\documentclass[a4paper,10pt]{article}
\usepackage{graphicx,xspace}
\usepackage[utf8]{inputenc}
\usepackage[left=2.5cm,top=3cm,bottom=3cm,right=2.5cm]{geometry}
\newcommand{\R}{\textsf{R}\xspace}

\usepackage{/home/gavin/R/build/3.3-patched/share/texmf/tex/latex/Sweave}

\renewcommand{\abstractname}{Summary}

\begin{document}
\title{Introduction to R for the Geoscience: Stratigraphic \& Palaeo Data}
\author{Gavin Simpson}
\date{February , 2017}

\maketitle

\section{Rates of Change}
In this part of the practical you will compute some rate of change estimates
for a short core sequence from the Round Loch of Glenhead covering the last 140
years. There aren't any canned functions for computing rates of change in \R so
you'll perform all the neccessary steps yourself --- don't worry, they aren't
too onerous and you'll learn more about \R coding as you go along.

Start by loading the \textsf{rioja} package and the dataset needed
\begin{Schunk}
\begin{Sinput}
> library("rioja")                        # install.packages("rioja")
> ## load data and extract
> data(RLGH)
> spp <- RLGH$spec
> age <- RLGH$depth$Age
\end{Sinput}
\end{Schunk}

\subsection{Ordination-based rates of change}
The first method you'll use is the ordination based rate of change, for which
we need to smooth and interpolate the species data to a common time interval.
This can be done using the \texttt{interp.dataset()} function
\begin{Schunk}
\begin{Sinput}
> ## interpolate new dataset to every 5 years
> ## using a smoothing splint
> x.new <- seq(0, max(age), by=5)
> sp.interp <- interp.dataset(y=spp, x=age, xout=x.new,
+                             method = "sspline")
> rownames(sp.interp) <- x.new
\end{Sinput}
\end{Schunk}

Next you need to ordinate the data. Here we use DCA to follow the published version, but you could try other ordination techniques should you wish.
\begin{Schunk}
\begin{Sinput}
> ## ordinate
> library("vegan")
> ord <- decorana(sp.interp)
> ord
\end{Sinput}
\begin{Soutput}
Call:
decorana(veg = sp.interp)

Detrended correspondence analysis with 26 segments.
Rescaling of axes with 4 iterations.

                  DCA1    DCA2     DCA3     DCA4
Eigenvalues     0.1312 0.02112 0.007314 0.007082
Decorana values 0.1316 0.01130 0.005090 0.003085
Axis lengths    1.1056 0.53068 0.427959 0.374999
\end{Soutput}
\begin{Sinput}
> ## plot of points showing ages
> plot(ord, display = "sites", type = "text")
\end{Sinput}
\end{Schunk}

How many axes do you want to retain?

Finally, to compute the rate of change we need to extract the axis scores we
need and compute the distance between observations in ordination space. This
has to be done by hand for the most part.
\begin{Schunk}
\begin{Sinput}
> ## get scores
> scrs <- scores(ord, display = "sites", choices = 1:2)
> roc <- as.matrix(dist(scrs))
> roc <- roc[row(roc) == col(roc) + 1] ## extract off-diagonal
> roc
\end{Sinput}
\begin{Soutput}
 [1] 0.145791683 0.038388466 0.056476075 0.096765764 0.141675748 0.089316724
 [7] 0.148886370 0.065164981 0.123568620 0.180866597 0.135311608 0.072936429
[13] 0.009012417 0.054150418 0.058022625 0.065137156 0.081900194 0.093647074
[19] 0.102022525 0.106469426 0.102384652 0.095557955 0.078070381 0.054041243
[25] 0.024817872 0.004879166 0.010482557 0.017234419
\end{Soutput}
\end{Schunk}

Plot the rates of change for the core sequence
\begin{Schunk}
\begin{Sinput}
> ## plot roc against age
> plot(roc ~ head(x.new, -1), type = "l", ylab = "Rate of Change", xlab = "Age")
> points(roc ~ head(x.new, -1), type = "h")
\end{Sinput}
\end{Schunk}

Identify the periods with greatest rates of change. You'll compare these with
those identified using the dissimilarity-based approach in the next section.

\subsection{Dissimilarity-based rates of change}
Now you'll calculate rates of change for the same samples using the raw
dissimilarity method. In this method the data don't need to be interpolate,
instead we work with the actual species data themselves. Start by computing
the squared chord distances between all samples and extract the off-diagonal
elements (the pairwise dissimilarities)
\begin{Schunk}
\begin{Sinput}
> roc2 <- as.matrix(paldist(spp/100, dist.method="sq.chord"))
> roc2 <- roc2[row(roc2) == col(roc2) + 1] ## extract off-diagonal
\end{Sinput}
\end{Schunk}

Next scale these by the number of years between each sample. We can compute the
sample intervals in years using the \texttt{diff()} function
\begin{Schunk}
\begin{Sinput}
> intervals <- diff(age)
> roc2 <- roc2 / intervals
\end{Sinput}
\end{Schunk}

Plot the rates of change for the core sequence
\begin{Schunk}
\begin{Sinput}
> ## plot roc2 against age
> plot(roc2 ~ head(age, -1), type = "l", ylab = "Rate of Change", xlab = "Age")
> points(roc2 ~ head(age, -1), type = "h")
\end{Sinput}
\end{Schunk}

Identify the periods with greatest rates of change. How do these compare with
the rates extract using the ordination-based approach? Can you think why there
might be differences? Which method would you trust most? Why?

To aid you in your comparison, you can plot both rates of change on the same
device
\begin{Schunk}
\begin{Sinput}
> ## compare plots
> layout(matrix(1:2, nrow = 2))
> ## plot roc against new age
> xlim <- range(age, x.new)
> plot(roc ~ head(x.new, -1), type = "l", ylab = "Rate of Change", xlab = "Age",
+      main = "Ordination-based", xlim = xlim)
> points(roc ~ head(x.new, -1), type = "h")
> ## plot roc2 against age
> plot(roc2 ~ head(age, -1), type = "l", ylab = "Rate of Change", xlab = "Age",
+      main = "Dissimilarity-based", xlim = xlim)
> points(roc2 ~ head(age, -1), type = "h")
> layout(1)
\end{Sinput}
\end{Schunk}

\section{Chronological clustering}

Now we'll look at a coupld of chronological clustering methods that are available in \R.

\subsection{CONISS}

First we'll apply CONISS to the Abernethy Forest pollen record. We load the data set, convert the observations to proportions (from percentages) and apply a square root transformation. Ths means that when we compute the euclidean distances between samples using \texttt{dist()} we are computing hellinger distances instead. Finally we use the \texttt{chclust()} function to perform the CONISS clustering

\begin{Schunk}
\begin{Sinput}
> library("analogue")
> data(abernethy)
> aber <- abernethy[, seq_len(ncol(abernethy) - 2L)]
> diss <- dist(tran(aber, method = "pcent2prop"))
> clust <- chclust(diss)
\end{Sinput}
\end{Schunk}

We can plot the CONISS results and the variances ``explained'' by varying the number of zones.

\begin{Schunk}
\begin{Sinput}
> layout(matrix(1:2, ncol = 2))
> op <- par(mar = c(5,4,1,2) + 0.1)
> plot(clust, labels = abernethy$Age, hang=-1, horiz=TRUE, x.rev = TRUE, cex = 0.5)
> bstick(clust, 10)
> par(op)
> layout(1)
\end{Sinput}
\end{Schunk}

Using the screeplot method or Bennett's broken stick approach, suggest how many zones you would consider splitting the Abernethy Forest pollen record into?

\subsection{Binary splitting}

Unfortunately, the \textbf{mvpart} package that I used previously to do binary or recursive partitioning has been removed from CRAN as it contains problems that were never addressed by its author/maintainer. A new way of fitting almost the same model has become available in the \textbf{partykit} package. Rather than use cross-validation and cost-complexity pruning to choose the number of binary splits, it uses conditional inference trees. I'm not exactly sure how to describe this, but it is essentially using statistical methods to decide if it should make a new split at all. This is in contrast to standard tree models where they are grown very large and we use cross validation to prune the branches back.

In this section we'll take a quick look at doing clustering via binary splitting using the \textbf{partykit} package. First we load the package (you'll need to install it first) and then we remove some of the rare species (you should just do this casually --- I'm doing it here to make fitting the tree easier). We also need to clean up (remove spaces and hyphens) the taxon names so we can create the formula needed to fit the model

\begin{Schunk}
\begin{Sinput}
> library("partykit")                     # install.packages("partykit")
> aber2 <- chooseTaxa(aber, n.occ = 2, max.abun = 5)
> names(aber2) <- gsub(" ", "", names(aber2))
> names(aber2) <- gsub("-", "", names(aber2))
\end{Sinput}
\end{Schunk}

Now we can create the formula which describes the conditional tree we want to fit. All the species we didn't remove will end up on the left hand side of the formula, and \texttt{Age} will be the sole predictor. We add on the \texttt{Age} variable to the reduced set of species so all the variables are in one object.

\begin{Schunk}
\begin{Sinput}
> frm <- formula(paste0(paste(names(aber2), collapse = " + "), " ~ Age"))
> aber2 <- cbind(aber2, Age = abernethy$Age)
\end{Sinput}
\end{Schunk}

Now we can fit the conditional inference tree and plot the results

\begin{Schunk}
\begin{Sinput}
> sptree <- ctree(frm, data = aber2, teststat = "max", minsplit = 2)
> plot(sptree, terminal_panel = node_barplot, tp_args = list(rot = 45, just = c("right")))
\end{Sinput}
\end{Schunk}

The leaves of the tree are illustrated by barplots showing the abundances of each species. These barplots give you some idea of the species composition in each zone, but the code isn't flexible enough yet to allow you to mke nicer plots or show taxon names clearly (or I haven't worked out how to do it!) Note that here we just used the raw percentage abundances to fit the tree, you might get a different tree if you transformed or standardised the species data.

How many zones are suggested by the tree? Do these zones match up with the ones CONISS identified?

\section{Principal Curves}
In this section of the practical you'll explore fitting a principal curve to
the Abernethy Forest pollen data set. The functions you need are available in
the \textsf{analogue} package. Load it, and ignore the warnings for now.
\begin{Schunk}
\begin{Sinput}
> library("analogue")
> data(abernethy)
\end{Sinput}
\end{Schunk}

A simple summary of the data can be produced using the \texttt{Stratiplot()}
function
\begin{Schunk}
\begin{Sinput}
> (plt <- Stratiplot(Age ~ . - Depth, data =
+                    chooseTaxa(abernethy, max.abun = 15, n.occ = 10),
+                    type = c("h","g","l"), sort = "wa"))
\end{Sinput}
\end{Schunk}

Next, remove two variables from the data set (the samples depths and ages) and
then proceed to fit a PCA and a CA, as well as the principal curve to the data
\begin{Schunk}
\begin{Sinput}
> abernethy2 <- abernethy[, -(37:38)]
> aber.pca <- rda(abernethy2)
> aber.ca <- cca(abernethy2)
> aber.pc2 <- prcurve(abernethy2, method = "ca", trace = TRUE, plotit = TRUE,
+                     vary = TRUE, penalty = 1.4)
\end{Sinput}
\begin{Soutput}
   Determining initial DFs for each variable...

  |
  |                                                                      |   0%
  |
  |==                                                                    |   3%
  |
  |====                                                                  |   6%
  |
  |======                                                                |   8%
  |
  |========                                                              |  11%
  |
  |==========                                                            |  14%
  |
  |============                                                          |  17%
  |
  |==============                                                        |  19%
  |
  |================                                                      |  22%
  |
  |==================                                                    |  25%
  |
  |===================                                                   |  28%
  |
  |=====================                                                 |  31%
  |
  |=======================                                               |  33%
  |
  |=========================                                             |  36%
  |
  |===========================                                           |  39%
  |
  |=============================                                         |  42%
  |
  |===============================                                       |  44%
  |
  |=================================                                     |  47%
  |
  |===================================                                   |  50%
  |
  |=====================================                                 |  53%
  |
  |=======================================                               |  56%
  |
  |=========================================                             |  58%
  |
  |===========================================                           |  61%
  |
  |=============================================                         |  64%
  |
  |===============================================                       |  67%
  |
  |=================================================                     |  69%
  |
  |===================================================                   |  72%
  |
  |====================================================                  |  75%
  |
  |======================================================                |  78%
  |
  |========================================================              |  81%
  |
  |==========================================================            |  83%
  |
  |============================================================          |  86%
  |
  |==============================================================        |  89%
  |
  |================================================================      |  92%
  |
  |==================================================================    |  94%
  |
  |====================================================================  |  97%
  |
  |======================================================================| 100%

Fitting Principal Curve:

Initial curve: d.sq: 103233.450
Iteration   1: d.sq: 4283.431
Iteration   2: d.sq: 4312.298
Iteration   3: d.sq: 4340.691
Iteration   4: d.sq: 4355.388
Iteration   5: d.sq: 4366.497
Iteration   6: d.sq: 4369.944

PC Converged in 6 iterations.
\end{Soutput}
\end{Schunk}
The arguments to \texttt{prcurve()} tell it to start from a CA solution, show
it working by printing to the console and plotting the curve as it converges,
taxa are allowed differeing complexity smoothers and the penalty per degree of
freedom is increased by 40\% to help avoid over-fitting.

Look at the fitted object. How much of the variance in the dataset is explained
by the principal curve?
\begin{Schunk}
\begin{Sinput}
> aber.pc2
\end{Sinput}
\begin{Soutput}
	Principal Curve Fitting

Call: prcurve(X = abernethy2, method = "ca", vary = TRUE, trace = TRUE,
plotit = TRUE, penalty = 1.4)

Algorithm converged after 6 iterations

           SumSq Proportion
Total     103234      1.000
Explained  98864      0.958
Residual    4370      0.042

Fitted curve uses 218.3391 degrees of freedom.
\end{Soutput}
\end{Schunk}
Compare that with the variance explained by the PCA and CA
\begin{Schunk}
\begin{Sinput}
> varExpl(aber.pca)
\end{Sinput}
\begin{Soutput}
      PC1
0.4649883
\end{Soutput}
\begin{Sinput}
> varExpl(aber.ca)
\end{Sinput}
\begin{Soutput}
      CA1
0.3098955
\end{Soutput}
\end{Schunk}
How well has the principal curve done compared to the more traditional
techniques?

Plot the principal curve
\begin{Schunk}
\begin{Sinput}
> ## Plot the fitted curve
> plot(aber.pc2)
\end{Sinput}
\end{Schunk}
Can you see why the principal curve performs much better than the other two
ordination techniques?

A longer chunk of code is required to draw rates of change and compare the
various methods
\begin{Schunk}
\begin{Sinput}
> Depth <- abernethy$Depth
> Age <- abernethy$Age
> layout(matrix(c(1,2,2), ncol = 3))
> nseg <- nrow(abernethy2) - 1
> RoC <- unclass(diff(gradientDist(aber.pc2))) / diff(Age)
> plot(y = Age[-length(Age)],
+      x = RoC * 1000, type = "n",
+      ylim = rev(range(Age)),
+      ylab = "Age (Radiocarbon years BP)",
+      xlab  = expression("Rate of Change" ~ (kyr^{-1})),
+      main = "a", cex.main = 1.5)
> segments(x0 = rep(0, nseg), y0 = Age[-length(Age)],
+          x1 = RoC * 1000, y1 = Age[-length(Age)])
> plot(gradientDist(aber.pc2), orderBy = Age,
+      xlim = rev(range(Age)),
+      type = "o", flipAxes = TRUE, xlab = "Age (Radiocarbon years BP)",
+      main = "b",
+      cex = 0.8, pch = 21, col = "black", bg = "black", cex.main = 1.5)
> lines(gradientDist(aber.pca), orderBy = Age,
+       lty = "dashed", flipAxes = TRUE, type = "o",
+       cex = 0.8, pch = 22, col = "black", bg = "black")
> lines(1 - gradientDist(aber.ca), orderBy = Age,
+       lty = "dotdash", flipAxes = TRUE, type = "o",
+       cex = 0.8, pch = 23, col = "black", bg = "black")
> legend("topright", bty = "n", pch = 21:23,
+        legend = c(expression(PCurve), expression(PCA[1]), expression(CA[1])),
+        lty = c("solid","dashed","dotdash"),
+        col = c("black","black","black"),
+        pt.bg = c("black","black","black"), inset = 0.01, cex = 1.4,
+        seg.len = 4)
> layout(1)
\end{Sinput}
\end{Schunk}

The individual curves fitted to each taxon can be visualised, again with a long
chunk of code. Here, only the most abundant taxa are shown
\begin{Schunk}
\begin{Sinput}
> taxaWant <- chooseTaxa(aber, max.abun = 25, n.occ = 10, value = FALSE)
> layout(matrix(seq_len(sum(taxaWant)), ncol = 3))
> op <- par(mar = c(4,4,3,1) + 0.1)
> plot(sppResponse(aber.pc2), which = taxaWant)
> par(op)
> layout(1)
\end{Sinput}
\end{Schunk}

Using the two plots, do you feel the principal curve has done a good job of
describing floristic change in the Abernethy core?
\end{document}


\subsection{Experiment} \label{experiment}

The proposed sliding window filter has several model parameters that need to be carefully tuned in order to achieve optimal performance. Depending on the application domain we need to select an appropriate window and step size, time series normalization, dissimilarity threshold, and filter criterion. In the following we describe all parameter settings that were assessed in our empirical study:

\begin{itemize}

\item
The \textbf{window size} determines the number of most recent measurements contained in the examined time series subsequences. We tested four different sizes that were learned from the training gesture, including \textbf{min}, \textbf{max}, and \textbf{avg} length as well as the \textbf{mid}-point of the range. \\

\item
The \textbf{step size} defines the gap between consecutive time series windows. As default setting we use one tenth of the window size. \\

\item
For online gesture recognition we employ the nearest neighbor classifier in combination with the DTW distance, where we evaluate 34 different Sakoe-Chiba \textbf{band} sizes, ranging from 1 \% to 100 \%.
Prior to pair-wise comparing sliding windows and training gestures, the corresponding time series should be normalized. We evaluate $\eta$, $z$, and no \textbf{normalization}. \\

\item
The dissimilarity \textbf{threshold} defines the time series distance at which a sliding window and a training gesture are considered to belong to the same class. We determine the threshold for an individual class by measuring the distances between all samples of that particular class and all instances of other classes. In our empirical study we evaluate the threshold influence for: (i) one half of the minimum distance - \textbf{HMinD}, (ii) one half of the average distance - \textbf{HAvgD}, and (iii) one half of the midpoint distance - \textbf{HMidD}. \\

\item
The \textbf{filter criterion} is an essential part of our proposed approach. In our empirical study we evaluate the performance of the two filter criteria, namely the sample variance \textbf{VAR} and the length normalized complexity estimate \textbf{LNCE} of a time series. Both filters are tested with different factors that increase the size of the filter interval from 100 \% to 300 \%.

\end{itemize}

Figure \ref{fig:experiment} visualizes the online gesture recognition results for a sample time series stream processed by our proposed sliding window filter,
after selecting the above described model parameters with help of the recorded training gestures.

\begin{figure}
    \resizebox {\textwidth} {!} {
        \begin{tikzpicture}
            \begin{axis}[
                xmin=0,
                xmax=2426,
                ymin=-16,
                ymax=16,
                width=10*\axisdefaultwidth,
                height=\axisdefaultheight,
                xticklabels={,,},
                yticklabels={,,}]
                \addplot[blue, mark=none, opacity=0.4] table[x=t, y=x] {../data/fig/experimentee_result2/exp1.dat};
                \addplot[red, mark=none, opacity=0.4] table[x=t, y=y] {../data/fig/experimentee_result2/exp1.dat};
                \addplot[green, mark=none, opacity=0.4] table[x=t, y=z] {../data/fig/experimentee_result2/exp1.dat};
                \addplot+[fill, opacity=0.5, red, mark=none] coordinates {(294, -16) (307, -16) (307, 16) (294, 16)} --cycle;
                \addplot+[fill, opacity=0.5, green, mark=none] coordinates {(307, -16) (357, -16) (357, 16) (307, 16)} --cycle;
                \addplot+[fill, opacity=0.5, red, mark=none] coordinates {(357, -16) (359, -16) (359, 16) (357, 16)} --cycle;
                \addplot+[fill, opacity=0.5, red, mark=none] coordinates {(497, -16) (508, -16) (508, 16) (497, 16)} --cycle;
                \addplot+[fill, opacity=0.5, green, mark=none] coordinates {(508, -16) (562, -16) (562, 16) (508, 16)} --cycle;
                \addplot+[fill, opacity=0.5, blue, mark=none] coordinates {(562, -16) (564, -16) (564, 16) (562, 16)} --cycle;
                \addplot+[fill, opacity=0.5, red, mark=none] coordinates {(712, -16) (722, -16) (722, 16) (712, 16)} --cycle;
                \addplot+[fill, opacity=0.5, green, mark=none] coordinates {(722, -16) (777, -16) (777, 16) (722, 16)} --cycle;
                \addplot+[fill, opacity=0.5, blue, mark=none] coordinates {(777, -16) (778, -16) (778, 16) (777, 16)} --cycle;
                \addplot+[fill, opacity=0.5, blue, mark=none] coordinates {(940, -16) (945, -16) (945, 16) (940, 16)} --cycle;
                \addplot+[fill, opacity=0.5, green, mark=none] coordinates {(945, -16) (1010, -16) (1010, 16) (945, 16)} --cycle;
                \addplot+[fill, opacity=0.5, blue, mark=none] coordinates {(1010, -16) (1023, -16) (1023, 16) (1010, 16)} --cycle;
                \addplot+[fill, opacity=0.5, red, mark=none] coordinates {(1310, -16) (1316, -16) (1316, 16) (1310, 16)} --cycle;
                \addplot+[fill, opacity=0.5, green, mark=none] coordinates {(1316, -16) (1367, -16) (1367, 16) (1316, 16)} --cycle;
                \addplot+[fill, opacity=0.5, red, mark=none] coordinates {(1367, -16) (1375, -16) (1375, 16) (1367, 16)} --cycle;
                \addplot+[fill, opacity=0.5, red, mark=none] coordinates {(1681, -16) (1689, -16) (1689, 16) (1681, 16)} --cycle;
                \addplot+[fill, opacity=0.5, green, mark=none] coordinates {(1689, -16) (1746, -16) (1746, 16) (1689, 16)} --cycle;
                \addplot+[fill, opacity=0.5, blue, mark=none] coordinates {(1746, -16) (1748, -16) (1748, 16) (1746, 16)} --cycle;
                \addplot+[fill, opacity=0.5, red, mark=none] coordinates {(2082, -16) (2090, -16) (2090, 16) (2082, 16)} --cycle;
                \addplot+[fill, opacity=0.5, green, mark=none] coordinates {(2090, -16) (2146, -16) (2146, 16) (2090, 16)} --cycle;
                \addplot+[fill, opacity=0.5, red, mark=none] coordinates {(2146, -16) (2147, -16) (2147, 16) (2146, 16)} --cycle;
                \addplot+[fill, opacity=0.5, blue, mark=none] coordinates {(2311, -16) (2388, -16) (2388, 16) (2311, 16)} --cycle;
                \addplot+[fill, opacity=0.5, red, mark=none] coordinates {(2297, -16) (2362, -16) (2362, 16) (2297, 16)} --cycle;
            \end{axis}
        \end{tikzpicture}
    }
    \caption{Visualized results of online gesture recognition for a sample time series stream. We highlight true positives in green, false positives in red, false negatives in blue, and true negatives in transparent.
    Although we see short false detection intervals before or after true positives, seven out of eight gestures were assigned to the correct class label.}
    \label{fig:experiment}
\end{figure}


\section{Comparison to other methods} \label{sec:compare}

\begin{table}
\caption{Table of $\theta_{\rm inf}$ - $\theta_{\rm true}$ and uncertainties for different CIGALE setups  }
\begin{center}
\begin{tabular}{ccccc} \toprule
set & CIGALE A & CIGALE B & CIGALE C & CIGALE D \\
$\Delta M_{tot}$ & 0.07 & 0.09 & 0.27 & 0.05\\
$M_{err}$ & 0.13 & 0.20 & 0.16 & 0.16\\
$\Delta$ Age & 1.78 & 1.59 & 1.97& 1.92\\
$Age_{err}$ & 2.36 & 2.63 & 2.47 & 2.47\\
$\Delta$ Z & 0.0037 & 0.0026 & 0.0027 & 0.0027\\
$Z_{err}$ & 0.0091 & 0.0085 & 0.0089 & 0.0089\\
\hline
\hline
\end{tabular} \label{tab:setups}
\end{center}
\end{table}

\begin{figure}
\begin{center}
\includegraphics[width=\textwidth]{figs/mini_mocha_cigale.png}
\caption{The properties inferred from CIGALE photometry fit as a function of true properties. Configuration CIGALE A, B, C, and D on one plot.
}
\label{fig:photo_cigaleALL}
\end{center}
\end{figure}


\documentclass[a4paper,twocolumn]{article}

\usepackage[english]{babel}
\usepackage[utf8]{inputenc}
\usepackage{graphicx}
\usepackage{fullpage}
\usepackage{amssymb}
\usepackage{caption}

\newenvironment{Figure}
  {\par\medskip\noindent\minipage{\linewidth}}
  {\endminipage\par\medskip}

\title{Progressive Neural Networks $-$ summary}
\author{Matěj Nikl}

\begin{document}
\maketitle
\noindent
Progressive Neural Networks (PNNs) are networks trying to address the task of using, transferring and not forgetting previously learned knowledge to learn yet another task, preferably with faster convergence. It retains a pool of trained models throughout training and learns connections to them to harvest potentially useful features while also learning new ones. What it means is that it has the ability to choose whether the previously learned knowledge is useful for the new task and thus to transfer it, or even to ignore it completely (by zeroing the lateral connections).

    \begin{figure}[!h]
        \centering
        \includegraphics[width=0.75\columnwidth]{PNN.png}
        \caption{A three column progressive network}
    \end{figure}

\subsection*{Basic definition}
A PNN starts with a single column $-$ a DNN with $L$ layers and hidden activations $h_i^{(1)} \in \mathbb{R}^{n_i}$, with $n_i$ the number of units at layer $i \le L$, and parameters $\Theta^{(1)}$ trained to convergence. When adding a second task, the parameters $\Theta^{(1)}$ are ``frozen'' and a new column with parameters $\Theta^{(2)}$ is instantiated (with random initialization), where layer $h_i^{(2)}$ receives input from both $h_{i-1}^{(2)}$ and $h_{i-1}^{(1)}$ via lateral connections. This generalizes to $K$ tasks as follows (biases omitted for clarity):
\[
    h_i^{(k)} = f \left( W_i^{(k)}h_{i-1}^{(k)} + \sum_{j<k} U_i^{(k,j)} h_{i-1}^{(j)} \right)
\]
where $W_i^{(k)} \in \mathbb{R}^{n_i \times n_{i-1}}$ is the weight matrix of layer $i$ of column $k$, $U_i^{(k,j)} \in \mathbb{R}^{n_i \times n_{i-1}}$ are the lateral connections from layer $i-1$ of column $j$, to layer $i$ of column $k$ and $h_0$ is the network input. $f$ is a element-wise non-linearity, $f(x) = \max (0, x)$ for all intermediate layers.

\paragraph{Adapters.} In practice, non-linear lateral connections called \textit{adapters} are used. The serve both to improve initial conditioning and perform dimensionality reduction, so that the number of parameters stemming from the lateral connections is in the same order as $\left| \Theta^{(1)} \right|$ as $k$ grows.

\subsection*{Principles of modularization}
The basic building block of PNNs is a \textit{column}. A column is a neural network with lateral connections to all previously trained columns, each trying to solve just one task. That might encourage the thinking of a column as a potential module. However, it cannot be taken away and used on its own as a some kind of a standalone unit $-$ it always needs all of its previous columns with whom it was trained with to function properly, because it might be extremely dependent on features (knowledge) extracted from input by them. So, even though we might like to see it as a module, it definitely cannot be used that way.

\subsection*{Principles of growing}
For each new task a new column is allocated. The knowledge from all previously learned tasks has the potential to be transferred, while being protected against forgetting, because all previous columns have frozen weights. This way, the PNN can theoretically grow for as many tasks as needed (while potentially transferring the knowledge from all of the previously learned ones), however in practice, some other techniques like pruning and online compression must be used during training for the number of parameters to be reasonable.

    \begin{figure*}[ht]
        \centering
        \includegraphics[width=0.65\textwidth]{2-column.png}
        \caption{A two column progressive network $-$ knowledge transfer}
    \end{figure*}

    \begin{figure*}[ht]
        \centering
        \includegraphics[width=0.9\textwidth]{3-column.png}
        \caption{A three column progressive network $-$ knowledge transfer to the rightmost task}
    \end{figure*}

    \begin{figure*}[ht]
        \centering
        \includegraphics[width=\textwidth]{perf.png}
        \captionsetup{singlelinecheck=off}
        \caption[trololo]{(a) Transfer matrix. Colors indicate transfer scores (clipped at 2). For progressive nets, the first column is trained on Pong, Noisy, or H-flip (table rows); the second column is trained on each of the other pong variants (table columns). (b) Example learning curves. \\
        \begin{itemize}
            \item \textbf{Baseline 2} $-$ a single column, pretrained on a source task and fine-tuned on the target task (output layer only)
            \item \textbf{Baseline 3} $-$ the same as baseline 2 but the whole model is fine-tuned
            \item \textbf{Baseline 4} $-$ a 2 column progressive architecture, with previous columns initialized randomly and frozen
        \end{itemize}
        }
    \end{figure*}

\end{document}


\chapter{The third protocol - Computing and Comparing HD Homomorphically}
\label{chap:thirdProtocol}

% **************************** Define Graphics Path **************************
\ifpdf
\graphicspath{{Chapter5/Figs/Raster/}{Chapter5/Figs/PDF/}{Chapter5/Figs/}}
\else
\graphicspath{{Chapter5/Figs/Vector/}{Chapter5/Figs/}}
\fi

% **** main chapter

\section{Introduction}
\label{sub:introChap3}
In the previous chapter, we assumed that, given the Hamming Distance (HD) between the registered and queried
binary bitstring templates, it is infeasible for an attacker to infer or acquire any information
about the registered templates stored on the server. This assumption is plausible as long as the
distributions of the HD between registered and the queried templates is not in any way
correlated to the templates themselves (analyzing these distributions is out of scope of the
project). However, in this chapter, we introduce our first attempt to hide this
information from the server as well. Our results not only cause the protocol
to work regardless of the aforementioned dependencies, it is also the first step we take to
secure the authentication protocol against an \textit{active} server security model. Although the communication size of this variant might not
be suitable in practice for current network infrastructures, one can
still find some generic techniques used within it to be helpful while
applying them to balance the computation time and the communication size of
lattice-based cryptographic protocols. The contributions of this variant include:
\begin{itemize}
\item A technique to compare Hamming Distance (HD) homomorphically by computing
  the Most Significant Bit (MSB) of a specific ciphertext.
\item A packing methods conversion technique to transform a ciphertext
  encrypting a binary-encoded to a unary-encoded plaintext.
\item Some extensions of the Zero Knowledge Proof (ZKP) technique we used
  in previous chapter to check the format of a message, in addition to the
  information carried by the plaintext itself.
\item The combination of ZKP protocols to balance the communication size
  trade-offs when used with lattice-based cryptosystems.
\end{itemize}

\section{Proposed Scheme}
We first propose a secure fingerprint authentication scheme that combines a
Somewhat Homomorphic Encryption (SHE) with a Zero-Knowledge Proof (ZKP) to
provide privacy features with low FAR overhead. The scheme is secure under a
hybrid model that assumes an active client and an honest but curious (HBC)
server. The server $\server$ is considered to be HBC by assuming that it can be
audited regularly. This scheme uses Hamming Distance (HD) as the main measure
unit to determine the difference between two fingerprint templates. The detailed
descriptions of each protocol step are discussed in later sections of the
chapter. Together with notations according to previous chapter, we use extra notations regarding encryptions as follows:
\begin{itemize}
\item $Enc^{(1)}(m)$: The BV encryption of $m$ as in previous chapter.
\item $Enc^{(2)}(m)$: The BV encryption of $x^{m}$: $Enc^{(2)}(m) = Enc^{(1)}(x^{m})$
\item $Enc^{(3)}(m)$: The LWE encryption of $m$ over $\mathbb{Z}_{Q}$ defined in section \ref{sec:LWESymmetric}.
\end{itemize}

\subsection{The protocol}
\label{sec:theProtocol}
\begin{description}
	\item[Setup] The server and the user run the setup process as
	follows:
	\begin{itemize}

		% * <trung.dinh@monash.edu> 2016-10-21T13:17:43.354Z:
		%
		% replace BGV by GSW for now
		%
		% ^.

		\item $\mathcal{S}$ invokes $params_{BV} \gets
		SGen_{BV}(1^\lambda)$
		\item We are currently using a BV cryptosystem
		(\cite{brakerski2011fully}). We refer the reader to section
		\ref{sec:BVScheme} for details of $params_{BV}$, the public
		key $pk$, the private key $sk$, as well as the
		operations of the
		cryptosystem.
		\item A user $\mathcal{U}_k$ invokes $(pk_k,sk_k) \gets
		UGen_{BGV}(params_{BGV})$ and makes $pk_k$ publicly
		available to $\mathcal{S}$.

		\iffalse
		\item $\mathcal{S}$ invokes $params_{GSW} \gets
		SGen_{GSW}(1^\lambda)$
		\item We are currently using GSW cryptosystem
		(\cite{gentry2013homomorphic}).
		We refer the reader to section
		\missref{} for details of $params_{GSW}$, the public
		key $pk$, the private key $sk$, as well as the
		homomorphic operations of the
		cryptosystem.
		\item A user $\mathcal{U}_k$ invokes $(pk_k,sk_k) \gets
		UGen_{GSW}(params_{GSW})$ and make $pp_k$ publicly
		available to $\mathcal{S}$
		\fi

	\end{itemize}
	\item[Enrolment] The enrolment process runs as follows.
	\begin{itemize}
		\item $\mathcal{U}$ uses a specific sensor and algorithm to
		extract his biometric template $X$. $\mathcal{U}$
		encrypts $X$ with his public key $pk_k$ to get
		$T_k = Enc^{(1)}(X)$.
		\item $\mathcal{U}$ sends $(k,T_k)$ to $\mathcal{S}$.
		Noted that $k$
		is used as an identity index for $\mathcal{U}$.
		\item $\mathcal{S}$ stores a tuple $(k, T_k)$ as a
		record.
	\end{itemize}
	\item[Authentication] The authentication process for a user
	$\mathcal{U}_k$ is as follows.
	\begin{enumerate}
		\item $\user_k$ extracts his query template $Y$. He
		encrypts $Y$ with his public key $pk_k$ to obtain
		$Q_k = Enc^{(1)}(Y)$.\label{protocol:step1}
              \item $\user_k$ sends $(k,Q_k)$ to $\server$ and runs
                $\mathbf{ZKPValidEnc((Q_k,pk_k),(Y,sk_k))}$ to prove the
                validity of $Y$.\label{protocol:step2} was detailed in Chapter \ref{chap:firstProtocol}.
              \item $\server$ locates the record $(k,T_k)$ and computes \ the
                encrypted Hamming Distance $C_{HD} = Enc^{(1)}( HD)$ of $X$ and
                $Y$, using the homomorphic operation discussed in Section \ref{sec:firstProcBGV}.
		$$C_{HD} \gets
		\textbf{EvalDistance}(T_k,Q_k).$$\label{protocol:step3}
		\item $\server$ masks the $C_{HD}$ by sampling $r
		\randomsample \mathcal{P}$
		and performs one homomorphic addition to get
		$C_{HD'} = Enc^{(1)}(HD + r) \gets Enc^{(1)}(HD) + Enc^{(1)}(r)$.
		The result ciphertext is sent to $\user_k$.\label{protocol:step4}
		\item $\user_k$ uses his private key $sk_k$ to decrypt $C_{HD'}$
		and sends
		the re-encryption $C_{HD'_0} = Enc^{(1)}(HD',0,0,\dots,0)$ back to $\server$.
		$\user_k$ also decomposes the plaintext result
		$HD' = HD+r$ into its binary representation:
		\[
		HD' = b_0 + b_12^1 + \dots + b_l2^{l-1}
		\]
		and sends $C_i = Enc^{(1)}(b_i)$ to $\server$
		for $i = 0, \dots, l-1$.\label{protocol:step5}

		\item $\user_k$ and $\server$ run the $\mathbf{ZKPUnpack}(C_{HD},C_{HD_0'})$ and
		$\mathbf{ZKPBinDecomp}(C_{HD_0'},C_i)$
		protocols to convince the server that
		$\user_k$ did follow the protocol transcript correctly. This is detailed
		in section
		\ref{sec:ZKPReencrypt}.
		\label{protocol:step6}
		\item $\server$ computes $C_{HD}'' = Enc^{(2)}(2^l + t - HD) \gets
		Enc^{(2)}(2^l + t) - Enc^{(2)}(HD+r) + Enc^{(2)}(r)$, where
		$Enc^{(2)}(HD + r)$ is computed by $\mathbf{ToUnary}(C_i)$. We note that
		$Enc^{(2)}$ is the ``unary'' mode of encryption with the message
		encoded in the exponent of the polynomial, which allows the
		Most significant bit (MSB)
		extraction on the ciphertext (this is detailed section \ref{sec:binToUna} \label{protocol:step7}).
		\item $\server$ does $Enc^{(3)}(res) \gets
		\mathbf{MSBExtract}(C_{HD}'')$, this is the ciphertext
		of the authentication result, which is sent to $\user_k$. This
		is described in section \ref{sec:MSBExtract}.
		\label{protocol:step8}
		\item $\user_k$ decrypts the result $res$ and sends it to $\server$
		(it will be either \textbf{Accepted} or \textbf{Rejected} by $\server$).
		$\user_k$ also runs another proof $\mathbf{ZKPCorrectDec}(res)$
		to convince $\server$ that he
		did follow the protocol honestly (Section \ref{sec:ZKPReencrypt}).\label{protocol:step9}

		%$\server$ also computes
		%the encryption of the authentication result $Enc(\Delta < \tau)$
		%using another homomorphic operation $Enc(\Delta \stackrel{?}{<}
		%\tau) \gets \textbf{EvalRes}(pk_k, \tau, Enc(\Delta))$.
		%\item $\server$ sends $Enc(\Delta \stackrel{?}{<} \tau)$ to $\user_k$.
		%$\user_k$ uses his private key $sk_k$ to decrypt the plaintext $
		%res \gets \Delta
		%\stackrel{?}{<} \tau$.

		% * <trung.dinh@monash.edu> 2016-10-21T13:15:14.957Z:
		%
		% we agreed to do this later, for now, we change back to GSW instead of BGV. Later when we apply MCC we will consider bringing these garble circuit back.
		%
		% ^.
		%\item $\server$ masks the computed distance with a random
		%value $R$, using Homomorphic addition operation:
		%$Enc(\Delta + R) \gets EvalAdd(pk_k, Enc(\Delta),
		%Enc(R))$.
		%\item $\server$ builds a garbled circuit $\textbf{GC}$ to evaluate
		%the bit value of the comparison between a plaintext $\Delta$
		%against a threshold
		%$\tau$ privately $(\Delta \stackrel{?}{<} \tau) \gets
		%\textbf{GC}(k_{\Delta + R}, k_R)$. We note that
		%$k_{\Delta + R}$ and $k_R$ are cryptographic keys input
		%to garble circuit protocol. We refer the reader to
		%section \missref{} for details of garble circuit
		%protocols.
		%\item $\server$ sends $Enc(\Delta + R)$ and $\textbf{GC}$ to $\user_k$, $\user_k$
		%uses his private key $sk_k$ to decrypt $\Delta+R$.
		%\item $\user_k$ derives $k_{\Delta + R}$ to be use as the
		%first input to $\textbf{GC}$ and $\user_k$ runs Oblivious Transfer protocol
		%$\textbf{OT}$ to obtain $k_R$ from $\server$ privately.
		%$\textbf{OT}$ is discussed in section
		%\missref{}.
		%\item $\user_k$ evaluates $(\Delta \stackrel{?}{<} \tau) \gets
		%\textbf{GC}(k_{\Delta + R}, k_R)$ and sends the result
		%$res$ to $\server$.

		%\item $\user_k$ convinces $\server$ that he did follow the
		%protocol honestly using Zero Knowledge Proof protocol
		%$\textbf{ZKP}$. This protocol is discussed in section
		%\missref{}.

	\end{enumerate}
	The proposed scheme satisfies the security notions defined in Sect. \ref{sec:syntaxModel}.
	\begin{theorem}
		\label{theo:server}
		Under the IND-CPA security of a BV cryptosystem, and the zero-knowledge
		property of the Stern protocol, the proposed scheme satisfies an (Honest But Curious) Server Privacy's Security.
	\end{theorem}
	\begin{theorem}
		\label{theo:client}
		Under the IND-CPA security of a BV cryptosystem and the soundness
		property of the underlying Stern protocol, the proposed scheme satisfies Impersonation Security. Concretely, for $\delta>0$, the protocol is $(q,c)$-secure against impersonation with $c \leq c(\delta) + 3 \cdot c_1$, assuming the underlying non-private biometric protocol has impersonation probability $\varepsilon_{bio}$ and the underlying Stern ZK protocols have knowledge errors $\eps_{ZK1},\ldots,\eps_{ZK4}$ such that $q(\varepsilon_{ZK1}+\varepsilon_{ZK2} +
\varepsilon_{ZK3} + \varepsilon_{ZK4}) + \delta \leq c_1 \cdot \varepsilon_{bio}$, $c(\delta) = 2 e^{1+2\delta}$, and the condition $\sigma/r_0 \geq 4 \pi k n q$ holds, with $k = 1 + \sqrt{1/\pi \ln(2nq/\delta)}$ and $r_0$ being an upper bound on the size of the noise in $C_{HD}$.
	\end{theorem}

\end{description}

\begin{figure}[htbp!]
  \centering \procedure{THE THIRD PROTOCOL}{
    \textbf{Client} \> \> \textbf{Server}\pclb
    \pcintertext[dotted]{Enrolment}\\
    \text{Extract } \mathbf{x} \randomsample D_k \> \> \\
    T_k = Enc^{(1)}(\mathbf{x},\pk) \> \sendmessageright*{(k, T_k)}
    \> \text{Persist $(k,T_{k})$}\pclb
    \pcintertext[dotted]{Authentication}\\
    \text{Extract } \mathbf{y} \randomsample D_k \> \> \\
    Q_k = Enc^{(1)}(\mathbf{y},\pk) \> \sendmessageright*{(k, Q_k)}
    \> \\
    \> \sendmessageright*{\mathbf{ZKPValidEnc}} \> C_{HD} \gets \mathbf{EvalDistance}(T_k, Q_k)\\
    \> \sendmessageleft*{C_{HD'}} \> C_{HD'} \gets Enc^{(1)}(HD,e_0) + Enc^{(1)}(r,e_r)\\
    HD' \gets Dec(C_{HD'},\sk) \> \> \\
    C_{HD'_0} \gets Enc^{(1)}(HD', 0, \dots, 0) \> \sendmessageright*{C_{HD'_0}} \> \\
    HD' = b_0 + b_1 2 + \dots + b_l 2^{l-1} \> \> \\
    C_i \gets Enc^{(1)}(b_i) \> \sendmessageright*{C_i} \> \\
    \> \sendmessageright*{\mathbf{ZKPUnpack}(C_{HD}, C_{HD'_0})} \> \\
    \> \sendmessageright*{\mathbf{ZKPBinDecomp}(C_{i}, C_{HD'_0})} \> C''_{HD} \gets Enc^{(2)}(2^t + \tau - HD)\\
    \> \sendmessageleft*{C_{res}} \> C_{res} = Enc^{(3)}(res) \gets \mathbf{MSBExtract}(C''_{HD})\\
    res = Dec(C_{res}) \> \sendmessageright*{\mathbf{ZKPCorrectDec}(res)} \>
    }
  \caption{The Third Protocol}
  \label{fig:thirdProtocol}
\end{figure}

\section{The Homomorphic tools}
\subsection{Extracting the Most Significant Bit homomorphically}
\label{sec:MSBExtract}
We observe that \(HD < \tau \iff MSB(2^{l} + \tau - HD) = 1\), where \(l\) is
the bit-length of \(HD\) and MSB denotes the Most Significant Bit. This is our
attempt to compare Hamming Distance homomorphically, the idea is to let the
server compute homomorphically the ciphertext of \(MSB(2^{l} + \tau - HD)\),
then having the client to decrypt it and to send back the authentication result
with a zero knowledge proof. This section discusses a variant of the technique
from \cite{ducas2015fhew} to efficiently compute the MSB of the plaintext $M$ given
$Enc(M)$, we adapt this technique to work with BGV encryption rather than GSW encryption used in \cite{ducas2015fhew}. The main idea comes from the way we encode the message $M$ in ``unary'' form before the
encryption.

Given $M \in \mathbb{Z}_{2n}$, we observe that
\[
  \begin{cases}
    MSB(M) = 0 \iff M \in [0, n)\\
    MSB(M) = 1 \iff M \in [n, 2n)
  \end{cases}
\]

Assume that we encrypt $M$ using the SHE scheme (section
\ref{sec:BVScheme}). With the message space $R_t$ and assuming that $2n < t < q$,
we can encode $M$ as a ring element $m \in R_t$ as follows
\[
  m(x) = 0x^0 + 0x^1 + \dots + 1x^M + \dots + 0x^{n-1}
  \ \textnormal{if} \ M \in [0,n)
\]
or, due to $x^n = -1$ in $R_q$, we can also encode M as
\[
  m(x) = 0x^0 + 0x^1 + \dots - 1x^M + \dots + 0x^{n-1}
  \ \textnormal{if} \ M \in [n,2n)
\]
The ciphertext $Enc^{(2)}(M)$ has this form
$(\mathbf{c} = \mathbf{p_0}\mathbf{u} + t\mathbf{g} + \mathbf{m}, \mathbf{c'} =
\mathbf{p_1}\mathbf{u} + t\mathbf{f})$, where $(\mathbf{p_0}, \mathbf{p_1})$ is
the public key and
$\mathbf{u}, \mathbf{f}, \mathbf{g} \randomsample \chi_{\alpha q}$.  We denote
$ rot({\textbf{c}}) \in \mathbb{Z}_q^{n\times n}$ as being an anti-circulant
square matrix, whose first column is $\mathbf{c}$, the other columns being the
cyclic rotations of $\mathbf{c}$ with the cycled entries negated
\[
  rot({\mathbf{c}})=
  \begin{bmatrix}
    c_0 & -c_{n-1} & -c_{n-2} & \dots\\
    c_1 & c_0 & -c_{n-1} & \dots\\
    \dots & \dots & \dots & \dots\\
    c_{n-1} & c_{n-2} & c_{n-3} & \dots
  \end{bmatrix}
\]
It's easy to see that $rot(\mathbf{c}\mathbf{u}) = rot(\mathbf{c})
\vec{u}$. Let $rot(\mathbf{c})[0]$ to be the first column of $rot(\mathbf{c})$.

\begin{lemma}\label{lemma:bitToBin}
	Given $M \in Z_{2n}$ and $(\mathbf{c},\mathbf{c'}) = Enc^{(2)}(M)$ as the first level ciphertext of $M$ from the BV scheme, let $\vec{1} = \{1,1,\dots,1\} \in \mathbb{Z}^n$. The transformed ciphertext $(l, l') \leftarrow (\vec{1}
	rot({\mathbf{c}})[0], \vec{1}
	rot({\mathbf{c'}})) \in (\mathbb{Z}_Q
	, \mathbb{Z}_Q^n)$ encrypts the MSB information of $M$ under $Enc^{(3)}$.
\end{lemma}

\begin{algorithm}
  \caption{Most Significant bit extraction}\label{alg:MSBExtract}
  \hspace*{\algorithmicindent} \textbf{Input:} $\mathbf{c} = Enc^{(2)}(M)$ \\
  \hspace*{\algorithmicindent} \textbf{Output: $EncLWE((-1)^{MSB(M)})$}
  \begin{algorithmic}[1]
    \Procedure{MSBExtract}{$\mathbf{c}$}
    \State $allOne = \{1,\dots,1\}$
    \State $rot_{c_0} \gets rot(c_0)$
    \State $lwe_0 \gets allOne \cdot rot_{c_0}[0]$
    \State $rot_{c_1} \gets rot(c_1)$
    \State $lwe_1 \gets allOne \cdot rot_{c_1}$
    \State \textbf{return} $(lwe_0,lwe_1)$
    \EndProcedure
  \end{algorithmic}
\end{algorithm}

\begin{proof}
	The following is the case:\\
	\begin{align*}
	\vec{1} \cdot rot(\mathbf{c})[0] \in \zzq &= \vec{1}\overrightarrow{
		\mathbf{p_0}\mathbf{u} + t\mathbf{g} + \mathbf{m}}\\
	&= \vec{1}\cdot\overrightarrow{p_0u} +t\vec{1}\cdot\vec{g} +\vec{1}\cdot\vec{m}\\
	&= -\vec{1}(rot(p_1s)\vec{u} +t.rot(e)\vec{u}) + t\vec{1}\cdot\vec{g} + (-1)^{MSB(M)}\\
	&= -\vec{1}rot(p_1)\vec{u}\vec{s} - t.rot(e)\vec{u} + t\vec{1}\cdot\vec{g} + (-1)^{MSB(M)}\\
	\end{align*}
	Provided that $\mathbf{c'} = \mathbf{p_1}\mathbf{u} + t\mathbf{f}$, the decryption $\langle(l,l'),(1,\mathbf{s})\rangle \mod t$ is $\pm1$.
	This implies the MSB information of M as discussed. We use here the relation $\vec{1}\cdot \vec{m} = (-1)^{MSB(M)}$ thanks to the ``unary'' encoding of M discussed previously.
\end{proof}

\subsection{Converting from binary-encoded to unary-encoded plaintext}
\label{sec:binToUna}
This section discusses a linear transformation to map a message $b \in \{0,1\}$
onto a message $x^{jb}$ for $j \geq 1$. Let $T: cx + d = y$ be the linear transformation. We want $T$ to map $0 \rightarrow x^{j0} $ and
$1 \rightarrow x^j$, or
\[
  \begin{cases}
    c.0 + d = 1\\
    c + d = x^j
  \end{cases}
  \Leftrightarrow
  \begin{cases}
    c = x^j - 1\\
    d = 1
  \end{cases}
\]
Due to the homomorphism property of BV cryptosystems , we can apply
$T$ in the ciphertext domain to obtain $Enc(x^{jb})$ given $Enc(b)$,
for $b \in \{0,1\}$:
\begin{align}
  \label{eq:encBitConvert}
  Enc^{(2)}(j.b) = Enc^{(1)}(x^{jb}) &= Enc^{(1)}(c)Enc(b) + Enc^{(1)}(d) \nonumber \\
              &= Enc^{(1)}(x^j - 1)Enc^{(1)}(b) + Enc^{(1)}(1)
\end{align}
From the implementation point of view, this operation can be done faster
by ensuring $\mathbf{u}, \mathbf{f}, \mathbf{g} \gets 0$ instead of sampling them from
$\chi$ during $Enc(x^j -1)$ and $Enc(1)$, which results in $Enc^{(1)}(x^j -1) = (x^j - 1, 0)$ and $Enc^{(1)}(1) = (1,0)$. These are still valid encryptions and will not affect the correctness of Eq. (\ref{eq:encBitConvert}).

This submodule is used in our protocol at authentication step
\ref{protocol:step7}. Recall that the server needs to compute $Enc^{(2)}(HD')$,
which is the encryption of $HD'$ in the ``unary'' mode of encoding (the message is
encoded in the exponent instead of in the coefficient of the polynomial). Given the encryptions $Enc(b_{i})$ of the bits $b_{i}$ of $HD' = \sum_{j = 0}^{l -1} b_{j}2^{j}$
, the server can convert $Enc(b_{j})$ to $Enc(2^{i}b_{i})$
$Enc(x^{jb})$ and perform
\[
  Enc^{(2)}(HD') = Enc^{(1)}(x^{HD'}) = \prod_{i=0}^{l-1}Enc^{(1)}(x^{b_i2^i})
\]
Note that this operation involves $log(l)$ levels of homomorphic multiplication, where
$l$ is the bit length of the Hamming Distance.
\begin{algorithm}
  \caption{Binary to Unary ciphertext}\label{alg:ToUnary}
    \hspace*{\algorithmicindent} \textbf{Input:} $\mathbf{c_{i}} = Enc(b_{i})$ \\
  \hspace*{\algorithmicindent} \textbf{Output:} $HD$
  \begin{algorithmic}[1]
    \Procedure{ToUnary}{$\mathbf{c_i}$}
    \For{$i = 0, \dots, l-1$}
    \State let $j = 2^{i}$
    \State let $\mathbf{hd_i} \gets (x^j - 1,0)\times \mathbf{c_i} + (1,0)$
    \EndFor
    \State let $\mathbf{hd} \gets \mathbf{hd}_0 \times \mathbf{hd}_1 \times \dots
    \times \mathbf{hd}_{l-1}$

    \State \textbf{return} $\mathbf{hd}$
    \EndProcedure
  \end{algorithmic}
\end{algorithm}

\section{The Zero Knowledge Tools}
\label{sec:zkptools}
\subsection{ZKPoPK of Regev Cryptosystem}
\label{sec:zkpRegev}
In this section, we first review an application of the \cite{ling2013improved} technique to apply ZKPoPK on Regev Cryptosystems, then we elaborate on the variants to be used in the protocol.
Given parameters $q, m, n, t, \chi$ of a typical LWE-based cryptosystem, we can describe a variant of Regev's system as follows:
\begin{description}
\item [Kengen.] A secret key $\vec{s}$ can be chosen from $\chi^n$. The public key is then generated as
  $pk = (p_0, p_1) = (\mathbf{A}, \mathbf{A}\vec{s} + t\vec{e})$. Where $\mathbf{A} \randomsample \mathbb{Z}_q^{m \times n}$
  and $\vec{e} \randomsample \chi^n$
\item [Encrypt.] Given a message $M \in \mathbb{Z}_t$, the ciphertext $C$ is computed by first sampling a random
  vector $\vec{r} \in \chi^n$ and setting
  $C = (c_0, c_1) = (p_0\vec{r}, p_1\vec{r} + M)$
\item [Decrypt.] Given a ciphertext $C = (c_0, c_1)$, the message $M$ can be recovered by computing $M = c_1 - c_0\vec{s} \mod t$
\end{description}
In \cite{ling2013improved}, the ZKPoPK was attained by proving the encryption relation
\begin{align*}
  R_{Regev}^{q,m,n,t,\chi} = \{ ((p_0,p_1),(c_0,c_1),\vec{r}||M) \in (\mathbb{Z}_q^{m \times n} \times \mathbb{Z}_q^{m})
  \times (\mathbb{Z}_q^n \times \mathbb{Z}_q) \times \mathbb{Z}_q^{n+1} : \\
  (c_0 = p_0\vec{r}) \land (c_1 = p_1\vec{r} + M) \}
\end{align*}

Let $\mathbf{A}' = \begin{bmatrix}
  p_1, 1\\
  p_0, 0
\end{bmatrix}
$, and $\mathbf{y} = \begin{bmatrix}
  c_1\\c_0
\end{bmatrix}$ be public parameters in the proof and
let $\mathbf{x} = \begin{bmatrix}
  \vec{r}\\
  M
\end{bmatrix}$ be the $Prover$'s witness. We observe that
$\mathbf{A'}\mathbf{x}= \mathbf{y} \mod q$, that is, $\mathbf{x}$ is a solution
to the ISIS problem defined by $(\mathbf{A'},\mathbf{y})$ and that we can use
the \textbf{SternExt} protocol to obtain an efficient
ZKPoPK. This works in a symmetric key setting, where the $Prover$ knows the
random $\vec{r}$ to use as his witness. In our context, the client does not know
that $\vec{r}$ as encryption was set by the server. Following the decryption
equation:
\begin{align*}
  c_1 - c_0\vec{s} &= p_1\vec{r} + M - p_0\vec{r}\vec{s} \\
                   &= \mathbf{A}\vec{s}\vec{r} + t\vec{e}\vec{r} + M - \mathbf{A}\vec{r}\vec{s}\\
                   &= t\tilde{e} + M,
\end{align*}
we can write out the decryption relation as
\begin{align}
  \label{eq:RegevPub}
  R_{Regev,dec}^{q,m,n,t,\chi} = \{ ((p_0,p_1),(c_0,c_1),\vec{s},\vec{e},\tilde{e}, M) \in (\mathbb{Z}_q^{m \times n} \times \mathbb{Z}_q^{m})
  \times (\mathbb{Z}_q^n \times \mathbb{Z}_q) \times \chi^n \times \chi^n \times \chi \times \zzq :\\ \nonumber
  (p_1 = p_0\vec{s} + t\vec{e}) \land (c_1 = c_0\vec{s} + t\tilde{e} + M) \}
\end{align}
In this situation, we can let $\mathbf{A'} = \begin{bmatrix}
  c_0, t, 0 , 1 \\p_0, 0, t, 0
\end{bmatrix}
$
and $\mathbf{y} = \begin{bmatrix}
  c_1\\p_1
\end{bmatrix}$
be the public parameters and let $\mathbf{x} = \begin{bmatrix}
  \vec{s}\\ \tilde{e}\\ \vec{e}\\ M
\end{bmatrix}
$, further applying the \textbf{SternExt} to obtain the ZKPoPK  . We note that the two separate rows of $\mathbf{A'}$ prove the two
separate relations in (\ref{eq:RegevPub}): The $Prover$ needs to prove that he knows a secret $\vec{s}$ that can decrypt
$(c_0,c_1)$; he also needs to prove that the secret key $\vec{s}$ is also the one corresponding to the public key
$(p_0, p_1)$.

\subsection{ZKPoPK of BV cryptosystem}
\label{sec:ZKPBV}
In this section, we discuss ZKPoPK for a ring variant of the Regev scheme discussed above, which is the BV system that we use in
our application context (section \ref{sec:BVScheme}). We will refer to this
proof as $\mathbf{ZKPValidEnc}$. Recall that our public key is a pair of ring elements $pk = (\mathbf{p_0},
\mathbf{p_1})$, where $\mathbf{p_0}, \mathbf{p_1} \in \rrq$ and $\mathbf{p_1}\mathbf{s}+ t\mathbf{e} = -\mathbf{p_0} $. This
is one of the relation that the client will need to prove later on. Next, given a ciphertext $c = (\mathbf{c_0}, \mathbf{c_1})$, the original
plaintext $\mathbf{m} \in R_{t}$ can be recovered by $\mathbf{m} = \mathbf{c_0} + \mathbf{c_1}\mathbf{s} \mod t$ (spelled out as $\mathbf{c_1}\mathbf{s} + \mathbf{c_0} = \mathbf{m} + t\mathbf{e'}$, or $\mathbf{c_1}\mathbf{s} -t\mathbf{e'} -\mathbf{m} = -\mathbf{c_0}$).
In summary, the relation required for the ZKPoPK is:
\begin{align}
  \label{eq:BVRel}
  R_{BV}^{Q,n,t,\chi} = \{((\mathbf{c_0}, \mathbf{c_1}),(\mathbf{p_0}, \mathbf{p_1}), \mathbf{s},\mathbf{e'}, \mathbf{e}, \mathbf{m} \in
  (\rrq \times \rrq) \times (\rrq \times \rrq)  \times \chi^n \times \chi^n \times \chi^n \times R_t:\\ \nonumber
  (\mathbf{p_1}\mathbf{s} + t\mathbf{e} = -\mathbf{p_0} ) \land (\mathbf{c_1}\mathbf{s} - t\mathbf{e'} -\mathbf{m} = -\mathbf{c_0})
  \}
\end{align}
We can proceed in a way similar to what appears in section \ref{sec:zkpRegev}, where we tried to derive the ISIS relation ($\mathbf{A}\mathbf{x} = \mathbf{y} \mod q$)
from the above relation and obtain the ZKP accordingly.
The matrix $\mathbf{A}$ should be derived from $\mathbf{T}= \begin{bmatrix}
  \mathbf{c_1}, -t, 0, -1\\ \mathbf{p_1}, 0, t, 0
\end{bmatrix}$ in order to obtain (\ref{eq:BVRel}). Note that with $\mathbf{c_1},\mathbf{p_1} \in \rrq$, we can construct $\mathbf{A}$ by
replacing from $\mathbf{T}$: $\mathbf{c_1}$ and $\mathbf{p_1}$ are replaced by $rot(\mathbf{c_1})$ and $rot(\mathbf{p_1})$, constants
are replaced by the product of the themselves by the identity matrix $\mathbf{I}$. Recall that $ rot({\textbf{c}}) \in
\mathbb{Z}_q^{n\times n}$ is defined to be an anti-circulant
square matrix, whose first
column is $\mathbf{c}$, the other columns being the cyclic rotations of
$\mathbf{c}$ with the cycled entries negated
\[
  rot({\mathbf{c}})=
  \begin{bmatrix}
    c_0 & -c_{n-1} & -c_{n-2} & \dots\\
    c_1 & c_0 & -c_{n-1} & \dots\\
    \dots & \dots & \dots & \dots\\
    c_{n-1} & c_{n-2} & c_{n-3} & \dots
  \end{bmatrix}
\]
So, the matrix $\mathbf{A}$ is of the following form:
\begin{align}
  \label{matrix:ZKP}
  \begin{bmatrix}
    \SquareBox[draw=black, minimum size=35]{$rot(\mathbf{c_1})$}
    \SquareBox[draw=black, minimum size=35]{$-t\mathbf{I}$}
    \SquareBox[draw=black, minimum size=35]{$\mathbf{0}$}
    \SquareBox[draw=black, minimum size=35]{$\mathbf{-I}$}\\
    \SquareBox[draw=black, minimum size=35]{$rot(\mathbf{p_1})$}
    \SquareBox[draw=black, minimum size=35]{$\mathbf{0}$}
    \SquareBox[draw=black, minimum size=35]{$t\mathbf{I}$}
    \SquareBox[draw=black, minimum size=35]{$\mathbf{0}$}
  \end{bmatrix}
\end{align}

By constructing the matrix $\mathbf{A}$ this way, we can let $\mathbf{x} = \begin{bmatrix}
  \mathbf{s}\\\mathbf{e'}\\\mathbf{e}\\\mathbf{m}
\end{bmatrix}$,  $\mathbf{y} = \begin{bmatrix}
  -\mathbf{c_0}\\-\mathbf{p_0}
\end{bmatrix}$ and come up with the original ISIS relation $\mathbf{A}\mathbf{x} = \mathbf{y} \mod Q$. Again,
we can use the \textbf{SternExt} protocol (section \ref{append:Stern}) to obtain the ZKPoPK with $\mathbf{x}$ being
the $Prover$'s witness and $\mathbf{A}, \mathbf{y}$ being the public parameters (Algorithm \ref{alg:ZKPBV}).

\begin{algorithm}
  \caption{ZKPoPK for BV}\label{alg:ZKPBV}
  \begin{algorithmic}[1]
    \Procedure{ZKPBV}{$(\mathbf{c}, pk),(\mathbf{m, s, e, e'}))$}
    \State $rot_{c_1} \gets rot(\mathbf{c_1})$
    \State $rot_{p_1} \gets rot(\mathbf{pk_1})$
    \State let I be the $n \times n$ identity matrix
    \State let Z be the $n \times n $ zero matrix
    \State $\mathbf{A} \gets ((rot_{c_1},-tI, Z, -I),(rot_{p_1}, Z, tI,Z)) $
    \State $\mathbf{x} \gets (\mathbf{s, e', e, m})$
    \State $\mathbf{y} \gets (\mathbf{-c_0, -pk_0})$
    \State \textbf{Return} $\mathbf{SternExt(A,x,y)}$
    \EndProcedure
  \end{algorithmic}
\end{algorithm}

\subsection{ZKP of plaintext with zero coefficients}
This section extends the previous proof with several submodules. Firstly, we
need a proof to convince the server that our ciphertext encrypts the message of the form $\mathbf{m(x)} =
0 + m_1x^1 + m_2x^2 + \dots + m_{n-1}x^{n-1}$. Next, we need another proof to convince about the knowledge of encryption of
$\mathbf{m(x)} = m_0 + 0x^1 + 0x^2 + \dots + 0x^{n-1}$. We also use some other proofs for messages containing only 1s or 0s. In other words, we want the $Prover$ to convince the $Verifier$
about the format correctness of the plaintext, in addition to asserting  knowledge of the plaintext itself.

\begin{description}
\item[Proving $\mathbf{m}=\sum_{i = 0}^l(m_ix^i) \land m_0 = 0$ \textbf{(ZKPExt1)}.]
  If and only if the $Prover$ P has the message $\mathbf{m}$ in this format, he can compute:
  \begin{align*}
    rot(\mathbf{c_0})\mathbf{s} -t\mathbf{Ie'} - \begin{bmatrix}
      1\\
      0\\
      \dots\\
      0
    \end{bmatrix}\mathbf{m_0} &= -\mathbf{c_0}\\
    \iff rot(\mathbf{c_0})\mathbf{s} -t\mathbf{Ie'} - \begin{bmatrix}
      m_0\\
      0\\
      \dots\\
      0
    \end{bmatrix} &= -\mathbf{c_0}
  \end{align*}
  In order to set up this proof, we can proceed similarly to what was proposed in section \ref{sec:ZKPBV},
  just a minor modification is needed in the matrix represented in (\ref{matrix:ZKP}):
  We completely remove all the last $(n-1)$ columns of the last $n$ columns during the construction of the matrix $\mathbf{A}$ (the new $\mathbf{A}$ will thus have dimension $n \times (3n + 1)$ instead of
  $n \times 4n$). The specification is summarized in Algorithm (\ref{alg:ZKPExt1}).

  \begin{algorithm}
    \caption{ZKP for zero constant coefficient}\label{alg:ZKPExt1}
    \begin{algorithmic}[1]
      \Procedure{ZKPExt1}{$(\mathbf{c}, pk),(\mathbf{m, s, e, e'}))$}
      \State $rot_{c_1} \gets rot(\mathbf{c_1})$
      \State $rot_{p_1} \gets rot(\mathbf{pk_1})$
      \State let I be the $n \times n$ identity matrix
      \State let I' be 1 column matrix with all 1s.
      \State let Z be the $n \times n $ zero matrix
      \State let Z' be 1 column matrix with all 0s.
      \State $\mathbf{A} \gets ((rot_{c_1},-tI, Z, -I'),(rot_{p_1}, Z, tI,Z')) $
      \State $\mathbf{x} \gets (\mathbf{s, e', e, m})$
      \State $\mathbf{y} \gets (\mathbf{-c_0, -pk_0})$
      \State \textbf{Return} $\mathbf{SternExt(A,x,y)}$
      \EndProcedure
    \end{algorithmic}
  \end{algorithm}

\item[Proving $\mathbf{m}=\sum_{i = 0}^l(m_ix^i) \land m_j = 0\  for\  j = 1,2
  \dots l-1$. \textbf{(ZKPExt2)}] This proof can be engineered similarly to $\mathbf{ZKPExt1}$, following
  the same method. Except that in this one, instead of removing $(n-1)$ columns, we
  remove only the first column of the last $n$ columns of $\mathbf{A}$. The result
  is the matrix $\mathbf{A}$, with dimension $n \times (4n-1)$. The specification is summarized in Algorithm (\ref{alg:ZKPExt2}).
  \begin{algorithm}
    \caption{ZKP for only constant non-zero coefficient}\label{alg:ZKPExt2}
    \begin{algorithmic}[1]
      \Procedure{ZKPExt2}{$(\mathbf{c}, pk),(\mathbf{m, s, e, e'}))$}
      \State $rot_{c_1} \gets rot(\mathbf{c_1})$
      \State $rot_{p_1} \gets rot(\mathbf{pk_1})$
      \State let I be the $n \times n$ identity matrix
      \State let I' be I with the first column removed.
      \State let Z be the $n \times n $ zero matrix
      \State let Z' be Z with the first column removed.
      \State $\mathbf{A} \gets ((rot_{c_1},-tI, Z, -I'),(rot_{p_1}, Z, tI,Z')) $
      \State $\mathbf{x} \gets (\mathbf{s, e', e, m})$
      \State $\mathbf{y} \gets (\mathbf{-c_0, -pk_0})$
      \State \textbf{Return} $\mathbf{SternExt(A,x,y)}$
      \EndProcedure
    \end{algorithmic}
  \end{algorithm}

\item[Proving $\mathbf{m}=\sum_{i = 0}^l(m_ix^i) \land m_j = 0 \lor m_j = 1\  for \  j = 0,1
  \dots l-1$ \textbf{(ZKPExt3 and ZKPExt4)}. ] Following the previous extensions, proving that a message
  contains only zero or one coefficients amounts to a trivial modification of the matrix $\mathbf{A}$ and an according set up of the bound of
  \textbf{SternExt}.
\end{description}

\subsection{ZKP of re-encryption correctness}
\label{sec:ZKPReencrypt}
This section first discusses the module \textbf{ZKPUnpack(c, c')}, which proves the
correctness of the re-encryption of a single slot unpacked plaintext $\mathbf{m'} = Dec(\mathbf{c'})$ from the
coefficients-packed ciphertext $\mathbf{m} = Dec(\mathbf{c})$.
We then provide details about the $\mathbf{ZKPBinDecomp(c,c_i)}$ module, aimed at proving the correctness of re-encryption of a binary-encoded plaintext as a unary-encoded one.
\begin{description}
\item [{ZKPUnpack(c,c',pk, s, e, e').}]The relation of the proof is:
  % \[
  %   R_{\mathbf{ZKPUnpack}} = \{ \mathbf{c, c'} \in R_q \times R_q :
  %   \mathbf{m} = Dec(\mathbf{c}) \land \mathbf{m'} = Dec(\mathbf{c'}) \land m_0
  %   = m_0' \land (m_i' = 0 \  \forall i \neq 0)\}
  % \]
  \begin{align*}
    R_{\mathbf{ZKPUnpack}} &= \{ \mathbf{c, c'} \in R_q \times R_q , \mathbf{pk} \in R_{q}^{2}; (\mathbf{s,e,e'}) \in \chi^{n} : \\
    &\mathbf{m} = Dec(\mathbf{c}) \land \mathbf{m'} = Dec(\mathbf{c'}) \land m_0
    = m_0' \land (m_i' = 0 \  \forall i \neq 0)\}
  \end{align*}
  Given $m_0 = m_0'$, we observe $\mathbf{m(x) - m'(x)} = 0 + m''_1x + \dots + m''_{n-1}x^{n-1}$. Therefore, $\mathbf{ZKPUnpack}$
  can be carried out as specified in Algorithm (\ref{alg:ZKPUnpack})

  \begin{algorithm}
    \caption{ZKP of coefficients transform}\label{alg:ZKPUnpack}
    \begin{algorithmic}[1]
      \Procedure{ZKPUnpack}{$\mathbf{c, c', pk, s, e, e'}$}
      \State Let $b_1 \gets \mathbf{ZKPExt1((c-c',pk),(Dec(c-c'), s, e, e'))}$
      \State Let $b_2 \gets \mathbf{ZKPExt2((c',pk),(Dec(c'),s,e,e'))}$
      \State \textbf{Return} $b_1 \land b_2$
      \EndProcedure
    \end{algorithmic}
  \end{algorithm}

\item [$\mathbf{ZKPBinDecomp(c,c_i).}$] The relation of the proof is:
  \begin{align*}
    R_{\mathbf{ZKPBinDec}} &= \{ \mathbf{c}, \mathbf{c}_{i}|_{i=0}^{l-1} \in R_q \times R_q^l, \mathbf{pk} \in R_{q}^{2}; (\mathbf{s,e,e'}) \in \chi^{n}:\\
    &\mathbf{m} = Dec(\mathbf{c}) \land \mathbf{m_0} = \sum_{i=0}^{l-1}b_i2^i
    \land \mathbf{c_i} = Enc(b_i) \land b_{i} \in {0,1}
    \}
  \end{align*}
  The specification of the proof is detailed in Algorithm
  (\ref{alg:ZKPBinDecomp}).

  \begin{algorithm}
    \caption{ZKP of encoding transform}\label{alg:ZKPBinDecomp}
    \begin{algorithmic}[1]
      \Procedure{ZKPBinDecomp}{$\mathbf{c, c_i}$}
      \State Let $\mathbf{c'} \gets \sum_{i=0}^{l-1}\mathbf{c_i}2^i$
      \State Let $\mathbf{c''} \gets c - c' $
      \State \textbf{Return} $\mathbf{ZKPExt1((c'',pk),(Dec(c''),s,e,e'))}$
      \EndProcedure
    \end{algorithmic}
  \end{algorithm}
\item [Applications in our protocol.] In authentication step \ref{protocol:step5}, after receiving
  the ciphertext $C_{HD'}$, which encrypts a plaintext
  of the form $(HD', g_1, \dots, g_{n-1})$, $\user_k$ removes the noise terms $g_1, \dots,
  g_{n-1}$ and sends the re-encryption $C_{HD_0'} = Enc(HD', 0, 0, \dots,
  0)$ back to $\server$. The client needs to prove that he performs this step correctly, this is done
  by $\mathbf{ZKPUnpack(C_{HD},C_{HD_0'}})$. In this step, the server also receives $\mathbf{c_i} = Enc(b_i)$ to compute $Enc(x^{HD'})$, as discussed in section \ref{sec:binToUna}. Before doing this operation, the client needs to convince the server
  that the bits sent are actually the ones decomposed from $HD'$. This proof is done
  by $\mathbf{ZKPBinDecomp(C_{HD_0'},c_i)}$.

  Besides, In authentication step \ref{protocol:step1}, $\user_k$ uses $\mathbf{ZKPBV}$ to convince $\server$ that he is
  authenticating with a valid template $Y$. Moreover, in step \ref{protocol:step9}, $\user_k$ can use either $\mathbf{ZKPExt3}$ or $\mathbf{ZKPExt4}$ to
  convince $\server$ about the authentication result.
\end{description}

\section{Security Proofs}
\label{append:Proofs}
\subsection{Security Proof for Theorem~\ref{theo:client}: Type I Impersonation attack}
The proof of theorem \ref{theo:server} and \ref{theo:client} can be provided
using a sequence of games between the challenger $\challenger$ and the adversary
$\attacker$. We present a sequence of games as well as the relations among them to demonstrate the type I security model proof.\\
% \begin{figure}[htbp!]
%   \centering
%   \fbox{
%    \begin{gameproof}[nr=-1]
%   \gameprocedure[linenumbering, mode=text]{
%     $D_{k} \randomsample D_{bio}$\\
%     $(\sk, \pk) \gets KeyGen(params)$\\
%     $\mathbf{X}_{k} \randomsample D_{k}$\\
%     $\enc{\mathbf{X_{k}}} \gets Enc(\mathbf{X}_{k},\pk)$\\
%     For $i=1,\dots,q$:\\
%     $\mathbf{Y}_{i} \gets \{0,1\}^{n}$\\
%     $\enc{\mathbf{Y}_{i}} \gets Enc(\mathbf{Y}_{i},\pk)$\\
%     $verifierView1 \gets \mathbf{ZKPoPK1}((\sk,\mathbf{Y}_{i});(\pk,\enc{\mathbf{Y}_{i}}))$\\
%     $\enc{\mathbf{HD}_{i}} = EvalDistance(\enc{\mathbf{X}_{k}},\enc{\mathbf{Y}_{i}})$\\
%     $r_{i} \randomsample \mathbb{Z}_{HD}$,$\enc{\mathbf{HD'}_{i}} = Add(\enc{\mathbf{HD}_{i}},\enc{r_{i}})$\\
%     $HD'_{i} \gets Dec(\enc{\mathbf{HD'}_{i}},\sk)$\\
%     $verifierView2 \gets \mathbf{ZKPoPK2}((\sk,\mathbf{HD'}_{i});(\pk,\enc{\mathbf{HD'}_{i}}))$\\
%     $HD_{i} \gets HD'_{i} - r_{i}$\\
%     $res_{i} \gets compare(HD_{i}, \tau)$\\
%     $\beta \gets \adv(verifierView1, verifierView2, \enc{\mathbf{X}_{k}}, \enc{\mathbf{Y}_{i}}, res_{i}, r_{i}, HD_{i},
%     \enc{\mathbf{HD'}_{i}}, \enc{\mathbf{HD}_{i}})$ }
% \end{gameproof}
%   }
%   \caption{Game 0 - Malicious Client game}
%   \label{fig:game0protocol3client}
% \end{figure}
\textit{Game 0} Game 0 is the original impersonation game for type I attack.
\begin{description}
	\item [Setup.] $\challenger$ initiates $D_k \randomsample D_{bio}$ and $X_k
	\randomsample D_k$. $\challenger$ sets up $(sk_k, pk_k)$ and executes
	$Enrol(k, X_k)$ to get $(sk_k, T_k =(pk_k, C_k = Enc^{(1)}_{pk_k}(X_k)))$.
	$\attacker$ submits the attack query type I and receives $sk_k$ from
	$\challenger$.
        \begin{sloppypar}
	\item [Query.] $\attacker$ runs $q$ authentication sessions. In each session $j
	= 1, \dots, q$,
	$\attacker$ sends $(Q_k^{(j)} = Enc^{(1)}(Y^{(j)}))$. $\attacker$ and
	$\challenger$ runs $\mathbf{ZKPValidEnc}(Q_k^{(j)},Y^{(j)})$. $\challenger$ evaluates
	$C_{HD} = \mathbf{EvalDistance}_{pk_k}(C_k, Q_k^{(j)})$, then computes
	$C_{HD'} = (-1)C_{HD} + Enc_{pk_k}^{(1)}(r_{HD'},e_{HD'})$ for $r_{HD'}
	\randomsample \mathcal{P}$ and $e_{HD'} \randomsample \chi_{HD}$. The
	result ciphertext is sent to $\attacker$, $\attacker$ decrypts $C_{HD'}$
	and decomposes it into bits and further sends back the ciphertexts $C_0^{(j)}, \dots,
	C_{l-1}^{(j)} (= Enc^{(1)}(b_i), i = 0,\dots, l-1)$, as well as the
	re-encryption $C_{HD_0'}$. $\attacker$ and $\challenger$ engage
	$\mathbf{ZKPUnpack}(C_{HD},C_{HD_0'})$ and $\mathbf{ZKPBinDecomp}(C_{HD_0'},
	C_i^{(j)})$.
	$\challenger$ evaluates $C_{HD}'' = Enc^{(2)}(2^l + t) +
	\mathbf{ToUnary}(C_i^{(j)}) + Enc^{(2)}(-r) $ to get $Enc^{(2)}(2^l + t -
	HD)$. $\challenger$ computes $Enc^{(3)}(res) \gets
	\mathbf{MSBExtract}(C_{HD}'')$ and sends the result to $\attacker$. $\attacker$
	decrypts it and sends the authentication result bit back. $\challenger$ and
	$\attacker$ then fire $\mathbf{ZKPCorrectDec}(res)$ to trigger the server's acceptance of the
	authentication result. At the end, the server outputs \textbf{Accept} if
	all the proofs pass and $res = \mathbf{Accept}$.
        \end{sloppypar}
\end{description}
Next, we discuss the games that follow, the plan being to proceed towards the final game where
everything $\attacker$ receives relating to $X_k$ can be simulated
without any knowledge about $X_k$, except that $X_k$ is
the function $Verify(X_k, Y)$. Let $res_s = Verify(X_k, Y^{(j)})$ and $S_i$ be
the event in the game $i$ such that $res_s = Accept$.\\
\textit{Game 1}. In this game, we abort $\mathbf{ZKPValidEnc}$ if $Q_k^{(j)}$
is not a valid encryption of the query, but the $Prover$ manages to pass the
proof. Let $(*)_1$ be this event.
\[
(*_1)res_s = \begin{cases}
\text{Reject if } \mathbf{ZKPValidEnc} \text{ fails}\\
\text{res else}
\end{cases}
\]
Let $bad_0$ be the event in game 0 : $\exists j \leq q\  s.t\  (*_1)\
\textnormal{is thus the case}$. We want to show that when we modify \textit{game 0}, the
probability of a successful forgery $S_1$ in this \textit{game 1} is not much
lower than what it was. Due to the modification, we observe that
$
Pr[S_1] \geq Pr[S_0] - Pr[bad_0]
$
.For any $j$ in the $q$ authentication attempts, by the $\varepsilon-soundness$ property of
$\mathbf{ZKPValidEnc}$ as a proof of membership in (*), we have $Pr[(*_1)\
occurring\ for\ some \ j] \leq \varepsilon_{ZK1}$. So, the probability of $bad_0$
would be the union of these events, which is bounded by $Pr[bad_0] \leq
q\varepsilon_{ZK1}$. In other words, the advantage of $\attacker$ in \textit{game
	1} is
\[
Pr[S_1] \geq Pr[S_0] - Pr[bad_0] \geq \varepsilon_{imp} - q\varepsilon_{ZK1}
\]
\\
\textit{Game 2}. In this game, we abort $\mathbf{ZKPUnpack}$ if, in one of the
$j^{th}$ runs, the $Verifier$ accepts but the ciphertext does not satisfy the
relation. Let $bad_1$ be this event, by the same type of argument, we can
derive $Pr[bad_1] \leq q\varepsilon_{ZK2}$ and therefore
$$Pr[S_2] \geq Pr[S_1]
- Pr[bad_1] \geq \varepsilon_{imp} - q(\varepsilon_{ZK1}+\varepsilon_{ZK2})
$$
\textit{Game 3 and Game 4}. Similarly, we abort $\mathbf{ZKPBinDecomp}$ and
$\mathbf{ZKPCorrectDec}$ if, in any $j^{th}$ runs, the $Verifier$ accepts even
when the correctness of the ZKP is not satisfied. We have
$$Pr[S_3] \geq  \varepsilon_{imp} - q(\varepsilon_{ZK1}+\varepsilon_{ZK2}
+\varepsilon_{ZK3})
$$ and
$$Pr[S_4] \geq  \varepsilon_{imp} - q(\varepsilon_{ZK1}+\varepsilon_{ZK2} +
\varepsilon_{ZK3} + \varepsilon_{ZK4})
$$
By the end of \textit{Game 4}, if in any authentication attempt $j$, there is
no abort while running any of the 4 games, then, by the correctness property of ZKP, the
server output is equal to the output of $Verify(X_k, Y^{(j)})$. In other words,
we have shown what we could get by just querying the oracle $Verify()$. Next,
we want to simulate everything related to $X_k$ the attacker can see using
just that oracle.\\
\textit{Game 5.} At the end of \textit{Game 4}, $\challenger$ possesses the bit
$b = Verify(Y^{(i)},X_k)$. In this game, we can change $C_{res}^{(j)}$ from
$\mathbf{MSBExtract}(C_{HD}'') = Enc(b;e_{res})$ to
$Enc(verify(Y^{(i)},X_k);e_{res})$, given that the challenger can use the
secret key to extract $e_{res}$. Despite this change,
the same ciphertext is still accessible to $\attacker$, so its probability of winning of
is the same as in \textit{Game 4}.\\
\textit{Game 6.} In this game, we change the way $\challenger$ computes
$C_{HD}''$: In the original game 0, $Enc(-r)$ was added to remove the mask. We now
want to remove this $r$ from being used anywhere in the game, so we replace
this with $Enc(0)$. This change does not affect $\attacker$'s success
probability: $r$ only affects the plaintext inside $C_{HD}''$, since we do not
use this plaintext anymore (as it has been replaced in \textit{Game 5}), so this change
does not affect the information available to the attacker. Again, $Pr[S_6] = Pr[S_5] = Pr[S_4]$.\\
\textit{Game 7.} We modify the way $C_{HD}'$ is computed in this game. Instead
of calculating $C_{HD}' \gets (-1)C_{HD} + Enc(r;e_{HD'})$, the challenger chooses a
random $HD' \randomsample \mathbb{Z}_t$ and encrypts it with the noise used
before: $C_{HD}' \gets Enc(HD'; -e_{HD} + e_{HD'})$. In this game, the
plaintext has changed from being $r + HD$ to a uniform $HD' \in \mathbb{Z}_t$.
Since $r$ is also uniform in $\mathbb{Z}_t$, the attacker is confronted with a uniform
plaintext in both cases. Therefore, $Pr[S_7] = Pr[S_6]$.\\
\textit{Game 8.} Finally, we set $C_{HD'} = Enc(HD', e_{HD'})$ for $e_{HD'}
\randomsample \chi_{mask}$ instead of $-e_{HD} + e_{HD'}$. We replace the sum
of the Gaussian noise with a random noise. In the previous chapter, we
showed that $Pr[S_8] \geq \frac{1}{c(\delta)}(Pr[S_7]-q \cdot \delta)$, where $c(\delta) = RD(-e_{HD} + e_{HD'},
e_{HD}) \leq 2 \cdot e^{1+2\delta}$ by Lemma~\ref{le:Renyi} and by our assumption on the parameter's values. After we finish \textit{Game 8}, we notice that all the messages available to the attacker can be simulated with only the verified bit $b =
Verify(Y^{(i)}, X_k)$. We now have an attacker $A'$ against the biometric
impersonation with advantage:
\[
\varepsilon_{bio} = Adv(A') = Pr[S_8] \geq \frac{1}{c(\delta)}(\varepsilon_{imp} - q(\varepsilon_{ZK1}+\varepsilon_{ZK2} +
\varepsilon_{ZK3} + \varepsilon_{ZK4}) + \delta),
\]
which gives the claimed bound $\varepsilon_{imp} \leq c(\delta) \cdot \varepsilon_{bio} + q \cdot (\varepsilon_{ZK1}+\varepsilon_{ZK2} +
\varepsilon_{ZK3} + \varepsilon_{ZK4}) + \delta \leq (c(\delta)+c_1) \cdot \varepsilon_{bio}$ if $q(\varepsilon_{ZK1}+\varepsilon_{ZK2} +
\varepsilon_{ZK3} + \varepsilon_{ZK4}) + \delta \leq c_1 \cdot \varepsilon_{bio}$.

\subsection{Security Proof for Theorem~\ref{theo:client}: Type II Impersonation attack}
\label{append:ProofsTypeII}
The proof of Theorem \ref{theo:client} can be provided using a sequence of games between the challenger $\challenger$ and the adversary $\attacker$. We present
a sequence of games as well as the relations among them to demonstrate the type II security model proof. The idea is that in this type of attack, $sk_k$ is not used to compute the view of $\attacker$. On the other hand, the soundness of the zero-knowledge proof of knowledge $\mathbf{ZKPValidEnc}$ implies the existence of an efficient witness extractor algorithm, that can be used to extract the witness (i.e. the secret key $sk_k$) from a cheating prover succeeding with probability non-negligibly higher than the knowledge error of the zero-knowledge proof, thus contradicting the IND-CPA security of the BV encryption scheme. \\\\
\textit{Game 0}. Game 0 is the original impersonation game for a type II attack, i.e., the same as Game 0 in the proof of security against Type I attacks, except that $(T_k =(pk_k, C_k = Enc^{(1)}_{pk_k}(X_k)))$ is given by $\challenger$ to $\attacker$ at the beginning of the game, rather than $sk_k$.
For $j \in \{1,\ldots,q\}$, let $res^{j}$ denote the result of the $j$th authentication protocol run between $\attacker$ and $\challenger$, and $S_0$ be
the event in the game $0$ such that $res^{j} = Accept$ for some $j=1,\ldots,q$. We have $\Pr[S_0] = \varepsilon_{imp,II}$ as the type II success probability of $\attacker$. \\\\
\textit{Game 1}. From the definition of event $S_0$ in Game 0, it follows that there exists some $j^* \in \{1,\ldots,q\}$ such that $\Pr[res^{j^*} = Accept] \geq \varepsilon_{imp,II}/q$. Furthermore, by an averaging argument, there must exist a set $G$ of $(D_k,X_k,pk_k)$ such that $\Pr[(D_k,X_k,pk_k) \in G] \geq \varepsilon_{imp,II}/(2 \cdot q)$, and for each $(D'_k,X'_k,pk'_k) \in G$, we have $\Pr[res^{j^*} = Accept |(D_k,X_k,pk_k)=(D'_k,X'_k,pk'_k)] \geq  \varepsilon_{imp,II}/(2 \cdot q)$. By $\varepsilon_{ZK1}$-soundness of the zero-knowledge proof of knowledge $\mathbf{ZKPValidEnc}$ \cite{goldreich2009foundations}, there exists a witness extractor algorithm that runs in expected time $T'=O(\mathrm{poly}(n \log Q) \cdot T / (\varepsilon_{imp,II}/(2*q) - \varepsilon_{ZK1}))$, where $T$ denotes the run-time of $\attacker$ and outputs a witness containing $sk_k$ for ${ZKPValidEnc}$. Therefore, we obtain a (secret key recovery) attack algorithm against the IND-CPA security of the BV encryption scheme, with expected run-time $T'$ and advantage $\varepsilon' \geq \varepsilon_{imp,II}/(2 \cdot q)$. Hence,  if $\varepsilon_{imp,II}/(2*q) - \varepsilon_{ZK1} > \varepsilon_{imp,II}/(4*q)$, or equivalently, if $\varepsilon_{imp,II} > 4 \cdot q \varepsilon_{ZK1}$, we obtain a contradiction with the assumption the BV encryption scheme with parameters $Q,n,\sigma$ is IND-CPA against attacks with expected time $O(\mathrm{poly}(n \log Q) \cdot T / \varepsilon_{ZK1})$ and advantage $\geq \varepsilon_{ZK1}$. It follows under the latter assumption that $\varepsilon_{imp,II} \leq 2q \varepsilon_{ZK1} \leq 4 c_1  \cdot \varepsilon_{bio}$, under the assumption that  $q(\varepsilon_{ZK1}+\varepsilon_{ZK2} +
\varepsilon_{ZK3} + \varepsilon_{ZK4} + \delta) \leq c_1 \cdot \varepsilon_{bio}$.

\subsection{Security Proof for Theorem~\ref{theo:server}: Privacy against Server}
\label{append:ProofsPrivacy}
The proof of Theorem \ref{theo:client} can be done using a sequence of games between the challenger $\challenger$ and the adversary $\attacker$. We present a sequence of games. The idea is to proceed to remove $sk_k$ and $X_k$ from being used to compute the view of $\attacker$, except for $Verify(X_k,Y_k^{j})$ queries, as in the ideal game, relying on the correctness of the protocol and the IND-CPA security of the BV encryption scheme. \\\\
\textit{Game 0}. Game 0 is the original real privacy game, in which $(T_k =(pk_k, C_k = Enc^{(1)}_{pk_k}(X_k)))$ is given by $\challenger$ to $\attacker$ at the beginning of the game. Then, for $j=1\ldots,q$, the attacker sends $Y_k^{(j)} \in \{0,1\}^n$ to $\challenger$, and the latter simulates a run of the authentication protocol between an honest client with input $(k,Y_k^{(j)}, sk_k)$ and an honest server with input $(k,T_k)$, returning to $\attacker$ the protocol view $V^{(j)}_S$ of the server. Finally, $\attacker$ outputs a bit $\beta$. In the following Game $i$, we let $S_i$ denote the event of $\beta=1$.\\\\
\textit{Game 1}. We change the computation of the authentication result bit $res^{(j)}$ sent by client to server from the decryption of the ciphertext $\textbf{MSBExtract}(C''_{HD}$ (its value in Game 0) to the result returned by $Verify(X_k, Y^{(j)})$. By correctness of the protocol, this does not change the value of $res^{(j)}$, so $\Pr[S_1] = \Pr[S_0]$. \\\\
\textit{Game 2}. We change the computation of the zero-knowledge protocol transcripts. Instead of computing those transcripts using the secret witnesses, we simulate them using the statistical zero-knowledge simulator algorithms for the zero-knowledge proofs. By the zero-knowledge property, this is a perfect simulation, yielding $\Pr[S_2]= \Pr[S_1]$.\\\\
\textit{Game 3}. We change the computation of the ciphertexts $C^{(j)}_i$ for $i=0,\ldots,l-1$ and $Q^{(j)}_k$ for $j=1,\ldots,q$ and $C_k$ to encrypt zero messages, instead of encrypting the secret-related messages as in the previous game. Since now $sk_k$ is not used anywhere in generating the view of $\attacker$, it follows by a hybrid argument that $|\Pr[S_3]-\Pr[S_2]| ((l+1) \cdot q + 1) \cdot \varepsilon_{BV}$, where $\varepsilon_{BV}$ denotes the maximal advantage of an attacker against IND-CPA of BV scheme against attacks with run-time $T + \mathrm{poly}(n, \log Q)$, where $T$ is the run-time of $\attacker$.
In this game, since the only information on $X_k$ comes via the $Verify(X_k,Y_k^{j})$ queries, the challenger together with $\attacker$ constitute an efficient attacker against the ideal privacy game, which outputs 1 with probability different by at most $(l+1) \cdot q + 1) \cdot \varepsilon_{BV}$ relatively to the probability of outputting 1 in the real privacy game, as required.

\section{Conclusion}
\label{sec:evaluation}
We quickly notice that the main bottle neck of this protocol is the
communication size: 4 different Zero-Knowledge Proofs are needed for one
authentication. With the parameters set used previously
($n=2048, q \approxeq 2^{70}, t = 2048, \sigma=8$), the communication size for
each authentication ($\approx 84MB$) will not satisfy the practical usage
requirement. However, the contributions of this chapter maybe of independent
interest, as building blocks for other secure computation protocols are based on the
BV SWHE scheme:
\begin{itemize}
\item A ZKP technique to prove the correctness of re-encryption of a
  binary-encoded plaintext (useful for efficient homomorphic
  addition/multiplication arithmetic operations) as a unary-encoded plaintext
  (useful for efficient homomorphic comparison operations).
\item Correctness of re-encryption of a coefficient-packed plaintext slot vector
  into an unpacked single slot plaintext.
\end{itemize}
In the next chapter, we discuss different techniques used to remove this
communication overhead: we replace the Stern-based ZKP technique, which requires
many rounds of proof for security by the Schnoor-based technique (requiring only 1 round). Other cryptographic tools including Garbled Circuit and Oblivious
Transfer will be used in the HD comparison step to avoid supplementary proofs during
authentication.

%%% Local Variables:
%%% mode: latex
%%% TeX-master: "../thesis"
%%% End:


\documentclass[11pt]{beamer}
\input{definitions}

\begin{document}
	\author{Myles Lee}
	\title{Explaining Makespan Schedules}
	\date{25\textsuperscript{th} June 2019}

	\begin{frame}[plain]
		\maketitle
	\end{frame}

	\begin{frame}
		\frametitle{Introduction}
		\makebox[\textwidth][c]{
			\begin{tikzpicture}
				\node (left) at (0, 0){\includegraphics[scale=0.25]{figures/inefficient_makespan.png}};
				\node (right) at (6, 0){\includegraphics[scale=0.25]{figures/efficient_makespan.png}};
				\draw[thick,->] (left) -- (right) node[midway, above] {optimise};
			\end{tikzpicture}
		}
		\begin{itemize}
			\item Solvers and schedules are difficult to understand
			\item Apply argumentation to makespan schedules to generate explanations
		\end{itemize}
	\end{frame}

	\begin{frame}
		\frametitle{Contributions}
		\begin{columns}
			\begin{column}{0.5\textwidth}
				\includegraphics[width=\textwidth]{figures/tool_gui.png}
			\end{column}
			\begin{column}{0.5\textwidth}
				\resizebox{\textwidth}{!}{\input{theorem_textless}}
			\end{column}
		\end{columns}

		\begin{columns}
			\begin{column}{0.5\textwidth}
				\begin{itemize}
					\item Interactive tool
					\item Algorithms
				\end{itemize}
			\end{column}
			\begin{column}{0.5\textwidth}
				\begin{itemize}
					\item Theoretical extensions
					\item Discussion
				\end{itemize}
			\end{column}
		\end{columns}
	\end{frame}

	\begin{frame}
		\frametitle{Demonstration}
		\includegraphics[width=\textwidth]{figures/tool_gui.png}
	\end{frame}

	\subsection{Interactive Tool and Algorithms}

	\begin{frame}
		\frametitle{Abstract Argumentation}
		\begin{itemize}
			\item An abstract argumentation framework is a directed graph $\pair{Args}{\rightsquigarrow}$.
			\item Extension $E$ is a subset of $Args$.
		\end{itemize}

		\begin{definition}
			$E$ is conflict-free on $\pair{Args}{\rightsquigarrow}$ iff $\forall a,b\in E. a\not\rightsquigarrow b$.
		\end{definition}

		\begin{definition}
			$E$ is stable on $\pair{Args}{\rightsquigarrow}$ iff $E$ is conflict-free on $\pair{Args}{\rightsquigarrow}$ and $\forall a\in Args\setminus E.\exists e\in E.e\rightsquigarrow a$.
		\end{definition}
	\end{frame}

	\begin{frame}[label=pipeline]
		\frametitle{Pipeline}
		\resizebox{\textwidth}{!}{\input{pipeline}}
	\end{frame}

	\begin{frame}
		\frametitle{Feasibility Framework Construction}

		\begin{columns}
			\begin{column}{0.5\textwidth}
				\begin{center}
					$\begin{bmatrix}
						1 & 0 & 1\\
						0 & 1 & 0\\
					\end{bmatrix}$
					\begin{equation*}
						\forall j\in\mathcal{J}.\sum_{i\in\mathcal{M}}x_{i,j}=1
					\end{equation*}
				\end{center}
			\end{column}
			\begin{column}{0.5\textwidth}
				\begin{center}
					\begin{tikzpicture}
						\node(a) at (0, 0){$\pair{2}{\mathtt{a}}$};
						\node(b) at (1, 0){$\pair{2}{\mathtt{b}}$};
						\node(c) at (2, 0){$\pair{2}{\mathtt{c}}$};
						\node(d) at (0, 2){$\pair{1}{\mathtt{a}}$};
						\node(e) at (1, 2){$\pair{1}{\mathtt{b}}$};
						\node(f) at (2, 2){$\pair{1}{\mathtt{c}}$};

						\draw[thick,<->](a) -- (d);
						\draw[thick,<->](b) -- (e);
						\draw[thick,<->](c) -- (f);
					\end{tikzpicture}
					$Args_F=\mathcal{M}\times\mathcal{J}$\\
					$\pair{i}{j}\rightsquigarrow_F\pair{i'}{j'}$ iff $i\neq i'\land j=j'$
				\end{center}
			\end{column}
		\end{columns}
	\end{frame}

	\begin{frame}
		\frametitle{Framework Modelling}

		\begin{definition}
			Framework $\pair{Args}{\rightsquigarrow}$ stability-models a property $P$ iff $\forall E\subseteq Args.E$ is stable on $\pair{Args}{\rightsquigarrow}\Leftrightarrow P$
		\end{definition}

		\begin{tikzpicture}
			\node(a) at (0, 0){$\pair{2}{\mathtt{a}}$};
			\node(b) at (1, 0){$\pair{2}{\mathtt{b}}$};
			\node(c) at (2, 0){$\pair{2}{\mathtt{c}}$};
			\node(d) at (0, 2){$\pair{1}{\mathtt{a}}$};
			\node(e) at (1, 2){$\pair{1}{\mathtt{b}}$};
			\node(f) at (2, 2){$\pair{1}{\mathtt{c}}$};

			\draw[thick,<->](a) -- (d);
			\draw[thick,<->](b) -- (e);
			\draw[thick,<->](c) -- (f);

			\node at (-1.7, 0.5){$\pair{Args_F}{\rightsquigarrow_F}$};
			\draw (-0.5, -0.5) rectangle (2.5, 2.5);

			\node at (-5, 1.5){$P_F\equiv\forall j\in\mathcal{J}.\sum_{i\in\mathcal{M}}x_{i,j}=1$};
		\end{tikzpicture}

		\begin{theorem}
			$\pair{Args_F}{\rightsquigarrow_F}$ \textnormal{stability-models} $P_F$
		\end{theorem}
	\end{frame}

	\begin{frame}
		\frametitle{Algorithm Notation}

		\begin{columns}
			\begin{column}{0.5\textwidth}
				\begin{align*}
					\mathbf{0}^{2\times 2}&=
					\begin{bmatrix}
						0&0\\
						0&0\\
					\end{bmatrix}
				\end{align*}

				\begin{align*}
					\begin{bmatrix}
						0&0\\
						1&1\\
					\end{bmatrix}
					\incircbin{\land}
					\begin{bmatrix}
						0&1\\
						0&1\\
					\end{bmatrix}
					&=
					\begin{bmatrix}
						0&0\\
						0&1\\
					\end{bmatrix}
				\end{align*}
			\end{column}
			\begin{column}{0.5\textwidth}
				\begin{align*}
					\incircbin{\neg}
					\begin{bmatrix}
						1&0\\
						0&1\\
					\end{bmatrix}&=
					\begin{bmatrix}
						0&1\\
						1&0\\
					\end{bmatrix}
				\end{align*}

				\begin{align*}
					\begin{bmatrix}
						0&0\\
						1&1\\
					\end{bmatrix}
					\incircbin{\lor}
					\begin{bmatrix}
						0&1\\
						0&1\\
					\end{bmatrix}
					&=
					\begin{bmatrix}
						0&1\\
						1&1\\
					\end{bmatrix}
				\end{align*}
			\end{column}
		\end{columns}
	\end{frame}

	\begin{frame}
		\frametitle{Construct-Feasibility Algorithm}
		\begin{algorithm}[H]
			\caption{}
			\begin{algorithmic}[1]
				\Function{Construct-Feasibility}{$m$, $n$}
				\State $\twoheadrightarrow_F$ $\gets$ $\mathbf{0}^{(m\times n)^2}$
				\For{$i_1,i_2\in\mathcal{M},j\in\mathcal{J}$}
				\If{$i_1\neq i_2$}
				\State ${\twoheadrightarrow_F}_{i_1,j,i_2,j}$ $\gets$ 1
				\EndIf
				\EndFor
				\State \Return $\twoheadrightarrow_F$
				\EndFunction
			\end{algorithmic}
		\end{algorithm}
	\end{frame}

	\begin{frame}
		\frametitle{Explain-Stability Algorithm}
		\vspace{-0.3\baselineskip}
		\begin{algorithm}[H]
			\caption{}
			\begin{algorithmic}[1]
				\Function{Explain-Stability}{$\mathbf{x}$, $\twoheadrightarrow$, $\bar{\mathbf{u}}$, $\bar{\mathbf{c}}$}
				\State $\mathbf{u}$ $\gets\incircbin{\neg}$ $\mathbf{x}$
				\State $\mathbf{c}$ $\gets\mathbf{0}^{(m\times n)^2}$
				\For{$i\in\mathcal{M},j\in\mathcal{J}$}
				\If{$x_{i,j}=1$}
				\State $\mathbf{u}$ $\gets$ $\mathbf{u}$ $\incircbin{\land}$ $\incircbin{\neg}\twoheadrightarrow_{i,j}$
				\State $c_{i,j}$ $\gets$ $\mathbf{x}$ $\incircbin{\land}$ $\twoheadrightarrow_{i,j}$
				\EndIf
				\EndFor
				\State $\mathbf{u}$ $\gets$ $\mathbf{u}$ $\incircbin{\land}$ $\incircbin{\neg}$ $\bar{\mathbf{u}}$
				\State $\mathbf{c}$ $\gets$ $\mathbf{c}$ $\incircbin{\land}$ $\incircbin{\neg}$ $\bar{\mathbf{c}}$
				\State \Return $\pair{\mathbf{u}}{\mathbf{c}}$
				\EndFunction
			\end{algorithmic}
		\end{algorithm}
	\end{frame}

	\begin{frame}
		\frametitle{Explain-Feasibility Algorithm}
		\vspace{-0.8\baselineskip}
		\scalebox{0.64}{\begin{minipage}{1.5625\textwidth}
			\begin{algorithm}[H]
				\caption{}
				\begin{algorithmic}[1]
					\Function{Explain-Feasibility}{$\mathbf{u}$, $\mathbf{c}$}
						\If{$m=0$}
							\If{$n=0$}
								\State \emph{There are no jobs, so the schedule is trivially feasible.}
							\Else
								\State \emph{There are no machines to allocate to jobs.}
							\EndIf
						\Else
							\If{$\mathbf{u}=\mathbf{0}\land\mathbf{c}=\mathbf{0}$}
							\State \emph{All jobs are allocated to exactly one machine.}
							\Else
							\For{$j\in\mathcal{J}$}
							\If{$u_{:,j}=1$}
							\State \emph{Job $j$ is not allocated to any machine.}
							\EndIf
							\If{$c_{:,j,:,j}\neq\mathbf{0}$}
							\State \emph{Job $j$ is over-allocated to machines $\{i\ |\ i\in\mathcal{M}, x_{i,j}=1\}$.}
							\EndIf
							\EndFor
							\EndIf
						\EndIf
					\EndFunction
					\end{algorithmic}
			\end{algorithm}
		\end{minipage}}
	\end{frame}

	\againframe{pipeline}

	\begin{frame}
		\frametitle{Algorithms Overview}
		\begin{center}
			\resizebox{0.9\textwidth}{!}{\input{algorithms}}
		\end{center}
	\end{frame}

	\begin{frame}
		\frametitle{Generating Efficiency Explanations}

		\begin{columns}
			\begin{column}{0.5\textwidth}
						\begin{itemize}
					\item Single and pair-wise exchange properties
					\item Fixed decision awareness
					\item Explanations are:
					\begin{itemize}
						\item superfluous
						\item local
						\item expensive
					\end{itemize}
				\end{itemize}
			\end{column}
			\begin{column}{0.5\textwidth}
				\includegraphics[width=\textwidth]{figures/inefficient_makespan.png}
			\end{column}
		\end{columns}
	\end{frame}

	\begin{frame}
		\frametitle{Generating Fixed Decisions Explanations}
		\scalebox{0.8}{\begin{minipage}{1.125\textwidth}
			\begin{algorithm}[H]
				\caption{}
				\begin{algorithmic}[1]
					\Function{Explain-Satisfaction}{$D$, $\mathbf{u}$, $\mathbf{c}$}
						\For{$j\in\mathcal{J}$}
							\If{$\exists i\in\mathcal{M}\ \pair{i}{j}\not\in D^-$}
								\State\emph{Job $j$ cannot be allocated to any machine.}
							\EndIf
							\If{$D^-$ and $D^+$ are not disjoint}
								\State\emph{Job $j$ has conflicting negative and positive fixed decisions.}
							\EndIf
							\If{$|\{i\in\mathcal{M}\ |\ \pair{i}{j}\in D^+\}|>1$}
								\State\emph{Job $j$ cannot be allocated to multiple machines.}
							\EndIf
						\EndFor
						\State ...
					\EndFunction
				\end{algorithmic}
			\end{algorithm}
		\end{minipage}}
	\end{frame}

	\begin{frame}
		\frametitle{Partial-Precomputation Optimisation}
		\begin{itemize}
			\item $\twoheadrightarrow$ construction has $\mathcal{O}(m^2n^2)$ memory usage.
			\item Inline stability and framework construction algorithms
			\item Operate on sub-graphs $\twoheadrightarrow_{i,j}$
		\end{itemize}
		\vspace{\baselineskip}
		\begin{itemize}
			\item Full-Precomputation complexity: $\mathcal{O}(m^2n^2)$
			\item Partial-Precomputation complexity: $\mathcal{O}(mn^2)$
		\end{itemize}
	\end{frame}
	\subsection{Theoretical Extensions}

	\begin{frame}
		\frametitle{Time-indexed Interval Scheduling}
		\begin{columns}
			\begin{column}{0.5\textwidth}
				\begin{center}
					\includegraphics[width=\textwidth]{figures/interval_schedule.png}
				\end{center}
			\end{column}
			\begin{column}{0.5\textwidth}
				\begin{itemize}
					\item Single-allocation of jobs
					\item No overlapping jobs
					\item Start and finish times
					\item Fixed decisions
				\end{itemize}
			\end{column}
		\end{columns}
	\end{frame}

	\begin{frame}
		\frametitle{Theoretical Applications}
		\begin{definition}
			Property $P$ is stability-modellable iff $\exists\pair{Args}{\rightsquigarrow}.\pair{Args}{\rightsquigarrow}$ stability models $P$.
		\end{definition}
		\begin{theorem}
			\textnormal{Interval scheduling feasibility is stability-modellable.}
		\end{theorem}
	\end{frame}

	\begin{frame}
		\frametitle{Union of Modelling Frameworks Theorem}
		\begin{center}
			\resizebox{0.9\textwidth}{!}{\input{theorem}}
		\end{center}
	\end{frame}

	\subsection{Evaluation}

	\begin{frame}
		\frametitle{Questionnaire}
		\begin{columns}
			\begin{column}{0.5\textwidth}
				\begin{center}
					\fbox{\includegraphics[scale=0.2,page=1]{../report/questionnaire.pdf}}
				\end{center}
			\end{column}
			\begin{column}{0.5\textwidth}
				\begin{center}
					\fbox{\includegraphics[scale=0.2,page=2]{../report/questionnaire.pdf}}
				\end{center}
			\end{column}
		\end{columns}
	\end{frame}

	\begin{frame}
		\frametitle{Questionnaire Results}
		\begin{center}
			\includegraphics[width=0.8\textwidth]{figures/questionnaire_results_summary.png}
		\end{center}
	\end{frame}

	\begin{frame}
		\frametitle{Profiling}
		\begin{itemize}
			\item $m=10$
		\end{itemize}
		\begin{columns}
			\begin{column}{0.5\textwidth}
				\begin{center}
					\includegraphics[width=\textwidth]{figures/cpu_profile.png}
					CPU Performance
				\end{center}
			\end{column}
			\begin{column}{0.5\textwidth}
				\begin{center}
					\includegraphics[width=\textwidth]{figures/memory_profile.png}
					Memory Performance
				\end{center}
			\end{column}
		\end{columns}
	\end{frame}

	\subsection{Conclusion}
	\begin{frame}
		\frametitle{Limitations with Argumentation}
		\begin{itemize}
			\item Memory performance
			\item Computational performance
			\item Abstracted interface
			\item Functional equivalence
			\item Implementation complexity
		\end{itemize}
	\end{frame}

	\begin{frame}
		\frametitle{Practicability of Argumentation}
		\resizebox{\textwidth}{!}{\begin{minipage}{\textwidth}
				\input{../report/problempath}
		\end{minipage}}
	\end{frame}

	\begin{frame}
		\frametitle{Summary}
		\begin{center}
			\begin{tikzpicture}
				\node[draw,align=center](a) at (0, 0){Explaining makespan schedules using argumentation is\\practically
				possible but not practically suitable.};
			\end{tikzpicture}
		\end{center}
	\end{frame}

	\begin{frame}
		\frametitle{Resources}
		\begin{center}
			These slides, report and source code are accessible at \url{github.com/mylestunglee/aes}.
		\end{center}
\end{frame}
\end{document}