\section{Method}
\label{sec:methods}

%We first describe our classifier for detecting split errors which is based on a convolutional neural network (CNN). We detail the CNN architecture, input features and the training method. We then describe how the same classifier can be used to detect merge errors and how we create potential corrections. The classifiers are integrated into an existing proofreading workflow as reported after. Finally, we explore an active label suggestion method which reorders the ranking obtained by our classifiers and maximizes the information gain provided by each potential correction.
\subsection{Split Error Detection}
\label{sec:spliterrordetection}

We build a split error classifier with output $p$ using a CNN to check whether an edge within an existing automatic segmentation is valid ($p=0$) or not ($p=1$). Rather than analyzing every input pixel, the classifier operates only on segment boundaries, which requires less pixel context and is faster. In contrast to Bogovic \etal~\cite{BogovicHJ13}, we work with 2D slices rather than 3D volumes. This enables proofreading prior or in parallel to a computationally expensive stitching and 3D alignment of individual EM images.

\paragraph{CNN Architecture.} Boundary split error detection is a binary classification task since the boundary is either correct or erroneous. However, in reality, the score $p$ is between 0 and 1. In connectomics, classification complexity arises from hundreds of different cell types, rather than from the classification decision itself. Intuitively, this yields a wider architecture with more filters rather than a deeper architecture with more layers. We explored different architectures---including residual networks~\cite{resnet}---with brute force parameter searches and precision and recall comparisons (see supplementary materials). Our final CNN configuration for split error detection has four convolutional layers, each followed by max pooling with dropout regularization to prevent overfitting due to limited training data (Fig.~\ref{fig:architecture}).

\paragraph{Classifier Inputs.} To train the CNN, we consider boundary context in the decision making process via a $75\times75$ patch over the center of an existing boundary. This size covers approximately $80\%$ of all boundaries in the 6~nm Mouse S1 AC3 Open Connectome Project dataset. If the boundary is not fully covered, we sample up to 10 non-overlapping patches along the boundary, and average the resulting scores weighted by the boundary length coverage per patch.
%\footnote{\scriptsize{\url{http://openconnectomeproject.org/}}}

Similar to Bogovic~\etal~\cite{BogovicHJ13}, we use grayscale image data, corresponding boundary probabilities, and a single binary mask combining the two neighboring labels as inputs to our CNN. However, we observed that the boundary probability information generated from EM images is often misleading due to noise or artifacts in the data. This can result in merge errors within the automatic segmentation. To better direct our classifier to train on the true boundary, we extract the border between two segments. Then, we dilate this border by 5 pixels to consider slight edge ambiguities as well as cover extra-cellular space, and use this binary mask as an additional input. This creates a stacked 4-channel input patch. Fig.~\ref{fig:cnn_inputs} shows examples of correct and erroneous input patches and their corresponding automatic segmentation and ground truth.

\begin{figure}[t]
\centering
\includegraphics[width=\linewidth]{gfx/cnn_inputs.pdf}
\caption{Example inputs for learning correct splits and split errors (candidate segmentation versus the ground truth). Image, membrane probabilities, merged binary labels, and a dilated border mask provide 4-channel input patches.}
\label{fig:cnn_inputs}
\vspace{-4mm}
\end{figure}

\subsection{Merge Error Detection}

Identification and correction of merge errors is more challenging than finding and fixing split errors, because we must look inside segmentation regions for missing or incomplete boundaries and then propose the correct boundary. However, we can reuse the same trained CNN for this task.

To find merge errors, we generate candidate splits within a label segment and use our split error classifier to rate them.
%If the classifier yields a result close to 0, meaning the candidate split is actually likely to be a correct one, then we assume that the label has been merged in error and that this candidate split will fix the merge error.
If the classifier yields a result close to 0, the candidate split is likely to be correct and we have found a potential correction.

%Similar to guided volume editing by Karimov~\etal~\cite{karimov_guided_volume_editing}, we generate potential borders within a segment.

%For each segmentation label, we dilate the label by 20 pixel and generate 50 potential boundaries through the region by randomly placing watershed seed points at opposite sides of the label boundary. We perform watershed on the inverted grayscale EM image. This yields 50 candidate splits.
To generate candidate splits for each segmentation label, we create 50 potential boundaries through the region by randomly placing watershed seed points at opposite sides of the label boundary.
%For each segmentation label, we generate 50 potential boundaries through the region by randomly placing watershed seed points at opposite sides of the label boundary.
We observed that correct splits tend to include label boundaries, and so we promote their inclusion by dilating the label 20 pixels. This lets the watershed algorithm `pick up' the boundary more successfully. These boundaries are then individually rated using our split error classifier (Fig.~\ref{fig:merge_error}, pseudo code in supplemental).

%We perform watershed on the inverted grayscale EM image. This yields 50 candidate splits. Prior to watershed, we dilate the label by 20 pixel which is motivated by our observation that the generated splits tend to attach to real membrane boundaries. These boundaries are then individually rated using our split error classifier.

%For this, we invert the probability score such that a correct split (previously encoded as $p=0$) is most likely a candidate for a merge error (now encoded as $p=1$). In other words, if a generated boundary is ranked as correct, it probably should be in the segmentation. Fig. \ref{fig:merge_error} illustrates this procedure. Pseudo code is available as supplemental material to promote understanding.

\begin{figure}[t]
\centering
\includegraphics[width=\linewidth]{gfx/merge_error_v6.pdf}
\caption{Merge error detection: Potential borders are generated using inverted images by randomly placing watershed seeds (green) on the boundary of a dilated segment. The best ranked seeds and border (both in red) result in the shown error correction.}
%Merge errors are identified by generating randomly-seeded watershed borders within a dilated label segment. Then, each border is individually rated using the split error CNN by inverting the probability score. A confident rating for a correct split most likely indicates the missing border of the merge error, and can be used to correct the labeling.}
\label{fig:merge_error}
\vspace{-4mm}
\end{figure}

\subsection{Error Correction}
\label{sec:errorcorrection}

We combine the proposed classifiers to perform corrections of split and merge errors in automatic segmentations. For this, we first perform merge error detection for all existing segments in a dataset and store the inverted rankings $1-p$ as well as potential corrections. After that, we perform split error detection and store the ranking $p$ for all neighboring segments in the segmentation. Then, we sort the merge and split error rankings separately from highest to lowest. For error correction, first we loop through the potential merge error regions and then through the potential split error regions. During this process, each error is now subject to a yes/no decision which can be provided in different ways:

\paragraph{Selection oracle.} If ground truth data is available, the selection oracle \textit{knows} whether a possible correction improves an automatic segmentation. This is realized by simply comparing the outcome of a correction using a defined measure. The oracle only accepts corrections which improve the automatic segmentation---others get
discarded. This is guided proofreading with a perfect user, and allows us to assess the upper limit of improvements.

\paragraph{Automatic selection with threshold.} The decision whether to accept or reject a potential correction is taken by comparing rankings to a threshold $p_t$. If the inverted score $1-p$ of a merge error is higher than a threshold $1-p_t$, the correction is accepted. Similarly, a correction is accepted for a split error if the ranking $p$ is higher than $p_t$. Our experiments have shown that the threshold $p_t$ is the same for merge and split errors for a balanced classifier that has been trained on equal numbers of correct and error patches.

\paragraph{Forced choice setting.} We present a user with the choice to accept or reject a correction. All potential split errors are seen. Inspecting all merge errors is not possible for users due to the sheer amount of generated borders. Therefore, we only present merge errors that have a probability threshold higher than $1-p_t$. Fig.~\ref{fig:ui} shows an example correction using the forced choice setting within our framework.

\noindent \newline In all cases, a decision has to be made to advance to the next possible erroneous region. If a merge error correction was accepted, the newly found boundary is added to the segmentation data. This partially updates the merge error and split error ranking with respect to the new segment. If a split error correction was accepted, two segments are merged in the segmentation data and the disappearing segment is removed from all error rankings. Then, we perform merge error detection on the now larger segment and update the ranking. We also update the split error rankings to include all new neighbors, and re-sort. The error with the next highest ranking then forces a choice.

\begin{figure}[t]
\includegraphics[width=\linewidth]{gfx/user_interface_split.pdf}
\caption{Example error correction within the forced choice setting. A candidate error region is shown on the left. The user must choose between the region being a split error which needs correcting (center) or not (right). Confirming the choice advances to the next potential error.} % Hovering highlights the current selection with a blue border, and a}
\label{fig:ui}
\vspace{-4mm}
\end{figure}

%
%\subsection{Active Label Suggestion}
%
%In an interactive setting, one way to present patches to the user for proofreading is to order them by the confidence probability of the GP classifier. However, in an active learning setting, where the network is retrained repeatedly on new label evidence, this approach is less likely to decrease segmentation error as, with the new labels, we are only reinforcing what the network already has a high confidence in.
%Instead, we apply active label suggestion to guide the user into labeling patches which will be more informative to retraining, and so overall decrease VI faster within the proofreading cycle of label $\rightarrow$ train $\rightarrow$ label. For each patch, we remove the softmax classification layer and look at the activation weights associated with the last dense layer. These become a high-dimensional feature vector. Then, we adapt Anon~\etal~\cite{ANON} to provide label suggestions based on features from the learned CNN, which is based on maximizing the average information gain provided by a candidate patch to label.
%A second consideration is that each patch labeled by the user provides evidence to other patches, e.g., correcting a split error redefines an entire boundary, from which multiple candidate patch labelings could have been drawn. As such, when the user labels a patch, we consider all `knock-on' effect patches as also being labeled, and feed these into the active label suggestion system similarly.
%In section \ref{sec:evaluation}, we report the difference in performance from using active label suggestion rather than confidence ordering when presenting patches to the user. These results are without retraining the network after new labelings: this should improve results, but would have to be batched to reduce computational load; hence, we leave this for future work.


\subsection*{Loops}

\subsubsection*{\href{https://sourceacademy.org/sicpjs/4.1.2\#ex_4.7}{while-loops}}

Roughly speaking, while loops are seen as abbreviations for function applications as follows:

\[
\textbf{\texttt{while}}\ \textbf{\texttt{(}}\  \textit{expression} \ \textbf{\texttt{)}} \
\textit{block}
\]
stands for

\begin{center}
  \begin{minipage}{90mm}
$\textbf{\texttt{function}}$ \lstinline{_body()} $\textbf{\texttt{\{}}\  \textit{block} \ \textbf{\texttt{\}}}$\newline
\lstinline{_while( () => } $\textit{expression}$ \lstinline{, _body );}
  \end{minipage}
\end{center}

where \lstinline{_while} is defined as follows:

\begin{lstlisting}
function _while(test, body) {
    if (test()) {
        body();
        _while(test, body);
    } else {
        undefined;
    }
}
\end{lstlisting}

\subsubsection*{\href{https://sourceacademy.org/sicpjs/4.1.2\#ex_4.8}{Simple for-loops}}

\[\textbf{\texttt{for}}\ \textbf{\texttt{(}} \
                                          \textit{assignment}_1 \textbf{\texttt{;}}
\ \textit{expression} \ \textbf{\texttt{;}} \ \textit{assignment}_2 \ \textbf{\texttt{)}} \
                                            \textit{block}
\]
stands for
\begin{center}
  \begin{minipage}{90mm}
\begin{lstlisting}
^$\textrm{\textit{assignment}}_1$^
while (^$\textrm{\textit{expression}}$^) {
    ^$\textrm{\textit{block}}$^
    ^$\textrm{\textit{assignment}}_2$^
}
\end{lstlisting}
  \end{minipage}
\end{center}

\subsubsection*{\href{https://sourceacademy.org/sicpjs/4.1.2\#ex_4.9}{for-loops with loop control variable}}

\[\textbf{\texttt{for}}\ \textbf{\texttt{(}} \
\textbf{\texttt{let}}\ \textit{name}\ \texttt{=}\
\textit{expression}_1 \textbf{\texttt{;}}
\ \textit{expression}_2 \ \textbf{\texttt{;}} \ \textit{assignment} \ \textbf{\texttt{)}} \
                                            \textit{block}
\]
stands for
\begin{center}
  \begin{minipage}{90mm}
  \begin{lstlisting}
{
    let ^$\textrm{\textit{name}}$^ = ^$\textrm{\textit{expression}}_1$^;
    for (^$\textrm{\textit{name}}$^ = ^$\textrm{\textit{name}}$^; ^$\textrm{\textit{expression}}_2$^; ^$\textrm{\textit{assignment}}$^) {
         const _copy_of_^$\textrm{\textit{name}}$^ = ^$\textrm{\textit{name}}$^;
         {
             const ^$\textrm{\textit{name}}$^ = _copy_of_^$\textrm{\textit{name}}$^;
             ^$\textrm{\textit{block}}$^
         }
    }
}
  \end{lstlisting}
  \end{minipage}

\end{center}

\subsubsection*{Return values, \lstinline{break} and \lstinline{continue}}

Contrary to the simplified explanation above, \lstinline{while} and \lstinline{for} loops return
the value of their last loop execution, or \lstinline{undefined} if there is no loop execution.
Evaluation of a \href{https://sourceacademy.org/sicpjs/4.1.2\#ex_4.7}{\lstinline{break}} statement within a loop terminates the loop with the return value
\lstinline{undefined} and evaluation of a \href{https://sourceacademy.org/sicpjs/4.1.2\#ex_4.7}{\lstinline{continue}} statement within a loop
terminates the current loop iteration and evaluates the test.


\section{Related work}
Pure neural models using convolutions, gating, differentiable memory, and/or attention architectures have attempted to learn arithmetic tasks through backpropagation \cite{NeuralGPU,GridLSTM,NTM,FreivaldsL17}.
Some of these results have close to perfect extrapolation. However, the models are constrained to only work with well-defined arithmetic setups with no input redundancy, single operation and one-hot representations of numbers for input and output.
We propose a model that has the flexibility to learn from hidden representations of a neural network where it has to work around redundancies and learn the underlying function.

The Neural Arithmetic Expression Calculator paper \cite{NAEC} propose learning real number arithmetic by having neural network subcomponents and repeatedly combines them through a memory-encoder-decoder architecture learned with hierarchical reinforcement learning.
While this model has the ability to dynamically handle a larger variety of expressions compared to our solution they require an explicit definition of the operations.

In our experiments, the NAU is used to do a subset-selection, which is then followed by either a summation or a multiplication.
An alternative, fully differentiable version, is to use a gumbel-softmax that can perform exact subset-selection \cite{DSS}.
However, this is restricted to a predefined subset size, which is a strong assumption that our units are not limited by.


\documentclass[a4paper]{article}
\usepackage[top=2cm, bottom=2cm, left=2.5cm, right=2.5cm]{geometry}

\usepackage[utf8]{inputenc}
\usepackage[english]{babel}
\usepackage{amsthm}
\usepackage{amsfonts}
\usepackage{amssymb}
\usepackage{hyperref}
\usepackage{biblatex}
\usepackage{listings}

\bibliography{notes}

\title{Bitcoin–Monero Cross-chain Atomic Swap Implementation notes\\
\normalsize v0.2 DRAFT}
\author{%
tecnovert\footnote{\texttt{tecnovert@tecnovert.net}}
}
\date{2020-09-10}

\begin{document}

\maketitle

\section{Introduction}
Notes on implementing the protocol described by h4sh3d in Bitcoin–Monero Cross-chain Atomic Swap\cite{h4sh3d:1}

\section{Discrete Logarithm Equality Across Groups}
A Discrete Logarithm Equality Across Groups (DLEAG) proof can prove a discrete logarithm is equal for two points on different curves.\\
We use the scheme from MRL-0010\cite{MRL:10}, slightly modified to use a borromean\cite{borromean} ring stack for a reduced proof size.
\\
The curves considered are secp256k1\cite{CerRes10} used by the Bitcoin\cite{nakamoto2008bitcoin} cryptocurrency and forks and ed25519\cite{ches-2011-24091} used by Monero\cite{van2013cryptonote}.\\
As the order of the generator point of the ed25519 curve $l$ is less than that of curve secp256k1 $o$ the shared secret must be less than $ l $.\\
To represent $l-1$ in base2, we must prove 252 bits.\\

\subsection{Definitions}
\begin{itemize}
    \item $G$   - The base point of curve secp256k1
    \item $\hat{G}$  - An alternate base point of curve secp256k1 in the same order as $G$, chosen as $G$ hashed to a point, proving it's discrete logarithm is unknown.
    \item $B$   - The base point of curve ed25519
    \item $\hat{B}$  - An alternate base point of curve ed25519 in the same order as $B$, chosen as $B$ hashed to a point, proving it's discrete logarithm is unknown.
    \item $l$   - Order of $B$ and $\hat{B}$
    \item $o$   - Order of $G$ and $\hat{G}$
    \item $n$   - Number of bits proved
    \item HashG() - A hash function which outputs an integer $\in \mathbb{Z}_{o}$
    \item HashB() - A hash function which outputs an integer $\in \mathbb{Z}_{l}$
\end{itemize}

\subsection{DLEAGProve($x$)}
\begin{enumerate}
    \item Split $x$ into an array of bits $b$ so $\displaystyle\sum_{i=0}^{n-1}b_{i} = x$
    \item For each $i \in [0, n-2]$ generate random blinding factors:\\
          $r_{i} \in \mathbb{Z}_{o}$ and $s_{i} \in \mathbb{Z}_{l}$
    \item Set the last blinding factors to:\\
          $r_{n-1} = (2^{n-1})^{-1} (-\displaystyle\sum_{i=0}^{n-2} r_{i}2^{i}) \in \mathbb{Z}_{o}$\\
          and\\
          $s_{n-1} = (2^{n-1})^{-1} (-\displaystyle\sum_{i=0}^{n-2} s_{i}2^{i})\in \mathbb{Z}_{l}$\\
          Causing each set of weighted blinding factors to sum to $0$\\
          $\sum_{i=0}^{n-1} r_{i}2^{i} == 0$ and $\sum_{i=0}^{n-1} s_{i}2^{i} == 0$
    \item For each $i \in [0, n-1]$ compute two commitments:
        $C^{G}_{i} = b_{i}G + r_{i}\hat{G} \in \mathbb{Z}_{o}$\\
        $C^{B}_{i} = b_{i}B + s_{i}\hat{B} \in \mathbb{Z}_{l}$\\
        so the weighted commitment sums equal $xG$ and $xB$\\
        $\sum_{i=0}^{n-1} C^{G}_{i}2^{i} = xG$\\
        $\sum_{i=0}^{n-1} C^{B}_{i}2^{i} = xB$
    \item Construct the ring stack, for each $i \in [0, n-1]$:
        \begin{enumerate}
            \item Choose random $j_{i} \in \mathbb{Z}_{o} $ and $ k_{i} \in \mathbb{Z}_{l}$
            \item Set $J_{i,b_{i}} = j_{i}\hat{G}$ and $K_{i,b_{i}} = j_{i}\hat{B}$
            \item For each $z \in [b_{i}+1, 2]$:
                \begin{enumerate}
                    \item $e_{G} = $HashG($C^{G}_{i}||C^{B}_{i}||J||K||i||z$)\\
                          $e_{B} = $HashB($C^{G}_{i}||C^{B}_{i}||J||K||i||z$)
                    \item Choose random $a^{G}_{i,z} \in \mathbb{Z}_{o} $ and $ a^{B}_{i,z} \in \mathbb{Z}_{l}$
                    \item $J_{i,z} = a^{G}_{i,z}\hat{G} - e_{G}(C^{G}_{i} - zG)$\\
                          $K_{i,z} = a^{B}_{i,z}\hat{B} - e_{B}(C^{B}_{i} - zB)$
                \end{enumerate}

        \end{enumerate}
    \item $e^{G}_{0} = HashG(J_{0,2}||...||J_{i-1,2})$ and\\
        $e^{B}_{0} = HashG(K_{0,2}||...||K_{i-1,2})$
    \item Sign the ring stack, For each $i \in [0, n-1]$:
        \begin{enumerate}
            \item $e_{G} = $HashG($C^{G}_{i}||C^{B}_{i}||e^{G}_{0}||e^{B}_{0}||i||0$)
            \item $e_{B} = $HashB($C^{G}_{i}||C^{B}_{i}||e^{G}_{0}||e^{B}_{0}||i||0$)
            \item For each $z \in [0, b_{i}]$:
                \begin{enumerate}
                    \item Choose random $a^{G}_{i,z} \in \mathbb{Z}_{o} $ and $ a^{B}_{i,z} \in \mathbb{Z}_{l}$
                    \item $J_{i,z} = a^{G}_{i,z}\hat{G} - e_{G}(C^{G}_{i} - zG)$\\
                          $K_{i,z} = a^{B}_{i,z}\hat{B} - e_{B}(C^{B}_{i} - zB)$
                    \item $e_{G} = $HashG($C^{G}_{i}||C^{B}_{i}||J||K||i||z+1$)\\
                          $e_{B} = $HashB($C^{G}_{i}||C^{B}_{i}||J||K||i||z+1$)
                \end{enumerate}
            \item Close the loop:\\
                $a^{G}_{i,b_{i}} = j_{i} + e_{G}r_{i}$\\
                $a^{B}_{i,b_{i}} = k_{i} + e_{B}s_{i}$
        \end{enumerate}
    \item Return the proof $(xG, xB, \{C^{G}_{i}\}, \{C^{B}_{i}\}, e^{G}_{0}, e^{B}_{0}, \{a^{G}_{0, i}\}, \{a^{G}_{1, i}\}, \{a^{B}_{0, i}\}, \{a^{B}_{1, i}\})$\\
        Proof length is $33+32+32+32+(33+32+(32)4)n == 129+193n$ bytes.
\end{enumerate}

\subsection{DLEAGVerify(proof)}
$(xG, xB, \{C^{G}_{i}\}, \{C^{B}_{i}\}, e^{G}_{0}, e^{B}_{0}, \{a^{G}_{0, i}\}, \{a^{G}_{1, i}\}, \{a^{B}_{0, i}\}, \{a^{B}_{1, i}\}) = $proof
\begin{enumerate}
    \item Verify the weighted commitment sums equal $xG$ and $xB$\\
        $\sum_{i=0}^{n-1} C^{G}_{i}2^{i} = xG$\\
        $\sum_{i=0}^{n-1} C^{B}_{i}2^{i} = xB$
    \item Verify the ring stack, for each $i \in [0, n-1]$:
        \begin{enumerate}
            \item $J_{i,z} = a^{G}_{i,z}\hat{G} - e_{G}(C^{G}_{i} - zG)$\\
                  $K_{i,z} = a^{B}_{i,z}\hat{B} - e_{B}(C^{B}_{i} - zB)$
            \item $e_{G} = $HashG($C^{G}_{i}||C^{B}_{i}||J||K||i||z+1$)\\
                  $e_{B} = $HashB($C^{G}_{i}||C^{B}_{i}||J||K||i||z+1$)
        \end{enumerate}
    \item $e^{'G}_{0} = HashG(J_{0,2}||...||J_{i-1,2})$ and\\
        $e^{'B}_{0} = HashG(K_{0,2}||...||K_{i-1,2})$
    \item return 1 if $e^{'G}_{0} == e^{G}_{0}$ and $e^{'B}_{0} == e^{B}_{0}$
\end{enumerate}

\section{Non-Interactive Zero Knowledge proof of Discrete Logarithm Equality}
The One-Time VES scheme requires a NIZK DLEQ from \cite{dleq-proof}\\
\\
Given two generator points and two points on the same curve a DLEQ proves the discrete logarithm of the two points is equal.

\subsection{DLEQProve}
Take points $B_{1}, B_{2}$ on the same curve and of the same group order and a scalar $x \in \mathbb{Z}_{o}$ where $o$ is the group order.\\
Hash is a function returning a number $\in \mathbb{Z}_{o}$\\
\begin{enumerate}
    \item Calculate $P_{1} = xB_{1}$ and $P_{2} = xB_{2}$
    \item Generate a random scalar $k \in \mathbb{Z}_{o}$
    \item Calculate $K_{1} = kB_{1}$ and $K2 = kB_{2}$
    \item Set $c = Hash(P_{1} || P_{2} || K_{1} || K2)$
    \item Set $r = k - cx$
    \item The proof is the tuple $(K_{1}, K_{2}, r)$
\end{enumerate}

\subsection{DLEQVerify}
Take points $P_{1}, P_{2}$ and the proof tuple $(K_{1}, K_{2}, r)$ as inputs.
\begin{enumerate}
    \item Set $c = Hash(P_{1} || P_{2} || K_{1} || K_{2}) $
    \item Calculate $R_{1} = rB_{1}$ and $R_{2} = rB_{2}$
    \item Calculate $C_{1} = cP_{1}$ and $C_{2} = cP_{2}$
    \item Output 1 if $K_{1} == R_{1} + C_{1}$ and $K2 == R_{2} + C_{2}$ else 0
\end{enumerate}

\section{One-Time Verifiably Encrypted Signatures}
Also known as Adaptor Signatures.\\
A One-Time VES is a signature made invalid by mixing it with the public key of an encrypting key pair, a valid signature can be decrypted with knowledge of the private encrypting key and the private encrypting key can be recovered with knowledge of both the encrypted and plaintext signatures.
We use a VES constructed to function with ECDSA signatures as described by Fournier et al. in \cite{oneTimeVES}\\

\subsection{EncSign($p_{S}, P_{E}, m$)}
On input of a secret signing key $p_{S}$, a public encryption key $P_{E}$ , and a message $m$, output a ciphertext $\hat{\sigma}$ which is an encrypted signature of $m$ by $p_{S}$.
\begin{enumerate}
    \item Generate a random scalar $r \in \mathbb{Z}_{o}$
    \item Calculate $R_{1} = rG$ and $ R_{2} = rP_{E}$
    \item $\pi = $ DLEQProve($G$, $P_{E}$, $r$)
    \item Set $R_{2x}$ to the $x$ coord of $R_{2} \bmod o$
    \item Calculate $\hat{s} = r^{-1}(Hash(m) + R_{2x}p_{S})$
    \item Return the tuple $(R_{1}, R_{2}, \hat{s}, \pi)$ as $\hat{\sigma}$
\end{enumerate}

\subsection{EncVrfy($P_{S}, P_{E},  m, \hat{\sigma}$)}
On input of a public signing key $P_{S}$, a public encryption key $P_{E}$ , a message $m$ and a ciphertext $\hat{\sigma}$ output
1 if $\hat{\sigma}$ is a valid encryption of a signature on $m$ for $P_{S}$ under $P_{E}$.
\begin{enumerate}
    \item Set $(R_{1}, R_{2}, \hat{s}, \pi) = \hat{\sigma}$
    \item Fail if DLEQVerify($R_{1}, R_{2}, \pi$) != 1
    \item Set $R_{2x} $ to the $x$ coord of $R_{2} \bmod o$
    \item Output 1 if $R_{1} = (Hash(m)G * R_{2x}P_{S})\hat{s}^{-1}$ else 0
\end{enumerate}

\subsection{DecSig($p_{E}, \hat{\sigma}$)}
Decrypt the signature with the private encryption key $p_{E}$.
\begin{enumerate}
    \item Set $(R_{1}, R_{2}, \hat{s}, \pi) = \hat{\sigma}$
    \item Calculate $s = \hat{s}p_{E}^{-1}$
    \item Set $R_{2x}$ to the $x$ coord of $R_{2} \bmod o$
    \item Return the tuple ($R_{2x}, s$) as $\sigma$
\end{enumerate}

\subsection{RecEncKey($P_{E}, \hat{\sigma}$, $\sigma$)}
Recover the private encryption key $p_{e}$ from the plaintext and encrypted signatures.
\begin{enumerate}
    \item Set $(R_{1}, R_{2}, \hat{s}, \pi) = \hat{\sigma}$
    \item Set $(R_{2x}, s) = \sigma$
    \item $p = s^{-1}\hat{s}$
    \item Return p if $pG == P_{E}$ else $-p$
\end{enumerate}

\section{Atomic Swap Protocol}

\subsection{Basic Idea}
Two parties want to exchange coins between blockchains in a such a way
that neither can be cheated.\\
\\
The swap leader exchanges coin from the script-enabled blockchain and sends the first transaction.\\
The leader wants to exchange an amount of coinA for an amount of coinB.\\
The follower wants to exchange an amount of coinB for an amount of coinA.\\

\begin{enumerate}
    \item Leader and follower exchange details necessary for the swap.
    \item Once they agree on the details the leader publishes a lock transaction
which locks up the amount of coinA being exchanged by sending it to an
output that can only be spent if both sides cooperate until the time
agreed for the exchange expires when the leader can reclaim it.
    \item The follower waits for the coinA lock transaction to be confirmed in
it's blockchain.  If he's satisfied the transaction was formed correctly
he publishes a transaction locking up the amount of coinB being
exchanged.  The coinB lock tx can only be spent with knowledge of a
private key from both the leader and follower.
    \item The leader waits for the coinB lock transaction to be confirmed in
it's blockchain. If he's satisfied the transaction was formed correctly
he reveals information to the follower which allows him to spend from
the coinA lock transaction.
    \item By spending from the coinA lock transaction the follower reveals
information to the leader allowing him to spend from the coinB lock
transaction.
    \item The leader spends from the coinB lock transaction and the exchange is
completed successfully.
\end{enumerate}

\noindent Leader:\\
 - Loses: coinA locked value, 1x coinA tx fees and 1x coinB tx fees.\\
 - Gains: coinB locked value.\\
Follower:\\
 - Loses: coinB locked value, 1x coinB tx fees and 1x coinA tx fees.\\
 - Gains: coinA locked value.\\
\\

\subsection{Details}

Step 2:\\
In addition to the coinA lock tx the parties craft a transaction
spending from the coinA lock tx refund path and spendable either by
both parties cooperating or by the follower after a second locktime has
expired.  Before the leader publishes the coinA lock tx he will know the
information to spend the coinA refund tx immediately after it's published
however spending from the coinA refund tx cooperative path reveals
information to the follower allowing him to from the coinB lock
transaction.\\
The refund path could be built into the coinA lock tx, but would
increase the size of the coinA lock tx significantly and should seldom
be required.\\
\\
Step 3:\\
The coinB lock tx outputs to a key which is the sum of a key from the
leader and a key from the follower.\\
The One-Time Verifiably Encrypted Signatures are crafted with this key
as the encryption key, and the information distributed so the
follower reveals his key to the leader by spending from the coinA lock
tx and the leader reveals his key to the follower by spending from the
coinA lock refund tx.\\
\\
\\

If something goes wrong and the leader or follower stop responding:\\
\\
After step 2, before step 3:\\
If the follower drops out:\\
The leader can retrieve his coin from the coinA lock tx by waiting for
the exchange time to expire and publishing the coinA refund tx.  Then
spending from the coinA refund tx cooperative path.  The follower has
not yet locked any coinB.\\
Leader loses 2x coinA tx fees, follower loses nothing.\\
\\
If the leader drops out:\\
The follower can wait for the first locktime to expire, then publish the
coinA refund tx.  Once the coinA refund tx locktime expires the follower
can spend from it with only his signature, thus claiming the amount of
coinA while still retaining the coinB.\\
Leader:\\
 - Loses: 1x coinA fees and locked coinA value.\\
Follower:\\
 - Loses: 1x coinA fees, 1x coinB fees.\\
 - Gains: Locked coinA value\\
\\
\\
After step 3:\\
If the follower drops out:\\
As at step 2, by spending from the coinA refund tx cooperative path the
leader reveals information allowing the follower to spend from the coinB
lock tx.\\
Leader:\\
 - Loses: 2x coinA tx fees.\\
Follower:\\
 - Loses: 2x coinB tx fees.\\
\\
If the leader drops out:\\
As at step 2 except the follower has published the coinB lock tx.\\
Neither party can spend the coinB lock tx without assistance from the
other.\\
Leader:\\
 - Loses: 1x coinA fees and locked coinA value.\\
Follower:\\
 - Loses: 1x coinA fees, 1x coinB fees and locked coinB value.\\
 - Gains: locked coinA value.\\

\subsubsection{Transaction scripts}

\begin{lstlisting}[language=C++, caption={\noindent Lock tx output script}]
OP_IF
    OP_SHA256 {secret_hash} OP_EQUALVERIFY
    OP_2 {pk_leader} {pk_follower} OP_2 OP_CHECKMULTISIG
OP_ELSE
    {lock_for_1} OP_CHECKSEQUENCEVERIFY OP_DROP
    OP_2 {pk_leader_refund} {pk_follower_refund} OP_2 OP_CHECKMULTISIG
OP_ENDIF
\end{lstlisting}

\begin{lstlisting}[language=C++, caption={\noindent Lock refund tx output script}]
OP_IF
    OP_2 {pk_leader_refund} {pk_follower_refund} OP_2 OP_CHECKMULTISIG
OP_ELSE
    {lock_for_2} OP_CHECKSEQUENCEVERIFY OP_DROP
    {pk_follower} OP_CHECKSIG
OP_ENDIF
\end{lstlisting}

\subsubsection{Checking the secret length}
Checking the secret length as required in Decred style atomic swaps
\cite{advisory1} is not strictly necessary as the secret value and hash
will only be used on one blockchain, it may help to prevent unexpectedly
large secret values from being used to throw off the transaction fee.

\section{Future Enhancements}
\begin{itemize}
    \item coinA lock and refund scripts can be joined into one more efficiently on
          chains where the taproot bip-0341\cite{bip-0341} improvement is active.
    \item DLEAG proof could prove multiple bits per ring layer, reducing the proof size.
    \item Improve encoding of VES data to reduce size.
\end{itemize}

\clearpage

\printbibliography

\end{document}


In this section, we assess the proposed framework. All the experiments are
conducted on a \up{GNU}/Linux machine equipped with 16 Intel Xeon E5520
2.27~\up{GH}z processors and 24~\up{GB} of \up{RAM}. All the source code,
configuration files, and input data used in the experiments are available online
at \cite{eslab2017a}.

We consider three platform sizes \np, two application sizes \nt, and three
quantities of interest \g. Specifically, \np is 2, 4, or 8; \nt is 10 or 20; and
\g is the end-to-end delay, total energy consumption, or maximum temperature.
The three quantities of interest are defined in \eref{frame-delay},
\eref{frame-energy}, and \eref{frame-temperature}, respectively. Therefore, we
address 18 problems in total, which correspond to different combinations of \np,
\nt, and \g. At this point, it might be helpful to recall the illustrative
application depicted in \fref{frame-application}.

Each problem is configured as follows. A platform with \np processing elements
and an application with \nt tasks are randomly generated by \up{TGFF}
\cite{dick1998}. The tool generates a table for each processing element that
specifies certain properties of the tasks when they are mapped to that
processing element. Namely, each table assigns two numbers to each task: a
reference execution time and a power consumption value, which are chosen
uniformly between 10 and 50~ms and between 5 and 25~W, respectively. The
application is scheduled using a list scheduler \cite{adam1974}. The mapping of
the application is fixed and obtained by scheduling the tasks based on their
reference execution times and assigning them to the earliest available
processing elements (a shared ready list).

Similarly to the previous chapters, the construction of thermal \up{RC}
circuits, which are required for temperature analysis, is delegated to HotSpot
\cite{skadron2003}. The floorplan of each platform is a regular grid where each
processing element occupies 4~\power{mm}{2}. The modeling of the static
component of power consumption is based on a linear fit to a set of \up{SPICE}
simulations of a series of \up{CMOS} invertors. The sampling interval \dt of
power and temperature profiles is 1~ms.

The uncertain parameters \vu are the execution times of the tasks, and their
marginal distributions and correlation matrix are as described in
\sref{frame-application-problem}; all other parameters are deterministic.
Regarding the marginal distributions, which are beta distributions as shown in
\eref{beta-distribution}, the left $c$ and right $d$ endpoints of their supports
are set to 80\% and 120\%, respectively, of the reference execution times
generated by \up{TGFF} as described earlier. The parameters $a$ and $b$ are set
to two and five, respectively, for all tasks, which skews the distributions
toward the left endpoints. The model-order-reduction parameter $\eta$ in
\eref{model-order-reduction} is set to 0.9, which results in $\nz = 2$ and $\nz
= 3$ independent variables for applications with $\nt = 10$ and $\nt = 20$
tasks, respectively.

The configuration of the interpolation algorithm---including the collocation
nodes, basis functions, and adaptation strategy with stopping
conditions---closely follows the description given in \sref{frame-construction}.
The parameters \error{a}, \error{r}, and \error{s} are set to around
\power{10}{3}, \power{10}{2}, and \power{10}{4}, respectively, depending on the
problem.

The performance of our framework with respect to each problem is assessed as
follows. First, as in \cref{uncertainty-process-development}, the true
probability distribution of \g is estimated by sampling \g directly and
extensively. Direct sampling means that there is no intermediate representation
or model order reduction involved. Second, we construct an interpolant of \g and
estimate the distribution of \g by sampling this interpolant, which is discussed
in \sref{frame-construction} and \sref{frame-processing}. In both cases, we draw
\power{10}{5} samples; recall, however, that, unlike the cost of direct
sampling, the cost of sampling the interpolant is negligible. Third, we perform
another round of direct sampling. This time, the number of samples taken is
equal to the number of times \g is invoked during the interpolation process.

In each of the aforementioned three cases, sampling is performed in accordance
with a Sobol sequence, which is a low-discrepancy sequence featuring better
convergence properties than those of classical \ac{MC} sampling \cite{joe2008}.
As a result, we obtain three estimates of the probability distribution of the
quantity of interest: reference (the one considered to be exact), proposed (the
one based on our interpolation), and direct (the one equal in terms of the
number of evaluations of \g to the proposed solution). The last two are compared
with the first one. For computing the proximity between two distributions, we
use the well-known \ac{KS} statistic \cite{rao2002}, which is the supremum over
the distance (pointwise) between two empirical distribution functions and is
consequently a stringent error indicator.

\subsection{Approximation Accuracy}

\inputfigure{frame-accuracy-delay}
\inputfigure{frame-accuracy-energy}
\inputfigure{frame-accuracy-temperature}
The results are given in \fref{frame-accuracy-delay},
\fref{frame-accuracy-energy}, and \fref{frame-accuracy-temperature}, which
correspond to the end-to-end delay, total energy, and maximum temperature,
respectively. Each figure contains six plots arranged in a three-by-two grid.
The three rows of the grid correspond to the three platform sizes, and the two
columns to the two application sizes. The horizontal axis of each plot shows the
number of evaluations of the quantity of interest \g, and the vertical one shows
the \ac{KS} statistic on a logarithmic scale. Each plot has two lines. The blue
line represents our technique. The circles on this line correspond to the steps
of the interpolation process shown in \eref{frame-interpolant}. They illustrate
how the \ac{KS} statistic computed with respect to the reference solution
changes as the interpolation process adds nodes to the interpolant until a
stopping condition is satisfied. Note that, in order to make the figure legible,
only a subset of the actual steps is displayed. Synchronously with the blue
line, that is, for the same numbers of evaluations of \g, the orange line shows
the error of direct sampling, which is also calculated with respect to the
reference solution.

We begin by describing one particular problem chosen among those shown in the
three figures. Consider, for instance, the one labeled with $\bigstar$ in
\fref{frame-accuracy-energy}. It can be seen that, at the very beginning, when
the number of evaluations is very small, both the proposed solution and direct
sampling perform poorly. The \ac{KS} statistic indicates that there is a
substantial mismatch between each of these two solutions and the reference one.
However, as the hierarchical interpolant is being adaptively refined, our
solution rapidly approaches the reference one and, by the end of the
interpolation process, leaves the solution produced by direct sampling
approximately an order of magnitude behind.

Studying \fref{frame-accuracy-delay}, \fref{frame-accuracy-energy}, and
\fref{frame-accuracy-temperature}, one can make a number of observations. Our
interpolation-based approach (the blue lines) to probabilistic analysis
outperforms direct sampling (the orange lines) in all the cases. This means
that, given a fixed budget of computation time, the probability distributions
delivered by our framework are closer to the true ones than those delivered by
sampling \g directly, despite the fact that the latter relies on Sobol
sequences, which are a sophisticated sampling strategy. Since sampling methods
try to cover the probability space impartially, the figures are a salient
illustration of the difference between being adaptive and nonadaptive.

It can also be seen in the figures that, as the number of evaluations increases,
the solutions computed by our technique approach the true ones. The error of the
framework generally decreases more steeply than the error of direct sampling.
The decrease, however, tends to plateau toward the end of the interpolation
process (terminated by a stopping condition). The observed behavior has two
potential explanations. First, the algorithm is instructed to satisfy certain
accuracy requirements (given by \error{a}, \error{r}, and \error{s}), and it
reasonably does not do more than what is requested. Second, since model order
reduction is performed in the case of interpolation, the quantity being
interpolated is not \g strictly speaking; it is a low-dimensional representation
of \g, which already implies some information loss. Consequently, there is a
certain limit on the accuracy that can be achieved, which depends on the amount
of reduction.

The message of the above observations is that the designer of an electronic
system can benefit substantially in terms of accuracy per computation time by
switching from direct sampling to the proposed technique. If the designer's
current workhorse is classical \up{MC} sampling, the switch might lead to even
more dramatic savings than those shown in the figures. It is worth mentioning
that the gain is especially prominent in situations where the analysis needs to
be performed many times, such as for the purpose of design-space exploration.

\begin{remark}
The wall-clock time taken by the experiments is not reported here, as this time
is irrelevant: since the evaluation of \g is time consuming (see
\sref{frame-problem}), the number of these evaluations is the most apposite
expense indicator. For the curious reader, however, let us give an example by
considering the problem labeled with $\clubsuit$ in
\fref{frame-accuracy-temperature}. Obtaining a reference solution with
\power{10}{5} samples in parallel on 16 cores takes around two hours.
Constructing an interpolant with 383 collocation nodes takes around 30 seconds
(this is also the time of direct sampling with 383 samples). Sampling the
interpolant \power{10}{5} times takes less than a second. The relative
computation cost of sampling an interpolant readily diminishes as the complexity
of \g increases; contrast it with direct sampling, whose cost grows
proportionally to the evaluation time of \g.
\end{remark}

\subsection{Real-Life Deployment}

Last but not least, we investigate the viability of deploying the proposed
framework in a real environment. This means that we should couple the framework
with a battle-proven simulator, used in both academia and industry, and let this
simulator evaluate a real application running on a real platform.

The scenario that we consider is similar to the one depicted in
\fref{frame-application}. The difference is that an industry-standard simulator
is put in place of the ``black box'' on the left-hand side of the figure, and
that the quantity of interest \g is now the total energy. Unlike the synthetic
examples discussed earlier, there is no true solution against which to compare
due to the prohibitive expense of running the simulator, which is exactly why
our framework is needed.

The chosen simulator is the well-known and widely used combination of Sniper
\cite{carlson2011} and \up{McPAT} \cite{li2009}. The architecture that we
simulate is Intel's Nehalem-based Gainestown series. Sniper is distributed with
a configuration for this architecture, and we utilize this configuration without
any changes. The simulated platform is set up to have three \up{CPU}s sharing
one L3 cache. Regarding the application chosen for this example, it is
\up{VIPS}, which is a piece of image-processing software taken from the
\up{PARSEC} benchmark suite \cite{bienia2011}. In this scenario, \up{VIPS}
applies a fixed set of operations to a given image. The width and height of the
image to process are considered as the uncertain parameters \vu, and they are
assumed to be uniformly distributed within certain ranges.

The deployment of the real-life example has fulfilled our expectations. The
interpolation process has successfully finished and delivered an interpolant
after 78 invocations of the simulator. Each such invocation takes 40 minutes on
average. The probability distribution of the total energy consumption has been
estimated by sampling the constructed surrogate \power{10}{5} times. This number
of samples would take around six months to obtain on our machine if we sampled
the simulator directly in parallel on 16 cores; using the technique presented in
this chapter, the whole procedure has taken approximately nine hours.


\section{Three Point Perspective Drawing Library}

\noindent\emph{by Max Snippe}

\begin{tikzlibrary}{perspective}
  This library provides tools for perspective drawing with one, two, or three
  vanishing points.
\end{tikzlibrary}

\subsection{Coordinate Systems}

\begin{coordinatesystem}{three point perspective}
  The |three point perspective| coordinate system is very similar to the |xyz|
  coordinate system, save that it will display the provided coordinates with a
  perspective projection.
  %
  \begin{key}{/tikz/cs/x=\meta{number} (initially 0)}
    The $x$ component of the coordinate. Should be given \emph{without} unit.
  \end{key}
  %
  \begin{key}{/tikz/cs/y=\meta{number} (initially 0)}
    Same as |x|.
  \end{key}
  %
  \begin{key}{/tikz/cs/z=\meta{number} (initially 0)}
    Same as |x|.
  \end{key}
\end{coordinatesystem}

\begin{coordinatesystem}{tpp}
  The |tpp| coordinate system is an alias for the |three point perspective|
  coordinate system.
\end{coordinatesystem}

\subsection{Setting the view}

\begin{key}{/tikz/3d view=\marg{azimuth}\marg{elevation}
    (default \{-30\}\{15\})}
  With the |3d view| option, the projection of the 3D coordinates on the 2D page
  is defined. It is determined by rotating the coordinate system by
  $-\meta{azimuth}$ around the $z$-axis, and by \meta{elevation} around the
  (new) $x$-axis, as shown below.

  \begin{tikzpicture}[
    viewpoint/.pic={
      \draw (22.5:0.45) -- (0,0) -- (-22.5:0.45);
      \draw (0,0) ++ (22.5:0.35) arc (22.5:-22.5:0.35);
      \draw (0.225,0) circle (0.02 and 0.09);
    }]
    \begin{scope}[3d view={-20}{20}]
      \draw[->] (-3,0,0) -- (3,0,0) node[pos=1.05]{x};
      \draw[->] (0,-3,0) -- (0,3,0) node[pos=1.05]{y};
      \draw[->] (0,0,-1) -- (0,0,3) node[pos=1.05]{z};

      \pgfmathsetmacro\az{50}
      \begin{scope}[canvas is xy plane at z=0]
        \draw[->] (0,0) ++(0,-2) arc (-90:-90+\az:2) coordinate[pos=0.5](az);
        \draw (az) -- ++(-90+\az/2:1) node[below]{\meta{azimuth}};
        \draw[dashed] (0,0) -- ++(-90+\az:3);
      \end{scope}
      \begin{scope}[rotate around z=\az]
        \pgfmathsetmacro\el{50}
        \begin{scope}[canvas is yz plane at x=0]
          \draw[->] (0,0) ++(-2.5,0) arc (180:180-\el:2.5)
            coordinate[pos=0.5](el);
          \draw (el) -- ++(180-\el/2:1) node[above]{\meta{elevation}};
          \draw[dashed] (0,0) --
            pic[solid,sloped,transform shape,pos=1.2]{viewpoint} ++(180-\el:3);
        \end{scope}
      \end{scope}
    \end{scope}
  \end{tikzpicture}

  For example, when both \meta{azimuth} and \meta{elevation} are 0$^\circ$,
  $+z$ will be pointing upward, and $+x$ will be pointing right. The default is
  as shown below.
  %
\begin{codeexample}[preamble={\usetikzlibrary{perspective}}]
\begin{tikzpicture}[3d view]
  \draw[->] (-1,0,0) -- (1,0,0) node[pos=1.1]{x};
  \draw[->] (0,-1,0) -- (0,1,0) node[pos=1.1]{y};
  \draw[->] (0,0,-1) -- (0,0,1) node[pos=1.1]{z};
\end{tikzpicture}
\end{codeexample}
\end{key}

\begin{stylekey}{/tikz/isometric view}
  A special kind of |3d view| is isometric, which can be set with the
  |isometric view| style. It simply sets |3d view={-45}{35.26}|. The value for
  \meta{elevation} is determined with $\arctan(1/\sqrt{2})$. In isometric
  projection the angle between any pair of axes is 120$^\circ$, as shown below.
  %
\begin{codeexample}[preamble={\usetikzlibrary{perspective}}]
\begin{tikzpicture}[isometric view]
  \draw[->] (-1,0,0) -- (1,0,0) node[pos=1.1]{x};
  \draw[->] (0,-1,0) -- (0,1,0) node[pos=1.1]{y};
  \draw[->] (0,0,-1) -- (0,0,1) node[pos=1.1]{z};
\end{tikzpicture}
\end{codeexample}
\end{stylekey}

\subsection{Defining the perspective}

In this section, the following example cuboid will be used with various
scaling. As a reference, the axes will be shown too, without perspective
projection.
%
\begin{codeexample}[preamble={\usetikzlibrary{perspective}}]
\newcommand\simplecuboid[3]{%
  \fill[gray!80!white] (tpp cs:x=0,y=0,z=#3)
    -- (tpp cs:x=0,y=#2,z=#3)
    -- (tpp cs:x=#1,y=#2,z=#3)
    -- (tpp cs:x=#1,y=0,z=#3) -- cycle;
  \fill[gray]  (tpp cs:x=0,y=0,z=0)
    -- (tpp cs:x=0,y=0,z=#3)
    -- (tpp cs:x=0,y=#2,z=#3)
    -- (tpp cs:x=0,y=#2,z=0) -- cycle;
  \fill[gray!50!white] (tpp cs:x=0,y=0,z=0)
    -- (tpp cs:x=0,y=0,z=#3)
    -- (tpp cs:x=#1,y=0,z=#3)
    -- (tpp cs:x=#1,y=0,z=0) -- cycle;}
\newcommand{\simpleaxes}[3]{%
  \draw[->] (-0.5,0,0) -- (#1,0,0) node[pos=1.1]{x};
  \draw[->] (0,-0.5,0) -- (0,#2,0) node[pos=1.1]{y};
  \draw[->] (0,0,-0.5) -- (0,0,#3) node[pos=1.1]{z};}

\begin{tikzpicture}[3d view]
  \simplecuboid{2}{2}{2}
  \simpleaxes{2}{2}{2}
\end{tikzpicture}
\end{codeexample}

\begin{codeexample}[setup code,hidden]
\newcommand\simplecuboid[3]{%
  \fill[gray!80!white] (tpp cs:x=0,y=0,z=#3)
    -- (tpp cs:x=0,y=#2,z=#3)
    -- (tpp cs:x=#1,y=#2,z=#3)
    -- (tpp cs:x=#1,y=0,z=#3) -- cycle;
  \fill[gray]  (tpp cs:x=0,y=0,z=0)
    -- (tpp cs:x=0,y=0,z=#3)
    -- (tpp cs:x=0,y=#2,z=#3)
    -- (tpp cs:x=0,y=#2,z=0) -- cycle;
  \fill[gray!50!white] (tpp cs:x=0,y=0,z=0)
    -- (tpp cs:x=0,y=0,z=#3)
    -- (tpp cs:x=#1,y=0,z=#3)
    -- (tpp cs:x=#1,y=0,z=0) -- cycle;}

\newcommand{\simpleaxes}[3]{%
  \draw[->] (-0.5,0,0) -- (#1,0,0) node[pos=1.1]{x};
  \draw[->] (0,-0.5,0) -- (0,#2,0) node[pos=1.1]{y};
  \draw[->] (0,0,-0.5) -- (0,0,#3) node[pos=1.1]{z};}
\end{codeexample}

\begin{key}{/tikz/perspective=\meta{vanishing points}
    (default p=\{(10,0,0)\},q=\{(0,10,0)\},r=\{(0,0,20)\})}
  The `strength' of the perspective can be determined by setting the location of
  the vanishing points. The default values have a stronger perspective towards
  $x$ and $y$ than towards $z$, as shown below.
  %
\begin{codeexample}[preamble={\usetikzlibrary{perspective}}]
\begin{tikzpicture}[3d view,perspective]
  \simplecuboid{2}{2}{2}
  \simpleaxes{2}{2}{2}
\end{tikzpicture}
\end{codeexample}
%
  From this example it also shows that the maximum dimensions of the cuboid are
  no longer 2 by 2 by 2. This is inherent to the perspective projection.
  %
  \begin{key}{/tikz/perspective/p=\marg{x,y,z} (initially (0,0,0))}
    The location of the vanishing point that determines the `strength' of the
    perspective in $x$-direction can be set with the |p| key.
    %
\begin{codeexample}[preamble={\usetikzlibrary{perspective}}]
\begin{tikzpicture}[
  3d view,
  perspective={
    p = {(5,0,0)}}]
  \simplecuboid{2}{2}{2}
  \simpleaxes{2}{2}{2}
\end{tikzpicture}
\end{codeexample}
    %
    Note also that when only |p| is provided, the perspective in $y$ and $z$
    direction is turned off.

    To turn off the perspective in $x$-direction, one must set the $x$ component
    of |p| to \texttt{0} (e.g.\ |p={(0,a,b)}|, where \texttt{a} and \texttt{b}
    can be any number and will be ignored). Or one can provide |q| and |r| and
    omit |p|.

    By changing the $y$ and $z$ components of |p|, one can achieve various
    effects.
    %
\begin{codeexample}[preamble={\usetikzlibrary{perspective}}]
\begin{tikzpicture}[
  3d view,
  perspective={
    p = {(5,0,1)}}]
  \simplecuboid{2}{2}{2}
  \simpleaxes{2}{2}{2}
\end{tikzpicture}
\end{codeexample}
    %
\begin{codeexample}[preamble={\usetikzlibrary{perspective}}]
\begin{tikzpicture}[
  3d view,
  perspective={
    p = {(5,1,0)}}]
  \simplecuboid{2}{2}{2}
  \simpleaxes{2}{2}{2}
\end{tikzpicture}
\end{codeexample}
    %
\begin{codeexample}[preamble={\usetikzlibrary{perspective}}]
\begin{tikzpicture}[
  3d view,
  perspective={
    p = {(5,1,1)}}]
  \simplecuboid{2}{2}{2}
  \simpleaxes{2}{2}{2}
\end{tikzpicture}
\end{codeexample}
    %
  \end{key}
  %
  \begin{key}{/tikz/perspective/q=\marg{x,y,z} (initially (0,0,0))}
    Similar to |p|, but can be turned off by setting its $y$ component to
    \texttt{0}.
    %
\begin{codeexample}[preamble={\usetikzlibrary{perspective}}]
\begin{tikzpicture}[
  3d view,
  perspective={
    q = {(0,5,0)}}]
  \simplecuboid{2}{2}{2}
  \simpleaxes{2}{2}{2}
\end{tikzpicture}
\end{codeexample}
    %
  \end{key}
  %
  \begin{key}{/tikz/perspective/r=\marg{x,y,z} (initially (0,0,0))}
    Similar to |p|, but can be turned off by setting its $z$ component to
    \texttt{0}.
    %
\begin{codeexample}[preamble={\usetikzlibrary{perspective}}]
\begin{tikzpicture}[
  3d view,
  perspective={
    r = {(0,0,5)}}]
  \simplecuboid{2}{2}{2}
  \simpleaxes{2}{2}{2}
\end{tikzpicture}
\end{codeexample}
    %
  \end{key}
\end{key}

\subsection{Shortcomings}

Currently a number of things are not working, mostly due to the fact that PGF
uses a 2D coordinate system underwater, and perspective projection is a
non-linear affine transformation which needs to be aware of all three
coordinates. These three coordinates are currently lost when processing a 3D
coordinate.
The issues include, but possibly are not limited to:
%
\begin{itemize}
    \item Keys like |shift|, |xshift|, |yshift| are not working
    \item Keys like |rotate around x|, |rotate around y|, and |rotate around z|
      are not working
    \item Units are not working
    \item Most keys from the |3d| library are unsupported, e.g.\ all the
      |canvas is .. plane| keys.
\end{itemize}

\subsection{Examples}

An |r| that lies `below' your drawing can mimic a macro effect.
%
\nopagebreak
\begin{codeexample}[preamble={\usetikzlibrary{perspective}}]
\begin{tikzpicture}[
  isometric view,
  perspective={
    p = {(8,0,0)},
    q = {(0,8,0)},
    r = {(0,0,-8)}}]

  \simplecuboid{2}{2}{2}]

\end{tikzpicture}
\end{codeexample}

A peculiar phenomenon inherent to perspective drawing, is that however great
your coordinate will become in the direction of the vanishing point, it will
never reach it.
%
\nopagebreak
\begin{codeexample}[preamble={\usetikzlibrary{perspective}}]
\begin{tikzpicture}[
  isometric view,
  perspective={
    p = {(4,0,0)},
    q = {(0,4,0)}}]

    \node[fill=red,circle,inner sep=1.5pt,label=above:p] at (4,0,0){};

    \foreach \i in {0,...,100}{
      \filldraw[fill = gray] (tpp cs:x=\i,y=0,z=0)
        -- (tpp cs:x=\i+0.5,y=0,z=0)
        -- (tpp cs:x=\i+0.5,y=2,z=0)
        -- (tpp cs:x=\i,y=2,z=0)
        -- cycle;}
\end{tikzpicture}
\end{codeexample}

Even for simple examples, the added perspective might add another `dimension' to
your drawing. In this case, two vanishing points give a more intuitive result
then three would.
%
\nopagebreak
\begin{codeexample}[preamble={\usetikzlibrary{perspective}}]
\begin{tikzpicture}[
  scale=0.7,
  3d view,
  perspective={
    p = {(20,0,0)},
    q = {(0,20,0)}}]

  \filldraw[fill=brown] (tpp cs:x=0,y=0,z=0)
    -- (tpp cs:x=0,y=4,z=0)
    -- (tpp cs:x=0,y=4,z=2)
    -- (tpp cs:x=0,y=2,z=4)
    -- (tpp cs:x=0,y=0,z=2) -- cycle;
  \filldraw[fill=red!70!black] (tpp cs:x=0,y=0,z=2)
    -- (tpp cs:x=5,y=0,z=2)
    -- (tpp cs:x=5,y=2,z=4)
    -- (tpp cs:x=0,y=2,z=4) -- cycle;
  \filldraw[fill=brown!80!white] (tpp cs:x=0,y=0,z=0)
    -- (tpp cs:x=0,y=0,z=2)
    -- (tpp cs:x=5,y=0,z=2)
    -- (tpp cs:x=5,y=0,z=0) -- cycle;
\end{tikzpicture}
\end{codeexample}

With the vanishing points nearby, the distortion of parallel lines becomes very
strong. This might lead to \texttt{Dimension too large} errors.
%
\nopagebreak
\begin{codeexample}[preamble={\usetikzlibrary{perspective}}]
\begin{tikzpicture}[
  3d view,
  perspective={
    p = {(2,0,0)},
    q = {(0,2,0)},
    r = {(0,0,2)}},
  scale=4,
  vanishing point/.style={fill,circle,inner sep=2pt}]

  \simplecuboid{3}{1}{2}

  \node[vanishing point,label = right:p] (p) at (2,0,0){};
  \node[vanishing point,label = left:q] (q) at (0,2,0){};
  \node[vanishing point,label = above:r] (r) at (0,0,2){};

  \begin{scope}[dotted]
    \foreach \y in {0,1}{
      \foreach \z in {0,2}{
        \draw (tpp cs:x=0,y=\y,z=\z) -- (p.center);}}
    \foreach \x in {0,3}{
      \foreach \z in {0,2}{
        \draw (tpp cs:x=\x,y=0,z=\z) -- (q.center);}}
    \foreach \x in {0,3}{
      \foreach \y in {0,1}{
        \draw (tpp cs:x=\x,y=\y,z=0) -- (r.center);}}
  \end{scope}
\end{tikzpicture}
\end{codeexample}

% A more complex example.
\iffalse
Of course these examples can become as complex as desired, but as with any 3D
drawing using \tikzname, the order of drawing commands is important and can
become increasingly more complex.
%
\nopagebreak
\begin{codeexample}[preamble={\usetikzlibrary{perspective}}]
\begin{tikzpicture}[
  cycle of vertices/.style 2 args={
    insert path={
      foreach \i [count=\j,evaluate=\j as \k using
        {ifthenelse(\j==1,"","-- "}] in {#2}{\k (vert-#1-\i)} -- cycle}},
  scale=0.7,
  line join=round,
  bottom/.style={draw=white!50!black,fill=white!40!black},
  front/.style={draw=white!50!black,fill=black},
  side/.style={draw=white!50!black,fill=white!80!black},
]
  \begin{scope}[
    3d view={-20}{0},
    perspective={
      p = {(20,0,0)},
      q = {(0,20,0)},
      r = {(5,1,50)},
    }]
    \path foreach \x/\y/\z [count=\i] in {
      3.5/2.0/0.0,3.5/2.0/4.0,6.0/2.0/4.0,6.5/2.0/3.5,6.5/2.0/0.5,6.0/2.0/0.0,
      4.5/2.0/1.0,4.5/2.0/3.0,5.5/2.0/3.0,5.5/2.0/1.0,3.5/0.0/0.0,3.5/0.0/4.0,
      6.0/0.0/4.0,6.5/0.0/3.5,6.5/0.0/0.5,6.0/0.0/0.0,4.5/0.0/1.0,4.5/0.0/3.0,
      5.5/0.0/3.0,5.5/0.0/1.0%
    }{(tpp cs:x=\x,y=\y,z=\z) coordinate[name=vert-D-\i]};
    \filldraw[front,cycle of vertices={D}{1,...,6},
      cycle of vertices={D}{7,10,9,8}];
    \filldraw[side,cycle of vertices={D}{10,9,19,20}];
    \filldraw[bottom,cycle of vertices={D}{8,9,19,18}];
    \filldraw[front,cycle of vertices={D}{11,...,16},
      cycle of vertices={D}{17,20,19,18}];
    \filldraw[side,cycle of vertices={D}{1,2,12,11}];
    % '3'
    \path foreach \x/\y/\z [count=\i] in {
      0.0/2.0/0.0,0.0/2.0/1.0,2.0/2.0/1.0,2.0/2.0/1.5,0.0/2.0/1.5,0.0/2.0/2.5,
      2.0/2.0/2.5,2.0/2.0/3.0,0.0/2.0/3.0,0.0/2.0/4.0,3.0/2.0/4.0,3.0/2.0/0.0,
      0.0/0.0/0.0,0.0/0.0/1.0,2.0/0.0/1.0,2.0/0.0/1.5,0.0/0.0/1.5,0.0/0.0/2.5,
      2.0/0.0/2.5,2.0/0.0/3.0,0.0/0.0/3.0,0.0/0.0/4.0,3.0/0.0/4.0,3.0/0.0/0.0%
    }{(tpp cs:x=\x,y=\y,z=\z) coordinate[name=vert-3-\i]};
    \filldraw[front,cycle of vertices={3}{1,...,12}];
    \filldraw[side,cycle of vertices={3}{3,4,16,15}];
    \filldraw[side,cycle of vertices={3}{7,8,20,19}];
    \filldraw[side,cycle of vertices={3}{1,2,14,13}];
    \filldraw[side,cycle of vertices={3}{5,6,18,17}];
    \filldraw[side,cycle of vertices={3}{9,10,22,21}];
    \filldraw[bottom,cycle of vertices={3}{4,5,17,16}];
    \filldraw[bottom,cycle of vertices={3}{8,9,21,20}];
    \filldraw[front,cycle of vertices={3}{13,...,24}];
  \end{scope}
\end{tikzpicture}
\end{codeexample}
\fi


\section{Correlations between loci, linkage disequilibrium, and recombination}

%</source-file>

Up to now we have been interested in correlations between alleles at the
same locus, e.g. correlations within individuals (inbreeding) or between
individuals (relatedness). We have seen how relatedness between parents affects the extent to which their offspring is inbred. We now turn to
correlations between alleles at different loci. To understand
correlations between loci we need to understand recombination.\\

\paragraph{Recombination}  Lets
consider an individual heterozygous for a $AB$ and $ab$
haplotype. If no recombination occurs between our two loci in this
individual, then these two haplotypes will be transmitted intact to
the next generation. While if a recombination (or more generally an
odd number of recombinations) occurs between our two loci on the
haplotype transmitted to the child then $\tfrac{1}{2}$ the time the
child receives a $Ab$ haplotype and $\tfrac{1}{2}$ the time the child
receives a $aB$ haplotype. So recombination is breaking up the
association between loci. We'll define the recombination fraction ($r$) to be
the probability of an odd number of recombinations between our loci.
In practice we'll often be interested in relatively short regions
where recombination is relatively rare, and so we might think that
$r=r_{BP}L \ll 1$, where $r_{BP}$ is the average recombination rate
per base pair (typically $\sim 10^{-8}$) and L is the number of base
pairs separating our two loci.\\

\paragraph{Linkage disequilibrium}
The (horrible) phrase linkage
disequilibrium (LD) refers to the statistical non-independence
(i.e. a correlation)  of
alleles at different loci. Our two loci, which segregate alleles $A/a$ and $B/b$, have allele
frequencies of $p_A$ and $p_B$ respectively. The frequency of the two locus haplotype is $p_{AB}$,
and likewise for our other three combinations. If our loci were
statistically independent then $p_{AB} = p_Ap_B$, otherwise $p_{AB} \neq p_Ap_B$
We can define a covariance between the $A$ and $B$ alleles at our two loci as
\begin{equation}
D_{AB} = p_{AB} - p_Ap_B
\end{equation}
and likewise for our other combinations at our two loci
($D_{Ab},~D_{aB},~D_{ab}$). These $D$ statistics are all closely
related to each other as $D_{AB} = - D_{Ab}$ and so on. Thus we only
need to specify one $D_{AB}$ to know them all, so we'll drop the
subscript and just refer to $D$. Also a handy result is that we can rewrite our haplotype
frequency $p_{AB}$ as
\begin{equation}
p_{AB} = p_Ap_B+D. \label{eqn:ABviaD}
\end{equation}
If $D=0$ we'll say the two loci are in linkage equilibrium, while if
$D>0$ or $D<0$ we'll say that the loci are in linkage
disequilibrium (we'll perhaps want to test whether $D$ is
statistically different from $0$ before making this choice). You should be careful to keep the concepts of linkage
and linkage disequilibrium separate in your mind. Genetic linkage refers to the
linkage of multiple loci due to the fact that they
are transmitted through meiosis together (most often because the
loci are on the same chromosome). Linkage disequilibrium merely refers
to the correlation between the alleles at different loci, this may in
part be due to the genetic linkage of these loci but does not
necessarily imply this (e.g. genetically unlinked loci can be in LD
due to population structure). \\

Another common statistic for summarizing LD is $r^2$ which we write as
\begin{equation}
r^2 = \frac{D^2}{p_A(1-p_A) p_B(1-p_B) }
\end{equation}
as $D$ is a covariance, and $p_A(1-p_A) $ is the variance of an allele
drawn at random from locus $A$, $r^2$ is the squared correlation
coefficient.    \\

{\bf Question.} You genotype 2 bi-allelic loci (A \& B) segregating in two mouse subspecies (1 \& 2) which mate randomly among themselves, but have not historically interbreed since they speciated. On the basis of previous work you estimate that the two loci are separated by a recombination fraction of 0.1. The frequencies of haplotypes in each population are:
\begin{center}
\begin{tabular}{|c|cccc|}
\hline
Pop    & $p_{AB}$    & $p_{Ab}$ &    $p_{aB}$ &    $p_{ab}$\\
\hline
1 &    .02    & .18 &     .08 &    .72\\
2&    .72 &    .18 &    .08 &    .02\\
\hline
\end{tabular}
\end{center}

{\bf A)} How much LD is there within populations, i.e. estimate D?\\

{\bf B)} If we mixed the two populations together in equal proportions what value would D take before any mating has had the chance to occur? \\

\paragraph{The decay of LD due to recombination}
We will now examine what happens to LD over the generations if we
only allow recombination to occur in a very large population (i.e. no
genetic drift, i.e. the frequencies of our loci follow their expectations). To do so consider the frequency of our $AB$ haplotype in the next generation
$p_{AB}^{\prime}$. We lose a fraction $r$ of our $AB$ haplotypes to
recombination ripping our alleles apart but gain a fraction $rp_A p_B$ per generation from other
haplotypes recombining together to form $AB$ haplotypes. Thus in the
next generation
\begin{equation}
p_{AB}^{\prime} = (1-r)p_{AB} + rp_Ap_B
\end{equation}
this last term here is $r(p_{AB}+p_{Ab})(p_{AB}+p_{aB})$, which
multiplying this out is the
probability of recombination in the different diploid genotypes that
could generate a $p_{AB}$ haplotype. \\

We can then write the change in the frequency of the $p_{AB}$
haplotype as
\begin{equation}
\Delta p_{AB} = p_{AB}^{\prime} -p_{AB} = -r p_{AB} + rp_Ap_B = - r D
\end{equation}
so recombination will cause a decrease in the frequency of $p_{AB}$ if
there is an excess of $AB$ haplotypes within the population ($D>0$), and an
increase if there is a deficit of $AB$ haplotypes within the
population ($D<0$). Our LD in the next generation is $D^{\prime} =
p_{AB}^{\prime}$, so we can rewrite the above eqn. in terms of the
$D^{\prime} $
\begin{equation}
D^{\prime}= (1-r) D
\end{equation}
so if the level of LD in generation $0$ is $D_0$ the level $t$
generations later ($D_t$) is
\begin{equation}
D_t=  (1-r)^t D_0
\end{equation}
so recombination is acting to decrease LD, and it does so
geometrically at a rate given by $(1-r)$. If $r \ll 1$ then we can
approximate this by an exponential and say that
\begin{equation}
D_t \approx  D_0 e^{-rt}
\end{equation}\\

{\bf Q C)} You find a hybrid population between the two mouse subspecies
described in the question above, which appears to be comprised of equal proportions of ancestry from the two subspecies.  You estimate LD between the two markers to be 0.0723. Assuming that this hybrid population is large and was formed by a single mixture event, can you estimate how long ago this population formed? \\

%\subsection{Testing for departures from HWE.}
%Note the form of $\hat{F}$ \eqref{eqn:FhatHO} is the same as the $X^2$
%statistic, and so we can test for a deviation from hardy-weinberg  $X^2$

%\subsection{Population structure}
%The question naturally arises at this point: what reference population
%(i.e. what allele frequency) do we use to calculate $\hat{F}$? If we are %calculating the inbreeding coefficient
%of an English person do we use the frequencies of the town of that
%person, of England, of the United Kingdom, or of the World?

%\gc{Include the HapMap exercise here?}

%==One locus models of selection==
%<source-file filename="one_loc_sel_models.tex" display="one_loc_sel_models.wrapped.latexml.xhtml">

\newpage


\section{Cryptographic Services}
\input{sections/hashlib}
\input{sections/hmac}
\input{sections/secrets}

%


    \filetitle{dbplot}{Plot from database}{dbase/dbplot}

	\paragraph{Syntax}\label{syntax}

\begin{verbatim}
[FF,AA,PDb] = dbplot(D,List,Range,...)
[FF,AA,PDb] = dbplot(D,Range,List,...)
\end{verbatim}

\paragraph{Input arguments}\label{input-arguments}

\begin{itemize}
\item
  \texttt{D} {[} struct {]} - Database with input data.
\item
  \texttt{List} {[} cellstr {]} - List of expressions (or labelled
  expressions) that will be evaluated and plotted in separate graphs.
\item
  \texttt{Range} {[} numeric {]} - Date range.
\end{itemize}

\paragraph{Output arguments}\label{output-arguments}

\begin{itemize}
\item
  \texttt{FF} {[} numeric {]} - Handles to figures created by
  \texttt{qplot}.
\item
  \texttt{AA} {[} cell {]} - Handles to axes created by \texttt{qplot}.
\item
  \texttt{PDB} {[} struct {]} - Database with actually plotted series.
\end{itemize}

\paragraph{Options}\label{options}

\begin{itemize}
\itemsep1pt\parskip0pt\parsep0pt
\item
  \texttt{'plotFunc='} {[} @bar \textbar{} @hist \textbar{} *@plot*
  \textbar{} @plotcmp \textbar{} @plotpred \textbar{} @stem \textbar{}
  cell {]} - Plot function used to create the graphs; use a cell array,
  \texttt{\{plotFunc,...\}} to specify extra input arguments that will
  be passed into the plotting function.
\end{itemize}

See help on \href{qreport/qplot}{\texttt{qreport/qplot}} for other
options available.

\paragraph{Description}\label{description}

The function \texttt{dbplot} opens a new figure window (as many as
needed to accommodate all graphs given the option \texttt{'subplot='}),
and creates a graph for each entry in the cell array \texttt{List}.

\texttt{List} can contain the names of the database time series,
expression referring to the database fields evaluating to time series.
You can also add labels (that will be displayed as graph titles)
enclosed in double quotes and preceding the expressions. If you start
the expression with a \texttt{\^{}} (hat) symbol, the function specified
in the \texttt{'transform='} option will not be applied to that
expression.

\paragraph{Example}\label{example}

\begin{verbatim}
dbplot(d,qq(2010,1):qq(2015,4), ...
   {'x','"Series Y" y','^"Series z"'}, ...
   'transform=',@(x) 100*(x-1));
\end{verbatim}


\chapter{Introduction}
\chaptermark{Introduction}
\label{chap:one}

In extreme values analysis (EVA), extremes are separated from the bulk of the distribution by either analyzing only points above a threshold or block maximums \citep{Coles2001}, e.g., the annual maximum of the daily precipitation.
A natural spatial model for block maximum at several spatial locations is the max-stable process, which, under certain conditions, arises as the limit of the location-wise maximum of infinitely-many spatial processes \citep{deHaan2006}.
Max-stable processes provide a very flexible framework, but they can be computationally challenging to implement.
This is because the full likelihood exists for only a few trivial situations.

In addition to computational limitations, the use of max-stable processes also necessitates the use of dependence measures other than covariances and correlations.
In extremes analysis, using measures like covariance to describe dependence is not reliable because they focus on deviations around the mean of the distribution.
This is problematic because the finite dimensional marginal distributions of a max-stable process follow a generalized extreme value (GEV) distribution which is not guaranteed to have a finite first moment.

In this chapter, we provide a basic overview of our contributions to solving some of the current issues in EVA.
The first contribution explores the use of the \skewt{} distribution for modeling spatial extremes.
This distribution has good extremal properties (i.e. it demonstrates dependence in the tails), but it requires some modification to address long-range asymptotic dependence and possible misspecification of distribution.
The second contribution is the development of a max-stable model for spatial dependence in rare binary data.
Spatial methods for binary data traditionally use a Gaussian process, but in the case of rare data, the Gaussian process may not be appropriate due to its lack of asymptotic dependence.
The third contribution is a new method to construct empirical basis functions (EBF) as an exploratory technique to examine spatial dependence in the extremes.
This method is motivated by principal components analysis (PCA), but differs in that the functions are positive and thus not orthogonal to one another.
Together these three contributions provide new solutions for existing challenges in spatial methods for EVA.

\section{A space-time \skewt{} model}

To assess the compliance of air quality regulations of a pollutant, the Environmental Protection Agency (EPA) must know if a site exceeds a pre-specified level.
In the case of ozone, compliance is fixed such that the year's 99th quantile should not exceed 75 parts per billion (ppb), which is high, but not extreme at all locations.
One standard approach in EVA is to consider the yearly maximum at each spatial location.
However, this approach is not appropriate because compliance is not based on the maximum at each site.
The other standard approach is to model threshold exceedances, but the threshold is usually selected to be extreme in the data as opposed to being fixed in advance by a regulatory agency.
Furthermore, the computing required to fit a max-stable process to a large spatiotemporal dataset can be onerous.

In \cref{chap:two}, we propose a new method that shares some asymptotic dependence characteristics of the max-stable process while retaining some of the desirable computing properties of a Gaussian process.
Our method is a space-time model for threshold exceedances based on the \skewt{} process of \citet{Azzalini2014}.
Without modification, the \skewt{} process has some undesirable characteristics such as long-range asymptotic dependence.
To address this concern, we incorporate a random partition to permit asymptotic independence between sites that are far apart while allowing for asymptotic dependence between sites that are near to one another.
We also incorporate censoring in the model.
This censoring is important because it allows the tails of the data to speak for themselves.
Finally, many extremal phenomena (e.g. high temperatures, extreme precipitation) exhibit some type of temporal dependence.
Therefore we introduce a transformed AR(1) time-series to allow for temporal dependence.
In many cases, this method provides results that show improvements over both Gaussian and max-stable methods.

\section{A spatial model for rare binary events}

Spatial methods for binary data commonly implement a Gaussian process to account for spatial dependence.
However, for rare data, the latent variable is typically extreme, so Gaussian processes may not adequately capture the dependence between observations.
This is due to the fact that Gaussian processes do not demonstrate asymptotic dependence regardless of the strength of the correlation in the bulk of the data \citep{Sibuya1960}.

As a solution to this problem, in \cref{chap:three} we extend the GEV link function \citep{Wang2010} to allow for a max-stable dependence structure based on the low-rank representation of a max-stable process given by \citet{Reich2012}.
We provide an exact expression for the joint distribution of extremely rare events.
For events that are moderately rare, Bayesian methods can be used to fit the model.
The results from the simulation study in this chapter give some evidence to suggest that the proposed method improves performance as rareness increases.
This is further supported by the results from the data analysis.

\section{Empirical basis functions}

Large datasets provide a rich source of information, but sometimes they can lead to onerous computing.
This is especially true for max-stable methods which can be computationally burdensome for as few as 20 simultaneously observed variables \citep{Wadsworth2014}.
Low-rank methods provide an attractive solution to dealing with this problem.
One such low-rank max-stable model is given by \citet{Reich2012}.
In this model, a set of spatial knots are placed throughout the domain of interest, and a positive stable (PS) random effect is then associated with each knot.

\cref{chap:four} presents the development of EBFs to be used in place of the spatial knots.
As mentioned previously, these basis functions play a similar role to principal components, but they are positive and thus not orthogonal.
Despite this difference, the basis functions can be plotted as a tool for exploratory data analysis to reveal important spatial trends.
They can also be used for Bayesian inference on the marginal parameters, modeling spatial dependence, and testing for covariate effects.
The basis function representation allows for analysis of both block-maxima data and thresholded data.

In the case that residual dependence is not strong, we find that the EBFs perform comparably to the method using spatial knots.
However, in the case that there is moderately strong residual dependence, we find that the EBFs give an improvement in the performance over using a similar number of spatial knots.


\section{Optimization \& Adv.\ Robustness}
\transitionFrame{Relating Optimization \& Adversarial Guarantees}

\begin{frame}{What is an adversarial \blue{guarantee}?}
  \begin{itemize}[<+->]
    \setlength{\itemsep}{20pt}
    \item \textbf{Guarantee}: Certifies that a ``well-defined'' class of adversarial attacks are prevented
      \begin{itemize}
        \item \textit{Example}: Class of \textbf{\blue{first-order adversaries}}
      \end{itemize}

    \item Last week we reviewed multiple possible defensive techniques, e.g.,~robustness, disinformation,~etc.

    \item \textbf{Question}: What guarantees did the authors' of last week's paper provide?
    \vspace{-14pt}
    \item \textbf{Answer}: None. \onslide<+->{\textit{And that's the point}}

    \item \textbf{Goal}: Make \textbf{\green{provable statements about robustness}}.
      \begin{itemize}[<+->]
        \item If we can do it, that's a \textit{yuge} deal.
        \item Ends\textsuperscript{*} the arms race.
      \end{itemize}
  \end{itemize}
\end{frame}

\begin{frame}{Nomenclature}
  \onslide<+->{Quite standard and used throughout this talk.}  \onslide<+->{\textit{If you have a question,} \textbf{ask now!}}

  \begin{itemize}[<+->]
    \setlength{\itemsep}{6pt}
  \item ${\X \in \domainX \subset \mathbb{R}^d}$: Feature vector
    \item ${\y \in \domainY \equiv \ints{k}}$: Ground truth (true) label
    \item $\func{\distr}{\domainX \times \domainY}{\mathbb{R}_{{\geq}0}}$: Underlying sample data probability distribution s.t.\ ${(\X,\y) \sim \distr}$

    \vspace{6pt}
    \item ${\params \in \domainP}$: Model (neural network) parameters

    \vspace{6pt}
  \item ${\sPerturb \subseteq \mathbb{R}^{d}}$: Set of allowed (adversarial) perturbations can be applied to any~$\X$
    \item ${\perturb \in \sPerturb}$: (Adversarial) perturbation s.t.
      \begin{equation}\label{eq:AdversarialX}
        \X^{\text{adv}} = x + \delta
      \end{equation}

    \vspace{6pt}
    \item $\mathbb{E}_{x \in \mathcal{X}}\sbrack{f(x)}$: Expected value (mean) of $f(x)$
  \end{itemize}
\end{frame}

\begin{frame}{``Standard'' Training Model}
  \begin{itemize}[<+->]
    \setlength{\itemsep}{20pt}
    \item Neural network training is based on \textbf{\blue{empirical risk minimization}} (ERM)
    \item \textbf{\green{Fundamental Idea}}:
      \begin{equation}\label{eq:ERM}
        \min_{\params} \mathbb{E}_{(\X,\y) \sim \distr} \sbrack{\loss \left( \X, \y ; \params \right)}
      \end{equation}

    \item \textbf{\blue{Attack Model}}: For any ${x \in \domainX}$, adversary can make a set of allowed perturbations~$\sPerturb$
      \begin{itemize}
        % \item \textit{Theoretical Paradigm}: $\sPerturb = \linf\text{-ball}$
        \item We'll formally define $\sPerturb$ later.  For now, it is any subset of $\mathbb{R}^{d}$
      \end{itemize}

    \item \textbf{\red{Big Problem}}: ERM-trained models are not robust to adversarially perturbed examples~\cite{Biggio:2013,Szegedy:2013}
  \end{itemize}
\end{frame}

\subsection{Minimax}
\begin{frame}{Adversarial Training Framework}
  \begin{definition}
    \blue{\textit{Minimax optimization}} reformulates ERM as:
    \onslide<2->{
      \begin{equation}\label{eq:Minimax}
        \textcolor<5->{ForestGreen}{\min_{\params} \rho(\params)}\text{, where } \rho(\params) = \mathbb{E}_{(\X,\y) \sim \distr} \sbrack{\textcolor<4->{red}{ \max_{\delta \in \sPerturb} \loss (\X + \perturb, \y ; \params)}} \text{.}
      \end{equation}
    }
  \end{definition}

  \vspace{8pt}
  \only<3-5>{Optimization Framework's Two Key Parts
    \begin{itemize}
      \setlength{\itemsep}{4pt}
    \item \onslide<4->{\textbf{\color{red}Inner Maximization}: Adversary finds ${\xadv = \X + \perturb}$ with highest loss (think worst case)}
      \item \onslide<5->{\textbf{\color{ForestGreen}Outer Minimization}: Defender selects model parameters~$\params$ that minimize adversarial loss}
    \end{itemize}
  }
  \only<6->{
    \textbf{Question}: What can we say if ${\textcolor{ForestGreen}{\min_{\params} \rho(\params)} \rightarrow 0}$?

    \vspace{4pt}
    \onslide<7->{\textbf{Answer}: \green{Perfect robustness}. \textit{Adversarial guarantee} no perturbation defined in attack model ($\sPerturb$) fools the network.}
    \begin{itemize}
      \item \onslide<8->{\textbf{Summary}: No adversarial examples!\textsuperscript{*}}
    \end{itemize}

    \vspace{10pt}
    \onslide<9->{\textbf{Why?}} \onslide<10->{Inner maximization considers \textbf{worst case} adversary guaranteeing all cases}
   }
\end{frame}

\begin{frame}{So\ldots Are We Done Here?}
  \onslide<+->{}
  \onslide<+->{\textbf{No.}} \onslide<+->{Inner \& outer components of minimax formulation are non-convex and non-concave respectively.}
  \begin{itemize}[<+->]
    \item \textit{Worst Case}: $\text{Non-convexity} \implies \text{Intractable}$ (rule of thumb)
  \end{itemize}
  \vfill
  \onslide<+->{\textbf{\green{Key Contribution \#1}}: Demonstrating adversarial minimax optimization \textit{is} tractable.}
  % \begin{itemize}[<+->]
  %   \item We will talk about tractability in the coming slides.
  % \end{itemize}
\end{frame}


\section{Individual Conditional Expectation}

\begin{frame}[c]
\Huge{\centerline{Individual Conditional Expectation}}
\end{frame}

%----------------------------------------------------------------------------------------

\begin{frame}\frametitle{Individual Conditional Expectation}
	\begin{itemize}
		\item Individual conditional expectation (ICE) plots can create localized explanations for a single observation of data using the same basic ideas as partial dependence plots.
		\item ICE is a type of nonlinear sensitivity analysis in which a model's predictions for a single observation are measured while a feature of interest is varied over its domain.
		\item To create an ICE plot for a row of interest $x^{(i)}$ and a feature of interest $x_j^{(i)}$, we vary $x_j^{(i)}$ within the range of the feature's original domain, and call a single such value $x_{j,q}$ (where $q$ specifies an index within the domain):\\
		\bigskip
		 $\text{Specifically, we plot }g(x_{j,q}, \mathbf{x}_{(-j)}^{(i)}) \text{ versus } x_{j,q} \text{ for each fixed }\mathbf{x}_{(-j)}^{(i)}.$
	\end{itemize}
\end{frame}

%----------------------------------------------------------------------------------------


\chapter{Sharemind: A Secure Computing Platform}\label{c:sharemind}

Sharemind \cite{bogdanov2008sharemind, bogdanov2013sharemind} is a general purpose SMPC system, for privacy preserving data processing operating on additively secret-shared values.
The idea of Sharemind is to provide a secure infrastructure that is able to host and evaluate privacy preserving algorithms.
Sharemind provides an easily programmable and flexible platform that enables non\hyp cryptographers to develop and test privacy preserving algorithms such as Privacy Preserving Data Mining (PPDM).
It consists of the computation runtime environment and a programming library for creating private data processing applications
Sharemind is provably secure under the semi-honest (honest but curious) setting.

Sharemind’s is deployed as a distributed computation platform, that can be used both for data storage and computation.
The deployment model consists of (usually three) nodes, the computing nodes that use SMPC through secret sharing to privately process the data.
Secret sharing guarantees data confidentiality during storage.
All computations are done by the dedicated computing nodes.

Data providers submit their private inputs by sending the corresponding cryptographic shares to the computing nodes.
The secret sharing scheme ensures that each share is a random bit string.
Each host, computing node, is not able to decrypt the data, or even extract any information about them.
Consequently, a node holding that share learns no extra information about the data input (secret), than if they did not hold that share.
For that reason, data providers need not trust any of the computing nodes.
Instead providers must trust that the nodes as a group obey a set of rules such as that they do not collude during the computations.
This can be achieved through physical and organizational security measures as well as software auditing.
In practice, the computing nodes will be servers run by independent entities, such as companies or government agencies, ideally having conflicting interests.
Data users want to analyze the information given by data providers.
Answers to their queries are given through the Sharemind system, and not from data providers directly.

The Sharemind framework provides a privacy preserving  instruction set which includes secure addition, multiplication and greater\hyp than\hyp or\hyp equal comparison of two shared values.
Multiplication of a shared value with a constant and extraction of its bits as shares is also possible.
Bit extraction and arithmetic primitives are sufficient to construct any Boolean circuit with a linear overhead and thus the Sharemind framework is also Turing complete \cite{bogdanov2008sharemind}.
Many data mining and statistical analysis algorithms use no other mathematical operations than the Sharemind's instruction set, thus it is sufficient for most applications.

\section{Real World Applications}\label{s:real-world-applications}

\subsection{Satellite Collision Detection}\label{s:satellite-collision-detection}
One notable example of a real world application of SMPC using Sharemind was presented in \cite{kamm2015secure}.
In this paper, Sharemind engine was utilized to perform satellite collision detection in a secure multiparty setting.
The number of satellites orbiting our planet is growing, and so does the danger of collisions.
Indeed, two satellites crashed in 2009.
Satellite owners, such as governments, do not want to reveal orbital information about their satellites.
However, satellites come with extravagant expenses and each satellite owner want to protect their property.

Future collisions could be avoided by sharing information about the satellites orbits.
Using SMPC, the parties can cooperate and learn whether a collision is going to happen and nothing else.
No information about the actual orbits would leak -- no party can see the individual values, since computations are carried out on encrypted data.
The SMPC solution provides cryptographic guarantees for the confidentiality of the input trajectories.

\subsection{Analysing Private Databases}\label{s:analysing-private-databases}
Another worth mentioning application took place in 2015, where the Estonian Center of Applied Research used Sharemind to collect governmental tax and education records with purpose to run a big data study looking for correlations between people who work during their studies and those who fail to graduate in time.

In Estonia -- where this research took place, the Ministry of Education and Science keeps track of students and the Tax and Customs Board keeps track of working (by tracking income tax payments).
A correlation between working during studies and not graduating in time could be possible to find, if these databases were not private.
However, this data cannot be shared because of the Personal Data Protection Act and the Taxation Act and also many European Union regulations, such as General Data Protection Regulation (GDPR) \cite{gdpr}.
All these legislation prevents such studies from being performed.

The results of the study were quite surprising.
The study found no relation between working during studies and not graduating on time.
Instead, it turned out that the population group that was studied (Estonian students of all fields) work an equal amount.
Moreover, it showed an obvious the reduction of employment during the financial crisis in 2008.
This study would not have been possible without an SMPC engine such as Sharemind, as no research organization can gain access to these private databases due to Data Protection regulations.
Nevertheless, this research allowed more personalized follow-up studies to be planned for finding the reasons why students quit.

\section{SecreC}\label{s:secrec}

The programmer of the privacy preserving applications does not necessarily know the underlying security protocols.
Application are developed using the SecreC programming language \cite{jagomagis2010secrec}.
SecreC is an procedural imperative domain specific language (DSL) that is syntactically similar to C. SecreC guarantees writing privacy-preserving algorithms without any knowledge of the underlying cryptographic protocol.
In other words, SecreC distinguishes the application\myslash business logic from the cryptographic protocol.

The language uses a custom type system, which separates private\myslash confidential data from public.
Public values are processed as usual, whereas private values, which are in secret-shared form are processed using secure computation.
To achieve this, SecreC adds a security type to each fundamental data type.
The security type can be either \textit{private} or \textit{public}.
If no security type is specified then the public one is used by default.
Security types differ from standard data types in the sense that data associated with the public security type will be stored and processed publicly on the Sharemind virtual machine, whereas data associated with the private security type, will be stored in secret\hyp shared form.
Each computing node will acquire one share of the actual value.

In SecreC one can have expressions of private or public data.
In the case that such two expressions are combined into a single expression, the public data are secret\hyp shared and moved into the private execution environment in order for the composite expression to be evaluated.
That way all data are of the private security type and the expression can be evaluated.

Sometimes however it is vital to open a secret.
This could be done in order to gain some insight about an algorithm having good intentions in mind.
SecreC offers a special \f{Declassify} operator through which is made possible to publish private information.
An expression that is declassified has its security type changed from private to public, and the secret\hyp shared value moves into the public execution environment.
Since the use of the \f{Declassify} operator is the only way for private data to become public, its use should be tracked in order to reason about data privacy and to avoid potential unwanted privacy leaks.
As a rule of thumb, declassification of private data should occur ass little as possible.
Ideally, declassification should be used only to publish the final results of an algorithm, or intermediate results that have low privacy risk \textit{i.e.} do not reveal sensitive information.

Typically, if a decision (\textit{e.g.} a branch) is to be made over private data, that would require the data to be published, that is to be converted to the public security type.
For instance, consider the following example:

\texttt{if (x) a = b; else a = c; }

One can rewrite the previous statement using with the following expression:

\texttt{a = b * x + c * (1-x); }

Using this technique a programmer can replace conditional statements on private data with such oblivious selection clauses.
So the control flow dependencies are converted into data dependencies.

{
\begin{minted}[xleftmargin=21pt, framesep=3mm, frame=single, linenos, tabsize=2, breaklines, breaksymbolleft=, fontsize=\footnotesize]{c++}
pd_shared3p uint64 max(pd_shared3p uint64 x, pd_shared3p uint64 y) {
  pd_shared3p uint64 gt = (uint64)(x > y); // 1 if x > y, 0 otherwise
  return x * gt + y * (1-gt); // Oblivious selection of the max value
}

void main(){
  pd_shared3p uint64 x1 = 5; // Private, secret-shared value of input party 1
  pd_shared3p uint64 x2 = 8; // Private, secret-shared value of input party 2
  pd_shared3p uint64 max = max(x1, x2); // Private result
  print(declassify(max)); // Result publishing
}
\end{minted}
\captionof{lstlisting}{Millionaire problem in SecreC}\label{l:millionaires}
}

An example of SecreC code can be found in Code Snippet \ref{l:millionaires}.
The problem at hand is Yao's millionaire problem \cite{yao1982protocols} as described in section \ref{s:smpc}.
Here we use \texttt{pd\_shared3p} as the security type, which stands for \textit{\textbf{p}rotection \textbf{d}omain \textbf{shared 3 p}arties}, and corresponds to a private security type using secret\hyp sharing between three parties.

\subsection{SIMD in SecreC}\label{ss:simd-secrec}

Each SMPC operation in Sharemind is implemented as an assembly instruction.
Sharemind also supports vectorized operations which play a significant role in the program's efficiency.
With vectorized operations the same protocol is executed but using multiple inputs at once, in parallel.
Using such SIMD (Single Input Multiple Data) instructions the protocol performs all operations in parallel by packaging the values in a single communication message.

This significantly reduces the communication overhead between the participating parties, which is usually a dominating factor in a protocol's performance.
Thus, developing applications with vectorization in mind, has a substantial contribution to the application's efficiency.
We have focused on using vectorization as much as possible when developing our privacy preserving algorithms, which we describe in chapter \ref{c:pp-algorithms}.

Below, in code snippets \ref{l:non_vectorized_addition} and \ref{l:vectorized_addition}, we present two versions of array addition in SecreC.
The first one works with a typical loop on each of the array elements, while the second one works by performing an SIMD addition between two arrays.

{
\begin{minted}[xleftmargin=21pt, framesep=3mm, frame=single, linenos, tabsize=2, breaklines, breaksymbolleft=, fontsize=\footnotesize]{c++}
  void main(){
    uint64 N = 5;
    pd_shared3p uint64 a(N) = {1, 2, 3, 4, 5}; // Array definition of size N
    pd_shared3p uint64 b(N) = {6, 7, 8, 9, 10}; // Array definition of size N
    pd_shared3p uint64 c(N); // Array declaration of size N
    for (uint64 i = 0; i < N; i++){
      c[i] = a[i] + b[i]; // Element-wise addition with sequential access
    }
    print(declassify(c)); // Result publishing
  }
\end{minted}
\captionof{lstlisting}{Array addition in SecreC}\label{l:non_vectorized_addition}
}

{
\begin{minted}[xleftmargin=21pt, framesep=3mm, frame=single, linenos, tabsize=2, breaklines, breaksymbolleft=, fontsize=\footnotesize]{c++}
  void main(){
    uint64 N = 5;
    pd_shared3p uint64 a(N) = {1, 2, 3, 4, 5}; // Array definition of size N
    pd_shared3p uint64 b(N) = {6, 7, 8, 9, 10}; // Array definition of size N
    pd_shared3p uint64 c(N) = a + b; // SIMD instruction of addition of the two arrays
    print(declassify(c)); // Result publishing
  }
\end{minted}
\captionof{lstlisting}{Array addition in SecreC using SIMD}\label{l:vectorized_addition}
}

The two example programs will have the same output but their performance will differ.
The first program will perform $N$ message exchanges between the computing parties for the addition, while the second will perform just one.
For large enough values of $N$, the performance difference is tremendous.

\section{Sharemind Infrastructure}\label{sharemind-infrastructure}
Sharemind consists of three different kinds of parties, input parties, computing parties and result parties.
The number of the input parties -- data providers -- as well as the result parties -- analysts/users -- is not restricted, however the computing parties are restricted by the SMPC protocol that is been used; for instance the aforementioned ``Millionaire problem" shown in (\textit{Source Code} \ref{l:millionaires}) uses the \textit{pd\_shared3p} security protocol, which utilizes three nodes.

As stated by Sharemind's author in \cite{bogdanov2013sharemind} three is usually the optimal number for the computing nodes configuration in the passively corrupted parties threat model.
Three is the lowest number for which an honest majority of parties processing secret shared data can be formed.
The number of parties can be less -- just two nodes -- but it adds more complexity to the protocols, as it requires more expensive cryptographic primitives to be used.
The number of computing parties can also be grater than three, increasing however the communication complexity.

An input party can also be the result party, or one of the computing nodes.
The data providers use secret sharing to distribute their confidential data between the computing nodes.
The analysts make queries and initiate computations, that are performed by the computing nodes leveraging the homomorphic primitives of the secret shares.
Finally, the analysts get the results of the private computation without anyone seeing the original confidential data.
Sharemind's infrastructure as explained in \cite{turban2014secure}, is presented in figure \ref{f:sharemind} in more detail.

\begin{figure}[th]
  \centering
  \includegraphics[width=\linewidth]{figures/sharemind_infrastructure.pdf}
  \caption{An overview of the architecture of Sharemind}\label{f:sharemind}
\end{figure}