Federated Learning (FL) has gained prominence as a decentralized and privacy-preserving paradigm that enables multiple clients to collaboratively train a machine learning model under the supervision of a central server. Instead of centralizing the data, clients keep their data locally and share only model parameters during multiple communication rounds. However, recent attacks, such as gradient reconstruction attacks (GRAs) show privacy issues when an attacker knows the communication of a client. In the literature, these privacy issues are mainly explored when clients compute new parameters using a single gradient descent step on their data (FedSGD) and then send them back to the remote server. In a more realistic scenario, the clients' protocol is based on several gradient descent steps (FedAvg). This protocol adds intermediate computation steps, which are unknown from the attacker, thus making GRAs less successful. In this incremental paper, we conduct exhaustive experiments on four state-of-the-art attacks under the FedAvg protocol, on a very basic and a more complex neural network (ResNet-18) with CIFAR100 dataset. These experiments provide the following results 1) a privacy-utility trade-off analysis, 2) insights on the choice of attacks' hyperparameters, 3) the client's local learning rate has little impact on attacks' effectiveness 4) a proof that the privacy risk is not necessarily decreasing over rounds, contrary to common belief.

Distribution shift detection is paramount in safety-critical tasks that rely on Deep Neural Networks (DNNs). The detection task entails deriving a confidence score to assert whether a new input sample aligns with the training data distribution of the DNN model. While DNN predictive uncertainty offers an intuitive confidence measure, exploring uncertainty-based distribution shift detection with simple sample-based techniques has been relatively overlooked in recent years due to computational overhead and lower performance than plain post-hoc methods. This paper proposes using simple sample-based techniques for estimating uncertainty and employing the entropy density from intermediate representations to detect distribution shifts. We demonstrate the effectiveness of our method using standard benchmark datasets for out-of-distribution detection and across different common perception tasks with convolutional neural network architectures. Our scope extends beyond classification, encompassing image-level distribution shift detection for object detection and semantic segmentation tasks. Our results show that our method’s performance is comparable to existing State-of-the-Art methods while being computationally faster and lighter than other Bayesian approaches, affirming its practical utility.

Dynamic Dependability Management (DDM) is a promising approach to guarantee and monitor the ability of safety-critical Automated Systems (ASs) to deliver the intended service with an acceptable risk level. However, the non-interpretability and lack of specifications of the Learning-Enabled Components (LECs) used in ASs make this mission particularly challenging. Some existing DDM techniques overcome these limitations by using probabilistic environmental perception knowledge associated with predicting behavior changes for the agents in the environment. We propose to improve these techniques with a supervisory system that considers hazard analysis and risk assessment from the design stage. This hazard analysis is based on a characterization of the AS's operational domain (i.e., its scenario space, including unsafe ones). The proposed supervisory system also considers the uncertainty estimation and interaction between AS components through the whole perception-planning-control pipeline. Our framework then proposes leveraging and handling uncertainty from LEC components toward building safer ASs.

The purpose of UML profile mechanism is to design domain specific languages (DSL) based on UML. It exists a wide range of UML profiles: MARTE, ROOM, SysML. Current profile design methodology only considers the syntactic part of the language and keeps informal the execution semantics description. This impairs Model Driven Engineering (MDE) promises which advocates for executable models. This paper presents a systematic approach to formalize the execution semantics of UML profiles using foundational UML (normative specification) which defines a precise semantics for a subset of UML. This approach is integrated into the reference profile design methodology. It is illustrated on a small profile to support Turing machines. It demonstrates capability to execute resulting profiled models through the defined semantics.

The documentation of customer needs from the source specifications in a modeling environment for allocating them to architectural elements needs efficient tools and techniques in requirement engineering. Once requirements are present in models, enhancement with suitable properties, classification, prioritization. and allocation on system architecture are then possible. A downside is that the customer needs are likely to evolve over time, and then, we would need to manually redo the modeling of the requirements. Then, what we want to avoid is the manual definition of the customer needs from the source documents as a requirements model in the target environment. We propose in this paper a solution to import and export in Papyrus MDT, a UML modeling tool, the customers' needs from Microsoft documents using the Requirement Interchange Format, ReqIF.

One pillar of Model-Driven Development for real-time embedded software is the separation of concerns between application model and target platform. This requires definition of model transformations realizing the mapping of the application model onto the target platform. Real-Time and Embedded Systems design means coping with different target platforms and with heterogeneous constraints related to time, synchronization and memory footprint. However, different target platforms have APIs and implementation patterns that vary significantly so that it is necessary to develop several dedicated model transformations in order to achieve portability between them. Although this is one way to achieve portability, we show in this paper that the cost of portability can be reduced by providing domain-independent model transformations while still ensuring performance requirements are satisfied.

AUTOSAR (Automotive Open System Architecture) is enjoying increasing interest and broad acceptance in the automotive domain. AUTOSAR aims at defining an open standardized software architecture to face future challenges in automotive development including the development of time-critical systems (e.g. brake-by-wire or steer-by-wire). Mastering the development of such systems requires being able to analyze their real-time behavior. Scheduling analysis is the theory that studies how far a real-time system may satisfy its real-time requirements against its real-time properties. In this paper, we will study to what extent it is possible to apply some of those scheduling analysis techniques on real-time systems deployed on AUTOSAR-compliant architectures. The paper focuses on scheduling analysis techniques implemented in one open source tool. A concrete case study shows the feasibility of the approach and shows scheduling analysis results.

The requirements of adaptive real-time systems include time constraints. They do not only have to hold during normal operation, but also during reconfiguration. This implies time constraints for adaptation operations, which are executed by a reconfiguration framework. In this paper, we present an off-line verification of these time constraints based on a comparison of the worst-case execution time required for the adaptation with the available time slots in the application schedule. We use a model-driven engineering approach, in which a state machine represents the application configurations and the transitions between these.

One pillar of Model-Driven Development of real-time software is the separation of concerns between application model and target platform. This requires the definition of model transformations realizing the mapping of the application model onto the target platform. However, target platforms APIs and implementation patterns vary largely from one to the other. This requires the development of several dedicated model transformations which actually embed a given computing target platform model. Dedicated model transformations have shown their limits as soon as we want to modify target platform. In this context, a good compromise could be to extract implementation patterns from model transformation and encapsulate them in a platform model. We, therefore propose some modeling heuristics that permits to build detailed descriptions of the target execution platform, where all platform-specific implementation choices are made explicit using a small set of variation points specific to real-time multi-tasking applications. The benefit expected is a true separation of concerns enabling efficient, reusable and portable transformation processes.

Model-Based Development (MBD) provides an additional level of abstraction, the model, which lets engineers focus on the business aspect of the developed system. MBD permits automatic treatments of these models with dedicated tools like synthesis of system's application by automatic code generation. Real-Time and Embedded Systems (RTES) are often constrained by their environment and/or the resources they own in terms of memory, energy consumption with respect to performance requirements. Hence, an important problem to deal with in RTES development is linked to the optimization of their software part. Although automatic code generation and the use of optimizing compilers bring some answers to application optimization issue, we will show in this paper that optimization results may be enhanced by adding a new level of optimizations in the modeling process. Our arguments are illustrated with examples of the Unified Modeling Language (UML) state machines diagrams which are widely used for control aspect modeling of RTES. The well-known Gnu Compiler Collection (GCC) is used for this study. The paper concludes on a proposal of two step optimization approach that allows reusing as they are, existing compiler optimizations.

This paper addresses the problem of code optimization for Real-Time and Embedded Systems (RTES). Such systems are designed using Model-Based Development (MBD)approach that consists of performing three major steps: building models, generating code from them and compiling the generated code. Actually, during the code generation, an important part of the modeling language semantics which could be useful for optimization is lost, thus, making impossible some optimizations achievement. This paper shows how adding a new level of optimization at the model level results in a more compact code. It also discusses the impact of the code generation on optimization: whether this step promotes or prevents optimizations. We conclude on a proposal of a new MBD approach containing only steps that advance optimization: modeling and compiling steps.

The development of embedded Systems becomes more and more complex. Model driven engineering can help to manage this complexity by specifying real-time properties in a declarative way and automating the deployment. The UML profile MARTE is a OMG standard that allows to model real-time properties. However, there is no execution infrastructure that supports MARTE's generic component model (GCM) and the application modeling (HLAM).

Multi-threaded real-time applications run on platforms that offer services such as concurrency, timing and synchronization. In a model driven context, separation of concerns between functional specification and design choices is one of the key challenges. For that purpose, annotations defined by the MARTE sub-profile for Software Resource Modeling (SRM) provide high level abstractions of target software platforms helping to deploy the same application model on various targets. However, deployment of an application on a platform is not only characterized by the API of the targeted OS, but it is also influenced by possible design restrictions set by the programming languages and their related libraries. We examine key characteristics that exist in two widely used programming languages (C++ and Java) and their libraries to analyze how this can be handled with an MDE approach based on the use of SRM.

The UML is now the most widespread language for systems modeling. However, this language has been designed as a general purpose modeling language that may lack for modeling constructs for specific domain, as for the real-time embedded (RTE) domain. In order to fill this lack, OMG has standardized a UML extension, called MARTE. This UML profile consists of specific concepts defined to cope with the specific concerns of the RTE domain. Of course, MARTE provides support for enabling model driven engineering (MDE) of RTE systems. The MDE development paradigm makes the model the first class citizen of development processes. Models need then to be productive. To achieve this purpose, providing methodology enabling model to be executable is a real challenge. The goal of this paper is then to present, on the one hand a UML/MARTE based methodology for executable RTE systems modeling and on the other hand, a framework and its underlying model transformations required to execute UML models conforming to the MARTE standard.

A UML profile for Modeling and Analysis of Real-Time and Embedded systems (MARTE) has been recently standardized by the OMG. This initiative meets the needs of several Thales divisions (e.g., aerospace, land and joint and air systems), which develop real-time and embedded systems. CEA LIST, INRIA and Thales have been the main contributors to the MARTE standard through the ProMARTE consortium. To foster the deployment of MARTE in Thales divisions, we have launched the development of a case study related to a real-time and embedded system using the MARTE adopted specification. As a first step of this study, we make use of a fictive system—the Josefil challenge—to evaluate whether the profile is applicable to the Thales current systems andsoftware engineering practices. The purpose of this paper is to report on this first stage and outline the next scheduled activities.

One promising solution for meeting the demands of constantly-evolving Real-Time Embedded (RTE) software is the model-driven development (MDD) paradigm, based on the principle of separating the description of an application from its platform-specific implementation. Existing model-driven approaches strive to achieve this separation through dedicated model transformations which actually embed a given computing platform model. This is a major impediment for MDD dissemination in an industrial context. The resulting dearth of customizable transformations hampers description of reusable generative processes. We therefore propose to explicitly describe the targeted computing platforms in the design process. The main benefit expected from explicit platform models is a true separation of concerns that enables efficient, reusable and customizable generative processes. This proposal is strongly promoted by the new OMG (Object Management Group) standard profile for Modeling and Analysis of Real-Time and Embedded systems (MARTE), with its software multitasking platforms. In this paper, we first describe the MARTE feature and then propose a framework for integrating explicit platform descriptions into a model-based generative process.

The profile extension mechanism has permitted a rapid growth of the use of UML as a domain-specific modeling language. However, designing profiles typically falls into ad-hoc processes that often rely on domain-inappropriate primitives. One of the fundamental reasons is that profiles are specified on the same level of abstraction as the UML abstract syntax and consequently they narrow down the design space to an implementation level. In order to improvethis situation, some profile designers start from a "conceptual domain model" that states the domain ontology, and only then deal with finding out the profile extensions to support it. In spite of this, building truthfulness conceptual domain models and maintaining traceable mapping with the profile view is a bit of an art. In this paper, we propose to systematize the design of UML profiles built-upon conceptual domain models, by adopting a minimal setof framing rules. As these rules are defined on the basis of regularly occurring design patterns, domain models can be afterward checked for self-consistency and interactively transformed in stereotypes, tags and constraints

Real-time (RT) applications are designed to control systems that are inherently parallel. For easing development, abstractions are mandatory to model this concurrency. To achieve this goal, the real-time object paradigm is proposed. It is used to demonstrate how to separate functional and concurrency concerns ensuring also high-level abstraction for parallelism modeling

Moving from code-oriented to model-oriented development facilitates significantly management of increasingly complex software. As explained in [1], clear separation of concerns during application development can drastically increase maintainability, reusability and complexity management. Although existing UML-based approaches for real-time systems development do help speed up software development, they still result in models that are hard to maintain and reuse. This drawback is mainly due to a failure to apply the principles of separating concerns. This paper presents an UML-based method using Aspect Principles and dedicated to the development of real-time embedded systems. It focuses mainly on how suitable separation of concerns may ease reusability and maintainability. Specifically, it depicts how application behavior can be clearly modeled applying separation of control and computation aspects of behavior in UML.