Zero Variance Markov Chain Monte Carlo for Bayesian Estimators Abstract Interest is in evaluating, by Markov chain Monte Carlo (MCMC) simulation, the expected value of a function with respect to a, possibly unnormalized, probability distribution. A general purpose variance reduction technique for the MCMC estimator, based on the zero-variance principle introduced in the physics literature, is proposed. Conditions for asymptotic unbiasedness of the zero-variance estimator are derived. A central limit theorem is also proved under regularity conditions. The potential of the idea is illustrated with real applications to probit, logit and GARCH Bayesian models. For all these models, a central limit theorem and unbiasedness for the zero-variance estimator are proved (see the supplementary material available on-line).Keywords Control variates · GARCH models · Logistic regression; · Metropolis-Hastings algorithm · Variance reductionThe expected value of a function f with respect to a, possibly unnormalized, probability distribution π, µ f = f (x)π(x)dx/ π(x)dx is to be evaluated. Markov chain Monte Carlo (MCMC) methods estimate integrals using a large but finite set of points, x i , i = 1, · · · , N , collected along the sample path of an ergodic Markov chain having π (normalized) as its unique stationary and limiting distributionμ f = N i=1 f (x i )/N . In this paper a general method is suggested to reduce the MCMC error by replacing f with a different function,f , obtained by properly re-normalizing f . The functionf is constructed so that its expectation, under π, equals µ f , but its variance with respect to π is much smaller. To this aim, a standard variance reduction technique introduced for Monte Carlo (MC) simulation, known as control variates [39] , is exploited.In the rest of this section we briefly explain the zero-variance (ZV) principle introduced in [4, 5] : an almost automatic method to construct control variates for MC simulation, in which an operator, H, acting as a map from functions to functions, and a trial function, ψ, are introduced.In quantum mechanics, a commonly used operator H is the so-called Hamiltonian, which represents the total energy of the system, that is, the sum of the kynetic energy and the potential energy, where the kinetic energy is typically defined as a second-order differential operator. Such operator is Hermitian (that is, self-adjoint) if it acts on the restricted class of infinitely differentiable functions with compact support. If the trial function ψ belongs to this class, and ifthe re-normalized function defined assatisfies µ f = µf : thus both f andf can be used to estimate the desired quantity via Monte Carlo or MCMC simulation. However, for general ψ the condition µ f = µf may not hold anymore and ad-hoc assumptions on the target π are necessary: this issue will be further discussed in Section 5. Inspired by this physical setting, as a general framework H is supposed to be a Hermitian operator (self-adjoint and real in all practical applications) satisfying (1), and the re-normalized function is defined as in (2): depending on the specific choices of H and ψ, the condition µ f = µf has to be carefully verified.Only a few operators will be considered in the paper, the key one being the Hamiltonian differential operator. An other important example discussed below is the Markov operator H acting as Hψ(x) = K(x, y)ψ(y)dy, where K(x, y) needs to be symmetric. The re-normalized function, in this case, becomesfand the condition µ f = µf holds as a simple consequence of (1). Regardless of the specific choice of the operator and of the trial function, the optimal pair (H, ψ), i.e. the one that leads to zero variance, can be obtained by imposing thatf is constant and equal to its average,f = µ f , which Zero Variance Markov Chain Monte Carlo for Bayesian Estimators 3 is equivalent to require that σ 2 (f ) = 0, where σ 2 (·) denotes the variance operator with respect to the target π. The latter, together with (2), leads to the fundamental equation:In most practical applications equation (4) cannot be solved exactly, still, we propose to find an approximate solution in the following way. First choose a Hermitian operator H verifying (1). Second, parametrize ψ and derive the optimal parameters by minimizing σ 2 (f ). The optimal parameters are then estimated using a first short MCMC simulation. Finally, a much longer MCMC simulation is performed usingμf instead ofμ f as the estimator. This final estimator will be called Zero Variance (ZV) estimator through the paper.Other research lines aim at reducing the asymptotic variance of MCMC estimators by modifying the transition kernel of the Markov chain. These modifications have been achieved in many different ways, for example by trying to induce negative correlation along the chain path ([6, 21, 13, 41, 12]); by trying to avoid random walk behavior via successive over-relaxation ([1, 36, 7]); by hybrid Monte Carlo ([16, 35, 10, 18, 27]); by exploiting non reversible Markov chains ([15, 32]), by delaying rejection in Metropolis-Hastings type algorithms ([45, 22]), by data augmentation ([46, 22]) and auxiliary variables ([43, 26, 33, 34]). Up to our knowledge, the only other research line that uses control variates in MCMC estimation follows the PhD thesis by [24] and has its most recent developement in [14] . In [25] it is observed that, for any real-valued function g defined on the state space of a Markov chain {X n }, the one-step conditional expectationhas zero mean with respect to the stationary distribution of the chain and can thus be used as control variate. The Authors also note that the best choice for the function g is the solution of the associated Poisson equation which can rarely be obtained analytically but can be approximated in specific settings. In [14] , the use of this type of control variates is further explored in the setting of reversible Markov chains were a closed form expression for U is often available.In [4, 5] unbiasedness and existence of a central limit theorem (CLT) for the ZV estimator are not discussed, neither in [28] , where this estimator is applied to a toy example. The main contributions of this paper are, on the one hand, to derive the rigorous conditions for unbiasedness and CLT for the ZV estimators in MCMC simulation. On the other hand, we apply the ZV principle to some widely used models (probit, logit, and GARCH) and demonstrate that, under very mild restrictions, the necessary conditions for unbiasedness and CLT are verified.In this section guidelines to choose the operator H, both for discrete and continuous settings, are given. In a discrete state space, denote with P (x, y) a transition matrix reversible with respect to π (a Markov chain will be identified with the corresponding transition matrix or kernel). We restrict our attention in this section to operators H acting as Hf := y K(x, y)f (y). The following choicesatisfies condition (1), where δ(x − y) is the Dirac delta function: δ(x − y) = 1 if x = y and zero otherwise. It should be noted that the reversibility condition imposed on the Markov chain is essential in order to have a symmetric operator K(x, y), as required. With this choice of H, lettingψ = ψ/ √ π, equation (3) becomes:The same H can also be applied in continuous settings. In this case, P is the kernel of the Markov chain and equation (5) can be trivially extended. This choice of H is exploited in [14] , where the following fundamental equation is found for the optimalψ:It is easy to prove that this equation coincides with our fundamental equation (4), with the choice of H given in (5). The Authors observe that the optimal trial function is given byψthat is,ψ is the solution to the Poisson equation for f (x). However, an explicit solution cannot be obtained in general.Another operator is proposed in [4] : if x ∈ R d consider the Schrödinger-type Hamiltonian operator:where V (x) is constructed to fulfill equation (1)∆ √ π and ∆ denotes the Laplacian operator of second order derivatives. In this setting, we obtain the general expression forf reported in (2), where now H is the Schrödinger-type Hamiltonian. These are the operator and the re-normalized function that will be considered throughout this paper. Although it can only be applied to continuous state spaces, this Schrödinger-type operator shows several advantages with respect to the operator (5). First of all, in order to use (5) the conditional expectation appearing in (6) has to be available in closed form. Secondly, definition (7) does not require reversibility of the Markov chain. Moreover, this definition is independent of the kernel P (x, y) and, therefore, also of the type of MCMC algorithm that is used in the simulation. Note that, for calculatingf both with the operator (7) and (5), the normalizing constant of π is not needed.The optimal choice of ψ is the exact solution of the fundamental equation (4). In real applications, typically, only approximate solutions, obtained by minimizing σ 2 (f ), are available. In other words, we select a functional form for ψ, parameterized by some coefficients of a class of polynomials, and optimize those coefficients by minimizing the fluctuations of the resultingf . The particular form of ψ is very dependent on the problem at hand, that is on π, and on f . In the sequel it will be assumed that ψ = P √ π, where P is a polynomial. As one would expect, the higher is the degree of the polynomial, the higher is the number of control variates introduced and the higher is the variance reduction achieved. It can be easily shown that in a d dimensional space, using polynomials of order p, provides d+p d− 1 control variates. However, some restrictions on the coefficients may occur in order to get an unbiased MCMC estimator. See Example 1 of Section 5 at this regard.In this section, general expressions for the control variates in the ZV method are derived. Using the Schrödinger-type Hamiltonian H as given in (7) and trial function ψ(x) = P (x) π(x), the re-normalized function is:where. Like any other control variate (i.e. zero mean random variables under the distribution of interest), the variable z can be monitored to test convergence along the lines suggested by [11] and [38], where the same control variate z = ∇ log π is used.Hereafter the function P is assumed to be a polynomial. As a first case, for P (x) = d j=1 a j x j (1st degree polynomial), one gets:The optimal choice of a, that minimizes the variance off (x), is:For a more general approach to the choice of coefficients using control variates, reference should be made to [37] and [30] . We anticipate that conditions under which the ZV-MCMC estimator obeys a CLT (Section 5) guarantee that the optimal a is well defined. In ZV-MCMC, the optimal a is estimated in a first 6 Antonietta Mira et al.stage, through a short MCMC simulation 1 . When higher-degree polynomials are considered, a similar formula for the coefficients associated to the control variates is obtained once an explicit formula for the control variate vector z has been found. As an example, for quadratic polynomialsthe re-normalizedf is :Using second order polynomials yields a vector of control variates of dimension 1 2 d(d+3). Therefore, finding the optimal coefficients requires working with Σ zz which is a matrix of dimension of orderd 2 . This makes the use of second order polynomials computationally expensive when dealing with high-dimensional sampling spaces, say of the order of decades.As remarked in Section 1, condition (1) may not be sufficient to ensure unbiasedness of the estimator when the Schrödinger operator (7) is used. In this section general conditionys on the target π are provided that guarantee that the ZV-MCMC estimator is (asymptotically) unbiased for the class of trial functions discussed. Details can be found in the on-line supplementary material, Appendix D.Proposition 1 Let π be a d-dimensional density on a bounded open set Ω with regular boundary ∂Ω, whose first and second derivatives are continuous. Then, if ψ = P √ π, a sufficient condition for unbiasedness of the ZV-MCMC estimator is π(x)The previous proposition is a consequence of multidimensional integration by parts, from which one gets the equalitywhere n denotes the versor orthogonal to ∂Ω. When π has unbounded support, integration by parts cannot be used directly. In this case, we can formulate the following result.Proposition 2 Let π be a d-dimensional density with unbounded support Ω, whose first and second derivatives are continuous, and let (B r ) r be a sequence of bounded subsets, so that B r Ω. Then, a sufficient condition for unbiasedness of the ZV-MCMC estimator is lim r→+∞ ∂Br π∇P · ndσ = 0.1 From a practical point of view there is no need to run two separate chains, one to get the control variates and one to get the final ZV estimator: everything can be done on a single Markov chain which is run once to estimate the optimal coefficients of the control variates and then post-processed to get the ZV estimator.In the univariate case, if Ω is some interval of the real line, that is, Ω = (l, u), where u, l ∈ R ∪ ±∞, it is sufficient thatwhich is true, for example, if dP dx π annihilates at the border of the support. In the seminal paper by [4] unbiasedness conditions are not clearly explored since, typically, the target distribution the physicists are interested in, annihilate at the border of the domain with an exponential rate. The following example shows how crucial the choice of trial functions is, in order to have an unbiased estimator, even in trivial models.Example 1 Let f (x) = x and π be exponential: π(x) = λe −λx I {x>0} . If P (x) is a first order polynomial, (10) does not hold and this choice does not allow for a ZV-MCMC estimator, since the control variate z = − 1 2 d dx ln π(x) is constant and σ(x, z) = 0. However, to satisfy equation (10) it is sufficient to consider second order polynomials. Indeed, if P (x) = a 0 + a 1 x + a 2 x 2 equation (10) is satisfied provided that a 1 = 0 and the minimization of the variance off can be carried out within this special class. The optimal choice a 2 := 1 2λ yields zero variance: σ 2 (f ) ≡ 0.Conditions for existence of a CLT forμ f are well known in the literature ([44]). Using these classical results, from (8) we have that the ZV-MCMC estimator obeys a CLT provided f , ∆P and ∇P · z belong to L 2+δ (π) when the Markov chain run for the simulation is geometrically ergodic. In the next corollary, the case of linear and quadratic polynomials P (used in the examples in Section 6) is considered.√ π, where P (x) is a first or second degree polynomial. Then, the ZV-MCMC estimatorμf is a consistent estimator of µ f which satisfies the CLT, provided one of the following conditions holds: C1 : The Markov chain is geometrically ergodic and f , x k i z j ∈ L 2+δ (π), ∀i, j, for all k ∈ {0, deg P − 1} and some δ > 0. C2 : The Markov chain is uniformly ergodic and f , x k i z j ∈ L 2 (π), ∀i, j and for all k ∈ {0, deg P − 1}.In the case of linear P , using the definition of control variate, the statement of the previous corollary can be reformulated in this simple way: if f ∈ L 2 (π) and the chain is uniformly ergodic, then a sufficient condition to get a CLT isThe quantity m j is known in the literature as Linnik functional (if considered as a function of the target distribution, I(π)) since it was introduced by [29] . The quantity m j is also interpretable as the Fisher information of a location family in a frequentist setting.Let π belong to a d-dimensional exponential family:, where β ∈ R d is the vector of natural parameters. The following theorem provides a sufficient condition for a CLT for ZV-MCMC estimators when the target belongs to the exponential family and a uniformly ergodic Markov Chain is considered. Similar results can be achieved when the Markov Chain is geometrically ergodic, by considering the 2 + δ moment. This statement can be easily verified by a direct computation.Theorem 1 Let π belong to an exponential family, with p such thatExample 2 The Gamma density Γ (α, θ) can be written as an exponential family on (0, +∞), where p(x) ≡ 1, so that hypotheses of Theorem 1 are satisfied. A direct computation shows that the Gamma density Γ (α, θ) has finite Linnik functional for any θ and for any α ∈ {1} ∪ (2, +∞). Under these conditions, a CLT holds for the ZV-MCMC estimator.In the sequel standard statistical models are considered. For these models, the ZV-MCMC estimators are derived in a Bayesian context; from now on, the target π = π(β|x) is the Bayesian posterior distribution: therefore, the argument associated with the state of the Markov chain is denoted by β instead of x, which represents, now, the vector of data. The operator H considered is the Schrödinger-type Hamiltonian defined in (7), and ψ = P √ π, where P is a polynomial.Numerical simulations are provided, that confirm the effectiveness of variance reduction achieved, by minimizing the variance off within the class of trial functions considered. Moreover, conditions for both unbiasedness and CLT forf are verified for all the examples. For the mathematical derivation of the zero-variance estimator and the proofs of unbiasedness and CLT for the models considered, we refer the reader to the appendices of the on-line supplementary material (Appendices A, B and C). 1, 2, 3, 4) , are the length of the bill, the width of the left and the right edge, and the bottom margin width. These variables are used in a probit model as the regressors, and the type of the banknote y i , is the response variable (0 for genuine and 1 for counterfeit). Using flat priors, the Bayesian estimator of each parameter, β k , under squared error loss function, is the expected value of f k (β) = β k under π (k = 1, 2, · · · , d). The Bayesian analysis of this problem is discussed in [31] . In order to find the optimal vector of parameters a k of the trial functions, a short Gibbs sampler, following ([2]), (of length 2000, after 1000 burn in steps) is run, and the optimal coefficients are estimated:Finally another MCMC simulation of length 2000 is run (and using the estimated optimal values obtained in the previous step), along which f k (β), for k = 1, . . . , 4 is averaged. We have repeated this experiment 100 times. The MCMC traces of the ordinary MCMC and the ZV-MCMC in one of these MOnte Carlo experiments have been depicted in the left plot of Fig. 1 . The blue curves are the traces of f k (ordinary MCMC), and the red ones are the traces of f k (ZV-MCMC). It is clear from the figure that the variances of the estimator have substantially decreased. Indeed for the linear trial functions, the ratios of the Monte Carlo estimates of the asymptotic variances of the two estimators (ordinary MCMC and ZV-MCMC) are between 25 and 100. Even better performance can be achieved using second degree polynomials to define the trial function. In the right column of Fig. 1 the traces of ZV-MCMC with second order P (x) are reported along with the traces of the ordinary MCMC. As it can be seen from the figure, the variances of the ZV estimators are negligible: the ratio of the Monte Carlo estimates of the asymptotic variances of the two estimators are between 18, 000 and 90, 000. In this example (with the simulation length and burn-in reported above) the CPU time of ZV-MCMC is almost 3 times larger than the one of ordinary MCMC.In order to study the unbiasedness of the ZV-estimators empirically, we have run a very long MCMC (of length 10 8 ) and obtained a very narrow 95% confidence region for each parameter. In Fig. 2 we have depicted the box-plot of the ordinary MCMC (first box-plot), and the ZV-estimators (second and third box-plot) along with these 95% confidence regions (the green regions). As it can be seen, the ZV-estimators are concentrated in the 95% confidence regions obtained from the very long chain. Fig. 3 Box-plots of ordinary MCMC estimates (1) and ZV-MCMC estimates (2 and 3) for the logit model, along with the 95% confidence region obtained by an ordinary MCMC of length 10 8 (green regions).A logit model is fitted to the same dataset of Swiss banknotes previously introduced. Flat priors are used and, as before, the Bayesian estimator of each parameter, β k , (again under squared error loss functions) is the expected value of β k under π (k = 1, 2, · · · , d). Similar to the probit example, in the first stage a MCMC simulation is run, and the optimal parameters of P (β) are estimated. Then, in the second stage, an independent simulation is performed, andf k is averaged, using the optimal trial function estimated in the first stage (the same simulation length and burn-in, as in the probit example, have been used). For linear polynomial, the ratio of the Monte Carlo estimates of the asymptotic variances of the two estimators (ordinary MCMC and ZV-MCMC) are between 15 and 50. Using quadratic polynomials, these ratios are between 15, 000 and 20, 000. In this example the CPU time of the ZV-MCMC is almost 3 times higher than that of ordinary MCMC.We have run a very long MCMC (of length 10 8 ) and obtained a very narrow 95% confidence region for each parameter. In Fig. 3 we have depicted the box-plot of the ordinary MCMC (first box-plot), and the ZV-estimators (second and third box-plot) along with these 95% confidence regions (the green regions). Again, as it can be seen, the ZV-estimators are concentrated in the 95% confidence regions obtained from the very long Markov chain. 1st Degree P (x) 8-18 13-28 12-27 2nd Degree P (x) 1200-2700 6100-13500 6200-13800 3rd Degree P (x) 21000-47000 48000-107000 26000-58000Generalized autoregressive conditional heteroskedasticity (GARCH) models ([8]) have become one of the most important building blocks of models in financial econometrics, where they are widely used to model returns. Here it is shown how the ZV-MCMC principle can be exploited to estimate the parameters of a univariate GARCH model applied to daily returns of exchange rates in a Bayesian setting. Let S(t) be the exchange rate at time t. The daily returns are defined as r(t) := [S(t) − S(t − 1)]/S(t − 1) ≈ ln (S(t)/S(t − 1)). In a Normal-GARCH model, we assume the returns are conditionally Normally distributed, r(t)|F t ∼ N (0, h t ), where h t = ω 1 + ω 3 h t−1 + ω 2 r 2 t−1 , and ω 1 > 0, ω 2 ≥ 0, and ω 3 ≥ 0 are the parameters of the model. The aim is to estimate the expected value of ω j under the posterior π, using independent truncated normal priors. As an example, a Normal-GARCH(1, 1) is fitted to the daily returns of the Deutsche Mark vs British Pound exchange rates from January 1985, to December 1987. In the first stage a short MCMC simulation ([3]) is used to estimate the optimal parameters of the trial function (2000 sweeps after 1000 burn-in). In the second stage an independent simulation is run (with length 10000) andf k (ω) is averaged in order to efficiently estimate the posterior mean of each parameter. We compare this ZV-MCMC with an ordinary MCMC of length 10000 (after 1000 burn-in). First, second and third degree polynomials in the trial function are used. In order to study the effectiveness of ZV-MCMC, we have run these simulations (ordinary MCMC and ZV-MCMC) 100 times. As it can be seen in Table 1 , where a 95% confidence interval for the variance reductions are reported, the ZV strategy reduces the variance of the estimators up to ten thousand times. In this example (with the simulation and burn-in lengths reported above) the CPU time of the ZV-MCMC is almost 20% higher than the CPU time of ordinary MCMC.In order to study the unbiasedness of the ZV-estimators empirically, we have run a very long MCMC (of length 10 7 ) and obtained a narrow 95% confidence region for each parameter. In Fig. 4 we have depicted the boxplot of the ordinary MCMC (first box-plot), and the ZV-estimators (second, third and fourth box-plots) along with these 95% confidence regions (the green regions). As it can be seen the ZV-estimators lie in the range obtained by the very long MCMC. Finally, note that the ZV strategy can be used in great generality and can be applied also to more complex GARCH models (such as E-GARCH, I-GARCH, Q-GARCH, GJR-GARCH, [9]), provided it is possible to analitically compute the necessary derivatives and verify the hypotheses needed for unbiasedness and CLT, in a way similar to the proof reported in Appendix C.Cross-fertilizations between physics and statistical literature have proved to be quite effective in the past, especially in the MCMC framework. The first paradigmatic example is the paper by [23] first and [19] later on.Besides translating into statistical terms the paper by [4] , the main effort of our work has been the discussion of unbiasedness and convergence of the ZV-MCMC estimator. The study of CLT leads to the condition of finiteness for. This quantity has also been used in the recent paper by [20] as a metric tensor to improve efficiency in Langevin diffusion and Hamiltonian MC methods. Their idea is to choose this metric as an optimal, local tuning of the dynamic, which is able to take into account the intrinsic anisotropy in the model considered. In our understanding, what makes these methods and our extremely efficient, is the common strategy of exploiting information contained 14 Antonietta Mira et al.in the derivatives of the log-target. A combination of the two strategies could be explored: once the derivatives of the log-target are computed, they can be used both to boost the performance of the Markov chain (as suggested by [20] ) and to achieve variance reduction by using them to design control variates. This is particularly easy since control variates can be constructed by simply post-processing the Markov chain and, thus, there is no need to re-run the simulation.The second main contribution of this paper is the critical discussion of the selection of H and ψ. A comparison between the variance reduction framework exploited in [14] and the choice of different operators H in our context has remarked contras and benefits of the two approaches. Different choices of H and ψ could provide alternative efficient variance reduction strategies. This can be easily achieved by considering a wider class of trial functions: ψ(x) = P (x)q(x), where, as before, P (x) denotes a parametric class of polynomials, and q(x) is an arbitrary (sufficiently regular) function.In the present research we have explored ψ based on first, second and third degree polynomials. Despite the use of this fairly restrictive class of trial functions, the degree of variance reduction obtained in the examples in Section 6 and in other simulation studies (not reported here) is impressive and of the order of ten times (for first degree polynomials) and of thousand times (for higher degree polynomials), with practically small extra CPU time needed in the simulation.Finally, mention should be made to an alternative, more general renormalized functionf reported in the paper by [5] , defined as:where, again, H is an Hamiltonian operator and ψ a quite arbitrary trial function. In this setting, if H = − 1 2 ∆ + V , under the same, mild conditions discussed in Section 5,f has the same expectation as f under π. This is true without imposing condition (1), so that now V can be also chosen arbitrarily. Therefore, the re-normalization (11) allows for a more general class of Hamiltonians. Cross-fertilizations between physics and statistical literature have proved to be quite effective in the past, especially in the MCMC framework. The first paradigmatic example is the paper by [23] first and [19] later on.. Besides translating into statistical terms the paper by [4] , the main effort of our work has been the discussion of unbiasedness and convergence of the ZV-MCMC estimator. The study of CLT leads to the condition of finiteness for. . This quantity has also been used in the recent paper by [20] as a metric tensor to improve efficiency in Langevin diffusion and Hamiltonian MC methods. Their idea is to choose this metric as an optimal, local tuning of the dynamic, which is able to take into account the intrinsic anisotropy in the model considered. In our understanding, what makes these methods and our extremely efficient, is the common strategy of exploiting information contained in the derivatives of the log-target. A combination of the two strategies could be explored: once the derivatives of the log-target are computed, they can be used both to boost the performance of the Markov chain (as suggested by [20] ) and to achieve variance reduction by using them to design control variates. This is particularly easy since control variates can be constructed by simply post-processing the Markov chain and, thus, there is no need to re-run the simulation.. The second main contribution of this paper is the critical discussion of the selection of H and ψ. A comparison between the variance reduction framework exploited in [14] and the choice of different operators H in our context has remarked contras and benefits of the two approaches. Different choices of H and ψ could provide alternative efficient variance reduction strategies. This can be easily achieved by considering a wider class of trial functions: ψ(x) = P (x)q(x), where, as before, P (x) denotes a parametric class of polynomials, and q(x) is an arbitrary (sufficiently regular) function.. In the present research we have explored ψ based on first, second and third degree polynomials. Despite the use of this fairly restrictive class of trial functions, the degree of variance reduction obtained in the examples in Section 6 and in other simulation studies (not reported here) is impressive and of the order of ten times (for first degree polynomials) and of thousand times (for higher degree polynomials), with practically small extra CPU time needed in the simulation.. Finally, mention should be made to an alternative, more general renormalized functionf reported in the paper by [5] , defined as:. where, again, H is an Hamiltonian operator and ψ a quite arbitrary trial function. In this setting, if H = − 1 2 ∆ + V , under the same, mild conditions discussed in Section 5,f has the same expectation as f under π. This is true without imposing condition (1), so that now V can be also chosen arbitrarily. Therefore, the re-normalization (11) allows for a more general class of Hamiltonians.

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O B I O B I O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O B I O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O B I O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O B I O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Support vector machine based multi-view face detection and recognition Detecting faces across multiple views is more challenging than in a fixed view, e.g. frontal view, owing to the significant non-linear variation caused by rotation in depth, self-occlusion and self-shadowing. To address this problem, a novel approach is presented in this paper. The view sphere is separated into several small segments. On each segment, a face detector is constructed. We explicitly estimate the pose of an image regardless of whether or not it is a face. A pose estimator is constructed using Support Vector Regression. The pose information is used to choose the appropriate face detector to determine if it is a face. With this pose-estimation based method, considerable computational efficiency is achieved. Meanwhile, the detection accuracy is also improved since each detector is constructed on a small range of views. We developed a novel algorithm for face detection by combining the Eigenface and SVM methods which performs almost as fast as the Eigenface method but with a significant improved speed. Detailed experimental results are presented in this paper including tuning the parameters of the pose estimators and face detectors, performance evaluation, and applications to video based face detection and frontal-view face recognition. q Over the past decade, face recognition has emerged as an active research area in computer vision with numerous potential applications including biometrics, surveillance, human -computer interaction, video-mediated communication, and content-based access of images and video databases. We have presented in this paper an integrated approach to multi-view face detection. The contributions of this work include:. (1) A novel approach to multi-view face detection, where pose information is explicitly estimated first, and is used to select an appropriate face detector. (2) An SVM regression based method to estimate the head pose. (3) A hybrid algorithm combining SVM and Eigenface methods for face detection which provides improved performance in terms of accuracy and speed.. Face detection can be defined as a classification problem of separating face patterns from non-face patterns. Therefore, estimating a boundary which robustly separates the two classes of patterns is more promising than other methods such as probabilistic modelling of the face patterns or the density functions of both face and non-face patterns since only the face and non-face patterns located around the boundary are concerned. This is actually the underlying characteristic of SVMs. By iteratively collecting near-face negative patterns using a prototype face detector, we can gradually refine the detector, making it well fitted to the boundary between face and non-face patterns.. Unlike the frontal-view problem, detecting faces with large pose variation is more challenging since the severe nonlinearity caused by rotation in depth, self-shadowing and self-occlusion yields an extraordinarily irregular distribution of face patterns. The straightforward method, constructing a single universal detector, proved to be inefficient. Some researchers tried to build view-based piece-wise multiple models to solve this problem [17, 27, 31] . However, computation is intensified since a pattern needs to be evaluated on more models. In this work, we presented a novel approach to this problem by explicitly using the pose information. By determining firstly the possible pose of a pattern, only the classifier for this specific pose is needed for detection. Moreover, the computation on pose estimation, which may be intuitively regarded as an extra burden, does not impose a significant influence on the real-time performance of a system since a 'cheap' pose estimator, which provides a coarse estimation, is sufficient.. We have presented an appearance based approach to pose estimation in this paper. PCA is adopted to represent multi-view face patterns in a low-dimensional orthogonal feature space, and SVM regression is employed to construct the pose estimators. The advantage of the SVM pose estimator is that it can be trained directly from the data with little requirement of the prior knowledge about the data and it is guaranteed to converge.. To improve the overall performance of face detection in terms of both speed and accuracy, three methods for multiview face detection were implemented and compared with Fig. 4 ), while the SVM method is more accurate but slower since the number of SVs cannot be efficiently controlled at a low level. By combining the two methods together, a novel method is proposed which keeps the advantages and suppresses the disadvantages of both methods. The properties of the hybrid method include:. (1) Most 'obvious' patterns are determined by the Eigenface method which is fast; (2) The ambiguous patterns are classified by the SVM method which is accurate; (3) The SVM classifier is trained only on a small set of ambiguous patterns, thus it is more accurate and faster.. This hybrid method can also be applied to other classification problems.. Another interesting issue is dynamic face detection from video input. In this situation, motion, skin colour and background information provide enriched information for detection. Although robust motion estimation and colour constancy over time can be problematic, a relatively simple method, which adopts temporal differencing for motion estimation, mixtures of Gaussians for skin colour modelling, and grouping motion and skin colour for selective attention, has proved to be sufficient to improve the real-time performance.. As a case study, we have also implemented a frontalview face recognition system based on the face detection results. Satisfactory results have been obtained on a small number of subjects. Statistical methods have been widely adopted in face detection. 34] introduced the Eigenface method, where the probability of face patterns is modelled by the 'distance-in-feature-space' (DIFS) and 'distance-from-feature-space' (DFFS) criteria. Osuna et al. [32, 33] presented an SVM-based approach to frontal-view face detection. Unlike the Eigenface method where only the positive density is estimated, this approach seeks to learn the boundary between face and non-face patterns. After learning, only the 'important' examples located on the boundary are selected to build the decision function. Soulie et al. [44] described a system using neural networks (NNs) for face detection. They implemented a multi-modal architecture where various rejection criteria are employed to trade-off false recognition against false rejection. Sung and Poggio [46] also presented a NN based face detection system. They designed six positive prototypes (faces) and six negative prototypes (non-faces) in the hidden layer. Supervised learning is performed to determine the weights of these prototypes to the output node. Rowley et al. [37] introduced a NN based upright frontal face detection system. A retinally connected NN examines small windows of an image and decides whether each window contains a face. This work was later extended to rotation invariant face detection by designing an extra network to estimate the rotation of faces in the image plane [38, 39] . Gong et al. [9] used general and modified hyper basis function (HBF) networks with Gaussian mixture models to estimate the density function of face space with large pose variation. As a result, face recognition can be performed more successfully than with either of the linear models. McKenna et al. [23, 24] presented an integrated face detection-tracking system where a motion-based tracker is used to reduce the search space and Multi-Layer Perceptron (MLP) based face detection is used to resolve ambiguities in tracking.. Feature-based methods have also been extensively addressed in previous work. For example, Brul and Perona [3] proposed a framework for recognising planar object classes, such as recognising faces from images, based on local feature detectors and a probabilistic model of the spatial configuration of the features. Yow and Cipolla [52] proposed a face detection framework that groups image features into meaningful entities using perceptual organisation, assigns probabilities to each of them, and reinforces the probabilities using Bayesian reasoning. They claimed that the framework can be applied to face detection under scale, orientation and viewpoint variations [51] .. Recently, Viola and Jones [13] presented an approach to fast face detection using simple rectangle features which can be efficiently computed from the so-called Integral Image. AdaBoost and cascade methods are then used to train a face detector based on these features. Li et al. [17, 53] adopted similar but more general features which can be computed from block differences. Also, FloatBoost is proposed to overcome the monotonicity of the sequential AdaBoost learning.

O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Region-based segmentation of 2D and 3D images with tissue-like P systems Membrane Computing is a biologically inspired computational model. Its devices are called P systems and they perform computations by applying a finite set of rules in a synchronous, maximally parallel way. In this paper, we develop a variant of P-system, called tissue-like P system in order to design in this computational setting, a region-based segmentation algorithm of 2D pixel-based and 3D voxel-based digital images. Concretely, we use 4-adjacency neighborhood relation between pixels in 2D and 6-adjacency neighborhood relation between voxel in 3D for segmenting digital images in a constant number of steps. Finally, specific software is used to check the validity of these systems with some simple examples. Natural Computing studies new computational paradigms inspired on Nature. It abstracts the way in which Nature ''computes'', conceiving new computing models. There are several fields in Natural Computing that are now well established, such as Genetic Algorithms (Holland, 1992) , Neural Networks (McCulloch and Pitts, 1988) , DNA-based molecular computing (Adleman, 1994) .. Membrane Computing is a theoretical model of computation inspired by the structure and functioning of cells as living organisms able to process and generate information. The computational devices in Membrane Computing are called P systems (Pȃun, 2000) . Roughly speaking, a P system consists of a membrane structure, in whose compartments one places multisets of objects which evolve according to given rules. In the most common model, the rules are applied in a synchronous non-deterministic maximally parallel way, but some other semantics are being explored.. According to their architecture, these models can be split into two sets: cell-like P systems (Pȃun, 2000) and tissue-like P systems (Mira and Álvarez, 2007; Díaz-Pernil et al., 2008 ). In the first systems, membranes are hierarchically arranged in a tree-like structure. The inspiration for such architecture is the set of vesicles inside the cell. All of them perform their biological processes in parallel and life is the consequence of the harmonious conjunction of such processes. This paper is devoted to the second approach: tissue-like P systems. (Stockman and Shapiro, 2001) refers to the process of partitioning a digital image into multiple segments (sets of pixels). The goal of segmentation is to simplify and/or change the representation of an image into something that is more meaningful and easier to analyze. Image segmentation is typically used to locate objects and boundaries (lines, curves, etc.) in images. More precisely, image segmentation is the process of assigning a label to every pixel in an image in such a way those pixels with the same label share certain visual characteristics. There exist different techniques to segment an image. Some of them are Clustering methods (Li et al., 2008) , Histogram-based methods (Tobias and Seara, 2002) , Watershed transformation methods (Tarabalka et al., 2010) , Graph partitioning methods (Yuan et al., 2009) . Some of the practical applications of image segmentation are medical Imaging (Campadelli et al., 2009) , study of anatomical structures, location of objects in satellite images (roads, forests, etc.) (Gamanya et al., 2007) , and face recognition (Zhao et al., 2003) . In this paper, tissue-like P-systems (Díaz-Pernil et al., 2008) are used for theoretically solving a region-based segmentation prob- lem for digital images. This work opens new promising research lines: (a) developing efficient sequential software mimicking these Natural Computing techniques; (b) developing efficient parallel software working with a cluster or a graphic card (GPUs); (c) and also designing topology-based processes (topological noise removal, topological simplification, snakes and active contours, topological filling, image compression,. . .) in Digital Imagery using Membrane Computing. Segmentation can be seen as a topologybased process in Digital Imagery, attending to the topological characteristics (connected components and holes, mainly) of each object defined by one unique label. To have at hand representation models for digital images trying to capture full topological and geometrical information of them (González-Díaz and Real, 2005; González-Díaz et al., 2009a,b) could be of help for getting this last goal.

B I O O O O O O O B I B I O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Non-reducible descriptions for conditional Kolmogorov complexity Assume that a program p on input a outputs b. We are looking for a shorter program q having the same property (q(a) = b). In addition, we want q to be simple conditional to p (this means that the conditional Kolmogorov complexity K (q|p) is negligible). In the present paper, we prove that sometimes there is no such program q, even in the case when the complexity of p is much bigger than K (b|a). We give three different constructions that use the game approach, probabilistic arguments and algebraic arguments, respectively.Let a and b be binary strings. Consider programs p such that p(a) = b (the program p on input a outputs b). What is the minimal length of such a program? If the programming language is chosen appropriately, this length is close to K (b|a), the conditional Kolmogorov complexity of b given a. We will ignore additive terms of order O(log n) where n is the maximum length of the strings involved. With this precision all the versions of Kolmogorov complexity (the plain one, the prefix one etc.) coincide. For the definition of Kolmogorov complexity K (b) and K (b|a) we refer to the textbook [2] .To avoid references to a specific programming language we will consider "descriptions" instead of programs. A string p is called a conditional description of a string b given a if

O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


New Crosstalk Avoidance Codes Based on a Novel Pattern Classification Abstract-The crosstalk delay associated with global on-chip interconnects becomes more severe in deep submicrometer technology, and hence can greatly affect the overall system performance. Based on a delay model proposed by Sotiriadis et al., transition patterns over a bus can be classified according to their delays. Using this classification, crosstalk avoidance codes (CACs) have been proposed to alleviate the crosstalk delays by restricting the transition patterns on a bus. In this paper, we first propose a new classification of transition patterns, and then devise a new family of CACs based on this classification. In comparison to the previous classification, our classification has more classes and the delays of its classes do not overlap, both leading to more accurate control of delays. Our new family of CACs includes some previously proposed codes as well as new codes with reduced delays and improved throughput. Thus, this new family of CACs provides a wider variety of tradeoffs between bus delay and efficiency. Finally, since our analytical approach to the classification and CACs treats the technology-dependent parameters as variables, our approach can be easily adapted to a wide variety of technologies. In this paper, we proposed a new classification of transition patterns. The new classification has finer classes and the delays do not overlap among different classes. Hence the new classification is conducive to the design of CACs. To illustrate this, we designed a family of CACs with different constraints. Some codes of the family are the same as existing codes, OLCs, FPCs, and FOCs. We also proposed two new CACs with a smaller worst case delay and better throughput than OLCs. Since our analytical approach to the classification and CACs treats the technology-dependent parameters as variables, our approach can be easily adapted to a wide variety of technologies.

O B I I O O O O O O O O B O O O O B O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


The Research of QoS Approach in Web Servers Abstract: Proportional Delay Guarantee has been widely used in the Web QoS service, and the most basic methods are the feedback of control theory and the predictive control of queuing theory. While the former belonging to passive control has a long setting time and imperfect real-time, the latter can not simulate the Web server queuing system well because of the model limitations. After the experimental verification and shortages analysis of the two methods, an improved approach is proposed in this paper. Based on the queuing feature of Web server and the HTTP 1.1 persistent connection, the improved approach predicts the delay by calculating the queue length and service rate and achieves the relative delay guarantee of different classes by adjusting their quota of worker threads. The experimental results demonstrate that the approach could maintain the relative delay guarantees well even in poor network environment and performs a much better superior compared with the traditional methods. The increasing diversity of Web applications the last decade has witnessed an increasing demand for provisioning of different levels of quality of service (QoS) to meet changing system configuration and satisfy different client requirements. Proportional delay differentiation (PDD) service aims to ensure the QoS parameters between data flow of different classes to meet the specified proportions, so the requests with higher priority will receive the quality of service which is "at least not lower than" the low priority. There are many previous studies worked on the Web QoS and two different methods are used to achieve the differentiated service: the feedback of control theory (see [1] , [2] , [3] , [4] and [5] ) and predictive control of queuing theory (see [2] , [6] and [7] ). Although the algorithms are different, the QoS architecture of Web server they used is non-distinctive.. The QoS of Web application is usually related to the network layer transmission and the operating system kernel. The latter that needs to replace the operating system on all the terminals is difficult to deploy, so more and more researchers tend to the differentiation service on the application layer. It ensures the PDD service by changing the original Web FIFO mechanism and the modified Apache MPM (Multi-Processing Modules) architecture is illustrated in Figure 1 .. 1. The single connection queue is improved to a multi-queue structure in accordance with the classified strategy. The listener monitors the network port, accepts the client TCP connections, classifies the requests based on some classified strategy, and then puts them into the appropriate waiting queue. The paper first presents a general Web QoS architecture, and then analyzed the defects of two traditional differentiated methods by experimental results. Finally, based on the queue length observer and parameter regression, improved predictive controller is proposed and produces a much better performance in real-time and stability.. But there are still some problems. For example, if the parameters b and d obtained online, it will be more accurate to the Web model. Meanwhile, the paper only talked about the static requests and is not compatible to the dynamic loads. In the future, we should also break the local area network, and take the network congestion into account.

O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Anonymity and one-way authentication in key exchange protocols Key establishment is a crucial cryptographic primitive for building secure communication channels between two parties in a network. It has been studied extensively in theory and widely deployed in practice. In the research literature a typical protocol in the public-key setting aims for key secrecy and mutual authentication. However, there are many important practical scenarios where mutual authentication is undesirable, such as in anonymity networks like Tor, or is difficult to achieve due to insufficient public-key infrastructure at the user level, as is the case on the Internet today.In this work we are concerned with the scenario where two parties establish a private shared session key, but only one party authenticates to the other; in fact, the unauthenticated party may wish to have strong anonymity guarantees. We present a desirable set of security, authentication, and anonymity goals for this setting and develop a model which captures these properties. Our approach allows for clients to choose among different levels of authentication. We also describe an attack on a previous protocol of Øverlier and Syverson, and present a new, efficient key exchange protocol that provides one-way authentication and anonymity. Authentication is one of the core security properties that many cryptographic protocols aim to provide: one party wishes to be convinced of the identity of another party. But in many contexts, the opposite property, anonymity is equally important: one party wishes for no one to be able to determine her identity. 1 Anonymity is an enabling technology for privacy, whether for normal citizens going about their day-to-day lives or for dissidents and whistleblowers putting themselves in danger because of the information they transmit.. In practice, the seemingly opposite properties of anonymity and authentication go handin-hand: Alice, wishing to remain anonymous, wants to communicate with Bob and be assured of Bob's identity. We see this in a number of examples on the Internet today:. • In the Tor anonymity network [DMS04, Tor11] , an anonymous client node establishes an encrypted Tor circuit through authenticated intermediate relay nodes.. • In secure web (HTTPS) transactions, the most common mode of operation has an unauthenticated client communicating with an authenticated server. There can be various reasons for clients to be unauthenticated. It may be that the client is not trying to gain access to any resources that require authentication but is indifferent to its anonymity, or it may in fact be that the client wishes very strongly to be anonymous.. Authenticated key exchange (AKE) is one of the most important cryptographic constructs and is used to establish an authenticated and confidential communication channel. Existing approaches to two-party key exchange have emphasized mutual authentication, in which both parties authenticate themselves to their peer. The use of one-way authenticated protocols raises an important question: what is the motivation for an authenticated server to use an encrypted channel to communicate with an unauthenticated client? We will argue that in some sense, the security provided with respect to confidentiality is upper-bounded by the security provided with respect to authentication. From the server's perspective there may be no motivation to encrypt the channel with an unauthenticated client, but servers may still wish to go to the computational effort of providing such encrypted connection out of sympathy for the client's security goals or for other external reasons.. Relaxing the authentication requirements in key exchange from mutual to one-way authentication also permits additional security properties, such as anonymity. Some previous approaches to key exchange have permitted identity hiding, in which the identity of a party is never communicated in the clear, but still eventually becomes known to the peer. Anonymity, on the other hand, means that a party's identity is kept secret even from its peer, and is an important privacy tool. A few protocols have been proposed that offer some combination of one-way authenticated key exchange and anonymity, but a more thorough, formal and unified approach is merited.. The cryptographic literature focuses almost entirely on mutually authenticated key exchange, usually in the two-party setting. Security models such as those by Canetti and Krawczyk [CK01] and LaMacchia et al. [LLM07] assume all parties have certificates. Thus session peers are indistinguishable in the sense that each peer can contribute static key pairs and certificates to the key establishment. However, this assumption does not reflect real-world practice. Of the millions of key agreement sessions that happen each day on the Internet, only a tiny proportion involve mutual public key authentication; the vast majority, especially using TLS on the web, involve only one certificate authenticating the server's identity to the client, while the client provides no certificate authentication (at least in the cryptographic key agreement protocol). This is not a surprising fact. Certificates that bind static public keys to identities require a public key infrastructure (PKI), which can be costly to deploy and difficult to manage; while many big corporations can adopt certificates, average users seldom do. Moreover, users tend to move between computers-at home, at work, in Internet cafés-without carrying along private keys and certificates. Even system administrators rarely, if at all, carry private-public key pairs, but nonetheless frequently perform remote maintenance. These scenarios are often encountered in practice, but are not captured by the aforementioned models.. Password-authenticated key exchange (PAKE) [BPR00, BM92] does treat clients and servers differently, and passwords can be easier to use than certificates (though passwords have their own usability and security challenges). Still, PAKE aims to provide mutual authentication for peers, which does not always match a system's needs.. In a number of situations, only one party needs, or can, or wants to be authenticated to the other. Fiore et al. [FGS10] point out that, for the identity-based setting, a mutually authenticated key exchange protocol can be transformed into a one-way protocol by assigning a "dummy" public key / private key pair that is shared among the one-way parties. A similar technique can be applied in the non-identity-based setting. However, one-way AKE need not just be a limited form of mutually authenticated key exchange. It can, for example, pave the way for features like anonymity. The generic construction of Fiore et al. provides no anonymity assertions, and indeed it is not hard to imagine a reasonable protocol or implementation in which nonces are generated by hashing previous values; with a reasonable hash function, this would still provide security, but not unlinkability and hence not anonymity.. Contributions. In this paper, we consider the problem of one-way authenticated key exchange and how it relates to anonymity. We provide an intuitive set of goals that such protocols should achieve, including confidential session key agreement, one-way authentication, and anonymity. We then present a formal model that captures these goals.. Our work differs from existing approaches to models for authenticated key exchange because it provides a means to achieve not only mutual but also only one-way authentication. We provide a security model that distinguishes between sessions that authenticate peers and sessions that do not: we are concerned with the secrecy of session keys that have authenticated peers. We also incorporate in our model the ability for an adversary to predict a party's behaviour by learning public keys in advance. This is a subtle issue as there are protocols -see [MU09] for further discussion -where leaking public information before the protocol run commences makes the difference between security and insecurity. Our security model differs from existing authenticated key exchange security models such as CK01 [CK01] and eCK [LLM07] in that it addresses one-way, not mutually authenticated, sessions, and is more general than the specialized security definition of Goldberg [Gol06] for the one-way Tor Authentication Protocol.. In addition to one-way AKE security, our model also provides anonymity definitions, including anonymity with respect to peers and unlinkability of sessions, and we show that unlinkability is equivalent to anonymity. Anonymity with respect to peers is a stronger property than the identity hiding property present in several existing AKE protocols, such as JFKi [ABB + 04], where the client's identity is hidden from eavesdroppers but eventually known to the peer.. To motivate the need for formal models and proofs, we analyze a key exchange protocol proposed by Øverlier and Syverson [ØS07] for use in the Tor anonymity network 2 and show that this protocol is insecure: it suffers from an authentication flaw allowing adversaries to easily impersonate honest servers to honest clients. As a remedy, we introduce an efficient new one-way authenticated key exchange protocol and show that it provides security and anonymity in our model. Our protocol is suitable for use in a variety of settings, including the establishment of circuits in the Tor network. This work provides a general approach to one-way authenticated key establishment. We motivated the need for a formal approach by analyzing and finding a major flaw in an existing protocol that aims to achieve one-way authentication. Subsequently, we identified the practical motivations for authentication and secrecy assurances of parties engaging in oneway AKE protocols. Based on our discussion we proposed a suitable model that covers those goals and offered an efficient protocol that formally meets the proposed security definition.. In our discussion we related our security definition not only with usual mutually authenticated key establishment protocols but also with public key encryption. It is of interest to formally investigate the relation between public key encryption and our one-way AKE security definitions. Furthermore, identifying and formalizing other goals such as aggregate security or exclusivity, and looking for the relation with our definitions is another worthy objective.. challenger randomly picks a bit b * ; if b * = 0, then the challenger runs one session at party P i the other session at party P j ; if b * = 1, then the challenger runs both sessions at party P i . The adversary's task is to guess b * . Authenticated key agreement. Key agreement is an important cryptographic primitive that has been extensively studied, especially in the two-party authenticated setting [BR93, BWJM97, CK01, CK02, LLM07, MU09]. However, only a few protocols have considered the problem of one-way authentication. Goldberg [Gol06] gave a specialized one-way AKE security definition for the Tor authentication protocol. Øverlier and Syverson [ØS07] proposed some alternative protocols for circuit establishment in Tor but without any security arguments. We analyze one of their protocols in Section 3 and demonstrate it does not prevent server impersonation. Kate et al. [KZG10] describe an identity-based anonymous authenticated key exchange protocol but with a limited session key secrecy definition based on key recovery, not indistinguishability. Morrissey, Smart, and Warinschi [MSW08] analyzed the security of the Transport Layer Security (TLS) protocol in the context of one-way authentication, but with specialized security definitions.. Identity hiding and anonymity. Some key exchange protocols [ABB + 04, CCCT06, Chi07, Kra03] aim to provide identity hiding, in which the identity of one party remains hidden during communication, though the identity becomes available to the peer by the end of the protocol. The Canetti-Krawczyk post-specified peer model [CK02] and MenezesUstaoglu model [MU09] encompass key exchange protocols in which the identity of the peer may not be available at the onset of the protocol.. Other key exchange protocols [Sho99, Gol06, ØS07, KZG10, RIO + 07, CC07] aim to give anonymity, in which even the peer does not learn the long-term identity of the party. This is an important goal for practical applications such as the Tor anonymity network [DMS04] . Most of the references above do not analyze the anonymity properties of their protocols in a formal manner, although a few do. Shoup [Sho99] defines anonymity in the context of the simulation framework for key exchange security, as opposed to the indistinguishability framework of, for example, Canetti-Krawczyk [CK01] , which has now become more commonplace for analyzing key agreement protocols. Kate et al. [KZG10] provide the only other one-way authenticated key exchange protocol with formal anonymity goals, although their definition is specialized for the protocol in question. In this paper, we present a generic anonymity definition, suitable for analyzing a wide variety of protocols, in a framework similar to the key exchange security framework of Canetti-Krawczyk [CK01] .. Some protocols [DGK06] provide deniability, where it cannot be conclusively proven that a party participated in a key exchange session. This differs from anonymity in that a deniable protocol may still leak information about the parties involved in its normal operation.. One-way vs One-flow. We make special note of the difference between one-way AKE and one-flow AKE. One-flow AKE protocols are designed to establish a session key using a single message from the client to the server. It can provide mutual authentication by using two static keys (one each from the client and the server) and one ephemeral key (from the client). In contrast, one-way AKE can use one static key (from the server) and two ephemeral keys (one each from the client and the server), but provides no authentication to the server. Although one can try to view a one-way AKE protocol as the complement of a one-flow AKE protocol, switching ephemeral and static keys, the security properties are substantially different.

B O B I O B I B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O B I O B O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O B I O O O O O O O B O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O B I O B O O O O O O O O O O O O O O O O O O O B I O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O B O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O B I O O O O O B O O O O O O O O O B O O O O O O O B I O B O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O B O O O O O O O O O O O O O O O O B B O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O B I O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O B O B I B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I B O O O O O O O O O O O O O O O O O O B I B O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O B O O O B O O O O O O O O O O O B O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O B I O O O B O O O O O O O O O O O O O O O O O O B O O O O O O O O B O O O O O O B I O O O O O O O B O O O O O O O O O O O O O O O B I O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Efficient and Generalized Pairing Computation on Abelian Varieties Abstract-In this paper, we propose a new method for constructing a bilinear pairing over (hyper)elliptic curves, which we call the R-ate pairing. This pairing is a generalization of the Ate and Atei pairing, and can be computed more efficiently. Using the R-ate pairing, the loop length in Miller's algorithm can be as small as log(r 1=(k) ) for some pairing-friendly elliptic curves which have not reached this lower bound. Therefore, we obtain savings of between 29% and 69% in overall costs compared to the Ate i pairing. On supersingular hyperelliptic curves of genus 2, we show that this approach makes the loop length in Miller's algorithm shorter than that of the Ate pairing. T HE development of efficient algorithms for pairing computation has been a very important issue in pairing-based cryptosystems. The pairing computation on Abelian varieties is generally based on Miller's algorithm for rational functions from scalar multiplications of divisors. Many algorithms for efficient pairing computation have been developed by reducing the iteration loops in Miller's algorithm. Barreto et al. [1] and Galbraith et al. [11] proposed algorithms for fast computation of the Tate pairing over some supersingular elliptic curves. Duursma and Lee [6] improved the BKLS-GHS algorithms by shortening the loop length of Miller's algorithm over some hyperelliptic curves. Barreto et al. [2] extended the Duursma-Lee method to supersingular Abelian varieties using the Eta pairing approach. Recent breakthroughs include the Ate pairing on ordinary elliptic curves by Hess et al. [15] , which is a generalization of Eta pairing, followed by the Ate pairing on hyperelliptic curves by Granger et al. [14] . Matsuda et al. [19] showed that the Ate pairing is always at least as fast as the Tate pairing by providing optimized versions of the Ate and the twisted Ate pairing. For fast pairing computation, it is known that the loop length in Miller's algorithm of the Ate pairing can be as small as where is the Euler-phi function of embedding degree and the prime number is the order of cyclic subgroup of given Abelian variety [15] . Zhao et al. [25] showed that the loop length reaches for some ordinary elliptic curves by proposing the Ate pairing.. In this paper, we propose a new method to construct a bilinear pairing over (hyper)elliptic curves. We call the pairing obtained by this method R-ate pairing. We show that the Ate and Ate pairing can be constructed by this approach. Therefore, this new pairing is a generalization of the Ate and Ate pairing. The R-ate pairing has two main advantages for efficient pairing computation. First, using the R-ate pairing, the loop length in Miller's algorithm can be as small as for some pairing-friendly elliptic curves which have not reached this lower bound. Therefore, this pairing enables the loop length to be around two or three times shorter than that of the Ate pairing on the curves suggested in [3] , [7] , [8] . Second, we show that, on supersingular hyperelliptic curves of genus , the loop length of the R-ate pairing can be reduced by up to half compared to the Ate pairing. In particular, we consider the DL curve [6] , , and analyze the complexity of the R-ate pairing on the curve. This result shows that the R-ate pairing is around 19% faster than the Ate pairing on this curve at 160-bit security level. Galbraith et al. suggested some open problems regarding hyperelliptic pairings in [12] . The first problem is related to loop shortening for the hyperelliptic Ate pairing. The R-ate pairing on hyperelliptic curves gives a positive answer for this question.. This paper is organized as follows. Section II includes the basic mathematical backgrounds such as the Tate, Ate, and Ate pairings and Miller's algorithm. In Section III, we define the R-ate pairing and also investigate the criterion for the R-ate pairing to be computed efficiently. Section IV provides examples of the R-ate pairings on supersingular elliptic curves over a finite field in characteristic and ordinary elliptic curves. Section V describes the R-ate pairings over supersingular hyperelliptic curves of genus two. Section VI includes the complexity analysis of the R-ate pairings over (hyper)elliptic curves provided in Sections IV and V.

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O B I O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O B I O O B I O O O O O O O O O O O O O O O O B I O B I O O O O O O O O O O O O O B I O O O O O O O O B I O O O O O O O O O O B I O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O B I O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O