# Reconciling airborne disease transmission concerns with energy saving
requirements: the potential of UV-C pathogen deactivation and air distribution
optimization

Antoine Gaillard<EMAIL_ADDRESS>Detlef Lohse  Daniel Bonn  Fahmi
Yigit<EMAIL_ADDRESS>
###### Abstract

The COVID-19 pandemic caused a paradigm shift in our way of using heating,
ventilation, and air-conditioning (HVAC) systems in buildings. In the early
stages of the pandemic, it was indeed advised to reduce the reuse and thus the
recirculation of indoor air to minimize the risk of contamination through
inhalation of virus-laden aerosol particles emitted by humans when coughing,
sneezing, speaking or breathing. However, such recommendations are not
compatible with energy saving requirements stemming from climate change and
energy price increase concerns, especially in winter and summer when the
fraction of outdoor air supplied to the building needs to be significantly
heated or cooled down. In this experimental study, we aim at providing low-
cost and low-energy solutions to modify the ventilation strategies currently
used in many buildings to reduce the risk of respiratory disease transmission.
We find that ultraviolet germicidal irradiation (UVGI) modules added to the
HVAC system are very efficient at inactivating pathogens present in aerosols,
leading to good indoor air quality even with significant indoor air
recirculation. Moreover, we show that an optimal placement of the air exhaust
vents relative to air supply vents can improve the ventilation efficiency,
with significant consequences in terms of energy savings.

###### keywords:

HVAC , COVID-19 , Virus , Aerosols , UVGI

††journal: Indoor Air

[aff1]organization=Van der Waals-Zeeman Institute, University of Amsterdam,
addressline=Science Park 904, city=Amsterdam, country=Netherlands

[aff2]organization=Physics of Fluids Group and Max Planck Center for Complex
Fluid Dynamics, J. M. Burgers Centre for Fluid Dynamics, University of Twente,
addressline=P.O. Box 217, city=Enschede, postcode=7500AE, country=Netherlands

[aff3]organization=Max Planck Institute for Dynamics and Self-Organization,
addressline=Am Fassberg 17, city=37077 Göttingen, country=Germany

[aff4]organization=Virobuster International GmbH, addressline=Köhlershohner
Straße 60, city=53578 Windhagen, country=Germany

##  1 Introduction

Heating, ventilation, and air-conditioning (HVAC) systems aim at providing
safety against high CO2 and volatile organic compound (VOC) concentrations, as
well as comfortable temperature and relative humidity levels for, e.g.,
employees working in office buildings as well as students and teachers in
classrooms. With the COVID-19 pandemic, new hygienic concerns emerged and the
importance of minimizing the risk of respiratory disease transmission in
buildings was raised. Virus laden airborne aerosols, which are typically 1
$\mu$m in size and remain in suspension in the air after being produced by
employees when speaking, coughing and sneezing [1, 2, 3, 4, 5, 6, 7, 8, 9, 10,
11, 12, 13, 14, 15] have indeed been found to be one of the major transmission
routes of the SARS-CoV-2 virus and other viruses [16, 17, 18, 19, 20, 21, 22,
23, 24, 25, 26]. The risk of transmission therefore correlates with the rate
at which indoor air is replaced by ‘clean’ (outdoor or decontaminated) air by
the building’s ventilation system. While only outdoor air supply was advised
during the COVID-19 pandemic, with minimum indoor air recirculation to avoid
aerosol spreading and accumulation [19], such strategy clashes with
sustainability requirements since the heating or cooling of outdoor air
represents a large fraction of the total energy consumption of buildings,
which is over one third of society’s global energy consumption [27].
Therefore, other solutions must be explored to reduce the risk of respiratory
disease transmission in an ecologically acceptable way.

Historically, the first HVAC systems had minimal recirculation and maximum
supply of outdoor air, offering a good protection against potential virus-
laden aerosols, as well as CO2 and potential organic volatile compounds
(VOCs). After the first oil crisis, more indoor air recirculation was needed
to reduce energy costs. This led to health problems referred to as the ‘sick
building syndrome’ such as, for example, eye and upper respiratory symptoms
attributed to high CO2 concentrations [28]. Generic air filters such as F5/F7
are often introduced to improve indoor air quality, but to trap all aerosols
finer HEPA filters are needed [29]. This suggests that, with insufficient air
treatment, indoor air recirculation can lead to virus accumulation in
buildings. Thermal wheels were therefore introduced in the 90’s to minimize
recirculation and increase the supply of fresh air from outside, which is now
heated by the warm exhaust air from the inside without physical contact
between the two air streams. However, in addition to their high construction
costs and maintenance levels, these energy recovery heat exchangers are known
to leak and send some indoor air back into the building (‘carry-over’ effect)
[30, 31, 32]. Hence, assuming that even a small fraction of virus
recirculation is problematic, thermal wheels may not be the solution to
optimize protection against viruses.

A promising solution for optimizing the hygienic quality of indoor air while
keeping the economical and ecological benefits of air recirculation lies in
the deactivation of pathogens via chemical [33], plasma [34, 35] or short
ultraviolet (UV-C) [36, 37] air treatment. Ultraviolet germicidal irradiation
(UVGI) has already proven effective to purify (drinking) water during the
fight against tuberculosis, for which Niels Ryberg Finsen received the Nobel
Prize in Medicine in 1903, as well as air in operation rooms [38]. Since then,
UVGI has been widely documented [39, 40, 41, 42] and was proven effective also
against corona viruses [43, 44]. UVGI technologies are affordable, require low
maintenance, and can be easily implemented as modules added to HVAC systems to
treat recirculating indoor air before it is re-injected into the room.
However, in spite of its great potential, experimental studies on the
efficiency of this technology in the context of indoor air quality in
buildings are still lacking to date.

In addition to hygienic air treatment, the ventilation efficiency is key to
reduce the risk of both short-range (via turbulent respiratory plumes emitted
when, e.g., coughing or sneezing [5, 45, 46, 47]) and long-range (after
dilution and mixing in the room) disease transmission. In principle, long-
range transmission can be reduced by increasing the ventilation power, which
involves energy costs, or by improving the air distribution via wise
placements of the air supply and exhaust vents to minimize pathogen
concentrations in the breathing zone of occupants [27, 48, 49, 50, 51, 52,
53]. In addition, future ventilation designs could rely on personalized
ventilation concepts with clean air supplied near occupants [27, 54]. However,
a key question that, to our knowledge, has not been addressed to date is
whether the ventilation efficiency, indexed by the CO2 or aerosol elimination
rate, for example, can be improved by modifying the air distribution strategy.

This study aims at providing further insight on finding a low-cost and
ecological solution to modify the ventilation systems currently used in many
buildings, in order to reduce the risk of respiratory disease transmission. To
do so, we investigate the efficiency of UVGI air treatment in an office
building with partly recirculated air, as well as the role of the air
distribution strategy. We start by reiterating a simple model [55] correlating
indoor CO2 and aerosol concentrations with the ventilation efficiency in §2.
Our employed experimental methods are then presented in §3 and the results are
presented in §4 and discussed in §5.

##  2 Model

The room concentration of a gas or substance in suspension in the air, such as
CO2 or aerosols produced by humans (neglecting other sources) evolves over
time and depends on the number of people present in the room and on the rate
at which air is replaced by new (fresh or recirculated) air via the
ventilation system. We recall here the simplest model for a well-mixed room
[55] equivalent to a continuous stirred tank reactor [56] which assumes a
homogeneous room concentration and which is the basis of the well-known
Wells–Riley model for airborne disease transmission [57, 58]. Because of
filtration (via face masks [59, 60, 61] or HEPA filters) and sedimentation-
induced deposition on surfaces [3, 8, 62, 63, 47] affecting specifically
airborne aerosols, the evolution in aerosol concentration may differ from that
of CO2 [64, 65, 66, 67, 68]. These effects are neglected here for simplicity
and aerosols and CO2 are treated equally. We also neglect the natural [62, 69,
70, 71] or active (via UVGI in our case) deactivation of pathogens contained
in aerosols since we aim at describing the concentration of aerosols only, and
not that of active pathogens themselves.

Figure 1: (a) Sketch of the ventilation system. (b-c) Sketch or the air flow
(arrows) in an overhead (b) and downflow (c) air distribution strategies. Two
employees are sketched, one producing aerosols (circles) via coughing or
sneezing, the other potentially breathing them. Note the specific case
sketched here is not representative of all possible scenarios with, e.g.,
different positions of employees relative to supply and exhaust vents.

The situation is described in figure 1(a) where the air entering the room from
supply vents consists of a fraction $x$ of fresh outdoor air and a fraction
$1-x$ of recirculating indoor air captured by the exhaust vents before
reentering the room after circulating through the AHU (Air Handling Unit). The
concentration $C$ of either CO2 or aerosols in a room of volume $V$ with $N$
people, each of them breathing at flow rate $q$, is set by the ventilation
flow rate $Q$ via the differential equation

$\frac{\mathrm{d}C}{\mathrm{d}t}=\lambda\left[C_{e}-C+\alpha C_{b}\right]$ (1)

where $C_{e}$ and $C_{b}$ are the CO2 or aerosol concentrations in the outdoor
air and in human breath, respectively. Here we have introduced the air
exchange rate

$\lambda=\frac{1}{\tau}=\frac{xQ}{V}$ (2)

and the ratio

$\alpha=Nq/xQ$ (3)

of people vs. ventilation flow rate, which is typically $\alpha\ll 1$ in
office buildings, as must be assumed to derive equation 1. The general
solution of equation 1 is

$C(t)=C_{\infty}+(C_{0}-C_{\infty})e^{-\lambda t}$ (4)

where $C_{0}$ is the initial concentration at $t=0$ and where the
concentration $C_{\infty}$ reached at times $t\gg\tau$ is given by

$C_{\infty}-C_{e}=\frac{NqC_{b}}{xQ}=\alpha C_{b}.$ (5)

Equations 2 and 5 show that both the equilibrium concentration difference
$C_{\infty}-C_{e}$ and the characteristic time $\tau$ needed to reach it are
inversely proportional to $xQ$ which, from a purely hygienic perspective,
needs to be as high as possible to minimize the risk of airborne disease
transmission. However, from an energy saving perspective, $x$ and $Q$ must
remain reasonably low to minimize the energy cost of heating (in winter) or
cooling down (in summer) the fresh outdoor air supplied to the room.

##  3 Materials and methods

Experiments are performed in a so-called open plan office building in Wierden,
Netherlands, consisting of a 435 m2 open space with ceiling height 2.6 m,
where 20 to 40 employees from the company ‘Brand Builders’, male and female
aged between 18 and 70, work with continuous communication with each other,
which may include speaking with raised voices. Employees do not have any
obligation to wear a face mask and are asked to keep windows and doors shut,
regardless of weather conditions.

While breathing or speaking, humans produce aerosols as well as CO2 which,
when other potential sources are negligible, are good indexers of the indoor
air quality. Hence, the office room in Wierden is equipped with 12 CO2
(MHZ19B) sensors and 5 air quality (SDS011) sensors placed on office desks and
on the walls, either near the floor, at desk level or near the ceiling. The
air quality sensors measure the concentration of particulate matter of size
less than 2.5 $\mu$m (PM2.5) and less than 10 $\mu$m (PM10). Additionally, one
CO2 and one particle sensor are placed outside of the room to compare CO2 and
particle levels in the room with outdoor levels. We choose a time resolution
of one data point per minute for all sensors.

Air is supplied to the room via 25 supply vents placed in the ceiling and
exhausted via 15 exhaust vents placed either in the ceiling, via open traps of
the dropped ceiling, or near the floor via tubes carrying the air above the
dropped ceiling. These two different air distribution strategies, labeled
‘overhead’ and ‘downflow’, respectively, are sketched in figure 1(b,c). In the
overhead strategy, where the tubes are closed, the ceiling traps placed above
these tubes are opened while, in the downflow strategy, all ceiling traps are
closed and the tubes are open.

A direct measurement of the flow rate delivered by each supply vent was
performed using an anemometer, yielding a value of the total ventilation flow
rate of $Q_{max}=6260$ m3/h by summing over all supply vents. This value was
measured at full ventilation capacity of the HVAC system. However, due to
potential ‘shortcuts’ between supply and exhaust vents, the effective air
exchange rate $\lambda$ might be less than the optimal value
$\lambda_{max}=xQ_{max}/V$ expected from an ideal ventilation efficiency (see
model in §2). This can be easily understood by considering that the CO2 or
aerosol concentration in the air exhausted via exhaust vents can indeed be
lower than the average concentration across the room. Since the importance of
these shortcuts depends on the position of the exhaust vents relative to the
supply vents, different air distribution strategies are expected to yield
different effective air exchange rates. In the following, results will be
presented in terms of an effective flow rate $Q=\lambda V/x$ based on the
measured CO2 or aerosol elimination rate $\lambda$.

Two types of measurements are performed to estimate this effective available
flow rate $Q$ for both overhead and downflow air distribution strategies. The
first consists of continuous measurements the CO2 and aerosol concentration in
the room over several days between May and September 2022 and using the
equilibrium concentration $C_{\infty}$ to estimate $Q$ for different air
distribution strategies using equation 5, knowing the number of employees $N$
in the rooms every day. These measurements are performed at full ventilation
capacity with $x=$30% of supplied outdoor air.

The second and more straightforward approach consists in partially filling the
room with either CO2 or aerosols at a sufficiently high initial concentration
$C_{0}$ before turning the ventilation on at full capacity with a fraction
$x=100$% of outdoor supplied air and without any employee in the room ($N=0$),
in which case the concentration is expected to decrease exponentially from
$C_{0}$ to $C_{e}$ at a rate $\lambda=Q/V$ from which $Q$ can be calculated,
see the model in §2. These experiments will be referred to as HADR (Hygienic
Air Delivery Rate) measurements as they aim at measuring the effective rate
$Q$ at which the air in a room is replaced by ‘fresh’ air through the
ventilation system. For CO2 measurements, the room was filled with CO2 by
sublimating a few kilograms of dry ice, pouring warm water on it to accelerate
the sublimation process. For aerosol measurements, the room was filled with
aerosols by spraying a liquid with a special spray nozzle provided by
Medspray®. The size distribution of droplets (before evaporation) and aerosols
(after evaporation) was measured by a laser diffraction technique provided by
Malvern Panalytical® (Spraytec). The average droplet and aerosol diameters are
7 and 4 $\mu$m, respectively, when spraying at a flow rate of 34 ml/h, from
which we estimate that $3\cdot 10^{9}$ droplets/aerosols are produced per
minute. The sprayed liquid consists of water with 1 wt% glycerin and 0.5wt%
NaCl so that, after water has evaporated, the glycerin and NaCl core remains
in the form of an aerosol particle. Fans were used to homogenize the
concentration during dry ice sublimation and aerosol spraying and were turned
off before starting the experiments, i.e., before turning the ventilation
system on. CO2 and aerosol measurements were performed on November 12th, 2022,
and September 3rd, 2022, respectively, both overhead and downflow air
distribution strategies being tested on the same day.

The building’s HVAC system, which doesn’t include a thermal wheel or HEPA
filters, is equipped with an UltraViolet Germicidal Irradiation (UVGI) system
provided by Virobuster® placed before the outdoor air injection point so that
recirculating indoor air is treated before re-entering the room, as sketched
in figure 1(a). The UVGI module is about 1 m long and exposes the circulating
air to UV-C light of wavelength 254 nm with an intensity around 600 J/m2. To
test the efficiency of this technology on the air quality, air samples were
collected every week between May and September 2022 by an certified validation
company at five different locations across the room, the same locations every
week, at heights 0.4 m, 0.75 m, and 2 m from the floor. The air sampling
protocol consists of creating a 6 m3/h air flow through a Sartorius gelatin
filter with 0.3 $\mu$m pores for 10 minutes during which employees were asked
to not approach the sampling locations. Two additional air samples were
collected, one outside to compare indoor air quality with outdoor, and one in
the air handling unit, after the UVGI module and before the outdoor air
injection point, to check whether the air leaving the module is significantly
affected by the UV-C treatment. The results for every sample are expressed in
terms of a number of colony forming units (CFU), including both bacteria and
fungi, the two being easily distinguishable. Measurements are divided in time
periods of at least two weeks corresponding to either overhead or downflow air
distribution strategies, each strategy being tested with UVGI either turned on
or turned off at full ventilation capacity with $x=30$% of outdoor supplied
air.

##  4 Results

###  4.1 HADR experiments

Figure 2: (a) Time evolution of the CO2 concentration in a HADR experiment
where the room is initially filled with CO2 by sublimating dry ice before
turning the ventilation on at $t=0$ for different sensors in a downflow air
distribution strategy. (b) Comparison of the re-normalized concentration decay
curves $(C-C_{\infty})/(C_{0}-C_{\infty})$ used to measure the air exchange
rate $\lambda=Q/V$ for overhead and downflow air distribution strategies for
three sensors. (c,d) Map of the effective flow rate $Q$ measured for all
sensors in overhead (c) and downflow (d) air distribution strategies. The zone
outlined in red is the room where experiments were carried out, all doors
leading to other rooms were closed. The position of supply vents in the
ceiling, exhaust vents in the ceiling (c) or near the floor (d) and sensors at
desk level or near the ceiling or floor are shown by symbols presented in the
legend. The sensor symbols are colored based on their $Q$ value following a
code from blue (low $Q$) to red (high $Q$).

The results of HADR measurements for CO2 are presented in figure 2(a) where,
starting from a high initial CO2 concentration $C_{0}$ of about $1700$ ppm,
the concentration drops down to equilibrium values $C_{\infty}$ around $400$
ppm, close to the outdoor concentration. The rate at which the concentration
decreases varies among different sensors placed at different locations across
the room. Re-normalized decay curves $(C-C_{\infty})/(C_{0}-C_{\infty})$ are
compared in figure 2(b) for three sensors for both overhead and downflow air
distribution strategies. We find that (i) the decay is exponential, in
agreement with the model presented in §2, allowing measurement of the air
exchange rate $\lambda=Q/V$ ($x=1$ here since there is no indoor air
recirculation) from which the effective flow rate $Q$ is measured for each
sensor, and that (ii) this effective flow rate is generally larger in downflow
than in overhead.

This is further demonstrated in the maps of figure 2(c,d), showing the
position of supply and exhaust vents in the room as well as the position of
CO2 sensors, which are colored based on their respective $Q$ value in overhead
(c) and downflow (d) air distribution strategies. We observe that the $Q$
value measured for almost every sensor is larger in downflow than in overhead.
The maps also reveal inhomogeneities, with for example a less well ventilated
region at the bottom left, with no significant differences between sensors
placed at different heights.

Averaging over all sensors leads to effective flow rates $\langle
Q\rangle=4260$ m3/h in overhead and $4930$ m3/h in downflow with a standard
variation of about $600$ m3/h in both cases. These values are respectively 32%
and 21% smaller than the maximum flow rate $Q_{max}$ that would be reached in
the absence of shortcuts in the air flow, meaning that adopting a downflow air
distribution strategy reduces the importance of these shortcuts by improving
the effective average available flow rate $\langle Q\rangle$ by 16% compared
to overhead.

Figure 3: (a,b) Time evolution of the concentration of aerosols of size less
than 2.5 $\mu$m (PM2.5) (a) and 10 $\mu$m (PM10) (b) in a HADR experiment
where the room is initially filled with aerosols of different sizes via a
special spraying technique before turning the ventilation on at $t=0$ for
different sensors in a downflow air distribution strategy. (c,d) Map of the
effective flow rate $Q$ measured for all sensors in overhead (c) and downflow
(d) air distribution strategies for aerosol of size less than 10 $\mu$m
(PM10). The zone outlined in red is the room where experiments were carried
out, all doors leading to other rooms were closed. The position of supply
vents in the ceiling, exhaust vents in the ceiling (c) or near the floor (d)
and sensors at desk level or near the ceiling or floor are shown by symbols
presented in the legend. The sensor symbols are colored based on their $Q$
value following a code from blue (low $Q$) to red (high $Q$).

Similar results are found for aerosol HADR measurements, as shown in figures
3(a,b), showing the decay curves of the concentration in aerosols of size less
than 2.5 $\mu$m (PM2.5) (a) and 10 $\mu$m (PM10) (b) in a downflow air
distribution strategy. Note that the initial concentration $C_{0}$ reached
before turning the ventilation on is larger for PM10 than for PM2.5, meaning
that the spraying technique used to fill the room with aerosols produces more
particles of size larger than 2.5 $\mu$m. As shown in the maps of figures
3(c,d), like for CO2, the effective flow rate $Q$ calculated from these
exponential decay curves is larger in downflow than in overhead for all
sensors. Averaging over all sensors leads to effective flow rates $\langle
Q\rangle=4180$ m3/h in overhead and $5390$ m3/h in downflow for PM2.5 and
$\langle Q\rangle=4240$ m3/h in overhead and $5660$ m3/h in downflow for PM10,
with standard variations of about $400$ m3/h in all four cases. This means
that adopting a downflow air distribution strategy improves the effective flow
rate by about 30% for aerosols, compared to overhead, which is a more
pronounced improvement than for CO2.

Flow rates and improvement percentages are presented in table 1. The more
pronounced improvement observed for aerosols compared to CO2 suggests that, in
addition to the reduction in air shortcuts between supply and exhaust vents
affecting both CO2 and aerosols, a downflow air distribution strategy also
enhances the elimination rate of aerosols via a second aerosol-specific
mechanism. A possible interpretation is that, when being forced towards the
floor, aerosols are more likely to be deposited on surfaces as they encounter
more obstacles such as tables, chairs and other furniture, which would also
occur in the absence of ventilation due to gravitational sedimentation [47].

###  4.2 Continuous concentration measurements

Figure 4: Time evolution of the CO2 concentration in the room for different
sensors over one working day (a), Tuesday June 21st and one full week (b) from
Monday June 20th to Sunday June 26th, with the number of employees present in
the room indicated in the top $x$-axis. The equilibrium concentration
$C_{\infty}$ is calculated by averaging over all indoor sensors between 11am
and 4pm. While the real time resolution is one data points per minute, we only
show enough points to see the trend in this figure. The air distribution
strategy in place during these days was “overhead”.

The time evolution of the CO2 concentration during normal working days with
employees present in the room is shown in figure 4 over one day (a) and over
one week (b) for an overhead air distribution strategy. The indoor
concentration starts increasing at around 8am and start decreasing at around
5pm, consistent with typical working hours, while the outdoor CO2
concentration increases slightly during the night and decreases in the
morning, consistent with the plant breathing cycle (CO2 release during the
night and captures during the day). We can therefore correlate the indoor CO2
concentration with the presence of people. However, as shown in figure 4(b)
where the number of employees present each day is indicated on the top
$x$-axis, the indoor CO2 concentration doesn’t correlate perfectly with the
number of employees present, probably due to some employees partially working
outside of the main room where the concentration was measured (i.e., outside
of the region outlined in red in figures 2(c,d) and 3(c,d)). For that reason,
estimating the effective flow rate for the two air distribution strategies
using equation 5, averaging over several days between 11am and 4pm for each
strategy, yields significant standard deviations. Using $C_{b}=40,000$ ppm and
$q=220$ l/h gives average values $\langle Q\rangle=4260$ m3/h in overhead and
$4670$ m3/h in downflow with standard variations of about $1300$ m3/h in both
cases, which is larger than the 10% improvement of downflow compared to
overhead estimated from these values, shown in table 1. We therefore believe
that HADR measurements are a more reliable way to measure the effective flow
rate and to detect differences between different air distribution strategies.

We measured that, contrary to CO2 concentrations, there was no difference in
aerosol concentration between weekend and working days, meaning that too few
aerosols were generated by human activity to be detected by our sensors.
Hence, no effective flow rate could be estimated from continuous aerosol
concentration measurements.

|  HADR CO2 |  Cont. CO2 | HADR PM2.5 | HADR PM10
---|---|---|---|---
$Q_{max}$ (m3/h) - Optimal | 6260 | 6260 | 6260 | 6260
$Q$ (m3/h) - (O)verhead | 4260 | 4260 | 4180 | 4240
$Q$ (m3/h) - (D)ownflow | 4930 | 4670 | 5390 | 5660
% Improvement O to D | 16 | 10 | 29 | 33
Table 1: Effective flow rates $Q$ measured from HADR measurements (no
employees in the room) with CO2 and aerosols (PM2.5 and PM10) and from
continuous CO2 measurements (employees in the room) for overhead and downflow
air distribution strategies. The last line shows the improvement of downflow
compared to overhead in percentage. In the absence of shortcuts, the measured
flow rate should be equal to the optimal value $Q_{max}=6260$0m3/h measured
with an anemometer.

###  4.3 Effect of ultraviolet germicidal irradiation

Figure 5: Bacterial count in air sampling, normalized by the outdoor value,
outdoor (green), indoor (averaged over different locations in the room) with
employees present and in the air handling unit, after the UVGI module, with
ultraviolet germicidal irradiation either turned off (red) or on (blue). The
data is averaged over different weeks where, for values in the room, we
distinguish between weeks with overhead and downflow air distribution
strategies. Error bars correspond to the standard variation over different
weeks.

The air quality measurements carried out on Friday every week showed strong
variations of both outdoor and indoor air quality between different weeks,
with numbers of bacterial colony forming units (CFU) ranging typically between
10 and 1000 for outdoor air samples. This is not surprising since the presence
of bacteria in the air is expected to depend on, e.g., the temperature and
relative humidity [72, 73]. Days of high outdoor bacterial concentration also
showed high indoor bacterial concentration when the UVGI module was off.
Hence, for every measurement day, we normalize the indoor air quality
(quantified by the number of bacterial CFU) measured at different locations in
the room and in the air handling unit by the outdoor air quality. Strong air
quality variations are observed for different air sampling locations in the
room for a given day, the location of the worst measured air quality not being
the same every week. This is not surprising since the amount of bacteria in
the air at a given location can vary significantly depending on the presence
of nearby sources such as plants or food whose location can vary from day to
day. Hence, we average over all five locations in the room for every
measurement day to obtain an average room air quality.

The final results are presented in figure 5 where the air quality in the room
and after the UVGI module is compared to the outdoor air quality. We average
over weeks corresponding to the same air distribution strategy (overhead or
downflow) for the air quality in the room and over all weeks for the air
quality after the UVGI module, distinguishing in both cases between weeks
where the UVGI was turned on (blue) and weeks where it was turned off (red).
The error bars represent the variation over different weeks. These results
show a strong improvement of the air quality in the room when UVGI is turned
on, typically by a factor two, making indoor air almost as clean as outdoor.
This is confirmed by the sharp reduction in bacterial count after the UVGI
module when it is turned on. No significant difference is measured between the
two air distribution strategies.

##  5 Conclusions and discussions

Our experiments confirm that ultraviolet germicidal irradiation (UVGI)
technologies can significantly improve the indoor air quality in buildings
when indoor air is partly re-injected in the room via recirculation, bringing
the level of active airborne bacteria almost as low as in the outdoor air.
Since viruses are much weaker than bacteria, and since the UV-C intensity of
around 600 J/m2 of the UVGI technology used in this study surpasses the
required 90% inactivation energy of SARS-CoV-2 (27 J/m2 [44]), it can be
assumed that the level of active airborne viruses will also be significantly
reduced after UVGI treatment. Hence, assuming a virus-free outdoor air, the
risk of airborne contamination is significantly reduced. We therefore conclude
that energy saving requirements, from which air recirculation is encouraged,
can be reconciled with hygienic requirements when properly treating the air
re-injected in the building.

The effective flow rate $Q$, or equivalently the effective air exchange rate
$\lambda$, available to replace indoor air with ‘clean’ (outdoor or treated
indoor) air was shown to be systematically less than the flow rate expected
from direct measurements of supply vent delivery. This is caused by
‘shortcuts’ in the global air flow of the room between supply and exhaust
vents, which cause the air being exhausted to be more similar to the clean
supplied air than to the average air in the room, either in terms of CO2 or
aerosol concentration or, consequently, in terms of temperature and humidity.
While air quality measurements did not allow us to rank the two different air
distribution strategies tested (overhead and downflow), a clear improvement of
up to 30% was measured in the effective air flow rate $Q$ for downflow
compared to overhead, proving that supply-exhaust air shortcuts can be
significantly minimized by changing the air distribution strategy. Future work
is needed to characterize the optimal position of inlet and exhaust vents to
minimize these shortcuts and to compare a downflow situation to the reverse
case (not considered in the present study) where air is supplied from the
floor and exhausted from the ceiling.

The improvement in ventilation capacity implies that, in addition to a better
protection against virus-laden aerosols, a better air distribution strategy is
also beneficial in terms of energy savings. Indeed, in winter for example, the
presence of supply-exhaust shortcuts means that a fraction of the precious
warm air supplied to the room is directly thrown away into exhaust vents
before properly mixing in the room. Hence, when limiting these shortcuts, less
ventilation energy is needed to keep the indoor air temperature at a
prescribed value, which has a significant economic impact. In other words, an
optimal air distribution strategy can lead to the same indoor air quality as
for another (less optimal) strategy, both in terms of temperature and aerosol
safety, with less ventilation power. For example, on a 4∘C winter day with 100
% outdoor air supply (no indoor air recirculation), the thermal power needed
to warm the outdoor air flowing in the air handling unit at flow rate
$Q_{max}=6260$ m3/h up to 21∘C is 35 kW based on the density and specific heat
capacity of air. Once in the room, our effective flow rate measurements in
“overhead” showed that about 30% of the flow rate is lost due to shortcuts,
implying a power loss of about 11 kW. In contrast, in “downflow”, based on CO2
and aerosol measurements, only 20% to 10% of the flow rate is lost,
respectively, implying a power loss of only 7.4 kW to 3.5 kW.

We note that the use of UVGI modules in HVAC systems could, in principle,
allow the use of rotary heat wheels, since the deactivation of pathogens that,
without treatment, would be re-injected in the building via the ‘carry-over
effect’, could ensure an acceptable indoor air quality. Moreover, in contrast
to air filters, UVGI modules can be easily switched on when required and don’t
introduce any additional pressure drop in the air handling unit (AHU). This
solution is therefore not only ecologically justifiable, but also economically
viable. In principle, UVGI modules also allow the use of cheap and small AHU
without separated exhaust and supply air, i.e., without rotary heat wheels.
This is particularly interesting since these ventilation systems allow, via
indoor air recirculation, an easier regulation of the indoor air humidity,
especially in winter, with the associated benefice for occupants’ well-being.

Conflicts of interest

The authors declare no conflicts of interest.

Funding

The authors acknowledge funding by NWO (Dutch Research Council) under the MIST
(MItigation STrategies for Airborne Infection Control) program.

Acknowledgments

The authors would like to thank Sander G. Huisman for fruitful discussions.

## References

  * [1] L. Bourouiba, Turbulent gas clouds and respiratory pathogen emissions: Potential implications for reducing transmission of COVID-19, J. Am. Med. Assoc. 323 (2020) 1837–1838.  doi:doi:10.1001/jama.2020.4756.
  * [2] S. L. Miller, W. W. Nazaroff, J. L. Jimenez, A. Boerstra, G. Buonanno, S. J. Dancer, J. Kurnitski, L. C. Marr, L. Morawska, C. Noakes, Transmission of SARS-CoV-2 by inhalation of respiratory aerosol in the skagit valley chorale superspreading event, Indoor Air (2020).  doi:medRxivpreprintdoi:https://doi.org/10.1101/2020.06.15.20132027.
  * [3] G. Buonanno, L. Stabile, L. Morawska, Estimation of airborne viral emission: quanta emission rate of SARS-CoV-2 for infection risk assessment, Environment International (2020) 105794.
  * [4] G. A. Somsen, C. van Rijn, S. Kooij, R. A. Bem, D. Bonn, Small droplet aerosols in poorly ventilated spaces and sars-cov-2 transmission, The Lancet Respiratory Medicine 8 (7) (2020) 658–659.
  * [5] M. Abkarian, S. Mendez, N. Xue, F. Yang, H. A. Stone, Speech can produce jet-like transport relevant to asymptomatic spreading of virus, Proc. Nat. Acad. Sci. 117 (41) (2020) 25237–25245.
  * [6] F. Yang, A. A. Pahlavan, S. Mendez, M. Abkarian, H. A. Stone, Towards improved social distancing guidelines: Space and time dependence of virus transmission from speech-driven aerosol transport between two individuals, Phys. Rev. Fluids 5 (12) (2020) 122501.
  * [7] C. van Rijn, G. A. Somson, L. Hofstra, G. Dahhan, R. A. Bem, S. Kooij, D. Bonn, Reducing aerosol transmission of SARS-CoV-2 in hospital elevators, Indoor Air 10 (2000) 10.1111/ina.12744.
  * [8] M. Z. Bazant, J. W. Bush, A guideline to limit indoor airborne transmission of COVID-19, Proc. Nat. Acad. Sci. 118 (17) (2021) e2018995118.
  * [9] L. Bourouiba, The fluid dynamics of disease transmission, Annu. Rev. Fluid Mech. 53 (2021) 473–508.
  * [10] K. L. Chong, C. S. Ng, N. Hori, R. Yang, R. Verzicco, D. Lohse, Extended lifetime of respiratory droplets in a turbulent vapor puff and its implications on airborne disease transmission, Phys. Rev. Lett. 126 (3) (2021) 034502.
  * [11] C. S. Ng, K. L. Chong, R. Yang, M. Li, R. Verzicco, D. Lohse, Growth of respiratory droplets in cold and humid air, Phys. Rev. Fluids 6 (5) (2021) 054303\.
  * [12] G. Bagheri, B. Thiede, B. Hejazi, O. Schlenczek, E. Bodenschatz, An upper bound on one-to-one exposure to infectious human respiratory particles, Proceedings of the National Academy of Sciences 118 (49) (2021) e2110117118.
  * [13] M. L. Pöhlker, O. O. Krüger, J.-D. Förster, T. Berkemeier, W. Elbert, J. Fröhlich-Nowoisky, U. Pöschl, C. Pöhlker, G. Bagheri, E. Bodenschatz, et al., Respiratory aerosols and droplets in the transmission of infectious diseases, arXiv preprint arXiv:2103.01188 (2021).
  * [14] F. Poydenot, I. Abdourahamane, E. Caplain, S. Der, J. Haiech, A. Jallon, I. Khoutami, A. Loucif, E. Marinov, B. Andreotti, Risk assessment for long-and short-range airborne transmission of SARS-CoV-2, indoors and outdoors, PNAS Nexus 1 (5) (2022) pgac223.
  * [15] B. Mutsch, M. Heiber, F. Grätz, R. Hain, M. Schönfelder, S. Kaps, D. Schranner, C. J. Kähler, H. Wackerhage, Aerosol particle emission increases exponentially above moderate exercise intensity resulting in superemission during maximal exercise, Proceedings of the National Academy of Sciences 119 (22) (2022) e2202521119.
  * [16] W. J. Fisk, Health and productivity gains from better indoor environments and their relationship with building energy efficiency, Annu. Rev. Energ. Environ. 25 (1) (2000) 537–566.
  * [17] Y. Li, G. M. Leung, J. W. Tang, X. Yang, C. Y. Chao, J. Z. Lin, J. W. Lu, P. V. Nielsen, J. Niu, H. Qian, et al., Role of ventilation in airborne transmission of infectious agents in the built environment-a multidisciplinary systematic review., Indoor Air 17 (1) (2007) 2–18.
  * [18] WHO, Q&A: ventilation and air conditioning in public spaces and buildings and COVID-19, Tech. rep., World Health Organization (2020).
  * [19] L. Morawska, J. W. Tang, W. Bahnfleth, P. M. Bluyssen, A. Boerstra, G. Buonanno, J. Cao, S. Dancer, A. Floto, F. Franchimon, C. Haworth, J. Hogeling, C. Isaxon, J. L. Jimenez, J. Kurnitski, Y. Li, M. Loomans, G. Marks, L. C. Marr, L. Mazzarella, A. K. Melikov, S. Miller, D. K. Milton, W. Nazaroff, P. V. Nielsen, C. Noakes, J. Peccia, X. Querol, C. Sekhar, O. Seppänen, S. Tanabe, R. Tellier, K. W. Tham, P. Wargocki, A. Wierzbicka, M. Yao, How can airborne transmission of COVID-19 indoors be minimised?, Environment International 142 (2020) 105832, 105832.  doi:10.1016/j.envint.2020.105832.
URL https://doi.org/10.1016/j.envint.2020.105832

  * [20] L. Morawska, J. Cao, Airborne transmission of SARS-CoV-2: The world should face the reality., Environment International 139 (2020) 105730, 105730.  doi:10.1016/j.envint.2020.105730.
URL https://doi.org/10.1016/j.envint.2020.105730

  * [21] M. Jayaweera, H. Perera, B. Gunawardana, J. Manatunge, Transmission of COVID-19 virus by droplets and aerosols: A critical review on the unresolved dichotomy, Environ. Res. 118 (2020) 109819.
  * [22] K. A. Prather, C. C. Wang, R. T. Schooley, Reducing transmission of SARS-CoV-2, Science 368 (2020) 1422–1424.  doi:10.1126/science.abc6197.
  * [23] V. Stadnytskyi, C. E. Bax, A. Bax, P. Anfinrud, The airborne lifetime of small speech droplets and their potential importance in SARS-CoV-2 transmission., Proc. Nat. Acad. Sci. 117 (22) (2020) 11875–11877, 11875.  doi:10.1073/pnas.2006874117.
URL https://doi.org/10.1073/pnas.2006874117

  * [24] R. Zhang, Y. Li, A. L. Zhang, Y. Wang, M. J. Molina, Identifying airborne transmission as the dominant route for the spread of COVID-19, Proc. Nat. Acad. Sci. 117 (2020) 14857–14863.  doi:www.pnas.org/cgi/doi/10.1073/pnas.2009637117.
  * [25] T. Greenhalgh, J. L. Jimenez, K. A. Prather, Z. Tufekci, D. Fisman, R. Schooley, Ten scientific reasons in support of airborne transmission of SARS-CoV-2, The lancet 397 (10285) (2021) 1603–1605.
  * [26] CDC, Ventilation in buildings, Tech. rep., Centers for Disease Control and Prevention (2021).
  * [27] L. Morawska, J. Allen, W. Bahnfleth, P. M. Bluyssen, A. Boerstra, G. Buonanno, J. Cao, S. J. Dancer, A. Floto, F. Franchimon, et al., A paradigm shift to combat indoor respiratory infection, Science 372 (6543) (2021) 689–691.
  * [28] D. Tsai, J. Lin, C. Chan, Office workers’ sick building syndrome and indoor carbon dioxide concentrations, Journal of occupational and environmental hygiene 9 (5) (2012) 345–351.
  * [29] J. Dreier, A. Bermpohl, P. Jeschin, B. Becker, K. Kleesiek, Transmission von viren durch raumlufttechnische anlagen und inaktivierung durch uvc-strahlung, Gefahrstoffe-Reinhaltung der Luft 68 (9) (2008) 379.
  * [30] C. J. Simonson, Heat and moisture transfer in energy wheels, Ph.D. thesis, University of Saskatchewan Saskatoon, SK, Canada (1998).
  * [31] H. Enventus, Rotary heat exchangers for heat recovery in ventilation systems (2018).
  * [32] H. M. D. P. Herath, M. D. A. Wickramasinghe, A. M. C. K. Polgolla, A. S. Jayasena, R. A. C. P. Ranasinghe, M. A. Wijewardane, Applicability of rotary thermal wheels to hot and humid climates, Energy Reports 6 (2020) 539–544.
  * [33] A. Schwartz, M. Stiegel, N. Greeson, A. Vogel, W. Thomann, M. Brown, G. D. Sempowski, T. S. Alderman, J. P. Condreay, J. Burch, et al., Decontamination and reuse of n95 respirators with hydrogen peroxide vapor to address worldwide personal protective equipment shortages during the sars-cov-2 (covid-19) pandemic, Applied Biosafety 25 (2) (2020) 67–70.
  * [34] A. Filipić, I. Gutierrez-Aguirre, G. Primc, M. Mozetič, D. Dobnik, Cold plasma, a new hope in the field of virus inactivation, Trends in Biotechnology 38 (11) (2020) 1278–1291.
  * [35] A. Lai, A. Cheung, M. Wong, W. Li, Evaluation of cold plasma inactivation efficacy against different airborne bacteria in ventilation duct flow, Building and Environment 98 (2016) 39–46.
  * [36] F. J. Garcia de Abajo, R. J. Hernández, I. Kaminer, A. Meyerhans, J. Rosell-Llompart, T. Sanchez-Elsner, Back to normal: An old physics route to reduce sars-cov-2 transmission in indoor spaces, ACS nano 14 (7) (2020) 7704–7713.
  * [37] M. L. Hitchman, A new perspective of the chemistry and kinetics of inactivation of covid-19 coronavirus aerosols, Future Virology 15 (12) (2020) 823–835.
  * [38] D. Hart, Bactericidal ultraviolet radiation in the operating room: twenty-nine-year study for control of infections, Journal of the American Medical Association 172 (10) (1960) 1019–1028.
  * [39] W. Kowalski, Uvgi disinfection theory, in: Ultraviolet germicidal irradiation handbook, Springer, 2009, pp. 17–50.
  * [40] D. Menzies, J. Popa, J. A. Hanley, T. Rand, D. K. Milton, Effect of ultraviolet germicidal lights installed in office ventilation systems on workers’ health and wellbeing: double-blind multiple crossover trial, The Lancet 362 (9398) (2003) 1785–1791.
  * [41] D. Sharp, The lethal action of short ultraviolet rays on several common pathogenic bacteria, Journal of Bacteriology 37 (4) (1939) 447–460.
  * [42] C. Tseng, C. Li, Inactivation of virus-containing aerosols by ultraviolet germicidal irradiation, Aerosol Science and Technology 39 (12) (2005) 1136–1142.
  * [43] C. M. Walker, G. Ko, Effect of ultraviolet germicidal irradiation on viral aerosols, Environmental science & technology 41 (15) (2007) 5460–5465.
  * [44] W. Kowalski, T. Walsh, V. Petraitis, Covid-19 coronavirus ultraviolet susceptibility, Purplesun Inc (2020).
  * [45] W. Chen, N. Zhang, J. Wei, H.-L. Yen, Y. Li, Short-range airborne route dominates exposure of respiratory infection during close contact, Building and Environment 176 (2020) 106859.
  * [46] L. Bourouiba, E. Dehandschoewercker, J. W. Bush, Violent expiratory events: on coughing and sneezing, J. Fluid Mech. 745 (2014) 537–563.
  * [47] S. H. Smith, G. A. Somsen, C. van Rijn, S. Kooij, L. van der Hoek, R. A. Bem, D. Bonn, Aerosol persistence in relation to possible transmission of SARS-CoV-2, Physics of Fluids 32 (10) (2020) 107108.
  * [48] M. Liu, J. Liu, Q. Cao, X. Li, S. Liu, S. Ji, C.-H. Lin, D. Wei, X. Shen, Z. Long, et al., Evaluation of different air distribution systems in a commercial airliner cabin in terms of comfort and COVID-19 infection risk, Building and Environment 208 (2022) 108590.
  * [49] A. F. El-Haroun, S. A. Kaseb, M. A. Fouad, H. O. Kayed, Numerical investigation of covid-19 infection spread expelled from cough in an isolation ward under different air distribution strategies, Journal of Advanced Research in Fluid Mechanics and Thermal Sciences 95 (1) (2022) 17–35.
  * [50] Y. Zhang, G. Feng, Z. Kang, Y. Bi, Y. Cai, Numerical simulation of coughed droplets in conference room, Procedia Engineering 205 (2017) 302–308.
  * [51] C. H. Cheong, B. Park, S. R. Ryu, Effect of under-floor air distribution system to prevent the spread of airborne pathogens in classrooms, Case Studies in Thermal Engineering 28 (2021) 101641.
  * [52] M. Abdolzadeh, E. Alimolaei, M. Pustelnik, Numerical simulation of airflow and particle distributions with floor circular swirl diffuser for underfloor air distribution system in an office environment, Environmental Science and Pollution Research 26 (24) (2019) 24552–24569.
  * [53] T. N. Verma, A. K. Sahu, S. L. Sinha, Study of particle dispersion on one bed hospital using computational fluid dynamics, Materials Today: Proceedings 4 (9) (2017) 10074–10079.
  * [54] C. Xu, X. Wei, L. Liu, L. Su, W. Liu, Y. Wang, P. V. Nielsen, Effects of personalized ventilation interventions on airborne infection risk and transmission between occupants, Building and environment 180 (2020) 107008.
  * [55] F. H. Shair, K. L. Heitner, Theoretical model for relating indoor pollutant concentrations to those outside, Environmental Science & Technology 8 (5) (1974) 444–451.
  * [56] M. E. Davis, R. J. Davis, Fundamentals of chemical reaction engineering, Courier Corporation, 2012.
  * [57] W. F. Wells, Airborne contagion and air hygiene: an ecological study of droplet infections, Cambridge, MA: Harvard University Press., 1955.
  * [58] E. Riley, G. Murphy, R. Riley, Airborne spread of measles in a suburban elementary school, American journal of epidemiology 107 (5) (1978) 421–432.
  * [59] Y. Shah, J. W. Kurelek, S. D. Peterson, S. Yarusevych, Experimental investigation of indoor aerosol dispersion and accumulation in the context of covid-19: Effects of masks and ventilation, Physics of Fluids 33 (7) (2021) 073315\.
  * [60] J. Howard, A. Huang, Z. Li, Z. Tufekci, V. Zdimal, H.-M. van der Westhuizen, A. von Delft, A. Price, L. Fridman, L.-H. Tang, et al., Face masks against COVID-19: an evidence review (2020).  doi:doi:10.20944/preprints202004.0203.v1.
  * [61] N. H. L. Leung, D. K. W. Chu, E. Y. C. Shiu, K. H. Chan, J. J. McDevitt, B. J. P. Hau, H. L. Yen, Y. Li, D. K. M. Ip, J. S. M. Peiris, W. H. Seto, G. M. Leung, D. K. Milton, B. J. Cowling, Respiratory virus shedding in exhaled breath and efficacy of face masks., Nature Medicine 26 (5) (2020) 676–680, 676.  doi:10.1038/s41591-020-0843-2.
URL https://doi.org/10.1038/s41591-020-0843-2

  * [62] W. Yang, L. C. Marr, Dynamics of airborne influenza a viruses indoors and dependence on humidity, PloS one 6 (6) (2011) e21481.
  * [63] G. Buonanno, L. Morawska, L. Stabile, Quantitative assessment of the risk of airborne transmission of sars-cov-2 infection: prospective and retrospective applications, Environment international 145 (2020) 106112.
  * [64] M. Z. Bazant, O. Kodio, A. E. Cohen, K. Khan, Z. Gu, J. W. Bush, Monitoring carbon dioxide to quantify the risk of indoor airborne transmission of COVID-19, Flow 1 (2021) E10.
  * [65] Z. Peng, J. L. Jimenez, Exhaled CO2 as a COVID-19 infection risk proxy for different indoor environments and activities, Environmental Science & Technology Letters 8 (5) (2021) 392–397.
  * [66] L. Stabile, A. Pacitto, A. Mikszewski, L. Morawska, G. Buonanno, Ventilation procedures to minimize the airborne transmission of viruses in classrooms, Building and Environment 202 (2021) 108042.
  * [67] W. R. von Pohle, J. D. Anholm, J. McMillan, Carbon dioxide and oxygen partial pressure in expiratory water condensate are equivalent to mixed expired carbon dioxide and oxygen, Chest 101 (6) (1992) 1601–1604.
  * [68] S. N. Rudnick, D. K. Milton, Risk of indoor airborne infection transmission estimated from carbon dioxide concentration., Indoor Air 13 (3) (2003) 237–245.
  * [69] K. Lin, L. C. Marr, Humidity-dependent decay of viruses, but not bacteria, in aerosols and droplets follows disinfection kinetics, Environmental Science & Technology 54 (2) (2019) 1024–1032.
  * [70] L. C. Marr, J. W. Tang, J. Van Mullekom, S. S. Lakdawala, Mechanistic insights into the effect of humidity on airborne influenza virus survival, transmission and incidence, J. R. Soc. Interface 16 (150) (2019) 20180298.
  * [71] G. Harper, Airborne micro-organisms: survival tests with four viruses, Epidemiology & Infection 59 (4) (1961) 479–486.
  * [72] P. Hoeksma, A. J. A. Aarnink, N. W. M. Ogink, Effect of temperature and relative humidity on the survival of airborne bacteria= effect van temperatuur en relatieve luchtvochtig-heid op de overleving van bacteriën in de lucht, Tech. rep., Wageningen UR Livestock Research (2015).
  * [73] Y. Qiu, Y. Zhou, Y. Chang, X. Liang, H. Zhang, X. Lin, K. Qing, X. Zhou, Z. Luo, The effects of ventilation, humidity, and temperature on bacterial growth and bacterial genera distribution, International Journal of Environmental Research and Public Health 19 (22) (2022) 15345.


# Applications of Machine Learning in Cryptography: A Survey

Mohammed M. Alani  0000-0002-4324-1774 Khawarizmi International CollegeAbu
DhabiUnited Arab Emirates<EMAIL_ADDRESS>
(2019)

###### Abstract.

Machine learning techniques have had a long list of applications in recent
years. However, the use of machine learning in information and network
security is not new. Machine learning and cryptography have many things in
common. The most apparent is the processing of large amounts of data and large
search spaces.
In its varying techniques, machine learning has been an interesting field of
study with massive potential for application. In the past three decades,
machine learning techniques, whether supervised or unsupervised, have been
applied in cryptographic algorithms, cryptanalysis, steganography, among other
data-security-related applications.
This paper presents an updated survey of applications of machine learning
techniques in cryptography and cryptanalysis. The paper summarizes the
research done in these areas and provides suggestions for future directions in
research.

cryptography, cryptanalysis, machine learning

††journalyear: 2019††copyright: acmlicensed††conference: 2019 the 3rd
International Conference on Cryptography, Security and Privacy; January 19–21,
2019; Kuala Lumpur, Malaysia††booktitle: 2019 the 3rd International Conference
on Cryptography, Security and Privacy (ICCSP 2019), January 19–21, 2019, Kuala
Lumpur, Malaysia††price: 15.00††doi: 10.1145/3309074.3309092††isbn:
978-1-4503-6618-2/19/01

##  1\. Introduction

In 1991, Ronald Rivest, one of the creators of RSA, presented an invited talk
in ASIACYPT’1991 about cryptography and machine learning(ref3, ). In his talk,
Rivest discussed the similarities and differences between machine learning and
cryptography, and how each area can impact the other. Since Ronald Rivest
spoke about the “cross-fertilization” of the fields of machine learning and
cryptography, the area has gained massive attention.
In general, machine learning and cryptanalysis have more in common that
machine learning and cryptography. This is due to that they share a common
target; searching in large search spaces. A cryptanalyst’s target is to find
the right key for decryption, while machine learning’s target is to find a
suitable solution in a large space of possible solutions.
The applications of different machine learning techniques have gained growing
attentions over the past years. The areas of research for these applications
were mainly in the directions list below:

  1. (1)

Applications in cryptography

    1. (a)

Cryptosystems based on machine learning

    2. (b)

Classification of encrypted traffic

  2. (2)

Applications in cryptanalysis

    1. (a)

Cryptanalysis of encryption algorithms

    2. (b)

Attacks based on machine learning

Other areas of research do exist, like privacy preservation(ref16, ; ref17, ;
ref20, ; ref30, ; ref41, ; ref42, ), quantum machine learning(ref33, ; ref43,
), and the manipulation of machine learning to mislead its application to
wrong classification.
Mutual research of machine learning and cryptography is not a new area. That
is why you will find in the survey presented here publications that go back to
1990s. In 1990, Kearns discussed in his dissertation the crpytographical
aspects of machine learning and how computational complexity can be
calculated(ref21, ). This publication paved the way for future research that
involved cryptography and machine learning.
In addition to cryptography and cryptanalysis, machine learning has a wide
range of applications in relation to information and network security. A none-
exhaustive list of examples found here:

  1. (1)

Using machine learning to develop Intrusion Detection System (IDS) (ref23, ;
ref32, ; ref24, )

  2. (2)

Botnet detection(ref25, )

  3. (3)

Network anomaly detection(ref28, )

  4. (4)

Malware analysis and detection(ref34, ; ref38, )

  5. (5)

Homomorphic encrpytion applications(ref35, )

  6. (6)

Attacks on Physical Unclonable Functions (PUFs)(ref36, )

  7. (7)

Malicious code classification and identification(ref40, ; ref39, )

##  2\. Machine Learning and Its Applications

Machine learning happens when we need a machine(computer) to learn to solve a
problem based on, usually large amounts of, data previously fed into the
machine. Machine learning can be a good solution finder for problems for which
we do not have a clear algorithm to solve. For example, when we want the
computer to be able to detect spam emails, there is not clear algorithm that
is 100% accurate in finding spam. Hence, machine learning can be a closer-to-
optimum solution when we feed the machine hundreds or thousands of spam and
non-spam examples. Gradually, the machine will learn to me more and more
accurate in detecting spam emails. The larger the data used for learning
becomes, the more accurate the classification becomes(ref1, ).
With around 2.5 quantillion bytes of data being generated every day(ref2, ),
legacy database systems become incapable of processing such amounts of data.
Unless new technologies are used to transfer, store, and process such large
amounts of data, all of the data being collected will be unusable.
The consumption of this data in a useful commercial application requires data
processing techniques that are design specifically to handle these large
amounts of data. Whether the applications are commercial, like processing user
access patterns to show highly-targeted ads, or for health uses, like
predicting illnesses or illness prediction patterns, or even political, like
predicting civil unrest, machine learning can be of great help in producing
useful information from extremely large amounts of data.
Classification is one of the most widely used applications of machine
learning(ref1, ). A common example of classification is the classification
that banks use for loans; low-risk, and high-risk. A bank needs to be able to
properly classify a loan into one of the two categories. Generally, high-risk
loans are loans that have a high probability of defaulting payments. On the
other hand, low-risk loans are loans that are highly expected to be paid back
on time, and in regular fashion. The data fed into the classification
software, which is basically historical data about the customer, like credit
score, is used as the input. This input will be used in training the software
to produce a rule that is relevant to several factors within the situation of
the loan applicant. This rule will help the bank decide whether this loan is a
high-risk or a low-risk loan.
Another example of machine learning applications is regression. Regression is
the type of problem that produces a number based on multiple inputs. An
example is when a government would like to predict the global prices of oil.
The input to this system is all elements that are expected to impact the oil
prices, like global production rates, current price, last several month’s
prices, season (winter, spring,..etc). The output would be a specific number
driven from the inputs. However, there has to be training that would enable
the system to be more accurate gradually and to learn the impact of change in
each of the input elements.
Learning associations is also one of the applications of machine learning. For
example, analysis of shopping baskets data can produce useful information to
supermarkets that they can use to improve their sales. When the supermarket
system analyzes the data of thousands of shopping baskets, it will be able to
produce useful association information. The system would help the management
know that 80% of people who buy soda, buy potato chips as well. Hence, placing
them in the same aisle can be a useful action to help boost items sales. The
system would be able to recognize that most people buying canned food are
likely to buy disposable plates. Hence, packaging them together or placing
them in the same isle can increase their sales.
Unsupervised learning can also be used in machine learning. When there is no
reference output to compare to, the learning is done through input data only.
This type of learning or training is called unsupervised. A common type of
unsupervised learning is called clustering. Clustering is used in finding
structures or clusters in input data. Companies might use this method to
process past data of customers to try to find density profiles for customers.
Reinforcement learning can also be used in machine learning applications. In
certain applications, the output of the system is a sequence of actions. A
signle action by itself is not important, but the sequence of the correct
action. For example, when playing a game, a single move might not be important
but a sequence of correct actions can lead to a successful accomplishment.

##  3\. Applications in Cryptography

Rosen-Zvi et. al. proposed, in 2002, that mutual learning in a tree parity
machine can be used as public-key cryptosystem(ref22, ). The paper explains
how the tree parity machine has a potential in being used as a public-key
cryptosystem by using its synchronization state as the key in a certain
encryption and decryption rule. This ”key” can be exchanged in public without
the need for prior communication. The receiving side only needs to perform a
finite number if steps of input-output exchange to achieve convergence to a
synchronization state.
In 2005, Klien et. al. introduced a new phenomenon named mutual
learning(ref45, ). This mutual learning phenomenon can be used in
cryptography. Mutual learning can help the two sides of communication to
create a common secret key over a public channel. The two parties have
advatage over the attacker that the attacker will be learning one-way, which
would make it virtually impossible to create the same secret key that the two
sides would have.
Blum, in 2007, discussed the possibilities of connecting machine learning and
cryptography(ref29, ). The paper states that at a technical level, strong
connections between techniques of machine learning and techniques used in
cryptography exist. As an example, the author discussed ”Boosting” technique,
which is a machine learning method designed to extract as much power as
possible out of a learning algorithm. This can be connected to methods for
amplifying cryptosystems.
In 2009, Al-Shammari and Zincir-Heywood introduced a classification technique,
based on machine learning, to classify encrypted traffic(ref8, ). The work was
done to assess the robustness of machine learning classification of encrypted
traffic. the work focused on flow-based without employing commonly used
features like Internet Protocol(IP) addresses, port numbers, and payload
information. The results of this study have shown that C4.5 learning algorithm
outperformed other algorithms like RIPPER, Naive Bayesian, support vector
machine, and AdaBoost.
In 2011, Huan, et. al, presented an invited talk about the adversarial machine
learning(ref14, ). The paper introduced taxonomy for classifying attacks
against online machine learning algorithms. In addition, the paper explored
vulnerabilities in machine learning algorithms and their counter measures. The
paper also presented two models by which adversaries capabilities can be
modeled. The paper discussed thoroughly a specific type of attacks name
exploratory integrity attacks. In this type of attacks, the adversary attempts
to passively circumvent the learning mechanism to exploit blind spots in the
learner that allow miscreant activities to go undetected. This type of attacks
can be used in different applications of machine learning.
In 2012, Schaathun presented a book with a collection of ideas to use machine
learning in steganalysis(ref4, ). The book describes ways in which machine
learning can be employed in countering steganography. The main idea presented
was to classify objects into steganograms or clean documents using machine
learning classification capabilities.
Graepel, et. al. presented, in 2012, a system by which it was possible to
delegate the execution of the machine learning algorithm to a computing
service while maintaining confidentiality through the use of a leveled
homomorphic encryption scheme(ref13, ). The rationale behind this approach was
to employ higher performance computing services, like cloud computing, to
improve the speed of machine learning and the capability to process larger
amounts of data.
Sagar and Kumar introduced, in 2014, a symmetric key encryption algorithm that
was based on counter propagation network(ref10, ). The algorithm proposed is a
symmetric block cipher where data is converted into bits and passed through
the neural network as the plainttext, and the resulting output of the
unsupervised learning process is considered the output. Although the principle
is not presented clearly in the paper, the direction can be further explored.
Bost, et al. presented three major classification protocols that rely on
machine learning in the classification of encrypted data, in 2015(ref7, ). The
three protocols presented, hyperplane decision, Naïve Bayesian, and decision
trees, were combined with AdaBoost. The work produced privacy-preserving
classifiers. The proposed classifiers were tested on medical datasets and have
proven to achieve proper classification with satisfactory efficiency.

##  4\. Applications in Cryptanalysis

Machine learning techniques were also applied to perform side-channel attacks.
In 2011, Hospodar, et. al, presented a first study that suggested utilizing
machine learning in side-channel attacks(ref12, ). The proposed system used
Least Squares Support Vector Machine (LS-SVM) learning algorithm with the
side-channel being the power consumption, wuth a target of software
implementation of Advanced Encrpytion Standard (AES). The study have shown
that the choice of parameters of the machine learning algorithm strongly
impacts the results.
Another side-channel and machine learning coupling was published in 2014.
Lerman, Bontempi, and Markowitch proposed the use of machine learning
techniques to improve accuracy of side-channel attacks(ref6, ). As side-
channel attacks rely on the physical measurements of hardware implementations
of cryptosystems, there are always certain parametric assumptions that these
attacks rely on. The proposed usage of machine learning relaxes such
assumptions and deal with high dimensional feature vectors.
In 2012, Alani introduced a known-plaintext attack that employed a neural
network to perform cryptanalysis(ref9, ). The proposed attack trains a neural
network to decrypt ciphertext without knowing the encryption key. The attack
was successful in reducing the time and the known plaintext-ciphertext pairs
needed for Data Encryption Standard (DES) and Triple-DES to a great extent
compared to other known-plaintext attacks.
In continuation of the work previously presented by Alani in (ref9, ),
Jayachandiran implemented a similar attack on a lightweight cipher named
Simon(ref11, ). However, the attack this time was aimed at finding the key
rather than the plaintext. The proposed neural network was tested on reduced-
round version of the cipher, and on the full-round version as well. Network
configurations were also changed to try to find achieve the highest possible
accuracy.
Conti, et al., in 2015, published research on analysis of Android encrypted
network traffic(ref5, ). This analysis was focused on identifying user action,
in spite of being encrypted. In this research, the adversary does not interact
actively with the target, but eavesdrop on encrypted traffic. The collected
encrypted traffic is then analyzed using advanced machine learning techniques
to figure out the actions performed by the user. The proposed system achieved
accuracy of up to 95% in identifying the user actions.
In 2016, Maghrebi et. al. published their research on the use of deep learning
in side-channel attacks(ref31, ). The paper examines the possibility of a more
sophisticated profiling techniques to reduce assumptions in template attacks.
In this paper, deeplearning techniques were used to produce more accurate
results in side-channel attacks on AES. The results stated in the paper
confirmed the advatages of this technique implemented on protected and
unprotected implementations of AES.
Yu et. al. presented, in 2016, a technique that can prevent machine learning
from being used as an attack tool in PUFs for lightweight
authentication(ref44, ). The paper introduced a lightweight PUF-based
authentication approach that is couple with a lockdown technique to prevent
machine learning from successfully obtaining the new challenge-response pair.

##  5\. Attacks on Machine Learning

Barreno et. al. published, in 2006, a paper discussing whether machine
learning can be secure or not(ref26, ). The paper introduced a taxonomy of
different types of attacks on machine learning techniques and systems. The
paper also introduced defenses against those attacks with an analytical model
showing attacker’s work function.
In 2010, Barreno et. al. also published a detailed paper building on their
previous work(ref27, ). In this paper, the authors expanded their taxonomy of
attacks and shown how the classes identified influence the cost for the
attacker and defender. The paper also presented a thorough survey of attacks
on machine learning systems and techniques discussed in previous literature.
It illustrates the taxonomy by showing how it can guide attacks against
SpamBayes, the statistical spam filter.
Biggio, et. al discussed, in 2013, a type of attack named evasion
attack(ref15, ). Although to some extent, similar to exploratory integrity
attacks mentioned in section 3, this attack relies on injecting adversarial
data in the training data used in a machine-learning-based system. The paper
states that it is important for machine learning to have thorough vetting of
its resistance to adversarial data.
In 2013 as well, Ateniese et. al. introduced a method by which machine
learning classifiers can be exploited to get information by attackers(ref19,
). The paper focused in statistical information that can be unconsciously or
maliciously revealed from machine learning classifiers. In this paper, a novel
meta-classifier was built and trained to hack other classifiers and obtain
meaningful information about their training sets. This kind of attack can be
used to build a more effective classifier or to obtain trade secrets from
competitors by violating intellectual property rights.
However, learning approaches can be evaded by adversaries, who change their
behavior in response to the learning methods. To-date, there has been limited
research into learning techniques that are resilient to attacks with provable
robustness guarantees The Perspectives Workshop, ”Machine Learning Methods for
Computer Security” was convened to bring together interested researchers from
both the computer security and machine learning communities to discuss
techniques, challenges, and future research directions for secure learning and
learning-based security applications. As a result of the twenty-two invited
presentations, workgroup sessions and informal discussion, several priority
areas of research were identified. The open problems identified in the field
ranged from traditional applications of machine learning in security, such as
attack detection and analysis of malicious software, to methodological issues
related to secure learning, especially the development of new formal
approaches with provable security guarantees. Finally a number of other
potential applications were pinpointed outside of the traditional scope of
computer security in which security issues may also arise in connection with
data-driven methods. Examples of such applications are social media spam,
plagiarism detection, authorship identification, copyright enforcement,
computer vision (particularly in the context of biometrics), and sentiment
analysis.

Peprnot, et. al. presented, in 2016, a thorough study of security and privacy
in machine learning(ref18, ). The paper introduces a comprehensive threat
model for machine learning along with proper categorization of attacks and
defenses within an adversarial framework. The adversarial settings of training
were categorized to two categories; targeting privacy, and targeting
integrity. On the other hand, inferring in adversarial settings was
categorized in to two categories as well; white-box adversaries, and black-box
adversaries. The paper also discussed how a robust, private, and accountable
machine learning model can be achieved.

##  6\. Conclusion and Future Directions

In this paper, we presented a survey of applications of machine learning in
cryptography and cryptanalysis. The review of the literature indicated that
there is a huge room for improvement in these research areas. The paper have
also discussed security attacks on machine learning techniques and machine-
learning-based systems.

Future directions in machine learning and cryptography may include:

  1. (1)

Employing machine learning algorithms in symmetric and asymmetric
cryptosystems design. Perhaps with the advancements in Artificial Intelligence
(AI) we can witness two AI-based systems design their own cryptosystem.

  2. (2)

Employing machine learning in privacy-reserving training based on obscured
data sets.

  3. (3)

The use of machine learning techniques in cryptanalysis to extract decryption
keys from ciphertext blocks.

  4. (4)

Connecting machine learning with existing cryptanalysis techniques (like
differential or linear cryptanalysis) to improve their efficiency in finding
solutions in the search space.

## References

  * (1) R. L. Rivest, “Cryptography and machine learning,” in Advances in Cryptology — ASIACRYPT ’91 (H. Imai, R. L. Rivest, and T. Matsumoto, eds.), (Berlin, Heidelberg), pp. 427–439, Springer Berlin Heidelberg, 1993.
  * (2) C. Dwork, A. Roth, et al., “The algorithmic foundations of differential privacy,” Foundations and Trends® in Theoretical Computer Science, vol. 9, no. 3–4, pp. 211–407, 2014.
  * (3) A. D. Sarwate and K. Chaudhuri, “Signal processing and machine learning with differential privacy: Algorithms and challenges for continuous data,” IEEE signal processing magazine, vol. 30, no. 5, pp. 86–94, 2013.
  * (4) O. Ohrimenko, F. Schuster, C. Fournet, A. Mehta, S. Nowozin, K. Vaswani, and M. Costa, “Oblivious multi-party machine learning on trusted processors.,” in USENIX Security Symposium, pp. 619–636, 2016.
  * (5) B. Wang, M. Li, S. S. Chow, and H. Li, “Computing encrypted cloud data efficiently under multiple keys,” in Communications and Network Security (CNS), 2013 IEEE Conference on, pp. 504–513, IEEE, 2013.
  * (6) P. Mohassel and Y. Zhang, “Secureml: A system for scalable privacy-preserving machine learning,” in 2017 38th IEEE Symposium on Security and Privacy (SP), pp. 19–38, IEEE, 2017.
  * (7) K. Bonawitz, V. Ivanov, B. Kreuter, A. Marcedone, H. B. McMahan, S. Patel, D. Ramage, A. Segal, and K. Seth, “Practical secure aggregation for privacy-preserving machine learning,” in Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pp. 1175–1191, ACM, 2017.
  * (8) Y.-B. Sheng and L. Zhou, “Distributed secure quantum machine learning,” Science Bulletin, vol. 62, no. 14, pp. 1025–1029, 2017.
  * (9) D. Ristè, M. P. da Silva, C. A. Ryan, A. W. Cross, A. D. Córcoles, J. A. Smolin, J. M. Gambetta, J. M. Chow, and B. R. Johnson, “Demonstration of quantum advantage in machine learning,” npj Quantum Information, vol. 3, no. 1, p. 16, 2017.
  * (10) M. J. Kearns, The computational complexity of machine learning.  MIT press, 1990.
  * (11) Z. Yu and J. J. Tsai, “A framework of machine learning based intrusion detection for wireless sensor networks,” in Sensor Networks, Ubiquitous and Trustworthy Computing, 2008. SUTC’08. IEEE International Conference on, pp. 272–279, IEEE, 2008.
  * (12) X. Xu, “Adaptive intrusion detection based on machine learning: feature extraction, classifier construction and sequential pattern prediction,” International Journal of Web Services Practices, vol. 2, no. 1-2, pp. 49–58, 2006.
  * (13) A. A. Alsadhan and M. M. A. Alani, “Detecting ndp distributed denial of service attacks using machine learning algorithm based on flow-based representation,” in Developments in eSystems Engineering (DeSE), 2018 Eleventh International Conference on, IEEE, 2018.
  * (14) S. Ranjan, “Machine learning based botnet detection using real-time extracted traffic features,” Mar. 25 2014.  US Patent 8,682,812.
  * (15) D. K. Bhattacharyya and J. K. Kalita, Network anomaly detection: A machine learning perspective.  Chapman and Hall/CRC, 2013.
  * (16) H. V. Nath and B. M. Mehtre, “Static malware analysis using machine learning methods,” in International Conference on Security in Computer Networks and Distributed Systems, pp. 440–450, Springer, 2014.
  * (17) M. Z. Mas’ ud, S. Sahib, M. F. Abdollah, S. R. Selamat, and R. Yusof, “Analysis of features selection and machine learning classifier in android malware detection,” in Information Science and Applications (ICISA), 2014 International Conference on, pp. 1–5, IEEE, 2014.
  * (18) L. J. Aslett, P. M. Esperança, and C. C. Holmes, “A review of homomorphic encryption and software tools for encrypted statistical machine learning,” arXiv preprint arXiv:1508.06574, 2015.
  * (19) X. Xu and W. Burleson, “Hybrid side-channel/machine-learning attacks on pufs: A new threat?,” in Proceedings of the conference on Design, Automation & Test in Europe, p. 349, European Design and Automation Association, 2014.
  * (20) O. Friedrichs, A. Huger, and A. J. O’donnell, “Method and apparatus for detecting malicious software using machine learning techniques,” Oct. 28 2014\.  US Patent 8,875,286.
  * (21) R. Komiya, I. Paik, and M. Hisada, “Classification of malicious web code by machine learning,” in Awareness Science and Technology (iCAST), 2011 3rd International Conference on, pp. 406–411, IEEE, 2011.
  * (22) E. Alpaydin, Introduction to machine learning.  MIT press, 2014.
  * (23) “How much data do we create every day?.” https://www.forbes.com/sites/bernardmarr/2018/05/21/how-much-data-do-we-create-every-day-the-mind-blowing-stats-everyone-should-read/#645fe1f960ba.  Accessed: 2018-11-17.
  * (24) M. Rosen-Zvi, E. Klein, I. Kanter, and W. Kinzel, “Mutual learning in a tree parity machine and its application to cryptography,” Physical Review E, vol. 66, no. 6, p. 066135, 2002.
  * (25) E. Klein, R. Mislovaty, I. Kanter, A. Ruttor, and W. Kinzel, “Synchronization of neural networks by mutual learning and its application to cryptography,” in Advances in Neural Information Processing Systems, pp. 689–696, 2005\.
  * (26) A. Blum, “Machine learning theory,” Carnegie Melon Universit, School of Computer Science, p. 26, 2007.
  * (27) R. Alshammari and A. N. Zincir-Heywood, “Machine learning based encrypted traffic classification: Identifying ssh and skype,” in Computational Intelligence for Security and Defense Applications, 2009. CISDA 2009. IEEE Symposium on, pp. 1–8, IEEE, 2009.
  * (28) L. Huang, A. D. Joseph, B. Nelson, B. I. Rubinstein, and J. Tygar, “Adversarial machine learning,” in Proceedings of the 4th ACM workshop on Security and artificial intelligence, pp. 43–58, ACM, 2011.
  * (29) H. G. Schaathun, Machine learning in image steganalysis.  Wiley-IEEE Press, 2012.
  * (30) T. Graepel, K. Lauter, and M. Naehrig, “Ml confidential: Machine learning on encrypted data,” in International Conference on Information Security and Cryptology, pp. 1–21, Springer, 2012.
  * (31) V. Sagar and K. Kumar, “A symmetric key cryptographic algorithm using counter propagation network (cpn),” in Proceedings of the 2014 International Conference on Information and Communication Technology for Competitive Strategies, p. 51, ACM, 2014.
  * (32) R. Bost, R. A. Popa, S. Tu, and S. Goldwasser, “Machine learning classification over encrypted data.,” in NDSS, 2015.
  * (33) G. Hospodar, B. Gierlichs, E. De Mulder, I. Verbauwhede, and J. Vandewalle, “Machine learning in side-channel analysis: a first study,” Journal of Cryptographic Engineering, vol. 1, no. 4, p. 293, 2011.
  * (34) L. Lerman, G. Bontempi, and O. Markowitch, “Power analysis attack: an approach based on machine learning,” International Journal of Applied Cryptography, vol. 3, no. 2, pp. 97–115, 2014.
  * (35) M. M. Alani, “Neuro-cryptanalysis of des and triple-des,” in International Conference on Neural Information Processing, pp. 637–646, Springer, 2012.
  * (36) K. Jayachandiran, “A machine learning approach for cryptanalysis,”
  * (37) M. Conti, L. V. Mancini, R. Spolaor, and N. V. Verde, “Analyzing android encrypted network traffic to identify user actions,” IEEE Transactions on Information Forensics and Security, vol. 11, no. 1, pp. 114–125, 2016.
  * (38) H. Maghrebi, T. Portigliatti, and E. Prouff, “Breaking cryptographic implementations using deep learning techniques,” in International Conference on Security, Privacy, and Applied Cryptography Engineering, pp. 3–26, Springer, 2016.
  * (39) M.-D. Yu, M. Hiller, J. Delvaux, R. Sowell, S. Devadas, and I. Verbauwhede, “A lockdown technique to prevent machine learning on pufs for lightweight authentication,” 2016.
  * (40) M. Barreno, B. Nelson, R. Sears, A. D. Joseph, and J. D. Tygar, “Can machine learning be secure?,” in Proceedings of the 2006 ACM Symposium on Information, computer and communications security, pp. 16–25, ACM, 2006.
  * (41) M. Barreno, B. Nelson, A. D. Joseph, and J. D. Tygar, “The security of machine learning,” Machine Learning, vol. 81, no. 2, pp. 121–148, 2010.
  * (42) B. Biggio, I. Corona, D. Maiorca, B. Nelson, N. Šrndić, P. Laskov, G. Giacinto, and F. Roli, “Evasion attacks against machine learning at test time,” in Joint European conference on machine learning and knowledge discovery in databases, pp. 387–402, Springer, 2013.
  * (43) G. Ateniese, G. Felici, L. V. Mancini, A. Spognardi, A. Villani, and D. Vitali, “Hacking smart machines with smarter ones: How to extract meaningful data from machine learning classifiers,” arXiv preprint arXiv:1306.4447, 2013\.
  * (44) N. Papernot, P. McDaniel, A. Sinha, and M. Wellman, “Towards the science of security and privacy in machine learning,” arXiv preprint arXiv:1611.03814, 2016.