both evaluation criteria are based on truth-positive rates (TPR) and false-positive rates (FPR), denoting "abnormal events" as "positive" while "normal status" as "negative". The results of experiments are compared with other state-of-art methods, demonstrating superiority over other methods. scenes are related to escaping action of crowds. In this dataset  [41] , evacuation behaviors of crowds were assigned as abnormal.
We detect the anomalism of each frame so this is measured by frame-level criteria. Fig. 4  shows a couple of frames from each of these scenes. For computation efficiency, all optical flow maps extracted from original video frames are resized to small sizes, which had been proved to contain enough information for detection. Foreground detection is used in this experiment to avoid the disturbance of no-meaning frames. The frames which contain less than three whole human body motion shapes which are shown in Fig. 5  are detected directly in our work by measuring moving foreground blobs. To improve the generalization ability of the AED-Net, data augmentation technique is adopted in this experiment. An Optical flow map is firstly resized to 120 × 160 and nine sub-maps with the size of 96 × 128 are cut from the resized map.
Experiments on improved AED-Net After adding LRN layer to PCAnet, the whole framework is tested on UCSD dataset, and the experiment setting is the same as the previous one on UCSD dataset. The hyperparameters of LRN is set as, γ = 2, δ = 10 -4 , n = 5, β = 0. 75. The results shown in Fig. 7  and Table  3 ,4 shows that after adding LRN, the whole framework shows better performance in detecting anomaly both measured by AUC and EER. It indicates that this strategy does improve our method by promoting its generalization ability.