Eugene H. Spafford researches computer security and analyzed the computer worm that disrupted Internet systems in November 1988. His technical report reconstructed the program's behavior using independent reverse-compilations and a disassembly, connecting observed failures with weaknesses in the affected systems.^[ref]

The historical program copied itself between vulnerable machines running versions of Unix. Its disruption illustrates a security failure involving computation and connectivity, even without defining the event solely by altered user files. Spafford's analysis treated program behavior, system assumptions and possible mitigations as related parts of the explanation.^[ref]

An original resource model separates stored-data correctness from service availability. Suppose legitimate work requires 25 percent of a CPU's capacity, and each unwanted running copy requires another two percent. Twenty copies demand $0.25+20(0.02)=0.65$ of capacity; 40 demand $1.05$. In this stipulated model, the latter demand exceeds what that CPU can supply, so some work must wait or fail. No changed document is required for users to lose timely service. These invented loads are an explanatory model, not measurements of the 1988 incident.

Reconstructing what a computer program did therefore supports a more precise security claim than merely observing that a machine became slow. The tested resource and the evidence for the failure mechanism must both be stated.

Simson Garfinkel researches computer security, privacy and digital forensics. With Abhi Shelat, he studied whether used hard disk drives retained readable information after disposal or resale. Their 2003 paper transformed a general concern about confidentiality into an investigation of actual storage devices.^[ref]

The researchers acquired 158 drives between November 2000 and August 2002, recorded their provenance and examined copied device contents. Some drives were damaged or unreadable; others retained recoverable data. The paper distinguishes ordinary access through a file system from information remaining outside its live names and records. It also cautions that the sample does not establish a population-wide prevalence.^[ref]

An original storage example makes the distinction concrete. Suppose a toy file system holds a document in four 512-byte file data blocks. Removing its name from a file-system directory and marking those blocks reusable can leave all $4\times 512=2048$ content bytes unchanged. The file deletion changed live bookkeeping, while this stipulated model performed zero overwrites of the document's contents. Other file systems can behave differently, but disappearing from a directory listing alone does not prove data sanitization.

The experiment motivates testing a storage claim at the level it concerns: absence of a live filename and absence of recoverable former content are different observations.

Carla P. Gomes studies algorithms for difficult search problems. With Bart Selman, she investigated algorithm portfolios: policies that combine candidate algorithms or randomized runs to exploit complementary runtime behavior. Their 2001 paper compared concurrent execution, interleaving and restart policies under specified problem distributions.^[ref]

A portfolio's benefit depends on how its runs behave together. For an original model, let one randomized algorithm finish in one second with probability $1/2$ and in ten seconds otherwise. Its expected value of completion time is $5.5$ seconds. Run two copies on separate full-speed CPUs and stop both at the first acceptable answer. With independent random variables for their completion times, both are slow with probability $1/4$, so mean wall time isIf their completion times are identical on every trial, that mean remains $5.5$ seconds. Different run labels do not establish independence.

The faster wall time also has a resource cost. In the stipulated independent model, both CPUs run until the first completion, consuming mean total work $2(3.25)=6.5$ CPU-seconds. This exceeds the single-run mean even though the answer arrives sooner. Gomes and Selman's portfolio approach makes such choices explicit: a useful policy is assessed against its workload, stopping rule and resource budget, rather than presumed universally faster.

Abhi Shelat is a computer scientist whose work includes cryptography and empirical studies of data sanitization. His first-person academic biography describes doctoral research on non-interactive zero-knowledge proofs and subsequent work at IBM's Zurich research laboratory and universities, including a move to Northeastern in2016.^[ref]

With Simson Garfinkel, he studied what information remained on second-hand hard disk drives. Their2003 paper reported acquiring158 drives between November2000 and August2002 and examining what could be recovered from the readable devices. The study made data sanitization a measurable problem in the handling of retired hardware, beyond a claim that files had been deleted.^[ref]

An original denominator example explains a limit of such evidence. Suppose a hypothetical sample contains100 drives, of which70 are readable and21 of those contain the specified residual data. The fraction is $21/70=30\%$ among readable devices but $21/100=21\%$ among all acquired devices. Treating unreadable devices as proven clean would change the scientific claim. Neither ratio establishes a population prevalence without a suitable sampling argument.

His cryptography work and the disk study address different parts of information protection: properties of cryptographic protocols and the behavior of real storage practices. The combination illustrates why a mathematically specified protection mechanism and evidence about its use are complementary research subjects.

Homepage: shelat.khoury.northeastern.edu/bio/

Danilo Jimenez Rezende coauthored the 2014 stochastic-backpropagation work with Shakir Mohamed and Daan Wierstra, developing trainable generative and approximate-inference models.^[ref] With Shakir Mohamed, he subsequently developed normalizing flows for richer approximations in variational inference.^[ref]

An original one-dimensional transformation illustrates the density accounting. Let $ϵ$ have standard normal distribution and take $Z=2ϵ+1$. Sampling is straightforward, but its density must also account for the stretching of length:At $z=1$, this is $1/(2\sqrt{2\pi })$. The factor $1/2$ comes from the absolute derivative of the inverse affine map. Omitting it would give a density integrating to $2$ instead of $1$.

The example is only an affine Gaussian transformation; it does not claim that every nonlinear transformation preserves a Gaussian family. A normalizing flow composes suitable invertible transformations while tracking the corresponding density changes. This connects an efficient sampling procedure to the density evaluation needed in a variational objective, rather than treating the generated samples alone as a complete inference method.

Shakir Mohamed coauthored the 2014 stochastic-backpropagation paper with Danilo Jimenez Rezende and Daan Wierstra. It develops gradient computations through stochastic variables for joint learning of generative and approximate-inference models.^[ref] He also coauthored the 2015 work on normalizing flows with Danilo Jimenez Rezende, constructing flexible approximate posterior distributions through invertible transformations.^[ref]

An original smooth example shows why a reparameterization gradient is a computational object. Let $Z_{\mu }=\mu +ϵ$ with standard-normal $ϵ$, and choose $J(\mu )=\mathbb{E}[\sin Z_{\mu }]$. The exact expectation and derivative areDifferentiating a sampled value while holding its noise fixed gives $\cos (\mu +ϵ)$. At $\mu =0$, a chosen draw $ϵ=0$ yields gradient $1$, while the exact expectation gradient is $e^{-1/2}\approx 0.60653$. Averaging the sampled gradients over the stated noise distribution recovers the expectation gradient in this smooth bounded example.

That calculation depends on the distribution and differentiability assumptions. It does not make a single random derivative equal to the derivative of an expectation, nor does it by itself establish an analogous rule for a discontinuous sampling map. The cited contributions concern explicit probabilistic models and estimators, not an unrestricted license to differentiate through any random procedure.

Daan Wierstra coauthored the 2014 work on stochastic backpropagation with Danilo Jimenez Rezende and Shakir Mohamed. The primary paper identifies all three with Google DeepMind in London. Their method jointly trains a generative model and a recognition network representing an approximate posterior.^[ref]

An original scalar example isolates the shared inference-map parameter. For inputs $x\in \{0,1\}$, take a Gaussian sample $Z_w(x)=wx+ϵ$, where $ϵ$ has a standard normal distribution. The same $w$ controls both conditional means. Define the chosen toy lossIts derivative is $w-1$, so at $w=0$ the gradient is $-1$. Holding a noise draw fixed permits the chain rule to pass through $Z_w(x)$ to the shared parameter, rather than optimizing a separate free mean for every input.

The paper's actual objective is a variational bound, not this squared-error illustration. Its Gaussian reparameterization provides a computable reparameterization gradient through random variables.^[ref] The example explains one ingredient of that collaborative contribution without assigning the complete method to one coauthor.

Ramaswamy Chandramouli coauthored Guidelines for Media Sanitization by Ramaswamy Chandramouli and Eric A. Hibbard, revision2, with Eric A. Hibbard in2025. The printed title page identifies Chandramouli with the National Institute of Standards and Technology's Computer Security Division.^[ref]

Their guidance classifies data sanitization by recovery resistance and the medium's future usability. In particular, destroying a medium prevents its subsequent use for data storage; this is an additional consequence beyond the intended protection of the target data.^[ref]

For an original scope example, suppose the same confidential dataset is stored on two devices. The first is successfully sanitized and recorded in an inventory, but the second remains readable. The statement that one device passed its acceptance criteria is compatible with the dataset still being recoverable from the other device. Protection of every relevant copy requires a scope that includes both devices; one certificate cannot establish a claim about an unassessed copy.

A different stipulated requirement might also demand reuse of the original medium. Destruction cannot satisfy that reuse requirement, even if it achieves the intended recovery resistance. The example shows why acceptance depends on both the information being protected and the constraints on the medium, without recommending a device-specific erasure technique.

Eric A. Hibbard coauthored the September2025 revision of Guidelines for Media Sanitization by Ramaswamy Chandramouli and Eric A. Hibbard with Ramaswamy Chandramouli. Its title page identifies Hibbard with Samsung Semiconductor, Inc.; the printed initial is retained without expansion.^[ref]

The guide distinguishes sanitization verification, checking the outcome of the attempted process, from sanitization validation, deciding whether that outcome adequately protects the target data.^[ref]

An original acceptance example separates those decisions. Suppose a specified process reports successful completion on all ten devices in a batch, and inspection finds no execution errors. Later assessment establishes that the selected technique is unsuitable for the particular storage technology on two devices. All ten completion records can be genuine while acceptance of the two unsuitable cases fails. The count of successful executions alone cannot establish that the target data is inaccessible at the required recovery effort.

This is a hypothetical classification example, not a procedure for erasing devices. It illustrates the joint guide's distinction between evidence of execution and the adequacy of data sanitization; the byline does not allocate particular sections to individual coauthors.

Karen Kent is the first-listed author of the 2006 Guide to Integrating Forensic Techniques into Incident Response by Karen Kent and others. The guide connects digital forensics to investigating computer security incidents and operational faults, separating collection, examination, analysis and reporting.^[ref]

A technical distinction in that workflow is preserving data integrity while separately evaluating what collected data establishes. The guide describes comparing message digests of original and copied data.^[ref]

For an original counterexample, suppose two computer files contain the same two bytes, with hexadecimal values $41$ and $42$, but their recorded paths and creation times differ. A deterministic cryptographic hash function applied only to those content bytes returns the same value for both. That comparison does not establish equality of their file metadata, identify who created either file, or prove when an event occurred. The input being hashed determines what the comparison can support.

Thus integrity checks support the analysis rather than replacing it. This example is about the logical scope of a content hash, not an incident or experimental result reported by Kent.

Chris Cremer coauthored the 2018 inference-suboptimality study with Xuechen Li and David Duvenaud. It compares shared inference with separately optimized distributions and considers richer approximations built using normalizing flows.^[ref]

For an original illustration of family enrichment, suppose the target posterior distribution is $N(0,4)$ while the family is $\{N(m,1):m\in \mathbb{R}\}$. Its optimum is $m=0$, but the Kullback-Leibler divergence between normal distributions remainsnats. A shared inference rule cannot remove that deficit just by choosing a better mean. Allowing the invertible scale transformation $z=2u$, with $u$ having the standard normal distribution, includes the exact target and makes the variational approximation gap zero in this example.

The example isolates distribution-family expressiveness. It does not imply that adding a normalizing flow always finds the optimum, or that every improvement in a trained variational autoencoder comes from this source alone. The paper's conclusions and method are collaborative; no division of individual authors' roles is inferred from author order.

Xuechen Li coauthored Inference Suboptimality in Variational Autoencoders by Chris Cremer and others with Chris Cremer and David Duvenaud. Their numerical method refits variational parameters per observation and uses the Monte Carlo method with 100 samples to estimate the evidence lower bound during that optimization.^[ref]

An original sampling calculation explains why sample count matters. Suppose independent contributions to a bound estimate have standard deviation two nats. A sample mean from $N$ such contributions has standard error $2/\sqrt{N}$ nats: $0.4$ at $N=25$ and $0.2$ at $N=100$. Quadrupling the sample count halves this sampling error under the independence assumption. These are assumed variances, not measured performance figures from the paper.

Reducing this error helps compare trial distributions, but neither a stable noisy bound nor a numerical stopping rule certifies the globally best member of the family. The mathematical variational approximation gap and amortization gap use that optimum; a measured local improvement can underestimate the latter. This distinction connects the joint experimental method to uncertainty in the numerical diagnostic.

David Duvenaud coauthored the 2018 study of inference suboptimality with Chris Cremer and Xuechen Li. Their analysis distinguishes distribution-family limitations from a shared inference rule's shortcomings.^[ref]

An original diagnostic example makes that distinction numerical. Fix the generative model and one observation. Suppose its exact log evidence is $-5$, the globally best evidence lower bound within a chosen family is $-5.2$, and a recognition network returns a distribution with bound $-5.9$. The variational approximation gap is $0.2$ nat; the amortization gap is $0.7$ nat. They sum to the total $0.9$-nat inference deficit.

These stipulated exact values isolate the diagnostic, rather than reproducing experimental measurements. Improving only the shared rule could recover at most $0.7$ nat within that family. Comparing a different generative model would change the target posterior distribution and would no longer isolate the same gap. This is a contribution of the joint paper; its byline does not specify individual responsibility for each derivation.

Gary Sullivan coauthored Recommended 8-Bit YUV Formats for Video Rendering by Gary Sullivan and Stephen Estrop with Stephen Estrop. Their technical article connects chroma subsampling, sample storage and conversion between the RGB color model and YCbCr.^[ref]

An original neutral-gray example isolates code range conversion from memory layout. Take eight-bit computer RGB inputs $(R,G,B)=(g,g,g)$, with codes from 0 to 255. Since the three coefficients in the guide's luma combination sum to one, the combined gray value is $g$ regardless of which of its two coefficient sets is selected. For its eight-bit nominal video coding, useThus gray 64 becomes $(Y,U,V)=(71,128,128)$, while gray 192 becomes $(181,128,128)$. The separation of the two stored luma codes is 110 rather than 128. These values follow the stipulated input/output ranges and nearest-integer rounding; copying an RGB component directly into the luma slot would implement a different mapping.^[ref]

Changing a pixel format can rearrange those same codes without performing this conversion. Conversely, converting every pixel's three components does not itself require chroma subsampling. Keeping these operations separate is a practical contribution of the jointly authored guide; no individual authorship of its formulas is inferred.

Stephen Estrop coauthored Microsoft's Recommended 8-Bit YUV Formats for Video Rendering by Gary Sullivan and Stephen Estrop with Gary Sullivan. The article is dated April2002, updated November2008, and specifies sample grids and memory layouts for eight-bit video rendering.^[ref]

An original address calculation illustrates why a pixel format needs more than a sample count. Stipulate an NV12 image of width 10 and height 6, with framebuffer stride 16 bytes in both planes. Let the first luma byte have address 2000, and place the interleaved colour-difference plane immediately after the six stored luma rows. Its base is $2000+6(16)=2096$. The allocation holds $96+48=144$ bytes, although active samples require only $60+30=90$ bytes.

At zero-based row 5, column 9, the luma byte is at $2000+5(16)+9=2089$. Its associated subsampled grid cell is row 2, column 4, whose Cb and Cr bytes are at $2096+2(16)+2(4)=2136$ and 2137. Counting active samples as if they were the allocation size would give the wrong plane base. The shared technical article defines NV12's component order; the chosen dimensions, padding and addresses here are illustrative.^[ref]

These calculations locate stored samples. Reconstructing colour additionally requires chroma sample location, chroma reconstruction and the specified YCbCr conversion. The article's joint byline does not identify which coauthor designed an individual format.

Mihir Bellare is a computer scientist whose work in cryptography connects practical constructions with provable security: a claimed security property is expressed as a mathematical condition, with a proof relating an attack to specified assumptions. His UC San Diego homepage describes this emphasis on primitives of applied interest.

With Ran Canetti and Hugo Krawczyk, Mihir Bellare developed the hash-based message authentication code HMAC. Their 1996 paper studies how to turn an unkeyed cryptographic hash function into a keyed message authentication mechanism and analyzes the resulting construction under explicit assumptions. The practical task is to let two parties sharing a cryptographic key detect unauthorized message changes: an ordinary public hash function alone cannot prevent an attacker from changing a message and recomputing its hash.^[ref] The construction was subsequently specified in the February1997 document HMAC: Keyed-Hashing for Message Authentication (RFC 2104); that RFC is explicitly categorized as Informational.^[ref]

With Oded Goldreich, Mihir Bellare also refined the definition of a proof of knowledge. Their work makes “knowing” a mathematical witness operational through a knowledge extractor, with a knowledge error distinguishing acceptance obtainable without such knowledge from acceptance that supports extraction.^[ref]

The graph isomorphism example makes that distinction concrete. A prover sends a graph $H$ and must answer a random challenge asking for an isomorphism from either $G_1$ or $G_2$ to $H$. Preparing only one answer can give acceptance probability $1/2$, so one accepted exchange is not itself evidence that the prover knows an isomorphism between $G_1$ and $G_2$. If an extractor obtains valid maps ${\pi }_1:G_1\to H$ and ${\pi }_2:G_2\to H$ for the same $H$, it can construct ${\pi }_2^{-1}\circ {\pi }_1:G_1\to G_2$. This illustrates why a careful extraction definition, rather than the informal phrase “the verifier was convinced”, matters when building larger cryptographic protocols.^[ref]

Ran Canetti is a computer scientist whose work in cryptography concerns the design and analysis of cryptographic protocols. His institutional biography records a doctorate from the Weizmann Institute.^[ref]

With Mihir Bellare and Hugo Krawczyk, Ran Canetti developed the HMAC message authentication code. The construction turns a cryptographic hash function into a keyed mechanism for detecting unauthorized message changes; its analysis connects a concrete algorithm with explicit security assumptions.^[ref]

Ran Canetti also introduced the framework of universal composability. It addresses a difficulty that appears when security mechanisms are combined: analyzing one isolated execution does not automatically establish security when many executions interact. His framework provides a composition guarantee for cryptographic protocols satisfying its definitions and assumptions, allowing larger systems to be reasoned about through suitable component guarantees.^[ref]

For motivation, imagine an application running two authenticated conversations at once. An attacker may schedule their messages and attempt to reuse information from one conversation in the other. A proof limited to a single isolated conversation leaves this interaction outside its stated model. Universal composability makes such surrounding activity part of the security question; it does not declare every component secure merely because the component has been called cryptographic. The report began in 2000 and an extended abstract appeared in 2001; the linked full report includes later revisions.^[ref]

Hugo Krawczyk is a computer scientist working on the theory and applications of cryptography, including message authentication and the design of cryptographic protocols.^[ref]

With Mihir Bellare and Ran Canetti, Hugo Krawczyk developed HMAC, a message authentication code built from a cryptographic hash function. The scientific problem is that an ordinary public hash function lets anyone recompute a digest after changing a message. A keyed construction lets parties sharing a cryptographic key check authenticity under stated security assumptions.^[ref] Authentication alone does not conceal the message: encryption addresses a different requirement.

With Pasi Eronen, Hugo Krawczyk specified HKDF, an HMAC-based key derivation function. Its extraction step processes input keying material into a pseudorandom key; expansion derives output keying material with application-specific context. For example, a protocol can use distinct context labels for sending and receiving keys, rather than reuse one key for both roles. This separates uses of an existing secret; it does not manufacture secrecy from fully predictable input.^[ref]

Pasi Eronen is a computer scientist contributing to Internet security and cryptographic protocols. His IETF author record links a series of protocol specifications; RFC 5869's author-contact section gives his full name and a Nokia Research Center affiliation at publication.^[ref][ref]

With Hugo Krawczyk, Pasi Eronen specified HKDF, an HMAC-based key derivation function. It separates extraction of an intermediate pseudorandom key from expansion into output keying material, with cryptographic salt and application context supplied as specified inputs.^[ref]

An original output-length calculation illustrates the design. With SHA-256, each expansion block has 32 bytes. Requesting 42 bytes therefore requires two blocks: all 32 bytes of the first and the first 10 of the second. The one-byte block counter limits expansion to 255 blocks, hence 8160 bytes for this hash. These are construction limits, not claims that a longer output contains more independent secret information than its input.^[ref]

The context input supports cryptographic domain separation. A protocol can distinguish two intended roles by unambiguous labels rather than silently reuse identical derived material. The surrounding cryptographic protocol must still authenticate its parties and provide suitable input secrets; HKDF does not establish those properties by itself.^[ref]

Magnus Nystrom is a computer scientist working in computer security and cryptography. An ITU-hosted speaker biography uses the spelling Magnus Nyström and describes his work on security architectures, cryptographic protocols and standards at RSA Security. The biography and RFC identify a security specialist of the same name at RSA Security.^[ref]

Magnus Nystrom authored RFC 4231, which supplies identifiers and cryptographic test vectors for HMAC used with several members of the SHA-2 family. This is a practical contribution to reproducibility and interoperability: two implementations given the same key and message should produce exactly the same authentication value.^[ref]

For a concrete published check, Test Case 1 uses twenty bytes of hexadecimal 0b as the key and the eight ASCII characters Hi There as data. The HMAC-SHA-256 output starts b0344c61. A developer must decode 0b as one byte rather than submit the two text characters 0 and b; confusing those representations changes the input.^[ref]

A cryptographic test vector is an exact check of specified behavior. Passing one example cannot establish the absence of implementation errors for every input, and conformance does not itself prove resistance to every attack. The value of a published collection is that its fixed inputs expose disagreements that informal descriptions of an algorithm can leave hidden.