% !TEX root = main.tex
% !TEX spellcheck = en-US

\section{Non-malleability of $\marlinprotfs$}
We show that $\marlin$ is \COMMENT{forking }simulation-extractable. To that end, we show
that $\marlin$ has all the required properties: has unique response property, is
forking special sound, and its simulator can provide indistinguishable proofs
without a trapdoor, just by programming the random oracle.

\subsection{$\marlin$ protocol rolled-out}
$\marlin$ uses R1CS as arithmetization method. That is, the prover given
instance $\inp$ and witness $\wit$ and $|\HHH| \times |\HHH|$ matrices $\vec{A},
\vec{B}, \vec{C}$ shows that $\vec{A} (\inp^\top, \wit^\top)^\top \circ \vec{B}
(\inp^\top, \wit^\top)^\top = \vec{C} (\inp^\top, \wit^\top)^\top$. (Here
$\circ$ is a entry-wise product.)

We assume that the matrices have at most $|\KKK|$ non-zero entries. Obviously,
$|\KKK| \leq |\HHH|^2$. Let $b = 3$, the upper-bound of polynomial evaluations
the prover has to provide for each of the sent polynomials.  Denote by $\dconst$
an upper-bound for $\smallset{|\HHH| + 2b -1, 2 |\HHH| + b - 1, 6 |\KKK| - 6}$.

The idea of showing that the constraint system is fulfilled is as
follows. Denote by $\vec{z} = (\inp, \wit)$. The prover computes polynomials
$\p{z_A} (X), \p{z_B} (X), \p{z_C} (X)$ which encode vectors
$\vec{A} \vec{z}, \vec{B} \vec{z}, \vec{C} \vec{z}$ and have degree $<
|\HHH|$. Importantly, when constrains are fulfilled,
$ \p{z_A} (X) \p{z_B} (X) - \p{z_C} (X) = \p{h_0} (X) \ZERO_\HHH (X)$, for some
$\p{h_0} (X)$ and vanishing polynomial $\ZERO_\HHH (X)$. The prover sends
commitments to these polynomials and shows that they have been computed
correctly. More precisely, it shows that
\begin{equation}
  \label{eq:marlin_eq_2}
\forall \vec{M} \in \smallset{\vec{A}, \vec{B}, \vec{C}},  \forall \kappa \in \HHH,
\p{z_M} (\kappa) = \sum_{\iota \in \HHH} \vec{M}[\kappa, \iota] \p{z}(\iota).
\end{equation}

The ideal verifier checks the following equalities
\begin{equation}
  \label{eq:marlin_ver_eq}
  \begin{aligned}
    \p{h}_3 (\beta_3) \ZERO_\KKK (\beta_3) & = \p{a} (\beta_3) - \p{b} (\beta_3)
    (\beta_3 \p{g_3} (\beta_3) + \sigma_3 / |\KKK|)\\
    \p{r}(\alpha, \beta_2) \sigma_3 & = \p{h_2} (\beta_2) \ZERO_\HHH (\beta_2) +
    \beta_2 \p{g2} (\beta_2) + \sigma_2/|\HHH|\\
    \p{s}(\beta_1) + \p{r}(\alpha, \beta_1) (\sum_M \eta_M \p{z_M} (\beta_1)) -
    \sigma_2 \p{z} (\beta_1) & = \p{h_1} (\beta_1) \ZERO_\HHH (\beta_1) +
    \beta_1
    \p{g_1} (\beta_1) + \sigma_1/|\HHH| \\
    \p{z_A} (\beta_1) \p{z_B} (\beta_1) - \p{z_C} (\beta_1) & = \p{h_0}
    (\beta_1) \ZERO_\HHH (\beta_1)
  \end{aligned}
\end{equation}
where $\p{g_i} (X), \p{h_i} (X)$, $i \in \range{1}{3}$,
$\p{a} (X), \p{b} (X), \sigma_1, \sigma_2, \sigma_3$ are polynomials and
variables required by the sumcheck protocol which allows verifier to efficiently
verify that \cref{eq:marlin_eq_2} holds.

\subsection{Unique response property}
\begin{lemma}\label{lem:marlinprot_ur}
  Let $\PCOM$ be a commitment of knowledge with security $\epsk(\secpar)$,
  $\epsbind(\secpar)$ and has unique response property with security
  $\epsop(\secpar)$. Then probability that a $\ppt$ adversary $\adv$ breaks
  $\marlinprotfs$ $\ur{1}$ property is at most
  $6 \cdot (\epsbind + \epsop + \epsk)$ \michals{8.9}{Do we need to add
    probability that the idealized verifier fails $\epsid$?}
\end{lemma}
\begin{proof}
  As in previous proofs, we show the property by game hops. Let
  $N = \p{g_1}, \p{h_1}, \p{g_2}, \p{h_2}, \p{g_3}, \p{h_3}$. That is, $M$ is a
  set of all polynomials which commitments are send during the protocol after
  Round 1.

  \ncase{Game 0} In this game the adversary wins if it breaks evaluation
  binding, unique opening property, or knowledge soundness of one of commitments
  for polynomials in $N$.

  Probability that a $\ppt$ adversary wins in Game 0, is upper bounded by $6
  \cdot (\epsbind + \epsop + \epsk)$.

  \ncase{Game 1} In this game the adversary additionally wins if it breaks the
  $\ur{2}$ property of the protocol

  \ncase{Game 0 to Game 1} Probability that the adversary wins in
  Game 1 but not in Game 0 is $0$. This is since the polynomials in $N$ are
  uniquely determined. W.l.o.g.~we analyse probability that adversary is able to
  produce two (different) pairs of polynomials $(\p{h_2}, \p{g_2})$ and $(\p{h'_2},
  \p{g'_2})$ such that
  \begin{align*}
    \p{h_2} (X) \ZERO_{\HHH} (X) + X \p{g_2} (X) & = \p{h_2} (X) \ZERO_{\HHH} (X) +
                                                   X \p{g_2} (X)\\
    (\p{h_2} (X) - \p{h'_2} (X)) \ZERO_{\HHH} (X) & = X (\p{g'_2} (X) - \p{g'_2}
    (X)).
  \end{align*}
  Since $\p{h_2}, \p{g_2} \in \FF^{< |\HHH| - 1} [X]$ and
  $\ZERO \in \FF^{|\HHH|} [X]$, LHS has different degree than RHS unless both
  sides have degree $0$. This happens when $\p{h_2} (X) = \p{h'_2} (X)$ and
  $\p{g_2} (X) - \p{g'_2} (X)$.
\end{proof}

\subsection{Forking special soundness}
\begin{lemma}\label{lem:marlinprot_ss}
	Assume that an idealised $\marlinprot$ verifier fails with probability at most
	$\epsid(\secpar)$ and probability that a $\ppt$ adversary breaks dlog is
	bounded by $\epsdlog(\secpar)$. Then $\marlinprot$ is
	$(\epsid (\secpar) + \epsdlog (\secpar), 2, d + 1)$-forking special
	sound.
\end{lemma}
\begin{proof}
	% \michals{8.9}{Need to check the degrees}
	The proof goes similarly to the respective proofs for $\plonk$ and
	$\sonic$. That is, let $\srs$ be $\marlinprot$'s finalised SRS and denote by $\srs_1$
	all SRS's $\GRP_1$-elements. Let $\tdv$ be an algebraic adversary that
	produces a statement $\inp$ and a $(1, \dconst + 1, 1, 1)$-tree of
	acceptable transcripts $\tree$. Note that in all transcripts the instance
	$\inp$, proof elements
	$\sigma_1, \gone{\p{w}(\chi), \p{z_A}(\chi), \p{z_B}(\chi), \p{z_C}(\chi),
		\p{h_0}(\chi), \p{s}(\chi)}, \gone{\p{g_1}(\chi), \p{h_1}(\chi)}$
	and challenges $\alpha, \eta_1, \eta_2, \eta_3$ are common as the transcripts
	share the first $3$ messages. The tree branches after the third message of the
	protocol where the challenge $\beta_1$ is presented, thus tree $\tree$ is
	build using different values of $\beta_1$.

	We consider the following games.

	\ncase{Game 0} In this game the adversary wins if all the transcripts it
	produced are acceptable by the ideal verifier,
	i.e.~$\vereq_{\inp, \zkproof}(X) = 0$, cf.~\cref{eq:marlin_ver_eq}, yet the extractor
	fails to extract a valid witness out of them.

	Probability of $\tdv$ winning this game is $\epsid(\secpar)$ as the protocol
	$\marlinprot$, instantiated with the idealised verification equation, is
	perfectly sound except with negligible probability of the idealised verifier
	failure $\epsid(\secpar)$. Hence for a valid proof $\zkproof$ for a statement
	$\inp$ there exists a witness $\wit$, such that $\REL(\inp, \wit)$ holds. Note
	that since the $\tdv$ produces $(\dconst + 1)$ acceptable transcripts for
	different challenges $\beta_1$, it obtains the same number of different
	evaluations of polynomials $\p{z_A}, \p{z_B}, \p{z_C}$.

	Since the transcripts are acceptable by an idealised verifier, the equality
	$\p{z_A} (X) \p{z_B} (X) - \p{z_C} (X) = \p{h_0} (X) \ZERO_\HHH (X)$ holds and
	each of $\p{z}_M$, $M \in \smallset{A, B, C}$, has been computed
	correctly. Hence, $\p{z_A}, \p{z_B}, \p{z_C}$ encodes the valid witness for
	the proven statement. Since $\p{z_A}, \p{z_B}, \p{z_C}$ are of degree at most
	$\dconst$ and there is more than $(\dconst + 1)$ their evaluations
	known, $\extt$ can recreate their coefficients by interpolation and reveal the
	witness with probability $1$. Hence, the probability that extraction fails in
	that case is upper-bounded by probability of an idealised verifier failing
	$\epsid(\secpar)$, which is negligible.

	\ncase{Game 1} In this game the adversary additionally wins if it produces a
	transcript in $\tree$ such that $\vereq_{\inp, \zkproof}(\chi) = 0$, but
	$\vereq_{\inp, \zkproof}(X) \neq 0$. That is, the ideal verifier does not
	accept the proof, but the real verifier does.

	\ncase{Game 0 to Game 1} Assume the adversary wins in Game 1, but
	does not win in Game 0. We show that such adversary may be used to break the
	$\dlog$ assumption. More precisely, let $\tdv$ be an adversary that for
	relation $\REL$ and randomly picked $\srs \sample \kgen(\REL)$ produces a tree
	of acceptable transcripts such that the winning condition of the game
	holds. Let $\rdvdlog$ be a reduction that gets as input an
	$(\dconst, 1)$-dlog instance $\gone{1, \ldots, \chi^\dconst}, \gtwo{1, \chi}$ and
	is tasked to output $\chi$. The reduction proceeds as follows---it builds $\adv$'s SRS $\srs$ in the updatable setting using the input $\dlog$ instance. Namely it answers $\adv$'s queries for SRS updates and sets the honest update of the SRS to be $\srs$. Let $\srs'$ be the finalised SRS and $(1, \tree)$ be the output
	returned by $\adv$. Let $\inp$ be a relation proven in $\tree$.  Consider a
	transcript $\zkproof \in \tree$ such that $\vereq_{\inp, \zkproof}(X) \neq 0$,
	but $\vereq_{\inp, \zkproof}(\chi) = 0$. Since the adversary is algebraic, all
	group elements included in $\tree$ are extended by their representation as a
	combination of the input $\GRP_1$-elements. Hence all coefficients of the
	verification equation polynomial $\vereq_{\inp, \zkproof}(X)$ are known and
	$\rdvdlog$ can find its zero points. Since
	$\vereq_{\inp, \zkproof}(\chi) = 0$, the targeted discrete log value $\chi'$ is
	among them.  Let $\chi_1, \ldots, \chi_\ell$ be the partial trapdoors of $\adv$'s SRS updates,  extracted by the reduction from the update proofs given by $\adv$. Now $\rdvdlog$ returns $\chi = \chi' (\chi_1 \chi_2 \ldots \chi_\ell)^{-1}$ and breaks the $\dlog$ assumption. Hence, the probability that this event happens is upper-bounded
	by $\epsdlog(\secpar)$.

\end{proof}

\subsection{Trapdoor-less simulatability of Marlin}
\begin{lemma}
  \label{lem:marlin_hvzk}
  $\marlinprot$ is 2-programmable trapdoor-less simulatable.
\end{lemma}
\begin{proof}
The simulator follows the protocol except it picks the challenges $\alpha,
\eta_A, \eta_B, \eta_C, \beta_1, \beta_2, \beta_3$ before it picks polynomials
it sends.

First, it picks $\p{\tilde{z}}_A (X)$, $\p{\tilde{z}}_B (X)$ at random and
$\p{\tilde{z}}_C (X)$ such that
$\p{\tilde{z}}_A (\beta_1) \p{\tilde{z}}_B (\beta_1) = \p{\tilde{z}}_C
(\beta_1)$.  Given the challenges and polynomials $\p{\tilde{z}}_A (X)$,
$\p{\tilde{z}}_B (X)$, $\p{\tilde{z}}_C (X)$ the simulator computes
$\sigma_1 \gets \sum_{\kappa \in \HHH} \p{s}(\kappa) + \p{r}(\alpha, X) (\sum_{M
  \in \smallset{A, B, C}}\eta_M \p{\tilde{z}}_M(X)) - \sum_{M \in \smallset{A,
    B, C}} \eta_M \p{r}_M (\alpha, X) \p{\tilde{z}} (X)$.

Then the simulator starts the protocol and follows it, except it programs the
random oracle that on partial transcripts it returns the challenges picked by
$\simulator$.
\end{proof}

\subsection{From forking special soundness and unique response property to\COMMENT{ forking}
  simulation extractability of $\marlinprotfs$}
\begin{corollary}
  Assume that $\marlinprot$ is $\ur{1}$ with security
  $\epsur(\secpar) = 6 \cdot (\epsbind + \epsop + \epsk)$, and forking special sound
  with security $\epsfor (\secpar)$. Let $\ro\colon \bin^* \to \bin^\secpar$ be a
  random oracle. Let $\advse$ be an adversary that can make up to $q$
  random oracle queries, up to $S$ simulation oracle queries, and outputs an
  acceptable proof for $\marlinprotfs$ with probability at least
  $\accProb$. Then $\marlinprotfs$ is \COMMENT{forking }simulation-extractable with
  extraction error $\eta = \epsur(\secpar)$. The extraction probability
  $\extProb$ is at least
\[
  \extProb \geq \frac{1}{q^{\dconst}} (\accProb - \epsur(\secpar))^{\dconst + 1}
  - \eps(\secpar).
	\]
	for some negligible $\eps(\secpar)$, $\dconst$ being, the upper bound of
  constrains of the system.
  \[
    \extProb \geq q^{-(\dconst - 1)} (\accProb - 6 \cdot (\epsbind + \epsop +
    \epsk))^{\dconst} -\eps(\secpar)\,.
\]
\end{corollary}

%\section{Further work}
%We identify a number of problems which we left as further work. First of all,
%the generalised version of the forking lemma presented in this paper can be
%generalised even further to include protocols where forking soundness holds for
%protocols where $\extt$ extracts a witness from a $(n_1, \ldots, n_\mu)$-tree of
%acceptable transcripts, where more than one $n_j > 1$. I.e.~to include
%protocols that for witness extraction require transcripts that branch at more
%than one point.
%
%Although we picked $\plonk$ and $\sonic$ as examples for our framework, it is
%not limited to SRS-based NIZKs. Thus, it would be interesting to apply it to
%known so-called transparent zkSNARKs like Bulletproofs \cite{SP:BBBPWM18},
%Aurora \cite{EC:BCRSVW19} or AuroraLight \cite{EPRINT:Gabizon19a}.
%
%Since the rewinding technique and the forking lemma used to show simulation
%extractability of $\plonkprotfs$ and $\sonicprotfs$ come with security loss,
%it would be interesting to show SE of these protocols directly in the
%algebraic group model.
%
%Although we focused here only on zkSNARKs, it is worth to
%investigating other protocols that may benefit from our framework, like
%e.g.~identification schemes.
%
%Last, but not least, this paper would benefit greatly if a more tight version
%of the generalised forking lemma was provided. However, we have to note here
%that some of the inequalities used in the proof are already tight, i.e.~for
%specific adversaries, some of the inequalities are already equalities.

%%% Local Variables:
%%% mode: latex
%%% TeX-master: "main"
%%% End:


\chapter{Related Work}
\label{cha:relatedwork}

The state of the art goes here...

\section{Blockchain}
This section describes the fundamental concepts of blockchain technology. First, cryptographic concepts such as hash functions and public-key cryptography will be explained. After this, an overview of different blockchain implementations as well as their properties is given.

\subsection{Definition}
The term blockchain still has no satisfying definition yet, but the ISO/TC 307 describes a blockchain as the following:
[Blockchain is] \textit{a shared, immutable ledger that can record transactions across different industries, [...]  It is a digital platform, that records and verifies transactions in a transparent and secure way, removing the need for middlemen and increasing trust through its highly transparent nature}.
\\
\\
In practice, this means that a blockchain is a distributed computer architecture where each computer is treated as a node of this network. Each node has knowledge of all transactions inside the network. Transactions are encrypted and bundled in a so called 'block'. Only one block at a time can be added to the network, because it has to be verified that it follows the previous blocks first. Nowadays, blockchain technologies have the following traits:
\begin{itemize}
\item \textbf{Distributed}: Each node is considered equal and has the full history of all transactions.
Because this ledger isn't stored in a central location, blockchains avoid situations like 'single point of failure', which can be inherent in client-server based system.
\item \textbf{Time-Stamped}: Each block contains a timestamp, along with a cryptographic hash of the previous block and transaction data. Consequently, with each new block it becomes harder to change past entries, because they are built on the information of past blocks.
\item \textbf{Consensus}: Once the block is recorded, a consensus algorithm ensures that the data in any given block cannot retroactively be altered without changing the data of all subsequent blocks. To achieve this, it would require at least 51 percent control of the whole network. This guarantees that a value can only be spent once~\cite{Blockchain}.
\end{itemize}

Due to these traits, blockchain technology makes a suitable fit for storing  medical records, identity management and financial transaction processing~\cite{Application}.

There are two types of blockchains: private and public. The best known public blockchain is the Bitcoin Network, in which everyone is allowed to read and write data to the ledger.
An advantage of such a blockchain type is, that no access control is needed and therefore applications can be built on top of it without the approval of others.
A private blockchain needs a participant to have the appropriate permission, in order to join the network. In contrast to the public blockchains, they do not rely on anonymous nodes to validate transactions, as the validators are vetted by the network owner~\cite{Private}.

\subsection{Cryptography}
Blockchain core processes are based on cryptographic algorithm such as symmetric and asymmetric encryption mechanism in order sign transactions and chain blocks.
Generally, the field of cryptography relates to mathematical techniques, which goal is to ensure information security. The most prevalent in todays distributed ledgers and cryptocurrencies include public key cryptography, cryptographic hash functions and digital signatures.

\textbf{Public key cryptography}

Asymmetric encryption or public- key cryptography has been developed by Helllmann and Merkle to ensure a secure exchange of messages through an unreliable and unsafe information canal. To achieve that, the message is signed by the public key and generates a digital signature, which is unique to the owner of that private key. By encrypting the message by the public key of its recipient, only the owner of the public key can encrypt this message through his private key. public and private key are uniquely linked and attached to each other, so that the public key can be shared with others while the private key is held privately to sign transactions and decrypt messages. This is made possible by hash functions.

\textbf{Hash functions}
Hash functions are mathematical functions to ensure data integrity and authenticity. They map a bit string of arbitrary size to a fixed size bit string and therefore making it easier to compute. The output of a hash function is called a hash value. It serves as a unique footprint of data or message.

\section{Decentralized Identity}

\subsection{Self-souvereign Identity}
/% Master thesis Martin Schaeffner
Identity management has always been a difficult topic in the online realm. While in centralized platforms, the platform operators have control over the data, the trend is going towards self-sovereign identity. It relies on decentralization, where no single central authority has control over the users data, but the users themselves. People, organizations and companies gain autonomy over their identity represented through so called decentralized identifiers, which enables its owner to share only the neccessary information needed by the third-party (minimal disclosure) or selectively (selective disclosure). Identities build trust through reputation. This reputation is gained by getting trusted claims from other trusted issuers. This concept also is called web of Trust.

Already existing concepts, formats, and technologies are being used together in order to create new standards for online identity management. Blockchain technology is being used as the decentralized safe public key infrastructure, in which cryptographic keys represent identities and are used to sign and authenticate messages. New standards, such as already mentioned Decentralized identifiers (DID) shall serve as the backbone of the entire SSI ecosystems. A DID, which represents a decentralized JSON Document and holds identity related attributes and is controlled by the owner of the identifier. This DID is linked to the public and private key pair and lets the owner sign transactions and messages. Claims and credentials can therefore be issued and authenticated by using that key pair.
Credential Holders can now present those verifiable claims to third-parties without disclosing unnecessary data. The Third party can decide themselves, wether to trust that claim or not, depending on their trust in the issuer.

\subsubsection{Decentralized Identifiers}
The DID specification was published by the W3C Credentials Community Group under the W3C Community Final Specifation Agreement.
It yet has to reach an official standard status, but offers great way to design systems and processes around it.
Decentralized Identifiers are globally unique, unchangeable and are generated by DLT, allowing full ownership of identity by its owner.
A DID can represent anything from a person, organization, to a machine or a digital document.
The following figure shows the syntax of a DID:

{figure }

The first part represents the Schema as a uniform ressource name. This part is followed by a namespace in the form of a uuid and the namespace-specific identifier.

Depending on the type of ledger, these DID will look differently. Uport e.g. uses this DID:

{figure }

As an analogy, this DID acts like an URL in order to request data. The DID itself just represents the identifier and is linked to its value. The value is the DID Document, which holds authentication keys, service endpoints and other data in order to support interaction with other identity owners.

The generation of DID Documents is called DID Resolution. Depending on the underlying blockchain or distributed ledger technology, this process unfolds differently for each.

\subsubsection{DID Method}
The DID method specifies how decentralized Identifier are created, updated, read and deleted within their underlying DLT. According to \textbf{source} , it has to specify the following points:

\begin{itemize}
    \item the DID method name
    \item the method-specific identifier structure
    \item the generation of a method- specific identifier
    \item the already mentioned CRUD operations on a DID and its respective DID document
\end{itemize}

The W3C keeps an updated list of officially registered DID Methods, which fulfill the requirements of a DID method specification.
Taking the uport project as an example, creating a did is as simply as generating a public private Key pair in accordance to the Ethereum Ledger. Since every address is a part of the public key and every key is unique, a DID has successfully been created.
Attributes are recorded on the blockchain as events and can be therefore queried.
As more and more blockchains are appearing on the market, and identifiers are bound to their underlying blockchain technology, DID methods offer the possibility to use the identifiers interoperable across different systems within the SSI ecosystem.

\subsubsection{DID Resolution}
In order to resolve the DID Document globally, the DID Document is being resolved through an implemented DID method. In fact, there are different ways to fetch the DID Document. Because DID attributes are recorded on the blockchain, the resolver is needed to dynamically create the DID Document. Attributes are just being attached to the decentralized identifier which in fact is the public key in the form of transaction data. The resolver now fetches those transactions and decodes neccessary information and assembles the DID document in accordance to the DID specification.

\subsection{Web of Trust}

Web of Trust is a Concept on how to assess trustworthiness of participants within a network, a system. It is one of two ways to assess trustworthiness in PKI systems. In contrast to having a central authority signing and therefore assigning trust to other nodes in web of Trust the nodes are verifying and signing trust themselves.
A trusted node has 2 properties. Validity and Trust. Validity refers that another trusted node has signed its public key. That means , that the public key really belongs to that real-world identity. Trust and Validity is on a ordinal scale with a range - full and marginal. If it is fully trusted, the node has the right to assess other nodes, or better it can validify other nodes. If it is only marginally trusted, it can only assign marginal validity. This makes sense since its ability to verify others isnt fully put faith into. The node with marginal validity need 3 other marginal trusted nodes in order to get full validity.

Especially with public key infrastructure where identities are represented through a computer key and disattached from real-world identity. Blockchain Technology enables for decentralized registry services and therefore allowing the owner of their keys full ownership over their identity.
How does it all connect?
Identity Management on blockchain based applications are using decentralized Identity already.
Because the blockchain by itself uses a decentralized key infrastructure.

\section{Decentralized Marketplaces}
The goal of this section is to present academic literature that relates to the development of decentralized services marketplaces.

Klems et al. offer a promising design of a blockchain-enabled IT service marketplace using smart contracts to enable trustless intermediation between service providers and service consumers. In their implemented prototype, the tasks of centralized service providers such as registry services, transaction settlement and service delivery are realized with different smart contracts.
A service registry contract holds all registered services and their respective owners and service description documents, allowing the service consumer to browse through available services. Transaction settlement is realized through a service contract, which is deployed for each service containing relevant business logic for different payment models and refunds of the service.
Additionally, the contract contains logic providing different options for dispute prevention and Resolution in case of service unavailability. Using an escrow mechanism requires the service provider to leave a deposit before offering a service, making sure that users will be compensated by a share of that deposit in case of multiple negative user reports.
Another approach describes the monitoring of quality service by logging the results to a separate monitoring contract, which notifies the service contract in case of violations, thus triggering the implemented refund mechanism.
Since data storage on Ethereum is quite expensive, Klems et. al. used IPFS for storing service meta data.

This thesis differs from the publication, as the research aims to improve trust mechanisms by the application of the new Trust Identity Standard W3C and examining its usefulness/ applicability in the context of such a decentralized marketplace.

Another decentralized marketplace called OpenBazaar is already running successfully with a continuously growing user base, ensuring the stability of the network.
In the OpenBazaar network, an actor can take on one of these three roles:  merchant,buyer or arbiter. In contrast to the usage of smart contracts like Klems et al. , OpenBazaar uses the concept of Ricardian contracts to carry out the trade.
Ricardian contracts represent contracts, which are both human - and machine-readable but are not fully automatized like smart contracts. They specify information about the merchants selling object and are then signed by the merchant's ECDSA key to verify its authenticity.

In order to prevent sybil attacks, which is a fundamental problem reputation systems are tackling with, Open Bazaar proposes
the implementation of costs of identity.
In order to leave a review, an identity must be created first. This creation come with a cost through proof of work.
But the proof of work is done after 30 seconds, so in order to leave a review , the action has to be bought either through the following methods:
\begin{itemize}
    \item \textbf {Proof of Burn}
    Bitcoin transaction is being transmitted to an address, where the private key is unknown. The amount becomes unspendable.
    \item \textbf {Security Deposit}
    A trusted third - party, validated by the community, acts as an escrow. They buyer deposits his funds there, and when it becomes clear, that the product is a fraud with fake reviews, the fund gets back to the buyers pockets.

\end{itemize}

While not being able to prevent Sybil attacks to 100 percent, an attack will have to be economically analyzed by an malicious attacker.
If the costs are higher than the value he gets out by selling them, he might not even attempt a sybil attack.

However, in order to increase the quality of reputation , additional methods are being presented with varying Reliability.

\textbf{Low Trust Level}
All Transaction summaries are being considered including those, which has no GUID of the buyer but only a Bitcoin address attached to them. Basically, there is no cost of identity, and a vendor could just have multiple wallets leaving fake reviews.

\textbf{Middle Trust Level}
Only Transaction summaries with disclosed GUIDs are being considered. That means only buyers with their GUID and their known Bitcoin addresses will be considered. Coin analysis can be performed, through Bitcoins transaction graph.
The vendor could send the fake identity money, and this money could be used in an endless cycle to create n-times fake reviews.
By analyzing the transaction graph this would be become visible.

\textbf{High trust Level}
Suppose I want to buy a product from vendor B.
This vendor has a history of transaction summaries.
Now for calculation of Reputation Score, only those will be considered, which had been transmitted by Users, who are with my network of trusted nodes. (Friends of my Friends of my direct Friends.) This is a partial topological web of my trusted identities.
All reviews from people who are outside my web, will not be taken into account.
Limitation: If I have a small web, I will not have enough score to assess the product.


\subsubsection{Neuro-Symbolic Integration approaches} \label{nsi_approaches}
The first boundary between NSI approaches can be drawn with respect to the field for which they are designed. We can identify two main areas where these approaches are applied: machine learning and symbolic reasoning. In the first case, the integration aims to regulate the learning process with the use of logical knowledge. The goal of this family of approaches is to exploit the computational efficiency of DNNs and the expressiveness of logic to improve neural model capabilities in classical machine learning tasks, ranging from classification (e.g., binary, multiclass, multilabel, collective) to embedding learning, also covering relational learning tasks. On the other hand, we can find NSI approaches that are designed to solve problems from the symbolic field. In this second family of approaches, a DNN is trained to learn and perform symbolic reasoning over knowledge. The target of these works is more about Inductive Logic Programming (ILP) tasks and related.

Another possible distinction between NSI works concerns the adopted logical language. Looking at the approaches proposed in the literature, we can notice that there is not a standard way to represent logical knowledge. In most cases, a set of FOL rules is used to set constraints on data. However, a lot of approaches relying on this kind of rules apply some restrictions to the language, thus limiting its expressiveness. Such restrictions may involve the arity of predicates, functions, and logical operators. Other limitations may be imposed on the form that must be used to express logical rules (e.g., Horn clauses). Furthermore, additional assumptions can involve the usage of variable quantifiers (e.g., universal assumption). Most of these restrictions do not affect the approaches based on propositional logic. However, propositional logic is less expressive and flexible than FOL by definition.

Even the semantics of the logical language can differ a lot from one approach to another. If the goal is to have an end-to-end fully differentiable architecture, then it will be necessary to move away from finite-valued logic. The motivation behind this need derives from the nature of neural networks, which deal with continuous real values. For this reason, the most frequent solution is to relax the logic by adopting fuzzy/probabilistic semantics. In this way, it is possible to evaluate logical formulas grounded with values coming from a neural network. The main benefit that derives from the use of infinite-valued logic is that it allows to efficiently train a Neuro-Symbolic model using back-propagation algorithms. As discussed in section \ref{fuzzy_logic}, there are many possible choices between fuzzy operators. Each of them behaves in different ways when used in a differentiable learning setting. In~\cite{analyzingDiffFuzzyLogic} several experiments were performed to show the weakness and strengths of different fuzzy operators.

After this NSI overview about logical language and semantics, we can go deeper and categorize the state-of-the-art works. As proposed in~\cite{ltn}, a reasonable way to group the novel approaches is to consider the methodology adopted to inject logical knowledge into the learning process. In Figure~\ref{fig:sota} we can see three main groups. Each of them is based on different architectures.
\begin{figure}
    \centerline{\includegraphics[scale=.58]{sota.png}}
    \caption{Categorization proposed in~\cite{ltn} to group Neuro-Symbolic approaches based on the knowledge injection methodology}
    \label{fig:sota}
\end{figure}
\\\\
\textit{\textbf{Neural architectures for logical reasoning:}}~\cite{tensorlog,cohen2020scalable,conditionalTheoremProvers,campero2018logical,neuralMarkovLogicNetworks,probabilisticLogicNeuralNetworks,recursiveReasoningNetworks,deepProlog,satnet,nlrl}. These approaches use neural networks to perform probabilistic inference on logical theories by learning reasoning strategies. This category focuses mainly on ILP (e.g., theory learning, theory compression, logical rule induction) and structured data-related tasks (e.g., knowledge graph completion, knowledge graph reasoning, triple classification). The proposed methodologies reach their goals in various ways.

Starting from~\cite{probabilisticLogicNeuralNetworks}, we find Probabilistic Logic Neural Networks. The proposed models are defined to perform knowledge graph reasoning. A Markov Logic Network~\cite{markovLogicNetworks} is used to compute the joint distribution of all triplets, then a model is trained with a variational expectation-maximization algorithm. Another approach based on Markov Logic Networks is~\cite{neuralMarkovLogicNetworks}, in which a statistical relational learning system is proposed to learn the implicit representation of FOL rules through neural networks.

Going on, we find~\cite{recursiveReasoningNetworks},~\cite{campero2018logical} and~\cite{tensorlog}. All of them introduce some FOL language restrictions, supporting only unary and binary predicates. In~\cite{recursiveReasoningNetworks}, Hohenecker and Łukasiewicz introduce Recursive Reasoning Networks. In this approach, each training example is a KB composed of different facts. Models are trained on these KBs using a shared ontology, then generate embeddings of individuals. Moving on to~\cite{campero2018logical}, Campero et al. propose a task-dependent loss function. Their methodology relies on forward chaining and soft unification to perform inference. Then there is TensorLog~\cite{tensorlog}, where a subset of FOL called \textit{ptree-SDKGs} is provided to represent knowledge in a highly scalable framework for tuning parameters of probabilistic logic.

To conclude with the last three approaches of this family, we find the methodology proposed by Cohen et al.~\cite{cohen2020scalable}, Conditional Theorem Provers (CPT)~\cite{conditionalTheoremProvers}, and SATNet~\cite{satnet}. Cohen et al. propose \textit{sparse-matrix reified KBs} to represent subjects, objects, and relations of a KB. Through these three sparse matrices, they provide an effective and scalable way to represent symbolical knowledge in neural contexts. Moving on to CPT, Minervini et al. propose a method to boost the efficiency of a model in a particular way: during the proving mechanism, the learning process aims to dynamically select only a minimal subset of rules depending on the current goal. At last, we have SATNet by Wang et al.. In this approach, a MaxSAT solver layer is used to make DNNs able to learn logical structures without explicitly specifying any logical rules. Both CPT and SATNet adopt a logical language that is function-free.
\\\\
\textit{\textbf{Logical specification of neural network architectures:}}~\cite{liftedRelationaNeuralNetworks,logicalNeuralNetworks}. In these novel approaches, a logical language is used to specify the architecture of neural networks. This peculiarity leads to better interpretability of DNNs.

In~\cite{liftedRelationaNeuralNetworks}, Sourek et al. propose Lifted Relational Neural Networks. These neural models are composed of multiple feed-forward networks (one per example) with shared weights, where each node represents a weighted clause. The methodology proposed in Logical Neural Networks~\cite{logicalNeuralNetworks} is quite different. In this case, a neural network is modeled as a graph representing the syntax tree of logical formulas. The knowledge is expressed through a function-free FOL language with \textit{weighted nonlinear logic} semantics.

In both approaches, clause weights are learnable parameters. This feature makes the model able to give greater importance to the more relevant rules at prediction time.
\\\\
\textit{\textbf{Neuro-symbolic architectures for the integration of inductive learning and deductive reasoning:}} The goal of this group of approaches is to integrate neural and logical components into a unique (possibly fully differentiable) framework. In this way, the processes of learning and reasoning of the two components influence each other to enhance the quality of predictions. Unlike the previous categories, these works are more oriented to exploit logical knowledge in classical machine learning tasks. This family of architectures can be further divided into three subclasses:
\begin{itemize}
    \item \textbf{\textit{Logical knowledge to modify neural networks predictions:}}~\cite{liSrikumar,rnm,dlm,kenn}. These works rely on additional components (e.g., neurons, layers, modules) responsible for handling the logical knowledge.

    Li and Srikumar~\cite{liSrikumar} propose a framework to introduce constraints as logical statements without adding any extra learnable parameters. The base neural model is augmented with \textit{named neurons} corresponding to the predicates of the logical clauses. The post-activation value of a named neuron can be seen as the truth value of the mapped predicate. About the language, rules must be expressed as logical implications with some restrictions: the antecedent is a conjunction/disjunction of literals and the consequent is a single literal.

    The second approach of this family is the one proposed by Daniele and Serafini with Knowledge Enhanced Neural Networks (KENN)~\cite{kenn}. The logical knowledge is injected through an additional layer called \textit{Knowledge Enhancer}. The initial predictions of the base neural network are modified through this layer to increase the satisfaction of each clause by applying a boost function. The logical language is a restricted function-free FOL: operators are limited to disjunction and negation, predicates must be at most binary, and variables are universally quantified.

    Proceeding with the last two approaches, we have Deep Logic Models (DLM)~\cite{dlm} and Relational Neural Machines (RNM)~\cite{rnm} that are quite similar in the way they work. In both cases, the process to compute the output is performed in two phases: a low-level stage to process the input and a semantic stage to perform high-level reasoning. The base neural network is supported by an undirected graphical model that represents the probability distribution. The two components are combined as follows: given the output of the neural network and the set of logical rules, a maximum a posteriori estimate (MAP) is performed to find the most probable assignment to the grounding atoms. The authors of RNM point out that their approach overcomes some limitations of DLM in terms of scalability and applicability. Furthermore, they promise a tighter connection between the trainer and the reasoner.

    \item \textbf{\textit{Loss function based:}}~\cite{lyrics,marra2019t,dl2,ltn,sbr,semanticLoss,harnessingDeepNeuralNetworks}. The idea behind these methodologies is to inject logical knowledge into the learning process through the loss function. The common strategy consists in translating logical rules into a regularization term to influence the training process: if the logical constraints are not satisfied during the optimization, then the regularization term will increase the loss.

    Starting from~\cite{semanticLoss}, Xu et al. propose a \textit{semantic loss function} to maximize the probability that the provided logical knowledge is true. In this approach, logical formulas are expressed with propositional logic. Going on we find Semantic-Based Regularization (SBR)~\cite{sbr} by Diligenti et al., where the authors propose a multilayer architecture: a kernel machine is used as the base model and a neural network is used to approximate fuzzy predicate logic

    Another approach we have to mention Logic Tensor Networks (LTN) by Badreddine et al.~\cite{ltn}. LTN can be used in a wide range of machine learning applications. The authors propose the language of \textit{Real Logic} to express FOL formulas. Predicates are represented as multiple neural networks and the final predictions are obtained by aggregation. LTN also includes in its features guarded quantifiers, explicit domain declarations, and different reasoning modalities. Moreover, it can be used as a generative model thanks to its ability to learn logical functions.

    Another interesting approach is proposed by Marra et al. with LYRICS~\cite{lyrics}. Inspired by SBR and LTN, it defines a declarative language that is suitable for exploiting logical knowledge in any machine learning context. The same authors extended this work in~\cite{marra2019t} by introducing a novel class of loss functions. These functions are specified through a \textit{t-norm generator} that leads to faster convergence. The difference can be found in the way the satisfaction of the knowledge is computed: instead of computing the truth degree of each subformula, connectives and quantifiers are used to combine the loss values in a less costly way.

    Hu et al. propose in~\cite{harnessingDeepNeuralNetworks} a different methodology to influence the optimization procedure. A distillation strategy is used to train the model: while the teacher network is trained in a semi-supervised setup to learn from unlabeled examples, the student network is trained to emulate the teacher and, at the same time, to predict some labeled examples.

    The latest approach of this category is proposed by Fischer et al. with DL2~\cite{dl2}. The model optimization is performed through an optimizer-adversary game: while the optimizer is trained to meet the constraints, the adversary is trained to find counterexamples that contradict the knowledge. Regarding the language, the knowledge is expressed through numerical comparisons linked by logical operators. This particular way of defining the knowledge makes this approach suitable to capture constraints in regression tasks.

    \item \textbf{\textit{Logical knowledge applied to neural networks predictions:}}~\cite{abl,deepproblog,li2020closed}. These approaches are used to compute logical inference starting from the output of a base neural network. The final output corresponds to the consequences implied by the neural predictions.

    In ABL~\cite{abl} by Dai et al., the output of a base neural network is extended using abductive reasoning. The goal is to maximize the consistency between predictions and background knowledge. Given the background knowledge, the consistency optimization process is performed to revise the pseudo-labels produced by the network taking into account the hypotheses obtained through logical abduction.

    Li et al.~\cite{li2020closed} provide an alternative architecture to process and update neural network predictions. A grammar model is introduced to bridge the neural model and the symbolic reasoning module. Errors are propagated through a back-search algorithm to find the most probable corrections that will be used as pseudo-labels.

    The last approach we find is DeepProbLog~\cite{deepproblog}, proposed by Manhaeve et al. as an extension of ProbLog. The goal of this work is to adapt ProbLog to deal with the output of a neural network. In this way, the predicates assume a neural interpretation. The logical knowledge is expressed through a function-free language in the form of a Prolog program, i.e., a set of Horn clauses.
\end{itemize}

\paragraph{Approaches of interest}
After this broad overview of possible NSI approaches, we can focus on those best suited to Fine-grained Entity Typing. In section~\ref{entity_typing}, FET has been described as a multilabel multiclass problem where hierarchical dependencies occur between types. Given this premise, the approaches that explicitly support multilabel classification are LTN~\cite{ltn}, SBR~\cite{sbr}, LYRICS~\cite{lyrics}, KENN~\cite{kenn} and RNM~\cite{rnm}. During the categorization, we saw that LTN, LYRICS, and SBR, belong to the group of methods based on the loss function. On the contrary, KENN and RNM both have a post-elaboration step to modify the final predictions. A detailed comparison between loss-based approaches, KENN and RNM can be found in~\cite{daniele2021neural}. The more relevant differences will be highlighted below.

KENN is the most recent of the five approaches identified. As stated by its authors, the strategy used by KENN affects the Hypothesis Space (HS) differently from loss-based approaches: while the action of constraining the loss function can be seen as ``removing" solutions from the HS, the action of KENN will result in the opposite. In other words, LTN, LYRICS, and SBR will produce models where the solutions penalized at training time can no longer be obtained at inference time. On the other hand, the additional layer introduced by KENN keeps influencing the model at inference time by adding new solutions to the HS. Moving on to RNM, we can find a relevant difference with respect to KENN in the optimization of the clause. The methodology applied by RNM considers the entire logical knowledge, while KENN optimizes each clause separately. As we will see when presenting KENN in section~\ref{KENN}, the independent optimization of the logical clauses may produce the side effect of not fully exploiting the knowledge during the training process.

All these works adopt a language that allows expressing FOL formulas. KENN is the only one having restrictions on the usage of connectives, quantifiers, predicates, and functions. However, these limitations still allow expressing the hierarchical relations of interest for FET. About the evaluation of a logical clause, each approach computes the truth degree of a formula using fuzzy operators. This feature makes it possible to build an end-to-end fully differentiable architecture except for RNM, which needs to solve an optimization problem at inference time.

An important feature to consider about an NSI system is the ability to learn clause weights. While KENN and RNM let you set clause weights as learnable parameters, LYRICS and SBR only support fixed weights. In LTN it is not possible to specify weights, but the authors suggest adding them indirectly to a clause by the conjunction of a 0-ary predicate. The feature of learning clause weights may be really helpful when dealing with multilabel classification problems because label dependencies are often unknown. In these cases, we can use a set of automatically generated rules and delegate to the network the choice of optimal weights. The learning process will decrease the weights of the clauses that are inconsistent with the data until they become irrelevant and, at the same time, it will increase the weights of the consistent ones.

The summary of the differences between the analyzed approaches can be found in Table~\ref{tab:sota_comparison}.

\begin{table}[H]
\centering
% \small
\caption{Comparison of KENN, RNM, LYRICS, LTN and SBR main characteristics}
\label{tab:sota_comparison}
\resizebox{\columnwidth}{!}{\begin{tabular}{c|c|c|c|c|c|}
\cline{2-6}
                                                          & \textbf{KENN}                                                                                & \textbf{RNM} & \textbf{LYRICS} & \textbf{LTN} & \textbf{SBR} \\ \hline
\multicolumn{1}{|c|}{\textbf{Knowledge}}                  & FOL                                                                                & FOL          & FOL             & FOL          & FOL          \\ \hline
\multicolumn{1}{|c|}{\textbf{Semantics}}                   & fuzzy                                                                                & fuzzy        & fuzzy           & fuzzy        & fuzzy        \\ \hline
\multicolumn{1}{|c|}{\textbf{Restrictions / Assumptions}} & \begin{tabular}[c]{@{}c@{}}- only disjunction\\ and negation\\ - no parenthesis\\ - universal assumption\end{tabular} & none         & none            & none         & none         \\ \hline
\multicolumn{1}{|c|}{\textbf{Predicates}}                 & unary and binary                                                                                & n-ary        & n-ary           & n-ary        & n-ary        \\ \hline
\multicolumn{1}{|c|}{\textbf{Functions}}                  & no                                                                                & yes          & yes             & yes          & yes          \\ \hline
\multicolumn{1}{|c|}{\textbf{Clause weights}}             & learnable                                                                                & learnable    & fixed           & none           & fixed        \\ \hline
\end{tabular}}
\end{table}

About the effectiveness of these works, in~\cite{rnm} we can find an experimental evaluation of collective classification to compare RNM and SBR. The results show that RNM achieved better performance than SBR on Citeseer~\cite{citeseer} dataset. The same experiment is reported in~\cite{daniele2021neural} using KENN. In this case, the results show that KENN is less performing than RNM when dealing with small training sets. However, it becomes more effective when the percentage of training data increases. Another evaluation of KENN involves the datasets Yeast~\cite{yeast}, Emotions~\cite{emotions} and VRD~\cite{vrd}. On these multilabel classification datasets, KENN reached better results than LTN and other state-of-the-art solutions in almost every setup~\cite{kenn}.

Another important factor to take into account is scalability. In terms of computation, the way KENN injects the knowledge is quite simple and inexpensive with respect to the approaches that are based on the loss function. If we consider LTN as an example, expensive operations are performed at training time to compute the truth degree of a grounded formula. RNM has scalability issues too, but in this case the bottleneck can be found in the optimization problem to solve at inference time.
\\\\
To sum up, KENN has more restrictions and limitations in the language. Anyhow, its expressivity suffices to represent the logical rules of interest. The advantages coming from learnable clause weights, scalability, and effectiveness, had a heavier impact on the choice of this NSI framework. Moreover, KENN is simple to integrate and analyze, thus allowing to easily study the effect of the logical knowledge injected by each clause.


\subsection{Torus}


\chapter*{Abstract}
This thesis examines Image Aesthetic Quality Assessment(IAQA) as a computer vision problem. We compare deep Convolutional Neural Networks (CNNs) with Vision Transformers (ViTs) and Convolutional Vision Transformers (ConViTs), and examine which models best predict 'image quality' as a binary classification problem.

While CNNS have superseded hand-crafted approaches to feature extraction, achieving this has required hand-crafting attention mechanisms as high level training policies on very complex CNN architectures - which are, themselves, time consuming and inefficient to train. We therefore produce a side-by-side comparison to assess whether self-attention can perform well as an IAQA classifier.

We perform training on the AVA Bench-marking dataset and show that in many cases both ViTs and ConVits outperform CNNs in side-by-side comparisons. Further, while ViTs and ConVits both require lengthy pre-training on very large datasets, they are excellent candidates for domain adaptation - often with pre-trained models performing well when architectural adjustments are made to output layers.

Surprisingly, this requires fewer training epochs than pre-trained CNN models to adapt to new domains. Further, while CNNs quickly overfit on the AVA Training subset, this is not the case with transformers. We also show that the conditions that suit each type of network differ, however, ConVits do not appear to require as many 'warm-up' epochs when being trained using transfer learning as they do in when being initially trained.

We show that while models will train on the AVA benchmarking dataset without pre-training, that using non pre-trained models does not achieve high training accuracy.
%

Total Words:
15046
Headers:
83
Math Inline:
126
Math Display:
17
\vfill
\begin{flushright}
\begin{longtable}
    \centering
    \begin{tabular}{c|c}
    Total Words & 15046 \\
    Headers & 83 \\
    Inline Equations & 126\\
    Equations & 17\\
    \end{tabular}
    \caption{Caption}
    \label{tab:my_label}
\end{longtable}
\end{flushright}


\documentclass{article}
\begin{document}

\section{Section One}
\label{sec:section_1}

This is the first equation:
\begin{equation}
1 + 1 = 2.
\label{eq:1}
\end{equation}

This is the second equation:
\begin{equation}
1 \times 1 = 1.
\label{eq:2}
\end{equation}

\end{document}


%========================================================================
%Beginning of Introduction
%========================================================================

\section{INTRODUCTION}\label{ch:intro}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\subsection{Introduction}\label{sec:chp1intro}

There are many issues to be addressed within any modeling and simulation environment.  Each of these areas must be carefully studied in order to make good decisions that will ensure the simulation is correct within the established error margin.  Within glacial modeling these issues must be considered on a grand scale with huge landmasses, a global climate, and massive oceans. These large scale problems mean that making an incorrect modeling decision at that smallest level could make the entire simulation far from the expected results.

Due to the complex nature of the equations that govern not only the ice-sheets, but the other large scale related climate factors, the tools necessary to simulate and understand the interactions and physical properties of these systems are extremely complicated and difficult to create.  The need to have sophisticated software tools means that a lot of time must be spent implementing them, approximations and shortcuts must be taken, or existing tools must be integrated together.  All of these methods are used to some degree within ice-sheet modeling, but moving forward it is important to choose the correct one for each task.

Approximations and shortcuts work for certain situations, but can also lead to erroneous results if not managed careful, and even when done correctly, usually some workarounds and fixes must be put in place to correct artifacts that appear.  This is evident within certain ice-sheet models due to the way in which the glaciers are represented and how data is stored:  finite difference grids. Using a set spaced grid is a generally accepted practice because of the many benefits that ease in generation, computation, and traceability.  These benefits, however, are also accompanied by a host of problems that must be addressed by the model.  These issues are exacerbated by the sheer scale and complexity of the problem domain.
%quote pattyn grounding line(other finite element papers)(quadrature?)

Roundoff errors and approximations are inherent in the nature of finite difference grids over large areas.  Thus the idea is to alleviate some of these errors by mapping to a finite element grid, solving the fields in question, and then bringing the interpolated data back onto the discrete grid to be viewed at each time-step.  This allows the model to gain some of the benefits in solving PDEs with finite element analysis while still keeping the majority of the finite difference benefits.

Another reason for using a separate finite element PDE solver is the complexity of the equations to be solved for the glacier.  Currently, either the shallow ice approximation (SIA) or a 1st order model must be used in order to handle calculations of this magnitude.  Processing power and computational time can be very large even when using the simplest approximations when simulating an ice mass as large as Antarctica.  The equations are also computationally demanding when doing anything more than the SIA-such as a first order model.  The number of extra libraries and general complexity of the equations make the code difficult to follow, prone to errors, and cumbersome.  Being able to use one external library whose functionality can be modularized for specific calculations is very appealing and would allow for the model to be more cohesive, easier to follow, and extensible.

Integrating existing libraries to increase functionality may be the best option for a few reasons: the functionality can be used or improved without having to reimplement everything saving a lot of time and effort, the workload is spread out between the developer of each tool so that each of them can be improved independently of the other, and there is increased standardization with datatypes, input, and output.  There is also the possibility that an available tool has more features and options than might be developed when focused on ice-sheets.

By integrating PHAML into GLIMMER-CISM all the benefits mentioned have been gained.  PHAML is an hp-adaptive FEM PDE solver that is very feature rich and extendible with a number of options that make it useful for nearly any situation.  PHAML also allows solving in parallel across many machines and processors to alleviate some of the time taken for simulations by distributing the problem into many small ones.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\subsection{Motivation}\label{sec:chp1motivation}

Awareness of the impact glaciers have on the global climate has increased dramatically over the last couple of decades, and the need to understand the possible impact and repercussions increased human activity may be having on the glaciers is of the utmost importance.  Glacial modeling is therefore extremely important in order to understanding these things.

The IPCC (Intergovernmental Panel on Climate Change) excluded glacial contributions from the sea rise predictions within the 2007 report due to the perceived inability of current glacial models to correctly model the ice-sheet dynamics within the time frame of the forecast.  The estimates in the report for sea-level rise are between .18 and .59 meters by the year 2100. \citep{IPCC2007}

Different model simulations put sea level rise anywhere between .09 and 2 meters with a most plausible rise of 0.8 meters within this century.\citep{Pfeffer:2008}  Given that about 634 million people live within 9.1 m of sea level, even small changes can have a dramatic impact.  In fact, even a small change of .2 meters would displace between 7-10 million people in the Bay of Bengal alone.  \citep{McGranahan:2007}  It is therefore dire that we not only have an idea of what will happen, but that we also know with enough accuracy in order to prepare for the consequences of those changes.

Glacial simulations and their outcomes have been noted extensively in literature and there seems to be little consensus on exactly what will happen, when, or why.  The point is that glaciers are changing and it is necessary that we have answers to these questions.  The reason for the disagreements are largely due to what has already been addressed: different modeling assumptions.  The focus should be on what a model has assumed, why those assumptions were made, and what the direct consequences are of the assumptions before the results of a simulation are considered.

The accuracy of a glacial model is always a point of contention and something that demands constant verification.  The complexity of the physics and the inability to capture the infinite number of climate forcers mean that there may never be a `correct' model that is able to give very detailed results year by year.  However, it is possible to make an accurate ice-sheet simulation for a long period of time.  The hope is that the threshold for accuracy can be brought down to between 50-100 year intervals rather than simply thousand year intervals.

%Having new powerful tools aid in this goal.
%Finding new ways to make problems easier

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\subsection{Goals}\label{sec:chp1goal}

There are several goals from the work presented within this thesis.  Some of these goals can be obtained now and some are obtainable in future research that uses the infrastructure presented here.  By integrating PHAML as a library the goal is that many of the features PHAML has will be advantageous to ice-sheet modeling.  This includes a method by which finite difference issues within glacial modeling can be reduced by using finite element methods at each time step, increase the flexibility of the model by introducing more parallel methods for distributed computation, increase the accuracy of the solutions without as much cumbersome code, and to provide a new mechanism within the ice-sheet model to solve certain fields.

This will allow for larger grids to be used because the FEM mesh will recursively increase the resolution of the boundary areas without increasing the resolution of the larger portions of the glacier.  Hopefully, this new library model will allow progress in certain areas to be made faster and easier.

The majority of this work focuses on the intermediate code making it possible to use PHAML from GLIMMER-CISM.  The goal is for the interface to be straightforward, isolated, and to provide utility functions making the library easier to use.  The interface should also conform to the same conventions other libraries in GLIMMER-CISM use so that the library is easy to use and set up quickly.

PHAML is a very versatile and customizable tool, and it is important that the same functionality be available from within the GLIMMER-CISM modules.  The PHAML solution should be held by GLIMMER-CISM, but all calls to PHAML should be explicit within each module, allowing the needs of a particular solution to be tweaked based on the simulation run.  This flexibility comes with complexity in using the PHAML libraries directly, but also simplicity in understanding the design.

%Overall
%easy to create modules, call modules, compile, call functions, use utility functions, change phaml settings, change pde types, debug

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\subsection{Benefits}\label{sec:chp1benefits}

There are many benefits of the method presented here in relation to ice-sheet modeling.  PHAML is a very powerful and sophisticated piece of software that goes well beyond that of just a PDE solver for general use.  A few of its features that GLIMMER-CISM will be able to take advantage of are an excellent hp-adaptive finite element PDE solver, finite element grids, parallel processing of the solution, an excellent OpenGL based graphics suite for viewing the solutions, and an independent code base.%i.e. phaml is independent

Many new ideas can come to fruition within the ice-sheet model with the library used in this way.  Because of the versatility and depth of PHAML a more accurate system can be developed and tested with a lot less effort.  The code is also much less cumbersome since the more complicated code lies within the library itself and not within the ice-sheet model.

The isolation of the callbacks into the individual modules creates the ability to prototype and build many different systems using the same powerful tools with very little effort.  All of the support functions aid in making calls to PHAML easy by taking care of any data formatting necessary to receive the desired data from the solution.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\subsection{Thesis Organization}\label{sec:chp1organization}

The rest of this thesis is organized as follows:

\begin{itemize}

%background
\item \textbf{Chapter \ref{ch:overview}} gives an overview of the ice sheet model, the PDE library, the mesh generator, and the changes made to them.

%work done
\item \textbf{Chapter \ref{ch:modelinput}} deals with the ice sheet model input, the data structures used to build the mesh, and the mapping techniques involved between the two.

\item \textbf{Chapter \ref{ch:softintegration}} presents the format of the new modules and how they are integrated together.

\item \textbf{Chapter \ref{ch:verification}} discusses verification of the software components and the mapping between them.

%conclusions/future work
\item \textbf{Chapter \ref{ch:conclusion}} presents the conclusions from this work and suggests future research directions.

\item \textbf{Appendix \ref{ch:setup}} demonstrates how all the software components are set up and compiled together.

\item \textbf{Appendix \ref{ch:usage}} gives examples of how the PHAML modules are used from within GLIMMER-CISM.

\item \textbf{Appendix \ref{ch:addingmods}} shows how new PHAML modules and drivers can be created and added to the build system.

\item \textbf{Appendix \ref{ch:phamlvars}} lists the variables within the `phaml' custom type in GLIMMER-CISM.

\item \textbf{Appendix \ref{ch:libphamlfunc}} provides a brief explanation of the functions in the different modules.
\end{itemize}

%========================================================================
%End of Introduction
%========================================================================


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%                                                                 %
%  GEANT manual in LaTeX form                                     %
%                                                                 %
%  Michel Goossens (for translation into LaTeX)                   %
%  Version 1.00                                                   %
%  Last Mod. Jan 24 1991  1300   MG + IB                          %
%                                                                 %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\Origin{I.Gavrilenko}
\Documentation{K.Lassila-Perini, I.Gavrilenko}
\Submitted{17.11.93} \Revised{16.12.93}
\Version{Geant 3.16}\Routid{PHYS360}
\Makehead{Synchrotron radiation}
\section{Subroutines}

\Shubr{GSYNC}{}
\Rind{GSYNC} is called for electron and positrons
when the flag {\tt ISYNC} is set $>$ 0. It
computes the magnetic field and calls
\Rind{GSYNGE} for the generation of the synchrotron radiation
photons. It reads them in the {\tt GEANT} stack.
\Rind{GSYNC} is called from \Rind{GTELEC}.

\Shubr{GSYNGE}{(GAMMA,AMASS,FLDT,STEP,NTR,ETR,STR)}
\Rind{GSYNGE} generates the synchrotron radiation
for an e$^-$ or e$^+$ with the Lorentz factor {\tt GAMMA}
in the magnetic field {\tt FLDT} and when the step
length is {\tt STEP}. The number of the secondary
photons is {\tt NTR}, their energy is in the array {\tt ETR} and
their position along the step is in {\tt STR}.
\Rind{GSYNGE} is called by \Rind{GSYNC}.

\section{Method}
A charged particle in a magnetic field emits radiation.
The number of photons emitted in a second is
\begin{equation}
\frac{d^2 \! N}{d\varepsilon \, dt} = \frac{15 \sqrt{3}}{8} \frac{P}{\varepsilon_c}
\end{equation}

where $\varepsilon_c$ is the critical photon energy
(the median of the energy spectrum) and $P$ the
total radiated power:

\begin{eqnarray}
\varepsilon_c & = & \frac{3}{2} \hbar c \frac{\gamma^3}{\rho} \\
P             & = & \frac{2}{3} \frac{ e^2 c}{\rho^2}\beta^4 \gamma^4
\end{eqnarray}
$\gamma$ is the e$^-$/e$^+$ Lorentz factor $E_{tot}/m_e$ and
$\beta = 1 - 1/\gamma^2$. $\rho$ is the
curvature caused by the magnetic field.
For more detailed derivation of these equations,
see \cite{bib-MAIE}.
The velocity of the particle being $\beta c$, the number of
photons per meter is
\begin{eqnarray}
\frac{d^2 \! N}{d\varepsilon \, dx}  & = &
         \frac{d^2 \! N}{d\varepsilon \, dt} \, \frac{1}{\beta c} \nonumber \\
  & = & \frac{5 \sqrt{3}}{6} \frac{e^2}{\hbar c}
        \beta^3 \gamma \frac{1}{\rho} \nonumber \\
  & = & \frac{5}{2 \sqrt{3}} \, \alpha \, \frac{\gamma}{\rho}
        \; \approx  \; 0.01053 \, \frac{\gamma}{\rho}
\end{eqnarray}
The fine structure constant $\alpha = e^2/(\hbar c)$ and it is
assumed that $\beta^3 \approx 1$.

The curvature in a magnetic field $B$ which has a component
$B_{\perp}$ transversal to the particle velocity can
be computed \cite{bib-PDGB}
\begin{equation}
\rho = \frac{p} {0.3 B_{\perp}}
\end{equation}
where $p$ is the momentum of the particle in GeV. $B$ is in tesla
and $\rho$ is in meters.

Knowing the step length, the energy of the electron
and the curvature of the particle track in the magnetic field,
the number of photons in a step $\delta x$ can be sampled from
a Poissonian distribution around the mean value
\begin{equation}
\overline{n_{\delta x}} = 0.01053 \, \frac{\gamma}{\rho} \delta x
\end{equation}

Now, the energies of $n_{\delta x}$ photons have to be determined.
The energy distribution in a step follows the distribution  \cite{bib-MAIE}
\begin{equation}
f(\varepsilon) \, = \, \frac{dN}{d\varepsilon} \, \propto \,
        \int_{\varepsilon / \varepsilon_c}^{\infty} K_{5/3}(x) \, dx
\end{equation}
The energy can be sampled from this by inverse transform method:
\begin{eqnarray}
N \, & = & \, F(\varepsilon) = \, \int f(\varepsilon) \, d\varepsilon \\
\varepsilon \, & = & \, F^{-1}(N)
\end{eqnarray}
The double integral is not analytically solved, and the sampling
is done from tabulated values of numerically computes $F(\varepsilon)$.

Two methods have been implemented. If the flag {\tt ISYNC}
is set to 1, the photons are emitted at the end of the step along the current
direction. If {\tt ISYNC} is set to 3, the photons are
emitted randomly along the tangent the real trajectory of the particle.
In the case when {\tt ISYNC = 3}, the magnetic field tracking routines are
called for each photon, and therefore this option is
considrably slower than {\tt ISYNC = 1}.

\begin{figure}
\begin{picture}(300,100)(-60,0)

\put(40,80){{\tt ISYNC = 1}}
\put(0,0){\line(2,1){80}}
\put(80,40){\vector(1,0){20}}
\multiput(80,40)(16,0){4}{\vector(1,0){12}}
\put(45,15){{\tt STEP}}
\put(40,5){Current step}
\put(85,57){{\tt VECT}}
\put(85,47){New direction of e}
\put(90,25){Photons}

\put(240,80){{\tt ISYNC = 3}}
\put(200,0){\line(2,1){80}}
\put(280,40){\vector(1,0){20}}
\put(205,5){\circle*{.25}}
\put(210,9){\circle*{.25}}
\put(215,13){\circle*{.25}}
\put(220,16){\circle*{.25}}
\put(225,19){\circle*{.25}}
\put(230,22){\circle*{.25}}
\put(235,25){\circle*{.25}}
\put(240,27){\circle*{.25}}
\put(245,29){\circle*{.25}}
\put(250,31.5){\circle*{.25}}
\put(255,33.5){\circle*{.25}}
\put(260,35.){\circle*{.25}}
\put(265,36.5){\circle*{.25}}
\put(270,38){\circle*{.25}}
\put(275,39){\circle*{.25}}

\put(202,4){\vector(1,1){12}}
\put(218,16){\vector(4,3){12}}
\put(242,29){\vector(2,1){12}}
\put(263,37){\vector(3,1){12}}
\put(245,15){{\tt STEP}}
\put(240,5){Current step}
\put(285,57){{\tt VECT}}
\put(285,47){New direction of e}
\put(190,30){Photons}
\end{picture}
\caption{The point where the synchrotron radiation photon
         is generated. The figure on the left describes
         the situation when {\tt ISYNC = 1}, and the one
         on the right when {\tt ISYNC = 3}. The little
         arrows are the photons and {\tt STEP} is the
         step taken by the e$^-$ or e$^+$. {\tt VECT}
         is the new direction computed in {\tt GTELEC}
         before entering in {\tt GSYNC}.}
\end{figure}


\documentclass{article}
\usepackage{hyperref}
\usepackage{amsmath}
\usepackage{charter}

\begin{document}

\title{A design for a fast, mostly-concurrent hash table}
\author{Hayley Patton}
\date{Draft of \today}
\maketitle

We have wanted to design a concurrent hash table which is designed to
handle epheremal mappings, which are removed quickly. Our decentralise2
implementation creates many such mappings, storing information on where
to retrieve objects in a concurrent hash table, then removing it when
the objects are successfully retrieved. Cliff Click's hash table (the
\texttt{NonBlockingHashMap}\footnote{\url{https://github.com/boundary/high-scale-lib/blob/master/src/main/java/org/cliffc/high_scale_lib/NonBlockingHashMap.java}}),
while usually providing excellent performance with many threads, does
not handle such an application as gracefully, as it ``pins'' keys to
entries in the table, requiring periodic resizes to remove keys.

After playing around with the idea, we decided we sadly cannot remove
the pinning requirement, as it is required to maintain important
invariants of the table, and Click chose to accept these problems
because the alternative is impossible. So we are left to optimise,
rather than totally replace, the design of the table.

There is one such optimisation we can make: we can maintain a
\emph{metadata} table, summarising the state of the main entry table
in a compact form that can be searched with SIMD instructions. Matt
Kulukundis presented a serial hash table using parallel probing in a
presentation entitled Designing a Fast, Efficient, Cache-friendly Hash
Table, Step by Step.\footnote{
  \url{https://www.youtube.com/watch?v=ncHmEUmJZf4}} This
optimisation may still improve the performance of applications which
handle epheremal mappings, as discussed later.

Another optimisation could reduce the overhead of copying, by simplifying
the protocol between updating and copying threads, but we are not yet
confident this optimisation would be safe.

\section{A quick rundown of Click's hash table}

Cliff Click's hash table can be simplified down to a linear-probing hash
table, which stores entries consisting of keys, values and ``prime''
bits. Keys may, of course be ``empty'', and values may also be
``tombstoned'' instead of having a value, as previously mentioned. The
table implementation also defines some limit on how many entries can be
probed, before it has probed too long, and the table should be resized.

Every operation begins by hashing the key, and producing an index into
the entry table. Typically, we would use a modulo function to wrap the
hash value into the range of acceptable indices; but we may use a
faster bitwise-and function, should we restrain the table size to
powers of 2. Instead of writing
$$ hash\text{-}value \;\mathrm{mod}\; table\text{-}size $$
we may instead write
$$ hash\text{-}value \otimes (table\text{-}size - 1) $$
This hash value is the initial value of the \emph{probe position} for
every operation.

\subsection{Finding a value}

To find a value associated with a key (as the Common Lisp
\texttt{gethash} function does, and as the Java method \texttt{get}
does):
\begin{itemize}
\item We load the key at the probe position.
\item If the key is equal to the provided key, we then load the value
  and prime bit.
  \begin{itemize}
  \item If the prime bit is set, wait for the current resize to
    finish, and search again.
  \item If the value is a tombstone, then there is no value stored for
    the key. Return nothing.
  \item Otherwise, return the value stored.
  \end{itemize}
\item If we exceeded the probe limit, then an entry could not have
  been stored any further, so return nothing.
\item Otherwise, increment the probe position (modulo the table size),
  and try again.
\end{itemize}

\subsection{Associating a key with a value}

To associate a value with a key, either inserting or updating a mapping
(as the Common Lisp \texttt{(setf gethash)} function does, and as the
Java method \texttt{put} does):
\begin{itemize}
\item We first attempt to ``claim'' an entry, ensuring that the entry
  has the provided key stored in it.
  \begin{itemize}
  \item We load the key at the probe position.
  \item If the key is empty, we then attempt to CAS (compare-and-swap)
    the key with the provided key.
    \begin{itemize}
    \item If the CAS succeeds, we have successfully claimed this
      entry.
    \item If it did not succeed, load the key at the probe position
      again.
    \end{itemize}
  \item If the key (which may be the key loaded after a failed CAS
    from the previous step) is equal to the provided key, then we have
    already claimed that entry.
  \item If we exceed the probe limit while probing, then begin
    resizing, and start over in the new table.
  \end{itemize}
\item We then update the value in the entry.
  \begin{itemize}
  \item We load the value and probe bit at the probe position.
  \item If the probe bit is set, we need to start all over using the
    new table.
  \item Otherwise, attempt to CAS the loaded value and probe bit with
    the provided value and a cleared bit.
    \begin{itemize}
    \item If the CAS succeeds, we have successfully inserted this entry.
    \item If the CAS fails, re-load the value, and try again.
    \end{itemize}
  \end{itemize}
\end{itemize}

The same procedure applies for removing a key, except that we insert a
tombstone value, and if the key is not present, either by finding an
empty entry first, or by exceeding the probe limit, we do not need to
insert anything.

\subsection{Resizing}

Resizing the table is relatively easy:
\begin{itemize}
\item Initialize a new table.
\item For each entry in the old table:
  \begin{itemize}
  \item Atomically and unconditionally set the probe bit, preventing
    new writes.
  \item Read the key and value.
  \item If the key is not empty, and the value is not a tombstone,
    then insert the key and value into the new table.
  \end{itemize}
\item Atomically and unconditionally replace the table.
\end{itemize}

\section{How to introduce a metadata table}

We first note that this table produces a lot of tombstones if the user
removes mappings frequently, and so keys may have longer probe lengths,
compared to a typical hash table. Improving the performance of probing
could thus greatly improve this concurrent hash table.

Kulukundis's table implements one method to improve the performance of
probing, which is to summarise the state of the table into another table
with smaller elements, which is called a \emph{metadata} table. This
table condenses the normal entries, each two words (128 bits on modern
computers), into eight bits of metadata. Each metadata element is either
``empty'', or the lowest bits of the hash of the key stored.

\subsection{The effects of stale metadata}

We cannot update the metadata table and the entry table simultaneously,
so we must update one first. If we update the entry table first, we can
then verify that all the operations should still work as intended.

When finding a value associated with a key, we would search for metadata
matching the lowest bits of the hash of the provided key. We may find
that the metadata is still empty, although there is an entry stored in
the entry table. This is unfortunate, but acceptable. We may only
guarantee that an update is visible when the procedure has completed,
and this would not pose a problem.

When associating a value with a key, we would search for metadata which
either matches the lowest bits of the provided key, or is empty. We find
that the metadata is still empty, although there is an entry stored in
the entry table. This should not pose an issue, as we will then load the
key and proceed based on the loaded key anyway.

When removing a key, we would again search for metadata which matches
the lowest bits of the provided key. As mentioned previously, if the
metadata is empty, but there is an entry in the entry table, then the
entry is not visible to the find procedure yet, and so it is also
acceptable to find no entry to remove.

\subsection{What do we gain?}

An immediate advantage of the metadata table is that most \emph{misses}
will require considerably fewer memory operations, loading fewer bytes
than probing the entry table. Kulukundis encodes an empty key as the
byte \texttt{\#x80}, and a present key as the lowest 7 bits of its
hash.  Assuming the hash function is uniformly distributed, then we
can determine there is a $ \frac{1}{2^7} $ (1 in 128) probability that
we have a false positive, where the metadata bytes are equal, but the
keys are not. This is an unlikely, but possible occurence. Provided
that probe lengths are still reasonably short, it is likely that a
find operation which misses a key will not load any values outside
the metadata table.

Another advantage appears if we consider probing multiple entries at
once, perhaps using the single instruction-multiple data (or
``vectorised'') instructions provided by the processor used. For
example, the AMD64 instruction set guarantees the existence of the
SSE2 instructions and registers, and many high-performance ARM
processors include the NEON extension. Both provide 128-bit registers,
which can store 16 packed metadata bytes. It should be noted that
retrieving many metadata bytes at once may lead to retrieving stale
metadata more frequently, but we have already described why stale
metadata should not be a problem. On some machines, particuarly those
with the AVX2 and AVX512 extensions, it could be possible to use
larger group sizes (32 and 64, respectively), but Kulukundis found
that this did not provide any significant performance increase with
256 bits.\footnote{From a comment on the Cppcon presentation: ``Any
  reason why you chose 128 bits SSE over 256 bits AVX2, or even
  AVX512?'' ``We have done tests with 256bit versions and did not find
  a win over 128.  We have not tried 512''}

\section{Maybe a good idea: Using one ``prime'' bit}

One early idea was to replace the per-entry prime bit with one bit per
table, which would be tested after a successful update operation. When
the bit is set, the updater should wait for a new table to be
inserted, and replicate the update in the new table. This would
greatly reduce the cache invalidation caused by resizing, and would
even allow reads to never wait for resizes, but it makes the table
susceptible to rollbacks.

We must describe why individual prime bits were used first; Click
sets the prime bit by wrapping values in a \texttt{Prime} object, and
reading the prime bit requires performing a type check. As such, if one
thread sets an entry to be primed, then a writer which attempts to CAS
after observing a cleared bit will still fail. Using one prime bit
weakens the barrier between writing and resizing; a thread can still
perform one update, before it must wait for resizing to finish, and
replicate changes.

\subsection{What happens if we test after updating?}

Suppose thread 1 begins resizing, and copies some entry in the table.
Another thread, say thread 2, updates that entry, and then notices
it must replicate the change in the new table. Until the new table is
installed, the updated entry is visible. Immediately after the new table
is installed, the old entry is visible, and the entry is said to have
\emph{rolled back}. The entry will be updated soon after, but the old
value is still visible for some time.

This, however, could be alleviated by allowing updating threads to
replicate updates to the new table before it is installed, so that the
old value is not visible after installing. The table must be large
enough to hold all newly inserted associations; but this is ensured as
no more insertions can succeed than there were slots in the old table,
and the new table is at least as large as the old.

The updates would also have to be applied in order; or threads which
updated while resizing could just enqueue keys to be copied again into
the new table, which would ensure the newest value was
inserted. Allowing such updates does not block the progress of
copying, as the number of updates in this state is bounded by the
number of threads which have not yet begun waiting for copying to
finish. However, the copying thread(s) could not determine when there
are no more copies to be made, and no threads are in the process of
writing to the old table, so this solution could not be made to work.

\subsection{Or maybe just simplify the prime test?}

As forementioned, Click uses a wrapper object to implement the prime
bit; but the value in the prime object is never used except by the
copier, and that use can be factored out fairly easily (the copier
thread which succeeds at CASing the prime object in can maintain a
reference to the value without pulling it again from the prime
object). We could then replace the prime object with a constant value,
simplifying the type test into a pointer-equality test.

A quick test suggests pointer tests can be faster:

\begin{verbatim}
CL-USER> (defstruct a)
CL-USER> (defvar *foo* (make-a))
CL-USER> (the-cost-of-nothing:bench (a-p *foo*))
1.65 nanoseconds
CL-USER> (defvar *bar* '+bar+)
CL-USER> (the-cost-of-nothing:bench (eq *bar* '+bar+))
695.06 picoseconds
\end{verbatim}

We would also reduce allocation and memory accesses outside the table,
which would have more pronounced effects when testing in a real hash
table.

\end{document}