% !TEX root = main.tex
% !TEX spellcheck = en-US

\section{Non-malleability of Plonk}
\label{sec:plonk}
In this section, we show that $\plonkprotfs$ is simulation-extractable. To this end, we first use the unique opening property to show that
$\plonkprotfs$ has the $\ur{3}$ property,
cf.~\cref{lem:plonkprot_ur}.
Next, we show that $\plonkprotfs$ is rewinding-based knowledge sound. That is, given a number of accepting transcripts whose first $3$ messages match, we can either extract a witness for the proven statement or use one of the transcripts to break the $\udlog$ assumption. This result is shown in the AGM, cf.~\cref{lem:plonkprot_ss}. We then show that $\plonkprotfs$ is $3$-programmable trapdoor-less ZK in the AGM, cf.~\cref{lem:plonk_tlzk}.

Given rewinding-based knowledge soundness, $\ur{3}$ and trapdoor-less zero-knowledge of $\plonkprotfs$, we invoke \cref{thm:se} and conclude that $\plonkprotfs$ is simulation-extractable.

\newcommand{\vql}{\vec{q_{L}}}
\newcommand{\vqr}{\vec{q_{R}}}
\newcommand{\vqm}{\vec{q_{M}}}
\newcommand{\vqo}{\vec{q_{O}}}
\newcommand{\vx}{\vec{x}}
\newcommand{\vqc}{\vec{q_{C}}}

\subsection{Plonk Protocol Description}
\label{sec:plonk_explained}
\oursubsub{The constraint system.}
Assume $\CRKT$ is a fan-in two arithmetic circuit, whose
fan-out is unlimited and has $\numberofconstrains$ gates and $\noofw$ wires
($\numberofconstrains \leq \noofw \leq 2\numberofconstrains$). The constraint
system of $\plonk$ is defined as follows:
\begin{compactitem}
\item Let $\vec{V} = (\va, \vb, \vc)$, where $\va, \vb, \vc
  \in \range{1}{\noofw}^\numberofconstrains$. Entries $\va_i, \vb_i, \vc_i$ represent indices of left,
  right and output wires of the circuit's $i$-th gate.
\item Vectors $\vec{Q} = (\vql, \vqr, \vqo, \vqm, \vqc) \in
  (\FF^\numberofconstrains)^5$ are called \emph{selector vectors}:
  \begin{inparaenum}[(a)]
  \item If the $i$-th gate is a multiplication gate then $\vql_i = \vqr_i = 0$,
    $\vqm_i = 1$, and $\vqo_i = -1$.
  \item If the $i$-th gate is an addition gate then $\vql_i = \vqr_i  = 1$, $\vqm_i =
    0$, and $\vqo_i = -1$.
  \item $\vqc_i = 0$ for multiplication and addition gates.\footnote{The $\vqc_i$ selector vector is meant to encode (input independent) constants.}
  \end{inparaenum}
\end{compactitem}

We say that vector $\vx \in \FF^\noofw$ satisfies constraint system if for all $i
\in \range{1}{\numberofconstrains}$
\[
  \vql_i \cdot \vx_{\va_i} + \vqr_i \cdot \vx_{\vb_i} + \vqo \cdot \vx_{\vc_i} +
  \vqm_i \cdot (\vx_{\va_i} \vx_{\vb_i}) + \vqc_i = 0.
\]

Public inputs $\brak{\inp_j}_{j = 1}^{\instsize}$ are enforced by adding the constrains
\[ \va_i = j, \vql_i = 1, \vqm_i = \vqr_i = \vqo_i = 0, \vqc_i = -\inp_j\,,
\]
for some $i \in \range{1}{\noofc}$.

\oursubsub{Algorithms rolled out}
\label{sec:plonk_explained}
\plonk{} argument system is universal. That is, it allows to verify computation
of any arithmetic circuit which has up to $\numberofconstrains$
gates using a single SRS. However, to make computation efficient, for each
circuit there is allowed a preprocessing phase which extends the SRS with
circuit-related polynomial evaluations.

For the sake of simplicity of the security reductions presented in this paper, we
include in the SRS only these elements that cannot be computed without knowing
the secret trapdoor $\chi$. The rest of the preprocessed input can
be computed using these SRS elements. We thus let them to be computed by the
prover, verifier, and simulator separately.

\ourpar{$\plonk$ SRS generating algorithm $\kgen(\REL)$:}
The SRS generating algorithm picks at random $\chi \sample \FF_p$, computes
and outputs
\(
	\srs = \left(\gone{\smallset{\chi^i}_{i = 0}^{\numberofconstrains + 5}},
	\gtwo{\chi} \right).
\)

\ourpar{Preprocessing:}
Let $H = \smallset{\omega^i}_{i = 1}^{\numberofconstrains }$ be a
(multiplicative) $\numberofconstrains$-element subgroup of a field $\FF$
compound of $\numberofconstrains$-th roots of unity in $\FF$. Let $\lag_i(X)$ be
the $i$-th element of an $\numberofconstrains$-elements Lagrange basis. During
the preprocessing phase polynomials $\p{S_{id j}}, \p{S_{\sigma j}}$, for
$\p{j} \in \range{1}{3}$, are computed:
\begin{equation*}
  \begin{aligned}
    \p{S_{id 1}}(X) & = X,\\[\myskip]
    \p{S_{id 2}}(X) & = k_1 \cdot X,\\[\myskip]
    \p{S_{id 3}}(X) & = k_2 \cdot X,
  \end{aligned}
  \qquad
\begin{aligned}
  \p{S_{\sigma 1}}(X) & = {\textstyle{\sum_{i = 1}^{\noofc} \sigma(i) \lag_i(X)}},\\[\myskip]
  \p{S_{\sigma 2}}(X) & = {\textstyle \sum_{i = 1}^{\noofc}
  \sigma(\noofc + i) \lag_i(X)},\\[\myskip]
  \p{S_{\sigma 3}}(X) & ={\textstyle\sum_{i = 1}^{\noofc} \sigma(2 \noofc + i) \lag_i(X)}.
\end{aligned}
\end{equation*}
Coefficients $k_1$, $k_2$ are such that $H, k_1 \cdot H, k_2 \cdot H$ are
different cosets of $\FF^*$, thus they define $3 \cdot \noofc$
different elements. Gabizon et al.~\cite{EPRINT:GabWilCio19} notes that it is enough to set
$k_1$ to a quadratic residue and $k_2$ to a quadratic non-residue.

Furthermore, we define polynomials $\p{q_L}, \p{q_R}, \p{q_O}, \p{q_M}, \p{q_C}$
such that
\begin{equation*}
  \begin{aligned}
  \p{q_L}(X) & = {\textstyle \sum_{i = 1}^{\noofc}} \vql_i \lag_i(X), \\
  \p{q_R}(X) & = \textstyle \sum_{i = 1}^{\noofc} \vqr_i \lag_i(X), \\
  \p{q_M}(X) & = \textstyle \sum_{i = 1}^{\noofc} \vqm_i \lag_i(X),
\end{aligned}
\qquad
\begin{aligned}
  \p{q_O}(X) & = \textstyle  \sum_{i = 1}^{\noofc} \vqo_i \lag_i(X), \\
  \p{q_C}(X) & =  \textstyle \sum_{i = 1}^{\noofc} \vqc_i \lag_i(X). \\
  \vphantom{\p{q_M}(X)  = \textstyle \sum_{i = 1}^{\noofc} \vqm_i \lag_i(X),}
\end{aligned}
\end{equation*}

\ourpar{Proving statements in $\plonkprotfs$} We show how prover's algorithm
$\prover(\srs, \inp=\brak{\wit'_i}_{i = 1}^\instsize, \wit = \brak{\wit_i}_{i=1}^{3 \cdot \noofc})$ operates for
the Fiat--Shamir transformed version of Plonk. Note that for notational convenience $\wit$ also contains the public input wires $\wit'_i=\wit_i$, $i\in \range{1}{\ell}$.
\begin{description}
\item[Message 1] Sample $b_1, \ldots, b_9 \sample \FF_p$; compute
  $\p{a}(X), \p{b}(X), \p{c}(X)$ as
	\begin{align*}
		\p{a}(X) &= (b_1 X + b_2)\p{Z_H}(X) + \textstyle \sum_{i = 1}^{\noofc} \wit_i \lag_i(X) \\
		\p{b}(X) &= (b_3 X + b_4)\p{Z_H}(X) + \textstyle \sum_{i = 1}^{\noofc} \wit_{\noofc + i} \lag_i(X) \\
		\p{c}(X) &= (b_5 X + b_6)\p{Z_H}(X) + \textstyle \sum_{i = 1}^{\noofc} \wit_{2 \cdot \noofc + i} \lag_i(X)
	\end{align*}
	Output polynomial commitments $\gone{\p{a}(\chi), \p{b}(\chi), \p{c}(\chi)}$.

\item[Message 2] Compute challenges $\beta, \gamma \in \FF_p$ by querying random oracle
  on partial proof, that is,
	\(
		\beta = \ro(\tzkproof[0..1], 0)\,, \qquad \gamma = \ro(\tzkproof[0..1], 1)\,.
	\)

	Compute permutation polynomial $\p{z}(X)$
	\begin{multline*}
		\p{z}(X) = (b_7 X^2 + b_8 X + b_9)\p{Z_H}(X) + \lag_1(X) + \\
    + \sum_{i = 1}^{\noofc - 1} \left(\lag_{i + 1} (X) \prod_{j = 1}^{i} \frac{
        (\wit_j +\beta \omega^{j - 1} + \gamma)(\wit_{\noofc + j} + \beta k_1
        \omega^{j - 1} + \gamma)(\wit_{2 \noofc + j} +\beta k_2 \omega^{j- 1} +
        \gamma)} {(\wit_j+\sigma(j) \beta + \gamma)(\wit_{\noofc + j} + \sigma(\noofc
        + j)\beta + \gamma)(\wit_{2 \noofc + j} + \sigma(2 \noofc + j)\beta +
        \gamma)}\right)
	\end{multline*}
	Output polynomial commitment $\gone{\p{z}(\chi)}$

\item[Message 3] Compute the challenge $\alpha = \ro(\tzkproof[0..2])$, compute the quotient
  polynomial
	\begin{align*}
    & \p{t}(X)  = \\
    & (\p{a}(X) \p{b}(X) \selmulti(X) + \p{a}(X) \selleft(X) +
      \p{b}(X)\selright(X) + \p{c}(X)\seloutput(X) + \pubinppoly(X) + \selconst(X)) /
      \p{Z_H}(X) +\\
    & + ((\p{a}(X) + \beta X + \gamma) (\p{b}(X) + \beta k_1 X + \gamma)(\p{c}(X)
      + \beta k_2 X + \gamma)\p{z}(X)) \infrac{\alpha}{\p{Z_H}(X)} \\
    & - (\p{a}(X) + \beta \p{S_{\sigma 1}}(X) + \gamma)(\p{b}(X) + \beta
      \p{S_{\sigma 2}}(X) + \gamma)(\p{c}(X) + \beta \p{S_{\sigma 3}}(X) +
      \gamma)\p{z}(X \omega))  \infrac{\alpha}{\p{Z_H}(X)} \\
    & + (\p{z}(X) - 1) \lag_1(X) \infrac{\alpha^2}{\p{Z_H}(X)}
	\end{align*}
	Split $\p{t}(X)$ into degree less then $\noofc$ polynomials
  $\p{t_{lo}}(X), \p{t_{mid}}(X), \p{t_{hi}}(X)$, such that
	\(
		\p{t}(X) = \p{t_{lo}}(X) + X^{\noofc} \p{t_{mid}}(X) + X^{2 \noofc}
    \p{t_{hi}}(X)\,.
	\)
	Output $\gone{\p{t_{lo}}(\chi), \p{t_{mid}}(\chi), \p{t_{hi}}(\chi)}$.

\item[Message 4] Get the challenge $\chz \in \FF_p$, $\chz = \ro(\tzkproof[0..3])$.
  Compute opening evaluations
	\(
    \p{a}(\chz), \p{b}(\chz), \p{c}(\chz), \p{S_{\sigma 1}}(\chz), \p{S_{\sigma 2}}(\chz), \p{t}(\chz), \p{z}(\chz \omega),
	\)
	Compute the linearization polynomial
	\[
		\p{r}(X) =
		\begin{aligned}
      & \p{a}(\chz) \p{b}(\chz) \selmulti(X) + \p{a}(\chz) \selleft(X) + \p{b}(\chz) \selright(X) + \p{c}(\chz) \seloutput(X) + \selconst(X) \\
      & + \alpha \cdot \left( (\p{a}(\chz) + \beta \chz + \gamma) (\p{b}(\chz) + \beta k_1 \chz + \gamma)(\p{c}(\chz) + \beta k_2 \chz + \gamma) \cdot \p{z}(X)\right) \\
      & - \alpha \cdot \left( (\p{a}(\chz) + \beta \p{S_{\sigma 1}}(\chz) + \gamma) (\p{b}(\chz) + \beta \p{S_{\sigma 2}}(\chz) + \gamma)\beta \p{z}(\chz\omega) \cdot \p{S_{\sigma 3}}(X)\right) \\
      & + \alpha^2 \cdot \lag_1(\chz) \cdot \p{z}(X)
		\end{aligned}
	\]
	Output
  $\p{a}(\chz), \p{b}(\chz), \p{c}(\chz), \p{S_{\sigma 1}}(\chz), \p{S_{\sigma
      2}}(\chz), \p{t}(\chz), \p{z}(\chz \omega), \p{r}(\chz).$

\item[Message 5] Compute the opening challenge $v \in \FF_p$,
  $v = \ro(\tzkproof[0..4])$.  Compute the openings for the polynomial commitment
  scheme
	\hspace*{-2cm}\begin{align*}
	& \p{W_\chz}(X) = \frac{1}{X - \chz} \left(
   \begin{aligned}
     & \p{t_{lo}}(X) + \chz^\noofc \p{t_{mid}}(X) + \chz^{2 \noofc} \p{t_{hi}}(X) - \p{t}(\chz)
     + v(\p{r}(X) - \p{r}(\chz))
      + v^2 (\p{a}(X) - \p{a}(\chz))\\
     & + v^3 (\p{b}(X) - \p{b}(\chz))
      + v^4 (\p{c}(X) - \p{c}(\chz))
      + v^5 (\p{S_{\sigma 1}}(X) - \p{S_{\sigma 1}}(\chz)) \\
     & + v^6 (\p{S_{\sigma 2}}(X) - \p{S_{\sigma 2}}(\chz))
   \end{aligned}
       \right)\\
    & \p{W_{\chz \omega}}(X) = \infrac{(\p{z}(X) - \p{z}(\chz \omega))}{(X - \chz \omega)}
  \end{align*}
	Output $\gone{\p{W_{\chz}}(\chi), \p{W_{\chz \omega}}(\chi)}$.
\end{description}

\ncase{Plonk verifier $\verifier(\srs, \inp, \zkproof)$}\ \newline
The \plonk{} verifier works as follows
\begin{enumerate}
	\item Validate all obtained group elements.
	\item Validate all obtained field elements.
	\item Parse the instance as
      $\smallset{\wit_i}_{i = 1}^\instsize \gets \inp$.
	\item Compute challenges $\beta, \gamma, \alpha, \chz, v, u$ from the transcript.
	\item Compute zero polynomial evaluation
      $\p{Z_H} (\chz) =\chz^\noofc - 1$.
	\item Compute Lagrange polynomial evaluation
      $\lag_1 (\chz) = \frac{\chz^\noofc -1}{\noofc (\chz - 1)}$.
	\item Compute public input polynomial evaluation
      $\pubinppoly (\chz) = \sum_{i \in \range{1}{\instsize}} \wit_i
      \lag_i(\chz)$.
	\item Compute quotient polynomials evaluations
	\begin{multline*}
    \p{t} (\chz) =  \Big(
    \p{r} (\chz) + \pubinppoly(\chz) - (\p{a}(\chz) + \beta \p{S_{\sigma 1}}(\chz) + \gamma) (\p{b}(\chz) + \beta \p{S_{\sigma 2}}(\chz) + \gamma)
    (\p{c}(\chz) + \gamma)\p{z}(\chz \omega) \alpha - \lag_1 (\chz) \alpha^2
    \Big) / {\p{Z_H}(\chz)} \,.
	\end{multline*}
	\item Compute batched polynomial commitment
	$\gone{D} = v \gone{r} + u \gone {z}$ that is
	\begin{align*}
		\gone{D} & = v
		\left(
		\begin{aligned}
          & \p{a}(\chz)\p{b}(\chz) \cdot \gone{\selmulti} + \p{a}(\chz)  \gone{\selleft} + \p{b}  \gone{\selright} + \p{c}  \gone{\seloutput} + \\
          & + (	(\p{a}(\chz) + \beta \chz + \gamma) (\p{b}(\chz) + \beta k_1 \chz + \gamma) (\p{c} + \beta k_2 \chz + \gamma) \alpha  + \lag_1(\chz) \alpha^2)  + \\
			% &   \\
          & - (\p{a}(\chz) + \beta \p{S_{\sigma 1}}(\chz) + \gamma) (\p{b}(\chz)
          + \beta \p{S_{\sigma 2}}(\chz) + \gamma) \alpha \beta \p{z}(\chz
          \omega) \gone{\p{S_{\sigma 3}}(\chi)})
		\end{aligned}
		\right) + \\
		& + u \gone{\p{z}(\chi)}\,.
	\end{align*}
	\item Computes full batched polynomial commitment $\gone{F}$:
	\begin{align*}
      \gone{F} & = \left(\gone{\p{t_{lo}}(\chi)} + \chz^\noofc \gone{\p{t_{mid}}(\chi)} + \chz^{2 \noofc} \gone{\p{t_{hi}}(\chi)}\right) + u \gone{\p{z}(\chi)} + \\
               & + v
                 \left(
		\begin{aligned}
			& \p{a}(\chz)\p{b}(\chz) \cdot \gone{\selmulti} + \p{a}(\chz)  \gone{\selleft} + \p{b}(\chz)   \gone{\selright} + \p{c}(\chz)  \gone{\seloutput} + \\
			& + (	(\p{a}(\chz) + \beta \chz + \gamma) (\p{b}(\chz) + \beta k_1 \chz + \gamma) (\p{c}(\chz)  + \beta k_2 \chz + \gamma) \alpha  + \lag_1(\chz) \alpha^2)  + \\
			% &   \\
			& - (\p{a}(\chz) + \beta \p{S_{\sigma 1}}(\chz) + \gamma) (\p{b}(\chz) + \beta \p{S_{\sigma 2}}(\chz) + \gamma) \alpha  \beta \p{z}(\chz \omega) \gone{\p{S_{\sigma 3}}(\chi)})
		\end{aligned}
		\right) \\
		& + v^2 \gone{\p{a}(\chi)} + v^3 \gone{\p{b}(\chi)} + v^4 \gone{\p{c}(\chi)} + v^5 \gone{\p{S_{\sigma 1}(\chi)}} + v^6 \gone{\p{S_{\sigma 2}}(\chi)}\,.
	\end{align*}
	\item Compute group-encoded batch evaluation $\gone{E}$
	\begin{align*}
		\gone{E}  = \frac{1}{\p{Z_H}(\chz)} & \gone{
		\begin{aligned}
			& \p{r}(\chz) + \pubinppoly(\chz) +  \alpha^2  \lag_1 (\chz) + \\
			& - \alpha \left( (\p{a}(\chz) + \beta \p{S_{\sigma 1}} (\chz) + \gamma) (\p{b}(\chz) + \beta \p{S_{\sigma 2}} (\chz) + \gamma) (\p{c}(\chz) + \gamma) \p{z}(\chz \omega) \right)
		\end{aligned}
           }\\
      + & \gone{v \p{r}(\chz) + v^2 \p{a}(\chz) + v^3 \p{b}(\chz) + v^4 \p{c}(\chz) + v^5 \p{S_{\sigma 1}}(\chz) + v^6 \p{S_{\sigma 2}}(\chz) + u \p{z}(\chz \omega) }\,.
	\end{align*}
\item Check whether the verification
 % $\vereq_\zkproof(\chi)$
  equation holds
	\begin{multline}
		\label{eq:ver_eq}
		\left( \gone{\p{W_{\chz}}(\chi)} + u \cdot \gone{\p{W_{\chz
                \omega}}(\chi)} \right) \bullet
		\gtwo{\chi} - \\
		\left( \chz \cdot \gone{\p{W_{\chz}}(\chi)} + u \chz \omega \cdot
          \gone{\p{W_{\chz \omega}}(\chi)} + \gone{F} - \gone{E} \right) \bullet
        \gtwo{1} = 0\,.
	\end{multline}
  The verification equation is a batched version of the verification equation
  from \cite{AC:KatZavGol10} which allows the verifier to check openings of
  multiple polynomials in two points (instead of checking an opening of a single
  polynomial at one point).
\end{enumerate}

\ncase{Plonk simulator $\simulator_\chi(\srs, \td= \chi, \inp)$}\
We describe the simulator in \cref{lem:plonk_tlzk}.

\subsection{Simulation extractability of $\plonk${}}
Due to lack of space, we provide here only theorem statements and intuition for why they hold. Full proofs are given in \cref{sec:plonkse_proofs}.

\oursubsub{Unique Response Property}
\begin{lemma}
	\label{lem:plonkprot_ur}
	Let $\PCOMp$ be a polynomial commitment that is $\epsbind(\secpar)$-binding and has unique opening property with loss $\epsop (\secpar)$. Then $\plonkprotfs$ is $\ur{3}$ against algebraic adversaries, who makes up to $q$ random oracle queries, with security loss $\epsbinding (\secpar) + \epsop ( \secpar )$.
\end{lemma}
\begin{proof}[Intuition]
  We show that an adversary who can break the $3$-unique response property of $\plonkprotfs$ can be either used to break the commitment scheme's evaluation binding or unique opening property. The former happens with the probability upper-bounded by $\epsbinding (\secpar)$, the latter with the probability upper bounded by $\epsop (\secpar)$.

  %We note that the probability of breaking evaluation binding increases by an additional $q / p$ (at most) since $\plonk$ batches verification of polynomial evaluations, which may lead to accepting an opening which would not be accepted by a verifier who verifies all openings separately. Similarly, the additional $q / p$ security loss from unique opening property comes from the batching as well.
\end{proof}

\oursubsub{Rewinding-Based Knowledge Soundness}
\begin{lemma}
	\label{lem:plonkprot_ss}
  $\plonkprotfs$ is $(3, 3 \noofc + 6)$-rewinding-based knowledge sound against algebraic adversaries who make up to $q$ random oracle queries with security loss
  \[
    \epscss(\secpar,\accProb, q) \leq \left(1 - \frac{\accProb - (q + 1) \left(\frac{3 \noofc + 5}{p} \right)}{1 - \frac{3 \noofc + 5}{p}}\right) + (3 \noofc + 6) \cdot \epsudlog (\secpar) %+ (3 \noofc + 6) \cdot \epsid (\secpar)
    \,,
  \]
	Here $\accProb$ is a probability that the adversary outputs an accepting proof,
  %$\epsid(\secpar)$ is a soundness error of the ideal verifier for $\plonkprot$,
  and $\epsudlog(\secpar)$ is security of $(\numberofconstrains + 5, 1)$-$\udlog$
	assumption.
\end{lemma}

\begin{proof}[Intuition]
  We use Attema et al.~\cite[Proposition 2]{EPRINT:AttFehKlo21} to bound the probability that an algorithm $\tdv$ does not obtain a tree of accepting transcripts in an expected number of runs. This happens with probability at most
  \[
    1 - \frac{\accProb - (q + 1) \left(\frac{3 \noofc + 5}{p} \right)}{1 - \frac{3 \noofc + 5}{p}}
  \]
  Then we analyze the case that one of the proofs in the tree $\tree$ outputted by $\tdv$ is not accepting by the ideal verifier. This discrepancy can be used to break an instance of an updatable dlog assumption which happens with probability at most $(3 \noofc + 6)  \cdot \epsudlog (\secpar)$. %Additionally, it may be impossible to extract the witness from a tree where each of the transcripts is accepting by the ideal verifier if the adversary broke soundness of the ideal verifier in one of the transcripts. That happens with probability at most $(3 \noofc + 6) \cdot \epsid (\secpar)$.
 \end{proof}

\oursubsub{Trapdoor-Less Zero-Knowledge of Plonk}
\begin{lemma}
  \label{lem:plonk_tlzk}
  $\plonkprotfs$ is 3-programmable trapdoor-less zero-knowledge.
\end{lemma}

\begin{proof}[Intuition]
  The simulator, that does not know the SRS trapdoor can make a simulated proof by programming the random oracle. It proceeds as follows. It picks a random witness and behaves as an honest prover up to the point when a commitment to the polynomial $\p{t}(X)$ is sent. Since the simulator picked a random witness and $\p{t}(X)$ is a polynomial only (modulo some negligible function) when the witness is correct, it cannot compute commitment to $\p{t}(X)$ as it is a rational function. However, the simulator can pick a random challenge $\chz$ and a polynomial $\p{\tilde{t}}(X)$ such that $\p{t} (\chz)  = \p{\tilde{t}} (\chz)$. Then the simulator continues behaving as an honest prover. We argue that such a simulated proof is indistinguishable from a real one.
\end{proof}

\subsection*{Simulation Extractability of~$\plonkprotfs$}
Since \cref{lem:plonkprot_ur,lem:plonkprot_ss,lem:plonk_tlzk} hold, $\plonkprot$ is $\ur{3}$,
rewinding-based knowledge sound and trapdoor-less zero-knowledge. We now make use of \cref{thm:se} and show that
$\plonkprot_\fs$ is simulation-extractable as defined in \cref{def:updsimext}.

\begin{corollary}[Simulation extractability of $\plonkprot_\fs$]
\label{thm:plonkprotfs_se}
$\plonkprotfs$ is \emph{updatable simulation-extractable} against any $\ppt$ adversary $\advse$ who makes up to $q$ random oracle queries and returns an accepting proof with probability at least $\accProb$ with extraction failure probability
\[
  \epsse(\secpar, \accProb, q) \leq \left(1 - \frac{\accProb - \epsur (\secpar) - (q + 1) \epserr (\secpar)} {1 - \epserr (\secpar)}\right) + (3 \noofc + 6) \cdot \epsudlog (\secpar)\COMMENT{ + (3 \noofc + 6) \cdot \epsid (\secpar)},
\]
where $\epserr (\secpar) = \frac{3 \noofc + 5}{p}$, $\epsur (\secpar) \leq \epsbind (\secpar) + \epsop (\secpar)$, $p$ is the size of the field, and $\noofc$ is the number of constrains in the circuit.
\end{corollary}

%%% Local Variables:
%%% mode: latex
%%% TeX-master: "main"
%%% End:


\documentclass[12pt]{article}

\include{preamble}

\title{Math 368 / 621 Fall 2019 \\ Midterm Examination One}
\author{Professor Adam Kapelner}

\date{Septmeber 25, 2019}

\begin{document}
\maketitle

\noindent Full Name \line(1,0){220} Circle Section and Class: A~B~C ~~ 368~621

\thispagestyle{empty}

\section*{Code of Academic Integrity}

\footnotesize
Since the college is an academic community, its fundamental purpose is the pursuit of knowledge. Essential to the success of this educational mission is a commitment to the principles of academic integrity. Every member of the college community is responsible for upholding the highest standards of honesty at all times. Students, as members of the community, are also responsible for adhering to the principles and spirit of the following Code of Academic Integrity.

Activities that have the effect or intention of interfering with education, pursuit of knowledge, or fair evaluation of a student's performance are prohibited. Examples of such activities include but are not limited to the following definitions:

\paragraph{Cheating} Using or attempting to use unauthorized assistance, material, or study aids in examinations or other academic work or preventing, or attempting to prevent, another from using authorized assistance, material, or study aids. Example: using an unauthorized cheat sheet in a quiz or exam, altering a graded exam and resubmitting it for a better grade, etc.
\\

\noindent I acknowledge and agree to uphold this Code of Academic Integrity. \\

\begin{center}
\line(1,0){250} ~~~ \line(1,0){100}\\
~~~~~~~~~~~~~~~~~~~~~signature~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ date
\end{center}

\normalsize

\vspace{-1cm}
\section*{Instructions}

This exam is seventy five minutes and closed-book. You are allowed one page (front and back) of a \qu{cheat sheet.} You may use a graphing calculator of your choice. Please read the questions carefully. If the question reads \qu{compute,} this means the solution will be a number otherwise you can leave the answer in choose, permutation, exponent, factorial or any other notation which could be resolved to a number with a computer. Questions marked \qu{[MA]} are required for those enrolled in 621 and extra credit for those enrolled in 368. If you are enrolled in 368, I advise you to finish the other questions on the exam and only then attempt the extra credit. I also advise you to use pencil. The exam is 100 points total plus extra credit. Partial credit will be granted for incomplete answers on most of the questions. \fbox{Box} in your final answers. Good luck!

\pagebreak

\problem Below are some theoretical exercises.

\benum

\subquestionwithpoints{6} Compute as best as possible: $\displaystyle\sum_{x_1 \in \reals} \displaystyle\sum_{x_2 \in \reals} \indic{x_1 \in \braces{3,4,5}} \indic{x_2 \in \braces{3,4,5}}$.  \spc{1}

\subquestionwithpoints{6} Let $X \sim \binomial{n}{p} := \binom{n}{x}p^x (1-p)^{n-x}$ where $n \in \naturals$ and $p \in (0, 1)$. In class we said that this PMF was valid $\forall x \in \reals$. If so, how did we define $\binom{n}{x}$ under the hood?
\vspace{-0.2cm}
\beqn
\binom{n}{x} := \quad\quad\quad\quad\quad\quad
\eeqn

%\subquestionwithpoints{7} Let $X_1 \sim \binomial{n}{p}$ and $X_2 \sim \negbin{r}{p}$. Find the $\support{X_1 - X_2}$.  \spc{3}

\subquestionwithpoints{10} Let r.v.'s $X_1 ,X_2 \iid$ with expectation $\mu$ and variance $\sigsq$. Let $T = X_1 + X_2$ and $\Y = \bracks{X_1 ~X_2~ T}^\top$. Find $\var{\Y}$. Simplify to be as clean as possible. \spc{7}

%\subquestionwithpoints{6} [MA] Let $X, Y \iid \geometric{p}$. Find $\prob{X \geq Y + c}$ where $c \in \naturals_0$, a constant. Your answer should be a function of $p, c$ and fundamental constants.  \spc{3}

\subquestionwithpoints{6} [MA] Consider $X, Y \iid \geometric{p}$ and find $\prob{X \geq Y + c}$ as a function of $p$ and $c$ where $c \in \naturals_0$, a constant.  \spc{8}

\subquestionwithpoints{6} [MA] Let $X \sim \bernoulli{\half}$ independent of $Y \sim \text{U}\parens{\braces{c, c + 2, c + 4, \ldots, c + 2m}}$ where $c \in \reals$ and $m \in \naturals_0$ are both constants. Find the PMF of $T = X + Y$ using a convolution formula. Is the final answer a brand name r.v. you know? If so, denote it using the notation we learned in class. \spc{6}

\eenum

\problem Consider the following bag of fruit with 5 apples, 6 bananas, 2 oranges and 1 grape cluster.

\begin{figure}[h]
\centering
\includegraphics[width=2.2in]{fruit_bag.png}
\end{figure}

\noindent Let the vector r.v. $\X = [X_1, X_2, X_3, X_4]^\top$ represent a sample of 20 fruits uniformly at random \textit{with replacement} from a bag where $X_1$ denotes the number of apples sampled, $X_2$ denotes the number of bananas sampled, $X_3$ denotes the number of oranges sampled and $X_4$ denotes the number of grape clusters sampled. Assume this sampling procedure and this notation for all questions in this problem.

A \qu{format that can be computed without choose notation} would mean if $X \sim \binomial{11}{0.4}$ then you should write its PMF as $\frac{11!}{x!(11-x)!}0.4^x 0.6^{11-x}$ and $\prob{X = 2} = \frac{11!}{2!9!}0.4^2 0.6^{9}$.

\benum

\subquestionwithpoints{7} Find the JMF of $\X$ in a format that can be computed. Do not use choose notation. No brand name notation allowed in the final answer. Assume $\x \in \support{\X}$ so no need to ensure your answer is valid $\forall \x \in \reals^K$. Please write all parameter values explicitly. \spc{3}

\subquestionwithpoints{7} What is the probability you draw 3 apples, 10 bananas, 5 oranges and 2 grape clusters? Do not compute explicitly but leave your answer in a format that a computer can do the calculation. Do not use choose notation. \spc{3}

\subquestionwithpoints{5} What is the probability you draw 7 apples, 8 bananas, 3 oranges and 3 grape clusters? Do not compute explicitly but leave your answer in a format that a computer can do the calculation. Do not use choose notation. \spc{1}

\subquestionwithpoints{5} What is the probability you draw 5 apples? Do not compute explicitly but leave your answer in a format that a computer can do the calculation. Do not use choose notation. \spc{1}

\subquestionwithpoints{8} Knowing that you drew 5 apples, what is the probability you drew 3 bananas? Do not compute explicitly but leave your answer in a format that a computer can do the calculation without using choose notation. \spc{4}

\subquestionwithpoints{5} You cannot sell apples and bananas, but you can sell each orange for \$0.50 and each grape cluster for \$2.00. Let $R$ be the r.v. the models sale revenue on the sample of 20 fruits from part (a). Compute $\expe{R}$ to the nearest cent. \spc{3}

\subquestionwithpoints{7} Write an expression to compute $\var{R}$. Factor out constants but leave in terms of matrix and vector multiplication. Do not compute. \spc{8}

\eenum

\problem In soccer, each team scores a number of \qu{goals} and whoever has the most goals wins. We will consider modeling soccer game point spreads. This is the number of goals one time wins (or loses) by. We will be using the Skellam distribution:

%\begin{figure}[h]
%\centering
%\includegraphics[width=2.5in]{soccer.jpg}
%\end{figure}

\beqn
D \sim \text{Skellam}(\lambda_1, \lambda_2) := e^{-(\lambda_1 + \lambda_2)} \tothepow{\frac{\lambda_1}{\lambda_2}}{d / 2} I_{|d|}(2 \sqrt{\lambda_1\lambda_2}) \indic{d \in \integers}
\eeqn

\noindent where $I_c(a)$ denotes the modified Bessel function of the first kind.

\benum

\subquestionwithpoints{6} Let $R = -D$ and prove that $R \sim \text{Skellam}(\lambda_2, \lambda_1)$. \spc{3}

\href{https://www.statista.com/statistics/269031/goals-scored-per-game-at-the-fifa-world-cup-since-1930/}{The website linked here} compiled statistics on each soccer team for almost 90 years. Below are average number of goals for many countries' teams that won the world cup since 1950:

This is not a class on statistics, so we will not talk about estimation. We will assume (a) the number of goals scored in any game is independent and Poisson-distributed and (b) the average number of goals above is exactly the $\lambda$ parameter in the Poisson distribution for each team.

%\vspace{-1cm}
\begin{figure}[h]
\centering
\includegraphics[width=4.5in]{goals_data.png}
\end{figure}

\subquestionwithpoints{5} If Brazil plays Argentina, who is expected to win and by how much?\spc{0.2}

\subquestionwithpoints{6} Find an expression for the probability that Brazil beats Argentina by 2. You can leave your answer in terms of $I_c(a)$, the modified Bessel function of the first kind. Simplify to be as clean as possible.\spc{1.5}

\subquestionwithpoints{5} [MA] The Skellam model actually has a small problem: you cannot tie in soccer (meaning both teams get the same score), so $d = 0$ \textit{should not be} in the support of our final modeling distribution. With this fact in mind, find an expression for the the probability that Brazil beats Argentina by 2. You can leave your answer in terms of $I_c(a)$, the modified Bessel function of the first kind. Simplify to be as clean as possible.\spc{2}

\eenum

\end{document}

\subquestionwithpoints{7}  Assume independent r.v.'s $X$ and $Y$ where $\support{X} = (0, \infty)$ and $\support{Y} = (0, \infty)$. Beginning from the general definition of convolution, prove that

\beqn
f_{X + Y}(t) =  \int\displaylimits_0^t f_X(x) f_Y(t-x) dx
\eeqn

where by convention, the notation $f_X$ represents the PDF of r.v. $X$ which \emph{does not include} an indicator function.
 \spc{8}

\subquestionwithpoints{7}  If $X,Y \iid \exponential{\lambda}$, find $\prob{X \geq Y}$. \spc{10}

\subquestionwithpoints{10}  If $X,Y \iid \exponential{\lambda}$, find the conditional density of $X$ given $X+Y$. There is no guarantee that the result will be the density of a brand name r.v., but if it is, denote it and find the parameter(s) as a function of $\lambda$. \spc{10}

\subquestionwithpoints{7}  Let $X \sim \binomial{n_1}{p_1}$ independent of $Y \sim \binomial{n_2}{p_2}$. Find the PMF of $X+Y$ \textit{as best as you possibly can} (even if there is no closed form solution). \spc{10}

\subquestionwithpoints{7}  Let $X \sim \binomial{2000}{0.004}$ independent of $Y \sim \binomial{20000}{0.0004}$. Approximate $\prob{X + Y = 0}$. The correct answer uses one simple operation and no credit will be given for answers that require the use of non-trivial computing. \spc{10}

\subquestionwithpoints{5}  Let $X \sim \negbin{35}{0.37}$ independent of $Y \sim \geometric{0.37}$. Find the PMF of $X + Y$. \spc{10}

\subquestionwithpoints{5} Calculate $\gamma(5,24.5) + \displaystyle\int\displaylimits_{24.5}^\infty t^4 e^{-t}dt$ as a number $\in \naturals$ explicitly. \spc{10}

\eenum

\problem Below are some questions about waiting times.

\benum

\subquestionwithpoints{5} The time until phone the next phone call is exponentially distributed with an average of half hour. If you have already waited half hour, find the probability you will wait more than another half hour. \spc{10}

\subquestionwithpoints{5} The time until phone the next phone call is exponentially distributed with an average of half hour. What is the probability you get two phone calls in one hour? \spc{10}

\subquestionwithpoints{7} The time until phone the next phone call is exponentially distributed with an average of half hour. What is the probability you get 10 phone calls before 5hr? You can answer using the CDF of a r.v. you define.\spc{10}

\eenum

\problem Below are some theoretical exercises about the vector-valued r.v.'s.

\benum
\subquestionwithpoints{6} Let $\Xoneton \iid \binomial{n}{p}$ and let $\X$ denote the vector of these r.v.'s. Find $\var{\X}$. \spc{10}

\subquestionwithpoints{7} Let $\Xoneton \iid \binomial{n_0}{p}$ and let $\X$ denote the vector of these r.v.'s. Is $\X \sim \multinomial{m}{\p}$? If yes, find the values of its parameters, $m$ and $\p$ as functions of $n_0$ and $p$. If no, explain why not. \spc{10}

\subquestionwithpoints{7} A person goes to the grocery store and buys $n$ fruits. For each of his $n$ selections, he picks rambutans with probability $p$ otherwise he picks dragonfruits. If rambutans cost $a$ and dragonfruits cost $b$, find his expected bill. \spc{4}

\subquestionwithpoints{15} Find the standard deviation of his bill and simplify as best as possible.\spc{10}
\eenum

\end{document}


\section{Anonymized Dataset Producing Libraries}

As mentioned earlier, an other possible output of a mechanism that adds D.P. to a dataset can be the dataset itself, after being anonymized using certain algorithms that meet the criteria of D.P.

This technique does not yet have many different implementations, mostly due to the success of the previous model shown, as well as the difficulty, the computer power needed and the poor quality of the result being produced.

Producing an anonymized dataset is the way to go if someone is using earlier forms of data privacy, such as \emph{k-anonymity}, \emph{l-diversity} etc, which we are going to analyze moving forward. However, in order to cover the needs of D.P., several adjustments have to be made. The main idea behind all those libraries, lay behind a theorem, presented in [4], that mixes the use of those previously mentioned techniques with D.P.

In this Thesis, we are going to examine the \emph{ARX tool}, a tool for data anonymization, that supports the method that we are trying to implement. We are going to analyze this tool, and perform similar testings as in IBM.

ARX is a tool for data anonymization, that in general, takes a dataset as an input, applies  privacy models, and produces an anonymized version of this dataset, thus offering protection to its members. The Menu of the ARX tool can be seen in the following \textbf{Figure 3.7.}

\begin{figure}[!htb]\centering
    \includegraphics[width=0.9\textwidth]{images/arx_tool.png}
    \caption{The ARX GUI tool}
\end{figure}

At its core, ARX uses a highly efficient globally-optimal search algorithm for transforming data with full-domain generalization and record suppression. The transformation of attribute values is implemented through domain generalization hierarchies, which represent valid transformations that can be applied to individual-level values.

\subsection{Classic Privacy Models}

The ARX tool offers standard privacy models that are tested in theory and are widely used to ensure anonymity given a plain dataset. Those consist of the implementation of the following protocols:

\begin{itemize}
    \item \textbf{K-anonymity}: A well-known privacy model that aims to protect datasets from re-identification in the prosecutor model. A dataset is $k$-anonymous if\emph{ each record cannot be distinguished from at least $k-1$ other records regarding the quasi-identifiers.} Each group of indistinguishable records forms a so-called equivalence class.
    \item \textbf{l-diversity}: This privacy model can be used to protect data against attribute disclosure by ensuring that each sensitive attribute \emph{has at least $l$ "well represented" values in each equivalence class}. Different variants, which implement different measures of diversity, have been proposed.
\end{itemize}

Moreover, the tool uses some simple concepts of processing a dataset:

\begin{itemize}
    \item \textbf{Random Sampling}: A method of sampling that utilizes some form of random selection. In order to have a random selection method, we must set up some process or procedure that assures that the different units in the population have equal probabilities of being chosen.
    \item \textbf{Attribute Generalization}: Generalizing a column of the dataset, based on its values. The applications of attribute generalization depend on the type of records (eg. integers, ranges etc).
    \item \textbf{Record Suppression}: Deletion of a specific row on the input dataset.
\end{itemize}

Those are some techniques that are not going to be analyzed and tested in this thesis, however, if combined with D.P. can produce interesting results. Specifically, according to [4], the following theorem applies:

\emph{Random sampling} with probability $\beta$ followed by \emph{attribute generalization} and the \emph{suppression} of
every record which appears less than k times \emph{satisfies $(\epsilon, \delta)$ differential privacy} for every $\epsilon \geq -ln(1-\beta)$ with
$$\delta = \max_{n:n \geq n_m} \sum_{j>\gamma_n}^{n}f(j;n,\beta)$$

where $n_m = \frac{k}{\gamma} - 1$, $\gamma = \frac{e^\epsilon-1+\beta}{e^\epsilon}$ and $f(j;n,\beta) = {n \choose  j} \beta^j(1-\beta)^{n-j}$.

In order to achieve attribute generalization, ARX uses the so called \emph{hierarchies}. They are either imported from a csv file, or being hard-coded into the API, and they are used in order to generalize a sensitive field. An example is given in \emph{Table 3.4}. The subject to generalize is the age of a person. Let's see the values as they proceed through generalization.

\begin{table}[!htb]
    \centering

    \caption{Generalization of data using hierarchies}
    \label{numbers}

    \begin{tabular}{| c | c | c | c |}
      \hline
      $1^{st}$ level & $2^{nd}$ level & $3^{rd}$ level & $4^{th}$ level\\
      \hline
      1 & 0-4 & 0-9 & *\\
      \hline
      3 & 0-4 & 0-9 & *\\
      \hline
      5 & 5-9 & 0-9 & * \\
      \hline
      10 & 10-14 & 10-19 & *\\
      \hline
      18 & 15-20 & 10-19 & *\\
      \hline

    \end{tabular}
\end{table}

\subsection{Conducting D.P. Testings}

ARX provides a cross-platform graphical tool, that supports many different ways of anonymizing data, as well as an API that delivers those data anonymization capabilities to Java programs. We are going to use the latter, in order to create our own scripts for testing the tool and its accuracy.

In order to test the accuracy of the models used by ARX, we are going to run simple queries, on the datasets produced by the anonymization process. We want to eliminate the probability of extremely high noise generation, thus we are going to run the anonymization tool multiple times, and the output dataset will be constructed by the mean values of the fields.

As show on the above matrix, ARX hierarchies tend to replace every type of value with an interval. This is not desirable when applying the testings we mentioned. Thus, we had to come up with a better solution of defining hierarchies. The ARX GUI provides a wizard that gives a variety of choices so the user can easily create a hierarchy for many data types.

Another challenge is the number of layers that we are going to use, meaning how far our anonymization will proceed. In each layer, the number of same records increase exponentially, thus we do not want to apply many layers, in order for our results to be accurate, and the output dataset to be readable.

Given the help from Dr. Fabian Prasser, one of ARX's creators, we opted to treat the integer values as numbers, and in each level:
\begin{itemize}
    \item Group the rows by 2
    \item Apply a function according to the query we want to ask.
\end{itemize}

For example, if we want a counting query, the best option would be to apply an \emph{arithmetic mean} function to the group, thus the sum, the mean, the variance etc will be the same. The way that ARX preserves D.P. with those settings, is by record suppression. If that was not the case, the results would be identical to the input dataset. However, now, the output dataset will differ because of its lack of some rows of the input.

Regarding the layers problem, we opted to use 4 layers of anonymization, the last of whom will be the * value, meaning that every record is inseparable. We do not want this to happen early in our anonymization, but we do not want it to never happen either, because then we would have a privacy leak, if the dataset was too small.

The creation of the hierarchies for the salary column, can be shown in \textbf{Figure 3.8}, taken from the ARX GUI Hierarchy Creation Wizard.

\begin{figure}[!htb]\centering
    \includegraphics[width=0.8\textwidth]{images/hierarchies.png}
    \caption{Creating an Hierarchy using ARX GUI}
\end{figure}

\subsection{Metrics Used}
We are going to test the applicability of the already given ARX mechanisms on a numerical dataset. Our goal is to run basic queries, such as mean value on the dataset's records. We are going to do that first by applying no DP at all, and then by using the API that is presented by ARX, helped by a simple java script that was built for this purpose.

\subsection{The identity of the testing Dataset}
The dataset that we are going to be looking at, contains sensitive data regarding NBA players' \emph{salaries} from the year 1990 until today. It also states other info about them, such as their \emph{age}, their\emph{ current team }and their \emph{position}. This particular data is not considered sensitive, as those numbers are widely available, however, when it comes down to certain people's salaries, applying D.P. in order to preserve their privacy is crucial.

\subsection{Process of running the queries}
As we have earlier noted, the application of D.P. in ARX is rather complicated, specifically for the use that we are interested in: We want the output dataset to have numerical values in the earnings' column, in order to apply queries.

For each column of the dataset, we have defined our own hierarchies. For every column except the `Salaries` one, this hierarchy is semantic, like the ones presented in our intro.

For the salaries column, with it being our goal to analyze, we opt to use the construction mentioned in our solution in the intro. We created 7 layers, in order to give the algorithm the ability to anonymize the dataset without the values being converted to `*`.

A sample of the result of the creation of the Salaries hierarchy is presented in \textbf{Table 3.5}, while the whole file is available in the GitHub distribution of the results of this Thesis.

\begin{table}[!htb]
    \centering

    \caption{Hierarchy Levels created}
    \label{numbers}

    \begin{tabular}{| c | c | c | c | c|}
      \hline
      $1^{st}$ level & $2^{nd}$ level & $3^{rd}$ level & ... & $7^{th}$ level \\
      \hline
        79.568  &	291.029 & 500.776 &   	... &	*\\
              \hline
        502.491 &	291.029 &	500.776 &... &	*\\
              \hline
        522.738 &	710.524 &	500.776 &...	&   *\\
              \hline
        898.310 &	710.524 &	500.776 &... &	*\\
              \hline
        1.000.000 &	1.114.013 &   1.220.739 &...&	*\\
              \hline
        1.228.026 &	1.114.013 &   1.220.739 &... &	*\\
              \hline
    \end{tabular}
\end{table}

Next up, we are going to setup the use the ARX API, which requires us to specify some variables in order to run Differential Privacy. Those variables are defined in the above Java code, and are those that were use in the actual testings.

\bigskip
\bigskip
\bigskip
\bigskip
\begin{lstlisting}[
basicstyle= \footnotesize,
language=Java]
    EDDifferentialPrivacy criterion = new EDDifferentialPrivacy(2d, 1d / Rows);

    ARXConfiguration config = ARXConfiguration.create();
    config.addPrivacyModel(criterion);
    config.setSuppressionLimit(1d);
    config.setHeuristicSearchStepLimit(100);
    ARXResult result = anonymizer.anonymize(data, config);
\end{lstlisting}
\bigskip

The basic principles that were followed for the above definitions are based on the following instructions and guidance by the ARX Tool documentations:
\begin{itemize}
    \item The delta value should not be 0, but is suggested to be set lower or equal than the reciprocal of the number of records.
    \item A suppression limit should be set, preferably to 1.
    \item In order to improve the quality of the data produced, a heuristic search step limit should be set, in order to tweak the ARX search algorithm that handles data suppression.
\end{itemize}

Additionally, following the same principles as with the IBM library, we are going to run the D.P. query multiple times before reporting its value. We are going to do so, because the amount of noise generated can be extreme, and because of the low bounds of the heuristic search that we have set. We chose to run each query 1000 times, and then report the mean value of those runs as the result produced by the mechanism.

Because of the structure of the result of the ARX mechanism (a dataset containing numerical values), we can only run queries like \emph{sum} and \emph{mean}. There is no point in running a min or max query: we already know that the result will not be accurate. Thus, we are going to try to run a\emph{ mean value} numerical query in the anonymized dataset. The function we are using in order to run this typed of queries is the following:
\bigskip
\clearpage
\begin{lstlisting}[
basicstyle= \footnotesize,
language=Java]
protected static double run_query(ARXResult data, int targetColumn) {
	// iterator that we are going to use to access the data
	final Iterator<String[]> itHandle = data.getOutput().iterator();

	// result of the query
	double result = 0d;
	// length of the dataset
	int totalRecords = 0;

	// ignore the name of the column
	String[] name = itHandle.next();
	if (name.length <= targetColumn) {
		System.out.println("Target column out of bounds\n");
		return 0d;
	}

	// iterate through all the values in the dataset
	while(itHandle.hasNext()) {
		String[] next = itHandle.next();
		// check that our target position is legal
		String string = next[targetColumn];
		if (!string.equals("*")) {
			result += Integer.parseInt(string);
			totalRecords++;
		}
	}
    // return the __mean__ of the dataset
    return result / totalRecords;
}

\end{lstlisting}
\bigskip

Finally, before running the queries, we must mention that while using the ARX Tool the dataset size should be significant. In our case, it contains almost 13 contains thousands of rows. The dataset size is a critical parameter when applying D.P., while being even more essential during the use of the ARX tool.

\subsection{Statistical Queries}

As shown by the above Java function, our testings can support every type of statistical queries, such as \emph{mean value}, \emph{sum}, and \emph{average}. However, due to the computer power required and the similarity of the results that those queries produce, we will focus our testings solely to the mean value query.

Given the dataset previously analyzed, the true mean value of the salaries column of the dataset is $\$2.868.981,32$. This will be the value that we are going to use in order to examine the accuracy of the D.P. results.

\subsubsection{Running with fixed parameters}

We are going to conduct our first test by anonymizing our dataset using the default parameters, as we set ε $ = 1$ and δ $ = \frac{1}{12377}$.  The results are shown in the following table.

\begin{table}[!htb]
    \centering

    \caption{Mean value query in ARX with default parameters}
    \label{numbers}

    \begin{tabular}{| c | c |}
      \hline
        Non-DP result & DP Result \\
      \hline
        $\$2.868.981,32$ & $\$2.860.215,6$\\
      \hline
    \end{tabular}
\end{table}

We observe that the query results, are somewhat close: We are in the range of millions of dollars, and the ARX mechanism only fails to approach the result by 8 thousand. This is not of course close to what the IBM library computed, but it is still a reliable result, given all the downsides of this type of anonymization.

\subsubsection{Running with different epsilon values}

Next up, in order to determine if ARX follows the rules of D.P., we should try anonymizing the dataset for different values of epsilon, just like we did with the IBM library.

We observed during our initial runs that if the epsilon value rises above 2, the algorithm faces certain problems, that will be analyzed moving forward. With that being the case, the epsilon values chosen to conduct the measurements are in the range $[0.2, 1.6]$. The results from our testings are shown in the above \textbf{Figure 3.8.}

\begin{figure}[!htb]\centering
    \includegraphics[width=1\textwidth]{images/arx_accuracy.png}
    \caption{Accuracy Error results for increasing values of epsilon}
\end{figure}

As we can see, the plot produces a linear type curve when the epsilon is below 0.8, and then stabilizes, unlike the Laplace distribution mechanisms, where the error curve is in logarithmic shape. We can not directly compare the results with the Laplace noise distribution, due to the different datasets used.

We generate the answers given by asking the query in the output dataset. Without its records being suppressed, the result dataset would have been perfect, because of the transformation of the data. However, when suppressing many records (nearly 10\% each time), the result could be severely altered, and thus the error plot, as we saw, is quite unpredictable.

\subsection{Observations regarding the Algorithm}

During our testings in the dataset using the ARX mechanism, we observe the following regarding its behavior in the DP queries:

\begin{itemize}
    \item The epsilon variable if raised above 2,5, makes the algorithm \emph{extremely slow}, to the point that it does not respond after minutes of execution. This makes sense, if we take into consideration that when epsilon increases, the accuracy gets better. Thus, the algorithm performs extreme searching techniques in order to find which records to suppress, resulting into slow execution.
    \item In order for the algorithm not to produce only *(the last level in our hierarchies) in our target column, we set each of the other columns as \emph{non sensitive} in their definition.
    \item As the epsilon values rise, \emph{the accuracy gets better}, as it is supposed to be, according to the DP principles.
    \item While the dataset has multiple columns, the algorithm usually fails to present all of them with anonymized values, and just reports * in each row. This could have been a result of the high \emph{Heuristic Search Step Limit}, which was by default set to maximum. Despite us lowering its value, the phenomenon persists.
\end{itemize}

\subsection{Conclusion}

While researching the ARX mechanism we came to the conclusion that it is for sure a whole different approach in Differential Privacy compared to the other libraries that we studied. With that being the case, it has some advantages and some disadvantages. Its main advantages are the following:

\begin{itemize}
    \item The result of the mechanism is a \emph{handy dataset} that the user can handle in multiple ways and gain more information than just the result of a query.
    \item The result \emph{can be iterated}, thus giving the option to the user to run the query in a smaller subset of the rows, while it being differential private.

\end{itemize}

On the other hand, the main disadvantages are:
\begin{itemize}
    \item The result can be misleading, because of the \emph{big accuracy error produced}.
    \item The algorithm \emph{requires a rather big dataset} in order to run properly, while other libraries perform just fine with smaller datasets.
    \item The algorithm is difficult to implement, as you have to create a self-made function for every query, and moreover tune many parameters if you want to run differential privacy.

\end{itemize}


\chapter{Diameter error propagation model}
\label{ch::diameter}

\textit{In this last chapter we will briefly discuss the error propagation while diameter is estimated. We will present one of the models introduced in Section \ref{sec:sys-cmp} and we will show some experimental results about it.}

% The Erone's model
  \input{./src/chapters/ch6-Diameter/model.tex}
% Experimental result
  \input{./src/chapters/ch6-Diameter/results.tex}


\section{Future Work}

A trained model is only as good as the data it is trained on.
This work can be improved and expanded by generating
more comprehensive depletion data that covers a wider
range of enrichment and burnup ranges. An automation
script might run SCALE/ORIGEN to perform depletion calculations
for a wide range of enrichment (e.g. 0.7 - 4.99 wt\%) and burnup (e.g. 0 - 80,000 MWd/MT),
for a single assembly design. Assumptions of criticality
and irradiation time should be made as well. The results
could then be parsed into a \gls{CSV} file and stored for
the training of a new model. This will allow better
prediction of the model for higher burnups and `fringe'
burnup-enrichment assemblies.

Methods used in this paper have the potential to be expanded into more
complicated problems. An interesting application of this method is for
\gls{MSR} system optimization. Current work on
\glspl{MSR} include optimization non-core operating
parameters such as reprocessing scheme and flow rate.
Fuel transmutation calculations
can be usually computationally burdensome for \gls{MSR}
simulations, since the flowing fuel is depleted and
reprocessed continuously. \gls{MSR} models implement semi-continuous
methods in which the depletion-to-reprocessing time is
very short (usually 3 days), which makes an
\gls{MSR} lifetime simulation (if 60 years)
require $\sim 7,300$ depletion calculations.
The computational burden
makes it impossible to use brute-force methods,
such as grid search of all possible parameters.
However, if a quick depletion calculation becomes possible
with a well-trained prediction model, the
computational burden will dramatically decrease.
However, problems with generating enough
training data, accuracy, and the model's ability to
extrapolate remain.


\section{Results} \label{results}
In order to evaluate the performance of the method described in Section \ref{approach}, we need to compare the predicted network to the real network that generated the data. In real biological applications this procedure is usually not possible, due to the fact that the real network is, in fact, unknown.
In the specific case described thus far, we take advantage of synthetic data that make such a performance evaluation practical.

Since our algorithm is designed to analyse gene expression profiles, we generate synthetic microarray data with the Gene Net Weaver software package (GNW) (\citealp{gnw1}). The aim of GNW is to generate in-silico networks extracting modules from biological networks. These networks are simulated to produce gene expression data (steady states or time series) (\citealp{gnw2}). The aforementioned framework can be used to evaluate the performance of our inference method by comparing the predicted network with the golden standard network that generated the dataset.

We perform the approach described above on synthetic microarray data generated from simulated networks of 50 and 200 nodes. The parameters used in our experiments are summarised in Table \ref{params}.

\begin{table}[htdp]
%\begin{center}
\begin{tabular}{| l | l |}
\hline
\textbf{cross-validation} & 3-fold on 10\% genes \\  \hline
\textbf{best} & 80\% genes\\  \hline
\textbf{fanout} & 1 \\
\textbf{B} & 0-500 \\ \hline
\end{tabular}
%\end{center}
\caption{Parameters of LABnet for both 50-node and 200-node networks}\label{params}
\end{table}

\begin{figure*}
\noindent\begin{minipage}{.5\textwidth}
\centering
  \includegraphics[width=1\linewidth]{degree_barplot.eps}
  \captionof{figure}{Degree correlation across real and predicted nodes}
  \label{fig:degree}
\end{minipage}
\noindent\begin{minipage}{.5\textwidth}
  \includegraphics[width=1\linewidth]{between_barplot.eps}
  \captionof{figure}{Betweenness correlation across real and predicted nodes}
  \label{fig:between}
\end{minipage}
\end{figure*}

A set of networks has been inferred with an increasing number of permutations. One important characteristic that arises from our experiments consists in the fact that by increasing the number of permutations, the connectivity of the network is increased proportionally (Figure \ref{fig:pred_fp}). Within the same figure it is shown that the number of false positives is limited regardless the number of predicted edges and permutations.
We measure the connectivity of the network by counting the number of the predicted edges.

In Figure \ref{fig:fpr_perm}, the false positive rate, usually referred to as accuracy, is not affected by the number of permutations but by the number of predicted edges which increases accordingly (as shown in Figure \ref{fig:pred_fn}).

Moreover, by increasing the number of permutations the false negatives, or missed edges, tend to decrease (\ref{fig:fpr_perm}). Since higher connected networks are usually affected by an increasing number of false negatives, we consider the method described above a promising approach with potential benefits to the analysis of large genetic networks.

We also found that the true positive rate follows the same trend of the number of permutations (Figure \ref{fig:tp_mcc}). Within the same figure the Matthew Correlation Coefficient (MCC) is also reported. The MCC is a correlation coefficient between the observed and the predicted classification (presence or absence of edges). It returns a value in the range $(-1, 1)$, where $-1$ indicates total disagreement between prediction and observations, $+1$ indicates perfect prediction and $0$ no better than random guessing.
One important property of the MCC is that it takes into account the number of true negatives and true positives of the predicted network within the normalisation factor. This leads to more meaningful interpretations of the final MCC score. Biological networks are usually sparse. Therefore, prediction methods performed on such networks usually return high numbers of true negatives (absent interactions are correctly predicted).
In the extreme case of empty predicted network (a network without any edge), the number of true negatives would positively impact the overall performance of the method. It comes without saying that measuring the number of true negatives would be too optimistic. The MCC mitigates extreme cases of this type. The empty network would have a $MCC = 0$.

The MCC, as introduced in (\citealp{Matthews1975}), is calculated as

\begin{equation}
MCC = \frac{(TP \times TN) - (FP \times FN)}{\sqrt{\splitfrac{(TP+FP)\times(TP+FN)}{
\times(TN+FP)\times(TN+FN)} }}
\label{eq:mcc}
\end{equation}

In order to compare the predicted network to the golden standard using a measure that takes into account the global structures of the graphs, two global measures have been provided, such as the degree correlation $DC$ and the betweenness correlation $BC$.

$DC$ is the correlation between the vector of the degrees of all genes in the real network and those of the predicted network. It is calculated as

\begin{equation}
DC = cor(\bar{d}_{gold}, \bar{d}_{pred})
\label{eq:degree}
\end{equation}

where $d$ is the $i$-dimensional vector containing the degree of each gene.

Similarly, the betweenness correlation $BC$ is the correlation between the same two vectors where the degree has been replaced by the betweenness centrality measure.

$BC$ is calculated as

\begin{equation}
BC = cor(\bar{b}_{gold}, \bar{b}_{pred})
\label{eq:betweenness}
\end{equation}

where $b=b(i)=\sum_{q \ne i \ne r} \frac{\sigma_{qr}(i) } {\sigma_{qr} } , \forall i$, $\sigma_{qr}$ is the total number of shortest paths from node $q$ to node $r$ and $\sigma_{qr}(i)$ is the number of shortest paths from $q$ to $r$ that pass through gene $i$.

Betweenness centrality is, in our opinion, more helpful than simple connectivity. This measure is a direct indicator of how connected the node is and its importance with respect to the global network topology.

As it can be seen in Figure \ref{fig:degree} and Figure \ref{fig:between} there is a strong degree correlation (0.83) and betweenness correlation (0.86) between the nodes of the predicted and real networks. The two measures and the aforementioned strong correlations support the evidence that the topology of the real network is conserved within the predicted network, following the same power law degree distribution of the original network that generated the data.
Due to the fact that GNW generates network from real life templates, we expect  similar results in real biological data.

\begin{figure*}
\noindent\begin{minipage}{.55\textwidth}
  \centering
  \includegraphics[width=.8\linewidth]{pred_fp.eps}
  \caption{Number of predicted edges and false positives vs. \\ number of permutations}
  \label{fig:pred_fp}
\end{minipage}%
\noindent\begin{minipage}{.55\textwidth}
  \centering
  \includegraphics[width=.8\linewidth]{pred_fn.eps}
  \caption{Number of predicted edges and false negatives vs. \\ number of permutations}
  \label{fig:pred_fn}
\end{minipage}
\begin{minipage}{.55\textwidth}
  \centering
  \includegraphics[width=.8\linewidth]{tp_mcc.eps}
  \caption{True positives and Matthew Correlation Coefficient vs. \\ number of permutations}
  \label{fig:tp_mcc}
\end{minipage}%
\begin{minipage}{.55\textwidth}
  \centering
  \includegraphics[width=.8\linewidth]{fpr.eps}
  \captionof{figure}{False positive rate vs. number of permutations}
  \label{fig:fpr_perm}
\end{minipage}
\label{fig:global}
\end{figure*}

\subsection{Performance}
We implemented LABNet in R and we used the \emph{glmnet} package to perform both the Lasso penalty estimation and variable selection.
For each gene (node) the algorithm performs a number of permutations to compute the most significant variables associated to the current gene. Therefore, the code that performs such permutations is the most demanding in terms of computing resources and time. The permutation-based variable selection described in the previous section can be performed independently from the rest of the code. As a consequence, the bottleneck of our method seems to be ideally suited for parallel architectures.
We implemented a parallel version that consistently improves the overall performance of the algorithm, with respect to its sequential execution.
The response permutation code has been written to perform within the \emph{snowfall} environment, distributed as R package in CRAN.

 A summary of the performance improvement achieved by parallel code is provided in Table \ref{timings}. Moreover, we found that the speedup is more consistent as the number of permutations is increased.

\begin{table}[h]
\begin{tabular}{|l|l|l|l|l|l|}
\hline
\textbf{Genes} & \textbf{Perm} & \textbf{1 CPU} & \textbf{2 CPU} & \textbf{3 CPU} & \textbf{4 CPU} \\ \hline
               50 & 500      &   269   &      175  &  153   &  135  \\ \hline
               50 & 1000    &   547  &  347        &  282   &   276  \\ \hline
               200 &  500   &   2846   &   2073  &  1997  & 1942      \\ \hline
\end{tabular}
\vspace{5mm}
\caption{Timings for 4 different execution of LABNet running in sequential (1 CPU) and parallel environments from 2 to 4 CPUs on general purpose hardware (1.3 GHz Intel Core i5), 4GB RAM. \emph{Perm} indicates the number of permutations per gene }
\label{timings}
\end{table}

In a setting with $c$ computing nodes, $p$ genes, $k$ permutations per gene, $T_k$ seconds required to perform $k$ permutations on one computing node, the speedup introduced by the parallel approach can be calculated as
$\frac{p T_k}{c}$ \footnote{In the aforementioned formula, the time needed to perform the first selection of covariates and set the computing nodes within the cluster are not counted. Therefore, the expression will indicate better performance than the one we measure effectively in our experiments.}. As the number of available computing nodes approaches the number of covariates, the total time required by our algorithm is determined by the number of permutations performed on the single computing node.


\section{NHS Chest X-ray dataset}
The first step to investigate interpretability methods was to apply them on a classification task.
We successfully, albeit with some difficulties on the way, trained a neural network for the NIH Chest X-Ray dataset.
We then applied the methods RISE, LIME and Grad-CAM on the neural network output. RISE delivered good results in most cases. Grad-CAM also generated good results, but generated no output at all on 33\% of all images. LIME delivered results of mixed quality. We therefore decided to only use RISE and Grad-CAM in the next phase.

\section{BraTS}
The BraTS dataset contains MRI scans of brains which have aggressive brain tumor growing in them. We extracted 2D slices from the 3D volumes of the dataset (because this reduces the required time to train a neural network significantly) and successfully trained a neural network based on the U-Net architecture. We then modified RISE and Grad-CAM to work on this image segmentation task. Grad-CAM did not generate any usable output which could be used to interpret the segmentation results. RISE generated a heat map marking the regions where the tumor is located. The spatial resolution of the heat map was quite low.

\section{Testnet}
To more accurately asses the quality of the developed methods, we built an artificial dataset named testnet (a "toy" dataset) and trained the same U-Net model was used with BraTS. Using this network we discovered that the output of RISE is not only of low spatial resolution, but also misses out on important parts of the image which is needed for the correct segmentation of images in the testnet dataset.

\section{Hausdorff Distance Masks}
Because Grad-CAM did not work at all, and RISE has only low spatial resolution, we started to evelop own method.
The basic idea is that we occlude small parts of an image (by drawing a black circle onto the image) and then compare the generated output segment with the unmodified baseline segment. When the segment changes significantly, the region occluded by the circle is important for the segmentation of the image.
The method showed good results on BraTS and testnet, displaying a much higher spatial resolution than RISE.

\section{BraTS 3D}
As a last step, we modified the HDM method to work on the 3D volumes in the BraTS dataset. BraTS contest participants provide their trained neural networks in the form of Docker containers. We used one of the GPU based containers and applied the HDM method on it. The results were very good and provide great insight which region of each modality was used by the neural network to generate the output segment.


\documentclass[11pt]{article}

\title{\textbf{Latex Macros}}
\author{Luca Parolari\footnote{luca.parolari23@gmail.com}}
\date{\today}

\usepackage[T1]{fontenc}     % define T1 charset for out files.
\usepackage[english]{babel}  % italian latex typo conventions.
\usepackage[utf8]{inputenc}  % italian symbols.
\usepackage{csquotes}        % needed by babel.
\usepackage{amsmath}         % math features.
\usepackage{amsthm}          % math theorems.
\usepackage{amssymb}         % math symbols.
\usepackage{amsbsy}			 % math bold.
\usepackage{stmaryrd}        % llbrackets, rrbrackets.
\usepackage{float}           % float management.
\usepackage[
backend=biber,
style=numeric,
citestyle=numeric            % numeric, alphabetic
]{biblatex}                  % bib management. %bibtex

\input{prooftree.tex}
\input{macros.tex}

\begin{document}

\maketitle

\begin{abstract}
	This document is a summary of what the \texttt{macros.txt} file contains. Here are listed all usable macros with their sintax, a short descrition and maybe some usage examples. Please refer first to section \ref{intro} in order to get help on how to install this tool and what it needs to work.
\end{abstract}

\tableofcontents
\clearpage

\section{The package}
\label{intro}

\subsection{How to install}
\label{install}

\begin{itemize}
	\item Ensure that required dependencies are satisfied. (See dependencies at \ref{deps}).
	\item Copy \texttt{macros.tex} and \texttt{prooftree.tex} in your source folder.
	\item Include the following lines after \emph{usepackage} section and their configurations.
	\begin{verbatim}
		... usepackage
		... package configuration

		\input{prooftree.tex}
		\input{macros.tex}
	\end{verbatim}
\end{itemize}

\subsection{Usage}

See the section \ref{macros}, use the symbol by typing the \emph{encoding} keyword preceded by a backslash (as an usual latex command).

\subsection{Dependencies}
\label{deps}

\paragraph{Known dependencies}
\begin{itemize}
	\item \texttt{amsmath}
	\item \texttt{amsthm}
	\item \texttt{amssymb}
	\item \texttt{amsbsy}
	\item \texttt{stmaryrd}
\end{itemize}

\paragraph{Usepackage code}
\begin{verbatim}
\usepackage{amsmath}         % math features.
\usepackage{amsthm}          % math theorems.
\usepackage{amssymb}         % math symbols.
\usepackage{amsbsy}          % math bold.
\usepackage{stmaryrd}        % llbrackets, rrbrackets.
\end{verbatim}

\clearpage

\section{Macros}
\label{macros}

\textbf{Note}: this section documets only a small and possibly most important part of implemented macros. For other commands please see \texttt{macros.tex} file.

\subsection{Math}

\subsubsection{Symbols}

\begin{table}[H]
	\def\arraystretch{1.5}
	\begin{tabular}{c l l}
		\textbf{Symbol} & \textbf{Encoding} & \textbf{Description} \\
		\hline
		$\convrg$ & \texttt{convrg} &  \\
		$\divrg$ & \texttt{divrg} &  \\
		$\diverges$ & \texttt{diverges} & Divergence relation \\
		$\lambdaop$ & \texttt{lambdaop} &  \\
		$\defrel{custom}$ & \texttt{defrel\{custom\}} &  \\
		$\defeq$ & \texttt{defeq} &  \\
		$\defiff$ & \texttt{defiff} &  \\
		$\lambdaop$ &  &  \\
		$\dom$ & \texttt{dom} & Domain function \\
		$\true$ & \texttt{true} &  \\
		$\false$ & \texttt{false} &  \\
		$\emptystring$ & \texttt{emptystring} & \\
		$\restrict{f}$ & \texttt{restrict\{f\}} & Restriction of a function \\
		$1 = 1 \quad \law{annotation}$ & \texttt{law\{annotation\}} & Annotation in equation \\
		$\summary{test}$ & \texttt{summary\{test\}} & Summaries for theorem-like environments \\

	\end{tabular}
\end{table}

\subsubsection{Common sets}

\begin{table}[H]
	\def\arraystretch{1.5}
	\begin{tabular}{c l l}
		\textbf{Symbol} & \textbf{Encoding} & \textbf{Description} \\
		\hline
		$\Nset$ & \texttt{Nset} &  \\
		$\Qset$ & \texttt{Qset} &  \\
		$\Zset$ & \texttt{Zset} &  \\
		$\Rset$ & \texttt{Rset} &  \\
	\end{tabular}
\end{table}

\subsubsection{Calligraphic Alphabet}

\begin{table}[H]
	\def\arraystretch{1.5}
	\begin{tabular}{c l l}
		\textbf{Symbol} & \textbf{Encoding} & \textbf{Description} \\
		\hline
		$\calA$ & \texttt{calA} &  \\
		$\calB$ & \texttt{calB} &  \\
		$\ldots$ & $\ldots$ &  \\
		$\calZ$ & \texttt{calZ} &  \\
	\end{tabular}
\end{table}

\subsubsection{Function declarations}

\begin{table}[H]
	\def\arraystretch{1.5}
	\begin{tabular}{c l l}
		\textbf{Symbol} & \textbf{Encoding} & \textbf{Description} \\
		\hline
		$\reld{name}{S_1}{S_2}$ & \texttt{reld\{name\}\{$S_1$\}\{$S_2$\}} &  \\
		$\fund{name}{S_1}{S_2}$ & \texttt{fund\{name\}\{$S_1$\}\{$S_2$\}} &  \\
		$\pard{name}{S_1}{S_2}$ & \texttt{pard\{name\}\{$S_1$\}\{$S_2$\}} &  \\
	\end{tabular}
\end{table}

\subsubsection{Logical stuff}

\begin{table}[H]
	\def\arraystretch{1.5}
	\begin{tabular}{c l l}
		\textbf{Symbol} & \textbf{Encoding} & \textbf{Description} \\
		\hline
		$\st$ & \texttt{st} & Dot user existensial quantification \\
		$\itc$ & \texttt{aaa} & Dot user universal quantification \\
	\end{tabular}
\end{table}

\subsection{Set}

\begin{table}[H]
	\def\arraystretch{1.5}
	\begin{tabular}{c l l}
		\textbf{Symbol} & \textbf{Encoding} & \textbf{Description} \\
		\hline
		$\emptyset$ & \texttt{emptyset} &  \\
		$\wpf$ & \texttt{wpf} &  \\
		$\sseq$ & \texttt{sseq} &  \\
		$\sseqf$ & \texttt{sseqf} &  \\
		$\sslt$ & \texttt{sslt} &  \\
		$\union$ & \texttt{union} &  \\
		$\bigunion$ & \texttt{bigunion} &  \\
		$\inters$ & \texttt{inters} &  \\
		$\setdiff$ & \texttt{setdiff} &  \\
		$\sset{1}{B}$ & \texttt{sset\{1\}\{A\}} &  \\
		$\FI$ & \texttt{setdiff} &  \\
		$\stimes$ & \texttt{stimes} & Strict cartesian product \\
		$\spair{S_1}{S_2}$ & \texttt{spair\{$S_1$\}\{$S_2$\}} & Strict cartesian product with operands \\
	\end{tabular}
\end{table}

\subsection{Syntax}

\subsubsection{BNF}

\begin{table}[H]
	\def\arraystretch{1.5}
	\begin{tabular}{c l l}
		\textbf{Symbol} & \textbf{Encoding} & \textbf{Description} \\
		\hline
		$\vbar$ & \texttt{vbar} & \\
	\end{tabular}
\end{table}

\subsubsection{Abstract syntax}

\begin{table}[H]
	\def\arraystretch{1.5}
	\begin{tabular}{c l l}
		\textbf{Symbol} & \textbf{Encoding} & \textbf{Description} \\
		\hline
		$\Integer$ & \texttt{Integer} &  \\
		$\Bool$ & \texttt{Bool} &  \\
		$\Ghost$ & \texttt{Ghost} &  \\
		$\LE$ & \texttt{LE} &  \\
		$\LExp$ & \texttt{LExp} &  \\
		$\FV$ & \texttt{FV} &  \\
		$\Var$ & \texttt{Var} &  \\
		$\Pred$ & \texttt{Pred} &  \\
		$\AExp$ & \texttt{AExp} &  \\
		$\BExp$ & \texttt{BExp} &  \\
		$\Com$ & \texttt{Com} &  \\
		$\Exp$ & \texttt{Exp} &  \\
		$\ST$ & \texttt{ST} &  \\
	\end{tabular}
\end{table}

\subsection{Semantics}

\begin{table}[H]
	\def\arraystretch{1.5}
	\begin{tabular}{c l l}
		\textbf{Symbol} & \textbf{Encoding} & \textbf{Description} \\
		\hline
		$\config{x}{y}$ & \texttt{config\{x\}\{y\}} &  \\
		$\denotB{b}{s}$ & \texttt{denotB\{b\}\{s\}} &  \\
		$\denotA{n}{s}$ & \texttt{denotA\{n\}\{s\}} &  \\
		$\denotE{e}{s}$ & \texttt{denotE\{e\}\{s\}} &  \\
		$\denotC{c}{s}$ & \texttt{denotC\{c\}\{s\}} &  \\
		$\denotBsl{b}$ & \texttt{denotBsl\{b\}} & \texttt{denotB} stateless \\
		$\denotCsl{c}$ & \texttt{denotCsl\{c\}} & \texttt{denotC} stateless \\
		$\assign{s}{x}{a}$ & \texttt{assign\{s\}\{x\}\{a\}} &  \\
		$\bigassign{s}{x}{a}$ & \texttt{bigassign\{s\}\{x\}\{a\}} &  \\
		$\ssarrow$ & \texttt{ssarrow} & Long arrow \\
		$\nssarrow$ & \texttt{nssarrow} & Long not arrow \\
		 & \texttt{subst} & ??? \\
		 & \texttt{substt} & ??? \\
		$\funcomp{f}{g}$ & \texttt{funcomp\{f\}\{g\}} &  \\
	\end{tabular}
\end{table}

\subsubsection{Prooftree}

\begin{table}[H]
	\def\arraystretch{1.5}
	\begin{tabular}{c l l}
		\textbf{Symbol} & \textbf{Encoding} & \textbf{Description} \\
		\hline
		 & \texttt{prooftree} & Beginning of prooftree \\
		 & \texttt{endprooftree} & End of prooftree \\
		 & \texttt{rulename} & Prooftree rule name \\
		 & \texttt{justifies} & Allows to insert the judgement \\
		 & \texttt{nohyp} & Create an axiom \\
	\end{tabular}
\end{table}

\paragraph{Usage}
The code
\begin{verbatim}
\rulename{Rule}
\prooftree
  clause1 ... clauseN
  \justifies
  judgement
\endprooftree
\end{verbatim}
produces
\begin{equation*}
\rulename{Rule}
\prooftree
  clause1\ ...\ clauseN
  \justifies
  judgement
\endprooftree
\end{equation*}

\subsection{Code}

\begin{table}[H]
	\def\arraystretch{1.5}
	\begin{tabular}{c l l}
		\textbf{Symbol} & \textbf{Encoding} & \textbf{Description} \\
		\hline
		$\wass$ & \texttt{wass} &  \\
		$\condif{b}{c_1}{c_2}$ & \texttt{condif\{b\}\{$c_1$\}\{$c_2$\}} &  \\
		$\while{b}{c}$ & \texttt{while\{b\}\{c\}} &  \\
		$\repeatuntil{c}{b}$ & \texttt{repeatuntil\{c\}\{b\}} &  \\
		$\ecc$ & \texttt{ecc} &  \\
		$\unvar$ & \texttt{unvar} &  \\
		$\id$ & \texttt{id} &  \\
		$\cond$ & \texttt{cond} &  \\
		$\seq$ & \texttt{seq} &  \\
		$\ttv$ & \texttt{ttv} &  \\
		$\ffv$ & \texttt{ffv} &  \\
		$\divop$ & \texttt{divop} &  \\
		$\modop$ & \texttt{modop} &  \\
		$\andop$ & \texttt{andop} &  \\
		$\orop$ & \texttt{orop} &  \\
		$\notop$ & \texttt{notop} &  \\
		$\type$ & \texttt{type} & Type of a constant \\
	\end{tabular}
\end{table}

\subsection{Abstract Interpretation}

\begin{table}[H]
	\def\arraystretch{1.5}
	\begin{tabular}{c l l}
		\textbf{Symbol} & \textbf{Encoding} & \textbf{Description} \\
		\hline
		$\lub$ & \texttt{lub} &  \\
		$\glb$ & \texttt{glb} &  \\
		$\lfp$ & \texttt{lfp} &  \\
		$\gfp$ & \texttt{gfp} &  \\
		$\widen$ & \texttt{widen} & Generic widening \\
	\end{tabular}
\end{table}

\subsection{Utils}

\begin{table}[H]
	\def\arraystretch{1.5}
	\begin{tabular}{c l l}
		\textbf{Symbol} & \textbf{Encoding} & \textbf{Description} \\
		\hline
		$\mactext{text}$ & \texttt{mactext\{text\}} & Typewriter font in math environment \\
		\Cplusplus & \texttt{Cplusplus} &  \\
		Create the footnote ``FIXME: text'' & \texttt{fixme{text}} & \\
		Create the footnote ``TODO: text'' & \texttt{todo{text}} & \\
	\end{tabular}
\end{table}

\subsection{Other}

\subsection{Configuration sets}

\begin{table}[H]
	\def\arraystretch{1.5}
	\begin{tabular}{c l l}
		\textbf{Symbol} & \textbf{Encoding} & \textbf{Description} \\
		\hline
		$\NTe$ & \texttt{aaa} &  \\
		$\NTb$ & \texttt{aaa} &  \\
		$\NTd$ & \texttt{aaa} &  \\
		$\NTg$ & \texttt{aaa} &  \\
		$\NTs$ & \texttt{aaa} &  \\
		$\NTk$ & \texttt{aaa} &  \\
		$\Te$ & \texttt{aaa} &  \\
		$\Tb$ & \texttt{aaa} &  \\
		$\Td$ & \texttt{aaa} &  \\
		$\Tg$ & \texttt{aaa} &  \\
		$\Ts$ & \texttt{aaa} &  \\
		$\Tk$ & \texttt{aaa} &  \\
	\end{tabular}
\end{table}

\subsubsection{Custom configuration sets}

\begin{table}[H]
	\def\arraystretch{1.5}
	\begin{tabular}{c l l}
		\textbf{Symbol} & \textbf{Encoding} & \textbf{Description} \\
		\hline
		$\NT{x}$ & \texttt{aaa} &  \\
		$\NTq$ & \texttt{aaa} &  \\
		$\Tq$ & \texttt{aaa} &  \\
	\end{tabular}
\end{table}

\subsubsection{Denotable values}

\begin{table}[H]
	\def\arraystretch{1.5}
	\begin{tabular}{c l l}
		\textbf{Symbol} & \textbf{Encoding} & \textbf{Description} \\
		\hline
		$\dVal$ & \texttt{aaa} &  \\
		$\sVal$ & \texttt{aaa} &  \\
		$\sval$ & \texttt{aaa} &  \\
	\end{tabular}
\end{table}

\subsection{Unknown}

\begin{table}[H]
	\def\arraystretch{1.5}
	\begin{tabular}{c l l}
		\textbf{Symbol} & \textbf{Encoding} & \textbf{Description} \\
		\hline
		$\FI$ & \texttt{aaa} &  \\
		$\DI$ & \texttt{aaa} &  \\
		$\SL$ & \texttt{aaa} &  \\
		$\Env$ & \texttt{aaa} &  \\
	\end{tabular}
\end{table}

%%% Control modes.
%\newcommand*{\CtrlMode}{\mathord{\mathrm{CtrlMode}}}
%\newcommand*{\cm}{\mathrm{cm}}
%%% Branch modes.
%%\newcommand*{\BranchMode}{\mathord{\mathrm{BranchMode}}}
%\newcommand*{\GotoMode}{\mathord{\mathrm{GotoMode}}}
%\newcommand*{\SwitchMode}{\mathord{\mathrm{SwitchMode}}}
%\newcommand*{\cmgoto}{\mathop{\mathrm{goto}}\nolimits}
%\newcommand*{\cmswitch}{\mathop{\mathrm{switch}}\nolimits}
%\newcommand*{\cmbreak}{\mathop{\mathrm{break}}\nolimits}
%\newcommand*{\cmcontinue}{\mathop{\mathrm{continue}}\nolimits}
%\newcommand*{\cmreturn}{\mathop{\mathrm{return}}\nolimits}
%%% Exec mode.
%\newcommand*{\cmexec}{\mathrm{exec}}
%%% Value mode.
%\newcommand*{\ValMode}{\mathord{\mathrm{ValMode}}}
%\newcommand*{\cmvalue}{\mathop{\mathrm{value}}\nolimits}
%%% Environment mode.
%\newcommand*{\EnvMode}{\mathord{\mathrm{EnvMode}}}
%\newcommand*{\cmenv}{\mathrm{env}}
%%% Exception modes.
%\newcommand*{\ExceptMode}{\mathord{\mathrm{ExceptMode}}}
%\newcommand*{\cmexcept}{\mathrm{except}}
%
%%% Control states.
%\newcommand*{\CtrlState}{\mathord{\mathrm{CtrlState}}}
%\newcommand*{\cs}{\mathord{\mathrm{cs}}}
%%% Value states.
%\newcommand*{\ValState}{\mathord{\mathrm{ValState}}}
%\newcommand*{\valstate}{\upsilon}
%%% Environment states.
%%\newcommand*{\EnvState}{\mathord{\mathrm{EnvState}}}
%%% Exception states.
%\newcommand*{\ExceptState}{\mathord{\mathrm{ExceptState}}}
%\newcommand*{\exceptstate}{\varepsilon}
%
%%% Keywords.
%\newcommand*{\kw}[1]{\mathop{\textup{\textbf{#1}}}}
%
%\newcommand*{\bop}{\mathbin{\mathrm{bop}}}
%%\newcommand*{\uop}{\mathop{\mathrm{uop}}}
%
%%% Exceptions.
%\newcommand*{\RTSExcept}{\mathord{\mathrm{RTSExcept}}}
%\newcommand*{\rtsexcept}{\chi}
%\newcommand*{\Except}{\mathord{\mathrm{Except}}}
%\newcommand*{\except}{\xi}
%\newcommand*{\none}{\mathtt{none}}
%\newcommand*{\divbyzero}{\mathtt{divbyzero}}
%\newcommand*{\stkovflw}{\mathtt{stkovflw}}
%\newcommand*{\datovflw}{\mathtt{datovflw}}
%\newcommand*{\memerror}{\mathtt{memerror}}
%%\newcommand*{\inerror}{\mathtt{inerror}}
%%\newcommand*{\nullptr}{\mathtt{nullptr}}
%%\newcommand*{\outofboundsptr}{\mathtt{outofboundsptr}}
%
%%% Flags for terminal configurations of catch clauses.
%\newcommand*{\caught}{\mathtt{caught}}
%\newcommand*{\uncaught}{\mathtt{uncaught}}
%
%%% Static semantics.
%\newcommand*{\TEnv}{\mathord{\mathrm{TEnv}}}
%\newcommand*{\tinteger}{\mathrm{integer}}
%\newcommand*{\tboolean}{\mathrm{boolean}}
%\newcommand*{\trtsexcept}{\mathrm{rts\_exception}}
%
%%% Memory structures.
%\newcommand*{\Loc}{\mathord{\mathrm{Loc}}}
%\newcommand*{\Ind}{\mathrm{Ind}}
%\newcommand*{\Addr}{\mathrm{Addr}}
%\newcommand*{\Map}{\mathrm{Map}}
%%\newcommand*{\eMap}{\mathrm{eMap}}
%\newcommand*{\Stack}{\mathord{\mathrm{Stack}}}
%\newcommand*{\Mem}{\mathord{\mathrm{Mem}}}
%\newcommand*{\stknew}{\mathop{\mathrm{new}_\mathrm{s}}\nolimits}
%\newcommand*{\datnew}{\mathop{\mathrm{new}_\mathrm{d}}\nolimits}
%\newcommand*{\txtnew}{\mathop{\mathrm{new}_\mathrm{t}}\nolimits}
%\newcommand*{\heapnew}{\mathop{\mathrm{new}_\mathrm{h}}\nolimits}
%\newcommand*{\heapdel}{\mathop{\mathrm{delete}_\mathrm{h}}\nolimits}
%\newcommand*{\datcleanup}{\mathop{\mathrm{cleanup}_\mathrm{d}}\nolimits}
%\newcommand*{\smark}{\mathop{\mathrm{mark}_\mathrm{s}}\nolimits}
%\newcommand*{\sunmark}{\mathop{\mathrm{unmark}_\mathrm{s}}\nolimits}
%\newcommand*{\slink}{\mathop{\mathrm{link}_\mathrm{s}}\nolimits}
%\newcommand*{\sunlink}{\mathop{\mathrm{unlink}_\mathrm{s}}\nolimits}
%\newcommand*{\asmark}{\mathop{\mathrm{mark}_\mathrm{s}^\sharp}\nolimits}
%\newcommand*{\asunmark}{\mathop{\mathrm{unmark}_\mathrm{s}^\sharp}\nolimits}
%\newcommand*{\aslink}{\mathop{\mathrm{link}_\mathrm{s}^\sharp}\nolimits}
%\newcommand*{\asunlink}{\mathop{\mathrm{unlink}_\mathrm{s}^\sharp}\nolimits}
%\newcommand*{\aswiden}{\mathop{\mathrm{widen}}\nolimits}
%\newcommand*{\sm}{\dag}
%\newcommand*{\fm}{\ddag}
%\newcommand*{\topmost}{\mathop{\mathrm{tf}}\nolimits}
%%% Short forms of \datcleanup, \sunmark, \sunlink for table.
%\newcommand*{\datcleanupshort}{\mathop{\mathrm{cu}_\mathrm{d}}\nolimits}
%\newcommand*{\sunmarkshort}{\mathop{\mathrm{um}_\mathrm{s}}\nolimits}
%\newcommand*{\sunlinkshort}{\mathop{\mathrm{ul}_\mathrm{s}}\nolimits}
%
%\newcommand*{\location}[1]{\mathord{#1 \; \mathrm{loc}}}
%%\newcommand*{\saeval}{\mathop{\mathrm{aeval}}\nolimits}
%%\newcommand*{\saupd}{\mathop{\mathrm{aupd}}\nolimits}
%\newcommand*{\asupported}{\mathop{\mathrm{supported}^\sharp}\nolimits}
%\newcommand*{\aeval}{\mathop{\mathrm{eval}^\sharp}\nolimits}
%\newcommand*{\ceval}[1]{\mathop{\mathrm{eval}_{#1}}\nolimits}
%
%%% Additional macros for the extension to pointer and arrays:
%%% Elementary types.
%\newcommand*{\eType}{\mathrm{eType}}
%\newcommand*{\eT}{\mathrm{eT}}
%%% Elementary values.
%%\newcommand*{\eValue}{\mathrm{eVal}}
%%% Array types.
%\newcommand*{\aType}{\mathrm{aType}}
%\newcommand*{\aT}{\mathrm{aT}}
%%% Record types.
%\newcommand*{\rType}{\mathrm{rType}}
%\newcommand*{\rT}{\mathrm{rT}}
%%% Object types.
%\newcommand*{\oType}{\mathrm{oType}}
%\newcommand*{\oT}{\mathrm{oT}}
%%% Function types.
%\newcommand*{\fType}{\mathrm{fType}}
%\newcommand*{\fT}{\mathrm{fT}}
%%% Memory types.
%\newcommand*{\mType}{\mathrm{mType}}
%\newcommand*{\mT}{\mathrm{mT}}
%%% Pointer types.
%\newcommand*{\pType}{\mathrm{pType}}
%\newcommand*{\pT}{\mathrm{pT}}
%%% Offsets.
%\newcommand*{\Offset}{\mathrm{Offset}}
%\newcommand*{\nooffset}{\boxempty}
%\newcommand*{\indexoffset}[1]{\mathopen{\boldsymbol{[}}{#1}\mathclose{\boldsymbol{]}}}
%\newcommand*{\fieldoffset}[1]{\mathop{\boldsymbol{.}}{#1}}
%%% Lvalues.
%\newcommand*{\lValue}{\mathrm{LValue}}
%\newcommand*{\lvalue}{\mathrm{lval}}
%%% Rvalues.
%\newcommand*{\rValue}{\mathrm{RValue}}
%\newcommand*{\rvalue}{\mathrm{rval}}
%%%
%\newcommand*{\pointer}[1]{{#1}\boldsymbol{\ast}}
%\newcommand*{\maddress}[1]{\mathop{\&}{#1}}
%\newcommand*{\indirection}[1]{\mathop{\boldsymbol{\ast}}{#1}}
%%%
%\newcommand*{\locnull}{\mathord{l_\mathrm{null}}}
%\newcommand*{\ptrmove}{{\mathop{\mathrm{ptrmove}}\nolimits}}
%\newcommand*{\ptrdiff}{{\mathop{\mathrm{ptrdiff}}\nolimits}}
%\newcommand*{\ptrcmp}{{\mathop{\mathrm{ptrcmp}}\nolimits}}
%%%
%\newcommand*{\arraysyntax}[3]{\kw{#1} {#2} \kw{of}\,{#3}}
%\newcommand*{\arraytype}[2]{\arraysyntax{array}{#1}{#2}}
%\newcommand*{\firstof}{{\mathop{\mathrm{firstof}}\nolimits}}
%\newcommand*{\arrayindex}{\mathop{\mathrm{index}}\nolimits}
%\newcommand*{\locindex}{\mathop{\mathrm{locindex}}\nolimits}
%%%
%\newcommand*{\recordsyntax}[3]{\kw{#1} {#2} \kw{of}\,{#3}}
%\newcommand*{\recordtype}[2]{\recordsyntax{record}{#1}{#2}}
%\newcommand*{\field}{\mathop{\mathrm{field}}\nolimits}
%\newcommand*{\locfield}{\mathop{\mathrm{locfield}}\nolimits}

%%% Additional macros for the extension for extra numeric types
%%% Floating point types.
%\newcommand*{\tfloat}{\mathrm{float}}
%%% Numeric types
%\newcommand*{\nType}{\mathrm{nType}}
%\newcommand*{\nT}{\mathrm{nT}}

%%% Abstracts.
%\newcommand*{\Abstract}{\mathord{\mathrm{Abstract}}}
%\newcommand*{\abs}{\mathord{\mathrm{abs}}}
%
%%% Integer part function.
%\newcommand{\intp}{\mathop{\mathrm{int}}\nolimits}
%
%%% Concrete functions and operations.
%% Aritmethic
%\newcommand*{\conadd}{\mathbin{\boxplus}}
%\newcommand*{\consub}{\mathbin{\boxminus}}
%\newcommand*{\conmul}{\mathbin{\boxdot}}
%\newcommand*{\condiv}{\mathbin{\boxslash}}
%\newcommand*{\conmod}{\mathbin{\boxbar}}
%% Boolean
%\newcommand*{\coneq}{\mathbin{\circeq}}
%\newcommand*{\conineq}{\mathbin{\leqq}}
%\newcommand*{\conneg}{\mathbin{\daleth}}
%\newcommand*{\conor}{\mathbin{\triangledown}}
%\newcommand*{\conand}{\mathbin{\vartriangle}}
%\newcommand*{\bneg}{\mathop{\neg}\nolimits}
%
%%% Abstract functions and operations.
%% Domains
%\newcommand*{\Sign}{\mathrm{Sign}}
%\newcommand*{\AbBool}{\mathrm{AbBool}}
%
%% Aritmethic
%\newcommand*{\absuminus}{\mathop{\ominus}\nolimits}
%\newcommand*{\absadd}{\mathbin{\oplus}}
%\newcommand*{\abssub}{\mathbin{\ominus}}
%\newcommand*{\absmul}{\mathbin{\odot}}
%\newcommand*{\absdiv}{\mathbin{\oslash}}
%\newcommand*{\absmod}{\mathbin{\obar}}
%% Boolean
%\newcommand*{\abseq}{\mathrel{\triangleq}}
%\newcommand*{\absneq}{\mathrel{\not\triangleq}}
%\newcommand*{\absleq}{\mathrel{\trianglelefteq}}
%\newcommand*{\abslt}{\mathrel{\vartriangleleft}}
%\newcommand*{\absgeq}{\mathrel{\trianglerighteq}}
%\newcommand*{\absgt}{\mathrel{\vartriangleright}}
%\newcommand*{\absneg}{\mathrel{\circleddash}}
%\newcommand*{\absor}{\mathrel{\ovee}}
%\newcommand*{\absand}{\mathrel{\owedge}}
%% Figures
%\newcommand*{\signtop}{\top}
%\newcommand*{\signbot}{\bot}
%\newcommand*{\signge}{\mathord{\geq}}
%\newcommand*{\signgt}{\mathord{>}}
%\newcommand*{\signle}{\mathord{\leq}}
%\newcommand*{\signlt}{\mathord{<}}
%\newcommand*{\signeq}{\mathord{=}}
%\newcommand*{\signne}{\mathord{\neq}}

%\theoremstyle{definition}
%\newtheorem{definizione}{Definizione}
%\newtheorem{teorema}{Teorema}
%\newtheorem{proposizione}{Proposizione}
%\newtheorem{lemma}{Lemma}
%\newtheorem{esercizio}{Esercizio}
%

\end{document}