%Deep neural networks (DNNs) have been demonstrated effective for approximating complex and high dimensional functions. In the data-driven inverse modeling, we use DNNs to substitute unknown physical relations, such as constitutive relations, in a physical system described by partial differential equations (PDEs). The coupled system of DNNs and PDEs enables describing complex physical relations while satisfying the physics to the largest extent. However, training the DNNs embedded in PDEs is challenging because input-output pairs of DNNs may not be available, and the physical system may be highly nonlinear, leading to an implicit numerical scheme. We propose an approach, physics constrained learning, to train the DNNs from sparse observations data that are not necessarily input-output pairs of DNNs while enforcing the PDE constraints numerically. Particularly, we present an efficient automatic differentiation based technique that differentiates through implicit PDE solvers. We demonstrate the effectiveness of our method on various problems in solid mechanics and fluid dynamics. Our PCL method enables learning a neural-network-based physical relation from any observations that are interlinked with DNNs through PDEs.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Beamer Presentation
% LaTeX Template
% Version 1.0 (10/11/12)
%
% This template has been downloaded from:
% http://www.LaTeXTemplates.com
%
% License:
% CC BY-NC-SA 3.0 (http://creativecommons.org/licenses/by-nc-sa/3.0/)
%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%----------------------------------------------------------------------------------------
%    PACKAGES AND THEMES
%----------------------------------------------------------------------------------------

\documentclass[usenames,dvipsnames]{beamer}
\usepackage{animate}
\usepackage{float}
\usepackage{bm}
\usepackage{mathtools}
\usepackage{extarrows}

\newcommand{\ChoL}{\mathsf{L}}
\newcommand{\bx}{\mathbf{x}}
\newcommand{\ii}{\mathrm{i}}
\newcommand{\bxi}{\bm{\xi}}
\newcommand{\bmu}{\bm{\mu}}
\newcommand{\bb}{\mathbf{b}}
\newcommand{\bA}{\mathbf{A}}
\newcommand{\bJ}{\mathbf{J}}
\newcommand{\bB}{\mathbf{B}}
\newcommand{\bM}{\mathbf{M}}

\newcommand{\by}{\mathbf{y}}
\newcommand{\bw}{\mathbf{w}}

\newcommand{\bX}{\mathbf{X}}
\newcommand{\bY}{\mathbf{Y}}
\newcommand{\bs}{\mathbf{s}}
\newcommand{\sign}{\mathrm{sign}}
\newcommand{\bt}[0]{\bm{\theta}}
\newcommand{\bc}{\mathbf{c}}
\newcommand{\bzero}{\mathbf{0}}
\renewcommand{\bf}{\mathbf{f}}
\newcommand{\bu}{\mathbf{u}}
\newcommand{\bv}[0]{\mathbf{v}}

\mode<presentation> {

% The Beamer class comes with a number of default slide themes
% which change the colors and layouts of slides. Below this is a list
% of all the themes, uncomment each in turn to see what they look like.

%\usetheme{default}
%\usetheme{AnnArbor}
%\usetheme{Antibes}
%\usetheme{Bergen}
%\usetheme{Berkeley}
%\usetheme{Berlin}
%\usetheme{Boadilla}
%\usetheme{CambridgeUS}
%\usetheme{Copenhagen}
%\usetheme{Darmstadt}
%\usetheme{Dresden}
%\usetheme{Frankfurt}
%\usetheme{Goettingen}
%\usetheme{Hannover}
%\usetheme{Ilmenau}
%\usetheme{JuanLesPins}
%\usetheme{Luebeck}
\usetheme{Madrid}
%\usetheme{Malmoe}
%\usetheme{Marburg}
%\usetheme{Montpellier}
%\usetheme{PaloAlto}
%\usetheme{Pittsburgh}
%\usetheme{Rochester}
%\usetheme{Singapore}
%\usetheme{Szeged}
%\usetheme{Warsaw}

% As well as themes, the Beamer class has a number of color themes
% for any slide theme. Uncomment each of these in turn to see how it
% changes the colors of your current slide theme.

%\usecolortheme{albatross}
\usecolortheme{beaver}
%\usecolortheme{beetle}
%\usecolortheme{crane}
%\usecolortheme{dolphin}
%\usecolortheme{dove}
%\usecolortheme{fly}
%\usecolortheme{lily}
%\usecolortheme{orchid}
%\usecolortheme{rose}
%\usecolortheme{seagull}
%\usecolortheme{seahorse}
%\usecolortheme{whale}
%\usecolortheme{wolverine}

%\setbeamertemplate{footline} % To remove the footer line in all slides uncomment this line
%\setbeamertemplate{footline}[page number] % To replace the footer line in all slides with a simple slide count uncomment this line

%\setbeamertemplate{navigation symbols}{} % To remove the navigation symbols from the bottom of all slides uncomment this line
}
\usepackage{booktabs}
\usepackage{makecell}
\usepackage{soul}
\newcommand{\red}[1]{\textcolor{red}{#1}}
%
%\usepackage{graphicx} % Allows including images
%\usepackage{booktabs} % Allows the use of \toprule, \midrule and \bottomrule in tables
%
%
%\usepackage{amsthm}
%
%\usepackage{todonotes}
%\usepackage{floatrow}
%
%\usepackage{pgfplots,algorithmic,algorithm}
\usepackage{algorithmicx}
\usepackage{algpseudocode}
%\usepackage[toc,page]{appendix}
%\usepackage{float}
%\usepackage{booktabs}
%\usepackage{bm}
%
%\theoremstyle{definition}
%
\newcommand{\RR}[0]{\mathbb{R}}
%
%\newcommand{\bx}{\mathbf{x}}
%\newcommand{\ii}{\mathrm{i}}
%\newcommand{\bxi}{\bm{\xi}}
%\newcommand{\bmu}{\bm{\mu}}
%\newcommand{\bb}{\mathbf{b}}
%\newcommand{\bA}{\mathbf{A}}
%\newcommand{\bJ}{\mathbf{J}}
%\newcommand{\bB}{\mathbf{B}}
%\newcommand{\bM}{\mathbf{M}}
%\newcommand{\bF}{\mathbf{F}}
%
%\newcommand{\by}{\mathbf{y}}
%\newcommand{\bw}{\mathbf{w}}
%\newcommand{\bn}{\mathbf{n}}
%
%\newcommand{\bX}{\mathbf{X}}
%\newcommand{\bY}{\mathbf{Y}}
%\newcommand{\bs}{\mathbf{s}}
%\newcommand{\sign}{\mathrm{sign}}
%\newcommand{\bt}[0]{\bm{\theta}}
%\newcommand{\bc}{\mathbf{c}}
%\newcommand{\bzero}{\mathbf{0}}
%\renewcommand{\bf}{\mathbf{f}}
%\newcommand{\bu}{\mathbf{u}}
%\newcommand{\bv}[0]{\mathbf{v}}

\AtBeginSection[]
{
   \begin{frame}
       \frametitle{Outline}
       \tableofcontents[currentsection]
   \end{frame}
}

%----------------------------------------------------------------------------------------
%    TITLE PAGE
%----------------------------------------------------------------------------------------
\usepackage{bm}
\newcommand*{\TakeFourierOrnament}[1]{{%
\fontencoding{U}\fontfamily{futs}\selectfont\char#1}}
\newcommand*{\danger}{\TakeFourierOrnament{66}}

\title[Physics Constrained Learning]{Data-driven Inverse Modeling with Sparse Observation} % The short title appears at the bottom of every slide, the full title is only on the title page

\author[Kailai Xu, et al.]{Kailai Xu and Eric Darve\\ { Alexandre M. Tartakovsky, Jeff Burghardt, Dongzhuo Li, Jerry M. Harris, Weiqiang Zhu, Gregory C. Beroza} }% Your name
%\institute[] % Your institution as it will appear on the bottom of every slide, may be shorthand to save space
%{
%%ICME, Stanford University \\ % Your institution for the title page
%%\medskip
%%\textit{kailaix@stanford.edu}\quad \textit{darve@stanford.edu} % Your email address
%}
\date{}% Date, can be changed to a custom date
% Mathematics of PDEs

\newcommand\blfootnote[1]{%
  \begingroup
  \renewcommand\thefootnote{}\footnote{#1}%
  \addtocounter{footnote}{-1}%
  \endgroup
}
\begin{document}

\usebackgroundtemplate{%
\begin{picture}(0,250)
\centering
	{{\includegraphics[width=1.0\paperwidth]{../background}}}
\end{picture}
  }
%\usebackgroundtemplate{%
%  \includegraphics[width=\paperwidth,height=\paperheight]{figures/back}}
\begin{frame}

\titlepage % Print the title page as the first slide

\blfootnote{\scriptsize Full version: \url{https://kailaix.github.io/ADCME.jl/dev/assets/Slide/ADCME.pdf} }
%dfa
\end{frame}
\usebackgroundtemplate{}

\section{Inverse Modeling}

\begin{frame}
	\frametitle{Inverse Modeling}
	\begin{itemize}
		\item \textbf{Inverse modeling} identifies a certain set of parameters or functions with which the outputs of the forward analysis matches the desired result or measurement.
		\item Many real life engineering problems can be formulated as inverse modeling problems: shape optimization for improving the performance of structures, optimal control of fluid dynamic systems, etc.t
	\end{itemize}
	\begin{figure}[hbt]
	\centering
  \includegraphics[width=0.8\textwidth]{../inverse2}
\end{figure}
\end{frame}

\begin{frame}
	\frametitle{Inverse Modeling}
	\begin{figure}
	\centering
  \includegraphics[width=1.0\textwidth]{../inverse3}
\end{figure}
\end{frame}

\begin{frame}
	\frametitle{Inverse Modeling}
	We can formulate inverse modeling as a PDE-constrained optimization problem
	\begin{equation*}
		\min_{\theta} L_h(u_h) \quad \mathrm{s.t.}\; F_h(\theta, u_h) = 0
	\end{equation*}
	\begin{itemize}
		\item The \textcolor{red}{loss function} $L_h$ measures the discrepancy between the prediction $u_h$ and the observation $u_{\mathrm{obs}}$, e.g., $L_h(u_h) = \|u_h - u_{\mathrm{obs}}\|_2^2$.
		\item $\theta$ is the \textcolor{red}{model parameter} to be calibrated.
		\item The \textcolor{red}{physics constraints} $F_h(\theta, u_h)=0$ are described by a system of partial differential equations. Solving for $u_h$ may require solving linear systems or applying an iterative algorithm such as the Newton-Raphson method.
	\end{itemize}
\end{frame}

\begin{frame}
	\frametitle{Function Inverse Problem}

	\begin{equation*}
		\min_{\textcolor{red}{f}} L_h(u_h) \quad \mathrm{s.t.}\; F_h(\textcolor{red}{f}, u_h) = 0
	\end{equation*}

	What if the unknown is a \textcolor{red}{function} instead of a set of parameters?
\begin{itemize}
	\item Koopman operator in dynamical systems.
	\item Constitutive relations in solid mechanics.
	\item Turbulent closure relations in fluid mechanics.
	\item ...
\end{itemize}

The candidate solution space is \textcolor{red}{infinite dimensional}.

\end{frame}

\begin{frame}
	\frametitle{Physics Based Machine Learning}
	$$\min_{\theta} L_h(u_h) \quad \mathrm{s.t.}\;F_h(\textcolor{red}{NN_\theta}, u_h) = 0$$
	\vspace{-0.5cm}
	\begin{itemize}
		\item Deep neural networks exhibit capability of approximating high dimensional and complicated functions.
		\item \textbf{Physics based machine learning}: \textcolor{red}{the unknown function is approximated by a deep neural network, and the physical constraints are enforced by numerical schemes}.
		\item \textcolor{red}{Satisfy the physics to the largest extent}.
	\end{itemize}
	\begin{figure}[hbt]
  \includegraphics[width=0.75\textwidth]{../physics_based_machine_learning.png}
\end{figure}
\end{frame}

\begin{frame}
	\frametitle{Gradient Based Optimization}
	\begin{equation}\label{equ:opt}
		\min_{\theta} L_h(u_h) \quad \mathrm{s.t.}\; F_h(\theta, u_h) = 0
		\end{equation}

	\begin{itemize}
		\item We can now apply a gradient-based optimization method to (\ref{equ:opt}).
		\item The key is to \textcolor{red}{calculate the gradient descent direction} $g^k$
		$$\theta^{k+1} \gets \theta^k - \alpha g^k$$
	\end{itemize}

	\begin{figure}[hbt]
	\centering
  \includegraphics[width=0.6\textwidth]{../im.pdf}
\end{figure}

\end{frame}

\section{Automatic Differentiation}

\begin{frame}
	\frametitle{Automatic Differentiation}
The fact that bridges the \textcolor{red}{technical} gap between machine learning and inverse modeling:
	\begin{itemize}
		\item Deep learning (and many other machine learning techniques) and numerical schemes share the same computational model: composition of individual operators.
	\end{itemize}

\begin{minipage}[b]{0.4\textwidth}

\begin{center}
\textcolor{red}{Mathematical Fact}

\

	Back-propagation

$||$

Reverse-mode

 Automatic Differentiation

$||$

 Discrete

 Adjoint-State Method
\end{center}
\end{minipage}~
\begin{minipage}[b]{0.6\textwidth}
\begin{figure}[hbt]
\centering
  \includegraphics[width=0.8\textwidth]{../compare-NN-PDE.png}
\end{figure}
\end{minipage}

\end{frame}

\begin{frame}
	\frametitle{Computational Graph for Numerical Schemes}

	\begin{itemize}
		\item To leverage automatic differentiation for inverse modeling, we need to express the numerical schemes in the ``AD language'': computational graph.
		\item No matter how complicated a numerical scheme is, it can be decomposed into a collection of operators that are interlinked via state variable dependencies.
	\end{itemize}

	\begin{figure}[hbt]
  \includegraphics[width=1.0\textwidth]{../cgnum}
\end{figure}

\end{frame}

%\begin{frame}
%	\frametitle{Code Example}
%	\begin{itemize}
%		\item  Find $b$ such that $u(0.5)=1.0$ and
%		$$-bu''(x)+u(x) = 8 + 4x - 4x^2, x\in[0,1], u(0)=u(1)=0$$
%	\end{itemize}
%	\begin{figure}[hbt]
%  \includegraphics[width=0.8\textwidth]{../code.png}
%\end{figure}
%\end{frame}

\section{Physics Constrained Learning}
\begin{frame}

	\frametitle{Challenges in AD}

	\begin{minipage}[t]{0.49\textwidth}
	\vspace{-3cm}
\begin{itemize}
	\item Most AD frameworks only deal with \textcolor{red}{explicit operators}, i.e., the functions that has analytical derivatives, or composition of these functions.
	\item Many scientific computing algorithms are \textcolor{red}{iterative} or \textcolor{red}{implicit} in nature.
\end{itemize}
\end{minipage}~
\begin{minipage}[t]{0.49\textwidth}
  \includegraphics[width=1.0\textwidth]{../sim.png}
\end{minipage}

	% Please add the following required packages to your document preamble:
% \usepackage{booktabs}
\begin{table}[]
\begin{tabular}{@{}lll@{}}
\toprule
Linear/Nonlinear & Explicit/Implicit & Expression   \\ \midrule
Linear           & Explicit          & $y=Ax$       \\
Nonlinear        & Explicit          & $y = F(x)$   \\
\textbf{Linear}           & \textbf{Implicit}          & $Ay = x$     \\
\textbf{Nonlinear}        & \textbf{Implicit}          & $F(x,y) = 0$ \\ \bottomrule
\end{tabular}
\end{table}
\end{frame}

\begin{frame}
	\frametitle{Example}

\begin{itemize}
	\item Consider a function $f:x\rightarrow y$, which is implicitly defined by
	$$F(x,y) = x^3 - (y^3+y) = 0$$
If not using the cubic formula for finding the roots, the forward computation consists of iterative algorithms, such as the Newton's method and bisection method
\end{itemize}

\begin{minipage}[t]{0.48\textwidth}
\centering
\begin{algorithmic}
\State $y^0 \gets 0$
\State $k \gets 0$
\While {$|F(x, y^k)|>\epsilon$}
\State $\delta^k \gets F(x, y^k)/F'_y(x,y^k)$
\State $y^{k+1}\gets y^k - \delta^k$
\State $k \gets k+1$
\EndWhile
\State \textbf{Return} $y^k$
\end{algorithmic}
\end{minipage}~
\begin{minipage}[t]{0.48\textwidth}
\centering
\begin{algorithmic}
\State $l \gets -M$, $r\gets M$, $m\gets 0$
\While {$|F(x, m)|>\epsilon$}
\State $c \gets \frac{a+b}{2}$
\If{$F(x, m)>0$}
\State $a\gets m$
\Else
\State $b\gets m$
\EndIf
\EndWhile
\State \textbf{Return} $c$
\end{algorithmic}

\end{minipage}

\end{frame}

\begin{frame}
	\frametitle{Example}

	\begin{itemize}
		%		\item A simple approach is to save part or all intermediate steps, and ``back-propagate''. This approach is expensive in both computation and memory\footnote{Ablin, Pierre, Gabriel Peyr�, and Thomas Moreau. ``Super-efficiency of automatic differentiation for functions defined as a minimum.''}.
		%		\item Nevertheless, the simple approach works in some scenarios where accuracy or cost is not an issue, e.g., automatic differetiation of soft-DTW and Sinkhorn distance.
		\item An efficient way to do automatic differentiation is to apply the \textcolor{red}{implicit function theorem}. For our example, $F(x,y)=x^3-(y^3+y)=0$; treat $y$ as a function of $x$ and take the derivative on both sides
		      $$3x^2 - 3y(x)^2y'(x)-y'(x)=0\Rightarrow y'(x) = \frac{3x^2}{3y^2+1}$$
		      The above gradient is \textcolor{red}{exact}.
	\end{itemize}
	\begin{center}
		\textbf{Can we apply the same idea to inverse modeling?}
	\end{center}

\end{frame}

\begin{frame}
	\frametitle{Example}

	\begin{itemize}
%		\item A simple approach is to save part or all intermediate steps, and ``back-propagate''. This approach is expensive in both computation and memory\footnote{Ablin, Pierre, Gabriel Peyré, and Thomas Moreau. ``Super-efficiency of automatic differentiation for functions defined as a minimum.''}.
%		\item Nevertheless, the simple approach works in some scenarios where accuracy or cost is not an issue, e.g., automatic differetiation of soft-DTW and Sinkhorn distance.
		\item An efficient way is to apply the \textcolor{red}{implicit function theorem}. For our example, $F(x,y)=x^3-(y^3+y)=0$, treat $y$ as a function of $x$ and take the derivative on both sides
		$$3x^2 - 3y(x)^2y'(x)-1=0\Rightarrow y'(x) = \frac{3x^2-1}{3y(x)^2}$$
	The above gradient is \textcolor{red}{exact}.
	\end{itemize}
	\begin{center}
			\textbf{Can we apply the same idea to inverse modeling?}
	\end{center}

\end{frame}

\begin{frame}
	\frametitle{Physics Constrained Learning}
	$${\small    \min_{\theta}\; L_h(u_h) \quad \mathrm{s.t.}\;\; F_h(\theta, u_h) = 0}$$
	\begin{itemize}
		\item Assume that we solve for $u_h=G_h(\theta)$ with $F_h(\theta, u_h)=0$, and then
		      $${\small\tilde L_h(\theta)  = L_h(G_h(\theta))}$$
		\item Applying the \textcolor{red}{implicit function theorem}
		      {  \scriptsize
			      \begin{equation*}
				      \frac{{\partial {F_h(\theta, u_h)}}}{{\partial \theta }} + {\frac{{\partial {F_h(\theta, u_h)}}}{{\partial {u_h}}}}
				      \textcolor{red}{\frac{\partial G_h(\theta)}{\partial \theta}}
				      = 0 \Rightarrow
				      \textcolor{red}{\frac{\partial G_h(\theta)}{\partial \theta}} =  -\Big( \frac{{\partial {F_h(\theta, u_h)}}}{{\partial {u_h}}} \Big)^{ - 1} \frac{{\partial {F_h(\theta, u_h)}}}{{\partial \theta }}
			      \end{equation*}
		      }
		\item Finally we have
			      {\scriptsize
				      \begin{equation*}
					      \boxed{\frac{{\partial {{\tilde L}_h}(\theta )}}{{\partial \theta }}
					      = \frac{\partial {{ L}_h}(u_h )}{\partial u_h}\frac{\partial G_h(\theta)}{\partial \theta}=
					      - \textcolor{red}{ \frac{{\partial {L_h}({u_h})}}{{\partial {u_h}}} } \;
					      \textcolor{blue}{ \Big( {\frac{{\partial {F_h(\theta, u_h)}}}{{\partial {u_h}}}\Big|_{u_h = {G_h}(\theta )}} \Big)^{ - 1} } \;
					      \textcolor{ForestGreen}{ \frac{{\partial {F_h(\theta, u_h)}}}{{\partial \theta }}\Big|_{u_h = {G_h}(\theta )} }
					      }
				      \end{equation*}
			      }

	\end{itemize}

\end{frame}

\section{Applications}

%\begin{frame}
%	\frametitle{ADSeismic.jl: A General Approach to Seismic Inversion}
%	\begin{itemize}
%		\item Many seismic inversion problems can be solved within a unified framework.
%	\end{itemize}
%	\begin{figure}[hbt]
%  \includegraphics[width=1.0\textwidth]{../adseimic.jpeg}
%\end{figure}
%
%\end{frame}
%
%\begin{frame}
%	\frametitle{ADSeismic.jl: Earthquake Location Example}
%	\begin{itemize}
%		\item The earthquake source function is parameterized by ($g(t)$ and $x_0$ are unknowns)
%		$$f(x, t) =  \frac{g(t)}{2\pi \sigma^2} \exp \left( -\frac{||x - x_0||^2}{2 \sigma^2} \right)$$
%	\end{itemize}
%	\begin{figure}[hbt]
%  \includegraphics[width=1.0\textwidth]{../source_time}
%\end{figure}
%\end{frame}
%
%
%\begin{frame}
%	\frametitle{ADSeismic.jl: Benchmark}
%	\begin{itemize}
%		\item ADCME makes the heterogeneous computation capability of TensorFlow available for scientific computing.
%	\end{itemize}
%	\begin{figure}[hbt]
%  \includegraphics[width=0.7\textwidth]{../benchmark}
%\end{figure}
%\end{frame}

\begin{frame}
	\frametitle{FwiFlow.jl: Elastic Full Waveform Inversion for Subsurface Flow Problems}
	\begin{figure}[hbt]
  \includegraphics[width=0.8\textwidth]{../geo.png}
\end{figure}
\end{frame}

\begin{frame}
\frametitle{FwiFlow.jl: Fully Nonlinear Implicit Schemes}
\begin{itemize}
	\item The governing equation is a nonlinear PDE
\begin{minipage}[b]{0.48\textwidth}
{\scriptsize
	\begin{align*}
	&\frac{\partial }{{\partial t}}(\phi {{S_i}}{\rho _i}) + \nabla  \cdot ({\rho _i}{\mathbf{v}_i}) = {\rho _i}{q_i},\quad
      i = 1,2	\\
     & S_{1} + S_{2} = 1\\
      &{\mathbf{v}_i} = - \frac{{\textcolor{blue}{K}{\textcolor{red}{k_{ri}}}}}{{{\tilde{\mu}_i}}}(\nabla {P_i} - g{\rho _i}\nabla Z), \quad
      i=1, 2\\
	&k_{r1}(S_1) = \frac{k_{r1}^o S_1^{L_1}}{S_1^{L_1} + E_1 S_2^{T_1}}\\
	&k_{r2}(S_1) = \frac{ S_2^{L_2}}{S_2^{L_2} + E_2 S_1^{T_2}}
	\end{align*}
	}
\end{minipage}~\vline
\begin{minipage}[b]{0.48\textwidth}
\flushleft
	{\scriptsize \begin{eqnarray*}
 && \rho \frac{\partial v_z}{\partial t} = \frac{\partial \sigma_{zz}}{\partial z} + \frac{\partial \sigma_{xz}}{\partial x} \nonumber \\
 && \rho \frac{\partial v_x}{\partial t} = \frac{\partial \sigma_{xx}}{\partial x} + \frac{\partial \sigma_{xz}}{\partial z} \nonumber \\
 && \frac{\partial \sigma_{zz}}{\partial t} = (\lambda + 2\mu)\frac{\partial v_z}{\partial z} + \lambda\frac{\partial v_x}{\partial x} \nonumber \\
 && \frac{\partial \sigma_{xx}}{\partial t} = (\lambda + 2\mu)\frac{\partial v_x}{\partial x} + \lambda\frac{\partial v_z}{\partial z} \nonumber \\
 && \frac{\partial \sigma_{xz}}{\partial t} = \mu (\frac{\partial v_z}{\partial x} + \frac{\partial v_x}{\partial z}),
\end{eqnarray*}}
\end{minipage}

	\item For stability and efficiency, implicit methods are the industrial standards.
{\scriptsize	$$\phi (S_2^{n + 1} - S_2^n) - \nabla \cdot \left( {{m_{2}}(S_2^{n + 1})K\nabla \Psi _2^n} \right) \Delta t =
\left(q_2^n + q_1^n \frac{m_2(S^{n+1}_2)}{m_1(S^{n+1}_2)}\right)
\Delta t\quad m_i(s) = \frac{k_{ri}(s)}{\tilde \mu_i}
$$}
\end{itemize}

\end{frame}

\begin{frame}
	\frametitle{FwiFlow.jl: Showcase}
	\begin{itemize}
		\item Task 1: Estimating the permeability from seismic data
		\begin{center}
	B.C. +	\textcolor{red}{Two-Phase Flow Equation} + Wave Equation $\Rightarrow$ Seismic Data
	\end{center}
		\begin{figure}[hbt]
		\centering
  \includegraphics[width=0.6\textwidth]{../coupled}
\end{figure}
\item Task 2: Learning the rock physics model from sparse saturation data. The rock physics model is approximated by neural networks
{\scriptsize$$f_1(S_1; \theta_1) \approx k_{r1}(S_1)\qquad f_2(S_1; \theta_2) \approx k_{r2}(S_1)$$}
\vspace{-0.4cm}
\begin{figure}
	\centering
	\includegraphics[width=0.3\textwidth]{../sat}~
  \includegraphics[width=0.25\textwidth]{../rock}
\end{figure}
	\end{itemize}
\end{frame}

\begin{frame}
	\frametitle{FwiFlow.jl: Showcase}
	\begin{itemize}
		\item Task 3: Learning the \textcolor{red}{nonlocal} (space or time) hidden dynamics from seismic data. This is very challenging using traditional methods (e.g., the adjoint-state method) because the dynamics are history dependent.
	\end{itemize}
	\begin{center}
	B.C. +	\textcolor{red}{Time-/Space-fractional PDE} + Wave Equation $\Rightarrow$ Seismic Data
	\end{center}
\begin{table}[htpb]
\centering
\begin{tabular}{@{}lll@{}}
\toprule
Governing Equation & $\sigma=0$ & $\sigma=5$ \\ \midrule
${}_0^CD_t^{\textbf{0.8}}m = 10\Delta m $ & \makecell{$a/a^*\ =1.0000$ \\  $\quad\alpha\quad =\mathbf{0.8000}$} & \makecell{$a/a^*\ =0.9109$ \\  $\quad\alpha\quad =\mathbf{0.7993}$} \\ \hline
${}_0^CD_t^{\textbf{0.2}}m = 10\Delta m $ & \makecell{$a/a^*\ =0.9994$ \\  $\quad\alpha\quad =\mathbf{0.2000}$} & \makecell{$a/a^*\ =0.3474$ \\  $\quad\alpha\quad =\mathbf{0.1826}$}  \\   \bottomrule
$\frac{\partial m}{\partial t} = -10(-\Delta)^{\textbf{0.2}} m$ & \makecell{$a/a^*\ =1.0000$ \\   $\quad s\quad =\mathbf{0.2000}$} & \makecell{$a/a^*\ =1.0378$ \\   $\quad s\quad =\mathbf{0.2069}$} \\  \hline
$\frac{\partial m}{\partial t} = -10(-\Delta)^{\textbf{0.8}} m$ & \makecell{$a/a^*\ =1.0000$ \\   $\quad s\quad =\mathbf{0.8000}$} & \makecell{$a/a^*\ =1.0365$ \\   $\quad s\quad =\mathbf{0.8093}$}\\  \bottomrule
\end{tabular}
\end{table}

\end{frame}

\newcommand{\bsigma}[0]{\bm{\sigma}}
\newcommand{\bepsilon}[0]{\bm{\epsilon}}

\begin{frame}
	\frametitle{PoreFlow.jl: Inverse Modeling of Viscoelasticity}
%
	\begin{itemize}
		\item Multi-physics Interaction of Coupled Geomechanics and Multi-Phase Flow Equations
{\small
\begin{align*}
\mathrm{div}\bsigma(\bu) - b \nabla p &= 0\\
    \frac{1}{M} \frac{\partial p}{\partial t} + b\frac{\partial \epsilon_v(\bu)}{\partial t} - \nabla\cdot\left(\frac{k}{B_f\mu}\nabla p\right) &= f(x,t)	\\
    	\bsigma &= \bsigma(\bepsilon, \dot\bepsilon)
\end{align*}
}
\item Approximate the constitutive relation by a neural network
{\small
$$\bsigma^{n+1} = \mathcal{NN}_{\bt} (\bsigma^n, \bepsilon^n) + H\bepsilon^{n+1}$$}
	\end{itemize}
	\begin{figure}[hbt]
	\centering
  \includegraphics[width=0.5\textwidth]{../ip}~
  \includegraphics[width=0.3\textwidth]{../cell}
\end{figure}

\end{frame}

\begin{frame}
	\frametitle{PoreFlow.jl: Inverse Modeling of Viscoelasticity}

	\begin{itemize}
		\item Comparison with space varying linear elasticity approximation
		\begin{equation*}
			\bsigma = H(x, y) \bepsilon
		\end{equation*}
	\end{itemize}
	\begin{figure}[hbt]
  \includegraphics[width=1.0\textwidth]{../visco1}
\end{figure}

\end{frame}

\begin{frame}
	\frametitle{PoreFlow.jl: Inverse Modeling of Viscoelasticity}
	\begin{figure}[hbt]
  \includegraphics[width=0.7\textwidth]{../visco2}
\end{figure}

\end{frame}

\section{Some Perspectives}

\begin{frame}
	\frametitle{Scopes, Challenges, and Future Work}
	\textcolor{red}{\textbf{Physics based Machine Learning}}: an innovative approach to inverse modeling.
	{\scriptsize
	\begin{enumerate}
		\item Deep neural networks provide a novel function approximator that outperforms traditional basis functions in certain scenarios.
		\item Numerical PDEs are not on the opposite side of machine learning. By expressing the known physical constraints using numerical schemes and approximating the unknown with machine learning models, we combine the best of the two worlds, leading to efficient and accurate inverse modeling tools.
	\end{enumerate}
	}

		\textcolor{red}{\textbf{Automatic Differentiation}}: the core technique of physics based machine learning.
		{\scriptsize
		\begin{enumerate}
		\item The AD technique is not new; it has existed for several decades and many software exists.
		\item The advent of deep learning drives the development of robust, scalable and flexible AD software that leverages the high performance computing environment.
		\item As deep learning techniques continue to grow, crafting the tool to incorporate machine learning and AD techniques for inverse modeling is beneficial in scientific computing.
		\item However, AD is not a panacea. Many scientific computing algorithms cannot be directly translated to the AD language.
	\end{enumerate}
	}

\end{frame}

\begin{frame}
	\frametitle{ADCME}
	\begin{itemize}
	\item ADCME is the materialization of the physics based machine learning concept.
		\item ADCME allows users to use \textcolor{red}{high performance} and \textcolor{red}{mathematical friendly} programming language Julia to implement numerical schemes, and obtain the \textcolor{red}{comprehensive automatic differentiation functionality}, \textcolor{red}{heterogeneous computing capability}, \textcolor{red}{parallelism} and \textcolor{red}{scalability} provided by the TensorFlow backend.
	\end{itemize}
	\begin{center}
		\url{https://github.com/kailaix/ADCME.jl}
	\end{center}
	\vspace{-0.3cm}
	\begin{figure}[hbt]
  \includegraphics[width=1.0\textwidth]{../Julia.png}
\end{figure}
\end{frame}

\begin{frame}
	\frametitle{A General Approach to Inverse Modeling}
	\begin{figure}[hbt]
  \includegraphics[width=1.0\textwidth]{../summary.png}
\end{figure}
%
\end{frame}

%}
%\usebackgroundtemplate{}
%----------------------------------------------------------------------------------------
%    PRESENTATION SLIDES
%----------------------------------------------------------------------------------------

%------------------------------------------------

\end{document}


\documentclass[11pt]{article}

\usepackage{amsmath,amsthm,amsfonts,amssymb,xspace,graphicx,url,stmaryrd,parskip}

\newtheorem{lemma}{Lemma}

\newcommand\todo[1]{\textbf{[[TODO: #1]]}\xspace}
\def\F{\ensuremath{\mathbb{F}}}
\def\G{\ensuremath{\mathbb{G}}}
\def\Z{\ensuremath{\mathbb{Z}}}
\def\O{\ensuremath{O}}

\begin{document}
\title{The Ristretto and Cortado elliptic curve groups}
\author{Mike Hamburg\thanks{Rambus Security Division}}
\maketitle

\begin{abstract}
\end{abstract}

\section{Introduction}
\section{Definitions and notation}

Let the symbol $\bot$ denote failure.

\subsection{Field elements}
Let \F\ be a finite field of prime order $p$.  For an element $x\in\F$, let $\text{res}(x)$ be the integer representative of $x\in[0,p-1]$.  We call an element $x\in\F$ \textit{negative} if $\text{res}(x)$ is odd.  Call an element in \F\ \textit{square} if it is a quadratic residue, i.e.\ if there exists $\sqrt{x}\in\F$ such that $\sqrt{x}^2=x$.  There will in general be two such square roots; let the notation $\sqrt{x}$ mean the unique non-negative square root of $x$.  If $p\equiv1\pmod 4$, then \F\ contains an element $i := \sqrt{-1}$.

Let $\ell := \lceil \log_{2^8} p\rceil$.  Each $x\in\F$ has a unique \textit{little-endian byte representation}, namely the sequence
$$
\text{\F\_to\_bytes}(x) := \llbracket b_i\rrbracket_{i=0}^{\l-1} \ \text{where}\ b_i\in[0,255]\text{\ and\ }\sum_{i=0}^{\l-1} 2^{8i} \cdot b_i = \text{res}(x)
$$
\todo{bytes to \F}

\subsection{Groups}
For an abelian group \G\ with identity \O, let $n\G$ denote the subgroup of $\G$ which are of the form $n\cdot g$ for some $g\in\G$.  Let $\G_n$ denote the $n$-torsion group of \G, namely the subgroup $\{g\in\G : n\cdot g = O\}$.

\subsection{Edwards curves}
We will work with twisted Edwards elliptic curves of the form
%
$$E_{a,d} : y^2 + a\cdot x^2 = 1 + d\cdot x^2\cdot y^2$$
%
where $x,y\in\F$. Twisted Edwards curves curves have a group law
$$(x_1,y_1) + (x_2,y_2) :=
\left(
\frac{x_1 y_2 + x_2 y_1}{1+d x_1 x_2 y_1 y_2},
\frac{y_1 y_2 - a x_1 x_2}{1-d x_1 x_2 y_1 y_2}
\right)
$$
with identity point $\O := (0,1)$ and group inverse operation $$-(x,y) = (-x,y)$$
The group law is called \textit{complete} if is produces the correct answer (rather than e.g.\ $0/0$) for all points on the curve.  The above formulas are complete when $d$ and $ad$ are nonsquare in \F, which implies that $a$ is square.  When these conditions hold, we also say that the curve itself is complete.

Let the number of points on the curve be $$\#E_{a,d} = h\cdot q$$ where $q$ is prime and $h\in\{4,8\}$.  We call $h$ the \textit{cofactor}.

For $P = (x,y)\in E$, we can define the \textit{projective homogeneous form} of $P$ as $(X,Y,Z)$ with $Z\neq 0$ and $$(x,y) = (X/Z,Y/Z)$$ and the \textit{extended homogeneous form} as $(X,Y,Z,T)$ where additionally $XY=ZT$.  Extended homogeneous form is popular because it supports simple and efficient complete addition formulas~\cite{hisil}.

\subsection{Montgomery curves}

When $a-d$ is square in \F, the twisted Edwards curve $E_{a,d}$ is isomorphic to the Montgomery curve
$$v^2 = u\cdot\left(u^2 + 2\cdot\frac{a+d}{a-d}\cdot u + 1\right)$$
by the map
$$(u,v) = \left(\frac{1+y}{1-y},\ \ \frac{1+y}{1-y}\cdot\frac1x\cdot\frac{2}{\sqrt{a-d}}\right)$$
with inverse
$$(x,y) = \left(\frac{u}{v}\cdot\frac{\sqrt{a-d}}{2},\ \ \frac{u-1}{u+1}\right)$$

If $M = (u,v)$ is a point on the Montgomery curve, then the $u$-coordinate of $2M$ is $(u^2-1)^2 / (4v^2)$ is necessarily square.  It follows that if $(x,y)$ is a point on $E_{a,d}$, and $a-d$ is square, then $(1+y)/(1-y)$ is also square.

Likewhise, when $d-a$ is square in \F, $E_{a,d}$ is isomorphic to the Montgomery curve
$$v^2 = u\cdot\left(u^2 - 2\cdot\frac{a+d}{a-d}\cdot u + 1\right)$$
by the map
$$(u,v) = \left(\frac{y+1}{y-1},\ \ \frac{y+1}{y-1}\cdot\frac1x\cdot\frac{2}{\sqrt{d-a}}\right)$$
with inverse
$$(x,y) = \left(\frac{u}{v}\cdot\frac{\sqrt{d-a}}{2},\ \ \frac{1+u}{1-u}\right)$$

\section{Lemmas}
First, we characterize the 2-torsion and 4-torsion groups.\\
\begin{lemma}\label{lemma:tors}
Let $E_{a,d}$ be a complete Edwards curve.  Its 2-torsion subgroup is generated by $(0,-1)$.  The 4-torsion subgroup is generated by $(1/\sqrt{a},0)$.

Adding the 2-torsion generator to $(x,y)$ produces $(-x,-y)$.  Adding the 4-torsion generator $(1/\sqrt{a},0)$ produces $(y/\sqrt{a},-x\cdot\sqrt{a})$
\end{lemma}
\begin{proof}
Inspection.
\end{proof}

\begin{lemma}\label{lemma:line}
Let $E_{a,d}$ be a complete twisted Edwards curve over \F, and $P_1 = (x_1,y_1)$ be any point on it.  Then there are exactly two points $P_2 = (x_2,y_2)$ satisfying $x_1 y_2 = x_2 y_1$, namely $P_1$ itself and $(-x_1,-y_1)$.  That is, there are either 0 or 2 points on any line through the origin.
\end{lemma}
\begin{proof}
Plugging into the group operation gives
$$x_1 y_2 = x_2 y_1 \Longleftrightarrow P_1-P_2 = (0,y_3)$$
for some $y_3$.  Plugging $x=0$ into the curve equation gives $y=\pm1$, the 2-torsion points.  Adding back, we have $P_2 = P_1 + (0,\pm1) = (\pm x_1, \pm y_1)$ as claimed.
\end{proof}

\begin{lemma}\label{lemma:dma}
If $E_{a,d}$ is a complete Edwards curve, then $a^2-ad$ is square in \F\ (and thus $a-d$ is square in \F) if and only if the cofactor of $E_{a,d}$ is divisible by 8.
\end{lemma}
\begin{proof}
Doubling an 8-torsion generator $(x,y)$ should produce a 4-torsion generator, i.e.\ a point with $y=0$.  From the doubling formula, this happens precisely when $y^2=ax^2$, or $2ax^2=1+adx^4$.  This has roots in \F\ if and only if its discriminant $4a^2-4ad$ is square, so that $a^2-ad$ is square.
\end{proof}

\begin{lemma}\label{lemma:sqrt}
If $(x_2,y_2) = 2\cdot(x_1,y_1)$ is an even point in $E_{a,d}$, then $(1-ax_2^2)$ is a quadratic residue in \F.  \todo{$(y_2^2-1)$}.
\end{lemma}
\begin{proof}
The doubling formula has $$x_2 = \frac{2x_1 y_1}{y_1^2+ax_1^2}$$
so that $$1-ax_2^2 = \left(\frac{y_1^2-ax_1^2}{y_1^2+ax_1^2}\right)^2$$
is a quadratic residue.  Now for any point $(x,y)\in E_{a,d}$, we have
$$(y^2-1)\cdot(1-ax^2)
= y^2+ax^2-1-ax^2y^2
= (d-a)x^2y^2
$$
which is a quadratic residue by Lemma~\ref{lemma:dma}.
\end{proof}

\section{The Espresso groups}
Let $E$ be a complete twisted Edwards curve with $a\in\{\pm1\}$ and cofactor $4$ or $8$. We describe the \textit{Espresso} group $\G(E)$ as
$$\text{Espresso}(E) := 2E / E_{h/2}$$
This group has prime order $q$.
\subsection{Group law}
The group law on $\text{Espresso}(E)$ is the same as that on $E$.
\subsection{Equality}
Two elements $P_1 := (x_1,y_1)$ and $P_2 := (x_2,y_2)$ in $\text{Espresso}(E)$ are equal if they differ by an element of $E_{h/2}$.

If $h=4$, the points are equal if $P_1-P_2\in E_2$.  By Lemma~\ref{lemma:line}, this is equivalent to $$x_1 y_2 = x_2 y_1$$

If $h=8$, the points are equal if $P_1-P_2\in E_4$.  By Lemmas~\ref{lemma:tors} and~\ref{lemma:line}, this is equivalent to $$x_1 y_2 = x_2 y_1\text{\ \ or\ \ }x_1 x_2 = -a y_1 y_2$$

These equations are homogeneous, so they may be evaluated in projective homogeneous form with $X_i$ and $Y_i$ in place of $x_i$ and $y_i$

\subsection{Encoding}
We now describe how to encode a point $P = (x,y)$ to bytes.  The requirements of encoding are that
\begin{itemize}
\item Any point $P\in2E$ can be encoded.
\item Two points $P,Q$ have the same encoding if and only if $P-Q\in E_{h/2}$.
\end{itemize}

When $h=4$, we encode a point as $\sqrt{a(y-1)/(y+1)}$

\end{document}


\revise{}{
\section{Fabrication}
In order to accurately manufacture adaptive width toolpaths using an off-the-shelf 3D printing system,
we need a model which relates the required width to process parameters such as movement speed and filament extrusion speed.
A different approach might be appropriate depending on whether the filament feeder is mounted directly on the print head (a.k.a. \emph{direct drive}) or the filament fed from the back of the printer to the print head via a \emph{Bowden tube}.
Because Bowden style 3D printing systems have the filament feeder relatively far away from the nozzle, changing the internal pressure in the system requires a large amount of filament movement, which requires a prohibitive amount of time.

\subsection{Back pressure compensation}
Because changing the internal pressure is difficult in our setup,
we keep the internal pressure constant, and vary the movement speed instead.
%In order to accurately realize a varying bead width we vary the movement speed, while keeping the internal pressure in the system constant.
One approach would be\revise{}{ to} keep the filament inflow $f$ (in \si{\milli\meter\cubed\per\second}) constant by varying movement speed accordingly \cite{Kuipers2018}.
However, that doesn't result in the intended filament outflow variation - see \cref{zero_back_pressure}.
We conjecture that the filament outflow is related to the total pressure in the system,
which depends not only on the amount of filament in between the feeder wheel and the nozzle (which we keep constant),
but also depends on the back pressure that the previous layer exerts on the filament protruding from the nozzle.
The amount of back pressure is most likely monotonically related to the requested line width.
We compensate for the back pressure using a simple linear model:

\begin{align}
 v(w) &= \frac{f(w)}{h w} \\
% f &\sim p \\
% p &= p_\text{in} + p_\text{ext} \\
% p_\text{in} &= C \\
% p_\text{ext} &\sim w \\
% p_\text{ext} &= w / w^* - 1 \\
% f &= f^* - k p_\text{ext} \\
 f(w) &= f_0 - k \left( w / w_0 - 1 \right)
 % f_0 &= v_0 w_0 h
% v &= \frac{f^* - k p_\text{ext}}{h w} \\
% v &= \frac{v^* w^* h - k (w / w^* - 1)}{h w}
\end{align}
where
$v(w)$ is the movement speed as a function of requested bead width $w$,
$f(w)$ is the filament outflow,
$f_0$ is a constant reference flow,
$w_0$ is a constant reference bead width
and
$k$ is the amount of back pressure compensation.

% adapted from 5.5 Discussion on implications
% limitations of back pressure compensation
Our back pressure compensation method effectively changes the speed to realize adaptive width,
but this approach is limited, since the movement speed is constrained by acceleration considerations near bends in the toolpath~\cite{Ertay2018}.
Moreover, as the layer height is decreased the back pressure becomes larger compared to the internal pressure, which might cause the back pressure compensation method to demand prohibitively slow movement speeds.
Furthermore, the shape and filling of the previous layer might influence the amount of back pressure.
%
% direct drive & pressure advance
Accurate flow control can be further enhanced by using a direct drive hardware system and by employing \emph{pressure advance algorithms} which dynamically change the internal pressure \cite{tronvoll2019investigating}.
Conversely such a setup might benefit from some form of back pressure compensation as well.

\subsection{Print results}\label{print_results_section}
Using increments of $0.1$ we established that using a factor of $k=1.1$ yields satisfactory bead width variation for our setup where we use
$f_0 = v_0 w_0 h $
with
$v_0=\SI{30}{\milli\meter\per\second}$,
$w_0=\SI{0.4}{\milli\meter}$
and
$h=\SI{0.1}{\milli\meter}$.
See \cref{back_pressure}.
The fact that the printed lines are wider than intended is compensated for using a flow reduction to \SI{90}{\percent}.
%
Test prints were performed on an unmodified Ultimaker S5 system,
with a standard  \SI{0.4}{\milli\meter} nozzle
and PLA filament.
The printing order is determined greedily by choosing the closest point of a polygonal extrusion path, or the closest of either end point in case of an open polyline extrusion path.
Because the machine instructions file format \emph{G-code} doesn't natively support adaptive width beads,
we discretize adaptive width extrusions into \SI{0.2}{\milli\meter} long segments of the average width.
The print results can be viewed in \cref{prints}.

\begin{figure}
\centering
\setlength{\figwidth}{0.32\columnwidth}
\setlength{\figheight}{0.5\columnwidth}
\begin{subfigure}[t]{\figwidth}\centering
\includegraphics[angle=90,height=\figheight]{sources-validation-backpressure_0_0}
\caption{$k=0$}\label{zero_back_pressure}
\end{subfigure}
\begin{subfigure}[t]{\figwidth}\centering
\includegraphics[angle=90,height=\figheight]{sources-validation-backpressure_1_1}
\caption{$k=1.1$}\label{back_pressure}
\end{subfigure}
\begin{subfigure}[t]{\figwidth}\centering
\includegraphics[angle=90,height=\figheight]{sources-validation-backpressure_2_0}
\caption{$k=2.0$}\label{too_much_back_pressure}
\end{subfigure}
\caption{
Print results (black) of the varying width test on top of a dense white raft.
Target widths in green.
\subref{zero_back_pressure} Simple flow equalization without back pressure compensation results in nearly constant bead widths.
\subref{back_pressure} A value of $k=1.1$ seems to produce good results.
}
\label{back_pressure_compensation}
\end{figure}

% discussion of print results
In \cref{print_naive} the underfill problem of the naive uniform offset approach is most prevalent for the Ultimaker word mark, which negatively impacts the visual quality and the stiffness of the part.
Moreover, in the case of the spatially graded honeycomb\revise{}{,} there are several fully disconnected hexagons, which means the object falls apart when picked up.
The honeycomb print is also missing all parts which are slightly more thin than the preferred bead width $w^*$.
\Cref{print_center} still shows some underfill, but considerably less than the uniform approach.
These prints also exhibit dark regions where the translucency of the layer is less because the bead is higher.
This can be explained by inaccuracies in the back pressure compensation method, which arise for bead widths which deviate from the preferred width by a large amount.
\Cref{print_inward} diminishes the underfill nearly completely and the visual quality of these prints is more homogenous than those of the other methods.
Moreover, the absence of dark regions signifies that our proposed method is more robust against inaccuracies in the deposition system.
However, both the centered and inward distributed approach introduce transitions to a different bead count in the word `Delft', which reduces the dimensional accuracy on the outline around those locations.

\begin{figure}
\centering
\setlength{\figwidth}{\columnwidth}
\begin{subfigure}{\figwidth}\centering
\includegraphics[width=\figwidth]{sources-applications-result-prints-target}
\caption{Outlines}\label{print_outlines}
\end{subfigure}
\begin{subfigure}{\figwidth}\centering
\includegraphics[width=\figwidth]{sources-applications-result-prints-naive-bw.png}
\caption{Uniform}\label{print_naive}
\end{subfigure}
\begin{subfigure}{\figwidth}\centering
\includegraphics[width=\figwidth]{sources-applications-result-prints-center-bw.png}
\caption{Centered}\label{print_center}
\end{subfigure}
\begin{subfigure}{\figwidth}\centering
\includegraphics[width=\figwidth]{sources-applications-result-prints-inward-bw.png}
\caption{Inward distributed}\label{print_inward}
\end{subfigure}
\caption{
Test shapes printed using the uniform scheme, centered scheme and the inward distributed scheme.
The uniform technique produces distinct underfill areas.
The centered scheme shows some defects due to inaccurate control of extreme deposition widths.
The inward distributed scheme produces the least defects.
}
\label{prints}
\end{figure}

}


\documentclass[10pt, letterpaper]{article}
\usepackage[cm]{fullpage}
\usepackage{algpseudocode}
\usepackage{algorithm}
\usepackage{graphicx}
\usepackage[section]{placeins}
\usepackage[table]{xcolor}
\usepackage{amsmath}
\usepackage[margin=0.7in]{geometry}
\usepackage{comment}
\usepackage{wrapfig}
\usepackage[demo]{graphicx}

\algrenewcommand\Return{\State \algorithmicreturn{} }%

\title{Tetanus - A Batch GCD RSA Cracker}
\author{Daiwei Chen \and Cole Houston}
\date{\today}

\begin{document}
\maketitle

\begin{abstract}
RSA is a widely used system for modern public key cryptography. It can be extremely secure, but there are several ways in which it can be implemented poorly. One such way is through weak generation of keys. This can happen when the seed used in the generation of the keys is not entirely random, which is the weakness that our program exploits. If several keys have the same seed, it is possible to deduce one of the prime numbers contained in the private key from the public key.  From there, it is possible to recreate the entire private key that should never be seen by the public in a strong implementation of RSA.
\end{abstract}

\section{RSA}
Let's quickly go over RSA, how it is possible to break it. RSA is usually cryptographically secure due to the complexity and difficulty to factor very, very large prime numbers. However, within the Public Component of RSA contains $N$, a result of the product between two (usually) large primes $p$ and $q$. However, if one could efficiently calcualte $p$ and $q$ from $N$, then it will be possible to reconstruct a RSA Private key. \\
\\
This means it is possible to perform Man In the Middle attacks against the cracked RSA Private Key target. Decrypt TLS encrypted traffic, or even authenticate SSH using the public key as well. Essentially, you become your target.

\section{Batch GCD}

\begin{wrapfigure}{r}{0.5\textwidth}
  \begin{center}
    \includegraphics[width=0.48\textwidth]{batch-gcd-tree.png}
  \end{center}
  \caption{The Batch GCD Trees, being created and used.}
\end{wrapfigure}

Batch GCD is split into 3 main components: creation of the product tree, creation of the remainder tree, and finally, the GCD process.

\begin{enumerate}
\item Creation of the product tree. \\
  The base of the product tree is simply the RSA moduli. The product tree is created by multiplying 2 numbers to create a new layer, and keep multiplying every next 2 numbers together till you run out of numbers. On odd layers, simply add the final number to the end. Stop creating more layers until you reach the final number.
\item Creation of the remainder tree. \\
  The remainder tree is created by first using the final number of the product tree. Then, for each new layer, the $i/2$th product number in that layer is modded to with then $i$th number on the next layer of the product tree squared. This is a faster version of Batch-GCD, in the slower version, you simply create the final layer of the remainder tree by modding the final product tree number to each moduli.
\item Performing the GCD. \\
  Finally, for each moduli, find the GCD between each number on the final layer of the remainder tree divide by the modulus and the modulus itself.
\end{enumerate}

The complexity of Batch-GCD is $O(n(\lg{n})^2 \lg{\lg{n}})$ for the entire process.

\section{Reconstruction}
After vulnerable keys are identified by batch GCD, it is possible to reconstruct the RSA private key. $N$ is publicly available via the public key, and the batch GCD algorithm reveals either $p$ or $q$.  Since $N$ divided by $p$ will give you $q$, at this point all three numbers are available. The rest of the numbers needed for the private key are $e$, $d$, exponent 1, exponent 2, and coefficient.  $e$ can be found within the public key, so it is already available. $d$ can be calculated via an inverse modulus on (p-1)*(q-1). Exponent 1 can be found with d mod (p-1), and the second exponent is calculated the same way but with q rather than p. Lastly, the coefficient is found by (inverse of q) mod p. With those numbers, it is possible to reconstruct the entire RSA private key.

\section{Experimental Setup}
We have collected about 22,000 keys all together from 2 main sources for this project. First, we grabbed a datadump of about 10,000 moduli from a 2016 scan containing vulnerable moduli off the internet. Next, using a in-house tool tScanner, which performs TLS Handshakes with HTTPS servers to extract the certificate. Then, it extracts the public componet $N$ for Tetanus to attempt Batch-GCD cracking. The 12,000 keys were collected from about 2 entire days of scanning on one computer. The moduli are output by tScanner are all uniq, since duplicate moduli could raise a false positive for Tetanus.\\
\\
All moduli and gcd are saved and processed in hex. Within Rust, we used the Rug crate for arbitrary large number processing and math operations. The benchmark process is done on a single thread of an Intel i5-7200U (3.1 GHz), and 8 GB of ram with 8 GB of swap on SSD.

\section{Results}
\begin{figure}[htp]
  \begin{center}
    \includegraphics[scale=0.8]{batch-gcd-time.png}
    \caption{Results for n and t (in seconds)}
  \end{center}
\end{figure}

\section{Conclusions}
Batch-GCD works better with more keys, since there will be a higher chance of finding a GCD. However, network, memory, and storage is an issue; we simply just don't have enough time and resources to do a check of the entire IPv4 range. Once vulnerable keys are found, it is quick and easy to recreate the private key. Since it is not certain whether p or q is returned by Batch-GCD there are two possible private keys to reconstruct for each vulnerable key. Judging from the difference in the number of vulnerable keys found via the 2016 scan versus our 2019 scan there are fewer vulnerable keys in the world today. This is somewhat thanks to other exploits that have forced people to update their systems, but there are still several keys in the world that are vulnerable to the Batch-GCD attack.

\end{document}


\documentclass{standalone}

\begin{document}

\chapter*{Appendix D - Multi-Class Performances}\addcontentsline{toc}{chapter}{Appendix C - Multi-Class Performances}
\markboth{Appendix D}{Scorer}

\begin{center}
\begin{figure}[htbp]
\centering
\includegraphics[width=0.6\textwidth]{scorer_net.png}
\caption{Multi classes score interaction graph.
Each node identifies a different performance evaluator and the links are given by the interactions between mathematical formulations of each quantity.
The graph has more than 100 nodes and more than 200 links.
The node colors are given by the classes identified in the work of Sepand et al.~\cite{PyCM}.
}
\label{fig:scorer_net}
\end{figure}
\end{center}

The performances evaluation is a crucial task in any Machine Learning application.
Given a set of patterns and its corresponding (true) labels, we can evaluate the efficiency of a given model with a comparison between labels and model outputs, i.e the predicted labels.
There are a lot of different score functions that can be computed and each of them evaluates some aspects of the model efficiency.
Any paper author choses the score that better highlights the advantages of its model and it is difficult to move around this large zoo of indicators.
Moreover, (it is quite a constant in scientific research) when a paper is send to a peer-review, in many cases the reviewers suggest to check if other performance indicators are good enough for the showed results.
This means that a lot of large simulations should be performed again and the appropriate variables recomputed to obtain the required scores.

At this point the main question is: are these scores totally independent one from each other?
The brief answer is simply no.
In a very interesting work of Sepand et al.~\cite{PyCM} the authors show how we can compute a wide range of these scores starting from the evaluation of the simple confusion matrix\footnote{
  The confusion matrix is a square matrix of shapes $(N, N)$, with $N$ the total number of classes in the current problem, whose entries are the number of right and false classifications.
  In particular, each entry of the matrix represents the predicted instances in a given class.
  If the class is the right one we call it as true positive item.
  As counterpart we have a false positive item.
}, providing a full mathematical documentation and references about their numerical evaluations.

Despite the \textsf{Python} code provided by Sepand et al. explains these links between the mathematical quantities, they stop their analyses on the score evaluations, without any interest on the optimization of these computations.
Starting from their work we analyzed the inter-connections between these mathematical formulas and we extracted the dependencies between the involved variables.
In particular, a score function can be interpreted as a node and its connections could be given by the variables needed to evaluate it.
This type of graphs are commonly called \href{https://en.wikipedia.org/wiki/Factor_graph}{\emph{factor graphs}}.
In a mathematical formulation of \emph{factor graphs} there are different kinds of nodes (variables and factors, or equations).
The focus of our analysis was not on the mathematical formalism of these kinds of graphs, but we aimed to a visualization of function interactions and an analysis of the numerical improvements derived from it.

In the work of Sepand et al. the authors identify three function classes: common statistics, class statistics and overall statistics.
In Fig.~\ref{fig:scorer_net} the interaction graph of these three classes is shown.
The figure shows deep interactions between the three function classes and it highlights the dependencies of the different quantities involved.
We can also use this kind of visualization to formulate computational considerations about the order in which these quantities could be evaluated.
Since the graph is a direct graph by definition, we can start from the root node (the node without links which bring to it) and cross the network up to the leaf nodes (nodes without links which go out from them) like in a tree-graph (or more precisely a DAG, \emph{Direct Acyclic Graph}).
At each step of the percolation, the incoming nodes identify totally independent quantities.
This independence means that the node-quantities can be potentially computed in parallel.
To clarify this consideration we can reorganize the graph visualization minimizing the link lengths and obtaining a stratified graph in which each level identifies a potential parallel section.
A graph with these properties was obtained using the \textsf{dot} visualization and it is shown in Fig.~\ref{fig:scorer_parallel}.
As can be seen in the figure we can identify 7 levels in the graph and thus 7 potential parallel regions for the computation of the full set of functions.

\begin{center}
\begin{figure}[htbp]
\hspace{-2cm}
\includegraphics[width=1.3\textwidth]{scorer_parallel.pdf}
\caption{Re-organization of the graph in Fig.~\ref{fig:scorer_net}.
The rendering was obtained using the \textsf{dot} visualization, i.e the minimization of the link lengths.
The direct graph identifies the tree of dependencies and each level of the tree represents a set of independent functions that can be potentially computed in parallel.
This graph is used as parallel scheme for the \textsf{Scorer} library.
}
\label{fig:scorer_parallel}
\end{figure}
\end{center}

These considerations allow us to create an optimized version of the code of Sepand et al., the \textsf{Scorer} library~\cite{Scorer}.
The \textsf{Scorer} library is the \textsf{C++} porting of the \textsf{PyCM} library of Sepand et al. with a \textsf{Cython} wrap for the \textsf{Python} compatibility.
Following the above told graph, the computation of score quantities are performed in parallel according to the 7 levels found.
The parallelization strategy chosen uses the \textsf{section} keywords of OpenMP library to perform no-wait tasks that are computed by each thread of the parallel region.

The extracted graph includes more than 100 different quantities so writing the full set of parallel sections becomes an hard (and boring) work in \textsf{C++}.
Moreover, update the graph with new quantities brings to a consequential update of the full code and also of the parallelization strategy.
Each function was written as an anonymous-struct, i.e a functor, with an appropriate operator overloading.
Each functor has a name given by a pre-determined regex (\textsf{get\_\{function\}}) and the list of arguments follows the same nomenclature\footnote{
  If the functor receives in input the variable $A$ and $B$ we have to ensure that two functors named $get\_A$ and $get\_B$ will be provided.
  The only exception is given by the root functor.
}.
With these expedients we created a fully automated \textsf{Python} script which parses the list of functors, it computes the dependency graph and the parallelization levels and it gives back a compilable \textsf{C++} script with the desired characteristics.
In this way we can guarantee an easy way to update the library and moreover we overcome the boring writing of a long code.
The automatic creation script is provided in the \textsf{Scorer} library and it should be used at each pull request or version update.

For a pretty/useful visualization of the computed quantities we rendered the interaction graph in an HTML framework.
In this way we can insert with a CSS table the computed values in each node that can be discovered passing the mouse over the figure.
An example of this rendering is given in the on-line version of the library~\cite{Scorer}.

In conclusion the developed \textsf{Scorer} library is a very powerful tool for Machine Learning performances evaluation which can be used either in \textsf{C++} either in \textsf{Python} codes through its \textsf{Cython} wrap.
The code is automatically generated at each update and automatically tested using continuous integration for any platform using \href{https://github.com/Nico-Curti/scorer/blob/master/.travis.yml}{Travis CI} and \href{https://github.com/Nico-Curti/scorer/blob/master/appveyor.yml}{Appveyor CI}\footnote{
  We perform tests for Unix and Windows environments.
  We check more than 15 combinations of environments and compilers.
}.
The code can be compiled using \href{https://github.com/Nico-Curti/scorer/blob/master/CMakeLists.txt}{\textsf{CMakefile}} or \href{https://github.com/Nico-Curti/scorer/blob/master/Makefile}{\textsf{Makefile}} and a \href{https://github.com/Nico-Curti/scorer/blob/master/setup.py}{\textsf{setup.py}} is provided for the \textsf{Python} version.
So when you write a new paper on Machine Learning and you do not know what could be the most appropriate indicator to show in your research or you are afraid that a referee could ask you to compute an other one there is only one solution: compute them all using \textsf{Scorer}.

\end{document}