%!TEX root = morusAC.tex

\section{Analysis on Initialization and Finalization of Reduced \texorpdfstring{\MORUS}{MORUS}}
\label{sec/IniFin}

The bias in the previous sections analysed the encryption part of the \MORUS. In this section, for comprehensive security analysis of \MORUS, we provide new attacks on reduced version of the initialization and the finalization. We emphasize that the results in this section do not threaten any security claim by the designers. However, we believe that investigating all parts of the design with different approaches from the existing work on \MORUS provides a better understanding and will be useful especially when the design will be tweaked in future.

\subsection{Forgery with Reduced Finalization}
\label{subsec/Fin}
We present forgery attacks on 3 out of 10 steps of \MORUS[1280] that claims 128-bit security for integrity. The attack only works for a limited number of steps, while it works in the nonce-respecting setting. As far as we know, this is the first attempt to evaluate integrity of \MORUS in the nonce-respecting setting.

\subsubsection{Overview.}
A general strategy for forgery attacks in the nonce-respecting setting is to inject some difference in a message block and propagate it so that it can be canceled by a difference in another message block. However this approach does not work well against \MORUS due to its large state size which prevents an attacker from easily controlling the differences in different registers.

Here we focus on the property that the padding for an associated data $A$ and a message $M$ is the zero-padding, hence $A$ and $A'=A\|0^*$ and $M$ and $M'=M\|0$ result in identical states after the associated data processing and the encryption parts, as long as $A,A'$ and $M,M'$ fit in the same number of blocks. During the finalization, since $A,A'$ (resp. $M,M'$) have different lengths, the corresponding 64-bit values $\adlen$ (resp. $\msglen$) are different, which appears as $\Delta \adlen$ (resp. $\Delta \msglen$) during the finalization, and is injected through the message input interface. Our strategy is to propagate this difference to the 128-bit tags $T$ and $T'$ such that their difference $\Delta T$ appears with higher probability than $2^{-128}$. All in all, the forgery succeeds as long as the desired $\Delta T$ is obtained or in other words, the attacker does not have to cancel the state difference, which is the main advantage of attacking the finalization part of the scheme.

Note that if the attacker uses different messages $M,M'$, not only the new tag $T'$ but also new ciphertext $C'$ must be guessed correctly. Because the encryption of \MORUS is a simple XOR of the key stream, $C'$ can be easily guessed. For this purpose, the attacker should first query a longer message $M'=M\|0^*$ to obtain $C'$. Then, $C$ can be obtained by truncating $C'$.

\subsubsection{Differential Trails.}
Recall that the message input during the finalization of \MORUS[1280] is $\adlen\mathrel\|\msglen\mathrel\|0^{128}$ where $\adlen$ and $\msglen$ are 64-bit strings. We set $\Delta \adlen$ to be of low Hamming weight, e.g.,~{\tt 0x0000000000000001}.
%Hereafter, we use {\tt typefont} denote hexadecimal numbers.
This difference propagates through 3 steps as specified in \Cref{Tbl:fin_diff}.

Recall that each step consists of 5 rounds and the input message is absorbed to the state in rounds 2 to 5. The trail in \Cref{Tbl:fin_diff} initially does not have any difference and the same continues even after round 1. Differences start to appear from round 2 and they will go through the bitwise-AND operation from round 4. We need to pay 1 bit to control each active AND gate. The probability evaluation for round 15 can be ignored since in this round only $S_4$ is non-linearly updated, while $S_4$ is never used for computing the tag. Finally, bitwise-AND in the tag computation is taken into account. Note that the tag is only 128 LSBs, thus the number of active AND gates should be counted only for those bits. As shown in \Cref{Tbl:fin_diff}, we can have a particular tag difference $\Delta T$ with probability $2^{-88}$. Thus after observing $A$ and corresponding $T$, $A\|0$ and $(T \oplus \Delta T)$ is a valid pair with probability $2^{-88}$.

\begin{table}[!tb]
\begin{center}
\caption{Differential propagation through 3 Steps. Five lines for round $i$ denote the difference of $S_0, \cdots, S_4$ after the round $i$ transformation.} %Weight is a Hamming weight of the state difference and accumulated probability is a probability to satisfy the trail from the beginning.}
\label{Tbl:fin_diff}
{%
\iflncsmargins
\tiny
\else
\scriptsize
\renewcommand{\arraystretch}{0.9}
\fi
\begin{tabular}{ccccccc} \hline
Round & \multicolumn{4}{c}{State difference} & Weight & Accumulated probability \\ \hline
%      & & & &                                &        &
      & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & 0  & \\
      & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & 0  & \\
Ini   & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & 0  & $-$ \\
      & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & 0  & \\
      & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & 0  & \\ \hline

      & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & 0  & \\
      & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & 0  & \\
1     & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & 0  & $1$\\
      & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & 0  & \\
      & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & 0  & \\ \hline

      & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & 0  & \\
      & {\tt 0000400000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & 1  & \\
2     & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & 0  & $1$\\
      & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & 0  & \\
      & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & 0  & \\ \hline

      & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & 0  & \\
      & {\tt 0000400000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & 1  & \\
3     & {\tt 0000004000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & 1  & $1$\\
      & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & 0  & \\
      & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & 0  & \\ \hline

      & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & 0  & \\
      & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000400000000000} & {\tt 0000000000000000} & 1  & \\
4     & {\tt 0000004000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & 1  & $1$\\
      & {\tt 0020000000000080} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & 2  & \\
      & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & 0  & \\ \hline

      & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & 0  & \\
      & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000400000000000} & {\tt 0000000000000000} & 1  & \multirow{3}{*}{$2^{-1}$}\\
5     & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000004000000000} & 1  & \\
      & {\tt 0020000000000080} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & 2  & \\
      & {\tt 0000040000000010} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & 2  & \\ \hline

      & {\tt 0000000000100004} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & 2  & \\
      & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000400000000000} & {\tt 0000000000000000} & 1  & \multirow{3}{*}{$2^{-3}$}\\
6     & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000004000000000} & 1 & \\
      & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0020000000000080} & 2  & \\
      & {\tt 0000040000000010} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & 2  & \\ \hline

      & {\tt 0000000000100004} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & 2  & \\
      & {\tt 0004400001000000} & {\tt 0000000000000000} & {\tt 0000000010000000} & {\tt 0000000000000000} & 4  & \multirow{3}{*}{$2^{-6}$}\\
7     & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000004000000000} & 1  & \\
      & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0020000000000080} & 2  & \\
      & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000040000000010} & {\tt 0000000000000000} & 2  & \\ \hline

      & {\tt 0000000000000000} & {\tt 0000000000100004} & {\tt 0000000000000000} & {\tt 0000000000000000} & 2  & \\
      & {\tt 0004400001000000} & {\tt 0000000000000000} & {\tt 0000000010000000} & {\tt 0000000000000000} & 4  & \multirow{3}{*}{$2^{-10}$}\\
8     & {\tt 0400014000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000001000} & 4  & \\
      & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0020000000000080} & 2  & \\
      & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000040000000010} & {\tt 0000000000000000} & 2  & \\ \hline

      & {\tt 0000000000000000} & {\tt 0000000000100004} & {\tt 0000000000000000} & {\tt 0000000000000000} & 2  & \\
      & {\tt 0000000010000000} & {\tt 0000000000000000} & {\tt 0004400001000000} & {\tt 0000000000000000} & 4  & \multirow{3}{*}{$2^{-14}$}\\
9     & {\tt 0400014000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000001000} & 4  & \\
      & {\tt 0220000080000080} & {\tt 0000000000000000} & {\tt 0000000800000000} & {\tt 1000000000004000} & 7  & \\
      & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000040000000010} & {\tt 0000000000000000} & 2  & \\ \hline

      & {\tt 0000000000000000} & {\tt 0000000000100004} & {\tt 0000000000000000} & {\tt 0000000000000000} & 2  & \\
      & {\tt 0000000010000000} & {\tt 0000000000000000} & {\tt 0004400001000000} & {\tt 0000000000000000} & 4  & \multirow{3}{*}{$2^{-20}$}\\
10    & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000001000} & {\tt 0400014000000000} & 4  & \\
      & {\tt 0220000080000080} & {\tt 0000000000000000} & {\tt 0000000800000000} & {\tt 1000000000004000} & 7  & \\
      & {\tt 4000140000000010} & {\tt 0000000000000000} & {\tt 0000400000000100} & {\tt 0000000000010000} & 7  & \\ \hline

      & {\tt 0000100000100044} & {\tt 0000000200008000} & {\tt 0001000000000000} & {\tt 0000000008000200} & 9  & \\
      & {\tt 0000000010000000} & {\tt 0000000000000000} & {\tt 0004400001000000} & {\tt 0000000000000000} & 4  &\multirow{3}{*}{$2^{-28}$} \\
11    & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000001000} & {\tt 0400014000000000} & 4  & \\
      & {\tt 0000000000000000} & {\tt 0000000800000000} & {\tt 1000000000004000} & {\tt 0220000080000080} & 7  & \\
      & {\tt 4000140000000010} & {\tt 0000000000000000} & {\tt 0000400000000100} & {\tt 0000000000010000} & 7  & \\ \hline

      & {\tt 0000100000100044} & {\tt 0000000200008000} & {\tt 0001000000000000} & {\tt 0000000008000200} & 9  & \\
      & {\tt 0004500005000400} & {\tt 0000000000000000} & {\tt 0040000100000040} & {\tt 4000000000000000} & 10 & \multirow{3}{*}{$2^{-39}$}\\
12    & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000001000} & {\tt 0400014000000000} & 4  & \\
      & {\tt 0000000000000000} & {\tt 0000000800000000} & {\tt 1000000000004000} & {\tt 0220000080000080} & 7  & \\
      & {\tt 0000400000000100} & {\tt 0000000000010000} & {\tt 4000140000000010} & {\tt 0000000000000000} & 7  & \\ \hline

      & {\tt 0000000008000200} & {\tt 0000100000100044} & {\tt 0000000200008000} & {\tt 0001000000000000} & 9  & \\
      & {\tt 0004500005000400} & {\tt 0000000000000000} & {\tt 0040000100000040} & {\tt 4000000000000000} & 10 & \multirow{3}{*}{$2^{-53}$}\\
13    & {\tt 0400114000040000} & {\tt 0020000000000080} & {\tt 0004000000400000} & {\tt 0000800100005002} & 14 &\\
      & {\tt 0000000000000000} & {\tt 0000000800000000} & {\tt 1000000000004000} & {\tt 0220000080000080} & 7  & \\
      & {\tt 0000400000000100} & {\tt 0000000000010000} & {\tt 4000140000000010} & {\tt 0000000000000000} & 7  & \\ \hline

      & {\tt 0000000008000200} & {\tt 0000100000100044} & {\tt 0000000200008000} & {\tt 0001000000000000} & 9  & \\
      & {\tt 0040000100000040} & {\tt 4000000000000000} & {\tt 0004500005000400} & {\tt 0000000000000000} & 10 & \multirow{3}{*}{$2^{-69}$}\\
14    & {\tt 0400114000040000} & {\tt 0020000000000080} & {\tt 0004000000400000} & {\tt 0000800100005002} & 14 & \\
      & {\tt 0228000280020080} & {\tt 0000040000000000} & {\tt 2000008000202008} & {\tt 1000004000004021} & 18 & \\
      & {\tt 0000400000000100} & {\tt 0000000000010000} & {\tt 4000140000000010} & {\tt 0000000000000000} & 7  & \\ \hline

%Weight: 69
      & {\tt 0000000008000200} & {\tt 0000100000100044} & {\tt 0000000200008000} & {\tt 0001000000000000} & 9  & \\
      & {\tt 0040000100000040} & {\tt 4000000000000000} & {\tt 0004500005000400} & {\tt 0000000000000000} & 10 & \\
15    & {\tt 0020000000000080} & {\tt 0004000000400000} & {\tt 0000800100005002} & {\tt 0400114000040000} & 14 & $-$\\
      & {\tt 0228000280020080} & {\tt 0000040000000000} & {\tt 2000008000202008} & {\tt 1000004000004021} & 18 & \\
      & {\tt 0000400000000100} & {\tt 0000000000010000} & {\tt 4000140000000010} & {\tt 0000000000000000} & 7  & \\ \hline

$\Delta T$ &                   &                        & {\tt 600080830020f00a} & {\tt 1405414005044421} & & $2^{-88}$ \\ \hline
\end{tabular}
}
\end{center}
\end{table}

\subsubsection{Remarks.} The fact that the $S_4$ is updated in the last round but is not used in the tag generation implies that the \MORUS finalization generally includes unnecessary computations with respect to security. It may be interesting to tweak the design such that the tag can also depend on $S_4$. Indeed in \Cref{Tbl:fin_diff}, we can observe some jump-up of the probability in the tag computation. This is because the non-linearly involved terms are $S_2 \cdot S_3$, and $S_3$ that was updated 2 rounds before has a high Hamming weight. In this sense, involving $S_4$ in non-linear terms of the tag computation imposes more difficulties for the attacker.

\subsection{Extending State Recovery to Key Recovery}
\label{subsec/Ini}
Kales et al.~\cite{cryptoeprint:2017:1137} showed that the internal state of \MORUS[640] can be recovered under the nonce-misuse scenario using $2^5$ plaintext-ciphertext pairs. As claimed by \cite{cryptoeprint:2017:1137} the attack is naturally extended to \MORUS[1280] though Kales et al. \cite{cryptoeprint:2017:1137} did not demonstrate specific attacks. The recovered state allows the attacker to mount a universal forgery attack under the same nonce. However, the key still cannot be recovered because the key is used both at the beginning and end of the initialization, which prevents the attacker from backtracking the state value to the initial state. In this section, we show that meet-in-the-middle attacks allow the attacker to recover the key faster than exhaustive search for a relatively large number of steps, i.e., 10 out of 16 steps in \MORUS[1280].

\subsubsection{Overview.}
We divide the 10 steps of the initialization computation into two subsequent parts $F_0$ and $F_1$. (We later set that $F_0$ is the first 4 steps and $F_1$ is the last 6 steps.) Let $S^{-10}$ be the initial state value before setting the key, i.e., $S^{-10} = (\IV\mathrel\|0^{128},0^{256},1^{256},0^{256},\const_0\mathrel\|\const_1)$. Also let $S^0$ be 1280-bit state value after the initialization, which is now assumed to be recovered with the nonce-misuse analysis~\cite{cryptoeprint:2017:1137}. We then have the following relation.
\begin{align*}
%F_1 \circ F_0 \bigl(S^{-10} \oplus (0, K\|K, 0, 0, 0)\bigr) \oplus (0,K\|K,0,0,0) = S^0.
F_1 \circ F_0 \bigl(S^{-10} \oplus (0, K, 0, 0, 0)\bigr) \oplus (0,K,0,0,0) = S^0.
\end{align*}
We target the variant \MORUS[1280-128], where $K = K_{128} \mathrel\| K_{128}$.

Here, our strategy is to recover $K_{128}$ by independently processing $F_0$ and $F_1^{-1}$ to find the following match.
\begin{align*}
  F_0 (S^{-10} \oplus (0, K_{128}\|K_{128}, 0, 0, 0)) \stackrel{?}{=} F_1^{-1} (S^0 \oplus (0,K_{128}\|K_{128},0,0,0)).
\end{align*}

To evaluate the attack complexity, we consider the following parameters.
\begin{itemize}
\item $G_0$: a set of bits of $K_{128}$ that are guessed for computing $F_0$.
\item $G_1$: a set of bits of $K_{128}$ that are guessed for computing $F_1^{-1}$.
\item $G_2$: a set of bits in the intersection of $G_0$ and $G_1$.
\item $x$ bits can match after processing $F_0$ and $F_1^{-1}$.
\end{itemize}
Suppose that the union of $G_0$ and $G_1$ covers all the bits of $K_{128}$. The attack exhaustively guesses $G_2$ and performs the following procedure for each guess.
\begin{enumerate}
\item $F_0$ is computed $2^{|G_0|-|G_2|}$ times and the results are stored in a table $T$. (Because $|G_1|-|G_2|$ bits are unknown, only a part of the state is computed.)
\item $F_1^{-1}$ is computed $2^{|G_1|-|G_2|}$ times and for each result we check the match with any entry in $T$.
\item The number of possible combinations is $2^{|G_0|-|G_2| + |G_1|-|G_2|}$, and the number of valid matches reduces to $2^{|G_0|-|G_2| + |G_1|-|G_2| - x}$ after matching the $x$ bits.
\item Check the correctness of the guess by using one plaintext-ciphertext pair.
\end{enumerate}

In the end,
$F_0$ is computed $2^{|G_2|} \cdot 2^{|G_0|-|G_2|} = 2^{|G_0|}$ times.
Similarly, $F_1^{-1}$ is computed $2^{|G_1|}$ times. The number of the total candidates after the $x$-bit match is $2^{|G_2|} \cdot 2^{|G_0|-|G_2| + |G_1|-|G_2| - x} = 2^{|G_0| + |G_1| - |G_2| - x}$. Hence, the key $K_{128}$ is recovered with complexity $$\max( 2^{|G_0|}, 2^{|G_1|}, 2^{|G_0| + |G_1| - |G_2| - x}).$$
Suppose that we choose $|G_0|$ and $|G_1|$ to be balanced i.e., $|G_0|=|G_1|$. Then, the complexity is $$\max( 2^{|G_0|}, 2^{2|G_0| - |G_2| - x}).$$
Two terms are balanced when $x = |G_0| - |G_2|$. Hence, the number of matched bits in the middle of two functions must be greater than or equal to the number of independently guessed bits to compute $F_0$ and $F_1^{-1}$.

In the attack below, we choose $|G_0|=|G_1|=127$ and $|G_2|=126$ (equivalently $|G_2|-|G_0| = |G_2|-|G_1| = 1$) in order to aim $x=1$-bit match in the middle, which maximizes the number of attacked rounds.

\begin{table}
\caption{Analysis of the diffusion and matching bits over 10 steps. `0' and `1' denote that the state bit can and cannot be computed from a partial knowledge of $K_{128}$, respectively. After the partial computations from each direction, 4 bits of $S^{-6}$ can match.}
\label{Tbl:ini_diffuse}
\centering
{
\iflncsmargins
\tiny
\else
\footnotesize
\renewcommand{\arraystretch}{0.9}
\fi
\begin{tabular}{ccccc} \hline
Round & \multicolumn{4}{c}{State Difference}\\ \hline
                         & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} \\
\multirow{3}{*}{$S^{-10}\oplus K_{128}$} & {\tt 0000000000000000} & {\tt 0000000000000001} & {\tt 0000000000000000} & {\tt 0000000000000001} \\
  & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} \\
                         & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} \\
                         & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} \\ \hline

      & {\tt 0000000000002000} & {\tt 0000000000000000} & {\tt 0000000000002000} & {\tt 0000000000000000} \\
      & {\tt 0000000000000000} & {\tt 0000400000000000} & {\tt 0000000000000000} & {\tt 0000400000000000} \\
1     & {\tt 0008000000000000} & {\tt 0000000000000000} & {\tt 0008000000000000} & {\tt 0000000000000000} \\
      & {\tt 0000000000100000} & {\tt 0020000000000000} & {\tt 0000000000100000} & {\tt 0020000000000000} \\
      & {\tt 0000000000020000} & {\tt 0084000000000000} & {\tt 0000000000020000} & {\tt 0084000000000000} \\ \hline

      & {\tt 0800000000000004} & {\tt 0000000204000001} & {\tt 0800000000000004} & {\tt 0000000204000001} \\
      & {\tt 8000000a00000000} & {\tt 0000002110000004} & {\tt 8000000a00000000} & {\tt 0000002110000004} \\
2     & {\tt 0400010221000000} & {\tt 008000400a000081} & {\tt 0400010221000000} & {\tt 008000400a000081} \\
      & {\tt 1000050001000244} & {\tt 4200118a08000280} & {\tt 1000050001000244} & {\tt 4200118a08000280} \\
      & {\tt 880004a0a0200858} & {\tt 4840123350000050} & {\tt 880004a0a0200858} & {\tt 4840123350000050} \\ \hline

      & {\tt 023d63c00050a850} & {\tt 00a1442000489380} & {\tt 023d63c00050a850} & {\tt 00a1442000489380} \\
      & {\tt 02b63380056aaa48} & {\tt 00b5563005dcd6c0} & {\tt 02b63380056aaa48} & {\tt 00b5563005dcd6c0} \\
3     & {\tt d42ab556bf5dfcd6} & {\tt 5a26f633a8556aaa} & {\tt d42ab556bf5dfcd6} & {\tt 5a26f633a8556aaa} \\
      & {\tt 5fbbf556bd556c65} & {\tt 7aab99aaee6bea2c} & {\tt 5fbbf556bd556c65} & {\tt 7aab99aaee6bea2c} \\
      & {\tt abff7f3ad7feafad} & {\tt cfff777ffddffd6d} & {\tt abff7f3ad7feafad} & {\tt cfff777ffddffd6d} \\ \hline

      & {\tt fff77dfffffdcf57} & {\tt fefad7efffdffbf7} & {\tt fff77dfffffdcf57} & {\tt fefad7efffdffbf7} \\
      & {\tt ffffffffffffbfff} & {\tt fffbf7fffddfff77} & {\tt ffffffffffffbfff} & {\tt fffbf7fffddfff77} \\
4     & {\tt ffffffffffffffff} & {\tt ffffffffffffffff} & {\tt ffffffffffffffff} & {\tt ffffffffffffffff} \\
      & {\tt ffffffffffffffff} & {\tt fffbffffefffffff} & {\tt ffffffffffffffff} & {\tt fffbffffefffffff} \\
      & {\tt ffffffffffffffff} & {\tt ffffffffffffffff} & {\tt ffffffffffffffff} & {\tt ffffffffffffffff} \\ \hline
%
%
      &                        & 2-bits match           & {\tt                 } & 2-bits match            \\ \hline
%
%
      & {\tt ffffffffffffffff} & {\tt ffffffffffffffff} & {\tt ffffffffffffffff} & {\tt ffffffffffffffff} \\
      & {\tt ffffffffffffffff} & {\tt ffffffffffffffff} & {\tt ffffffffffffffff} & {\tt ffffffffffffffff} \\
5     & {\tt ffffffffffffffff} & {\tt ffffffffffffffff} & {\tt ffffffffffffffff} & {\tt ffffffffffffffff} \\
      & {\tt fffff7ffedfffff7} & {\tt ffffffffedffffff} & {\tt fffff7ffedfffff7} & {\tt ffffffffedffffff} \\
      & {\tt ffffffffedffffff} & {\tt fffff7ffedfffff7} & {\tt ffffffffedffffff} & {\tt fffff7ffedfffff7} \\ \hline

      & {\tt ffffffffedffffff} & {\tt fffff7ffedfffff7} & {\tt ffffffffedffffff} & {\tt fffff7ffedfffff7} \\
      & {\tt fffbf5e7cdfffbf7} & {\tt fffff7bfcdfff757} & {\tt fffbf5e7cdfffbf7} & {\tt fffff7bfcdfff757} \\
6     & {\tt fffbf5e7cdfffbf7} & {\tt fffff7bfcdfff757} & {\tt fffbf5e7cdfffbf7} & {\tt fffff7bfcdfff757} \\
      & {\tt 7ffd75b6cdfff357} & {\tt fffbf5a6ccfcfb73} & {\tt 7ffd75b6cdfff357} & {\tt fffbf5a6ccfcfb73} \\
      & {\tt 7ffbf5a6ccfcf373} & {\tt 7ff975b6ccfff353} & {\tt 7ffbf5a6ccfcf373} & {\tt 7ff975b6ccfff353} \\ \hline

      & {\tt 7efbf5a6cc7cf353} & {\tt 7fd975a6cceff353} & {\tt 7efbf5a6cc7cf353} & {\tt 7fd975a6cceff353} \\
      & {\tt 7eb950a4cc78e353} & {\tt 7dd07184cced7153} & {\tt 7eb950a4cc78e353} & {\tt 7dd07184cced7153} \\
7     & {\tt 7eb950a4cc78e353} & {\tt 7dd07184ccec7153} & {\tt 7eb950a4cc78e353} & {\tt 7dd07184ccec7153} \\
      & {\tt 7cd051044c6c3153} & {\tt 3e985024cc48a313} & {\tt 7cd051044c6c3153} & {\tt 3e985024cc48a313} \\
      & {\tt 3c905004cc482313} & {\tt 7c9051044c6c2113} & {\tt 3c905004cc482313} & {\tt 7c9051044c6c2113} \\ \hline

      & {\tt 2c905004c4482113} & {\tt 7c9050040c682113} & {\tt 2c905004c4482113} & {\tt 7c9050040c682113} \\
      & {\tt 2810100444082112} & {\tt 5c1010040c402113} & {\tt 2810100444082112} & {\tt 5c1010040c402113} \\
8     & {\tt 2810100444082112} & {\tt 1c1010040c402113} & {\tt 2810100444082112} & {\tt 1c1010040c402113} \\
      & {\tt 0c00100404400113} & {\tt 2800000404082112} & {\tt 0c00100404400113} & {\tt 2800000404082112} \\
      & {\tt 0800000404002112} & {\tt 0800100404400113} & {\tt 0800000404002112} & {\tt 0800100404400113} \\ \hline

      & {\tt 0800000404002112} & {\tt 0800100004000112} & {\tt 0800000404002112} & {\tt 0800100004000112} \\
      & {\tt 0000000404000102} & {\tt 0000100004000110} & {\tt 0000000404000102} & {\tt 0000100004000110} \\
9     & {\tt 0000000404000102} & {\tt 0000000004000110} & {\tt 0000000404000102} & {\tt 0000000004000110} \\
      & {\tt 0000000004000110} & {\tt 0000000000000102} & {\tt 0000000004000110} & {\tt 0000000000000102} \\
      & {\tt 0000000000000100} & {\tt 0000000004000110} & {\tt 0000000000000100} & {\tt 0000000004000110} \\ \hline

      & {\tt 0000000000000100} & {\tt 0000000004000100} & {\tt 0000000000000100} & {\tt 0000000004000100} \\
      & {\tt 0000000000000000} & {\tt 0000000004000100} & {\tt 0000000000000000} & {\tt 0000000004000100} \\
10    & {\tt 0000000000000000} & {\tt 0000000000000100} & {\tt 0000000000000000} & {\tt 0000000000000100} \\
      & {\tt 0000000000000100} & {\tt 0000000000000000} & {\tt 0000000000000100} & {\tt 0000000000000000} \\
      & {\tt 0000000000000000} & {\tt 0000000000000100} & {\tt 0000000000000000} & {\tt 0000000000000100} \\ \hline

                     & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} \\
\multirow{3}{*}{$S^0\oplus K_{128} $} & {\tt 0000000000000000} & {\tt 0000000000000100} & {\tt 0000000000000000} & {\tt 0000000000000100} \\
                     & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} \\
                     & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} \\
                     & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} & {\tt 0000000000000000} \\ \hline

\end{tabular}
}
\end{table}

\subsubsection{Full Diffusion Rounds.}
We found that {\tt StepUpdate} was designed to have good diffusion in the forward direction. Thus, once the state is recovered, the attacker can perform the partial computation in the backward direction longer than the forward direction. We set $G_0$ and $G_1$ as follows.
\begin{align*}
G_0 &= \{1, 2, \cdots, 127\} & \textrm {Bit position 0 is unknown.}\\
G_1 &= \{0, 1, \cdots, 7, 9, 10, \cdots, 127\} & \textrm {Bit position 8 is unknown.}
\end{align*}
Those will lead to 4 matching bits after the 4-step forward computation and the 6-step backward computation. The analysis of the diffusion is given in \Cref{Tbl:ini_diffuse}. In the end, $K_{128}$ can be recovered faster than the exhaustive search by 1 bit, i.e., with complexity $2^{127}$.

\subsubsection{Remarks.}
The matching state does not have to be a border of a step. It can be defined on a border of a round, or even in some more complicated way. We did not find the extension of the number of attacked steps even with this way.

As can be seen in \Cref{Tbl:ini_diffuse}, the updated register in step $i$ is independent of the update function in step $i+1$ in the forward direction, and starts to impact from step $i+2$. By modifying this point, the diffusion speed can increase faster, which makes this attack harder.


\chapter{Time-Frequency Masking}\label{ch:tf_mask_ch}
\section{Introduction}
Speech separation, in similarity to other
prevalent enhancement applications, such as the
Computational Auditory Scene Analysis (CASA)\cite{BROWN1994297}
and Blind Speech Separation (BSS)\cite{6709849},
makes use of various
algorithms in order to distinguish in one way or another
between desired speech and interferences.
The advantages of precise distinction
between speech and interference include, among others,
the ability to apply speech enhancements,
noise cancelation or reduction, speech corrections, and more.
With ASR systems, these abilities are expressed in
improved performance of precisely detecting words
with higher detection rates.

A typical algorithm in CASA applications is the
Time-Frequency Masking (T-F Masking).
Since speech signals vary with time,
as described in chapter \;\ref{ch:features},
they are not considered stationary.
Hence, a unique representation is required
for conducting an accurate analysis of such signals.

A T-F representation means presenting a speech
signal in time-frequency composition,
where each T-F unit contains the
speech's spectral elements at a certain time window bin.
As described in chapter\;\ref{ch:features},
the T-F presentation of a signal
arrives by using the STFT or auditory filtering\cite{Xia2017UsingOR}.

\begin{figure}[H]
    \centering
    \includegraphics[width=\linewidth]{Features/images/noisy_specgram}
    \caption{Noisy mixture spectrogram}\label{fig:noisy_specgram}
\end{figure}
\begin{figure}[H]
    \centering
    \includegraphics[width=\linewidth]{Features/images/clean_specgram}
    \caption{Reference clean speech spectrogram}\label{fig:clean_specgram}
\end{figure}

Examination of the T-F units provides a
possibility to classify an entire unit
or parts of a unit
as a speech-centric bin or, on the contrary,
as interference (mainly noise).
Based on this classification,
appropriate weights are associated with each segment bin.
In that way, speech elements can be extracted
by separating of the classified speech
out of the mixture, or alternatively,
the attenuation of non-speech elements
in certain activity areas
along the length of the audio signal.
In general, the association of weights for classifying different
elements in a signal is called T-F masking.
This process of T-F masking takes a
significant role in CASA and BSS applications,
and in recent years, they proved to be
very useful in E2E-ASR systems.

Additional use of T-F masking
is to tie it as input to a beamformer that
in turn, filters interferences based
on the classification received
by the masking operation.

\section{IBM --- Ideal Binary Mask}
Assuming that a voice activity detection algorithm
can separate speech from noise effectively,
the IBM technique is based on power differences.
Whenever the speech's power
spectral density (PSD) is higher
than any of the interferences PSD,
the speech is masked binarily to ``1''.
\begin{align}\label{eq:ibm_mask}
    \mathbf{M}_{s}(j\omega, t) & =
        \begin{cases}
            1, & if\;|\mathbf{S}(t,j\omega)|^2 - |\mathbf{N}(t,j\omega)|^2 > \epsilon \\
            0, & otherwise
        \end{cases}
\end{align}
Where \(\epsilon\) marks a changeable threshold value
for the speech activity detection over the noise.

Equation~\ref{eq:ibm_mask} indicates that as a result of
applying the IBM masks, the speech and interference separated
sources become complementary in such a way that
\[\mathbf{M}_{n} = 1 - \mathbf{M}_{s} \] and thus:
\begin{align}
    y(t) &= \begin{cases}
        \hat{x_{s}}, &if\;\;\mathbf{M}_{s} = 1 \\
        \hat{x_{n}}, &if\;\;\mathbf{M}_{s} = 0
    \end{cases}
\end{align}

\section{IRM --- Ideal Ratio Mask}
% \begin{align}
%     \mathrm{IRM}(f;t) = \left( \frac{ || }{  } \right)
% \end{align}
Unlike IBM, where hard decisions in terms of
boolean values are made,
that is, marking speech or noise
elements with ``true'' or ``false'', the Ideal Ratio Mask (IRM) provides a soft decision
mechanism with values in the range of \([0,1]\)\cite{Jiang2018RobustBF}.
The IRMs at any T-F unit of the clean speech and noise artifacts,
\(\mathbf{M}_{s}(j\omega, t)\) and \(\mathbf{M}_{n}(j\omega, t)\),
are given in
Equations\;\ref{eq:irm_speech} and \ref{eq:irm_noise}, respectively.

\begin{align}
    \label{eq:irm_speech}\mathbf{M}_{s}(j\omega, t) & = {\left( \frac{|\mathbf{S}(t,j\omega)|^2}{|\mathbf{S}(t,j\omega)|^2 + |\mathbf{N}(t,j\omega)|^2} \right)}^{\beta} \\
    \label{eq:irm_noise}\mathbf{M}_{n}(j\omega, t) & = {\left( \frac{|\mathbf{N}(t,j\omega)|^2}{|\mathbf{S}(t,j\omega)|^2 + |\mathbf{N}(t,j\omega)|^2} \right)}^{\beta}
\end{align}

Where \(\beta \) is a tunable parameter that
controls the strength of the mask estimations.
A value of 0.5 is used
for a fair trade-off between speech and noise mask estimations.
%
\begin{align}
    \mathbf{M}_{s}(j\omega, t) & = \sqrt{\left( \frac{|\mathbf{S}(t,j\omega)|^2}{|\mathbf{S}(t,j\omega)|^2 + |\mathbf{N}(t,j\omega)|^2} \right)} \\
    \mathbf{M}_{n}(j\omega, t) & \approx 1 - \mathbf{M}_{s}
\end{align}

\begin{figure}[H]
    \centering
    \includegraphics[width=\linewidth]{Features/images/irm_mask}
    \caption{IRM Speech Mask \(\mathbf{M}_{s}(j\omega, t)\)}\label{fig:irm_mask}
\end{figure}
\begin{figure}[H]
    \centering
    \includegraphics[width=\linewidth]{Features/images/irm_mask_noise}
    \caption{IRM Noise Mask \(\mathbf{M}_{n}(j\omega, t)\)}\label{fig:irm_mask_noise}
\end{figure}

%
Thus, the covariance matrices are extracted by:
\begin{align}
    \mathbf{R}_{NN}(j\omega) & = \frac{1}{\sum\limits_{t=1}^{T}\mathbf{M}_{n_{(jw, t)}}}\sum_{t=1}^{T}\mathbf{M}_{n_{(jw, t)}}|\mathbf{R}_{x_{(jw, t)}}|^2\\
    \mathbf{R}_{SS}(j\omega) & = \frac{1}{\sum\limits_{t=1}^{T}\mathbf{M}_{s_{(jw, t)}}}\sum_{t=1}^{T}\mathbf{M}_{s_{(jw, t)}}|\mathbf{R}_{x_{(jw, t)}}|^2
\end{align}

\subsection{Masks Estimations}
The IRM masks, \(\mathbf{M}_{s}(j\omega, t)\), \(\mathbf{M}_{n}(j\omega, t)\)
given in Equations\;\ref{eq:irm_speech}, \ref{eq:irm_noise} are bounded
in the range of [0, 1].
Since both the speech and noise masks are bounded in that range, it is easier
to use a Sigmoid activation function
as the output layer,
thus ensuring the output indeed remains in this range.

A simple neural network of six to eight fully-connected (FC) layers,
as seen in Figure\;\ref{fig:irm_dnn}, is proposed for
classifying the input features to the desired IRM masks.
The network's input features are the MFCCs of the microphone-array.
Each input signal is framed into \(25ms\) lasting frames with a
hopping length of \(6.25ms\). With a sampling frequency of \(16KHz\),
the framing settings are 400 samples per frame and
a total of 300 overlapping samples.

A BLSTM (Bidirectional Long Short-Term Memory)
layer is placed as the first block in the network,
giving weight to the temporal context as well.
In that way, three additional adjacent feature maps
are concatenated from both sides of the currently
processed T-F unit feature map.
The BLSTM is then followed
by several fully connected (FC) layers
holding in between the ReLU activation functions.

\begin{figure}[H]
    \centering
    \includegraphics[width=0.95\linewidth]{Features/images/irm_dnn}
    \caption{IRM estimation DNN blocks diagram}\label{fig:irm_dnn}
\end{figure}

Production of both the speech and noise estimations co-occurs.
Consequently, the cost function should
consider the two masks in the
minimization process of the error term.
To that end, the cost function is defined as:
\begin{align}
    \ell(\mathbf{\widehat{M}}_{j\omega, t},\;\mathbf{M}_{j\omega, t}) & =
        \frac{1}{2N}\sum_{j\omega, t}
        \left[
            \beta\!\left(
                \mathbf{\widehat{M}}^{(s)}_{j\omega, t} -
                \mathbf{M}^{(s)}_{j\omega, t}
            \right)^{2}
            + \left( 1- \beta \right)\!
            \left(
                \mathbf{\widehat{M}}^{(n)}_{j\omega, t} -
                \mathbf{M}^{(n)}_{j\omega, t}
            \right)^{2}
        \right]
\end{align}
Here, \(\beta\) denotes the weighing factor.
For a fair and evenly consideration between the masks, \(\beta \)
is set to 0.5.

The proposed IRM estimation network blocks diagram is shown in
Figure\;\ref{fig:irm_nn}.

\begin{figure}[H]
    \centering
    \includegraphics[width=0.75\linewidth]{Beamformers/images/irm_nn}
    \caption{Proposed DNN for IRM T-F masking estimations}\label{fig:irm_nn}
\end{figure}

\begin{figure}[H]
    \centering
    \subfloat[\label{irm_s_ref}]{%
       \includegraphics[width=0.45\linewidth]{Beamformers/images/irm_s_ref}}
    \hspace{0.1cm}
    \subfloat[\label{irm_s_nn}]{%
        \includegraphics[width=0.45\linewidth]{Beamformers/images/irm_s_nn}}
    \vspace{-0.35cm}
    \subfloat[\label{irm_n_ref}]{%
        \includegraphics[width=0.45\linewidth]{Beamformers/images/irm_n_ref}}
    \hspace{0.1cm}
    \subfloat[\label{irm_n_nn}]{%
        \includegraphics[width=0.45\linewidth]{Beamformers/images/irm_n_nn}}
        \caption{(a) and (b) are the ``IRM''
        reference vs. estimation masks of the speech.
        \(\mathbf{\widehat{M}}^{(s)}_{j\omega, t}\), \(\mathbf{M}^{(s)}_{j\omega, t}\);\;\;
        (c) and (d) are the ``IRM'' reference vs. estimation masks
        of the noise \(\mathbf{\widehat{M}}^{(n)}_{j\omega, t}\), \(\mathbf{M}^{(n)}_{j\omega, t}\).}\label{fig:irm_ref_s_n}
\end{figure}

\subsection{Measurements}
\subsubsection{SNR}
\begin{figure}[H]
    \centering
    \subfloat[\label{irm_enh_snr}]{%
       \includegraphics[width=0.5\linewidth]{Features/images/irm_enh_snr}}
    % \hspace{0.1cm}
    \subfloat[\label{irm_noisy_snr}]{%
        \includegraphics[width=0.5\linewidth]{Features/images/irm_noisy_snr}}
    \caption{(a) ``IRM'' enhanced SNR \& Segmental-SNR degradation
        with respect to the clean reference speech;\;\;
        (b) The SNR \& Segmental-SNR ratios between the
        clean reference speech and the noisy mixture.}\label{fig:irm_enh_noisy_snr}
\end{figure}

Figure\;\ref{fig:irm_enh_noisy_snr} shows two measurements of the SNR \&
Segmental-SNR metrics for two subject signals,
an ``IRM'' enhanced beamformed
version of the noisy mixture and the noisy mixture itself
with respect to the clean reference speech.
The overall improvements in SNR and Segmental-SNR
are the ratios between the enhanced beamformed signal
and the noisy mixture. Thus, from Figure\;\ref{fig:irm_enh_noisy_snr}
the accumulated improvement in SNR is:
\[|SNR_{noisy}| - |SNR_{enh}| = 5.1725\;[dB]\]
Likewise, the improvement in Segmental-SNR is \(9.2675\;[dB]\).
It is important to note that the enhanced beamformed signal
does not align in time with the clean speech reference.
In a worst-case scenario, we measured a delay of \(-0.0014\;[s]\),
which equals approximately \(22\) samples.
A perfectly aligned comparison considers being more
accurate, but since the frame lengths' (400 samples)
are much larger than the worst measured delay,
the impact of this time misalignment is less acute.
The Segmental-SNR calculation involves
a VAD (voice activity detection) algorithm
for dropping segments where the detected speech activity is negligible.
These dropped segments are red colored in Figure\;\ref{fig:irm_enh_noisy_snr}.

\begin{figure}[H]
    \centering
    \includegraphics[width=\linewidth]{Experiments/images/irm_pesq_mosq}
    \caption{IRM beamformer PESQ vs. MOSLQ}\label{fig:irm_pesq_mosq}
\end{figure}

In Figure\;\ref{fig:irm_pesq_mosq} presented the ``PESQ'' and ``MOSLQ''
metrics for the IRM beamformer. The results are shown in a pair-plot
diagram, where the correlations between each pair of metrics are plotted.
On the diagonal, the distributions of the measured values are shown.
On top of the plots also shown are the mean values for both
the ``PESQ'' and ``MOSLQ'' under the test cases of the real and
simulation datasets from the ``CHiME4'' dataset. ``et'' stands for
the evaluation subset and ``dt'' marks the development subset.
More details about the datasets are provided in Chapter\;\ref{ch:datasets}.

A strong correlation between the ``PESQ'' and ``MOSLQ'' is seen in the
plot, and this behavior is both understandable and desirable since
the ``MOSLQ'' metric is based on the ``PESQ'' measurement.

Another pair-plot for the SNR, ``Segmental-SNR'', ``SI-SNR'' and ``STOI''
metrics is shown in Figure\;\ref{fig:irm_snr_stoi}.
The ``simulation'' subset yields better results in terms of
performance. It is important to note that faulty microphones
in the ``real'' subset are dropped prior to taking the measurements.
Nevertheless, the ambient noise absorbed is characterized by
a real scenario and a non-artificial room impulse response. On the other hand,
the ``simulation'' subset is composed of a recording taken in a relatively
clean environment (recording booth) and an artificial mixture of
the recorded background noises.

Because the SNR and Segmental-SNR are measured as the improvement
compared to the noisy mixture,
and since the background noises are truncated
to match the booth recorded speech for the ``simulation'' subset,
the results for those metrics are more sparsely distributed
compared to the ``real'' subset measurements.
With the ``SI-SNR'',
the measurements are taken regardless of the noisy mixture.
Hence, the ``simulation'' results are far better
and more spatially dense
in contrast to the ``real'' subset ``SI-SNR'' results.

Likewise, in the same manner,
the ``STOI'' is measured regardless of the noisy mixture
but relatively to the clean speech.
Therefore, the ``simulation''
subset distribution is narrower with lower variance.

% The results are summarized in Table\;\ref{tbl:irm_snr_stoi},
% side by side with the ideal masks and the improvement ratios.

\begin{figure}[H]
    \centering
    \includegraphics[width=\linewidth]{Features/images/irm_snr_stoi}
    \caption{IRM beamformer SNR vs. Segmental-SNR vs. STOI vs. SI-SNR}\label{fig:irm_snr_stoi}
\end{figure}

In order to evaluate the generalization of the prediction model,
the DNN estimations are compared to the ideal mask enhancement.
In Figure\;\ref{fig:irm_ideal_snr}, shown is the measurements of
the SNR and ``Segmental-SNR'' for an ideal IRM mask.
SNR measurement.

\begin{figure}[H]
    \centering
    \includegraphics[width=\linewidth]{Features/images/irm_ideal_snr}
    \caption{Ideal IRM beamformer enhancement SNR \& Segmental-SNR.}\label{fig:irm_ideal_snr}
\end{figure}

\section{cIRM --- Complex Ideal Ratio Mask}\label{ssec:cirm}
Both IBM and IRM utilize the noise and speech magnitudes only
while completely neglecting the phase arguments.
The outcome of the STFT operation is a complex pair
representation of each T-F unit. Recent studies
showed the importance of
the phase element in
speech seperation\cite{7364200,Xia2017UsingOR}.

In that manner, further extension of the IRM mask
to include the imaginary part
altogether with the magnitudes forms the cIRM.
Thus, instead of having a magnitude only based mask matrix, a complex
pair of masking matrices that make use of the phase element too is given.

The mixture \(y(t)\) after being processed by
the STFT operation can be described as a complex sum
whether in polar coordinates as seen in Equation\ref{eq:ystft_polar}
or in the general form as in Equation\ref{eq:ystft_general}.
\begin{align}\label{eq:ystft_polar}
    \mathbf{Y}(j\omega, t)  & = \mathcal{STFT} \{ y(t) \} := \mathbf{Y}_{j\omega, t} \nonumber \\
                            & = |\mathbf{A}_{_{\mathbf{Y}}}|\cos(\bm{\theta}_{_{\mathbf{Y}}})
                            + j|\mathbf{A}_{_{\mathbf{Y}}}|\sin(\bm{\theta}_{_{\mathbf{Y}}}) \\
\label{eq:ystft_general}      & = \mathbf{Y}_{r} + j\mathbf{Y}_{i}
\end{align}

The real and imaginary parts can be summarized as:
\begin{align}
    \mathbf{Y}_{r} & := \mathfrak{R}_{_{\mathfrak{C}}} \{\mathbf{Y}_{j\omega, t}\}
                            = |\mathbf{A}_{_{\mathbf{Y}}}|\cos(\bm{\theta}_{_{\mathbf{Y}}})  \\
    \mathbf{Y}_{i} & := \mathfrak{T}_{_{\mathfrak{M}}} \{\mathbf{Y}_{j\omega, t}\}
                            = |\mathbf{A}_{_{\mathbf{Y}}}|\sin(\bm{\theta}_{_{\mathbf{Y}}})
\end{align}
Extraction of the magnitude and phase from the complex representation
is accomplished by the following set of
Equations\ref{eq:complex_mag},\ref{eq:complex_phase}:
\begin{align}\label{eq:complex_mag}
    |\mathbf{A}_{_{\mathbf{Y}}}|    & = \sqrt{ \mathfrak{R}_{_{\mathfrak{C}}} \{\mathbf{Y}_{j\omega, t}\}^{2}
                                            + \mathfrak{T}_{_{\mathfrak{M}}} \{\mathbf{Y}_{j\omega, t}\}^{2} } \\
    \label{eq:complex_phase}\bm{\theta}_{_{\mathbf{Y}}}     & = \tan^{-1} \Bigg\{ \frac{ \mathfrak{T}_{_{\mathfrak{M}}} \{\mathbf{Y}(j\omega, t)\} }
                                            {\mathfrak{R}_{_{\mathfrak{C}}} \{\mathbf{Y}(j\omega, t)\}} \Bigg\}
\end{align}
Rearranging the equations above,
we can write the cIRM mask's real and
imaginary parts as:
\begin{align}
    \mathbf{M}_{r} & = \frac{\mathbf{Y}_{r}\mathbf{S}_{r} + \mathbf{Y}_{i}\mathbf{S}_{i}}
                            { \mathbf{Y}_{r}^{2} + \mathbf{Y}_{i}^{2}} \\
    \mathbf{M}_{i} & = \frac{\mathbf{Y}_{r}\mathbf{S}_{i} - \mathbf{Y}_{i}\mathbf{S}_{r}}
                            { \mathbf{Y}_{i}^{2} + \mathbf{S}_{r}^{2}}
\end{align}
Thus, the complex masks for the speech and noise are:
\begin{align}
    \mathbf{M}^{(s)}_{j\omega, t} & = \mathbf{M}^{(s)}_{r} + j\mathbf{M}^{(s)}_{i} \nonumber \\
            & = \frac{\mathbf{Y}_{r}\mathbf{S}_{r} + \mathbf{Y}_{i}\mathbf{S}_{i}}
            { \mathbf{Y}_{r}^{2} + \mathbf{Y}_{i}^{2}}
            + j \frac{\mathbf{Y}_{r}\mathbf{S}_{i} - \mathbf{Y}_{i}\mathbf{S}_{r}}
            { \mathbf{Y}_{i}^{2} + \mathbf{S}_{r}^{2}} \label{eq:cirmr_mask} \\
    \mathbf{M}^{(n)}_{j\omega, t} & = \mathbf{M}^{(N)}_{r} + j\mathbf{M}^{(N)}_{i} \nonumber \\
    & = \frac{\mathbf{Y}_{r}\mathbf{N}_{r} + \mathbf{Y}_{i}\mathbf{N}_{i}}
    { \mathbf{Y}_{r}^{2} + \mathbf{Y}_{i}^{2}}
    + j \frac{\mathbf{Y}_{r}\mathbf{N}_{i} - \mathbf{Y}_{i}\mathbf{N}_{r}}
    { \mathbf{Y}_{i}^{2} + \mathbf{N}_{r}^{2}} \label{eq:cirmi_mask}
\end{align}
Therefore, applying a cIRM T-F masking requires a complex multiplication
for separation as opposed to the more basic IBM and IRM
where magnitudes multiplications are taken in the real domain only.

The reference compressed cIRM masks are
shown in Figure\;\ref{fig:cirm_ref_s_n};

\begin{figure}[H]
    \centering
    \subfloat[\label{cIRM_real_mask}]{%
       \includegraphics[width=0.45\linewidth]{Features/images/cIRM_real_mask}}
    \subfloat[\label{cIRM_imag_mask}]{%
        \includegraphics[width=0.45\linewidth]{Features/images/cIRM_imag_mask}}
    \vspace{-0.35cm}
    \subfloat[\label{cIRM_real_noise_mask}]{%
        \includegraphics[width=0.45\linewidth]{Features/images/cIRM_real_noise_mask}}
    \subfloat[\label{cIRM_imag_noise_mask}]{%
        \includegraphics[width=0.45\linewidth]{Features/images/cIRM_imag_noise_mask}}
        \caption{(a) and (b) are the cIRM
        real and imaginary references of the speech
        \(\mathbf{M}^{(s)}_{r}\), \(\mathbf{M}^{(s)}_{i}\);\;\;
        (c) and (d) are the cIRM real and imaginary references
        of the noise \(\mathbf{M}^{(n)}_{r}\), \(\mathbf{M}^{(n)}_{i}\).}\label{fig:cirm_ref_s_n}
\end{figure}

\subsection{Masks Estimations}
In Section~\ref{ssec:cirm},
the \(cIRM\) masks are described in
Equations~\ref{eq:cirmr_mask},~\ref{eq:cirmi_mask}.
In contrast to the \(IRM\) masks which are bounded in the range \([0, 1]\),
the \(cIRM\) masks are unbounded, and have the range \((-\infty, \infty)\).

A neural network cannot train for unbounded values.
Hence, an alternative presentation to the mask values is needed.
One possibility is to compress the real and imaginary masks
with a hyperbolic tangent as suggested in \cite{7364200}:
\begin{align}\label{eq:cirm_compress}
    cIRM_{x} &= K \frac{1-e^{-C\cdot M_{x}}}{1+e^{-C\cdot M_{x}}}
\end{align}
Where \(x\) stands for the real or the imaginary parts of the mask.
By applying this compression, the mask values are bounded in
the range \([-K, K]\), while \(C\) controls the steepness.
For that purpose, we replaced the
simpler IRM DNN sigmoid layers placed at the output
with linear layers.

Then, the cost function is defined to include both real and imaginary parts
of both the noise and speech masks.
\begin{align}
    \ell(\mathbf{\widehat{M}}^{(x)}_{j\omega, t},\;\mathbf{M}^{(x)}_{j\omega, t}) & =
        \frac{1}{2N}\sum_{j\omega, t}
        \left[
            \beta\!\left(
                \mathbf{\widehat{M}}^{(s \in \mathbb{C})}_{j\omega, t} -
                \mathbf{M}^{(s \in \mathbb{C})}_{j\omega, t}
            \right)^{2}
            + \left( 1- \beta \right)\!
            \left(
                \mathbf{\widehat{M}}^{(n \in \mathbb{C})}_{j\omega, t} -
                \mathbf{M}^{(n \in \mathbb{C})}_{j\omega, t}
            \right)^{2}
        \right]
\end{align}

The proposed cIRM estimation network blocks
diagram is shown in Figure\;\ref{fig:cirm_nn}.

\begin{figure}[H]
    \centering
    \includegraphics[width=0.75\linewidth]{Beamformers/images/cirm_nn}
    \caption{Proposed DNN for cIRM T-F masking estimations}\label{fig:cirm_nn}
\end{figure}

\begin{figure}[H]
    \centering
    \subfloat[\label{mel_fb_ref}]{%
       \includegraphics[width=0.45\linewidth]{Beamformers/images/cirm_r_s_ref}}
    \hspace{0.1cm}
    \subfloat[\label{mel_fbfcc_ref}]{%
        \includegraphics[width=0.444\linewidth]{Beamformers/images/cirm_r_s_nn}}
    \caption{(a) Reference cIRM
        real speech mask \(\mathbf{M}^{(s)}_{r}\);\;\;
        (b) The estimated cIRM
        real speech \(\mathbf{\widehat{M}}^{(s)}_{r}\).}\label{fig:cirm_nn_vs_ref}
\end{figure}

Figure\;\ref{fig:cirm_nn_vs_ref} shows the reference real speech cIRM mask
compared to the estimated real speech mask predicted by the DNN model.
Looking at the figure, one can conclude that the model generalized correctly
as the estimated mask resembles the reference to a great extent.
Compared to the ``IRM'' DNN performance, the cIRM model
with a compression in the range of \([-10, 10]\) performs better.

\subsection{Measurements}
Due to the complexity of the cIRM DNN model,
it did not generalize properly for the evaluation dataset
with a number of epochs settings set to 50.
The results hence, are not accurate as a reference nor for comparison,
unless a retraining process is initialized with a sufficient number of epochs
to let the model generalize.

Due to the uncertainty of the impact the low number of epochs have
on the model performance, and the lack of time for a re-evaluation of the
DNN mask estimation, we decide to skip the results and
to drop the cIRM measurements.

% \begin{figure}[H]
%     \centering
%     \includegraphics[width=\linewidth]{Experiments/images/irm_pesq_mosq}
%     \caption{IRM beamformer PESQ vs. MOSLQ}\label{fig:irm_pesq_mosq}
% \end{figure}

\section{PSM --- Phase Sensitive Mask}
The PSM T-F masking makes use of the magnitude ratios and phase differences
rather than requiring a complex multiplication.
In that way, the multiplication is taken in the real domain only,
while utilizing the phase contribution directly.

\begin{figure}[H]
    \centering
    \includegraphics[width=\linewidth]{Features/images/psm_mask}
    \caption{PSM Speech Mask \(\mathbf{M}_{s}(j\omega, t)\)}\label{fig:psm_mask}
\end{figure}
\vspace{-0.5cm}
\begin{figure}[H]
    \centering
    \includegraphics[width=\linewidth]{Features/images/psm_mask_noise}
    \caption{PSM Noise Mask \(\mathbf{M}_{n}(j\omega, t)\)}\label{fig:psm_mask_noise}
\end{figure}
The following equations give the PSM masks for the reference speech and noise,
\(\mathbf{M}^{(s)}_{j\omega, t}\) and \(\mathbf{M}^{(n)}_{j\omega, t}\):
\begin{align}
    \mathbf{M}^{(s)}_{j\omega, t} & = \frac{|\mathbf{S}(t,j\omega)|}{|\mathbf{Y}(t,j\omega)|} \cos(\bm{\theta}_{_{\mathbf{S}}} - \bm{\theta}_{_{\mathbf{Y}}}) \\
    \mathbf{M}^{(n)}_{j\omega, t} & = \frac{|\mathbf{N}(t,j\omega)|}{|\mathbf{Y}(t,j\omega)|} \cos(\bm{\theta}_{_{\mathbf{N}}} - \bm{\theta}_{_{\mathbf{Y}}})
\end{align}

\subsection{Masks Estimations}
Unlike the cIRM complex masks, the PSM masks are real valued.
However, the masks are not bounded similarly to the cIRM masks.
Therefore, the proposed model for the cIRM masks can be reused
with a slight difference in implementation.
Now, only two outputs are created
instead of branching to four outputs at the final layer.
One output for the speech mask and the other for the noise mask.
The same as we did for the ``IRM'' but without the Sigmoids.
In addition, to deal with the unbounded range of values,
we also apply apply a compression algorithm to the reference masks as well.
The compression mechanism is the same as
described in Equation\;\ref{eq:cirm_compress}.

Following this architecture, the cost function can be set
to take two masks in the calculation of the error term,
like with the ``IRM'' masks:
\begin{align}\label{eq:psm_costf}
    \ell(\mathbf{\widehat{M}}_{j\omega, t},\;\mathbf{M}_{j\omega, t}) & =
        \frac{1}{2N}\sum_{j\omega, t}
        \left[
            \beta\!\left(
                \mathbf{\widehat{M}}^{(s)}_{j\omega, t} -
                \mathbf{M}^{(s)}_{j\omega, t}
            \right)^{2}
            + \left( 1- \beta \right)\!
            \left(
                \mathbf{\widehat{M}}^{(n)}_{j\omega, t} -
                \mathbf{M}^{(n)}_{j\omega, t}
            \right)^{2}
        \right]
\end{align}

The proposed PSM estimation network blocks diagram is shown in
Figure\;\ref{fig:psm_nn}.

\begin{figure}[H]
    \centering
    \includegraphics[width=0.75\linewidth]{Beamformers/images/psm_nn}
    \caption{Proposed DNN for PSM T-F masking estimations.}\label{fig:psm_nn}
\end{figure}

\subsection{Measurements}
\begin{figure}[H]
    \centering
    \includegraphics[width=\linewidth]{Features/images/psm_snr_stoi}
    \caption{PSM beamformer SNR vs. Segmental-SNR vs. STOI vs. SI-SNR.}\label{fig:psm_snr_stoi}
\end{figure}

\begin{figure}[H]
    \centering
    \includegraphics[width=\linewidth]{Features/images/psm_ideal_snr}
    \caption{Ideal PSM beamformer enhancement SNR \& Segmental-SNR.}\label{fig:psm_ideal_snr}
\end{figure}

\section{ORM --- Optimal Ratio Mask}
The realization of the phase component importance along with
the desire to keep the masking as simple as possible in terms of number
of matrices and the simplicity of multiplication for separation,
the IRM masking is further developed.

Trying to minimize the general MSE loss function for T-F masking,
same as with the ``Weiner filter'' that the IRM masking approximates, we get:
\begin{align}
    \mathbf{M}^{(s)}_{j\omega, t} & = \frac{
        |\mathbf{S}(t,j\omega)|^{2}
        + \mathfrak{R}_{e}\{ \mathbf{S}(t,j\omega) \cdot {\mathbf{N}}^{*}(t,j\omega) \}
        }{
            |\mathbf{S}(t,j\omega)|^{2}
            + |\mathbf{N}(t,j\omega)|^{2}
            + 2 \mathfrak{R}_{e}\{ \mathbf{S}(t,j\omega) \cdot {\mathbf{N}}^{*}(t,j\omega) \}
        } \\
    \mathbf{M}^{(n)}_{j\omega, t} & = \frac{
        |\mathbf{N}(t,j\omega)|^{2}
        + \mathfrak{R}_{e}\{ \mathbf{N}(t,j\omega) \cdot {\mathbf{S}}^{*}(t,j\omega) \}
        }{
            |\mathbf{S}(t,j\omega)|^{2}
            + |\mathbf{N}(t,j\omega)|^{2}
            + 2 \mathfrak{R}_{e}\{ \mathbf{N}(t,j\omega) \cdot {\mathbf{S}}^{*}(t,j\omega) \}
        }
\end{align}

Looking at the equation above,
it resembles the IRM form but also introduces
the real part of the multiplication between the speech spectrum
and the conjugate noise spectrum.

\subsection{Masks Estimations}
The ORM masking in terms of the estimation process resembles the
PSM completely. Therefore, the same compression and
DNN architecture are used to estimate the ORM masks.

The proposed DNN model blocks diagram is shown in Figure\;\ref{fig:psm_nn},
and the cost function is given in Equation\;\ref{eq:psm_costf}.

\subsection{Measurements}

\begin{figure}[H]
    \centering
    \includegraphics[width=\linewidth]{Features/images/orm_snr_stoi}
    \caption{ORM beamformer SNR vs. Segmental-SNR vs. STOI vs. SI-SNR.}\label{fig:orm_snr_stoi}
\end{figure}

\begin{figure}[H]
    \centering
    \includegraphics[width=\linewidth]{Features/images/orm_ideal_snr}
    \caption{Ideal ORM beamformer enhancement SNR \& Segmental-SNR.}\label{fig:orm_ideal_snr}
\end{figure}

% \section{Masks Estimations}
% \subsection{IRM}

% \begin{align}
%     \ell(\mathbf{\widehat{M}}_{j\omega, t},\;\mathbf{M}_{j\omega, t}) & =
%         \frac{1}{2N}\sum_{j\omega, t}
%         \left[
%             \beta\!\left(
%                 \mathbf{\widehat{M}}^{(s)}_{j\omega, t} -
%                 \mathbf{M}^{(s)}_{j\omega, t}
%             \right)^{2}
%             + \left( 1- \beta \right)\!
%             \left(
%                 \mathbf{\widehat{M}}^{(n)}_{j\omega, t} -
%                 \mathbf{M}^{(n)}_{j\omega, t}
%             \right)^{2}
%         \right]
% \end{align}

% \begin{figure}[H]
%     \centering
%     \includegraphics[width=0.75\linewidth]{Beamformers/images/irm_nn}
%     \caption{Proposed DNN for IRM T-F masking estimations}\label{fig:irm_nn}
% \end{figure}

% \subsection{cIRM}
% In Section~\ref{ssec:cirm},
% the \(cIRM\) masks are described in
% Equations~\ref{eq:cirmr_mask},~\ref{eq:cirmi_mask}.
% In contrast to the \(IRM\) masks which are bounded in the range \([0, 1]\),
% the \(cIRM\) masks are unbounded, and have the range \((-\infty, \infty)\).

% A neural network cannot train for unbounded values.
% Hence, an alternative presentation to the mask values is needed.
% One possibility is to compress the real and imaginary masks
% with a hyperbolic tangent as suggested in \cite{}:
% \begin{align}
%     cIRM_{x} &= K \frac{1-e^{-C\cdot M_{x}}}{1+e^{-C\cdot M_{x}}}
% \end{align}

% Where \(x\), stands for the real or the imaginary parts of the mask.
% By applying this compression, the mask values are bounded in
% the range \([-K, K]\), while \(C\) controls the steepness.
% In that way, a linear layer at the output is placed
% in favor of the sigmoid layers used in the simpler IRM DNN.

% Then, the cost function is defined to include both real and imaginary parts
% of both the noise and speech masks.
% \begin{align}
%     \ell(\mathbf{\widehat{M}}^{(x)}_{j\omega, t},\;\mathbf{M}^{(x)}_{j\omega, t}) & =
%         \frac{1}{2N}\sum_{j\omega, t}
%         \left[
%             \beta\!\left(
%                 \mathbf{\widehat{M}}^{(s \in \mathbb{C})}_{j\omega, t} -
%                 \mathbf{M}^{(s \in \mathbb{C})}_{j\omega, t}
%             \right)^{2}
%             + \left( 1- \beta \right)\!
%             \left(
%                 \mathbf{\widehat{M}}^{(n \in \mathbb{C})}_{j\omega, t} -
%                 \mathbf{M}^{(n \in \mathbb{C})}_{j\omega, t}
%             \right)^{2}
%         \right]
% \end{align}

% \begin{figure}[H]
%     \centering
%     \includegraphics[width=0.75\linewidth]{Beamformers/images/cirm_nn}
%     \caption{Proposed DNN for cIRM T-F masking estimations}\label{fig:cirm_nn}
% \end{figure}

% \subsection{PSM}

% \subsection{ORM}

\section{Conclusions}
In Table\;\ref{tbl:masks_l_params} are presented
the model's sizes in terms of memory requirement
and the number of learnable parameters.
The model's parameters were quantized
to the form of signed 16 bits.
The MSB (most significant bit) is for the sign,
the following four bits are set for the integer part,
and the other eleven bits present the fractional part.
All of the tested models were trained with and without
the \(\Delta, \Delta\Delta\) features.
Usage of the additional \(\Delta, \Delta\Delta\) features
enlarges the input size of the model and thus
leading to a larger number of learnable parameters, resulting
in a bigger model. Bigger models take a longer time to train
and are more complex to fit in limited resources hardware
devices. A trade-off decision can be made with respect to
the memory size and desired performance in the design phase
of T-F masks based applications. Although presenting
better results in audio metrics, the PSM and ORM
masks require \(\sim 43\%\) larger memory space
compared to the IRM masks,
when the feature set does not include
the \(\Delta, \Delta\Delta\) features.
A less severe increase of \(\sim 22\%\) in memory
size requirement has been observed
when the \(\Delta, \Delta\Delta\) features
were not excluded from the feature set.

\begin{table}[H]
    % for more info see: https://www.overleaf.com/learn/latex/tables
    \centering
    % \hspace*{-2.8cm}
    \arrayrulecolor{mtblborder}
\begin{tabular}{ !{\color{mtblborder}\vrule}c!{\color{mtblborder}\vrule}cc|||cc| }
    \hline

    \hline
    \rowcolor{mtblcaption}
    & \multicolumn{2}{c}{\color{white}\bf{Learnable Parameters} [Mil]}
    & \multicolumn{2}{c}{\color{white}\bf{Quant. (S16.11) Mem } [Mb]}\\
    % \cline{2-8}

    \multirow{-2}{*}{\cellcolor{mtblcaption}\color{white}\bf{Targets} }
    & \cellcolor{mtbl} \color{black}{W/o (\(\Delta\),\(\Delta\Delta\))}
    & \cellcolor{mtbl} \color{black}{W/ (\(\Delta\),\(\Delta\Delta\))}
    & \cellcolor{mtbl} \color{black}{W/o (\(\Delta\),\(\Delta\Delta\))}
    & \cellcolor{mtbl} \color{black}{W/ (\(\Delta\),\(\Delta\Delta\))} \\
    % & \color{white}\bf{ORM}
    % & \color{white}\bf{Clean} \\
    \hline

    \hline
    \rowcolor{mtblA} IRM
        & 2.44
        & 4.67
        & 39.0
        & 74.8 \\
    \hline

    \hline
    \rowcolor{mtbl} cIRM
        & 3.76
        & 5.99
        & 60.1
        & 95.9 \\
    \hline

    \hline
    \rowcolor{mtblA} PSM
        & 3.49
        & 5.73
        & 55.9
        & 91.7 \\
    \hline

    \hline
    \rowcolor{mtbl} ORM
        & 3.50
        & 5.74
        & 56.0
        & 91.8 \\
    \hline

    \hline
\end{tabular}
\arrayrulecolor{black}
\caption{T-F Masks models learnable parameters vs. Required memory size}
\label{tbl:masks_l_params}
\end{table}


%!TEX root = /home/renaud/Documents/EPL/tfe/latex/tfe.tex
\addcontentsline{toc}{chapter}{Introduction}
\chapter*{Introduction}
The understanding of geophysical and environmental fluid flows has shown an increasing interest over the past decades. Climate change, and the related issue of pollution have raised the need for accurate simulations allowing to understand and predict the time-space evolution of the concentration of pollutants in the environment. In this regard, the fate of constituents dissolved in a fluid mixture is commonly modelled by means of reactive-transport equations. Those are coupled partial differential equations taking into account the influence of \textit{reactions} as well as of the advective and diffusive \textit{transport phenomena} on the concentration of the constituent in the mixture. Accurate algorithms have been developed by engineers to numerically solve such equations. Finite differences, finite volume and finite elements methods are amongst the most commonly used discretization methods. However, they rely on grids containing thousands and in some instances millions of grid points so that CPU time can become prohibitive in cases where long time simulations are needed. Furthermore, although those methods provide pretty accurate results, these often suffer from a lack of \textit{interpretation}. This raises the need for simpler models with a few number of variables that would allow for an easier interpretation of the results as well as for fast long time simulations. Obviously, one cannot expect such models to provide results that would be as accurate as the ones furnished by the previously mentioned methods. Hence, both approaches are complementary.

One way to build such coarser models is to partition the domain of interest into a relatively small number of subdomains, called \textit{compartments} or \textit{boxes} over which the state variables are assumed \textit{homogeneous}. The fluxes between the compartments are then expressed by simple laws, leading to models that are relatively easy to interpret. This procedure leads to models called \textit{compartment models} or equivalently \textit{box models}. The number of subdomains and their shapes vary widely from one problem to another. Some schematic representations of compartment models found in the literature are shown in figure~\ref{fig:intro:boxmodels}.

Box models have been widely used in studies involving marine systems as well at local scale \cite{deleersnijder1998two,maderich2014regional,soetaert1995estimating} as at global scale \cite{kohler2005quantitative,munhoven1996glacial}. The choice of the subdomains and the specification of the fluxes exchanged between them rely on ad-hoc or empirical methods, based on the known hydrodynamics over the domain considered. It seems that no automatic procedure exists to define a relevant partitioning of the domain. The goal of this work is thus to fill that gap by proposing a method based on the tools of \textit{network science} to automatically delineate relevant compartments.

Network science may be defined as the study of graphs (or networks) and their use to model various (real-life or not) problems. Informally, a graph is a mathematical representation of a set of objects (the \textit{nodes} or \textit{vertices} of the graph), and the links between pairs of them (the \textit{edges} of the graph). The field of application of network science is extremely large, as illustrated by this quote from Newman \cite{newman2010networks}: "\textit{Many objects of interest in the physical, biological, and social sciences can be thought of as networks and [...] thinking of them in this way can often lead to new and useful insights}."

Often, graphs exhibit a \textit{community structure}: it is the case if the vertices can be organized into groups such that there are many interactions between the nodes within a group, and few interaction between the nodes of different groups. Such groups of vertices are called \textit{communities} or \textit{clusters}. An example of a three communities partitioning of a simple graph is shown in figure~\ref{fiug:intro:communities}. The art of revealing the community structure of a graph has a long history in network science, and a variety of \textit{community detection algorithms} and \textit{heuristics} has been developed, see \cite{fortunato2010community} for a 2010 survey. Clustering methods have shown to be useful for a wide applications such as social and biological networks \cite{girvan2002community}, biochemical networks \cite{holme2003subnetwork,guimera2005functional,palla2005uncovering}, or informations networks such as the world wide web \cite{flake2002self}. What makes communities particularly appealing is that they often correspond to \textit{functional units} such as cycles or pathways in metabolic networks \cite{guimera2005functional,palla2005uncovering,huss2007currency} or collections of pages on a single topic on the web \cite{flake2002self}. In the context of geophysical modeling, clustering methods have been used in works providing suggestions for the optimal placement of marine protected areas \cite{thomas2014numerical,jacobi2012identification,rossi2014hydrodynamic}. In this work, we aim to show that communities may correspond to relevant compartments in the case of advection-diffusion flow networks. To this end, we focus on one relatively recent method for community detection based on the \textit{stability} measure \cite{delvenne2010stability,delvenne2013stability,lambiotte2009laplacian}.

A complete procedure is proposed to build a compartment model from any problem whose velocity field and diffusivity tensor are known. First, the Lagrangian equations describing individual particles trajectories are derived from the transport model, and consistent numerical methods are proposed. This allows to compute the transition probability matrix at the desired times, which is the information needed to apply the stability clustering method. Finally, subdomains are delineated from the communities found by the clustering algorithm, and the exchange coefficients between the compartments are estimated numerically, completing the construction of the box model. This approach may be viewed	as a special application of the theory of model order reduction~\cite{deleersnijder2009reduction}. The whole procedure is applied on a simple, two dimensional test problem, and the resulting box model is assessed.

The first part of the work gathers all the theoretical tools needed for that procedure. Chapter~\ref{chap:clustering} is devoted to community detection and in particular to the \textit{stability} measure and the related clustering algorithm. The reactive transport equation and the study of its properties is the topic of chapter~\ref{chap:transportmodel}, whereas compartment models and their properties are studied in chapter~\ref{chap:compartment}. Then, the link between the transport model and the Lagrangian equations describing the position of an individual particle is shown in chapter~\ref{chap:numerical}, leading to the theory of stochastic differential equations and of the consistent numerical methods to solve them. The second part of this work consists in applying the procedure on a simple problem. An idealized, two-dimensional overturning circulation model is presented in~\ref{chap:overturnercirculation} and is then used the build the test problem in chapter~\ref{chap:bioverturner}. The complete procedure is applied on that test problem and assessed in the same chapter.

\begin{figure}[!htp]
	\begin{subfigure}[t]{.47\linewidth}
		\centering
		\includegraphics[width=\textwidth]{fig/intro/boxmodel_KohlerEtAl.png}
		\caption{Geometry of the box model of the isotopic carbon cycle (BICYCLE), where the arrows represent carbon fluxes between the compartments. This is figure 1 of \cite{kohler2005quantitative}.}
	\end{subfigure}
		\begin{subfigure}[t]{.51\linewidth}
		\centering
		\includegraphics[width=\textwidth]{fig/intro/boxmodel_SoetaertHerman.png}
		\caption{Representation of a subdomain decomposition of the Westerschelde. This is figure 1 of \cite{soetaert1995estimating}.}
	\end{subfigure}
	\begin{subfigure}[b]{\linewidth}
		\centering
		\includegraphics[width=\textwidth]{fig/intro/boxmodel_Munhoven.png}
		\caption{Geometry and water fluxes of a compartmental model for the World Ocean. The fluxes are expressed in sverdrups ($1$ Sv = $10^6$ $\rm{m^3/s}$). This is figure 3 of \cite{munhoven1996glacial}.}
	\end{subfigure}%
\caption{Schematic representations of different compartment models.}\label{fig:intro:boxmodels}
\end{figure}
\begin{figure}[!htp]
	\centering
	\includegraphics[width=.4\textwidth]{fig/intro/communities_example.png}
	\caption{Example of a three-communities partitioning on a simple network.} \label{fiug:intro:communities}
\end{figure}


\section{Results and interpretation}
\label{sec:results}
Trying different network structures and extensive hyperparameter tuning results in a network which achieves an accuracy of $\SI{84.4}{\percent}$ on the validation set by using the
hyperparameter values shown in \autoref{tab:hyperparameters}.
An overview of the final network can be seen in \autoref{fig:best_model}.
\begin{table}
    \centering
    \caption{A CNN using these hyperparameters can solve our problem the best. *= In the first convolutional layer and doubling from layer to layer afterwards.}
    \label{tab:hyperparameters}
    \begin{tabular}{c c c c c c c}
        \toprule
        $N_\text{conv. layers}$ & ${\text{num}_\text{kernels}}^*$ & $N_\text{kernel}$ & $N_\text{dense layers}$ & $N_\text{dense nodes}$ & $r_\text{L2}$ & $r_\text{dropout}$ \\
        \midrule
        5 & 48 & 4 & 1 & 128 & \num{1e-5} & 0.3\\
        \bottomrule
    \end{tabular}
\end{table}

The final step of every machine-learing based work is the performance evaluation on data that was not used at any point in the work before.
After the preprocessing we split $\SI{15}{\percent}$ of our data into a test set for this purpose.
Using our best performing model we achieve
\begin{align}
    \text{accuracy}_\text{test} = \SI{79.9}{\percent}.
\end{align}
The significant gap between validation accuracy and test accuracy ($\SI{4.5}{\percent}$) might be due to the extensive hyperparameter tuning, while the validation and test datasets are quite small
(50 images of each flower species).
This might lead to manual overfitting on the validation set during hyperparameter tuning.

It is also helpful to examine the distribution of the predicted probability for a single species, while distinguishing between the images which truly show a flower(s) of this species and
all other images.
This is done in \autoref{fig:hist} for \enquote{Marguerite Daisy}.
Another import graphic for evaluating a classification is the \textit{confusion matrix} which can be seen in \autoref{fig:matrix}.
\begin{figure}
    \centering
    \begin{subfigure}{0.49\textwidth}
        \centering
        \includegraphics[width=0.99\textwidth]{../data/eval_plots_test/One_vs_all_histogram.pdf}
        \caption{Probability distribution for \enquote{Marguerite Daisy}.}
        \label{fig:hist}
    \end{subfigure}
    \hfill
    \begin{subfigure}{0.49\textwidth}
        \centering
        \includegraphics[width=0.99\textwidth]{../data/eval_plots_test/confusion_matrix.pdf}
        \caption{Confusion matrix.}
        \label{fig:matrix}
    \end{subfigure}
    \caption{The predicted probabilities for the class \enquote{Marguerite Daisy} and the confusion matrix based on the test data set help to illustrate the performance of our classification model.}
\end{figure}
The probability distribution shows that out network is generally pretty certain of its classification of Marguerite Daisies, as most images (regardless if correctly classified or not)
are in the highest or lowest bin.

If we look at both plots, we can see, that \enquote{Marguerite Daisy} is the class which gets misclassified the most as only 31 of 50 images of Marguerite Daisies in the test set get
classified as such.
They get confused with Waterlilies the most, which, looking at \autoref{fig:images}, might be caused by similarities in color and petal shape.
However, there are also images of Waterlilies with different colors in our dataset
So it might be the case, that Waterlilies are the species which is hard to correctly classify and the (weak) classification criteria for Waterlilies just happen to also apply to Marguerite Daisies
quite often.
Another interesting observation in \autoref{fig:matrix} is, that Butterfly Bushs get confused with Bee Balm flowers and Grape Hyacinths a lot.
Bee Balm flowers come in very similar colors to Butterfly Bushes and the tattered-looking blossoms of Bee Balm flowers can look very similar to Butterfly Bushs which have already lost some of their
blossoms.
The purple color and general shape of the flower head of Grape Hyacinths can make them look very much like Butterfly Bushs on images.
In reality the size of the flower head is very different, but this is not an information which our network has access to.
However, real images of Grape Hyacinths do not get misclassified at all within our test set.
This can be caused by the very distinctive ball-like petal-shape (see \autoref{fig:images}) which our network can probably detect very reliably in real images of Grape Hyacinths.
More interpretations like these for the other flower species are possible.

\begin{wrapfigure}{R}{0.75\textwidth}
    \centering
    \includegraphics[width=0.75\textwidth]{../data/eval_plots_test/biggest_errors.pdf}
    \caption{These six images get misclassified with the highest certainty in the wrong prediction.}
    \label{fig:errors}
\end{wrapfigure}
The six images which the network misclassifies with the highest certainty in its wrong prediction are shown in \autoref{fig:errors}.
The image in the top left looks very similar to a Blanket Flower (like the one in the top middle) and the bottom left, bottom middle and top right image are drawings and have
a white/ white-grey background which probably makes it harder for the network due to a lack of contrast.
The Waterlilies on the bottom right image are very small and its color is very similar to a Grape Hyacinth, so this misclassification is understandable.
The only strange misclassification is the image in the top middle.
A possible explanation is the network detecting something in the background of the image as resembling a Butterfly Bush.

\subsection{Alternative method}
In order to get a reference to compare the performance of our network to, we also try a different approach to the classification based on the eleven flower species.
We choose a \textit{k-Nearest Neighbor} Algorithm (kNN) for this task, because it is one of the simplest machine-learning algorithms (\textit{lazy learner}).
Suitable input data for the kNN is generated by looking at a histogram of the color intensity of all three RGB colors (red, green, blue) for all pixels in an image.
An example of this can be seen in \autoref{fig:kNN_hist}.
Then the mean and the standart deviation for each color channel are calculated and used as input data for the kNN.
This results in an reduction of $200\cdot 200 \cdot 3 = 120.000$ parameters for each image to only $6$ parameters for each image.

The main hyperparameters of the kNN algorithm is the number of neighbors $k$ to consider for the classification of a new datapoint, as well as the distance metric used to decide which points are
the nearest ones.
We use the implementation of a kNN classifier in \texttt{scikit-learn} \cite{scikit-learn} with its default \textit{Euclidean distance} as distance metric.
We then search for the optimal $k$ by looking at the accuracy the algorithm achieves on the validation data set for $k \in [1, 300]$ which can be seen in \autoref{fig:kNN_acc}.
\begin{wrapfigure}{r}{0.55\textwidth}
    \centering
    \includegraphics[width=0.55\textwidth]{../data/alternative_approach/accuracy_knn_threshold_300.pdf}
    \caption{The validation accuracy of the kNN algorithm for different $k$.}
    \label{fig:kNN_acc}
\end{wrapfigure}
We discard $k = 1, 2$, because there are images which are almost identical between the train and test set which distort the results for $k = 1, 2$.
Therefore, $k = 82$ results in the best validation accuracy of $\SI{39.0}{\percent}$.
Applying this kNN model on the test set achieves a classification accuracy of
\begin{align}
    \text{accuracy}_\text{test, kNN} = \SI{37.0}{\percent}.
\end{align}
Considering the simplicity of the approach, this result is within an expected margin.


\documentclass{article}

\usepackage[utf8]{inputenc}
\usepackage[T1]{fontenc}

\begin{document}

\section*{Powers and indices}

\[x^2\]

\[x_2\]

\[^tM^{2}_{1}\]

% The command \! removes a "loose" space for matrix transpose
\[^{t\!}M^{2}_{1}\]

\end{document}


%!TEX root = ../OGUSAdoc.tex

In \ogindia, the government enters by levying taxes on households, providing transfers to households, levying taxes on firms, spending resources on public goods, and making rule-based adjustments to stabilize the economy in the long-run. It is this last activity that is the focus of this chapter.

\section{Government Tax Revenue}\label{SecUnbalGBCrev}

  We see from the household's budget constraint that taxes $T_{s,t}$ and transfers $TR_{t}$ enter into the household's decision,
  \begin{equation}\tag{\ref{EqHHBC}}
    \begin{split}
      c_{j,s,t} + b_{j,s+1,t+1} &= (1 + r_{t})b_{j,s,t} + w_t e_{j,s} n_{j,s,t} + \zeta_{j,s}\frac{BQ_t}{\lambda_j\omega_{s,t}} + \eta_{j,s,t}\frac{TR_{t}}{\lambda_j\omega_{s,t}} - T_{s,t}  \\
      &\quad\forall j,t\quad\text{and}\quad s\geq E+1 \quad\text{where}\quad b_{j,E+1,t}=0\quad\forall j,t
    \end{split}
  \end{equation}
  where we defined the tax liability function $T_{s,t}$ in \eqref{EqTaxCalcLiabETR} as an effective tax rate times total income and the transfer distribution function $\eta_{j,s,t}$ is uniform across all households as in \eqref{EqTaxCalcEtajs}. And government revenue from the corporate income tax rate $\tau^{corp}$ and the tax on depreciation expensing $\tau^\delta$ enters the firms' profit function.
  \begin{equation}\tag{\ref{EqFirmsProfit}}
    PR_t = (1 - \tau^{corp})\bigl(Y_t - w_t L_t\bigr) - \bigl(r_t + \delta\bigr)K_t + \tau^{corp}\delta^\tau K_t \quad\forall t
  \end{equation}
  We define total government revenue from taxes as the following.
  \begin{equation}\label{EqUnbalGBCgovRev}
    Rev_t = \underbrace{\tau^{corp}\bigl[Y_t - w_t L_t\bigr] - \tau^{corp}\delta^\tau K_t}_{\text{corporate tax revenue}} + \underbrace{\sum_{s=E+1}^{E+S}\sum_{j=1}^J\lambda_j\omega_{s,t}\tau^{etr}_{s,t}\left(x_{j,s,t},y_{j,s,t}\right)\bigl(x_{j,s,t} + y_{j,s,t}\bigr)}_{\text{household tax revenue}} \quad\forall t
  \end{equation}

\section{Government Budget Constraint}\label{SecUnbalGBCbudgConstr}

  Let the level of government debt in period $t$ be given by $D_t$. The government budget constraint requires that government revenue $Rev_t$ plus the budget deficit ($D_{t+1} - D_t$) equal expenditures on interest of the debt, government spending on public goods $G_t$, and total transfer payments to households $TR_t$ every period $t$.
  \begin{equation}\label{EqUnbalGBCbudgConstr}
    D_{t+1} + Rev_t = (1 + r_t)D_t + G_t + TR_t \quad\forall t
  \end{equation}

  We assume that total government transfers to households are a fixed fraction $\alpha_{tr}$ of GDP each period.
  \begin{equation}\label{EqUnbalGBCtfer}
    TR_t = g_{tr,t}\:\alpha_{tr}\: Y_t \quad\forall t
  \end{equation}
  The time dependent multiplier $g_{tr,t}$ in front of the right-hand-side of \eqref{EqUnbalGBCtfer} will equal 1 in most initial periods. It will potentially deviate from 1 in some future periods in order to provide a closure rule that ensures a stable long-run debt-to-GDP ratio. We will discuss the closure rule in Section \ref{SecUnbalGBCcloseRule}.

  We also assume that government spending on public goods is a fixed fraction of GDP each period in the initial periods.
  \begin{equation}\label{EqUnbalGBC_Gt}
    G_t = g_{g,t}\:\alpha_{g}\: Y_t
  \end{equation}
  Similar to transfers $TR_t$, the time dependent multiplier $g_{g,t}$ in front of the right-hand-side of \eqref{EqUnbalGBC_Gt} will equal 1 in most initial periods. It will potentially deviate from 1 in some future periods in order to provide a closure rule that ensures a stable long-run debt-to-GDP ratio. We make this more specific in the next section.

\section{Interest Rate on Government Debt}\label{SecRateWedge}

Despite the model having no aggregate risk, it may be helpful to build in an interest rate differential between the rate of return on private capital and the interest rate on government debt.  Doing so helps to add realism by including a risk premium.  \ogindia allows users to set an exogenous wedge between these two rates.  The interest rate on government debt,

\begin{equation}\label{EqUnbalGBC_rate_wedge}
  r_{gov, t} = (1 - \tau_{d, t})r_{t} - \mu_{d}
\end{equation}

The two parameters, $\tau_{d,t}$ and $\mu_{d,t}$ can be used to allow for a government interest rate that is a percentage hair cut from the market rate or a government interest rate with a constant risk premia.

In the cases where there is a differential ($\tau_{d,t}$ or $\mu_{d,t} \neq 0$), then we need to be careful to specify how the household chooses government debt and private capital in its portfolio of asset holdings.  We make the assumption that under the exogenous interest rate wedge, the household is indifferent between holding its assets as debt and private capital. This amounts to an assumption that these two assets are perfect substitutes given the exogenous wedge in interest rates.  Given the indifference between government debt and private capital at these two interest rates, we assume that the household holds debt and capital in the same ratio that debt and capital are demanded by the government and private firms, respectively. The interest rate on the household portfolio of asset is thus given by:

\begin{equation}\label{EqUnbalGBC_rate_wedge}
  r_{hh,t} = \frac{r_{gov,t}D_{t} + r_{t}K_{t}}{D_{t} + K_{t}}
\end{equation}

\section{Budget Closure Rule}\label{SecUnbalGBCcloseRule}

  If total government transfers to households $TR_t$ and government spending on public goods $G_t$ are both fixed fractions of GDP, one can imagine corporate and household tax structures that cause the debt level of the government to either tend toward infinity or to negative infinity, depending on whether too little revenue or too much revenue is raised, respectively.

  A virtue of dynamic general equilibrium models is that the model must be stationary in order to solve it. That is, no variables can be indefinitely growing as time moves forward. The labor augmenting productivity growth $g_y$ from Chapter \ref{Chap_Firms} and the potential population growth $\tilde{g}_{n,t}$ from Chapter \ref{Chap_Demog} render the model nonstationary. But we show how to stationarize the model against those two sources of growth in Chapter \ref{Chap_Stnrz}. However, even after stationarizing the effects of productivity and population growth, the model could be rendered nonstationary and, therefore, not solvable if government debt were becoming too positive or too negative too quickly.

  The \ogindia model offers three different options for budget closure rules. Each rule uses some combination of changes in government spending on public goods $G_t$ and government transfers to households $TR_t$ to stabilize the debt-to-GDP ratio in the long-run.
  \begin{enumerate}
    \item Change only government spending on public goods $G_t$.
    \item Change only government transfers to households $TR_t$.
    \item Change both government spending $G_t$ and transfers $TR_t$ by the same percentage.
  \end{enumerate}

  \subsection{Change government spending only}\label{SecUnbalGBC_chgGt}

    We specify a closure rule that is automatically implemented after some period $T_{G1}$ to stabilize government debt as a percent of GDP (debt-to-GDP ratio). Let $\alpha_D$ represent the long-run debt-to-GDP ratio at which we want the economy to eventually settle.
    \begin{equation}\label{EqUnbalGBCclosure_Gt}
      \begin{split}
        &G_t = g_{g,t}\:\alpha_{g}\: Y_t \\
        &\text{where}\quad g_{g,t} =
          \begin{cases}
            1 \qquad\qquad\qquad\qquad\qquad\qquad\qquad\:\:\:\,\text{if}\quad t < T_{G1} \\
            \frac{\left[\rho_{d}\alpha_{D}Y_{t} + (1-\rho_{d})D_{t}\right] - (1+r_{t})D_{t} - TR_{t} + Rev_{t}}{\alpha_g Y_t} \quad\text{if}\quad T_{G1}\leq t<T_{G2} \\
            \frac{\alpha_{D}Y_{t} - (1+r_{t})D_{t} - TR_{t} + Rev_{t}}{\alpha_g Y_t} \qquad\qquad\quad\:\:\:\,\text{if}\quad t \geq T_{G2}
          \end{cases} \\
        &\quad\text{and}\quad g_{tr,t} = 1 \quad\forall t
      \end{split}
    \end{equation}
    The first case in \eqref{EqUnbalGBCclosure_Gt} says that government spending $G_t$ will be a fixed fraction $\alpha_g$ of GDP $Y_t$ for every period before $T_{G1}$. The second case specifies that, starting in period $T_{G1}$ and continuing until before period $T_{G2}$, government spending be adjusted to set tomorrow's debt $D_{t+1}$ to be a convex combination between $\alpha_D Y_t$ and the current debt level $D_t$, where $\alpha_D$ is a target debt-to-GDP ratio and $\rho_d\in(0,1]$ is the percent of the way to jump toward the target $\alpha_D Y_t$ from the current debt level $D_t$. The last case specifies that, for every period after $T_{G2}$, government spending $G_t$ is set such that the next-period debt be a fixed target percentage $\alpha_D$ of GDP.

  \subsection{Change government transfers only}\label{SecUnbalGBC_chgTRt}

    If government transfers to households are specified by \eqref{EqUnbalGBCtfer} and the long-run debt-to-GDP ratio can only be stabilized by changing transfers, then the budget closure rule must be the following.
    \begin{equation}\label{EqUnbalGBCclosure_TRt}
      \begin{split}
        &TR_t = g_{tr,t}\:\alpha_{tr}\: Y_t \\
        &\text{where}\quad g_{tr,t} =
          \begin{cases}
            1 \qquad\qquad\qquad\qquad\qquad\qquad\qquad\:\text{if}\quad t < T_{G1} \\
            \frac{\left[\rho_{d}\alpha_{D}Y_{t} + (1-\rho_{d})D_{t}\right] - (1+r_{t})D_{t} - G_{t} + Rev_{t}}{\alpha_{tr} Y_t} \quad\text{if}\quad T_{G1}\leq t<T_{G2} \\
            \frac{\alpha_{D}Y_{t} - (1+r_{t})D_{t} - G_{t} + Rev_{t}}{\alpha_{tr} Y_t} \qquad\qquad\quad\:\:\:\:\text{if}\quad t \geq T_{G2}
          \end{cases} \\
        &\quad\text{and}\quad g_{g,t} = 1 \quad\forall t
      \end{split}
    \end{equation}
    The first case in \eqref{EqUnbalGBCclosure_TRt} says that government transfers $TR_t$ will be a fixed fraction $\alpha_{tr}$ of GDP $Y_t$ for every period before $T_{G1}$. The second case specifies that, starting in period $T_{G1}$ and continuing until before period $T_{G2}$, government transfers be adjusted to set tomorrow's debt $D_{t+1}$ to be a convex combination between $\alpha_D Y_t$ and the current debt level $D_t$. The last case specifies that, for every period after $T_{G2}$, government transfers $TR_t$ are set such that the next-period debt be a fixed target percentage $\alpha_D$ of GDP.

  \subsection{Change both government spending and transfers}\label{SecUnbalGBC_chgGtTRt}

    In some cases, changing only government spending $G_t$ or only government transfers $TR_t$ will not be enough. That is, there exist policies for which a decrease in government spending to zero after period $T_{G1}$ will not stabilize the debt-to-GDP ratio. And negative government spending on public goods does not make sense.\footnote{Negative values for government spending on public goods would mean that revenues are coming into the country from some outside source, which revenues are triggered by government deficits being too high in an arbitrary future period $T_{G2}$.} On the other hand, negative transfers do make sense. Notwithstanding, one might want the added stabilization ability of changing both government spending $G_t$ and transfers $TR_t$ to stabilize the long-run debt-to-GDP ratio.

    In our specific form of this joint option, we assume that the factor by which we scale government spending and transfers is the same $g_{g,t} = g_{tr,t}$ for all $t$. We label this single scaling factor $g_{trg,t}$.
    \begin{equation}\label{EqUnbalGBCclosure_gTRGt}
      g_{trg,t}\equiv g_{g,t} = g_{tr,t} \quad\forall t
    \end{equation}
    If government spending on public goods is specified by \eqref{EqUnbalGBC_Gt} and government transfers to households are specified by \eqref{EqUnbalGBCtfer} and the long-run debt-to-GDP ratio can only be stabilized by changing both spending and transfers, then the budget closure rule must be the following.
    \begin{equation}\label{EqUnbalGBCclosure_TRGt}
      \begin{split}
        &G_t + TR_t = g_{trg,t}\left(\alpha_g + \alpha_{tr}\right)Y_t \quad\Rightarrow\quad G_t = g_{trg,t}\:\alpha_g\: Y_t \quad\text{and}\quad TR_t = g_{trg,t}\:\alpha_{tr}\:Y_t \\
        &\text{where}\quad g_{trg,t} =
          \begin{cases}
            1 \qquad\qquad\qquad\qquad\qquad\qquad\:\:\:\,\text{if}\quad t < T_{G1} \\
            \frac{\left[\rho_{d}\alpha_{D}Y_{t} + (1-\rho_{d})D_{t}\right] - (1+r_{t})D_{t} + Rev_{t}}{\left(\alpha_g + \alpha_{tr}\right)Y_t} \quad\text{if}\quad T_{G1}\leq t<T_{G2} \\
            \frac{\alpha_{D}Y_{t} - (1+r_{t})D_{t} + Rev_{t}}{\left(\alpha_g + \alpha_{tr}\right)Y_t} \qquad\qquad\quad\:\:\:\:\text{if}\quad t \geq T_{G2}
          \end{cases}
      \end{split}
    \end{equation}
    The first case in \eqref{EqUnbalGBCclosure_TRGt} says that government spending and government transfers $Tr_t$ will their respective fixed fractions $\alpha_g$ and $\alpha_{tr}$ of GDP $Y_t$ for every period before $T_{G1}$. The second case specifies that, starting in period $T_{G1}$ and continuing until before period $T_{G2}$, government spending and transfers be adjusted by the same rate to set tomorrow's debt $D_{t+1}$ to be a convex combination between $\alpha_D Y_t$ and the current debt level $D_t$. The last case specifies that, for every period after $T_{G2}$, government spending and transfers are set such that the next-period debt be a fixed target percentage $\alpha_D$ of GDP.

    Each of these budget closure rules \eqref{EqUnbalGBCclosure_Gt}, \eqref{EqUnbalGBCclosure_TRt}, and \eqref{EqUnbalGBCclosure_TRGt} allows the government to run increasing deficits or surpluses in the short run (before period $T_{G1}$). But then the adjustment rule is implemented gradually beginning in period $t=T_{G1}$ to return the debt-to-GDP ratio back to its long-run target of $\alpha_D$. Then the rule is implemented exactly in period $T_{G2}$ by adjusting some combination of government spending $G_t$ and transfers $TR_t$ to set the debt $D_{t+1}$ such that it is exactly $\alpha_D$ proportion of GDP $Y_t$.

\section{Some Caveats and Alternatives}\label{SecUnbalGBCcaveat}

  \ogindia adjusts some combination of government spending $G_t$ and government transfers $TR_t$ as its closure rule instrument because of its simplicity and lack of distortionary effects. Since government spending does not enter into the household's utility function, its level does not affect the solution of the household problem. In contrast, government transfers do appear in the household budget constraint. However, household decisions do not individually affect the amount of transfers, thereby rendering government transfers as exogenous from the household's perspective. As an alternative, one could choose to adjust taxes to close the budget (or a combination of all of the government fiscal policy levers).

  There is no guarantee that any of our stated closure rules \eqref{EqUnbalGBCclosure_Gt}, \eqref{EqUnbalGBCclosure_TRt}, or \eqref{EqUnbalGBCclosure_TRGt} is sufficient to stabilize the debt-to-GDP ratio in the long run. For large and growing deficits, the convex combination parameter $\rho_d$ might be too gradual, or the budget closure initial period $T_{G1}$ might be too far in the future, or the target debt-to-GDP ratio $\alpha_D$ might be too high. The existence of any of these problems might be manifest in the steady state computation stage. However, it is possible for the steady-state to exist, but for the time path to never reach it. These problems can be avoided by choosing conservative values for $T_{G1}$, $\rho_d$, and $\alpha_D$ that close the budget quickly.

  And finally, in closure rules \eqref{EqUnbalGBCclosure_Gt} and \eqref{EqUnbalGBCclosure_TRGt} in which government spending is used to stabilize the long-run budget, it is also possible that government spending is forced to be less than zero to make this happen. This would be the case if tax revenues bring in less than is needed to financed transfers and interest payments on the national debt. None of the equations we've specified above preclude that result, but it does raise conceptual difficulties. Namely, what does it mean for government spending to be negative? Is the government selling off pubic assets? We caution those using this budget closure rule to consider carefully how the budget is closed in the long run given their parameterization. We also note that such difficulties present themselves across all budget closure rules when analyzing tax or spending proposals that induce structural budget deficits. In particular, one probably needs a different closure instrument if government spending must be negative in the steady-state to hit your long-term debt-to-GDP target.