\documentclass[main.tex]{subfiles}
\begin{document}

% \marginpar{Thursday\\ 2019-11-28, \\ compiled \\ \today}
% \section*{Thu Nov 28 2019}

% We derived
% %
% \begin{align}
%   \expval{T} = -\frac{1}{3} \frac{E _{\text{grav}}}{V}
% \,,
% \end{align}
% %
% so now we proceed: we want a relation between kinetic and gravitational energy densities.
Now, the question we want to as is: is this equilibrium configuration \textbf{stable}? This is equivalent to asking whether the system is gravitationally bound, \(E _{\text{grav}} < 0\), which as we have shown is equivalent to \(\expval{P}> 0\).

In order to answer this question we shall use a statistical-mechanics, microscopic approach.

We consider a cubic box of volume \(V = L^3\) with \(N\) particles inside it, each of which has a velocity \(\vec{v} = (v_x, v_y, v_z)^{\top}\) and a momentum \(p\). Let us select a face of the box, which we assume to be perpendicular to the \(x\) axis. Each particle will hit it with a frequency \(t^{-1} = v_x / 2L\), and each time it does so it imparts upon it a momentum \(2 p_x\), since it is reflected backwards.

Summing over all the particles, the rate of momentum transfer (so, the force) in the direction \(x\) is given by
%
\begin{align}
  \frac{N}{2L} \expval{2p_x v_x}
\,,
\end{align}
%
so the pressure upon that face will be the force divided by the area of the face
%
\begin{align}
P_x = \frac{N}{L} \expval{p_x v_x} \frac{1}{L^2} = \underbrace{\frac{N}{V}}_{= n} \expval{p_x v_x}
\,.
\end{align}

This will be the same for each direction by isotropicity: \(P_x = P_y = P_z\), and by the same argument we can write \(\expval{p_x v_x} = \expval{\vec{p} \cdot \vec{v}} / 3\): so
%
\begin{align}
  P = \frac{n}{3} \expval{\vec{p} \cdot \vec{v}}
\,,
\end{align}
%
% in full generality.
which, although we will not show it, generalizes to a configuration of any shape, and does not change if we consider quantum-mechanical or relativistic effects.
This is a simple expression for the \textbf{equipartition theorem}, a crucial result in Hamiltonian mechanics.

Let us consider two limits: nonrelativistic and fully relativistic particles.

\paragraph{Nonrelativistic particles}

% In the nonrelativistic case we have
% In this case the energy of a particle with momentum \(p \approx mv\) can be expressed as
% %
% \begin{align}
%   \epsilon_{p} = mc^2 + \frac{p^2}{2m}
% \,,
% \end{align}
% %
% where \(p = mv\).
In this case, since \(\gamma \approx 1\) the four-momentum of the particles is approximately
%
\begin{align}
p^{\mu } = \left[\begin{array}{c}
\gamma mc^2 \\
\gamma m \vec{v}
\end{array}\right]
\approx \left[\begin{array}{c}
mc^2 \\
m \vec{v}
\end{array}\right]
\,,
\end{align}
%
so \(\vec{p} = m \vec{v}\), which means \(\expval{\vec{p} \cdot \vec{v}}  = \expval{ m v^2}\).

% In the ultrarelativistic case we have
% %
% \begin{align}
%   \epsilon_{p} = pc
% \,,
% \end{align}
% %
% and the velocity is approximately the speed of light.

Then, for a gas of nonrelativistic particles we can write the pressure as
%
\begin{align}
  P = \frac{n}{3} \expval{ m v^2} = \frac{2}{3} \rho_{E_K}
\,,
\end{align}
%
where \(\rho_{E_K} = n m \expval{ v^2 /2}\) is the density of translational kinetic energy.

Combining this result with the fact that, as we have seen before, \(\expval{P}=- \rho _{\text{grav}} / 3\), we find
%
\begin{align}
  - \frac{1}{3} \rho _{\text{grav}} = \frac{2}{3} \rho_{E_K} \implies
  2 E _{\text{K}} + E _{\text{grav}} = 0
\,,
\end{align}
%
% in the nonrelativistic approximation.
which is an alternate statement of the \textbf{nonrelativistic} case of the \textbf{virial theorem}.

The total energy is then given by \(E _{\text{tot}} = E_k + E _{\text{grav}} = - E_k\): this means that in general the system will be \textbf{bound} --- the kinetic energy is quadratic, so always positive --- and that the hotter it is, the more bound it is.

% We define: \(\Delta E _{\text{tot}} = - \Delta E _{\text{K}} = \frac{1}{2} \Delta E _{\text{grav}}\).

% We know that
% %
% \begin{align}
%   \expval{P} = \frac{1}{3} \frac{E _{\text{K}}}{V} = -\frac{1}{3} \frac{E _{\text{grav}}}{V}
% \,
% \end{align}
% %
% by the virial theorem: so the total binding energy is equal to zero, since this gives us
% %
% \begin{align}
%   E _{\text{grav}} + E _{\text{K}} = E _{\text{tot}} = 0
% \,.
% \end{align}
% %

\paragraph{Relativistic case}

In this case \(v \approx c\), so \(\expval{p \cdot \vec{v}} \approx pc = \gamma m c\). We can apply the reasoning from before, but the density of translational kinetic energy is given by
%
\begin{align}
\rho_{E_K} = n (E - mc^2) = n (\gamma -1) mc^2 \approx n\gamma mc^2 = npc
\,,
\end{align}
%
so we have
%
\begin{align}
P = \frac{n}{3} \expval{\vec{p} \cdot \vec{v}} = \frac{\rho _{E_k}}{3}
\,.
\end{align}

Then, we can apply the same reasoning as the nonrelativistic case, with the difference of the missing factor 2: we then get
%
\begin{align}
\rho_{E_k} + \rho_{\text{grav}} = 0 \implies
E _{\text{grav}} + E_k = E _{\text{tot}} = 0
\,,
\end{align}
%
so the system is \textbf{unbound}, it does not have any constraint preventing it from dissociating.

% while in the relativistic case we have:
% %
% \begin{align}
%   P = \frac{1}{2} n \expval{pc} = \frac{1}{3} \times \text{translational KE density}
% \,.
% \end{align}

% We will show that, if a star is made of a gas of classical nonrelativistic particles it tends to be stable, if the particles are relativistic then it tends not to be stable.

% The virial theorem tells us that

\paragraph{Adiabatic gas}

We have seen the limiting cases, now let us consider a slightly more general one: a gas undergoing an adiabatic transformation, such that \(P V^{\gamma }\) (with some real number \(\gamma \)) is constant.\footnote{A more realistic model would allow \(\gamma \) to vary, which it definitely does in the stages of stellar formation and evolution and even across a single transformation. We will not, however, get that deep in the weeds.}
We will show that this is equivalent to the equations of state considered in cosmology, where \(P = w \rho \).
This will allow us to characterize the gravitational stability of the to-be star depending on the equation of state of the gas.

We start by differentiating: \(\dd \qty(P V^{\gamma }) = 0\), which means that we also have \(\dd{ (\log (P V^{\gamma }))} = 0\), which we can expand into
%
\begin{align}
  \dd{\log (V^{\gamma })} + \dd{\log (P)} =
  \gamma \frac{ \dd{V}}{V} + \frac{ \dd{P}}{P} = 0
\,,
\end{align}
%
so
%
\begin{align}
  - (\gamma -1 ) P \dd{V}
  = P \dd{V} + V \dd{P} =
  \dd{(PV)}
\,.
\end{align}
%
% and we know that for an adiabatic transformation

% Isentropicity of the trasformation means
In an adiabatic transformation the entropy must not change: so, we can write
%
\begin{align}
  T \dd{S} =
  \dd{E _{\text{in}}} + P \dd{V} = 0
\,,
\end{align}
%
which we can then write using the relation we derived previously:
%
\begin{align}
  \dd{E _{\text{in}}} &= \frac{1}{\gamma -1} \dd{(PV)} \\
  E _{\text{in}} &= \frac{PV}{\gamma -1}  \\
  P &= (\gamma - 1) \frac{E _{\text{in}}}{V} = (\gamma - 1) \rho _{\text{in}}
\,.
\end{align}
%
% and let us assume that \(\gamma \) is approximately constant in the transformation: this means

We can then see that if we impose that the transformation be adiabatic, we find the equation of state \(P  =w \rho \), with \(\gamma -1 = w\).

% %
% \begin{align}
%   E _{\text{in}} = \frac{PV}{\gamma -1}
% \,,
% \end{align}
% %
% so
% %
% \begin{align}
%   P = (\gamma -1 ) \frac{E _{\text{in}}}{V}
% \,,
% \end{align}
% %
% which justifies the relations we used in cosmology, \(P = w \rho \) with \(w = \gamma -1\).

% We can rewrite the equation from before as
Using the fact that, as we have shown before, \(P = - \rho _{\text{grav}} / 3\), this means
%
\begin{align}
- \frac{\rho _{\text{grav}}}{3} = (\gamma - 1) \rho _{\text{in}} \implies
  3(\gamma -1 ) E _{\text{in}} + E _{\text{gr}} = 0
\,,
\end{align}
%
which, together with the fact that the total energy of the star after the collapse is the initial energy plus the (negative) gravitational binding energy: \(E _{\text{tot}} = E _{\text{in}} + E _{\text{gr}}\), so
%
\begin{align}
  E _{\text{tot}} = - (3 \gamma - 4) E _{\text{in}}
\,,
\end{align}
%
which means that \(\gamma > 4/3\) characterizes a bound system, while \(\gamma < 4/3\) characterizes a free system.
This is consistent with what we have seen before: the limiting case \(\gamma = 4/3\) is equivalent to \(w = 1/3\), the equation of state of radiation (or ultrarelativistic matter), which as we have already seen is unbound.
% \(\gamma  = 1\) is equivalent to nonrelativistic matter with \(w = 0\), meaning no pressure at all: this matter will then collapse and

From classical thermodynamics we know that, for instance, a monoatomic gas has \(\gamma = 5 /3\).

% There are two dangers: one is the fight against the pressure forces, one is the fight against the quantum forces (the Pauli exclusion principle) which do not allow the compression to happen further.

\section{Jeans instability}

%
Let us now try to understand the conditions under which a cloud of gas may become unstable and collapse onto itself to form a star (or a planet, for that matter).
% Now we discuss Jeans instability:

In general, the gravitational potential energy of a body whose characteristic size is \(R\) and whose mass is \(M\) is given by
%
\begin{align}
  E _{\text{grav}}
  = - \int_{x, y \in V} \dd[3]{x} \dd[3]{y} \rho (x) \rho (y) \frac{G}{\abs{x - y}}
  = - f \frac{GM^2}{R}
\,,
\end{align}
%
where \(f\) is a numerical factor depending on the mass distribution.
If the object at hand is uniform-density sphere, we have \(f = 3/5\).
In general, the factor is of order 1.

The kinetic component of the energy, on the other hand, is
%
\begin{align}
  E _{\text{K}} = \frac{3}{2} N k_B T
\,.
\end{align}

% We can then see that the gravitational energy scales with \(R^{-1}\);

The gravitational cloud is unstable the gravitational energy is larger than the kinetic energy:
\todo[inline]{Why should this be? The way \textcite[]{keetonStarPlanetFormation2014} discusses it makes more sense to me: he studies the response of the total energy to a decrease in radius, and checks that it is positive; if might be the same as what we are doing here but that's not really obvious.}
%
\begin{align}
  f \frac{GM^2}{R} > \frac{3}{2} N k_B T
\,,
\end{align}
%
and the Jeans mass, \(M_J\), corresponds to the boundary of the stability region: the number of particles, \(N\), depends on it as \(N = M_J / \overline{m}\), where \(\overline{m}\) is the average particle mass.

The criterion then reads:
%
\begin{align}
  f \frac{gM_J^2}{R} &= \frac{3}{2} \frac{M_J}{\bar{m}} k_B T \\
  M_J &= \frac{3}{2} \frac{k_B T }{G \bar{m}} R
\,,
\end{align}
%
where we set \(f =1\), since we are only interested in an order-of-magnitude calculation.
% where \(\bar{m} = M / N\).
% The \(J\) denotes the fact that we are considering the specific boundary mass on both sides. Simplifying the formula we find:
%
% and we can reframe this in terms of the density, which is defined by

As usual, we want to reframe our result in terms of densities: the Jeans mass corresponds to a Jeans density times the volume of the sphere:
%
\begin{align}
  M_J = \frac{4 \pi }{3} \rho _J R^3
\,.
\end{align}

In order to find out what this density is we start off by cubing the
expression for the Jeans mass, and then substituting the expression for \(M_J\) in terms of \(\rho _J\):
% and multiply on both sides:
%
\begin{align}
M_J^3 &= \qty(\frac{3 k_B T}{2 G \bar{m}})^3 R^3\\
&=  \qty(\frac{3 k_B T}{2 G \bar{m}})^3 \frac{3M_J}{4 \pi \rho _J} \\
  \rho _J &= \frac{3}{4 \pi M_J^2} \qty(\frac{3 k_B T}{2 G \bar{m}})^3
  \label{eq:jeans-critical-density-by-mass}
\,.
\end{align}

Alternatively, we can write
%
\begin{align}
\frac{4 \pi }{3} \rho _J R^3 &= \frac{3}{2} \frac{k_B T}{G \overline{m}} R \\
\rho _J &= \frac{9}{8 \pi } \frac{1}{R^2} \frac{k_B T}{G \overline{m}}
\,. \label{eq:jeans-density}
\end{align}
%

We will have an instability if the density is larger than this.
As we have seen in the previous section, a lower temperature facilitates the collapse.
It should be stressed that the precise numerical coefficient will depend on the geometry of the cloud of material, this is not a hard rule but more of a guide for the understanding of the behavior of clouds.
% So, if we want a collapse, we must decrease the mass\dots

% When the last scattering happens, the pions are decoupled from the photons. Dark matter behaves differently from conventional matter.

\todo[inline]{Here appears in the lecture the argument for the fact that the temperature of matter decreases as \(T \sim a^{-2}\); it does not really seem to fit with the rest of the chapter, perhaps it should go earlier?

I'll leave it here, commented out.}

% We have
% %
% \begin{align}
%   \dot{\rho}_r = - 3H \qty(\rho _r + P_r)
% \,,
% \end{align}
% %
% and
% %
% \begin{align}
%   \dot{\rho}_m = -3H \qty(\rho _m + P_m )
% \,,
% \end{align}
% %
% and \(P_r = \rho_r / 3\), which scale like \(a^{-4} \) and also as \(T^{4}\), which means \(T \sim 1/a\).
% %
% \begin{align}
%   \dd \qty(\rho _m c^2 a^3) + P_m d a^3 = 0
% \,,
% \end{align}
% %
% where we usually approximate \(\rho _m c^2 = m_p n_b c^2\), but we can include more terms:
% %
% \begin{align}
%   \rho _m c^2 = m_p n_b c^2 \qty(1 + (\gamma -1 )^{-1} \frac{k_B T}{m_p c^2})
% \,,
% \end{align}
% %
% while the pressure is given by \(P = n_b k_B T\): so in the end we find
% %
% \begin{align}
%   \dd \qty(\qty(m_p n_b c^2 + \frac{3}{2} m_p n_b \frac{k_BT}{m_p})a^3) = - n_b k_B T \dd{a^3}
% \,,
% \end{align}
% %
% which after some computation gives us
% %
% \begin{align}
%   \frac{1}{2} \dd{T } = - T \frac{ \dd{a}}{a}
% \,,
% \end{align}
% %
% which implies \(T_m \propto a^{-2}\) after baryogenesis.

% \todo[inline]{This is for monoatomic baryonic matter, right?}

\subsubsection{Equations for stellar structure}

In order to properly study the dynamics of the stellar collapse, however, we need to analyze the differential equations which govern it.
We will start out by doing so on a static background, following the original reasoning by Jeans (who, working in the early 1900s, did not know about the expansion of the universe). Then, we will discuss the effects of the universe's expansion on the gravitational instability.
% Let us start writing equations for the stellar interior.

The \textbf{continuity equation}, imposed by mass conservation, is
%
\begin{align}
  \partial_{t} \rho + \nabla \cdot \qty(\rho \vec{v}) = 0
\,,
\end{align}
%
where \(\rho \) is the matter density while \(\vec{v}\) is the velocity field; the \textbf{Euler equation}, imposed by momentum conservation (assuming no viscosity), is
%
\begin{align}
  \partial_{t} \vec{v} + \qty(\vec{v} \cdot \vec{\nabla}) \vec{v}
  = - \frac{1}{\rho } \vec{\nabla} P - \vec{\nabla} \Phi
\,,
\end{align}
%
where \(P\) is the pressure while \(\Phi \) is the gravitational potential.

If we define the \textbf{convective} time \textbf{derivative},
%
\begin{align}
  \frac{ \mathrm{D} }{\mathrm{D}t} = \partial_{t} + \vec{v} \cdot \nabla_{x} \approx u^{\mu } \partial_{\mu }
\,,
\end{align}
%
we can write the two equations as
%
\begin{align}
  \frac{ \mathrm{D} }{\mathrm{D}t} \rho + \rho \nabla \cdot \vec{v} &= 0 \\
  \frac{ \mathrm{D} }{\mathrm{D}t} \vec{v}
  &= - \frac{\nabla P}{\rho } - \nabla \Phi
\,.
\end{align}

Lastly, the gravitational field \(\Phi \) must obey Poisson's equation:
%
\begin{align}
  \nabla^2 \Phi = 4 \pi G \rho
\,.
\end{align}

Right now we have five equations (Euler is a vector equation, corresponding to three scalar ones) and six variables: \(\rho \), \(\Phi \), \(P\) and the three components of \(\vec{v}\).
In order to be able to solve this system we need one more condition; typically this is provided as an equation of state, giving \(P\) in terms of the other variables.

One way to go about this is to consider entropy: we define the entropy density \(s \) by the relation \(S  = s \rho \), where \(S\) is the (total?) entropy.

We will consider isentropic processes, in which
%
\begin{align}
  \frac{ \mathrm{D} s}{\mathrm{D}t} + s \vec{\nabla} \cdot \vec{v} = 0
  % \partial_{t} s + \vec{v} \cdot \vec{\nabla} s = 0
\,.
\end{align}

We introduce this, an additional eqution as well as an additional variable, in order to complete our equations with an equation of state in the form:
%
\begin{align}
P = P(\rho , s)
\,.
\end{align}

Now, then, we are left with seven equations and seven variables: let us solve them!
This is in general very hard, no analytic solutions exist.

% Jeans looked for a simple solution, an ansatz, called the background solution and then tried to perturb it: if it is stable than it was a good solution.
Jeans' approach, which we will follow, is to find a fixed background solution and then to perturb it.
We are then looking to see whether the perturbation is dampened or amplified. Perturbations are always present, so this will tell us whether the configuration is stable or unstable.

\subsubsection{Static ansatz}

Jeans' first ansatz was \(\rho = \rho_0 = \const\), \(\vec{v} = 0\), \(s = s_0 =  \const\), \(\Phi = \Phi_0 = \const\), \(P =P_0 = \const\).

% It is obviously wrong! It cannot satisfy the Poisson equation.
This is a \emph{very} simplified model, and it is not even self-consistent: unless \(\rho  = 0\), Poisson's equation cannot be satisfied, but we want to have matter in our proto-star.
We will ignore this problem, since despite it we get a physically meaningful result.
The equation cannot precisely hold, but in low-density regions it is not that far from equality.

% However, we start from it and add some \(\delta \rho \), \(\delta \vec{v}\) (which we just call \(\vec{v}\)), \(\delta s\) and \(\delta \Phi \); then we only keep the linear terms in these perturbations.
We perturb the variables: for each variable we will have \(x = x_0 + \delta x\) (except \(\vec{v}\): since there is no \(\vec{v}_0 \), we just write \(\vec{v}\) instead of \(\delta \vec{v}\)).

With this, the equations read:
%
\begin{align}
  \partial_{t} \delta \rho  +
  \rho_0 \vec{\nabla} \cdot \vec{v} &= 0 \\
  \partial_{t} \vec{v} &= - \frac{1}{\rho_0 } \vec{\nabla} \delta P - \vec{\nabla} \delta \Phi \\
  \nabla^2 \delta \Phi &= 4 \pi G \delta \rho  \\
  \partial_{t} \delta s &= 0
\,.
\end{align}

% We can expand
The pressure perturbation can be expressed in terms of the density and entropy ones:
%
\begin{align}
  \delta P = \underbrace{\eval{\pdv{P}{\rho }}_{s}}_{= c_s^2} \delta \rho + \pdv{P}{s} \delta s
\,,
\end{align}
%
where we recognize the constant-entropy derivative of the pressure with respect to the density: the square of the adiabatic speed of sound.

% In our study of these equations we will only consider first-order terms in the perturbations.

% We will then consider an exponential solution:
% %
% \begin{align}
%   \delta \rho = \delta \rho_0 \exp(i \qty(\vec{k} \cdot \vec{x} - \omega r))
% \,,
% \end{align}
% %
% and similarly for \(\vec{v}\), \(s\), \(\Phi \).

% We will see that we will need to stick to \(\delta s =0\), and find a dispersion relation with \(\omega \) and \(\vec{k}\): it will be
% %
% \begin{align}
%   \omega^2 = c_s^2 \vec{k}^2 - 4 \pi G \rho
% \,,
% \end{align}
% %
% so if the wavenumber is small enough we will have an imaginary \(\omega \).

\end{document}


\documentclass{standalone}
\begin{document}
	\subsection{Kernel Size}

	During the building of the multi-channel image, I had to compute different image features, that requires the setting of different parameters, like median or standard filter kernel sizes. To achieve the best segmentation, I have performed an optimization step that aims to find the parameters that allow obtaining the best segmentation.

	Notice that this process is not necessary and a good segmentation can be achieved also by setting these parameters manually.

	In order to perform the optimization, I have used \textsc{scikit-optimize}~\cite{skopt}, more specifically the \textsc{gc\_minimize method}.

	This method seeks to perform a Bayesian optimization by using a Gaussian process to approximate an objective function. The function values are assumed to follow a multivariate Gaussian. The covariance of the function values is given by a GP kernel between the parameters. Then a smart choice to choose the next parameter to evaluate can be made by the acquisition function over the Gaussian prior which is much quicker to evaluate~\cite{skopt}.

	In the end, an objective function is minimized. I have used the objective function defined in\,\ref{alg:optimize} in which is also reported the whole minimization pseudocode. The used function aim to minimize $1 - IoU$ where the IoU(Intersection over Union) is computed between the output labels and a reference one:
	\begin{equation*}
			IoU = \frac{Area\,of\,Overlap}{Area\,of\,Union}
			\label{eq:IoU}
	\end{equation*}

	I have decided to use the IoU instead of accuracy since the number of pixels concerning the labelled object is very few against the number of pixels related to the background. Thus, the label would be a matrix with a large number of zeros (background) and only a few ones (object). In this case, the standard metric functions have to consider an unbalanced number of samples so the solution was to use the IoU which measures the ratio between the Intersection and Union of the output labels and the binary ground truth~\cite{PhDtheis}:

	\begin{algorithm}[h!]

		\SetAlgoLined
		\DontPrintSemicolon
		\SetKwRepeat{Do}{do}{while}%
		\KwData{Test scans, Ground Truth}

		\SetKwFunction{Obj}{objective}
		\SetKwProg{Fn}{Function}{:}{}

		\Fn{\Obj{$parameters, ref\_labels, CT\_scan$}}{{

				$labels$ $\leftarrow$ segment($CT\_scan$)\;
				iou = IoU($labels$, $ref\_labels$)\;
			}
			\textbf{return} $ 1 - iou $ \;
		}

		$best\_parameters\leftarrow$gc\_minimize(objective, n\_calls, n\_random\_init)\;

			\caption{Parameter Optimization Algorithm}\label{alg:optimize}
	\end{algorithm}

	This process allows optimizing the parameters to obtain better results. As reference labels, I have used the ones evaluated as gold standard from five experts radiologists at least $2$ years of experience.

	This procedure allows only to tune the parameters for better segmentation, but the learning process remains unsupervised.

\end{document}


\section{Conclusion and Discussion}

In this lab, we have studied the harmonic oscillation
and the relations between $T$, $M$, $k$ and $v_{\max}$.
Now we analyze the results.

\subsection{Spring Constant}

\begin{table}[H]
\centering
\begin{tabular}{|c|c|}
spring 1 & 2.3311 $\pm$ 0.013[N/m] \\ \hline
spring 2 & 2.3206 $\pm$ 0.0105[N/m] \\ \hline
spring series & 1.165 $\pm$ 0.0380[N/m]  \\ \hline
\end{tabular}
\caption{The spring constant}
\end{table}

For the relative uncertainty are all very small,
the experiment in this part is very accurate.

By theory, we can calculate $k_3$, i.e. the $k$ of the spring serial by
$$ k_{3,theory} = \frac{k_1 \cdot k_2 }{k_1 + k_2} =  1.1629 $$

Compared with $k_3 = 1.1649$  from the experiment,
$$ u_{k_{3,theory},k_3} = \frac{1.1649 - 1.1629}{1.1629} \cdot 100 \%  = 0.17 \% $$
The theory data is close to the experiment data.

The accurate experimental results prove that Hooke’s Law.

\subsection{Relation between the period $T$ and the mass $M$}

From curve fitting, we find that $T^2$  is linearly dependent with $M$
The slope is shown below:

\begin{table}[H]
\centering
\begin{tabular}{|c|c|}
horizontal  &  8.3233 $\pm$  0.2235 [s2/kg] \\ \hline
incline 1   &  8.4380 $\pm$  0.0500 [s2/kg] \\ \hline
incline 2   &  8.3467 $\pm$  0.2185 [s2/kg] \\ \hline
\end{tabular}
\caption{Slope}
\end{table}

We find the slopes of three cases are very close to each other,
so the ratio between $T^2$ and $M$  are independent of the incline degree of the air track.
We see all the relative errors are very small,
thus the result in this part is very accurate.

\subsection{The relation between $T$ and  $A$}

From the failed fitting curve, we find there is no clear linear relation between $T$ and $A$.
Thus, we can conclude that $T$ is independent of $A$.

\subsection{Relation between $ v_{\max}$ and $A$}

From the fitting curve we find that  $v_{\max}^2$ and $A^2$ is linearly dependent.
And
$$ k =   23.6964 \pm 0.3300  $$
$$ u_{k,r} = 1.39 \% $$

The relative uncertainty of the experimental ratio is $1.39\%$,
which is moderate.
Thus the result is quite precise.
Still, $v_{\max}^2$ is more easily affected by the friction force, so the relative uncertainty is quite large.


% !TeX root = ../thuthesis-example.tex

% Input your chapter title here
\chapter{ADVERSARIAL ATTACKS ON IMAGES}
\label{sec:ima}

Since the policy attacks included in this thesis work by perturbing the image observations given in input to the victim policies, this chapter reviews some of the most common image attacks, their threat model and introduces some common defense methods to counter them.

\section{Adversarial attacks on images}
Since the advent of deep convolutional networks used for image classification \cite{NIPS2012_4824}, the computer vision field has been subjected to many important breakthroughs with the aim to further improve the classification accuracy obtained on many images classification tasks \cite{he2015deep} \cite{zhang2020resnest}. However, despite their high accuracy, those models lack robustness since they can be easily deceived by adversarial examples \cite{goodfellow2014explaining}. More formally, an adversarial example is a \textit{sample input data that has been modified very slightly in a way that is intended to cause a machine learning classifier to misclassify it} \cite{kurakin2016adversarial}. In fact, to be effective, an adversarial example should be misclassified by deep learning models, but not by the human brain. Therefore, only small changes can be made to the original input image \textit{x} (legitimate example) to craft the adversarial example \(x_{adv}\)=\textit{x}+\(\delta\), where \(\delta\) is also known as adversarial noise. The distance introduced by the noise between \textit{x} and \(x_{adv}\) is usually defined by the \(l_{p}\) norm of the difference between the original and the adversarial sample for some p=0,..,\(\infty\). Hence, an adversarial example \(x_{adv}\) has to satisfy the constraint \(||x_{adv}-x||_p\leq \epsilon\) (adversarial constraint), where smaller \(\epsilon\) values correspond to smaller input perturbations, thus leading to less perceptible changes under the condition that \(x_{adv}\) is misclassified. Moreover, images adversarial attacks can be designed to achieve two different goals:
\begin{itemize}
    \item \textbf{Untargeted}: Untargeted attacks aim at making the model predict any class different from the correct one without targeting at any desired class. Formally speaking, given a classifier \textit{f} and the true label \textit{y}, an adversarial example would cause \(f(x_{adv})\neq y\). Hence, untargeted attacks' goal consists of maximizing the loss of the attacked model respect to the true label \(y\), namely, \(\max \: L(x_{adv}, y)\), under the assumption \(||x_{adv}-x||_p\leq \epsilon\). Given the relaxed constraints the adversarial examples are subjected to, these kinds of attacks are usually easier to perform.
    \item \textbf{Targeted}: Conversely, targeted attacks try to mislead the model's prediction toward a specific class \textit{y'}, that is, \(f(x_{adv})=y'\), where \(y'\neq y\). The loss function can then be formulated as \(\min L(x_{adv}, y')\) always under adversarial constraints. In this way, given the input \(x_{adv}\), it will be more likely that the attacked model would predict the target class \(y'\) rather than any other class. More sophisticated policy attacks usually require crafting adversarial observation in a targeted way so to force the victim agent to perform some required actions.
\end{itemize}
For example, if we want an agent simply to have its performance degraded, attacking under untargeted settings would be enough since preventing it to take the best action would naturally lower its total earned reward. However, if our goal is to control the agent by making it choose some predefined actions such as to lead it to a particular state, then adversarial attacks should be performed under targeted settings. Finally, adversarial attacks are also divided into two main categories depending on how much information is available regarding the model under attack:
\begin{itemize}
    \item \textbf{White-box attacks}: Under this setting, the adversary has full access and knowledge of the model, that is, the architecture of the model, its parameters, gradients, and loss respect to the input as well as possible defense mechanisms are known to the attacker \cite{goodfellow2014explaining}. Thus, it is not particularly difficult to attack models under this condition, and common methods exploit model's output gradients to generate adversarial examples. Only attacks belonging to this category have been evaluated in this work.
    \item \textbf{Black-box attacks}: In this category of attacks, the adversary has zero or very little knowledge about the model. Thus existing methods often rely on training a similar model or an ensemble of them. These methods work because, generally, adversarial examples that fool one model are likely to fool another similar model. Furthermore, in practice, this is the most likely kind of attack, since, in normal circumstances, attackers don't have the possibility to access much of the models' knowledge. Other methods exploit knowledge about the accuracy of the prediction or only the label to craft adversarial examples \cite{wiel2017decisionbased}.
\end{itemize}
Both white and black-box attacks are possible when attacking DRL algorithms and it depends on how much knowledge is known regarding the network defining the policy of the agents. Conversely, adversarial defenses aim to protect deep learning models from adversarial attacks, namely, making models more robust against adversarial examples. In this context, research on adversarial robustness resembles a minimax game where attackers constantly try to exploit more powerful techniques to fool deep learning models while, at the same time, defenders have to invent new defense methods to guard against these malicious attacks.

\subsection{Generating adversarial examples}
In the next sections, have been reported some of the most common white-box attacks on images that are often also used to attack DRL agents. Moreover, these methods can also be used to attack images under black-box settings by crafting adversarial examples attacking similar models and then exploiting the transferability propriety of the adversarial examples to fool the target model \cite{dong2017boosting} or they can be directly applied to perform black-box attacks after estimating gradients by querying the target model \cite{Chen_2017}.

\subsection{FGSM}
Fast Gradient Sign Method (FGSM) \cite{goodfellow2014explaining} is a basic one-step gradient-based approach that is able to find an adversarial example in a single step by maximizing the loss function \( L(x_{adv}, y)\) with respect to the input \(x\) and then adding back the sign of the output gradients to \(x\) so to produce the adversarial example \(x_{adv}\)
\begin{equation}
x_{adv}=x+\epsilon \cdot sign(\nabla_x L(x, y)),
\end{equation}
where \(\nabla_x L(x, y)\) is the gradient of the loss respect to the input \(x\), and the equation is expected to meet the \(l_{\infty}\) norm bound by design. This method works because adding a perturbation to the legitimate input such to maximize its loss respect to the correct label \textit{y} decreases the likelihood that \textit{y} could be predicted given the input \(x_{adv}\). Mathematically, it moves the adversarial example in one direction toward the border between the true class and some other class \cite{dong2017boosting}. This method is sometimes implemented without the {\it sign} operator (FGM) and it yields similar results to the version with sign \cite{agarwal2018explainable}.

\subsection{I-FGSM}
Basic iterative methods \cite{kurakin2016adversarial} iteratively apply FGSM with a small step size \(\alpha\). Thus, the iterative version of FGSM (I-FGSM) can be expressed as
\begin{equation}
x_{adv}^{t+1}=x_{adv}^{t}+\epsilon \cdot \alpha \cdot sign(\nabla_x L(x_{adv}^{t}, y)),
\end{equation}
where \(x_{adv}^{0}=x\) is the legitimate example. There are several ways to make the adversarial example satisfy the norm bound. For example, \(x_{adv}\) could be clipped into the \(\epsilon\) vicinity of x or set \(\alpha=\epsilon/T\) with \(T\) being the number of iterations. \cite{kurakin2016adversarial} proved that iterative methods exploit much finer perturbations which do not destroy the image even with higher \(\epsilon\) and at the same time confuse the classifier with a higher rate. Their drawback is that iterative methods are a little bit slower than their one-step counterparts.
%, and more importantly, they show poor performance on transferability, which is a fundamental propriety in black-box attacks.

\subsection{MI-FGSM}
Momentum iterative gradient-based methods \cite{dong2017boosting} integrate momentum into iterative fast gradient method to generate adversarial examples satisfying the \(l_{p}\) norm bound. Traditionally, momentum is a technique for accelerating gradient descent algorithms by accumulating a velocity vector in the gradient direction of the loss function across iterations. However, this concept can also be applied to generate adversarial examples and obtain tremendous benefits. As it was for the learning rate update, the first step consists of updating the momentum \(g_t\) by accumulating the velocity vector in the gradient direction as
\begin{equation}
g_{t+1}=\mu \cdot g_{t} + \frac{\nabla_x L(f(x, y)}{||\nabla_x L(x, y)||_p},
\end{equation}
where \(\mu\) is a decay factor. Next, the adversarial example \(x_{adv}^{t}\) is perturbed in the direction of the sign of \(g_{t}\) with a step size \(\alpha\) as
\begin{equation}
x_{adv}^{t+1}=x_{adv}^{t}+\alpha \cdot sign(g_{t+1}).
\end{equation}
In each iteration, the current gradient \(\nabla_x L(x, y)\) is normalized by the \(l_{p}\) distance of itself because the authors noticed that the scale of the gradients in different iterations varies in magnitude.

\subsection{PGD}
Projected gradient descent (PGD) \cite{madry2019deep} is another iterative algorithm that exploits projected gradient descend to iteratively craft adversarial examples as:
\begin{equation}
x_{adv}^{t+1}=\pi_{x+S}(x_{adv}^{t} +\alpha \cdot sign(\nabla_x L(x_{adv}^{t}, y))),
\end{equation}
where S is the set of all the allowed perturbations. Projected gradient descent performs one step of standard gradient descent, and then clips all the coordinates to be within the \(l_p\) ball. Moreover, in order to explore a large part of the loss landscape, the algorithm is restarted from many points within the \(l_p\) ball around data points taken from the evaluation set. Thanks to this large number of observations, the authors realized that all the local maxima found by PGD have similar loss values, both for normally trained networks and for adversarially trained networks, thus pointing out that robustness against the PGD adversary yields robustness against all first-order adversaries such as SGD based attacks. This conclusion also leads to the fact that as long as the adversary only uses gradients of the loss function with respect to the input, it will not find significantly better local maxima than PGD.

\subsection{C\&W}
The method proposed by Carlini \& Wagner \cite{carlini2016evaluating} relies on the initial formulation of adversarial example and formally defines the problem of finding an adversarial instance for an image \textit{x} as a minimization problem of a continuous function:
\begin{equation} \label{eq:CW}
\min \: ||\delta||_p+c \cdot L(x+\delta, y),
\end{equation}
under the condition that \((x+\delta)\in [0,1]^n\). The function \(f\) is an objective function such that \(L(x+\delta, y)\neq y\) if and only if \(L(x+\delta, y)<=0\). Finally, the term \textit{c} is a suitable chosen hyper-parameter. Moreover, to ensure that the modification yields a valid image, the adversarial noise \(\delta\) is constrained such that \(0\leq x_i+\delta_i\leq 1 \: \forall i\) (here assuming image pixels to be in the range [0,1]). One way to do it, is to replace \((x+\delta)\) with \((1+\tanh(w))/2\) so that the optimization problem in (\ref{eq:CW}) becomes an unconstrained minimization problem in \textit{w}.

\section{Defending against adversarial examples}
Extensive research in developing effective defense mechanisms in order to build robust models and safeguard them against adversarial attacks has also been conducted. One very promising technique is robust training which aims to make a classifier robust against small internal perturbations. Some possible strategies are based on adversarial training by adding generated adversarial examples to the training data \cite{goodfellow2014explaining}, defensive distillation which consists of retraining a network using previously generated soft-labels \cite{papernot2016distillation}, or another technique consists of training robust models with regularization such to train the defended model to ignore small perturbations \cite{hein2017formal}. Another category of defense methods that we are going to examine consists of input transformation. This method is not applied during training but only during inference by transforming the inputs right before feeding them to the classifier with the aim to make adversarial perturbations less effective.

\subsection{Adversarial training}
Adversarial training (AT) is a very simple and intuitive defense method to protect a model against adversarial examples. The first step consists of generating adversarial examples using different attack methods on the target model. In the second step, these adversarial examples are merged to the original training set so to form an augmented training set and finally the target model is retrained on the augmented training set. When adversarial examples are crafted with PGD we have PGD-adversarial training which can train very robust deep networks but it is much more expensive than traditional training due to the iterative design of PGD. In contrast, FGSM-adversarial training is typically faster but less effective \cite{wong2020fast}.

\subsubsection{JPEG compression}
JPEG compression \cite{dziugaite2016study} is a simple input transformation method that converts each input image to JPEG before it is fed to the target network. It has been studied that compressing an image can partially remove possible adversarial perturbations and, at the same time, elude the human perception that no transformation has been applied. However, in practice, this method is not very effective since it degrades the performance of the model while not cleaning completely an image from all the adversarial perturbations. To remedy this problem, \cite{das2018shield} proposes to vaccinate a policy by retraining it on JPEG compressed images multiple times on multiple compression qualities, and use an ensemble of these models to get the final classification label.

\subsubsection{Feature squeezing}
Feature squeezing \cite{Xu_2018} is another input transformation method that reduces the search space available to an adversary by compressing different features vectors in the original space into a single sample. Digital computers usually represent images as an array of pixels each of them representing a specific color (RGB images) or a shadow of grey (greyscale images). Thus, reducing bit depth can reduce the space that an adversarial has to craft perturbations possibly limiting the drop in accuracy that this compression may lead to. For example, an 8-bit greyscale image provides \(2^8=256\) values for each pixel which if reduced to 5-bits we would have only \(2^5=32\) values for each pixel that could be changed to create an adversarial example.