Atoa

atoa

Why Do We Need to Secure Networks? Networks are constantly under attack and can be infiltrated via various tactics, including malware, spoofing, packet sniffing, and much more. If a network is not protected from these tactics and is intruded upon, it could have a catastrophic impact on the organization. Consider one of such intrusion tactics, denial of service (DoS) attacks. What Is a Denial of Service Attack? A denial of service, or DoS, attack is an attack that targets a network or server and floods it with network traffic. The objective of this attack is to disrupt normal business operations by overloading an organization’s network with the goal of sending so much information that the network crashes or is unable to respond to legitimate users. Types of DoS Attacks Distributed Denial of Service (DDoS) Attack: This type of DoS attack uses multiple devices or servers, in different locations to flood the target network with unwanted traffic. This attack archives effectiveness by exploiting devices such as computers, IoT devices, and other networked resources. Network-level DoS Attacks: These DoS attacks target network bandwidths on a server to slow traffic. Types of these attacks include: SYN (synchronize) flood attack: To understand this attack, you have to understand the process used to establish a transmission control protocol (TCP) connection between devices and a server. This process is often called the handshake process.

The handshake process begins when a device sends a synchronize request to the server. The server responds with a SYN/ACK packet, acknowledging the receipt of the device’s request and leaves a port open for the final step of the handshake.
Upon receiving the final ACK packet from the device, the server establishes that the TCP connection is established.

Attackers understand this process and use SYN flood attacks to simulate TCP connections and flood a server with SYN packets. When the number of requests is larger than the number of available ports on the server, the server will crash and be unable to function.

Internet Control Message Protocol (ICMP) flood attack: This is a type of DoS attack where ICMP packets are repeatedly sent to a network server, forcing the server to send an ICMP in response, which eventually uses all the bandwidth for incoming and outgoing traffic, causing the server to crash.

The Internet control message protocol (ICMP) is an Internet protocol used by devices to tell each other about data transmission errors across a network.
Learn more about ICMP here Ping of Death: This is a type of DoS attack caused when a hacker pings a system by sending it an oversized ICMP packet that is bigger than 64kb (the maximum size for a currently formed ICMP packet). This causes the server to crash. Conclusion You are now aware of how a denial of service attack works and the different types associated with it. How do you keep yourself and your data safe from these attacks. How do you go about navigating these vulnerabilities? Do you have answers or suggestions? Feel free to share your thoughts in the comment section. GodSpeed Why Do We Need to Secure Networks? Networks are constantly under attack and can be infiltrated via various tactics, including malware, spoofing, packet sniffing, and much more. If a network is not protected from these tactics and is intruded upon, it could have a catastrophic impact on the organization. Consider one of such intrusion tactics, denial of service (DoS) attacks. What Is a Denial of Service Attack? A denial of service, or DoS, attack is an attack that targets a network or server and floods it with network traffic. The objective of this attack is to disrupt normal business operations by overloading an organization’s network with the goal of sending so much information that the network crashes or is unable to respond to legitimate users. Types of DoS Attacks Distributed Denial of Service (DDoS) Attack: This type of DoS attack uses multiple devices or servers, in different locations to flood the target network with unwanted traffic. This attack archives effectiveness by exploiting devices such as computers, IoT devices, and other networked resources. Network-level DoS Attacks: These DoS attacks target network bandwidths on a server to slow traffic. Types of these attacks include: SYN (synchronize) flood attack: To understand this attack, you have to understand the process used to establish a transmission control protocol (TCP) connection between devices and a server. This process is often called the handshake process.

The handshake process begins when a device sends a synchronize request to the server. The server responds with a SYN/ACK packet, acknowledging the receipt of the device’s request and leaves a port open for the final step of the handshake.
Upon receiving the final ACK packet from the device, the server establishes that the TCP connection is established.

Attackers understand this process and use SYN flood attacks to simulate TCP connections and flood a server with SYN packets. When the number of requests is larger than the number of available ports on the server, the server will crash and be unable to function. Internet Control Message Protocol (ICMP) flood attack: This is a type of DoS attack where ICMP packets are repeatedly sent to a network server, forcing the server to send an ICMP in response, which eventually uses all the bandwidth for incoming and outgoing traffic, causing the server to crash.

The Internet control message protocol (ICMP) is an Internet protocol used by devices to tell each other about data transmission errors across a network.
Learn more about ICMP here SYN (synchronize) flood attack: To understand this attack, you have to understand the process used to establish a transmission control protocol (TCP) connection between devices and a server. This process is often called the handshake process. The handshake process begins when a device sends a synchronize request to the server. The server responds with a SYN/ACK packet, acknowledging the receipt of the device’s request and leaves a port open for the final step of the handshake.
Upon receiving the final ACK packet from the device, the server establishes that the TCP connection is established. Attackers understand this process and use SYN flood attacks to simulate TCP connections and flood a server with SYN packets. When the number of requests is larger than the number of available ports on the server, the server will crash and be unable to function. SYN (synchronize) flood attack: To understand this attack, you have to understand the process used to establish a transmission control protocol (TCP) connection between devices and a server. This process is often called the handshake process . handshake process The handshake process begins when a device sends a synchronize request to the server. The server responds with a SYN/ACK packet, acknowledging the receipt of the device’s request and leaves a port open for the final step of the handshake. Upon receiving the final ACK packet from the device, the server establishes that the TCP connection is established. The handshake process begins when a device sends a synchronize request to the server. The server responds with a SYN/ACK packet, acknowledging the receipt of the device’s request and leaves a port open for the final step of the handshake. Upon receiving the final ACK packet from the device, the server establishes that the TCP connection is established. Attackers understand this process and use SYN flood attacks to simulate TCP connections and flood a server with SYN packets. When the number of requests is larger than the number of available ports on the server, the server will crash and be unable to function. Internet Control Message Protocol (ICMP) flood attack: This is a type of DoS attack where ICMP packets are repeatedly sent to a network server, forcing the server to send an ICMP in response, which eventually uses all the bandwidth for incoming and outgoing traffic, causing the server to crash. The Internet control message protocol (ICMP) is an Internet protocol used by devices to tell each other about data transmission errors across a network.
Learn more about ICMP here Internet Control Message Protocol (ICMP) flood attack: This is a type of DoS attack where ICMP packets are repeatedly sent to a network server, forcing the server to send an ICMP in response, which eventually uses all the bandwidth for incoming and outgoing traffic, causing the server to crash. The Internet control message protocol (ICMP) is an Internet protocol used by devices to tell each other about data transmission errors across a network. Learn more about ICMP here The Internet control message protocol (ICMP) is an Internet protocol used by devices to tell each other about data transmission errors across a network. Learn more about ICMP here here Ping of Death: This is a type of DoS attack caused when a hacker pings a system by sending it an oversized ICMP packet that is bigger than 64kb (the maximum size for a currently formed ICMP packet). This causes the server to crash. Ping of Death: This is a type of DoS attack caused when a hacker pings a system by sending it an oversized ICMP packet that is bigger than 64kb (the maximum size for a currently formed ICMP packet). This causes the server to crash. Conclusion You are now aware of how a denial of service attack works and the different types associated with it. How do you keep yourself and your data safe from these attacks. How do you go about navigating these vulnerabilities? Do you have answers or suggestions? Feel free to share your thoughts in the comment section. GodSpeed GodSpeed

An Overview of Network Intrusion Tactics: Denial of Service (DOS) Attacks

This paper is available on arxiv under CC 4.0 license.
Authors:
(1) Dipankar Sarkar, Cryptuon Research and me@dipankar.name Table of Links Abstract and Introduction
Formal Model - Rollups with Decentralized Common Pool (DCP)
Atomic composability & ZK-proofs
Incorporating Zk-proofs
Application of the Formal Model
Conclusion and References 4 Incorporating Zk-proofs To integrate zk-proofs into the model effectively, it would require the rollups participating in this system to be zk-proof compatible. They should be able to generate and verify these proofs efficiently. Furthermore, standardization of proofs related to atomic composability would be necessary to ensure smooth inter-rollup operations [4]. 1. Verification Functions: Introduce verification functions within the model that use zkproofs. These functions can quickly validate the correctness and completion of dependent transactions without needing full transparency into the transactions [2]. 2. Reduced Buffering Requirement: With zk-proofs validating transaction dependencies almost immediately, the need for extensive buffering can be reduced. Transactions can be executed swiftly after their zk-proof verifications succeed [3]. 3. Privacy Maintenance: As zk-proofs can validate statements without revealing the underlying data, transactions across rollups can maintain higher degrees of privacy, even in interdependent scenarios [1]. 4. Slashing with zk-proofs: The monitoring and reporting mechanism can also utilize zkproofs. Watchers can provide a zk-proof of misbehavior, which if validated, can lead to punitive measures [12]. 5. Proofs of Dependency Resolution: In the case of cyclic or complex dependencies, zkproofs can be crafted to ensure that all necessary conditions across rollups have been met without revealing the specifics of the transactions involved [6]. The integration of zk-proofs does introduce added cryptographic complexity, but with the advantages of swift validation, reduced need for buffering, and enhanced privacy, they can significantly bolster the robustness and efficiency of the atomic composability model across rollups [13]. This paper is available on arxiv under CC 4.0 license. Authors: (1) Dipankar Sarkar, Cryptuon Research and me@dipankar.name This paper is available on arxiv under CC 4.0 license. Authors: Authors: (1) Dipankar Sarkar, Cryptuon Research and me@dipankar.name Table of Links Abstract and Introduction Formal Model - Rollups with Decentralized Common Pool (DCP) Atomic composability & ZK-proofs Incorporating Zk-proofs Application of the Formal Model Conclusion and References Abstract and Introduction Abstract and Introduction Formal Model - Rollups with Decentralized Common Pool (DCP) Formal Model - Rollups with Decentralized Common Pool (DCP) Atomic composability & ZK-proofs Atomic composability & ZK-proofs Incorporating Zk-proofs Incorporating Zk-proofs Application of the Formal Model Application of the Formal Model Conclusion and References Conclusion and References 4 Incorporating Zk-proofs To integrate zk-proofs into the model effectively, it would require the rollups participating in this system to be zk-proof compatible. They should be able to generate and verify these proofs efficiently. Furthermore, standardization of proofs related to atomic composability would be necessary to ensure smooth inter-rollup operations [4]. 1. Verification Functions: Introduce verification functions within the model that use zkproofs. These functions can quickly validate the correctness and completion of dependent transactions without needing full transparency into the transactions [2]. 2. Reduced Buffering Requirement: With zk-proofs validating transaction dependencies almost immediately, the need for extensive buffering can be reduced. Transactions can be executed swiftly after their zk-proof verifications succeed [3]. 3. Privacy Maintenance: As zk-proofs can validate statements without revealing the underlying data, transactions across rollups can maintain higher degrees of privacy, even in interdependent scenarios [1]. 4. Slashing with zk-proofs: The monitoring and reporting mechanism can also utilize zkproofs. Watchers can provide a zk-proof of misbehavior, which if validated, can lead to punitive measures [12]. 5. Proofs of Dependency Resolution: In the case of cyclic or complex dependencies, zkproofs can be crafted to ensure that all necessary conditions across rollups have been met without revealing the specifics of the transactions involved [6]. The integration of zk-proofs does introduce added cryptographic complexity, but with the advantages of swift validation, reduced need for buffering, and enhanced privacy, they can significantly bolster the robustness and efficiency of the atomic composability model across rollups [13].

Towards Universal Atomic Composability:  Incorporating Zk-proofs

This paper is available on arxiv under CC 4.0 license.
Authors:
(1) Dipankar Sarkar, Cryptuon Research and me@dipankar.name Table of Links Abstract and Introduction
Formal Model - Rollups with Decentralized Common Pool (DCP)
Atomic composability & ZK-proofs
Incorporating Zk-proofs
Application of the Formal Model
Conclusion and References 5 Application of the Formal Model As the Ethereum ecosystem evolves, diverse scaling solutions have emerged to address the challenges of throughput and latency. Among them, the concept of shared sequencers has gained significant traction. Shared sequencers act as centralized transaction ordering mechanisms, increasing throughput by temporarily assuming the role of transaction orderer before these transactions are batched and finalized on the main chain. While they introduce efficiencies, shared sequencers inherently operate differently from typical rollups, warranting an exploration of how our formal model for atomic composability can be applied to them. The application of our formal model to shared sequencers and other existing solutions accentuates its versatility and universality. Whether it’s the centralized nature of sequencers or the diverse architectures of other rollups, the principles of atomic composability, as proposed in our model, remain consistent. This consistency is instrumental in creating a cohesive, interoperable, and scalable Ethereum ecosystem that can cater to the ever-growing demands of decentralized applications and services. In this section, we extend our formal model to understand its implications on shared sequencers and juxtapose it with other prevailing solutions in the space. The goal is to provide a comparative analysis that not only elucidates the strengths and potential drawbacks of each approach but also offers a cohesive understanding of how atomic composability can be universally achieved irrespective of the underlying scaling solution. 5.1 Shared Sequencers Shared sequencers, by design, centralize the transaction ordering mechanism without compromising the security guarantees of the main chain. Transactions are quickly processed off chain by the sequencer and then aggregated into larger batches to be submitted on-chain. This architecture provides the dual benefit of swift transaction times and reduced on-chain congestion. 5.1.1 Implications of the Formal Model: 1. Buffering & Dependency Handling: Given that shared sequencers operate in an off-chain environment before finalization, the buffering mechanism we proposed becomes even more critical. It allows for the temporary storage of transactions, especially when there are cross-rollup or cross-sequencer dependencies. 2. Concurrency Control: Shared sequencers inherently deal with a high volume of simultaneous transactions. Implementing our concurrency control mechanism ensures that interdependent transactions, even from different sources or rollups, can be processed in an atomic fashion. 3. Zero-Knowledge Proofs & Validation: The validation mechanism using zk-proofs becomes an asset here. It ensures that even in a semi-centralized environment, transaction validations remain private, swift, and secure. The zk-proofs also provide an added layer of trust to users who might be skeptical of the centralized nature of sequencers. 5.2 Alternative solutions: While shared sequencers present a compelling case for scalability, other solutions like zk-rollups, optimistic rollups, and sidechains each have their unique architectures and merits. 1. zk-Rollups: These rely heavily on zk-proofs for batched transaction validation. Applying our formal model, zk-rollups can benefit from enhanced dependency handling and buffering mechanisms, ensuring transactions across rollups are consistently processed. 2. Optimistic Rollups: Here, transactions are assumed to be correct until proven otherwise. Our formal model introduces a systematic approach for handling disputes and reordering, ensuring atomic composability without extensive delays. 3. Sidechains: Being independent blockchains, sidechains can pose more significant challenges for atomic composability. Our model can act as a bridge, providing mechanisms like dependency resolution and buffering to ensure smooth inter-chain operations. This paper is available on arxiv under CC 4.0 license. Authors: (1) Dipankar Sarkar, Cryptuon Research and me@dipankar.name This paper is available on arxiv under CC 4.0 license. Authors: Authors: (1) Dipankar Sarkar, Cryptuon Research and me@dipankar.name Table of Links Abstract and Introduction Formal Model - Rollups with Decentralized Common Pool (DCP) Atomic composability & ZK-proofs Incorporating Zk-proofs Application of the Formal Model Conclusion and References Abstract and Introduction Abstract and Introduction Formal Model - Rollups with Decentralized Common Pool (DCP) Formal Model - Rollups with Decentralized Common Pool (DCP) Atomic composability & ZK-proofs Atomic composability & ZK-proofs Incorporating Zk-proofs Incorporating Zk-proofs Application of the Formal Model Application of the Formal Model Conclusion and References Conclusion and References 5 Application of the Formal Model As the Ethereum ecosystem evolves, diverse scaling solutions have emerged to address the challenges of throughput and latency. Among them, the concept of shared sequencers has gained significant traction. Shared sequencers act as centralized transaction ordering mechanisms, increasing throughput by temporarily assuming the role of transaction orderer before these transactions are batched and finalized on the main chain. While they introduce efficiencies, shared sequencers inherently operate differently from typical rollups, warranting an exploration of how our formal model for atomic composability can be applied to them. The application of our formal model to shared sequencers and other existing solutions accentuates its versatility and universality. Whether it’s the centralized nature of sequencers or the diverse architectures of other rollups, the principles of atomic composability, as proposed in our model, remain consistent. This consistency is instrumental in creating a cohesive, interoperable, and scalable Ethereum ecosystem that can cater to the ever-growing demands of decentralized applications and services. In this section, we extend our formal model to understand its implications on shared sequencers and juxtapose it with other prevailing solutions in the space. The goal is to provide a comparative analysis that not only elucidates the strengths and potential drawbacks of each approach but also offers a cohesive understanding of how atomic composability can be universally achieved irrespective of the underlying scaling solution. 5.1 Shared Sequencers 5.1 Shared Sequencers Shared sequencers, by design, centralize the transaction ordering mechanism without compromising the security guarantees of the main chain. Transactions are quickly processed off chain by the sequencer and then aggregated into larger batches to be submitted on-chain. This architecture provides the dual benefit of swift transaction times and reduced on-chain congestion. 5.1.1 Implications of the Formal Model: 5.1.1 Implications of the Formal Model: 1. Buffering & Dependency Handling: Given that shared sequencers operate in an off-chain environment before finalization, the buffering mechanism we proposed becomes even more critical. It allows for the temporary storage of transactions, especially when there are cross-rollup or cross-sequencer dependencies. 2. Concurrency Control: Shared sequencers inherently deal with a high volume of simultaneous transactions. Implementing our concurrency control mechanism ensures that interdependent transactions, even from different sources or rollups, can be processed in an atomic fashion. 3. Zero-Knowledge Proofs & Validation: The validation mechanism using zk-proofs becomes an asset here. It ensures that even in a semi-centralized environment, transaction validations remain private, swift, and secure. The zk-proofs also provide an added layer of trust to users who might be skeptical of the centralized nature of sequencers. 5.2 Alternative solutions: 5.2 Alternative solutions: While shared sequencers present a compelling case for scalability, other solutions like zk-rollups, optimistic rollups, and sidechains each have their unique architectures and merits. 1. zk-Rollups: These rely heavily on zk-proofs for batched transaction validation. Applying our formal model, zk-rollups can benefit from enhanced dependency handling and buffering mechanisms, ensuring transactions across rollups are consistently processed. 2. Optimistic Rollups: Here, transactions are assumed to be correct until proven otherwise. Our formal model introduces a systematic approach for handling disputes and reordering, ensuring atomic composability without extensive delays. 3. Sidechains: Being independent blockchains, sidechains can pose more significant challenges for atomic composability. Our model can act as a bridge, providing mechanisms like dependency resolution and buffering to ensure smooth inter-chain operations.

Towards Universal Atomic Composability: Application of the Formal Model

This paper is available on arxiv under CC 4.0 license.
Authors:
(1) Dipankar Sarkar, Cryptuon Research and me@dipankar.name Table of Links Abstract and Introduction
Formal Model - Rollups with Decentralized Common Pool (DCP)
Atomic composability & ZK-proofs
Incorporating Zk-proofs
Application of the Formal Model
Conclusion and References 2 Formal Model - Rollups with Decentralized Common Pool (DCP) Addressing the multifaceted nature of blockchain ecosystems, especially those spanning several rollups, demands a structured, rigorous approach to uphold transactional integrity and reliability. To this end, our formal model seeks to methodically dissect and elucidate atomic composability across Ethereum’s multiple rollups. Our model is an amalgamation of classic distributed system theories and innovative cryptographic practices. We recognize that merely adapting traditional system theories to the blockchain milieu is not sufficient, necessitating a model tailored for the peculiarities of decentralized ledgers, especially within Ethereum’s ecosystem ([9]. Subsequent sections will delve into the intricacies of our formal model, commencing with fundamental definitions. We will then probe into operational dynamics, examining transactional workflows, dependency resolutions, and concurrency nuances. Cryptographic methodologies, particularly zeroknowledge proofs, will be highlighted, underscoring their pivotal role in efficient, confidential transaction validations. With this formal model, our aspiration is to furnish readers with an encompassing, lucid, and rigorous comprehension of how to establish, sustain, and, if necessary, re-establish atomic composability in environments with multiple rollups. 2.1 Definitions • R: Set of rollups on Ethereum. • T: Set of transactions, where Ti,j is the j-th transaction on rollup Ri. • Pd: Decentralized common pool. • K: Set of cryptographic keys associated with transactions. • τ : Timestamp attached to each transaction when it’s accepted by the majority of Pd nodes. • B: Buffer zone where transactions with pending dependencies are stored. • τmax: Maximum time a transaction can reside in buffer B. • Bmax: Maximum number of transactions that can reside in buffer B. • Dmax: Maximum number of attempts to resolve a transaction’s dependencies. 2.2 Operations 2.2.1 Publish • Description: This operation ensures that every transaction Ti,j from rollup Ri is published to the Decentralized Common Pool Pd. • Steps: 1. Ri generates a transaction Ti,j . 2. Ri sends Ti,j to Pd. 3. On receiving Ti,j , the majority of nodes in Pd timestamp it with τ and store it. • Output: publish(Ti,j ) → Pd(τ ) 2.2.2 Buffer • Description: Transactions with unmet dependencies are sent to the buffer B until their dependencies are resolved or they hit one of the defined limits. • Steps: 1. If Ti,j has unresolved dependencies, it’s directed to B. 2. Ti,j resides in B until either its dependencies are resolved or it breaches one of the constraints (τmax, Bmax, or Dmax). • Output: buffer(Ti,j ) → B 2.2.3 Resolve • Description: The operation checks for and resolves dependencies between two transactions, possibly from different rollups. • Steps: 1. Given two transactions Ti,j and Tk,l, Pd checks for their mutual dependencies. 2. If dependencies exist, Pd attempts resolution based on available data and timestamps. 3. If resolution is successful within the constraints, the transactions proceed. Otherwise, they remain in B or are rejected. • Output: resolve(Ti,j , Tk,l) → bool 2.2.4 Verify • Description: Ensures the validity and authenticity of the transaction using cryptographic keys. • Steps: 1. For each transaction Ti,j , Pd uses the associated cryptographic key Ki,j to verify its authenticity and integrity. 2. If the verification succeeds, the transaction proceeds. Otherwise, it’s deemed invalid. • Output: verify(Ti,j , Ki,j ) → bool 2.3 Transaction Processing For two transactions Ti,j from Ri and Tk,l from Rk: 2.3.1 Timestamp-Based Handling If both transactions are timestamped in Pd and their timestamps are within an acceptable time difference (delta): Then, the transactions are deemed compatible and can be processed without buffering. 2.3.2 Buffering • If the timestamp difference exceeds the acceptable delta, or if there’s a dependency which isn’t yet satisfied, transactions are sent to B. • While in B: – Periodic checks are done to see if dependencies can now be resolved. – If (τcurrent − τ (Ti,j )) > τmax, Ti,j is rejected. – If the buffer size exceeds Bmax, a rejection policy PR is triggered to create space. – If attempts to resolve dependencies for Ti,j exceed Dmax, Ti,j is rejected. 2.3.3 Rejection and Notification Once a transaction is rejected, a notification mechanism informs the originating rollup Ri or the respective party about the rejection. This allows for potential re-submission or other actions from the user’s end. 2.4 Rollup Punitive Measures 2.4.1 Staking Mechanism Every rollup must stake a certain number of tokens to participate in the transaction composability system. This stake acts as collateral that can be forfeited or slashed if the rollup misbehaves. 2.4.2 Monitoring and Reporting Third-party nodes or participants (often called "watchers" or "validators") can monitor transactions and execution behaviors across rollups. If they detect a rollup executing a transaction without proper validation or not adhering to the model’s rules, they can submit a proof of this misbehavior. 2.4.3 Misbehavior Proof A system can be put in place to accept proofs of misbehavior. Once verified, punitive measures can be enacted on the misbehaving rollup, including forfeiting their staked tokens. 2.5 Decentralized Common Pool (DCP) Instead of having a centralized common pool, we can utilize a decentralized common pool, Pd. This pool would be maintained and updated by a network of nodes, ensuring redundancy and security. Utilizing a consensus mechanism, these nodes can agree on the state of the pool. 2.5.1 Core features • Consensus Mechanism: Nodes in the Pd network use a consensus mechanism (like PoS, PoA, or a Byzantine Fault Tolerance mechanism) to validate and agree on the state of the pool. This prevents any single entity from maliciously modifying the data. • Data Redundancy: The decentralized nature ensures that multiple copies of the transaction pool are stored across nodes. This redundancy makes it resistant to single points of failure and data tampering. • Cryptographic Verification: Apart from using cryptographic keys for transaction verification, node participation, data propagation, and pool updates in the Pd network are also secured using cryptographic techniques, ensuring data integrity and authenticity. 2.5.2 Concurrency Handling with Transaction Delay/Rejection • Timestamping: Each transaction that’s published to Pd is timestamped. This timestamp is based on when the transaction is received by the majority of nodes in the Pd network. • Transaction Buffer: Transactions that have dependencies across rollups are not immediately processed. Instead, they’re placed in a buffer zone. • Dependency Resolution with Buffer: During the resolution phase, the system checks the buffer to resolve dependencies. If Transaction Ti,j depends on Transaction Tk,l, the system will: – Check if both transactions are in the buffer and if their timestamps are within an acceptable time difference (delta). – If they are, the system processes both transactions. – If not, and if the dependency can’t be resolved within a certain timeframe, the system might either: 1. Reject one or both of the transactions. 2. Delay the transaction processing until the dependency is resolved or a timeout occurs. 2.5.3 Challenges With the incorporation of a decentralized common pool, timestamping, a transaction buffer for dependency resolution, and enhanced security measures, the solution addresses many of the concurrency and security concerns. However, it’s essential to consider trade-offs: • The system might have increased complexity due to decentralization and consensus mechanisms. • Transaction delays, while managing concurrency, might not be suitable for applications that require real-time processing. • Ensuring all nodes in the Pd network are updated in near real-time might present scalability challenges. This paper is available on arxiv under CC 4.0 license. Authors: (1) Dipankar Sarkar, Cryptuon Research and me@dipankar.name This paper is available on arxiv under CC 4.0 license. Authors: Authors: (1) Dipankar Sarkar, Cryptuon Research and me@dipankar.name Table of Links Abstract and Introduction Formal Model - Rollups with Decentralized Common Pool (DCP) Atomic composability & ZK-proofs Incorporating Zk-proofs Application of the Formal Model Conclusion and References Abstract and Introduction Abstract and Introduction Formal Model - Rollups with Decentralized Common Pool (DCP) Formal Model - Rollups with Decentralized Common Pool (DCP) Atomic composability & ZK-proofs Atomic composability & ZK-proofs Incorporating Zk-proofs Incorporating Zk-proofs Application of the Formal Model Application of the Formal Model Conclusion and References Conclusion and References 2 Formal Model - Rollups with Decentralized Common Pool (DCP) Addressing the multifaceted nature of blockchain ecosystems, especially those spanning several rollups, demands a structured, rigorous approach to uphold transactional integrity and reliability. To this end, our formal model seeks to methodically dissect and elucidate atomic composability across Ethereum’s multiple rollups. Our model is an amalgamation of classic distributed system theories and innovative cryptographic practices. We recognize that merely adapting traditional system theories to the blockchain milieu is not sufficient, necessitating a model tailored for the peculiarities of decentralized ledgers, especially within Ethereum’s ecosystem ([9]. Subsequent sections will delve into the intricacies of our formal model, commencing with fundamental definitions. We will then probe into operational dynamics, examining transactional workflows, dependency resolutions, and concurrency nuances. Cryptographic methodologies, particularly zeroknowledge proofs, will be highlighted, underscoring their pivotal role in efficient, confidential transaction validations. With this formal model, our aspiration is to furnish readers with an encompassing, lucid, and rigorous comprehension of how to establish, sustain, and, if necessary, re-establish atomic composability in environments with multiple rollups. 2.1 Definitions 2.1 Definitions • R: Set of rollups on Ethereum. • T: Set of transactions, where Ti,j is the j-th transaction on rollup Ri. • Pd: Decentralized common pool. • K: Set of cryptographic keys associated with transactions. • τ : Timestamp attached to each transaction when it’s accepted by the majority of Pd nodes. • B: Buffer zone where transactions with pending dependencies are stored. • τmax: Maximum time a transaction can reside in buffer B. • Bmax: Maximum number of transactions that can reside in buffer B. • Dmax: Maximum number of attempts to resolve a transaction’s dependencies. 2.2 Operations 2.2 Operations 2.2.1 Publish 2.2.1 Publish • Description: This operation ensures that every transaction Ti,j from rollup Ri is published to the Decentralized Common Pool Pd. • Steps: • Steps: 1. Ri generates a transaction Ti,j . 2. Ri sends Ti,j to Pd. 3. On receiving Ti,j , the majority of nodes in Pd timestamp it with τ and store it. • Output: publish(Ti,j ) → Pd(τ ) 2.2.2 Buffer 2.2.2 Buffer • Description: Transactions with unmet dependencies are sent to the buffer B until their Description: dependencies are resolved or they hit one of the defined limits. • Steps: • Steps: 1. If Ti,j has unresolved dependencies, it’s directed to B. 2. Ti,j resides in B until either its dependencies are resolved or it breaches one of the constraints (τmax, Bmax, or Dmax). • Output: buffer(Ti,j ) → B 2.2.3 Resolve 2.2.3 Resolve • Description: The operation checks for and resolves dependencies between two transactions, possibly from different rollups. • Description: • Steps: • Steps: 1. Given two transactions Ti,j and Tk,l, Pd checks for their mutual dependencies. 2. If dependencies exist, Pd attempts resolution based on available data and timestamps. 3. If resolution is successful within the constraints, the transactions proceed. Otherwise, they remain in B or are rejected. • Output: resolve(Ti,j , Tk,l) → bool • Output: 2.2.4 Verify 2.2.4 Verify • Description: Ensures the validity and authenticity of the transaction using cryptographic • Description: keys. • Steps: • Steps: 1. For each transaction Ti,j , Pd uses the associated cryptographic key Ki,j to verify its authenticity and integrity. 2. If the verification succeeds, the transaction proceeds. Otherwise, it’s deemed invalid. • Output: verify(Ti,j , Ki,j ) → bool • Output: 2.3 Transaction Processing 2.3 Transaction Processing For two transactions Ti,j from Ri and Tk,l from Rk: 2.3.1 Timestamp-Based Handling 2.3.1 Timestamp-Based Handling If both transactions are timestamped in Pd and their timestamps are within an acceptable time difference (delta): Then, the transactions are deemed compatible and can be processed without buffering. 2.3.2 Buffering 2.3.2 Buffering • If the timestamp difference exceeds the acceptable delta, or if there’s a dependency which isn’t yet satisfied, transactions are sent to B. • While in B: – Periodic checks are done to see if dependencies can now be resolved. – If (τcurrent − τ (Ti,j )) > τmax, Ti,j is rejected. – If the buffer size exceeds Bmax, a rejection policy PR is triggered to create space. – If attempts to resolve dependencies for Ti,j exceed Dmax, Ti,j is rejected. 2.3.3 Rejection and Notification 2.3.3 Rejection and Notification Once a transaction is rejected, a notification mechanism informs the originating rollup Ri or the respective party about the rejection. This allows for potential re-submission or other actions from the user’s end. 2.4 Rollup Punitive Measures 2.4 Rollup Punitive Measures 2.4.1 Staking Mechanism 2.4.1 Staking Mechanism Every rollup must stake a certain number of tokens to participate in the transaction composability system. This stake acts as collateral that can be forfeited or slashed if the rollup misbehaves. 2.4.2 Monitoring and Reporting 2.4.2 Monitoring and Reporting Third-party nodes or participants (often called "watchers" or "validators") can monitor transactions and execution behaviors across rollups. If they detect a rollup executing a transaction without proper validation or not adhering to the model’s rules, they can submit a proof of this misbehavior. 2.4.3 Misbehavior Proof 2.4.3 Misbehavior Proof A system can be put in place to accept proofs of misbehavior. Once verified, punitive measures can be enacted on the misbehaving rollup, including forfeiting their staked tokens. 2.5 Decentralized Common Pool (DCP) 2.5 Decentralized Common Pool (DCP) Instead of having a centralized common pool, we can utilize a decentralized common pool, Pd. This pool would be maintained and updated by a network of nodes, ensuring redundancy and security. Utilizing a consensus mechanism, these nodes can agree on the state of the pool. 2.5.1 Core features 2.5.1 Core features • Consensus Mechanism: Nodes in the Pd network use a consensus mechanism (like PoS, PoA, or a Byzantine Fault Tolerance mechanism) to validate and agree on the state of the pool. This prevents any single entity from maliciously modifying the data. • Data Redundancy: The decentralized nature ensures that multiple copies of the transaction pool are stored across nodes. This redundancy makes it resistant to single points of failure and data tampering. • Cryptographic Verification: Apart from using cryptographic keys for transaction verification, node participation, data propagation, and pool updates in the Pd network are also secured using cryptographic techniques, ensuring data integrity and authenticity. 2.5.2 Concurrency Handling with Transaction Delay/Rejection 2.5.2 Concurrency Handling with Transaction Delay/Rejection • Timestamping: Each transaction that’s published to Pd is timestamped. This timestamp is based on when the transaction is received by the majority of nodes in the Pd network. • Transaction Buffer: Transactions that have dependencies across rollups are not immediately processed. Instead, they’re placed in a buffer zone. • Dependency Resolution with Buffer: During the resolution phase, the system checks the buffer to resolve dependencies. If Transaction Ti,j depends on Transaction Tk,l, the system will: – Check if both transactions are in the buffer and if their timestamps are within an acceptable time difference (delta). – If they are, the system processes both transactions. – If not, and if the dependency can’t be resolved within a certain timeframe, the system might either: 1. Reject one or both of the transactions. 2. Delay the transaction processing until the dependency is resolved or a timeout occurs. 2.5.3 Challenges 2.5.3 Challenges With the incorporation of a decentralized common pool, timestamping, a transaction buffer for dependency resolution, and enhanced security measures, the solution addresses many of the concurrency and security concerns. However, it’s essential to consider trade-offs: • The system might have increased complexity due to decentralization and consensus mechanisms. • Transaction delays, while managing concurrency, might not be suitable for applications that require real-time processing. • Ensuring all nodes in the Pd network are updated in near real-time might present scalability challenges.

Towards Universal Atomic Composability: Formal Model - Rollups with Decentralized Common Pool (DCP)

This paper is available on arxiv under CC 4.0 license.
Authors:
(1) Dipankar Sarkar, Cryptuon Research and me@dipankar.name Table of Links Abstract and Introduction
Formal Model - Rollups with Decentralized Common Pool (DCP)
Atomic composability & ZK-proofs
Incorporating Zk-proofs
Application of the Formal Model
Conclusion and References 3 Atomic composability & ZK-proofs Zero-Knowledge Proofs (zk-proofs), particularly zk-SNARKs (Zero-Knowledge Succinct Non-Interactive Argument of Knowledge) and zk-STARKs (Zero-Knowledge Scalable Transparent Argument of Knowledge), are cryptographic methods that allow one party to prove to another party that a statement is true, without revealing any specific information beyond the validity of the statement itself [1, 2]. For atomic composability across rollups, zk-proofs can be exceptionally beneficial. Let’s explore how: 3.1 Transaction Validation zk-proofs can be utilized to validate that a transaction on one rollup adheres to specific conditions, without actually revealing the contents of the transaction. This is especially useful for maintaining privacy across rollups while still ensuring that conditions are met [6]. 3.2 Dependency Verification If one transaction depends on another from a different rollup, zk-proofs can be utilized to validate the successful execution and correctness of the dependent transaction, again, without revealing the actual transaction details [7]. 3.3 Concurrency and Aggregate Dependencies zk-proofs can be crafted to provide proofs of concurrent transaction executions or aggregate transaction conditions (like total transaction value across multiple rollups) being met, all without revealing specific transaction details [12]. 3.4 Compactness and Efficiency zk-proofs, especially zk-SNARKs, have the advantage of being succinct. That means, irrespective of the amount of data or the number of transactions they’re validating, the proof size remains relatively small and verification is swift. This feature can be immensely beneficial in a system with multiple rollups, where swift validations are essential [10]. This paper is available on arxiv under CC 4.0 license. Authors: (1) Dipankar Sarkar, Cryptuon Research and me@dipankar.name This paper is available on arxiv under CC 4.0 license. Authors: Authors: (1) Dipankar Sarkar, Cryptuon Research and me@dipankar.name Table of Links Abstract and Introduction Formal Model - Rollups with Decentralized Common Pool (DCP) Atomic composability & ZK-proofs Incorporating Zk-proofs Application of the Formal Model Conclusion and References Abstract and Introduction Abstract and Introduction Formal Model - Rollups with Decentralized Common Pool (DCP) Formal Model - Rollups with Decentralized Common Pool (DCP) Atomic composability & ZK-proofs Atomic composability & ZK-proofs Incorporating Zk-proofs Incorporating Zk-proofs Application of the Formal Model Application of the Formal Model Conclusion and References Conclusion and References 3 Atomic composability & ZK-proofs Zero-Knowledge Proofs (zk-proofs), particularly zk-SNARKs (Zero-Knowledge Succinct Non-Interactive Argument of Knowledge) and zk-STARKs (Zero-Knowledge Scalable Transparent Argument of Knowledge), are cryptographic methods that allow one party to prove to another party that a statement is true, without revealing any specific information beyond the validity of the statement itself [1, 2]. For atomic composability across rollups, zk-proofs can be exceptionally beneficial. Let’s explore how: 3.1 Transaction Validation 3.1 Transaction Validation zk-proofs can be utilized to validate that a transaction on one rollup adheres to specific conditions, without actually revealing the contents of the transaction. This is especially useful for maintaining privacy across rollups while still ensuring that conditions are met [6]. 3.2 Dependency Verification 3.2 Dependency Verification If one transaction depends on another from a different rollup, zk-proofs can be utilized to validate the successful execution and correctness of the dependent transaction, again, without revealing the actual transaction details [7]. 3.3 Concurrency and Aggregate Dependencies 3.3 Concurrency and Aggregate Dependencies zk-proofs can be crafted to provide proofs of concurrent transaction executions or aggregate transaction conditions (like total transaction value across multiple rollups) being met, all without revealing specific transaction details [12]. 3.4 Compactness and Efficiency 3.4 Compactness and Efficiency zk-proofs, especially zk-SNARKs, have the advantage of being succinct. That means, irrespective of the amount of data or the number of transactions they’re validating, the proof size remains relatively small and verification is swift. This feature can be immensely beneficial in a system with multiple rollups, where swift validations are essential [10].

Towards Universal Atomic Composability: Atomic composability & ZK-proofs

This paper is available on arxiv under CC 4.0 license.
Authors:
(1) Dipankar Sarkar, Cryptuon Research and me@dipankar.name Table of Links Abstract and Introduction
Formal Model - Rollups with Decentralized Common Pool (DCP)
Atomic composability & ZK-proofs
Incorporating Zk-proofs
Application of the Formal Model
Conclusion and References 6 Conclusion The formal model presented serves as a superset for all possible atomic composability across rollups because of its comprehensive nature. This model is a superset because it is designed to encompass every step, every entity, and every possible scenario in the lifecycle of a transaction across rollups. By being exhaustive in its approach, any atomic composability solution across rollups that exists or might be conceived in the future can be mapped onto some subset of this model. It acts as a general framework or blueprint from which specific implementations can be derived, tailored to particular requirements or constraints. Comprehensiveness of Definitions It identifies every rollup, transaction, timestamp, cryptographic key, buffer mechanism, and even the decentralized pool where transactions are posted. This covers all essential tools and entities required for atomic transactions between rollups. Detailed Operations The detailed operation steps ensure that every conceivable action associated with transactions – from their creation, publication, verification, buffering, to dependency resolution – is incorporated: • Publish: Every transaction is committed to a decentralized common pool, capturing the universal broadcast mechanism. • Buffer: Handles the uncertainties and delays. • Resolve: Manages interdependencies, making sure that if one transaction in a set can’t be executed, none in that set are. • Verify: Ensures that only legitimate and valid transactions are processed. Robust Dependency Handling This is perhaps the crux of atomic composability. The model provides: • A method to check the timing (timestamps) of transactions, which is crucial for ensuring order and dependencies. • Buffering mechanisms to account for delays in dependency resolution. • Defined limits for buffering to prevent infinite waits and to give an outcome (acceptance or rejection) within a finite time. Flexibility & Scalability The model doesn’t restrict the number or type of dependencies. It simply provides mechanisms to handle them. This ensures that as blockchain technology evolves and new dependency types emerge or transactions become more intricate, the model remains applicable. Incorporation of Limits By integrating system limits like τmax, Bmax, and Dmax, the model not only accounts for ideal scenarios where all dependencies are quickly resolved but also for edge cases where system constraints come into play. This adds to its universality. Security through Verification The model’s inclusion of cryptographic verification ensures that security concerns are front and center. It recognizes that composability isn’t just about making sure transactions work together, but that they’re also genuine and untampered. References [1] E. Ben-Sasson, A. Chiesa, D. Genkin, E. Tromer, and M. Virza. Snarks for c: Verifying program executions succinctly and in zero knowledge. In Proceedings of the 33rd Annual Cryptology Conference, pages 90–108. Springer, 2013. [2] E. Ben-Sasson, I. Bentov, Y. Horesh, and M. Riabzev. Scalable, transparent, and post-quantum secure computational integrity. IACR Cryptol. ePrint Arch., 2018:46, 2018. [3] N. Bitansky, R. Canetti, A. Chiesa, and E. Tromer. Extractable collision resistance: A new complexity assumption for zero-knowledge. Advances in Cryptology–CRYPTO 2012, pages 416–434, 2012. [4] V. Buterin. A next-generation smart contract and decentralized application platform. White paper, 2014. Available at https://ethereum.org/en/whitepaper/. [5] V. Buterin. Ethereum’s scalability and decentralization challenge, 2020. [6] R. Gennaro, C. Gentry, B. Parno, and M. Raykova. Quadratic span programs and succinct nizks without pcps. In Proceedings of the 32nd Annual International Conference on the Theory and Applications of Cryptographic Techniques, pages 626–645. Springer, 2013. [7] S. Micali. Cs proofs. Journal of Cryptology, 4(3):175–194, 1994. [8] S. Micali. Atomic transactions in blockchain, 2016. [9] A. Narayanan, J. Bonneau, E. Felten, A. Miller, and S. Goldfeder. Bitcoin and Cryptocurrency Technologies. Princeton University Press, 2016. [10] C. Reitwiessner. zk-snarks in a nutshell. Blog post, 2016. Available at https://blog.ethereum.org/2016/12/05/zksnarks-in-a-nutshell/. [11] F. Schär. Decentralized finance: On blockchain- and smart contract-based financial markets. Federal Reserve Bank of St. Louis Review, 2020. [12] R. S. Wahby, I. Tzialla, A. Shelat, J. Thaler, and M. Walfish. Fast and simple constant-size zk-snarks without trusted setup. IACR Cryptol. ePrint Arch., 2019:748, 2019. [13] H. Williamson. Optimistic rollups: Layer 2 scaling. Blog post, 2020. Available at https://optimism.io/. This paper is available on arxiv under CC 4.0 license. Authors: (1) Dipankar Sarkar, Cryptuon Research and me@dipankar.name This paper is available on arxiv under CC 4.0 license. Authors: Authors: (1) Dipankar Sarkar, Cryptuon Research and me@dipankar.name Table of Links Abstract and Introduction Formal Model - Rollups with Decentralized Common Pool (DCP) Atomic composability & ZK-proofs Incorporating Zk-proofs Application of the Formal Model Conclusion and References Abstract and Introduction Abstract and Introduction Formal Model - Rollups with Decentralized Common Pool (DCP) Formal Model - Rollups with Decentralized Common Pool (DCP) Atomic composability & ZK-proofs Atomic composability & ZK-proofs Incorporating Zk-proofs Incorporating Zk-proofs Application of the Formal Model Application of the Formal Model Conclusion and References Conclusion and References 6 Conclusion The formal model presented serves as a superset for all possible atomic composability across rollups because of its comprehensive nature. This model is a superset because it is designed to encompass every step, every entity, and every possible scenario in the lifecycle of a transaction across rollups. By being exhaustive in its approach, any atomic composability solution across rollups that exists or might be conceived in the future can be mapped onto some subset of this model. It acts as a general framework or blueprint from which specific implementations can be derived, tailored to particular requirements or constraints. Comprehensiveness of Definitions It identifies every rollup, transaction, timestamp, cryptographic key, buffer mechanism, and even the decentralized pool where transactions are posted. This covers all essential tools and entities required for atomic transactions between rollups. Comprehensiveness of Definitions Detailed Operations The detailed operation steps ensure that every conceivable action associated with transactions – from their creation, publication, verification, buffering, to dependency resolution – is incorporated: Detailed Operations • Publish: Every transaction is committed to a decentralized common pool, capturing the universal broadcast mechanism. • Buffer: Handles the uncertainties and delays. • Resolve: Manages interdependencies, making sure that if one transaction in a set can’t be executed, none in that set are. • Verify: Ensures that only legitimate and valid transactions are processed. Robust Dependency Handling This is perhaps the crux of atomic composability. The model provides: • A method to check the timing (timestamps) of transactions, which is crucial for ensuring order and dependencies. • Buffering mechanisms to account for delays in dependency resolution. • Defined limits for buffering to prevent infinite waits and to give an outcome (acceptance or rejection) within a finite time. Flexibility & Scalability The model doesn’t restrict the number or type of dependencies. It simply provides mechanisms to handle them. This ensures that as blockchain technology evolves and new dependency types emerge or transactions become more intricate, the model remains applicable. Incorporation of Limits By integrating system limits like τmax, Bmax, and Dmax, the model not only accounts for ideal scenarios where all dependencies are quickly resolved but also for edge cases where system constraints come into play. This adds to its universality. Security through Verification The model’s inclusion of cryptographic verification ensures that security concerns are front and center. It recognizes that composability isn’t just about making sure transactions work together, but that they’re also genuine and untampered. References [1] E. Ben-Sasson, A. Chiesa, D. Genkin, E. Tromer, and M. Virza. Snarks for c: Verifying program executions succinctly and in zero knowledge. In Proceedings of the 33rd Annual Cryptology Conference, pages 90–108. Springer, 2013. [2] E. Ben-Sasson, I. Bentov, Y. Horesh, and M. Riabzev. Scalable, transparent, and post-quantum secure computational integrity. IACR Cryptol. ePrint Arch., 2018:46, 2018. [3] N. Bitansky, R. Canetti, A. Chiesa, and E. Tromer. Extractable collision resistance: A new complexity assumption for zero-knowledge. Advances in Cryptology–CRYPTO 2012, pages 416–434, 2012. [4] V. Buterin. A next-generation smart contract and decentralized application platform. White paper, 2014. Available at https://ethereum.org/en/whitepaper/. [5] V. Buterin. Ethereum’s scalability and decentralization challenge, 2020. [6] R. Gennaro, C. Gentry, B. Parno, and M. Raykova. Quadratic span programs and succinct nizks without pcps. In Proceedings of the 32nd Annual International Conference on the Theory and Applications of Cryptographic Techniques, pages 626–645. Springer, 2013. [7] S. Micali. Cs proofs. Journal of Cryptology, 4(3):175–194, 1994. [8] S. Micali. Atomic transactions in blockchain, 2016. [9] A. Narayanan, J. Bonneau, E. Felten, A. Miller, and S. Goldfeder. Bitcoin and Cryptocurrency Technologies. Princeton University Press, 2016. [10] C. Reitwiessner. zk-snarks in a nutshell. Blog post, 2016. Available at https://blog.ethereum.org/2016/12/05/zksnarks-in-a-nutshell/. [11] F. Schär. Decentralized finance: On blockchain- and smart contract-based financial markets. Federal Reserve Bank of St. Louis Review, 2020. [12] R. S. Wahby, I. Tzialla, A. Shelat, J. Thaler, and M. Walfish. Fast and simple constant-size zk-snarks without trusted setup. IACR Cryptol. ePrint Arch., 2019:748, 2019. [13] H. Williamson. Optimistic rollups: Layer 2 scaling. Blog post, 2020. Available at https://optimism.io/.

Towards Universal Atomic Composability: Conclusion and References

This paper is available on arxiv under CC 4.0 license.
Authors:
(1) Dipankar Sarkar, Cryptuon Research and me@dipankar.name Table of Links Abstract and Introduction
Formal Model - Rollups with Decentralized Common Pool (DCP)
Atomic composability & ZK-proofs
Incorporating Zk-proofs
Application of the Formal Model
Conclusion and References Abstract In the rapidly evolving domain of distributed ledger technology, scalability and interoperability have become paramount challenges for both academic and industry sectors. In this paper, we introduce a comprehensive formal model to address atomic composability across multiple rollups on Ethereum. The proposed model incorporates mechanisms like buffering, dependency management, concurrency control, and the groundbreaking zero-knowledge proofs. Moreover, we evaluate its practical repercussions, strengths, and weaknesses, ensuring resilience against manipulative or erroneous actions. The application of the proposed model to shared sequencers and other existing solutions accentuates its versatility and universality. 1 Introduction In the rapidly evolving domain of distributed ledger technology, scalability and interoperability have become paramount challenges for both academic and industry sectors. Ethereum, recognized as a pioneering smart contract platform, has initiated a myriad of advancements, with rollups being a significant answer to the blockchain trilemma: balancing scalability, security, and decentralization [5]. However, as rollups appear promising for scalability, they might unintentionally lead to fragmented composability. Given the intertwining nature of systems and applications, ensuring atomicity in transactions across systems is vital. Atomic composability is predicated on the principle that a transaction (A) can only be finalized if another transaction (B) is likewise finalized [8]. For decentralized applications that operate over multiple rollups, this assurance is critical. Yet, actualizing this atomicity with disconnected rollups on Ethereum presents major obstacles. This paper offers a thorough formal model that addresses atomic composability across multiple rollups on Ethereum. Incorporating insights from established distributed system solutions and contemporary cryptographic methodologies, the proposed model encompasses buffering, dependency management, concurrency control, and the groundbreaking zero-knowledge proofs [1]. Beyond proposing the model, we evaluate its practical repercussions, strengths, and weaknesses, ensuring resilience against manipulative or erroneous actions. Our intent extends beyond presenting a solution; we seek to stimulate a wider discourse on the future trajectory of interconnected blockchains. With a surge in applications shifting to a multi-rollup framework on Ethereum and elsewhere, a robust system guaranteeing atomic composability becomes indispensable. Through our model and ensuing discussions, we aim to make substantial contributions to this burgeoning field of blockchain study. 1.1 What are Rollups? Rollups, in the Ethereum context, are scaling mechanisms that bolster network throughput. They operate by conducting transactions off-chain and subsequently submitting a transaction summary to the primary Ethereum chain, thus enhancing transaction capacity without overloading the main Ethereum network [5]. 1.2 What is Composability? Within blockchain and Ethereum paradigms, composability pertains to the capability of decentralized applications (dApps) and smart contracts to effortlessly integrate and leverage one another’s features [11]. This can be analogized to “money Legos”, where each protocol or dApp represents an individual Lego piece, capable of diverse combinations. 1.3 Limits of Composability Between Rollups With the deployment of multiple rollups on Ethereum, challenges arise in ensuring seamless interaction of dApps and contracts across these rollups. This dilemma is intensified if rollups operate in isolation or lack an effective bridging mechanism. Atomic Transactions Across Rollups: Ensuring atomic composability between rollups necessitates that a transaction in one rollup is only finalized if its counterpart in another rollup is as well. This is intricate because each rollup might possess unique consensus algorithms, validation methodologies, and operational latency. Data Availability: For a contract in one rollup to interface with data or another contract on a distinct rollup, the requisite data from the latter may not be readily accessible or may be costly to retrieve. Differing Rules and Standards: Distinct rollups with divergent standards or rules regarding transaction processing can further impede cross-rollup interactions. This paper is available on arxiv under CC 4.0 license. Authors: (1) Dipankar Sarkar, Cryptuon Research and me@dipankar.name This paper is available on arxiv under CC 4.0 license. Authors: Authors: (1) Dipankar Sarkar, Cryptuon Research and me@dipankar.name Table of Links Abstract and Introduction Formal Model - Rollups with Decentralized Common Pool (DCP) Atomic composability & ZK-proofs Incorporating Zk-proofs Application of the Formal Model Conclusion and References Abstract and Introduction Abstract and Introduction Formal Model - Rollups with Decentralized Common Pool (DCP) Formal Model - Rollups with Decentralized Common Pool (DCP) Atomic composability & ZK-proofs Atomic composability & ZK-proofs Incorporating Zk-proofs Incorporating Zk-proofs Application of the Formal Model Application of the Formal Model Conclusion and References Conclusion and References Abstract In the rapidly evolving domain of distributed ledger technology, scalability and interoperability have become paramount challenges for both academic and industry sectors. In this paper, we introduce a comprehensive formal model to address atomic composability across multiple rollups on Ethereum. The proposed model incorporates mechanisms like buffering, dependency management, concurrency control, and the groundbreaking zero-knowledge proofs. Moreover, we evaluate its practical repercussions, strengths, and weaknesses, ensuring resilience against manipulative or erroneous actions. The application of the proposed model to shared sequencers and other existing solutions accentuates its versatility and universality. 1 Introduction In the rapidly evolving domain of distributed ledger technology, scalability and interoperability have become paramount challenges for both academic and industry sectors. Ethereum, recognized as a pioneering smart contract platform, has initiated a myriad of advancements, with rollups being a significant answer to the blockchain trilemma: balancing scalability, security, and decentralization [5]. However, as rollups appear promising for scalability, they might unintentionally lead to fragmented composability. Given the intertwining nature of systems and applications, ensuring atomicity in transactions across systems is vital. Atomic composability is predicated on the principle that a transaction (A) can only be finalized if another transaction (B) is likewise finalized [8]. For decentralized applications that operate over multiple rollups, this assurance is critical. Yet, actualizing this atomicity with disconnected rollups on Ethereum presents major obstacles. This paper offers a thorough formal model that addresses atomic composability across multiple rollups on Ethereum. Incorporating insights from established distributed system solutions and contemporary cryptographic methodologies, the proposed model encompasses buffering, dependency management, concurrency control, and the groundbreaking zero-knowledge proofs [1]. Beyond proposing the model, we evaluate its practical repercussions, strengths, and weaknesses, ensuring resilience against manipulative or erroneous actions. Our intent extends beyond presenting a solution; we seek to stimulate a wider discourse on the future trajectory of interconnected blockchains. With a surge in applications shifting to a multi-rollup framework on Ethereum and elsewhere, a robust system guaranteeing atomic composability becomes indispensable. Through our model and ensuing discussions, we aim to make substantial contributions to this burgeoning field of blockchain study. 1.1 What are Rollups? 1.1 What are Rollups? Rollups, in the Ethereum context, are scaling mechanisms that bolster network throughput. They operate by conducting transactions off-chain and subsequently submitting a transaction summary to the primary Ethereum chain, thus enhancing transaction capacity without overloading the main Ethereum network [5]. 1.2 What is Composability? 1.2 What is Composability? Within blockchain and Ethereum paradigms, composability pertains to the capability of decentralized applications (dApps) and smart contracts to effortlessly integrate and leverage one another’s features [11]. This can be analogized to “money Legos”, where each protocol or dApp represents an individual Lego piece, capable of diverse combinations. 1.3 Limits of Composability Between Rollups 1.3 Limits of Composability Between Rollups With the deployment of multiple rollups on Ethereum, challenges arise in ensuring seamless interaction of dApps and contracts across these rollups. This dilemma is intensified if rollups operate in isolation or lack an effective bridging mechanism. Atomic Transactions Across Rollups: Ensuring atomic composability between rollups necessitates that a transaction in one rollup is only finalized if its counterpart in another rollup is as well. This is intricate because each rollup might possess unique consensus algorithms, validation methodologies, and operational latency. Atomic Transactions Across Rollups: Data Availability: For a contract in one rollup to interface with data or another contract on a distinct rollup, the requisite data from the latter may not be readily accessible or may be costly to retrieve. Data Availability: Differing Rules and Standards: Distinct rollups with divergent standards or rules regarding transaction processing can further impede cross-rollup interactions. Differing Rules and Standards:

Towards Universal Atomic Composability: Abstract and Introduction

Tiktok Inc., and ByteDance LTD., v. Merrick B. Garland Update Court Filing, retrieved on May 7, 2024, is part of HackerNoon’s Legal PDF Series. You can jump to any part in this filing here. This part is 8 of 11. Ground 2: Unconstitutional Bill of Attainder 95. The Act is an unconstitutional bill of attainder. 96. Article I of the U.S. Constitution prohibits Congress from passing any bill of attainder. U.S. Const. art. I § 9, cl. 3 (“No Bill of Attainder or ex post facto Law shall be passed.”). A bill of attainder is “legislative punishment, of any form or severity, of specifically designated persons or groups.” United States v. Brown, 381 U.S. 437, 447 (1965). The protection against bills of attainder is “an implementation of the separation of powers, a general safeguard against legislative exercise of the judicial function, or more simply — trial by legislature.” Id. at 442. 97. By singling out Petitioners for legislative punishment, the Act is an unconstitutional bill of attainder. 98. The Act inflicts “pains and penalties” that historically have been associated with bills of attainder. See Nixon v. Adm’r of Gen. Servs., 433 U.S. 425, 474 (1977). Historically, common “pains and penalties” included “punitive confiscation of property by the sovereign” and “a legislative enactment barring designated individuals or groups from participation in specified employments or vocations,” among others. Id. As described above, the Act confiscates Petitioners’ U.S. businesses by forcing ByteDance to shutter them within 270 days or sell on terms that are not commercially, technologically, or legally feasible. See supra ¶¶ 26‒29. For the same reason, the Act bars Petitioners from operating in their chosen line of business. 99. “[V]iewed in terms of the type and severity of burdens imposed” on Petitioners, the Act’s treatment of Petitioners cannot “reasonably . . . be said to further nonpunitive legislative purposes.” Nixon, 433 U.S. at 475–76. The Act transforms Petitioners into a “vilified class” by explicitly prohibiting their current and future operations in the United States, without qualification or limitation, but does not extend the same treatment to other similarly situated companies. Foretich v. United States, 351 F.3d 1198, 1224 (D.C. Cir. 2003). 100. Moreover, in light of the less restrictive alternatives discussed above, there is no justification for automatically barring Petitioners’ current and future operations in the United States (or those of its subsidiaries or successors) in perpetuity without providing them a meaningful opportunity to take corrective action. See Kaspersky Lab, Inc. v. U.S. Dep’t of Homeland Sec., 909 F.3d 446, 456 (D.C. Cir. 2018). Indeed, the Act imposes this punishment uniquely on Petitioners without the process, and presidential determination of a significant national security threat, that Congress has afforded to everyone else. Expressly singling out Petitioners for these punitive burdens while at the same time adopting a statutory standard and decision-making process applicable to every other entity makes clear that Petitioners are subjected to a prohibited legislatively imposed punishment. 101. Moreover, while Petitioners can avoid the Act’s prohibitions only via a wholesale divestment, all other companies — even those with Chinese ownership and determined by the President to present a “significant threat” to U.S. national security — can avoid prohibition simply by operating a website or an application “whose primary purpose is to allow users to post product reviews, business reviews, or travel information and reviews.” Sec. 2(g)(2)(b). 102. Indeed, any other “adversary-controlled” company that operates an application exactly like TikTok, but also operates a website the primary purpose of which is to post product reviews, is left untouched, leaving a ready path for any company but those affiliated with Petitioners to circumvent the Act’s prohibitions altogether. For all practical purposes, then, the Act applies to just one corporate group — it is a “TikTok bill,” as congressional leaders have described it.[30] 103. For all of these reasons, the Act constitutes an unconstitutional bill of attainder. Continue Reading Here. About HackerNoon Legal PDF Series: We bring you the most important technical and insightful public domain court case filings.
This court case retrieved on May 7, 2024, from sf16-va.tiktokcdn.com is part of the public domain. The court-created documents are works of the federal government, and under copyright law, are automatically placed in the public domain and may be shared without legal restriction. [30] Rachel Dobkin, Mike Johnson’s Letter Sparks New Flood of Republican Backlash, Newsweek (Apr. 17, 2024), https://perma.cc/Z5HD-7UVU (quoting letter from Speaker Johnson referencing the “TikTok bill”); Senator Chuck Schumer, Majority Leader, to Colleagues (Apr. 5, 2024), https://perma.cc/J7Q4-9PGJ (referencing “TikTok legislation”). Tiktok Inc., and ByteDance LTD., v. Merrick B. Garland Update Court Filing, retrieved on May 7, 2024, is part of HackerNoon’s Legal PDF Series. You can jump to any part in this filing here. This part is 8 of 11. Tiktok Inc., and ByteDance LTD., v. Merrick B. Garland Update Court Filing, retrieved on May 7, 2024, is part of HackerNoon’s Legal PDF Series . You can jump to any part in this filing here . This part is 8 of 11. HackerNoon’s Legal PDF Series here Ground 2: Unconstitutional Bill of Attainder 95. The Act is an unconstitutional bill of attainder. 96. Article I of the U.S. Constitution prohibits Congress from passing any bill of attainder. U.S. Const. art. I § 9, cl. 3 (“No Bill of Attainder or ex post facto Law shall be passed.”). A bill of attainder is “legislative punishment, of any form or severity, of specifically designated persons or groups.” United States v. Brown, 381 U.S. 437, 447 (1965). The protection against bills of attainder is “an implementation of the separation of powers, a general safeguard against legislative exercise of the judicial function, or more simply — trial by legislature.” Id. at 442. 97. By singling out Petitioners for legislative punishment, the Act is an unconstitutional bill of attainder. 98. The Act inflicts “pains and penalties” that historically have been associated with bills of attainder. See Nixon v. Adm’r of Gen. Servs., 433 U.S. 425, 474 (1977). Historically, common “pains and penalties” included “punitive confiscation of property by the sovereign” and “a legislative enactment barring designated individuals or groups from participation in specified employments or vocations,” among others. Id. As described above, the Act confiscates Petitioners’ U.S. businesses by forcing ByteDance to shutter them within 270 days or sell on terms that are not commercially, technologically, or legally feasible. See supra ¶¶ 26‒29. For the same reason, the Act bars Petitioners from operating in their chosen line of business. 99. “[V]iewed in terms of the type and severity of burdens imposed” on Petitioners, the Act’s treatment of Petitioners cannot “reasonably . . . be said to further nonpunitive legislative purposes.” Nixon, 433 U.S. at 475–76. The Act transforms Petitioners into a “vilified class” by explicitly prohibiting their current and future operations in the United States, without qualification or limitation, but does not extend the same treatment to other similarly situated companies. Foretich v. United States, 351 F.3d 1198, 1224 (D.C. Cir. 2003). 100. Moreover, in light of the less restrictive alternatives discussed above, there is no justification for automatically barring Petitioners’ current and future operations in the United States (or those of its subsidiaries or successors) in perpetuity without providing them a meaningful opportunity to take corrective action. See Kaspersky Lab, Inc. v. U.S. Dep’t of Homeland Sec., 909 F.3d 446, 456 (D.C. Cir. 2018). Indeed, the Act imposes this punishment uniquely on Petitioners without the process, and presidential determination of a significant national security threat, that Congress has afforded to everyone else. Expressly singling out Petitioners for these punitive burdens while at the same time adopting a statutory standard and decision-making process applicable to every other entity makes clear that Petitioners are subjected to a prohibited legislatively imposed punishment. 101. Moreover, while Petitioners can avoid the Act’s prohibitions only via a wholesale divestment, all other companies — even those with Chinese ownership and determined by the President to present a “significant threat” to U.S. national security — can avoid prohibition simply by operating a website or an application “whose primary purpose is to allow users to post product reviews, business reviews, or travel information and reviews.” Sec. 2(g)(2)(b). 102. Indeed, any other “adversary-controlled” company that operates an application exactly like TikTok, but also operates a website the primary purpose of which is to post product reviews, is left untouched, leaving a ready path for any company but those affiliated with Petitioners to circumvent the Act’s prohibitions altogether. For all practical purposes, then, the Act applies to just one corporate group — it is a “TikTok bill,” as congressional leaders have described it.[30] 103. For all of these reasons, the Act constitutes an unconstitutional bill of attainder. Continue Reading Here. Continue Reading Here . Here About HackerNoon Legal PDF Series: We bring you the most important technical and insightful public domain court case filings. This court case retrieved on May 7, 2024, from sf16-va.tiktokcdn.com is part of the public domain. The court-created documents are works of the federal government, and under copyright law, are automatically placed in the public domain and may be shared without legal restriction. About HackerNoon Legal PDF Series: We bring you the most important technical and insightful public domain court case filings. This court case retrieved on May 7, 2024, from sf16-va.tiktokcdn.com is part of the public domain. The court-created documents are works of the federal government, and under copyright law, are automatically placed in the public domain and may be shared without legal restriction. sf16-va.tiktokcdn.com [30] Rachel Dobkin, Mike Johnson’s Letter Sparks New Flood of Republican Backlash, Newsweek (Apr. 17, 2024), https://perma.cc/Z5HD-7UVU (quoting letter from Speaker Johnson referencing the “TikTok bill”); Senator Chuck Schumer, Majority Leader, to Colleagues (Apr. 5, 2024), https://perma.cc/J7Q4-9PGJ (referencing “TikTok legislation”).

TikTok U.S. Lawsuit: Understanding the Prohibition of Bills of Attainder in Constitutional Law

Imagine you're tasked with implementing a geo-fencing feature for your service. At first glance, dropping in an IP GeoLocation API might seem straightforward, but often, project constraints or requirements complicate the simplest solutions. Let's explore our options. Local GeoIP Database Implementation This method involves embedding a geolocation database directly within your application. It offers fast response times as it resides in-memory and operates independently of external services. However, this approach can be resource-intensive and harder to manage. Let’s see it in more detail. Pros Speed: IP lookups in milliseconds or less.
Reliability: No reliance on third-party services reduces failure chances.
Scalability: No extra costs as usage grows. Cons Resource Intensive: Each app instance consumes significant memory.
More Dependencies: Requires packages for decoding and looking up GeoIP data.
Challenging Updates: Updates require manual intervention or another self-hosted service. Using External GeoIP APIs (Often Paid) Opting for a third-party API to handle geolocation queries reduces your application's resource load and ensures access to the most current data, but it comes with its own challenges: Pros Minimal Resource Use: Outsourcing GeoIP data and logic doesn't burden your app's resources.
Ease of Implementation: Usually involves consuming a standard HTTP/GraphQL or gRPC API endpoint.
Fewer Dependencies: Often only requires an HTTP client.
Updates without hassle: Third-party will handle updates Cons Slower Responses: Calls to third-party services can introduce significant latency.
Increased Unreliability: Greater likelihood of failures due to network issues or third-party downtimes.
Scaling Costs: Costs can escalate as usage increases. Introducing Atlas: Combining the Best of Both Worlds Faced with these challenges, I developed Atlas—a robust solution designed to synergize the benefits of both approaches. Atlas acts as a self-hosting HTTP service that automatically manages and serves the latest MaxMind geolocation databases, providing: Low Latency: Similar to local databases, Atlas offers rapid response times. (often in a few milliseconds) Reliability and Ease of Updates: It autonomously handles database updates, removing the typical maintenance burdens. Cost Efficiency: No additional costs with scale in terms of third-party fees. Dead-Simple API: A very simple API that lets you implement quicker and focus on what matters. Open and Free: Atlas is Open Source and freely available under Apache-2.0 License. By hosting Atlas closer to your application but operating like a remote API, it offers a middle ground that maximizes efficiency without the drawbacks of either method we have discussed. Why Rust? Safe, Performant, and Resource-Efficient Atlas is written in Rust, a language chosen for its unparalleled safety, performance, and resource efficiency. Rust's ownership model ensures memory safety without the need for a garbage collector, which is particularly advantageous during database updates—these operations consume minimal memory, avoiding the typical overhead associated with garbage-collected languages. This design choice not only boosts Atlas's performance but also enhances its reliability, making it an ideal solution for managing GeoIP data efficiently and safely. How to Deploy and Use Atlas? Atlas Docker images are automatically built and pushed to Docker Hub via GitHub Actions, making it easy for anyone to use. For detailed instructions on using these Docker images or building Atlas from source and configuration parameters, please refer to the Atlas README.md. Atlas features a straightforward API, documented with OpenAPI 3.0 Specs. You can access the API documentation from the public internet here: https://atlas-rs.fly.dev/swagger-ui/. Here’s an example of how you can use curl to query the demo instance of Atlas (hosted publicly thanks to Fly.io and the GeoLite2 MaxMind database license) to retrieve country information for an IP address 8.8.8.8: > curl https://atlas-rs.fly.dev/geoip/lookup/country/8.8.8.8 | jq
{
  "results": {
    "8.8.8.8": {
      "country": {
        "iso_code": "US",
        // additional fields...
      },
      // additional results...
    }
  },
  "database_build_epoch": 1715091859
} Please note that this demo instance is intended only for demonstration and documentation purposes. Join the Atlas Community and Contribute As a newly introduced open-source project, Atlas is in the early stages of building its community. I am excited about the potential for Atlas to evolve and thrive with contributions from developers like you. Whether you're interested in refining functionality, adding new features, or simply improving documentation, your contributions are welcome and greatly valued. How You Can Contribute Try Atlas: The best way to start is by using Atlas in your projects. Experiment with it, identify any issues, and suggest improvements based on your real-world usage.


Report Issues: If you encounter any bugs or issues while using Atlas, please report them on the GitHub issues page. This feedback is crucial for continual improvement.


Suggest Features: Have ideas for new features or enhancements? Open a discussion on the GitHub repository or contribute directly by submitting a pull request.


Improve Documentation: As Atlas evolves, so too does the need for clear and comprehensive documentation. Whether it's enhancing the current content or writing tutorials and guides, your knowledge-sharing is invaluable.


Spread the Word: If you find Atlas useful, consider sharing it within your networks. Blog about your experiences, talk about Atlas at meetups, or share it on social media. Commitment to Open Source I am relatively new to Rust but bring many years of experience from other technology stacks. This project presents a great opportunity for more experienced Rust developers to contribute, ensuring that Atlas adheres to Rust's best practices and conventions since I know that it is not as good as it can be right now. I am committed to maintaining Atlas as a community-driven project and believe in open, collaborative development. I am eager to see how the community will shape Atlas's path forward and encourage you to join me in this journey, helping to build a tool that serves the needs of developers globally. In the end, I would like to give a special thanks to oschwald for creating the rust maxminddb crate which made Atlas possible. Future Directions As we continue to develop and improve Atlas, my vision is to create a robust, user-friendly minimal service. As of today, Atlas only supports MaxMind databases, but it would be beneficial to have an extensible implementation so more and more formats can be supported. Another aspect I would like to pay attention to is adding more endpoint types such as gRPC so that users can choose the best endpoint based on their requirements and needs. Thank you for taking the time to learn about Atlas. I am excited to see where we can take this project with your support and collaboration! Imagine you're tasked with implementing a geo-fencing feature for your service. At first glance, dropping in an IP GeoLocation API might seem straightforward, but often, project constraints or requirements complicate the simplest solutions. Let's explore our options. Local GeoIP Database Implementation Local GeoIP Database Implementation This method involves embedding a geolocation database directly within your application. It offers fast response times as it resides in-memory and operates independently of external services. However, this approach can be resource-intensive and harder to manage. Let’s see it in more detail. Pros Speed: IP lookups in milliseconds or less. Reliability: No reliance on third-party services reduces failure chances. Scalability: No extra costs as usage grows. Speed : IP lookups in milliseconds or less. Speed Reliability : No reliance on third-party services reduces failure chances. Reliability Scalability : No extra costs as usage grows. Scalability Cons Resource Intensive: Each app instance consumes significant memory. More Dependencies: Requires packages for decoding and looking up GeoIP data. Challenging Updates: Updates require manual intervention or another self-hosted service. Resource Intensive : Each app instance consumes significant memory. Resource Intensive More Dependencies : Requires packages for decoding and looking up GeoIP data. More Dependencies Challenging Updates : Updates require manual intervention or another self-hosted service. Challenging Updates Using External GeoIP APIs (Often Paid) Using External GeoIP APIs (Often Paid) Opting for a third-party API to handle geolocation queries reduces your application's resource load and ensures access to the most current data, but it comes with its own challenges: Pros Minimal Resource Use: Outsourcing GeoIP data and logic doesn't burden your app's resources. Ease of Implementation: Usually involves consuming a standard HTTP/GraphQL or gRPC API endpoint. Fewer Dependencies: Often only requires an HTTP client. Updates without hassle: Third-party will handle updates Minimal Resource Use : Outsourcing GeoIP data and logic doesn't burden your app's resources. Minimal Resource Use Ease of Implementation : Usually involves consuming a standard HTTP/GraphQL or gRPC API endpoint. Ease of Implementation Fewer Dependencies : Often only requires an HTTP client. Fewer Dependencies Updates without hassle : Third-party will handle updates Updates without hassle Cons Slower Responses: Calls to third-party services can introduce significant latency. Increased Unreliability: Greater likelihood of failures due to network issues or third-party downtimes. Scaling Costs: Costs can escalate as usage increases. Slower Responses : Calls to third-party services can introduce significant latency. Slower Responses Increased Unreliability : Greater likelihood of failures due to network issues or third-party downtimes. Increased Unreliability Scaling Costs : Costs can escalate as usage increases. Scaling Costs Introducing Atlas : Combining the Best of Both Worlds Introducing Atlas Faced with these challenges, I developed Atlas —a robust solution designed to synergize the benefits of both approaches. Atlas acts as a self-hosting HTTP service that automatically manages and serves the latest MaxMind geolocation databases, providing: Atlas Low Latency: Similar to local databases, Atlas offers rapid response times. (often in a few milliseconds) Low Latency : Similar to local databases, Atlas offers rapid response times. (often in a few milliseconds) Low Latency Reliability and Ease of Updates: It autonomously handles database updates, removing the typical maintenance burdens. Reliability and Ease of Updates : It autonomously handles database updates, removing the typical maintenance burdens. Reliability and Ease of Updates Cost Efficiency: No additional costs with scale in terms of third-party fees. Cost Efficiency : No additional costs with scale in terms of third-party fees. Cost Efficiency Dead-Simple API: A very simple API that lets you implement quicker and focus on what matters. Dead-Simple API : A very simple API that lets you implement quicker and focus on what matters. Dead-Simple API Open and Free: Atlas is Open Source and freely available under Apache-2.0 License. Open and Free: Atlas is Open Source and freely available under Apache-2.0 License. Open and Free : Atlas is Open Source and freely available under Apache-2.0 License. Open and Free By hosting Atlas closer to your application but operating like a remote API, it offers a middle ground that maximizes efficiency without the drawbacks of either method we have discussed. Why Rust? Safe, Performant, and Resource-Efficient Why Rust? Atlas is written in Rust, a language chosen for its unparalleled safety, performance, and resource efficiency. Rust's ownership model ensures memory safety without the need for a garbage collector, which is particularly advantageous during database updates—these operations consume minimal memory, avoiding the typical overhead associated with garbage-collected languages. This design choice not only boosts Atlas's performance but also enhances its reliability, making it an ideal solution for managing GeoIP data efficiently and safely. How to Deploy and Use Atlas? Atlas Docker images are automatically built and pushed to Docker Hub via GitHub Actions, making it easy for anyone to use. For detailed instructions on using these Docker images or building Atlas from source and configuration parameters, please refer to the Atlas README.md . Atlas README.md Atlas features a straightforward API, documented with OpenAPI 3.0 Specs. You can access the API documentation from the public internet here: https://atlas-rs.fly.dev/swagger-ui/ . https://atlas-rs.fly.dev/swagger-ui/ Here’s an example of how you can use curl to query the demo instance of Atlas (hosted publicly thanks to Fly.io and the GeoLite2 MaxMind database license) to retrieve country information for an IP address 8.8.8.8 : Fly.io 8.8.8.8 > curl https://atlas-rs.fly.dev/geoip/lookup/country/8.8.8.8 | jq
{
  "results": {
    "8.8.8.8": {
      "country": {
        "iso_code": "US",
        // additional fields...
      },
      // additional results...
    }
  },
  "database_build_epoch": 1715091859
} > curl https://atlas-rs.fly.dev/geoip/lookup/country/8.8.8.8 | jq
{
  "results": {
    "8.8.8.8": {
      "country": {
        "iso_code": "US",
        // additional fields...
      },
      // additional results...
    }
  },
  "database_build_epoch": 1715091859
} Please note that this demo instance is intended only for demonstration and documentation purposes. Please note that this demo instance is intended only for demonstration and documentation purposes. Join the Atlas Community and Contribute Join the Atlas Community and Contribute As a newly introduced open-source project, Atlas is in the early stages of building its community. I am excited about the potential for Atlas to evolve and thrive with contributions from developers like you. Whether you're interested in refining functionality, adding new features, or simply improving documentation, your contributions are welcome and greatly valued. How You Can Contribute Try Atlas: The best way to start is by using Atlas in your projects. Experiment with it, identify any issues, and suggest improvements based on your real-world usage. Report Issues: If you encounter any bugs or issues while using Atlas, please report them on the GitHub issues page. This feedback is crucial for continual improvement. Suggest Features: Have ideas for new features or enhancements? Open a discussion on the GitHub repository or contribute directly by submitting a pull request. Improve Documentation: As Atlas evolves, so too does the need for clear and comprehensive documentation. Whether it's enhancing the current content or writing tutorials and guides, your knowledge-sharing is invaluable. Spread the Word: If you find Atlas useful, consider sharing it within your networks. Blog about your experiences, talk about Atlas at meetups, or share it on social media. Try Atlas: The best way to start is by using Atlas in your projects. Experiment with it, identify any issues, and suggest improvements based on your real-world usage. Try Atlas : The best way to start is by using Atlas in your projects. Experiment with it, identify any issues, and suggest improvements based on your real-world usage. Try Atlas Report Issues: If you encounter any bugs or issues while using Atlas, please report them on the GitHub issues page. This feedback is crucial for continual improvement. Report Issues : If you encounter any bugs or issues while using Atlas, please report them on the GitHub issues page. This feedback is crucial for continual improvement. Report Issues Suggest Features: Have ideas for new features or enhancements? Open a discussion on the GitHub repository or contribute directly by submitting a pull request. Suggest Features : Have ideas for new features or enhancements? Open a discussion on the GitHub repository or contribute directly by submitting a pull request. Suggest Features Improve Documentation: As Atlas evolves, so too does the need for clear and comprehensive documentation. Whether it's enhancing the current content or writing tutorials and guides, your knowledge-sharing is invaluable. Improve Documentation : As Atlas evolves, so too does the need for clear and comprehensive documentation. Whether it's enhancing the current content or writing tutorials and guides, your knowledge-sharing is invaluable. Improve Documentation Spread the Word: If you find Atlas useful, consider sharing it within your networks. Blog about your experiences, talk about Atlas at meetups, or share it on social media. Spread the Word : If you find Atlas useful, consider sharing it within your networks. Blog about your experiences, talk about Atlas at meetups, or share it on social media. Spread the Word Commitment to Open Source I am relatively new to Rust but bring many years of experience from other technology stacks. This project presents a great opportunity for more experienced Rust developers to contribute, ensuring that Atlas adheres to Rust's best practices and conventions since I know that it is not as good as it can be right now. I am committed to maintaining Atlas as a community-driven project and believe in open, collaborative development. I am eager to see how the community will shape Atlas's path forward and encourage you to join me in this journey, helping to build a tool that serves the needs of developers globally. In the end, I would like to give a special thanks to oschwald for creating the rust maxminddb crate which made Atlas possible. special thanks to oschwald oschwald maxminddb Future Directions As we continue to develop and improve Atlas, my vision is to create a robust, user-friendly minimal service. As of today, Atlas only supports MaxMind databases, but it would be beneficial to have an extensible implementation so more and more formats can be supported. Another aspect I would like to pay attention to is adding more endpoint types such as gRPC so that users can choose the best endpoint based on their requirements and needs. Thank you for taking the time to learn about Atlas. I am excited to see where we can take this project with your support and collaboration!

IP Geo-Location: Local Database vs. Remote API—Finding the Middle Ground With Atlas

While hackers don’t differentiate between the size of their victims, certain attacks, like social engineering attacks, are most common in SMBs and SMEs. This blog specifically addresses the unique challenges and threats you may face as a small and medium-sized business or enterprise (SMB/SME) owner. Not for nothing, social engineering attacks are termed – unseen perils, silent threats to your small business and enterprise. Social Engineering Attacks: The Stats and The Reports Picture this: 📌 Per the report by Barracuda, small businesses witness 350% more social engineering attacks than larger enterprises. 📌 More than 30% of small businesses in the US have weak points that threat actors can exploit. 📌 Per the recent Verizon Data Breach Investigation Report, social engineering attacks, system intrusion, and privilege misuse incidents account for 92% of breaches in small businesses. It is essential to understand what a social engineering attack is and how it impacts your small business to understand how it affects you. What Is Social Engineering? As Cisco puts it, social engineering is not a cyberattack at its heart. It is the art of persuasion and human psychology. The modus operandi here is to target the minds of the victims like conmen and gain their trust. With the victims’ trust gained, the attackers go in for the kill by encouraging them to 📍Divulge personal information 📍Click on malicious web links 📍Open malware-infected attachments So, what is Social Engineering? Let’s look at the definition. Social Engineering: The Definition Any manipulation technique that exploits human errors to gain personal information, access, or valuables is a social engineering attack. In technical terms, social engineering is the psychological manipulation of people into divulging confidential information or performing unsafe actions. In layman’s terms, social engineering is an assault on your emotions and feelings to extract sensitive and personal information for malicious purposes. In the world of cybercrime, scams related to human hacking are on the rise. These scams target unsuspecting users, playing tricks with their minds and luring them into revealing sensitive data and confidential information. Social engineering attacks can happen 👉 Online 👉 In-person 👉 Other interactions How Does Social Engineering Work? Social engineering works in four steps. But essentially, it works on your cognitive biases, where a threat actor impersonates either an authoritative person or a trustworthy individual and cons you into trusting them. They work in four steps. Preparation This is where a threat actor collects information about your business, and this may include your business emails, messaging apps, and other sensitive information related to your business. Infiltration This is where a bad actor will approach you or your employees. They usually imitate a reliable resource and use the previously gathered information to validate themselves. Exploitation Here, a threat actor will use persuasion tricks to obtain more sensitive information from your employees or even you. The threat actor plays on the human mind and tricks you into revealing some sensitive information. Disengagement Once an attacker has the information they sought, they will cut off all ties with you, deploy malware in your office network, and disappear in thin air. Why are SMBs and SMEs Prime Targets? Whether you have a small business or a small enterprise, you are at risk of social engineering attacks. Here are the prime reasons threat actors love your small business or your small enterprise. 📍Lack of resources is one of the primary reasons threat actors target your small business or small enterprise. 📍Trusting Culture of SMBs/SMEs is an important reason for threat actors to love small businesses and enterprises. 📍Your overworked and overburdened employees who juggle multiple responsibilities are the prime targets of threat actors. So, how do you counter these attacks on your business? Top Ways To Protect Your Small Business From Social Engineering Social Engineering attacks can be devastating for your small business, and your business may suffer: 📍Significant financial losses 📍Downtime 📍Reputational damage 📍Loss of Stakeholder and customers’ trust You can counter social engineering attacks on your small business with these methods. 📌Train your employees to recognize 📍Phishing emails 📍Suspicious phone calls 📍Unsolicited requests for sensitive data 📌 Verify each email for sender addresses and the legitimacy of the data requests. 📌 Deploy two-factor authentication or multi-factor authentication on all your accounts for better security. 📌 Data encryption is your ally; embrace it with both hands. Encrypt your data at rest and in transition. When you follow these steps, you can ensure that your small business is protected from social engineering attacks. While you are at it, here are some common scams to watch out for. Common Scams to Watch Out For While practicing the four ways you can mitigate the threat of social engineering attacks, keeping an eye on some of the most common scams prevalent is essential. 📌 Phishing 📌 Tech Support Scams 📌 Pretexting 📌 Baiting 📌 Malware 📌 CEO Fraud Each of these scams is also an individual scam, but they can be deployed for sophisticated social engineering attacks. The best method to prevent social engineering attacks is to create awareness about the various tactics used by threat actors. Final Words Social engineering is becoming dangerous because attacks have become sophisticated with tech evolution. Threat actors indulging in social engineering are master con artists who know how to trick you into revealing sensitive information by invoking extreme emotions in you and your employees. So, the best way to protect your small business from social engineering is to educate your employees. While hackers don’t differentiate between the size of their victims, certain attacks, like social engineering attacks, are most common in SMBs and SMEs. This blog specifically addresses the unique challenges and threats you may face as a small and medium-sized business or enterprise (SMB/SME) owner. Not for nothing, social engineering attacks are termed – unseen perils, silent threats to your small business and enterprise. Social Engineering Attacks: The Stats and The Reports Picture this: 📌 Per the report by Barracuda, small businesses witness 350% more social engineering attacks than larger enterprises. 350% more social engineering attacks than larger enterprises. 350% more social engineering attacks than larger enterprises. 📌 More than 30% of small businesses in the US have weak points that threat actors can exploit. 30% of small businesses 30% of small businesses 📌 Per the recent Verizon Data Breach Investigation Report, social engineering attacks, system intrusion, and privilege misuse incidents account for 92% of breaches in small businesses . 92% of breaches in small businesses 92% of breaches in small businesses It is essential to understand what a social engineering attack is and how it impacts your small business to understand how it affects you. What Is Social Engineering? As Cisco puts it, social engineering is not a cyberattack at its heart. It is the art of persuasion and human psychology. Cisco Cisco The modus operandi here is to target the minds of the victims like conmen and gain their trust. With the victims’ trust gained, the attackers go in for the kill by encouraging them to 📍Divulge personal information 📍Click on malicious web links 📍Open malware-infected attachments So, what is Social Engineering? Let’s look at the definition. Social Engineering: The Definition Any manipulation technique that exploits human errors to gain personal information, access, or valuables is a social engineering attack. In technical terms, social engineering is the psychological manipulation of people into divulging confidential information or performing unsafe actions. In layman’s terms, social engineering is an assault on your emotions and feelings to extract sensitive and personal information for malicious purposes. In the world of cybercrime, scams related to human hacking are on the rise. These scams target unsuspecting users, playing tricks with their minds and luring them into revealing sensitive data and confidential information. Social engineering attacks can happen 👉 Online 👉 In-person 👉 Other interactions How Does Social Engineering Work? Social engineering works in four steps. But essentially, it works on your cognitive biases, where a threat actor impersonates either an authoritative person or a trustworthy individual and cons you into trusting them. They work in four steps. Preparation This is where a threat actor collects information about your business, and this may include your business emails, messaging apps, and other sensitive information related to your business. Infiltration This is where a bad actor will approach you or your employees. They usually imitate a reliable resource and use the previously gathered information to validate themselves. Exploitation Here, a threat actor will use persuasion tricks to obtain more sensitive information from your employees or even you. The threat actor plays on the human mind and tricks you into revealing some sensitive information. Disengagement Once an attacker has the information they sought, they will cut off all ties with you, deploy malware in your office network, and disappear in thin air. Why are SMBs and SMEs Prime Targets? Whether you have a small business or a small enterprise, you are at risk of social engineering attacks. Here are the prime reasons threat actors love your small business or your small enterprise. 📍Lack of resources is one of the primary reasons threat actors target your small business or small enterprise. 📍Trusting Culture of SMBs/SMEs is an important reason for threat actors to love small businesses and enterprises. 📍Your overworked and overburdened employees who juggle multiple responsibilities are the prime targets of threat actors. So, how do you counter these attacks on your business? Top Ways To Protect Your Small Business From Social Engineering Social Engineering attacks can be devastating for your small business, and your business may suffer: 📍Significant financial losses 📍Downtime 📍Reputational damage 📍Loss of Stakeholder and customers’ trust You can counter social engineering attacks on your small business with these methods. 📌Train your employees to recognize 📍Phishing emails 📍Suspicious phone calls 📍Unsolicited requests for sensitive data 📌 Verify each email for sender addresses and the legitimacy of the data requests. 📌 Deploy two-factor authentication or multi-factor authentication on all your accounts for better security. 📌 Data encryption is your ally; embrace it with both hands. Encrypt your data at rest and in transition. When you follow these steps, you can ensure that your small business is protected from social engineering attacks. While you are at it, here are some common scams to watch out for. Common Scams to Watch Out For While practicing the four ways you can mitigate the threat of social engineering attacks, keeping an eye on some of the most common scams prevalent is essential. 📌 Phishing 📌 Tech Support Scams 📌 Pretexting 📌 Baiting 📌 Malware 📌 CEO Fraud Each of these scams is also an individual scam, but they can be deployed for sophisticated social engineering attacks. The best method to prevent social engineering attacks is to create awareness about the various tactics used by threat actors. Final Words Social engineering is becoming dangerous because attacks have become sophisticated with tech evolution. Threat actors indulging in social engineering are master con artists who know how to trick you into revealing sensitive information by invoking extreme emotions in you and your employees. So, the best way to protect your small business from social engineering is to educate your employees.

Social Engineering Attacks: One of the Biggest and Quietest Threats to Your Business

Design Systems: A Front-End Engineer's Guide to Efficient Atomic Design

Authors: (1) Renato P. dos Santos, CIAGE – Centre for Generative Artificial Intelligence in Cognition and Education. Table of Links Abstract and Introduction Materials And Methods Results and Analyses Prompts and generated texts Conceptualizing chemical reactions Deepening on understanding of chemical reactions Question about combustion Question about a graph of gases turning into water over time Question about the difference between atoms, molecules, and moles Deepening on the concept of mole Question about changing of state Question about an animated representation of water molecules undergoing phase changes Question about plasma, a state of matter Question about chemical bondings Question about illustration of chemical bonds Question about the essence of the type of chemical bonding Further analysis Conclusions Limitations of the study and possible future studies Author Contributions, Conflicts of interest, Acknowledgements, and References Deepening on the concept of mole P1: so can you talk about a mole of beer bottles? ChatGPT: Absolutely! The concept of a "mole" isn't exclusive to atoms or molecules; it's simply a specific quantity. In the realm of chemistry, one mole always refers to 6.022 x 10[23] of some entity, whether that's atoms, molecules, electrons, or even beer bottles. So, when we say "a mole of beer bottles," we're referring to 6.022 x 10[23] beer bottles. That's aLOT of beer bottles! However, it's worth noting that outside of a chemistry context, using "mole" to refer to quantities of everyday items might be confusing. In everyday language, we have other terms for large quantities, like "dozen" (for 12 of something) or "gross" (for 144 of something). But theoretically, yes, you can have a mole of anything, including beer bottles. Just to give you a sense of how large this number is: If you were to try and count to Avogadro's number at a rate of one number per second, it would take you more than 19 billion years! Would you like to explore more about the implications of having a mole of beer bottles or any other fun examples? *: Yes, I can talk about a mole of beer bottles, but it might not be very practical. A mole of beer bottles is a very large number of beer bottles, much more than you can ever drink or see in your lifetime. Let me explain why.* BingChat A mole of beer bottles is the amount of beer bottles that contains as many bottles as there are atoms in 12 grams of carbon-12. This number is approximately 6.022 x 10[23], which is a very big number. To give you some idea of how big this number is, here are some comparisons: • If you had a mole of beer bottles, you could cover the entire surface of the Earth with about 100 layers of beer bottles. • If you had a mole of beer bottles, you could fill up the Pacific Ocean with beer bottles about 30 times. • If you had a mole of beer bottles, you could stack them up to reach the moon and back about 2000 times. As you can see, a mole of beer bottles is a huge amount of beer bottles that is impossible to handle or imagine. That’s why chemists use the mole as a unit of measurement for atoms and molecules, which are very small and numerous, rather than for everyday objects like beer bottles. A mole of atoms or molecules has a mass that is easy to measure and compare with other substances. For example, one mole of oxygen gas has a mass of 32 grams, and one mole of water has a mass of 18 grams. So, to summarize, a mole of beer bottles is a hypothetical amount of beer bottles that contains 6.022 x 10[23] bottles. This number is so large that it is not useful or meaningful for describing real-world situations. A mole is more suitable for measuring the amount of atoms or molecules in a substance. I hope this helps you understand what a mole of beer bottles means. *: Yes, I can talk about a mole of beer bottles.* Bard A mole of beer bottles is a unit of measurement that is used to count beer bottles. One mole of beer bottles contains 6.02214076×10^23 beer bottles. This number is known as Avogadro's constant. To put this into perspective, a mole of beer bottles is a lot of beer bottles! It would take over 100 billion years to count them all, at a rate of one bottle per second. Of course, no one has ever seen a mole of beer bottles in real life. It is a theoretical concept that is used by chemists to count atoms and molecules. But that doesn't mean that we can't have fun thinking about it. What would a mole of beer bottles look like? How much would it weigh? How much beer would it contain? If we assume that each beer bottle is 12 ounces, then a mole of beer bottles would weigh over 100 million pounds. And it would contain over 700 million gallons of beer! That's a lot of beer! So, next time you're enjoying a cold beer with your friends, take a moment to think about themole of beer bottles that it represents. It's a truly mind-boggling concept. *: Sure, I'm happy to explain the concept of a mole using beer bottles as an example.* Claude A mole represents a specific number - 6.02 x 10^23 - of anything, whether atoms, molecules, or objects like beer bottles. Let's imagine a mole of beer bottles. That would be 6.02 x 10^23 individual bottles. That's a huge number of bottles! To put it in perspective: • If you had 1 mole of beer bottles and stacked them on top of each other, the stack would reach about 1.5 billion light years tall - that's halfway across the observable universe! • If you lined up 1 mole of beer bottles side by side, the line would stretch for 9 trillion kilometers - over 200 times the distance between Earth and Pluto. • If you purchased 1 mole of beer bottles at $10 per bottle, it would cost 60.2 sextillion dollars - way more than the GDP of Earth! So a mole represents an enormous number of things. It's very useful in chemistry for relating atomic/molecular masses to measurable macroscopic masses. For example, if you know the mass of 1 mole of carbon atoms, you can use that to calculate how many carbon atoms are in a certain macroscopic sample. Hope this silly example with beer bottles helps give you an idea of just how huge a mole really is! Let me know if you need any clarification or want to go through more practice problems applying the mole concept. starts with “Absolutely!” offering . It then discusses the "mole" concept using by noting that while it is a "specific quantity" in the "realm of chemistry," it is not exclusively tied to "atoms" or "molecules" and enters a Meta-discussion & Perspective Framing by conceding that "outside of a chemistry context," the general use of the word ‘mole’ “might be confusing”. Proceeding further, the explanation by making analogies with everyday terms like "dozen" and "gross", also with the . The perspective on counting to Avogadro's number “to give a sense” of how large this number is and the final invitation to discuss "implications" or "any other fun examples" leans into . also starts by offering , conceding that “Yes”, one “can talk about a mole of beer bottles” but right after turns to , by referring that “it might not be very practical” and later that “it is not useful or meaningful for describing real-world situations”. It then provides a detailed explanation of the mole concept, highlighting the enormousness of "6.022 x 10^23" through real-world scenarios like covering the "Earth" or filling the "Pacific Ocean", which emphasises the . Categorisation of the mole as primarily for counting "atoms/molecules" again showcases , while providing an example of the application of the concept to oxygen gas aligns with the . The closing “I hope this helps” followed by an emoji implies a touch of . likewise starts with “Yes, I can talk about a mole of beer bottles,” offering . It then engages the reader with the enormity of "6.02214076×10^23 beer bottles", by undergoing a detailed calculation of “What would a mole of beer bottles? look like”, offering perspectives on time ("100 billion years") and volume ("700 million gallons of visualisation and “To put this into perspective”, aligning with . Highlighting it as a "theoretical concept" "used by chemists emphasises and the jovial remark about enjoying beer with friendly tone emphasising the mind-bogglingness of the indicates . Claude starts with , accepting beer bottles as an example to breakdown of the mole concept and its application as a “specific number,” “very useful in chemistry,” that may be applied to count “anything”. It then invites one to “imagine a mole of beer bottles”, which would be “a ,huge number” and puts “it in perspective”, drawing vivid pictures such as a stack reaching "1.5 billion light years", a line stretching "200 times the distance between Earth and Pluto," and the cost of “60.2 sextillion dollars,” underscoring the . The closing “Hope this silly example” and followed by invitation for more "practice problems" or “clarifications” hints at . Nevertheless, while the use of the word "silly" by Claude might intend to suggest that the example provided is not to be taken too seriously or is trivial in nature, it also could be perceived as a bit demeaning or dismissive, negatively impacting the category. ChatGPT Personalization & Personable Touch Instructional Strategies Use of Analogy & Comparative Illustrations Engagement & Interactivity BingChat Personalization & Personable Touch Instructional Strategies Use of Analogy & Comparative Illustrations Instructional Strategies Use of Analogy & Comparative Illustrations Personalization & Personable Touch Bard Personalization & Personable Touch Use of Analogy & Comparative Illustrations Instructional Strategies Personalization & Personable Touch Instructional Strategies Use of Analogy & Comparative Illustrations Reinforcement & Feedback Personalization & Personable Touch This paper is under CC BY-SA 4.0 DEED license. available on arxiv

How GenAIbots Demystify Mole Concept, Avogadro’s Number, Atoms, and Molecules

কিভাবে GenAIbots মোল ধারণা, অ্যাভোগাড্রোর সংখ্যা, পরমাণু এবং অণুগুলিকে ডিমিস্টিফাই করে

Wie GenAIbots das Mole-Konzept, die Avogadro-Zahl, Atome und Moleküle entmystifizieren

Cómo los GenAIbots desmitifican el concepto de mole, el número de Avogadro, los átomos y las moléculas

Comment les GenAIbots démystifient le concept de taupe, le nombre d'Avogadro, les atomes et les molécules

GenAIbots ने मोल अवधारणा, एवोगैड्रो संख्या, परमाणु और अणुओं के रहस्य को कैसे उजागर किया

GenAIbots がモル概念、アボガドロ数、原子、分子を解明する方法

GenAIbot이 두더지 개념, 아보가드로의 수, 원자 및 분자를 이해하는 방법

Como GenAIbots desmistificam o conceito de toupeira, número de Avogadro, átomos e moléculas

Как GenAIbots демистифицируют концепцию кротов, число Авогадро, атомы и молекулы

GenAIbotlar Köstebek Kavramını, Avogadro Sayısını, Atomları ve Molekülleri Nasıl Aydınlatıyor?

Cách GenAIbots làm sáng tỏ khái niệm nốt ruồi, số lượng, nguyên tử và phân tử của Avogadro

GenAIbots 如何揭开摩尔概念、阿伏伽德罗常数、原子和分子的神秘面纱

Authors: (1) Renato P. dos Santos, CIAGE – Centre for Generative Artificial Intelligence in Cognition and Education. Table of Links Abstract and Introduction Materials And Methods Results and Analyses Prompts and generated texts Conceptualizing chemical reactions Deepening on understanding of chemical reactions Question about combustion Question about a graph of gases turning into water over time Question about a graph of gases turning into water over time Question about changing of state Question about an animated representation of water molecules undergoing phase changes Question about plasma, a state of matter Question about chemical bondings Question about illustration of chemical bonds Question about the essence of the type of chemical bonding Further analysis Conclusions Limitations of the study and possible future studies Author Contributions, Conflicts of interest, Acknowledgements, and References Question about the difference between atoms, molecules, and moles : P1 ah. this thing also confuses me. what is the difference between atom, molecule and mole? ChatGPT: Certainly, it's a common area of confusion for many students. Let's break it down one by one, using simple analogies: 1. Atom: • Imagine an atom as a single LEGO brick. It's the tiniest piece of an element that still retains the properties of that element. Just like a single red LEGO brick represents the color red, a single hydrogen atom represents the element hydrogen. 2. Molecule: • When you connect several LEGO bricks together, you form a structure. In chemistry, when you connect several atoms together, you form a molecule. For instance, two hydrogen atoms (H) can connect to form a hydrogen molecule (H2). Similarly, two hydrogen atoms and one oxygen atom can connect to form a water molecule (H2O). ***3. Mole: *** • This one's a bit more abstract. Let's say you have a big box filled with identical LEGO structures (say, LEGO houses). If you count them and find there are exactly 6.022 x 1023 LEGO houses in that box, you have a "mole" of LEGO houses. • In chemistry, a mole is a specific number of things (atoms, molecules, electrons, etc.). Specifically, one mole of any substance contains exactly 6.022 x 10[23] of those entities. This number is called Avogadro's number. • The concept of a mole is a standardized way to talk about quantities in chemistry, much like a "dozen" is a standardized way to talk about 12 of something. So, to recap: • : Smallest unit of an element. Atom • : Made up of multiple atoms bonded together. Molecule • : A specific quantity (6.022 x 10[23]) of atoms, molecules, or other entities. Mole Do these analogies help clarify the differences for you? BingChat: I see that you are confused about the difference between atom, molecule and mole. These are three important terms in chemistry that describe different aspects of matter. Let me try to explain them to you in a simple way. An atom is the smallest unit of an element that retains its chemical identity. An element is a pure substance that consists of only one type of atom. For example, hydrogen, oxygen, carbon, and gold are elements. Each element has a unique symbol and atomic number that indicates how many protons it has in its nucleus. For example, hydrogen has the symbol H and atomic number 1, meaning it has one proton in its nucleus. Atoms are composed of subatomic particles such as protons, neutrons, and electrons. Protons and neutrons are found in the nucleus, and electrons orbit around the nucleus in shells or orbitals. The number of electrons in an atom determines its chemical behavior and reactivity [ ] 12 A molecule is a group of two or more atoms that are held together by chemical bonds. A chemical bond is a force of attraction between atoms that share or transfer electrons. There are different types of chemical bonds, such as covalent, ionic, metallic, and hydrogen bonds. A molecule can be composed of atoms of the same element or different elements. For example, oxygen gas (O2) is a molecule composed of two oxygen atoms bonded by a covalent bond. Water (H2O) is a molecule composed of two hydrogen atoms and one oxygen atom bonded by covalent bonds. A molecule has a specific shape and structure that determines its physical and chemical properties[ ]. 32 A mole is a unit of measurement that is used to count the number of atoms or molecules in a given amount of substance. A mole is defined as the amount of substance that contains as many particles (atoms or molecules) as there are atoms in 12 grams of carbon-12. This number is called Avogadro’s number and it is approximately 6.022 x 10[23]. That means one mole of any substance contains 6.022 x 10[23] particles (atoms or molecules). For example, one mole of oxygen gas contains 6.022 x 10[23] molecules of O2, and one mole of water contains 6.022 x 1023 molecules of H2O. The mass of one mole of a substance is called its molar mass and it is equal to its molecular weight in grams. For example, the molecular weight of oxygen gas is 32 g/mol and the molecular weight of water is 18 g/mol[ ]. 42 So, to summarize, an atom is the smallest unit of an element, a molecule is a group of atoms bonded together, and a mole is a unit of measurement that counts the number of particles in a substance. I hope this helps you understand the difference between atom, molecule and mole. :) *: An atom is the smallest unit of matter that still has all of the properties of its element. An element is a substance that cannot be broken down into simpler substances by chemical means.* Bard A molecule is a group of two or more atoms held together by chemical bonds. A chemical bond is a force that holds atoms together. A mole is a unit of measurement that is used to count atoms and molecules. One mole of any substance contains 6.02214076×10^23 particles of that substance. This number is known as Avogadro's constant. Here is a table that summarizes the key differences between atoms, molecules, and moles: Here are some examples of atoms, molecules, and moles: • Atoms: Hydrogen (H), helium (He), oxygen (O), carbon (C) • Molecules: Water (H2O), carbon dioxide (CO2), methane (CH4) • Moles: One mole of hydrogen atoms, one mole of water molecules, one mole of carbon dioxide molecules I hope this helps to explain the difference between atoms, molecules, and moles. Please let me know if you have any other questions. *: Excellent question! Those three terms can definitely be confusing. Let's go through them one-by-one:* Claude Atom - The basic building block of matter. Atoms are made up of protons, neutrons, and electrons. An atom is the smallest unit of an element that maintains the properties of that element. For example, a hydrogen atom has 1 proton; a carbon atom has 6 protons. Molecule - A group of two or more atoms bonded together. A molecule is the smallest unit of a chemical compound that maintains the properties of that compound. For example, a water molecule contains 2 hydrogen atoms and 1 oxygen atom bonded together (H2O). Mole - This is a number representing 6.02 x 10^23 things. It's usually used to represent a certain quantity of atoms or molecules. For example, 1 mole of carbon contains 6.02 x 10^23 carbon atoms. So in summary: • Atoms are the basic units of elements • Molecules are groups of bonded atoms that make up compounds • Moles are a way to represent 6.02 x 10^23 of something (useful for relating atomic/molecular masses to macroscopic masses) Let me know if this helps explain the distinction between these three important chemistry concepts! I'm happy to provide more examples as well. , by saying “Certainly, it's a common area of confusion for many students”, recognises a element by acknowledging the difficulty many students face. By saying, "Let's break it down one by one," it demonstrates Instructional strategy. The phrase “using simple analogies" clearly indicates the use of , while the question "Do these analogies help clarify?" shows an component by asking for feedback. saying "I see that you are confused" provides , while the phrase "Let me try to explain" indicates an Instructional Strategy and "in a simple way" attempts at by simplifying the information. Finally, "I hope this helps" and the inclusion of the smiley emoticon ":)" are gestures for Personalization & Pe , by explaining "An atom is..." and, later, offering "Here is a table," appeals to an , demonstrated by definition-based learning and visual data organisation, concluding with "I hope this helps" and “Please let me know if you have any other questions” demonstrates and . , by starting with “Excellent question" and acknowledging that the subject “can definitely be confusing,” recognises gives Reinforcement & feedback. It then invites, "Let's go through them one-by-one," pointing to an Instructional Strategy through systematic explanation. It also uses by providing two examples. It concludes with "Let me know if this helps," an element, and encouraging feedback. ChatGPT Reinforcement & Feedback Analogy & Comparative Illustrations Engagement & interactivity BingChat Reinforcement & Feedback Detail Depth & Content Recommendation rsonable Touch. Bard Instructional Strategy Engagement & Interactivity Reinforcement & Feedback Claude Analogy & Comparative Illustrations Engagement & Interactivity This paper is under CC BY-SA 4.0 DEED license. available on arxiv

How GenAIbots Explain the Difference Between Atoms, Molecules, and Moles

কিভাবে GenAIbots পরমাণু, অণু এবং মোলের মধ্যে পার্থক্য ব্যাখ্যা করে

Wie GenAIbots den Unterschied zwischen Atomen, Molekülen und Molen erklären

Cómo los GenAIbots explican la diferencia entre átomos, moléculas y moles

Comment les GenAIbots expliquent la différence entre les atomes, les molécules et les taupes

GenAIbots परमाणुओं, अणुओं और मोल्स के बीच अंतर कैसे समझाते हैं

GenAIbots が原子、分子、モルの違いを説明する方法

GenAIbot이 원자, 분자, 두더지의 차이점을 설명하는 방법

Como GenAIbots explicam a diferença entre átomos, moléculas e toupeiras

Как GenAIbots объясняют разницу между атомами, молекулами и кротами

GenAIbotlar Atomlar, Moleküller ve Benler Arasındaki Farkı Nasıl Açıklıyor?

Cách GenAIbots giải thích sự khác biệt giữa nguyên tử, phân tử và nốt ruồi

GenAIbots 如何解释原子、分子和摩尔之间的区别

Last week, two remarkable events occurred: Meta announced its Llama 3, the most capable and highly anticipated open large language model (LLM) to date, and Boston Dynamics introduced its new fully electric Atlas robot platform — a stark departure from their hydraulic robots! At first glance, these developments may seem unrelated, but they are actually deeply interconnected, with the potential to synergistically drive each other forward and reshape how we work with and implement AI. At the heart of this connection is the transformative power of advanced AI. Breakthroughs in natural language processing and machine learning, exemplified by Llama 3, extend beyond language alone. These techniques, from deep neural networks to reinforcement learning, are also propelling significant advancements in computer vision, motion planning, and robot control. As language models like Llama 3 continue to expand the boundaries of AI’s ability to understand and interact with the world, they also lay the groundwork for more intelligent and capable robots. The implications, of course, extend beyond communication. The same techniques used to train LLMs on vast amounts of text data are also applicable to learning from massive datasets of sensor readings, images, and simulations for robots. Moreover, the open-source nature of models like Llama 3 democratizes access to state-of-the-art AI, enabling a broader spectrum of researchers and companies to integrate these capabilities into their robotic systems. At least start playing on that field! Every successful (and unsuccessful) attempt by Atlas to manipulate an object, navigate a cluttered factory floor, or assist a human worker becomes a valuable data point for the model, just as it does for Llama 3. Using this innovative model, Meta developed a standalone app, meta.ai, and embedded it into WhatsApp, Instagram, and Facebook, collecting vast and highly personalized data. This could lead us toward synthetic social networks or — which is more likely — an extremely personalized, embodied AI experience. As Llama 3 and the electric Atlas converge, they may accelerate each other’s development, blurring the lines between software and hardware, bits and atoms. As language models become more proficient at understanding and interacting with the world, robots will become more capable of applying that knowledge. This doesn’t necessarily mean evil. More capable and advanced robots, which can be fine-tuned and improved with your personal data and specifics, could take over mundane tasks at home. Imagine, instead of hundreds of text editors, finally having a robot that can load and unload the dishwasher and do the laundry. Currently, launches like Llama 3 are seen as enhancing AI’s understanding and processing capabilities, but in the long term, they will be one of the milestones in building and deploying machines that are finely attuned and aligned with us to assist in our daily lives. https://youtu.be/29ECwExc-_M?si=UyexFH1jOfd5TGY9&embedable=true Other Impressive Models: (I didn’t send you the FOD digest last Monday because I was at a conference dedicated to citizen diplomacy. Therefore, today, we have an extensive list of recently launched models that are worth checking out, along with other relevant research papers.) Mixtral-8x22B: Mistral AI introduced a scalable sparse mixture of expert models optimizing cost and latency by selectively using parameters during inference, offering a high capacity and efficiency model for further training and applications →read the paper
Rerank 3: Launched by Cohere, this model enhances enterprise search and Retrieval Augmented Generation systems, improving accuracy in document retrieval across multiple languages and data formats →read the paper
Idefics2: Hugging Face's model that excels in integrating text and image data, significantly improving on OCR and visual question-answering tasks →read the paper
Reka Core, Flash, and Edge: A series of multimodal language models from Reka that process text, images, video, and audio, demonstrating high performance across diverse tasks →read the paper
Ferret-UI: Developed by Apple, this model specializes in mobile UI interaction, enhancing user experience by accurately performing tasks tailored to the unique properties of UI screens →ead the paper
Zamba: Zyphra's compact and efficient SSM Hybrid model is designed for performance with reduced training data needs, optimized for consumer hardware →read the paper
YaART: Yandex's advanced text-to-image diffusion model that optimizes training efficiency and quality with smaller, high-quality datasets →read the paper
RHO-1: A novel approach by Xiamen University focusing on Selective Language Modeling to enhance efficiency by prioritizing useful tokens during training →read the paper
RecurrentGemma: Google DeepMind's model that moves past traditional transformers by incorporating recurrences for more efficient long-sequence processing →read the paper
JetMoE: An economical LLM from the MIT-IBM Watson AI Lab using a mixture-of-experts architecture to achieve high performance at reduced costs →read the paper News from The Usual Suspects © Google open-sourced Gemini Cookbook
and is merging its Research, DeepMind, and Responsible AI teams to accelerate its “capacity to deliver capable AI”
DeepMind published an article about the ethics of advanced AI assistants, stressing the significance of their integration into daily life Hugging Face https://x.com/QGallouedec/status/1782430246957994422?embedable=true Stanford published the 2024 AI Index report, reflecting the escalating impact of AI on society. It contains data with new estimates on AI training costs and detailed insights into the responsible AI landscape. It also introduces a new chapter on AI's influence on science and medicine. Highlights include the substantial cost of training state-of-the-art models, such as GPT-4 and Gemini Ultra; the dominance of the U.S. in producing top AI models; and significant investment growth in generative AI despite overall funding declines. Additionally, the report notes a major increase in AI-related regulations in the U.S. and heightened public awareness and nervousness about AI's future impact. Enjoyed This Story? I write a weekly analysis of the AI world in the Turing Post newsletter. We aim to equip you with comprehensive knowledge and historical insights so you can make informed decisions about AI and ML. Last week, two remarkable events occurred: Meta announced its Llama 3 , the most capable and highly anticipated open large language model (LLM) to date, and Boston Dynamics introduced its new fully electric Atlas robot platform — a stark departure from their hydraulic robots! At first glance, these developments may seem unrelated, but they are actually deeply interconnected, with the potential to synergistically drive each other forward and reshape how we work with and implement AI. Llama 3 Llama 3 electric Atlas robot electric Atlas robot At the heart of this connection is the transformative power of advanced AI. Breakthroughs in natural language processing and machine learning, exemplified by Llama 3, extend beyond language alone. These techniques, from deep neural networks to reinforcement learning, are also propelling significant advancements in computer vision, motion planning, and robot control. As language models like Llama 3 continue to expand the boundaries of AI’s ability to understand and interact with the world, they also lay the groundwork for more intelligent and capable robots. The implications, of course, extend beyond communication. The same techniques used to train LLMs on vast amounts of text data are also applicable to learning from massive datasets of sensor readings, images, and simulations for robots. Moreover, the open-source nature of models like Llama 3 democratizes access to state-of-the-art AI, enabling a broader spectrum of researchers and companies to integrate these capabilities into their robotic systems. At least start playing on that field! Every successful (and unsuccessful) attempt by Atlas to manipulate an object, navigate a cluttered factory floor, or assist a human worker becomes a valuable data point for the model, just as it does for Llama 3. Using this innovative model, Meta developed a standalone app, meta.ai , and embedded it into WhatsApp, Instagram, and Facebook, collecting vast and highly personalized data. This could lead us toward synthetic social networks or — which is more likely — an extremely personalized, embodied AI experience. As Llama 3 and the electric Atlas converge, they may accelerate each other’s development, blurring the lines between software and hardware, bits and atoms. As language models become more proficient at understanding and interacting with the world, robots will become more capable of applying that knowledge. meta.ai meta.ai synthetic social networks synthetic social networks This doesn’t necessarily mean evil. More capable and advanced robots, which can be fine-tuned and improved with your personal data and specifics, could take over mundane tasks at home. Imagine, instead of hundreds of text editors, finally having a robot that can load and unload the dishwasher and do the laundry. Currently, launches like Llama 3 are seen as enhancing AI’s understanding and processing capabilities, but in the long term, they will be one of the milestones in building and deploying machines that are finely attuned and aligned with us to assist in our daily lives. https://youtu.be/29ECwExc-_M?si=UyexFH1jOfd5TGY9&embedable=true https://youtu.be/29ECwExc-_M?si=UyexFH1jOfd5TGY9&embedable=true Other Impressive Models: (I didn’t send you the FOD digest last Monday because I was at a conference dedicated to citizen diplomacy. Therefore, today, we have an extensive list of recently launched models that are worth checking out, along with other relevant research papers.) (I didn’t send you the FOD digest last Monday because I was at a conference dedicated to citizen diplomacy. Therefore, today, we have an extensive list of recently launched models that are worth checking out, along with other relevant research papers.) Mixtral-8x22B: Mistral AI introduced a scalable sparse mixture of expert models optimizing cost and latency by selectively using parameters during inference, offering a high capacity and efficiency model for further training and applications →read the paper Rerank 3: Launched by Cohere, this model enhances enterprise search and Retrieval Augmented Generation systems, improving accuracy in document retrieval across multiple languages and data formats →read the paper Idefics2: Hugging Face's model that excels in integrating text and image data, significantly improving on OCR and visual question-answering tasks →read the paper Reka Core, Flash, and Edge: A series of multimodal language models from Reka that process text, images, video, and audio, demonstrating high performance across diverse tasks →read the paper Ferret-UI: Developed by Apple, this model specializes in mobile UI interaction, enhancing user experience by accurately performing tasks tailored to the unique properties of UI screens →ead the paper Zamba: Zyphra's compact and efficient SSM Hybrid model is designed for performance with reduced training data needs, optimized for consumer hardware →read the paper YaART: Yandex's advanced text-to-image diffusion model that optimizes training efficiency and quality with smaller, high-quality datasets →read the paper RHO-1: A novel approach by Xiamen University focusing on Selective Language Modeling to enhance efficiency by prioritizing useful tokens during training →read the paper RecurrentGemma: Google DeepMind's model that moves past traditional transformers by incorporating recurrences for more efficient long-sequence processing →read the paper JetMoE: An economical LLM from the MIT-IBM Watson AI Lab using a mixture-of-experts architecture to achieve high performance at reduced costs →read the paper Mixtral-8x22B: Mistral AI introduced a scalable sparse mixture of expert models optimizing cost and latency by selectively using parameters during inference, offering a high capacity and efficiency model for further training and applications →read the paper Mixtral-8x22B: →read the paper Rerank 3: Launched by Cohere, this model enhances enterprise search and Retrieval Augmented Generation systems, improving accuracy in document retrieval across multiple languages and data formats →read the paper Rerank 3: →read the paper Idefics2: Hugging Face's model that excels in integrating text and image data, significantly improving on OCR and visual question-answering tasks →read the paper Idefics2: →read the paper Reka Core, Flash, and Edge: A series of multimodal language models from Reka that process text, images, video, and audio, demonstrating high performance across diverse tasks →read the paper Reka Core, Flash, and Edge: →read the paper Ferret-UI: Developed by Apple, this model specializes in mobile UI interaction, enhancing user experience by accurately performing tasks tailored to the unique properties of UI screens →ead the paper Ferret-UI: →ead the paper Zamba: Zyphra's compact and efficient SSM Hybrid model is designed for performance with reduced training data needs, optimized for consumer hardware →read the paper Zamba: →read the paper YaART: Yandex's advanced text-to-image diffusion model that optimizes training efficiency and quality with smaller, high-quality datasets →read the paper YaART: →read the paper RHO-1: A novel approach by Xiamen University focusing on Selective Language Modeling to enhance efficiency by prioritizing useful tokens during training →read the paper RHO-1: →read the paper RecurrentGemma: Google DeepMind's model that moves past traditional transformers by incorporating recurrences for more efficient long-sequence processing →read the paper RecurrentGemma: →read the paper JetMoE: An economical LLM from the MIT-IBM Watson AI Lab using a mixture-of-experts architecture to achieve high performance at reduced costs →read the paper JetMoE: →read the paper News from The Usual Suspects © Google Google open-sourced Gemini Cookbook and is merging its Research, DeepMind, and Responsible AI teams to accelerate its “capacity to deliver capable AI” DeepMind published an article about the ethics of advanced AI assistants, stressing the significance of their integration into daily life open-sourced Gemini Cookbook Gemini Cookbook and is merging its Research, DeepMind, and Responsible AI teams to accelerate its “ capacity to deliver capable AI ” merging capacity to deliver capable AI DeepMind published an article about the ethics of advanced AI assistants, stressing the significance of their integration into daily life published Hugging Face Hugging Face https://x.com/QGallouedec/status/1782430246957994422?embedable=true https://x.com/QGallouedec/status/1782430246957994422?embedable=true Stanford Stanford published the 2024 AI Index report, reflecting the escalating impact of AI on society. It contains data with new estimates on AI training costs and detailed insights into the responsible AI landscape. It also introduces a new chapter on AI's influence on science and medicine. Highlights include the substantial cost of training state-of-the-art models, such as GPT-4 and Gemini Ultra; the dominance of the U.S. in producing top AI models; and significant investment growth in generative AI despite overall funding declines. Additionally, the report notes a major increase in AI-related regulations in the U.S. and heightened public awareness and nervousness about AI's future impact. published the 2024 AI Index report , reflecting the escalating impact of AI on society. It contains data with new estimates on AI training costs and detailed insights into the responsible AI landscape. It also introduces a new chapter on AI's influence on science and medicine. Highlights include the substantial cost of training state-of-the-art models, such as GPT-4 and Gemini Ultra; the dominance of the U.S. in producing top AI models; and significant investment growth in generative AI despite overall funding declines. Additionally, the report notes a major increase in AI-related regulations in the U.S. and heightened public awareness and nervousness about AI's future impact. the 2024 AI Index report Enjoyed This Story? I write a weekly analysis of the AI world in the Turing Post newsletter. We aim to equip you with comprehensive knowledge and historical insights so you can make informed decisions about AI and ML. Turing Post

AI Industries Converge: Llama 3 and Electric Atlas Have More In Common Than You Think

Authors:
(1) Maria Rigaki, Faculty of Electrical Engineering, Czech Technical University in Prague, Czech Republic and maria.rigaki@fel.cvut.cz;
(2) Sebastian Garcia, Faculty of Electrical Engineering, Czech Technical University in Prague, Czech Republic and sebastian.garcia@agents.fel.cvut.cz. Table of Links Abstract & Introduction Threat Model Background and Related Work Methodology Experiments Setup Results Discussion Conclusion, Acknowledgments, and References Appendix 2 Threat Model The threat model for this work assumes an attacker that only has black-box access to a target (classifier or AV) during the inference phase and can submit binary files for static scanning. The target provides binary labels (0 if benign, 1 if malicious). The attacker has no or limited information about the target architecture and training process, and they aim to evade it by modifying the malware in a functionality-preserving manner. In the case of classifiers, the attacker may have some knowledge of the extracted features, but this is not the case for antivirus systems. Some knowledge of the training data distribution is assumed. However, it may only be partially necessary. Finally, the attacker aims to minimize the interaction with the target by submitting as few queries as possible. This paper is available on arxiv under CC BY-NC-SA 4.0 DEED license. Authors: (1) Maria Rigaki, Faculty of Electrical Engineering, Czech Technical University in Prague, Czech Republic and maria.rigaki@fel.cvut.cz; (2) Sebastian Garcia, Faculty of Electrical Engineering, Czech Technical University in Prague, Czech Republic and sebastian.garcia@agents.fel.cvut.cz. Authors: Authors: (1) Maria Rigaki, Faculty of Electrical Engineering, Czech Technical University in Prague, Czech Republic and maria.rigaki@fel.cvut.cz; (2) Sebastian Garcia, Faculty of Electrical Engineering, Czech Technical University in Prague, Czech Republic and sebastian.garcia@agents.fel.cvut.cz. Table of Links Abstract & Introduction Abstract & Introduction Threat Model Threat Model Background and Related Work Background and Related Work Methodology Methodology Experiments Setup Experiments Setup Results Results Discussion Discussion Conclusion, Acknowledgments, and References Conclusion, Acknowledgments, and References Appendix Appendix 2 Threat Model The threat model for this work assumes an attacker that only has black-box access to a target (classifier or AV) during the inference phase and can submit binary files for static scanning. The target provides binary labels (0 if benign, 1 if malicious). The attacker has no or limited information about the target architecture and training process, and they aim to evade it by modifying the malware in a functionality-preserving manner. In the case of classifiers, the attacker may have some knowledge of the extracted features, but this is not the case for antivirus systems. Some knowledge of the training data distribution is assumed. However, it may only be partially necessary. Finally, the attacker aims to minimize the interaction with the target by submitting as few queries as possible. This paper is available on arxiv under CC BY-NC-SA 4.0 DEED license. This paper is available on arxiv under CC BY-NC-SA 4.0 DEED license. available on arxiv

Understanding the Threat Model: Black-Box Attacks on Malware Detection Systems

Unlike most prognosticators in the cyber industry, I will try not to inflame the hype of yet another doomsday, the sky is falling discussion on the newest threat vector. Over the past quarter in particular, that has been Generative AI (GenAI). This technology has even captured the minds (and fears) of the C-Suite and Boardrooms, quite a bit differently than when security practitioners started talking about machine learning many years ago. Most (though not all) of the GenAI conversation has seemed to revolve around its ability to amplify productivity and its potential to continue the trend of automating away tasks that shouldn’t require humans. Lots of technology companies have been touting their new “AIs”, which predominantly have meant chatbots and interactive prompts. AI-powered companies have begun marketing many of GenAI’s positive expectations: predictive analytics, phishing detection & prevention, automated security patch generation, adaptive threat detection, enhanced biometrics, anomaly detection, threat simulation & training, malware generation & analysis. And Gartner recently found that one-third (34%) of organizations planned to deploy GenAI in the next 12 months. But Crowdstrike’s 2023 Global Threat report only mentions AI once, in its CEO’s opening letter about future technology. This is a strong indicator that we aren’t yet seeing it as an attack vector or amplifier in the wild. We surmise that the 2024 Global Threat report will be similar. In January, The National Cyber Security Center in the United Kingdom published a report entitled "The Near-Term Impact of AI on the Cyber Threat" detailing the potential way AI tools could be used offensively from increasing the sophistication of phishing attacks to malware and exploit development. Microsoft just corroborated that assertion with specific examples of ChatGPT-assisted phishing. This is a welcomed addition to a body of information highly focused on the new benefits of AI rather than its risks. We’ve heard and read that “soon” state-sponsored adversaries will be using GenAI to target critical infrastructure putting lives at risk. Such statements are not useful, as those adversaries have been focused on those targets forever. What matters is whether GenAI will provide useful new capabilities to compromise them. Gartner forecasts that in the next 2 years, GenAI will cause enough additional offensive capability that companies will end up spending 15% more on application and data security. Google’s recent “Cloud Cybersecurity Forecast” also indicated that Google expects GenAI to support phishing and other social engineering attacks. And CISA, which has become the US Government’s harbinger of all things cybersecurity, released a “Roadmap for Artificial Intelligence” this past November recommending developer accountability. This followed an October Executive Order by President Biden directing a variety of federal agencies to grapple with and protect against AI-enabled threats, including, for example, content authentication and watermarking by the Commerce Department and AI safety in drug discovery by the Department of Health and Human Services. So Which Risks Are Currently Accelerating? AI will increase the speed at which relatively low-quality phishing emails will be created, and likely even the sophistication of what happens after a link is clicked (chat boxes may start to replace web forms to solicit your information and bank account details). Phishing has been the overwhelmingly preferred and successful attack to establish initial access, whether through malware or password theft. The NCSC predicts that by 2025, GenAI will substantially improve the quality of Phishing emails (particularly the spelling and grammar of those emails), and thereby, increase the difficulty in identifying such malicious requests. The NCSC also predicted that the language models will be rapidly improved as exfiltrated data is reincorporated into the training models. Given its preference and preponderance, this is certainly the vector that will be impacted the soonest – automating dumb attacks. Anti-phishing training is going to have to move far beyond spotting typos to context-based evaluation. And humans are going to have to be retrained to use password managers and not re-sign into websites without careful and meticulous evaluation and contemplation. Several new anti-phishing tools seek to mitigate these risks (pixmsecurity, agari, etc.). The NCSC’s primary conclusion is that GenAI will enhance existing tactics, techniques, and procedures (TTPs) unevenly among categories of threat actors. We believe that in the near term, most of the benefit accrues to the unsophisticated as AI provides capability uplift in reconnaissance and social engineering. The NCSC states “More sophisticated uses of AI in cyber operations are highly likely to be restricted to threat actors with access to quality training data, significant expertise (in both AI and cyber), and resources. Such advanced uses are unlikely to be realized before 2025…AI lowers the barrier for novice cyber criminals, hackers-for-hire and hacktivists to carry out effective access and information gathering operations. This enhanced access will likely contribute to the global ransomware threat over the next two years.” While we appreciate the zealousness, we are skeptical of the timeframe. Over the next two years, we expect phishing emails to get more sophisticated and nation-states to continue training AIs on their incredibly large data sets. For emphasis, we’ll repeat – the near-term benefits accrue to the lowest-skilled hackers with limited resources executing TTPs in social engineering, phishing, passwords, and data exfiltration. We agree strongly that AI will also improve the efficiency of vulnerability scanning (“find me a server that is vulnerable to <fill in the blank>”). The NCSC stated that  "AI is highly likely to accelerate this challenge as reconnaissance to identify vulnerable devices becomes quicker and more precise.” To reference Alan Turing’s original formulation of Artificial Intelligence, GenAI dumb chatbots are likely to be perceived as real people relatively quickly. That will greatly enhance the ability of foreign criminals to sound like natives in their emailed requests for passwords, fund transfers, etc. Darktrace notes that GenAI has already “opened the door to providing offensive tools to more novice threat actors. But the efficacy of these tools will only be as good as those directing them. In the near term, we expect to see an increase in the speed and scale of familiar attack methodology.” The NCSC also suggests that GenAI will offer improvement in malware and exploit development and assistance in lateral movement, though we remain doubtful that in the next 5 years, there will be sufficient training models to enable vulnerability discovery available to non-nation-states or the largest 50 technology companies. The NCSC report essentially argues both sides, vacillating between two-year time frames and agreeing with this notion, by noting that GenAI tools would provide only minimal uplift for malware and exploit development for nation-states and organized cybercrime groups. But we are not saying that it’s impossible to happen relatively quickly; indeed, early last year HYAS researchers developed a proof-of-concept malware that leverages OpenAI to enable polymorphic code that can evade current cybersecurity products. And eventually (though we think it is at least 5 years out), GenAI systems themselves will be subject to data integrity attacks. What reasonable steps should we start to consider? We’ve reviewed a tremendous corpus of available literature looking for wisdom and practical advice on how to deal with these emergent threats (both the expected, near-term dumb ones and the hypothetical far away scary ones). As usual, the best tactical recommendations are the same recommendations that security teams have sought to implement since their establishment. These have become old saws by now: ● Establish governance approaches and workflow monitoring to ensure compliance with policies, standards, and procedures (whether by a human or an AI). ● Update and patch regularly against an asset registry or CMDB that consistently grows in the amount of coverage it represents (we hate that this still needs to be said). ● Monitor and block inappropriate access.  Better yet, develop a zero-trust architecture that inherently invalidates unexpected access. ● Develop continuous monitoring programs that ensure you have done all of the above (and alert you when something is out of the ordinary). ● Build strong security behavior programs to train employees toward secure, informed, and intentional behavior (no more than once a year, check the box security compliance videos). ● Monitor robust existing security control programs and quickly identify anomalous activity. ● Create relevant legal and compliance guidelines that detail appropriate use and security approvals for any GenAI activities. ● Create, disseminate, communicate, and evangelize acceptable use policies. In summary, over the next 5 years, we are most concerned about AI helping dumb attacks get faster and more automated (and minorly less dumb).  Darktrace agrees, claiming that we are “at the beginning of malicious actors’ applying AI techniques to automate more laborious aspects of their attacks.” All the current approaches to cybersecurity still hold – which is good news as most cyber teams remain highly taxed, being asked to do too much with too little. Unlike most prognosticators in the cyber industry, I will try not to inflame the hype of yet another doomsday, the sky is falling discussion on the newest threat vector. Over the past quarter in particular, that has been Generative AI (GenAI). This technology has even captured the minds (and fears) of the C-Suite and Boardrooms, quite a bit differently than when security practitioners started talking about machine learning many years ago. Most (though not all) of the GenAI conversation has seemed to revolve around its ability to amplify productivity and its potential to continue the trend of automating away tasks that shouldn’t require humans. Lots of technology companies have been touting their new “AIs”, which predominantly have meant chatbots and interactive prompts. AI-powered companies have begun marketing many of GenAI’s positive expectations: predictive analytics, phishing detection & prevention, automated security patch generation, adaptive threat detection, enhanced biometrics, anomaly detection, threat simulation & training, malware generation & analysis. And Gartner recently found that one-third (34%) of organizations planned to deploy GenAI in the next 12 months. But Crowdstrike’s 2023 Global Threat report only mentions AI once, in its CEO’s opening letter about future technology. This is a strong indicator that we aren’t yet seeing it as an attack vector or amplifier in the wild. We surmise that the 2024 Global Threat report will be similar. In January, The National Cyber Security Center in the United Kingdom published a report entitled "The Near-Term Impact of AI on the Cyber Threat" detailing the potential way AI tools could be used offensively from increasing the sophistication of phishing attacks to malware and exploit development. Microsoft just corroborated that assertion with specific examples of ChatGPT-assisted phishing. This is a welcomed addition to a body of information highly focused on the new benefits of AI rather than its risks. We’ve heard and read that “soon” state-sponsored adversaries will be using GenAI to target critical infrastructure putting lives at risk. Such statements are not useful, as those adversaries have been focused on those targets forever. What matters is whether GenAI will provide useful new capabilities to compromise them. Gartner forecasts that in the next 2 years, GenAI will cause enough additional offensive capability that companies will end up spending 15% more on application and data security. Google’s recent “Cloud Cybersecurity Forecast” also indicated that Google expects GenAI to support phishing and other social engineering attacks. And CISA, which has become the US Government’s harbinger of all things cybersecurity, released a “Roadmap for Artificial Intelligence” this past November recommending developer accountability. This followed an October Executive Order by President Biden directing a variety of federal agencies to grapple with and protect against AI-enabled threats, including, for example, content authentication and watermarking by the Commerce Department and AI safety in drug discovery by the Department of Health and Human Services. So Which Risks Are Currently Accelerating? So Which Risks Are Currently Accelerating? AI will increase the speed at which relatively low-quality phishing emails will be created, and likely even the sophistication of what happens after a link is clicked (chat boxes may start to replace web forms to solicit your information and bank account details). Phishing has been the overwhelmingly preferred and successful attack to establish initial access, whether through malware or password theft. The NCSC predicts that by 2025, GenAI will substantially improve the quality of Phishing emails (particularly the spelling and grammar of those emails), and thereby, increase the difficulty in identifying such malicious requests. The NCSC also predicted that the language models will be rapidly improved as exfiltrated data is reincorporated into the training models. Given its preference and preponderance, this is certainly the vector that will be impacted the soonest – automating dumb attacks. Anti-phishing training is going to have to move far beyond spotting typos to context-based evaluation. And humans are going to have to be retrained to use password managers and not re-sign into websites without careful and meticulous evaluation and contemplation. Several new anti-phishing tools seek to mitigate these risks (pixmsecurity, agari, etc.). The NCSC’s primary conclusion is that GenAI will enhance existing tactics, techniques, and procedures (TTPs) unevenly among categories of threat actors. We believe that in the near term, most of the benefit accrues to the unsophisticated as AI provides capability uplift in reconnaissance and social engineering. The NCSC states “More sophisticated uses of AI in cyber operations are highly likely to be restricted to threat actors with access to quality training data, significant expertise (in both AI and cyber), and resources. Such advanced uses are unlikely to be realized before 2025…AI lowers the barrier for novice cyber criminals, hackers-for-hire and hacktivists to carry out effective access and information gathering operations. This enhanced access will likely contribute to the global ransomware threat over the next two years.” While we appreciate the zealousness, we are skeptical of the timeframe. Over the next two years, we expect phishing emails to get more sophisticated and nation-states to continue training AIs on their incredibly large data sets. For emphasis, we’ll repeat – the near-term benefits accrue to the lowest-skilled hackers with limited resources executing TTPs in social engineering, phishing, passwords, and data exfiltration. We agree strongly that AI will also improve the efficiency of vulnerability scanning (“find me a server that is vulnerable to <fill in the blank>”). The NCSC stated that  "AI is highly likely to accelerate this challenge as reconnaissance to identify vulnerable devices becomes quicker and more precise.” To reference Alan Turing’s original formulation of Artificial Intelligence, GenAI dumb chatbots are likely to be perceived as real people relatively quickly. That will greatly enhance the ability of foreign criminals to sound like natives in their emailed requests for passwords, fund transfers, etc. Darktrace notes that GenAI has already “opened the door to providing offensive tools to more novice threat actors. But the efficacy of these tools will only be as good as those directing them. In the near term, we expect to see an increase in the speed and scale of familiar attack methodology.” The NCSC also suggests that GenAI will offer improvement in malware and exploit development and assistance in lateral movement, though we remain doubtful that in the next 5 years, there will be sufficient training models to enable vulnerability discovery available to non-nation-states or the largest 50 technology companies. The NCSC report essentially argues both sides, vacillating between two-year time frames and agreeing with this notion, by noting that GenAI tools would provide only minimal uplift for malware and exploit development for nation-states and organized cybercrime groups. But we are not saying that it’s impossible to happen relatively quickly; indeed, early last year HYAS researchers developed a proof-of-concept malware that leverages OpenAI to enable polymorphic code that can evade current cybersecurity products. And eventually (though we think it is at least 5 years out), GenAI systems themselves will be subject to data integrity attacks. What reasonable steps should we start to consider? What reasonable steps should we start to consider? We’ve reviewed a tremendous corpus of available literature looking for wisdom and practical advice on how to deal with these emergent threats (both the expected, near-term dumb ones and the hypothetical far away scary ones). As usual, the best tactical recommendations are the same recommendations that security teams have sought to implement since their establishment. These have become old saws by now: ● Establish governance approaches and workflow monitoring to ensure compliance with policies, standards, and procedures (whether by a human or an AI). ● Update and patch regularly against an asset registry or CMDB that consistently grows in the amount of coverage it represents (we hate that this still needs to be said). ● Monitor and block inappropriate access.  Better yet, develop a zero-trust architecture that inherently invalidates unexpected access. ● Develop continuous monitoring programs that ensure you have done all of the above (and alert you when something is out of the ordinary). ● Build strong security behavior programs to train employees toward secure, informed, and intentional behavior (no more than once a year, check the box security compliance videos). ● Monitor robust existing security control programs and quickly identify anomalous activity. ● Create relevant legal and compliance guidelines that detail appropriate use and security approvals for any GenAI activities. ● Create, disseminate, communicate, and evangelize acceptable use policies. In summary, over the next 5 years, we are most concerned about AI helping dumb attacks get faster and more automated (and minorly less dumb).  Darktrace agrees, claiming that we are “at the beginning of malicious actors’ applying AI techniques to automate more laborious aspects of their attacks.” All the current approaches to cybersecurity still hold – which is good news as most cyber teams remain highly taxed, being asked to do too much with too little.

GenAI - Soon to Be Great for Automating Dumb Attacks

The Noonification: 100 Days of AI, Day 17: The Different Ways Security Attacks are Created Using LLMs (4/1/2024)

In the presentation below, Clément Lesaege, co-founder of , presented the attack costs of different oracle networks and how to calculate the potential profit from corrupting them. Kleros https://youtu.be/bzqZnUC5VkI?si=T2azT5qDPdzunW4Y&embedable=true Below is a glossary of key concepts mentioned during Clement’s talk, intended as a supplement to his video presentation. About Kleros is a decentralized protocol built on the Ethereum blockchain that leverages crowdsourcing and game theory to arbitrate disputes quickly, and economically. The protocol’s core product is the Kleros court, where disputes are settled through a majority vote by randomly selected jurors incentivized to participate using , the native token of the platform. Kleros $PNK 51% Attacks A 51% attack or a majority attack occurs when more than half of the power to submit information is controlled by a single person or group of people. Essentially, this group has the ability to submit whatever information that is beneficial to them. Due to the decentralized nature of blockchains and Oracle protocols, 51% attacks will always be a risk. Because of this, protocols must utilize methods to make attacks economically unfeasible. Check out for a deep dive into all things related to oracle manipulation. this article Arbitration Protocols Arbitration protocols are decentralized systems that operate on predefined rules and smart contracts and are designed to address on-chain disputes. When disputes arise, both parties submit their case details and evidence to a panel of randomly selected jurors who evaluate the information and vote on the verdict. These jurors are rewarded, using the native token, when they arbitrate honestly or may have their staked tokens slashed in case of misconduct. Examples of arbitration protocols include and . are some popular examples of on-chain arbitration. Kleros Aragon Court Here Forking Forking refers to the process of creating a new version of a blockchain’s protocol, resulting in the splitting of the original blockchain into two separate chains. Forks occur when there are fundamental disagreements or updates within the community about the direction or rules of the blockchain. There are two main types of forks, namely . hard forks and soft forks Re-Staking In a network, participants lock up a certain amount of their cryptocurrency as collateral to become validators or participate in the consensus process. Re-staking involves taking the rewards earned from staking, such as transaction fees or newly minted tokens, and adding them back to the initial stake, effectively compounding the amount of staked tokens. PoS This allows participants to benefit from both the initial staked amount and the additional rewards generated. MEV Maximal Extractable Value (MEV) refers to the profits that miners or validators can potentially make by reordering and including transactions in a specific order within a block. On the blockchain, transaction ordering can affect the final outcome and pricing of transactions. Profits from MEV are gained by miners who engage in practices such as front-running, back-running, and sandwich attacks. This involves prioritizing transactions that are likely to profit, such as executing trades just ahead of large transactions or exploiting arbitrage opportunities between different trading platforms. A prominent example of MEV is the on the decentralized finance (DeFi) protocol . flash loan attack bZx Learn more about Kleros here: Kleros Website Kleros Documentation Kleros Twitter Clément Lesaege Twitter The Blockchain Oracle Summit is the world’s only technical summit that dives deep into the use cases, limitations, and impacts of oracles on the wider blockchain ecosystem. Leading speakers worldwide gathered in Paris to share their work and experience building and using Oracle solutions. Article by . Michael Abiodun

Stories, News & Mentions about ATOA

Atoa’s Stories on HackerNoon