Covariate adjustment via a regression approach is known to increase the precisionof statistical inference when fixed trial designs are employed in randomizedcontrolled studies. When an adaptive multi-arm design is employed with theability to select treatments, it is unclear how covariate adjustment affectsvarious aspects of the study. Consider the design framework that relies onpre-specified treatment selection rule(s) and a combination test approach forhypothesis testing. It is our primary goal to evaluate the impact of covariateadjustment on adaptive multi-arm designs with treatment selection. Our secondarygoal is to show how the Uniformly Minimum Variance Conditionally UnbiasedEstimator can be extended to account for covariate adjustment analytically. Wefind that adjustment with different sets of covariates can lead to differenttreatment selection outcomes and hence probabilities of rejecting hypotheses.Nevertheless, we do not see any negative impact on the control of the familywiseerror rate when covariates are included in the analysis model. When adjustingfor covariates that are moderately or highly correlated with the outcome, we seevarious benefits to the analysis of the design. Conversely, there is negligibleimpact when including covariates that are uncorrelated with the outcome.Overall, pre-specification of covariate adjustment is recommended for theanalysis of adaptive multi-arm design with treatment selection. Having thestatistical analysis plan in place prior to the interim and final analyses iscrucial, especially when a non-collapsible measure of treatment effect isconsidered in the trial. A key goal of an evaluation programme is toidentify interventions that are beneficial to patients from the set of candidates.One way to achieve this goal is to conduct experiments through the different phasesof clinical trials. A multi-arm design with many-to-one comparisons, i.e., comparingeach candidate intervention with a control treatment, is one option for phase II andIII studies. It is more efficient than conducting separate two-arm parallel trialson the same set of candidate interventions, since only a single control arm isrecruited in a multi-arm trial.2For example, the features of adding and dropping arms reduce the duration of theevaluation process,4and adaptive randomization can optimise a utility function that is of interest tostakeholders.57 The focus ofthis work is on the adaptation that achieves the “screening” (or treatmentselection) goal with randomization probabilities being fixed in advance by design.Hereafter we use ‘adaptive multi-arm design’ (AMAD) to denote a multi-arm designthat contains the pre-planned opportunity for such an adaptation.Design adaptations have been proposed to further improve the efficiency of amulti-arm design based on accruing data collected during a study. The idea is knownas an adaptive multi-arm design, which has at least one interim analysis, and thedesign structure can be considered as having multiple stages that are defined by thetiming of interim analyses.9One framework is an extension of two-arm group-sequential designs where therejection boundaries for early stopping (via hypothesis tests) are computed at thestudy planning stage.1013 Another framework requiresthe pre-specification of rule(s) for treatment selection at the planning stage, andutilises a flexible testing approach for the final inference, such as thecombination test approach1417 or the error spendingapproach.18 Depending on the study context, AMADs have been known asdrop-the-loser designs, pick the winner designs, multi-arm screening trials andadaptive seamless phase II/III designs.1922 In any case, data collectedfrom each stage is used in the final inference about the selected intervention(s);the inferential approach under each framework ensures that the family-wise errorrate (FWER) is controlled at the desired level. The FWER is defined as theprobability of falsely rejecting at least one null hypothesis, which is ageneralisation of the type I error rate that is often controlled in two-armdesigns.Broadly, there are different types of design and inferential frameworks forAMADs.24 Some have also focused on theestimation of treatment effects 2531 and confidenceintervals,32 respectively, in the absence of covariates. This is becausethe standard estimation procedures that have been used in fixed designs may fail tohave good properties (e.g. in terms of bias or coverage) when an AMAD isimplemented.Most of the existing literature about AMADs focuses on the operating characteristicsof the design when different testing procedures are used.3337 To the best of our knowledge,only the work by Jaki and Magirr38 has briefly touched on thetopic of covariate adjustment in the context of AMADs, but the work is based on theframework of group sequential designs. There are some publications that consider therole of covariates when other types of adaptation are implemented, such as theblinded sample size re-estimation method,40 the standard group-sequentialdesign,41 and adaptive randomization.42 In this paper, we aim to fillthis gap in the literature and explore the impact of covariate adjustment in AMADswith treatment selection. We show how covariate adjustment affects treatmentselection rules, hypothesis testing and power, as well as the estimation of thetreatment effects. For the latter, we derive the Uniformly Minimum VarianceConditionally Unbiased Estimator to account for covariate adjustment analytically.In addition, when the interest is in the odds ratios for binary endpoint, or thehazard ratios for time-to-event endpoint, it is often overlooked by researchers thatcovariate adjustment plays an important role in the definition of the estimand ofinterest. We evaluate the impact of covariate adjustments by simulation when acollapsible measure of treatment effect is considered for a continuous endpoint andrevisit the concept of non-collapsiblity, emphasising the importance of consideringconditional or unconditional treatment effects in the context of AMADs.One key feature of AMADs that has not been explored in the literature is the role ofcovariates in the design and analysis of such trials. In studies using fixeddesigns, i.e., non-adaptive designs, it is well-known that covariate adjustmentincreases the precision of the inference.43 is then provided to depictthe application of an AMAD framework. In Section 5, we discuss the issue when theodds ratio and hazard ratio are considered as the primary descriptive statistics inAMADs. In Section 6, we emphasise the practical aspects of implementing AMADs andgive some concluding remarks.This paper is organised as follows. In Section 2, we present the design and theanalysis of AMADs. In Section 3, we illustrate the treatment effect estimatesfollowing a linear regression model. In Section 4, we present a simulation study toexamine the role of covariate adjustment in treatment selection and in the finalinference. A case illustration based on the INHANCE study2.Consider a two stage setting, i.e., where there is one interim analysis for treatmentselection in an AMAD. We describe the treatment selection rule, hypothesis testingapproach and the procedure for identifying the required total sample size. Wepresent the standard estimators for a treatment effect as well as confidenceintervals, noting that both of these may not be compatible with the testingframework due to the complexity in combining the stage-wise data in the testingframework.2.1.29 which relate to the goalof the study. For instance, a threshold rule selects interventions to continueto the second stage together with the control treatment when their teststatistics is greater than a pre-defined threshold. The size of the subset ofinterventions can range from 2 to In general, an AMAD has 2.2.4547 A statistical frameworkto control for the FWER is required for an AMAD, since it is designed to screenmultiple interventions at stage one (in a pre-defined way) and to testmany-to-one comparisons at the end of the study (when more than one interventionis selected). Here we describe the combination test approach briefly. It is aflexible approach in the sense that other adaptations are allowed at interimanalysis. For example, when the threshold rule is considered the number ofselected interventions given stage one data is not known in advance; resourcescan be reallocated accordingly without inflating the FWER when the combinationtest approach is used in the final inference. This is the approach considered inthe asd R package,44 which can be used to conduct simulation studies forAMADs, but in the absence of covariates.When there are more than one primary research comparisons, the control of FWER isoften required by regulators.Let 48 can be applied to control for the FWER under thisglobal null hypothesis.For superiority studies, the global null hypothesis in a multi-arm setting is 14 Forexample, a Fisher’s combination test considers the product of the stage-wisep-values, whereas the weighted inverse normal method considers the summation ofthe weighted stage-wise p-values. When there is only one research comparison ina study, the stage-wise p-values from the standard Z-test or t-test are computedusing the corresponding stage-wise data. The combined value is then comparedwith the When the design of a study is modified at interim analyses, a combination testcan be applied to ensure that the FWER is controlled at the required level bycombining the stage-wise p-values via a pre-specified function.In AMADs, some of the interventions do not continue to stage two of the study.For the comparison involving these interventions, only stage one data isavailable for the corresponding hypothesis test. In this context, the control ofthe FWER in the strong sense might be desirable, i.e., ensure that theprobability of falsely rejecting at least one null hypothesis is less than the 23). Forintersection hypotheses that involve the deselected interventions, the stage onep-values of all the associated comparisons are considered, but only the secondstage p-values of the comparisons involving the selected (and associated)interventions are considered in the combination test, since there is no data ofthe deselected interventions in stage two.32 Note that other testingprocedures can be applied in place of the Dunnett test for the intersectionhypotheses, such as Simes test, 32More specifically, the combination test is used to test 49 Forexample, conjunctive power is the probability of detecting all effectiveinterventions whereas disjunctive power is the probability of detecting at leastone effective intervention. Having specified the power, the choice of thecombination test function and the testing procedures, one can conduct asimulation study to identify the required sample size under the alternative hypothesis in an iterative manner.For the power of an AMAD, different definitions can be considered when more thanone intervention can be selected to continue to stage two.One approach is to vary the sample size per arm per stage, while another is tovary the overall sample size until the required power is obtained. Note thatwhen the number of interventions to be selected to continue is not specified bythe selection rule, the overall sample size of the former approach variesconsiderably across the trial replications. This may create uncertainty incosting if one does not plan to cover the maximum overall sample size. When thelatter approach is considered, one needs to specify the total sample sizeper-stage in the simulation setting. In this case, when the stage-one totalsample size is small , the chanceof selecting the truly effective interventions might be lower than the settingwhere the stage-one total sample size is larger. However, the latter setting canmean more subjects are unnecessarily exposed to the ineffective interventionswhen only a small subset of interventions are truly effective.Having identified the required sample size for a given  alternativehypothesis, one can conduct a sensitivity analysis to examine the operatingcharacteristics of an AMAD at the design stage. For example, one can vary theparameter configurations of treatment effects in the data generating mechanism(DGM) of the simulation to mimic other plausible scenarios. This will indicatehow much power is gained or lost when the global alternative hypothesis does nothold.2.3.31 Astandard approach is to fit a regression model for the outcome/endpoint on thetreatment group as well as the covariates of interest. The conventional pointestimate of the treatment effect Estimating the treatment effects for AMADs is an additional importantconsideration, and one that has received relatively little attention in theliterature compared with error rate control in hypothesis testing.biased,i.e. 25 When multipleinterventions have similar effects, then the selected candidate is typicallybased on chance variability rather than true superiority.50 On theother hand, for the deselected interventions, the stage one regression estimatewill be negatively biased due to early stopping.32 A simple unbiasedestimator for a selected treatment effect 2551 which aim to reduce oreliminate the conditional bias of the conventional end-of-trial estimate whilestill utilising all of the trial data. We give a concrete example of one suchunbiased estimator in Section 3.2..In general, given a selection rule based on the stage one data, the estimators 52 However, in general these approaches can be verycomputationally intensive.As for the construction of confidence intervals at the end of the trial, for manycommonly-used regression models, the joint distribution of the estimatedregression coefficients 3.We illustrate the estimators and their properties when baseline covariate adjustmentis made in AMADs.3.1.Consider a normally distributed endpoint, Note that setting To analyse the data at the end of the trial, one can fit the following linearregression model3.2.The conventional point estimator at the end of the trial for the mean treatmenteffect of intervention ng model  to all o53 to derive the UniformlyMinimum Variance Conditionally Unbiased Estimator (UMVCUE). As the namesuggests, this estimator has the minimum variance out of the class of unbiasedestimators. It is conditionally unbiased since we condition on the (pre-defined)selection rule used in the trial.To derive an alternative unbiased estimator that utilises all of the trial data,the distributions of the stage-wise estimators The UMVCUE for a treatment effect As an explicit example, consider selection rules based on ranking the treatmentsby their 4.Following the above example of a selection rule where the seemingly best interventionis selected at interim analysis, we explore the impact of covariate adjustment onseveral aspects of an AMAD with a simulation study. Note that the total number ofpatients in this two-stage AMAD is 54 An example R script is available in the supplementalmaterial.We describe the background of our simulation study and some performance measures. Welook at the simulation results that cover the treatment selection characteristics ofAMADs and the analysis perspective when different sets of covariates are consideredin the modelling approach. For each simulation scenario, which consists of a datagenerating mechanism (DGM) under a specific parameter configuration for thetreatment effects, we conducted 100,000 trial replications using R version4.0.5.4.1.Consider a simple example where there is a total of In terms of the treatment selection rule used, we assume that one intervention In the simulation, we set 4.1.1.DGM1: no correlation between the covariates and the outcome,i.e., DGM2: DGM3: both DGM4: For each DGM, we run simulations for scenarios that are defined bythe following parameter configuration for Null: the global null configuration that has LFC50: a least-favourable-configuration that has LFC80: a least-favourable-configuration that has STEP50: a stepwise-configuration that has STEP80: a stepwise-configuration that has The above numerical examples of effect sizes have been chosen asfollows. Since we want to explore the impact of covariate adjustment on theoperating characteristics of an AMAD, we fix the total sample size andidentify the effect sizes required for a level of power under an alternativehypothesis. More specifically, consider Each of the following DGMs are considered in our simulation study: 4.1.2.Unadjusted: a linear model for the outcome on the treatmentvariable only, ignoring the covariate information, i.e., setting AdjustedAdjustedAdjustedSince there are two covariates considered in the simulation study, weconsider the following modelling approaches for both the interim and finalanalyses, using the linear model defined by equation in Secti4.1.3.To illustrate the role of covariate adjustment in AMADs, we examine thefollowing performance measures to make comparisons between the analysisapproaches under different scenarios in the simulation study.Regarding the treatment selection operating characteristics of the AMAD, weconsider the frequency when one specific treatment is selected over trialreplications and the frequency when an adjusted approach selects a differenttreatment to the unadjusted approach. The former reflects if the AMAD isselecting the truly effective arm(s) correctly based on the interimanalysis; a higher frequency of selecting the truly effective arm(s) isdesirable. The latter reflects how often an adjusted modelling approachcould lead to a different treatment selection outcome to the unadjustedanalysis approach. This indicates the disparity of the treatment selectionoutcome when covariate adjustment is considered in the framework of anAMAD.For the inferential properties of the AMAD, we evaluate the probability ofrejecting (any) one hypothesis and the marginal probability of rejecting aspecific hypothesis under the above described scenarios. We look at thestandard properties of different estimators following different modellingapproaches in terms of the bias and mean squared error (MSE). In whatfollows, the bias of an estimator 4.2.We describe the simulation results by part: i) Frequency of selecting a specifictreatment, ii) Probability of rejecting a hypothesis, and iii) Properties ofdifferent estimators of the treatment effect.4.2.1.First consider the treatment selection operating characteristics of the AMAD.For the LFC parameter configurations, it is desirable to select T2 asfrequently as possible. When the interim data is such that T1 is selected,that means an incorrect selection has been made and the study will fail todetect a truly effective treatment. For the stepwise-configurations,selecting T1 is not an incorrect selection but it is less desirable thanselecting T2 as T2 is more effective than T1. For the null scenario wherethe interventions have the same effectiveness to the control treatment, itdoes not matter which intervention is selected when the DGMs have such aparameter configurations. For this reason we exclude the null scenario inthis part of the results.The second and third row of plots shows the probability that T1 and T2 areselected, respectively, to continue with the control treatment to the secondstage of the study. (The third row is the complement of the second row asprobability sums to one.) In general, we find that adjusting for covariatesthat are truly correlated with the outcome can reduce the probability thatT1 is selected and increase the probability that T2 is selected under allthe considered non-null scenarios, from the probabilities that are obtainedby the unadjusted approach. This is desirable as T2 is the most effectivetreatment among the three options across the scenarios on the x-axis ofMoreover, we find that adjusting for a highly correlated covariate can leadto a better treatment selection result even when the weakly correlatedcovariate has been omitted. This is reflected by AdjustedWhen the correlations of the covariates are weak, failing to include thecovariates in the modelling approaches has little impact on the probabilityof treatment selection when compared with the desirable approach. This isobserved from the unadjusted approach and AdjustedOn the other hand when uncorrelated covariates are mistakenly being includedin the model, the probability of one treatment being selected is similar tothe approach that has the correct adjustment. For example, the desirableapproach for DGM1 is the unadjusted approach, both the plots in column oneof In summary, adjusting for covariates that are highly correlated with theoutcome leads to a higher chance of selecting the truly best treatment inAMADs, whereas including uncorrelated covariates or omitting weaklycorrelated covariates has little impact on the selection result whencompared with the unadjusted approach. The maximum and minimum of theprobabilities of treatment selection and their differences are presented inTable S1 in the supplemental material.4.2.2.We focus on the results of hypothesis tests for AMADs. Recall that we havetwo elementary null hypotheses, For the non-null scanarios, When adjusting for at least one covariate that is correlated with theoutcome, we find that the overall power becomes higher than that achieved bythe unadjusted approach. This is true even when an approach includes anuncorrelated covariate (to the outcome) in addition to the covariate that iscorrelated with the outcome; for example, see the first plot in column twoof This highlights the benefit of covariate adjustments on the overall power ofAMAD. The increases in the overall power can be as high as 21% under DGM 4when either AdjustedNow focus on the probability of rejecting For Step50 and Step80, the probability of rejecting Lastly for the marginal probability of rejecting 4.2.3.We consider the properties of the treatment effect estimators described inSection 3.2.. First we focus on the bias and then the MSE of theseestimators, as defined in Section 4.1.3.. Looking across the different scenarios, both the Stage one and Overallestimators exhibit a positive bias and the magnitude of this bias has thefollowing ordering (for any given adjustment method): Null > Step50 >Step80 > LFC50 > LFC80. This reflects how the upwards selectionpressure is greatest for the Null scenario , which then decreases as the treatment effects become moredistinct, i.e. as the difference Looking now at the different adjustment approaches, when the correlationbetween the covariates and outcome is zero or low (i.e. under DGMs 1-3),there is minimal difference in the bias of either the Stage one or Overallestimators. In particular, there is no loss in terms of increased bias whenadjusting for covariates that are uncorrelated with the outcome (i.e. DGM1). When there is a moderate correlation between covariate X2 and theoutcome (DGM 4), there is a noticeable decrease in the bias when adjustingfor X2  as the ordering for the bias of the Stage one and Overallestimators, i.e. Null > Step50 > Step80 > LFC50 > LFC80. Thisreflects how the larger adjustments made by the UMVUCE to the Overallestimator in scenarios with a larger bias results in a larger variance andhence MSE. The UMVCUE has a larger MSE than the Overall estimator , with the magnitude ofthis difference having the same ordering as above. Hence the UMVCUE pays thelargest price in terms of MSE precisely in the scenarios where the Overallestimator pays the largest price in terms of bias. Reassuringly, when thereis little bias in the Overall estimator (e.g. in the LFC80 scenario) thenthe MSE of the Overall estimator and UMVCUE are virtually identical.Finally, looking at the different adjustment approaches, when there is no orlow correlation between the covariates and outcome, there is littledifference in the MSE for a given estimator. In particular, there is noincrease in MSE when adjusting for covariates that are uncorrelated with theoutcome. When there is a moderate correlation between covariate X2 and theoutcome (DGM 4), we observe a noticeable decrease in the MSE when adjustingfor X2. For example, the MSE of the Overall estimator decreases by 39% whencomparing the Unadjusted analysis with Adjusted4.3.43 An adaptive seamlessphase IIb/ IIIa study design was used to screen six interventions at stage one(with 376 patients randomized to seven arms including the placebo group), andselect three interventions to be continued with the placebo group to stage twobased on 2-week efficacy and safety data. A total of 1683 patients wererandomised to four arms at the second stage of the study: placebo, double-blindindacaterol 150 One of the objectives of the INHANCE study was to demonstrate the efficacy ofindacaterol (intervention) versus placebo on patients with moderate-to-severechronic obstructive pulmonary disease.To illustrate what might happen using the AMAD framework, consider a hypotheticalscenario where the placebo and three interventions mentioned above are to beevaluated again using a similar design, but with only two of them selected tocontinue (together with the placebo) in the subsequent stage. This can beconsidered as a confirmatory two-stage multi-arm design where a strict controlof the FWER is required when one intervention arm is closed at the end of stageone. Here we focus on using the treatment selection rule where the best twointerventions would be selected, as opposed to using some pre-definedprogression criteria based on the safety and efficacy data. We use the observedefficacy and covariate information (in terms of the means and standarddeviations) from the INHANCE study, as given in Across all the adjustment methods, the Stage one estimate is substantially largerthan the Stage two estimate for interventions 1 and 3, which is particularlynoticeable for intervention 3. This reflects the upward selection pressure onthe top and second-ranked interventions in Stage one. For interventions 1 and 3,the Overall estimate is approximately halfway between the Stage one and Stagetwo estimates, while the UMVCUE corrects the Overall estimate towards theunbiased Stage two estimate. Interestingly, this correction is minimal when notadjusting for X1  describes the effect on theoutcome of an individual patient when taking an intervention instead of the controltreatment; the marginal odds ratio (or hazard ratio) describes the effect on theoutcome of the samples of a target population when they were given the interventioninstead of the control treatment. The conditional estimand accounts for theindividual patient characteristics or background via the incorporation of theassociated covariates in the regression models. On the other hand, the marginalestimand depends on the distribution of the associated covariates implicitly,meaning that the estimate of a marginal odds ratio (or hazard ratio) obtained from astudy may not be applicable to other populations that have differentcharacteristics, see for example the illustration in 55 and the references therein for more details aboutnon-collapsibility.The subtlety in the interpretation of the marginal versus conditional odds ratio (orhazard ratio) make them non-comparable with respect to the benefits of covariateadjustment. This is not the case for continuous outcome where the conditional andthe marginal estimand are equivalent in nature . Other measures that are collapsible include theabsolute risk difference, the relative risk difference, the log odds ratio and thehazard difference in the additive hazards models. The interested reader is referredto Daniel et al. We emphasise that when the odds ratio (or hazard ratio) is used as a measure oftreatment effect in a trial, the pre-specification in the statistical analysis planof which covariates to be included in the analyses  isparamount. One should not make comparisons of treatment effect estimates fromanalyses with different sets of covariates because the resulting conditionaltreatment effects convey different information. In the context of AMADs, the sameset of covariates should be included in both the treatment selection and the finalanalyses for the same reason.The consideration of marginal odds ratio (or hazard ratio) is less useful since thefocus of early phase clinical studies often is on the average treatment effect onindividual patients, and not the average treatment benefits for the targetpopulation. For AMADs, a caveat to using the marginal odds ratio or the marginalhazard ratio for both the treatment selection and the final analyses is that thepatient composition may vary across stages. Consequently the stage wise parameterestimates may not be congruent in terms of the applicability of the results to thetarget population when the distribution of the characteristics of patients recruitedin stage one is different to that in stage two.55.However, it might be less straightforward to produce the UMVCUE for these treatmenteffect measures using the procedure as the standard deviation of the stage-wiseparameters requires approximation by using either the Delta method orbootstrapping.Nevertheless, one may produce a marginalised-covariate-adjusted odds ratio (or hazardratio) as supplemental information following the procedure in Daniel et al.6.Within a two-stage design, we have evaluated the impact of covariate adjustments onthe operating characteristics of AMADs and the properties of treatment effectestimators. More simulation results on trial operating characteristics in thepresence of additional six covariates that are uncorrelated with the outcome arepresented in the supplemental material. In general, we find that includingcovariates that are uncorrelated with the outcome has a negligible impact on thetreatment selection outcome and the final inference. On the contrary, includingcovariates that are moderately or highly correlated with the outcome can increasethe chance of selecting the truly effective intervention to continue to the secondstage of AMADs, increase the study power, and reduce the bias and MSE of estimatorsof the treatment effect. Moreover, the FWER is controlled at the nominal level whencovariates are adjusted via the regression approach. The UMVCUE also has goodproperties in terms of being unbiased with only a relatively small increase in theMSE compared to the standard overall estimator of the treatment effect.Our simulation study and the discussion in Section 5 also emphasise the importance ofspecifying the covariates in advance of the analyses. More specifically, adjustingfor different sets of covariates in a single trial replication may lead to differenttreatment selection outcomes and different results of hypothesis testing. Fortreatment effect measures that have the inherit property of non-collapsibility,comparing adjusted results of different sets of covariates requires care. This isbecause extra analysis steps to marginalise the treatment effect estimates arenecessary to ensure that the estimates are comparable. To avoid data dredging,having a statistical analysis plan in place prior to any of the data analyses iscrucial. Such a practice also maintains the integrity of randomised studies.Like any other randomized control trials, the sample size calculation of AMADsassuming the absence of covariates at the design stage is an approximation. The gainin power is maximised with covariate adjustment when all other assumptions made inthe sample size calculation hold, e.g., dropout rate, the values of the nuisanceparameter and the treatment effect under the  alternative hypothesis.Alternatively, one may perform simulation studies to identify an appropriate samplesize given the information about the distribution of the covariates. This is stillan approximation as there are uncertainties in the distributional assumptions.5760 In this case, the probabilityof selecting the truly effective interventions can vary according to the correlationbetween the surrogate endpoint and the primary endpoint. When an uncorrelated (orweakly correlated) surrogate endpoint is used, there is a higher chance of selectingthe truly ineffective interventions compared to the ideal case where the mainoutcome on all recruited patients is available for the interim analysis. We have notexplored this but hypothesise that the role of covariates adjustment is similar insuch a context.We note that the benefits from implementing AMADs is affected by the recruitment rateand the length to observe the data that is used for treatment selection. In somehealth problems where the primary outcome is not available immediately, a surrogate(or a short-term) endpoint that is correlated with the long-term endpoint might beused for treatment selection. This has been one of the active research areas aboutAMADs.61 A common practice is to adjust for the variables used inthe randomisation procedures, e.g., minimisation, in the final analysis. This canimprove the statistical power when the variables are predictive of theoutcome.62 We believe chance imbalance has little impact on our generalfindings especially when a covariate-adaptive randomization procedure 63 is in place,the stage one sample size of AMADs is not small, and that the analyses adjust forthe covariates used in the randomization procedure.We also have not incorporated randomization procedures in our simulation set-up buthave assumed the ideal scenario where patients in each arm are comparable withrespect to the baseline characteristics and other unmeasured factors. In practice,covariate imbalance can happen in a randomised trial due to the random nature intreatment allocation.41. We have also assumed that there is no missing data in oursimulation study. Future work can explore how the missing data approaches may impacton AMADs when some of the covariates and responses are missing at random or missingnot at random. Another direction could be exploring the sensitivity of someestimators in the presence of a population drift, especially when there are morethan two stages. Note that we also have not provided the confidence interval for theUMVCUE in the case illustration in Section 4.3. This is because there are noestablished methods to construct valid confidence intervals based on the UMVCUE.More investigation is required to explore the construction of confidence intervalsin the presence of covariates.Another limitation of our investigation is that we have considered treatmentselection without other adaptations, such as sample size re-estimation and adaptiverandomization. We note that when an intervention is not selected to continue tostage two, there is no formal claim about its inference until a formal testing isconducted at the end of the study. The AMAD framework that is based on thegroup-sequential design accounts for this adaptation in a more direct sense and caninclude covariate adjusted for some of the commonly used models as shown by Jennisonand Turnbull Click here for additional data file.Supplemental material, sj-R-1-smm-10.1177_09622802221114544 for The benefits ofcovariate adjustment for adaptive multi-arm designs by Kim May Lee, David S.Robertson, Thomas Jaki and Richard Emsley in Statistical Methods in MedicalResearchClick here for additional data file.Supplemental material, sj-R-2-smm-10.1177_09622802221114544 for The benefits ofcovariate adjustment for adaptive multi-arm designs by Kim May Lee, David S.Robertson, Thomas Jaki and Richard Emsley in Statistical Methods in MedicalResearch


Data gathering is an essential concern in Wireless Sensor Networks (WSNs). This paper proposes an efficient data gathering method in clustered WSNs based on sparse sampling to reduce energy consumption and prolong the network lifetime. For data gathering scheme, we propose a method that can collect sparse sampled data in each time slot with a fixed percent of nodes remaining in sleep mode. For data reconstruction, a subspace approach is proposed to enforce an explicit low-rank constraint for data reconstruction from sparse sampled data. Subspace representing spatial distributions of the WSNs data can be estimated from previous reconstructed data. Incorporating total variation constraint, the proposed reconstruction method reconstructs current time slot data efficiently. The results of experiments indicate that the proposed method can reduce the energy consumption and prolong the network lifetime with satisfying recovery accuracy. Recently, wireless sensor networks (WSNs) have been applied in many fields, such as target tracking, medical care, and environmental monitoring. The component of a WSN includes a number of sensor nodes monitoring and collecting the physical environmental information and a sink aggregating the collected data. The data collection from each node to the sink, known as data gathering, is a significant research issue in WSNs.In most real-world applications, the sensor nodes in WSNs are always limited by computational capacity and battery power. Lots of data gathering methods have been proposed to reduce energy consumptions in WSNs. These data gathering methods can be mainly classified into two categories: methods utilizing data compression techniques ,2,3 and Although these methods enforcing low-rank constraint achieve better data recovery performances than the CS based methods, the requirement to form an environment matrix limits the real-time data gathering and reconstruction in WSNs. Besides, the sparse sampling strategy is adopted in matrix completion based methods, resulting in the existence of several nodes remaining in sleep mode. These inactive nodes will cause the failure of real-time data gathering. To achieve real-time data gathering with matrix completion, this paper proposes a sparse data gathering method based on clustered WSNs. Sparse sampled data can be collected in each time slot even with a fixed percent of nodes remaining in sleep mode. For data reconstruction, a subspace approach is proposed to enforce an explicit low-rank constraint. With subspace representing temporal distributions of the WSNs data estimated from previous reconstructed data, data collected in current time slot can be recovered efficiently. To guarantee data recovery performance even with low sampling ratio, we incorporate total variation constraint to further improve data recovery accuracy.The rest of this paper is organized as follows. Matrix completion problem was proposed to recover a data matrix from its partially sampled entries, and it has been proved that most low-rank matrices can be perfectly recovered from an incomplete set of entries . Specifi problem:minimizerHere, x. Then,  can be rr can be expressed as the product of two matrices For the second one, the incomplete matrix ed. Then  can be cThe matrix factorization based approach has gained great popularity due to fewer requirements for storage capacity and computational overhead. It is worth noting that the problem  is a nonn sensor nodes and one sink with symbol m time slots):jth time slot. In most matrix completion based methods, partially sampled readings sensed during m time slots are transmitted to the sink together. Since readings generated by the nodes in a certain area during consecutive times are redundant and highly correlated, the EM Inspired by the great success of matrix completion, many data gathering and reconstruction methods in WSNs were proposed based on matrix completion. Considering a WSN consisting of In matrix completion based methods in WSNs, sparse sampling is adopted in data gathering to reduce the amount of transmission data and energy consumption. Typically, the sparse sampled readings sensed during a fixed number of time slots are transmitted to the sink together in the last time slot, which limits real-time data gathering and reconstruction. To implement real-time data gathering in WSNs, the sparse sampled data should be collected and transmitted to the sink in every time slot. However, since only partial sensor nodes wake up and collect data while other nodes remaining in sleep mode, the traditional data gathering methods fail due to the existence of inactive nodes. If the successful aggregation of sparse sampled data is guaranteed at the expense of all nodes waking up to transmit data, the goal of reducing energy consumption through sparse sampling can not be achieved. Moreover, for data reconstruction in real-time case, only data in current time slot need to be reconstructed. In this paper, a sparse data gathering method based on clustered WSNs is proposed to implement real-time data gathering, and a subspace approach based method is proposed to reconstruct data in current time slot by enforcing an explicit low-rank constraint.To ensure the success of sparse sampled data gathering without waking up all nodes, a sparse sampling data gathering scheme is proposed in clustered WSNs. In clustered WSNs, all nodes are divided into multiple clusters, and each cluster contains one cluster head (CH) and a number of cluster members (CMs). The cluster head is selected for each round to communicate with the sink, and the cluster members only communicate with CHs in their clusters. The proposed sparse sampling data gathering scheme based on clustered WSNs is shown in The proposed sparse sampling data gathering scheme can combine with many existing clustering algorithms. In this paper, the well known distributed energy-efficient clustering (DEEC) scheme  is selecn denotes the number of nodes still alive and In the first phase, clusters are formed and the sampling ratio of each node is determined. Specifically, each node decides whether to become a CH based on its own probability threshold, which is related to the residual energy and estimated average energy of networks at current round. After the CHs are selected, the other nodes, cluster members, determine the dependent cluster according to the signal strength of the received information, and notify the corresponding CH to complete the establishment of the clusters. Then the sink broadcasts a fixed sampling ratio In the second phase, sparse sampling and data gathering are held. Specifically, each node in CMs generates a random number between 0 and 1. If the number is less than the sampling ratio Instead of using all nodes to collect the information, the proposed sampling data gathering scheme only wakes partial nodes up in each time slot, which greatly reduces the energy consumption and prolongs the lifetime of the network compared to original clustering algorithm.n sensor nodes between time slots w time slots. The first window, the previous window of the current window, contains time slots from In real-time data gathering with sparse sampling, data from CHs and partial CMs are collected in the sink for current time slot. We use For example, to reconstruct data It is worth noting that the sink needs the indexes of the sparse sampled data to reconstruct the current data. To avoid overhead incurred by index information, the preset random seed can be used. At the beginning of each round, each CM generates a random seed as a pseudo-random number generator and sends it to the CHs and sink. The generated random number determines whether the CM wakes up and collects data. With all the information of random seeds, the sink can obtain the indexes of the sparse sampled data without extra overhead.With the proposed sparse sampling data gathering scheme, the sink can obtain the current sparse sampled data To further improve the recovery accuracy, the total variation constraint ty term,  can be cy term, To solve the subproblem in , which i solving  can be ss. Since  is a conIn this section, the experimental environments are established to verify the effectiveness of the proposed method. For the reconstruction experiments, the performance of the subspace based reconstruction method was compared with local interpolation method K-Nearest Neighbors (KNN) , the CS To verify the effectiveness of the subspace approach for reconstruction, a small real dataset collected from GreenOrbs  was seleFor the first aspect, the 50th time slot in the dataset was selected as the current time slot, and the width of sliding window was set to Here, r. For simplicity, the historical data collected from 10th to 49th time slots were used as r was set to 15 according to singular values of In the simulation, the spatial distributions As shown in to solve  is negliThe historical data were used as Despite the reduction in the recovery accuracy of the proposed method for long-term reconstruction, the overall reconstruction accuracy is still satisfying. The average NMAE is To further verify the benefit of the proposed method in reducing the energy consumption, we established the experimental environments for the proposed sparse sampling data gathering scheme using DEEC as the clustering algorithm.In the simulation, a two-level heterogeneous network containing advanced nodes and normal nodes was utilized. The initial energy of normal node was The parameters used in simulations are shown in To keep 50% nodes alive, the original DEEC can only carry out 1081 rounds. The proposed method with This paper proposes an efficient sparse sampling data gathering method in clustered WSNs including a sparse sampling data gathering scheme and a subspace based reconstruction algorithm. The proposed sparse sampling data gathering scheme not only uses the sparse sampling strategy to reduce the amount of transmission data and the energy consumption, but also ensures the success of real-time sparse sampled data gathering in clustered WSNs. Then the previous reconstructed data are introduced with the sliding window model and used to estimate the subspace representing spatial distributions of the WSNs data. In this way, the proposed subspace based reconstruction approach can enforce an explicit low-rank constraint for data reconstruction from sparse sampled data. Besides, the total variation constraint is joint utilized to further improve the recovery accuracy. The experimental results show that the proposed method outperforms the state-of-the-art methods in data recovery and reduces the energy consumption of network efficiently.


Distinctive from other forms of microfluidic system, capillary microfluidics is of great interest in autonomous micro-systems due to its well-engineered fluidic control based on capillary force. As an essential component of fluidic control in capillaric circuits, micro-valves enable sequential fluidic operations by performing actions such as stopping and triggering. In this paper, we present a stair-step liquid-triggered valve; the functionality of the valve and its dependencies on geometry and surface modification are studied. The surface contact angle of the microfabricated valves that are coated by polyethylene glycol (PEG) or (3-Aminopropyl) triethoxysilane (APTES) is evaluated experimentally, and the corresponding reliability of the valve structure is discussed. Moreover, the variation in the surface contact angle over time is investigated, indicating the shelf time of the device. We further discuss the overall fluidic behavior in such capillary valves, which benefits the capillaric circuit designs at the initial stage. Microfluidic devices offer the promise of rapid, miniaturized, and automated biochemical assays, as they have potential to realize large-scale applications at a much smaller scale in order to reduce instrument size and sample consumption. Microfluidic devices have been suggested as powerful tools for a variety of applications, including point-of-care diagnosis and bio analysis ,2,3.The control of liquid flow at the micro scale is the key to microfluidic applications. Operations of most microfluidic devices require complex peripheral equipment to effect and control the flow of liquid, which in reality limits their scenarios . GoverneA valve is a critical component in the capillary microfluidic system, since it controls the stoppage and resuming of fluidic flow . EssentiCapillary pressure is essential in designing the valve geometry, as it has to be sufficient for the liquid to pass the valve for triggering. On the other hand, it cannot break the pressure barrier of the expansions to stop the liquid, otherwise the valve would fail in the first place. The Young–Laplace equation for a rectangular microchannel denotes the close relations among the capillary pressure, channel geometry, and contact angle . In otheSurface modification is considered the most commonly used technique to alter the wettability of capillary microfluidic circuits. Surface tension and wettability vary largely with the surface itself , as well as the molecules/chemicals used to modify the surfaces . To deveWhen the liquid trigger valve is fabricated on silicon substrate, the superhydrophilic nature of the bare Si surface provides an overwhelming capillary pressure against the energy barrier of the expansion geometry in the stop flow channel . This coIn this paper, we present a stair-step liquid-triggered capillary valve on a silicon substrate that is designed to work with a closed-top surface. The nature of enclosed microfluidics can prevent liquid evaporation and lower the risk of contamination across the system ,43. FollThe microfluidic chip with length of 10 mm and width of 4 mm consists of a silicon substrate with microfluidic structures and a thin film of Polydimethysiloxane  as the top layer to enclose the microfluidic channels a. The si2 that is made by thermal oxidation and used as the hard mask for the upcoming silicon etching processes. This hard mask is then patterned by standard photolithography using the AZ1500 positive photoresist  and a mask aligner 610TB , following by reactive ion etching (RIE) with CF4 + CHF3 plasma  to open the window for shallow silicon etching. After removing the residual AZ 1512 layer, the substrate is then patterned by a second photolithography process using the AZ4620 positive photoresist (10 μm thickness), followed by RIE CF4 + CHF3 plasma etching to open the window for silicon deep etching on the SiO2 layer. Deep RIE (DRIE) with C4F8 + SF6 plasma  is used to etch the silicon substrate for a depth of 105 µm first. Then the remaining photoresist layer is stripped, leaving the window for silicon etching fully open. As the last step, the silicon substrate is etched for an additional 25 µm of thickness. In such way, the designated depths of the shallow and the deep layer of the microfluidic system are 25 and 130 µm, respectively, which will be further discussed in detail in The silicon chip is fabricated by a two-step silicon etching process. The microfabrication process flow is shown in After the fabrication of the microfluidic systems, the silicon chip is functionalized by either PEG or APTES. PEG is often used to prevent bio-fouling by minimizing the unspecific absorption of small molecules on the surface of the device, and APTES is usually utilized to generate silane patterns in the microfluidic channels for protein immobilization . The silAn optical contact angle measurement tool  is used to determine the equilibrium contact angles of water on the chip surface, which is obtained by averaging five measurement results at different locations on each chip. The experimental setup is shown in The microstructure is characterized after the microfabrication process. As shown in In our design, a geometric expansion of the channel cross-section along both the channel width and depth is used to generate a robust valve structure. It should be noted that a sharp transition between the two steps is essential, because a smooth transition could cause the valve to leak. Therefore, the two-step DRIE process presented in Following the device fabrication, the chip surface is functionalized either by mPEG or by APTES, and the equilibrium static contact angle is measured at different locations on the chip surface to characterize the wetting property of the device. The results are shown in The functionality of the valves with different surface modifications are then evaluated by using a solution of Rhodamine B in deionized water with a concentration of 100 µg/mL. Six devices are tested at each surface condition. The experimental results are consistent, and the results obtained from different conditions are shown in In close relation to the functionality of silicon capillary microfluidic chips, the shelf time of the different mPEG/APTES treatment groups on the contact angle point-of-view is further assessed experimentally. The contact angle on the device surface at different times and the corresponding valve functionality are tested. As shown in As shown in Liquid-triggered micro-valves are of great interest in capillary-driven planar microfluidic systems. In this paper, we present a stair-step liquid-triggered valve and test its functionalities in capillary circuits. In this study, the valves with geometric expansions in both horizontal and vertical interfaces are fabricated by a two-step DRIE process on silicon substrate. In particular, a process flow that can ensure sharp transitions on the interfaces of the stop-flow channel and the trigger-flow channel is proposed. The surface of the microfluidic chips is functionalized by mPEG and APTES of different concentrations; the equilibrium contact angle and its variation over time are evaluated. In order to have a functional valve, not only the liquid from the stop-flow channel should stop at the interface of shallow and deep channels, but also the triggering liquid should flow through the trigger-flow channel. Therefore, mPEG and APTES should maintain proper concentrations for device surface modification to keep the contact angles in a working range from 30° to 50°. The experimental results show that mPEG-modified surfaces present a better stability over time, with the concentration of 1 mg/mL in the surface treatment solution excelling in valve performance. Yet the reactive amine groups and their short molecular chain nature make APTES a choice for rather short-term use. When designing a complex capillaric circuit for long-term applications, it is essential to consider all the combining factors, including channel geometry, surface contact angle, as well as the shelf time of surface functioning groups. We believe this article would provide a guideline for integrating a robust trigger valve structure into capillaric systems designed for various purposes.


As the blockchain 2.0 platform, Ethereum’s turing complete programming language and smart contract components make it play an important role in the commercialization of blockchain. With the further development of blockchain applications, the privacy and security issues of Ethereum have gradually emerged. To solve this problem, we proposed a blockchain privacy protection model called RZcash in the previous work. It implements the dynamically updateable and verifiable hiding of the asset information in Ethereum, namely the account balance and transaction amount. However, RZcash does not pay attention to the key redundancy problem that may be caused by the creation of secret accounts. In addition, the large size of proofs gives it high communication costs. In response to these problems, we further improve RZcash. For the key redundancy problem, we construct a new signature scheme based on the ciphertext equivalent test commitment. Moreover, we use the Schnorr signature and bulletproof to improve the corresponding proof scheme in RZcash, thereby reducing the size of proof. Based on these improvements, we propose a decentralized payment system, called RZcoin, based on Ethereum. Finally, we implement the algorithm model of RZcoin and evaluate its security and performance. The results show that RZcoin has higher security and Lower communication cost than RZcash. With the rise of Bitcoin , the cryThroughout the history of cryptocurrency, privacy has always been the design goal of these systems. From the beginning, privacy protection has been the focus of researchers. In 1982, David Chaum, known as the father of the digital currency, proposed Ecash . Chaum uThe above problems not only affect the legalization of digital currency, but also hinder the application of the blockchain in the industrial Internet and other fields. China’s legal digital currency will be issued soon. The government has also begun to actively develop the blockchain technology. Therefore, it is urgent to build a blockchain system with complete privacy protection services. In response to this demand, we proposed a blockchain privacy protection solution called RZcash in 2019. It realizes the hiding of account balance and transaction amount in Ethereum by integrating the existing cryptographic technology . SpecifiWe further improve the privacy protection mechanism called RZcash. For the key redundancy problem, we propose a signature scheme called CEs based on the ciphertext equivalent test scheme . It achiWe combine the improved privacy protection mechanism with Ethereum and propose a decentralized payment called RZcoin with optional privacy services. In RZcoin, the hidden asset can be publicly verifiable and dynamically updated. Users can neither overspend nor forge their assets. All proofs required for transactions involving the privacy service  are attached to the "extraData" module of transactions.We implement the above decentralized payment scheme based on the Ethereum test chain and evaluate its performance. At the same time, we also propose the adversarial model it faces and give the corresponding security analysis. The result shows that the scheme can provide the privacy service to users with good performance while ensuring security.In this regard, we proposed a series of improvements in this paper. Based on RZcash, we further improve its core algorithms and propose a decentralized payment scheme called RZcoin that provides the optional privacy protection service. When users need the service, they must create a new secret account through the creation transaction. The account can be traded with other secret accounts or with open accounts . The former is called the secret transaction, and the latter is called the semi-secret transaction. In general, our main contributions are as follows:By summarizing the existing research results, we observe that the privacy service structure of the blockchain system is mainly divided into two modes: off-chain and on-chain.In the off-chain model, the private data is stored and calculated in the off-chain environment, thereby avoiding the privacy disclosure caused by the on-chain storage. For example, the Keep project initiated by Luongo et al. expands the basic application of smart contracts through the form of private data containers . In addiMost of the existing research results achieved privacy protection in an on-chain mode, such as Dash , Monero Compared to Bitcoin, the privacy requirement of Ethereum is more complex. In addition to hiding the transaction amount and participants, Ethereum also needs to hide the account balance and transaction details of the smart contract. In the past two years, Mobius , Zether The rest of this paper proceeds as follows. In Ethereum is known as the blockchain 2.0 platform. It is widely used because of its turing-complete scripting language, account-based transaction model and practical smart contract components. According to the description in its white paper, the architecture of Ethereum is mainly divided into seven layers: application, contract, consensus, protocol, network, data and storage, which arranged in order from top to bottom as shown in We can see that the main body of the data layer is the transaction. It is stored in the transaction pool and packaged into blocks by the full node after passing the legality verification. Then it is recorded in the blockchain after multi-party consensus. As shown in As a basic tool in the public key cryptography, number theory played a very important role in the research and development of modern cryptography. The discrete logarithm problem (DLP) is the basic conclusion in it and is widely used in many public key cryptographic schemes. In 1985, Koblitz and Miller first proposed the creative idea of applying the elliptic curve to cryptography and constructed the discrete logarithm problem on elliptic curves (ECDLP) based on the Abelian addition group consisting of elliptic curve points . The cryDefinition 1.Let g be a generator of the cyclic group then we say that it is difficult to solve the discrete logarithm problem.(DLP ).Let g E be the elliptic curve group on the finite field m as 1. Let G be a generator of Let Definition 2.Let G be the base point of group then we say that it is difficult to solve the elliptic curve discrete logarithm problem.(ECDLP ).Let G G and H, he cannot obtain the secret value s in polynomial time because of ECDLP.All privacy protection schemes used in this paper involve the point addition operation on elliptic curves. Therefore, we can provide security for our privacy protection solution based on ECDLP. For example, for the Pedersen commitment To solve the problem of the construction of secret accounts in RZcoin, we propose the ciphertext equivalent signature scheme called CEs based on the existing ciphertext equivalent scheme. This scheme mainly relies on bilinear mapping in number theory . The defDefinition 3.Given an addition cyclic group Bilinear: Non-degenerate: Computability: If all the above properties are satisfied, the mapping relationship e is called a bilinear mapping.(Bilinear Mapping)In this paper, we use the Pedersen commitment scheme based on elliptic curves to hide the asset information . Its inhDefinition 4.For the elliptic curve group Equation  holds, t(Pedersen Commitment ).For thOn the basis of the above scheme, Bunz et al. proposed the Pedersen vector commitment in the bulletproof scheme published in 2018 to further strengthen the scalability of confidential transactions . BulletpDefinition 5.For the elliptic curve group where Equation  holds, t(Pedersen Vector Commitment ).For thIt was proved that because of the hardness of ECDLP, both of these commitment schemes are unconditionally hiding and computationally binding. The definition of these properties is as follows.Theorem 1.If a commitment .If a cRemark 1.The proof of this theorem can be referred to .The so-cTheorem 2.If a commitment .If a cRemark 2.The proof of this theorem can be referred to . The theAs early as 1985, Goldwasser, Micali, and Rackoff came up with a groundbreaking idea called “zero-knowledge proof”. The original proof system is an interactive two-party protocol in which the prover can convince the verifier that certain statement is correct without providing the verifier with any useful information. In 1988, a non-interactive zero-knowledge proof scheme (NIZK) was proposed . It exteIn the existing blockchain privacy protection schemes, zero-knowledge proof is used to provide evidence for the legality of confidential transactions. Moreover, it works with the public key signature scheme to achieve accountability. Currently, zero-knowledge proof is considered to be the most effective solution to blockchain privacy issues. Therefore, for the hidden asset in RZcoin, we choose a zero-knowledge proof to provide evidence for its legitimacy.s equivalently into the special zero coefficient problem of inner product. In bulletproof, s is within a certain range, the zero coefficient of In RZcoin, we use bulletproof to implement rangeproofs to further reduce the size of proof . BulletpDefinition 6.For the input value a and global parameters cheme in , we choo(1) Convert a to a binary string (2) Choose blinding vectors (3) Use Fiat-Shamir heuristic to achieve non-interaction, i.e., use the hash fuction instead of the challenge interaction of (4) Construct the two linear polynomials (5) Use the polynomial identity test protocol to prove that Equation  holds anEquation  holds. I(Bulletproof ).For thRemark 3.The specific details of the above definition can be found in . For exaIn RZcoin, if users want to use the privacy protection service, they should create a new secret account for secret transactions. Although the account information will become visible throughout the network as the secret initial transaction recorded in the blockchain, the validity of new account cannot be verified directly because its balance is hidden in the commitment. Therefore, a proof must be attached to the secret initial transaction for validity verification.Similar to the Ethereum, the account balance is zero during the initial creation period. Only through transactions with other accounts can the balance be increased. In other words, we only need to prove that the initial balance is zero. We implement this proof operation using the zero-knowledge proof based on ECDSA in RZcash. In this paper, we use the "key-prefixed" variant of Schnorr signature to reconstruct the scheme, thereby reducing the size of proof.Definition 7.The "key-prefixed" variant of Schnorr signature is defined by the following three algorithms:Equation  holds, t(The “key-prefixed” Schnorr signature ).The "kx to be proved and the auxiliary parameter m, this algorithm calls the schnorr signature scheme to generate the corresponding evidence z.z, if Based on the above scheme, we re-explain our original zero-knowledge proof as follows. To facilitate the subsequent algorithm description, we will call this scheme Szkp. Szkp mainly contains the following three algorithms:In the existing blockchain system, each account contains a pair of keys To solve this problem, we attempt to improve the existing ciphertext equivalence test scheme and construct a new public key signature scheme, which is called ciphertext equivalence signature scheme (CEs). The so-called ciphertext equivalence test is to determine whether two different ciphertexts contain the same plaintext information without decryption. The ciphertext equivalent test scheme we used was proposed by Zhu et al. in 2018. This work improves the PKEwET scheme proposed by Lin et al. in 2016, and uses the straight line to construct equivalent tests to obtain better performance and lower ciphertext space. The specific details of the scheme called PKEwET-L are shown in Inspired by the straight line construction of this scheme, we further optimize the design of its equivalent test and propose a public key signature mechanism called CEs suitable for the blockchain system. Based on the original private key of users, CEs generates a new public key by constructing the ciphertext equivalent commitment. The public key is bound to the secret account and is used to sign and verify secret transactions. The address for receiving secret transactions is also generated based on it. CEs does not need to generate a new private key, so it can reduce the cost of key management while ensuring the non-repudiation of signatures.Definition 8.The ciphertext equivalence signature scheme CEs is defined as the following four algorithms:In this paper, we implement Hash1 and Hash2 based on SHA256. Their construction methods are: Equation . Here, bIf Equation  holds, tTheorem 3.A adversary cannot successfully forge a valid signature without knowing the signer’s private key. That is, for any PPT adversary (Unforgeability)Like the other general public key signature scheme, our scheme is unforgeable and non-repudiation. Among them, the definition of unforgeability is as follows:Proof of Theorem 3.G. Since the transaction T and the point G are publicly known throughout the network, the scalar (1)Attack on (2)Attack on As shown in Equation , the genFor the first attack mentioned above, we use the hash function with strong collision to achieve defense. In the implementation of CEs, we construct these two hash functions based on SHA256. By adding randomness to the input of SHA256, we implement Because CEs satisfy the unforgeability, a valid signature can only be generated by the signer himself. Therefore, CEs is non-repudiation.RZcoin is a decentralized payment system that provides optional privacy services based on the account model blockchain. In this paper, we choose Ethereum as the underlying blockchain system to build it. Each user needs to register an Ethereum account for subsequent transactions when entering RZcoin for the first time. The user can choose to mortgage a certain amount of assets to become an accounting node  to participate in mining, or can only perform daily transactions as lightweight nodes. When a transaction is initiated, the complete information of it will be broadcast across the entire network through P2P communication. Some full nodes collect these transactions and verify their validity. Valid transactions will be integrated into blocks and recorded in the blockchain through a consensus mechanism .A is the transaction payer and the node B is the transaction payee, the basic workflow of RZcoin is shown in RZcoin mainly contains three roles, namely payer, payee and verifier. When the transaction requires privacy services, its payer and payee need to first create a new account to store and transfer secret assets. We call this account a secret account. After the creation is completed, the payer and the payee can use their secret accounts for the next secret transfer without regenerating. In RZcoin we implemented, the verifier is mainly played by the full node. When the full node receives the transaction, it will verify the evidence, and the verification. In addition, only if the verification is passed, the transaction can be uploaded to the chain. Subsequently, the payee updates its balance according to the transaction data recorded in the chain. Assuming that the node Since the privacy service provided by RZcoin is optional, users can have both open accounts and secret accounts. The composition of transactions between different accounts is also different. Transactions between public accounts do not involve privacy services, so we do not describe them in this paper. Next, we will introduce the work that each role is responsible for in secret transactions.-Payer: When the payer wants to initiate a secret transaction, he needs to update the current commitment of secret assets  based on the amount spent in this transaction. He also generates the commitment corresponding to the transaction amount. For these commitments, he needs to provide corresponding evidence to prove its legitimacy, such as range proofs. At the same time, he will use the public key of payee to encrypt the transaction amount and corresponding random number. These ciphertexts will be sent to the payee so that he can verify the correctness of the amount. The payer packages the above data into a transaction, signs it and sends it to the network.-Verifier: For the received secret transaction, the full node will verify the validity of the transaction signature, range proofs and the updated balance commitment. If the verification is passed, the transaction will be packaged into a block and recorded in the blockchain through distributed consensus.-Payee: For the secret transaction related to him in the blockchain, the payee uses his private key to decrypt the ciphertext in it and verifies the corresponding commitment. If the verification fails, the payee will publish the evidence to the network and declare the secret transaction invalid. If the verification is successful, the payee updates his locally stored balance and random numbers.To ensure security, the secret information owned by payer and payee must be stored in their respective TEEs, and calculations involving this information are also performed in it.We define some types of attacks that RZcoin may face to lay the foundation for subsequent security analysis. RZcoin mainly faces the following three attack modes, namely balance forgery attack, signature forgery attack and over-spending attack. Next, we will introduce the principles and operations of these attacks.When the user wants to use the privacy service, he needs to create a secret account bound to his private key and publishes the initial information of it, such as its initial balance and account address, in the form of secret initial transaction on the blockchain network. The initial balance in such transaction is expressed in the form of commitment. That is, the balance of secret account is hidden from the beginning. Since then, the balance was updated in a hidden state. No one except the account owner can know the secret balance at any time.Since RZcoin is built on Ethereum, the setting requirements of the initial balance are the same as that of Ethereum, i.e., the initial balance must be set to zero. Since the account creation is a local operation of the user, an adversary may want to violate the above system settings to forge the account balance commitment. When the adversary sets an account balance, he may want to use any known positive integer to replace zero to generate the commitment, thereby fabricating an available asset with no legal source for himself.For each secret transaction in the system, its initiator needs to sign it to ensure the traceability of the transaction source. This also realizes the non-repudiation of transactions. RZcoin uses CEs to generate the public key of secret accounts and sign secret transactions. In this regard, malicious adversaries may want to obtain key parameters of the signature by analyzing some public information in the Internet . The parameter can be used to forge the signer’s signature, thereby further forging his transaction. Using this method, the adversary may want to transfer the victim’s secret assets to his account or spend them. This is the so-called signature forgery attack.In RZcoin, The asset information involved in each secret transaction is hidden in the commitment. Except for its payer and payee, no one can know the amount of this transaction. In addition, the secret balance of the transaction participants cannot be known by other nodes in the network. Malicious adversaries may want to spend more than their account balance in a single secret transaction and forge the legal range proof to disguise the unreasonable consumption behavior. This is the so-called signature over-spending attack.In this section, we will systematically introduce the transaction details in RZcoin. Because the focus of our work is on privacy services, we will focus on the secret and semi-secret transactions in RZcoin to introduce the details of their construction process and entire transaction cycle. Since the use of secret services requires the construction of a new secret account, the secret initial transaction is also the focus of our description. The specific process of open transactions is omitted. We start with the definition of some notations involved in RZcoin.G and H represent two different points of the elliptic curve group G is the base point of the curve and H is any point other than the base point. It requires that the discrete logarithm H relative to G must be unknown. For the secret balance and transaction amount, RZcoin can hide them in the commitment. (1)Call the key generation algorithm (2)Set the initial balance (3)m here is set by the system and its value will not affect the generation of evidence.Calculate the commitment (4)Integrate the data generated in the above steps into (5)Use The secret initial transaction is the first transaction generated by users after calling the privacy service. Its construction depends on the algorithm called In the above process, (1)Call the signature verification algorithm (2)Call the proof verification algorithm (3)If all above verifications are passed, the algorithm returns 1, otherwise 0.When The process of the secret initial transaction is shown in In the previous section, we briefly introduced the concept of secret transactions. The entire process of secret transactions does not involve open assets. All transaction information is hidden through privacy services. Next, we will take a specific transaction scenario as an example to introduce the specific process of secret transactions. In this scenario, node (1)Randomly select (2)For the updated balance (3)For the two commitments generated in the previous step, the proof generation algorithm (4)Use (5)Update the balance commitment of (6)Construct the secret transaction The construction of secret transactions depends on the algorithm (1)Call (2)Call the proof verification algorithm (3)Respectively verify the algebraic relationship between these balance commitments. If Equations  and 38)38) hold,(4)If all above verifications are passed, the algorithm returns 1. Otherwise it returns 0.After receiving the transaction, the full node needs to call the algorithm (1)C.Use (2)Use the decrypted When the payee The semi-secret transactions refers to transactions involving one of the payer and payee using public accounts. It realizes the conversion between secret assets and open assets. When the payer and payee are the same user, this conversion realizes the "cash-out" and "recharge" operations of the user’s secret assets. Next, we will use two specific scenarios as examples to show the interactive process of semi-secret transactions, which are called Scene 1 and Scene 2 respectively. Scene 1 is used to describe it initiated by the open account and Scene 2 is used to describe it initiated by the secret account. There are three nodes involved in these two scenarios: Payer : (1)Randomly select (2)Use (3)Update (4)(5)Construct The construction of Verifier:(1)Call (2)Call (3)Verify the correctness of the balance updates of quations  and 50)A and B. After receiving the transaction Payee : (1)Use the locally saved (2)Use the decrypted When In Scene 1, we describe the conversion from open assets to secret assets. Next, we will introduce Scene 2 according to different roles.Payer : (1)Randomly select (2)Generate the commitment of (3)Generate the updated balance and commitment.(4)Call bulletproof to generate the corresponding evidence of the updated commitment.(5)Construct The construction of Verifier:After receiving (1)Call (2)Call (3)Call (4)Verify the correctness of the updated balance of quations  and 65)B and C. Payee : When In the previous article, we defined three attack models that RZcoin may face. In this section, we will perform the heuristic analysis of security of RZcoin based on these attack models.This attack mainly refers to an attack against the initial balance. As long as the initial balance is legal, RZcoin will ensure the legality of balances updated subsequently. RZcoin chooses to use the non-interactive zero-knowledge proof scheme called Szkp to resist this attack. This scheme can prove that the user honestly calculated the initial balance commitment of the secret account without exposing the secret information ely used .We choseH, where RZcoin can resist the balance forgery attack.Because of the schnorr signature, the proof generated by Szkp also satisfies unforgeability. This property is based on the ECDLP. Based on it, a malicious adversary cannot know the discrete logarithm RZcoin can resist the signature forgery attacks.The signature mechanism of RZcoin is implemented through CEs. In Therefore, RZcoin can resist the over-spending attacks.In RZcoin, the asset information involved in each secret transaction is hidden in the commitment. Except for payer and payee, no node can know the transaction amount. To ensure the validity of secret transactions, we require the payer to provide the legality proof for its hidden asset information. Therefore, a malicious adversary who wants to launch an over-spending attack must be able to forge a legal proof to disguise his unreasonable consumption behavior. The security proof of bulletproof used in this article was given in . TherefoWe use python to simulate RZcoin and test its performance. We will first evaluate the underlying improvements, such as CEs and Szkp. Then we will evaluate the performance of each algorithm in RZcoin from the running time and memory consumption. We will start with the configuration of simulation environment.To facilitate testing, we chose to implement RZcoin’s core algorithm on the laptop with Ubuntu 18.04.2 LTS operating system. The hardware and software configuration of the entire test environment is shown in In RZcoin, we mainly give three improvements: (1) We propose CEs to solve the key redundancy problem caused by secret accounts; (2) We use Schnorr to reconstruct the zero-knowledge proof scheme to reduce the size of proof; (3) We used bulletproof to further reduce the size of the transaction. In the previous section, we performed a heuristic analysis of their security. It shows that these improvements improved the security of RZcoin. In this section, we will further evaluate their performance. To facilitate evaluation, the accuracy of the running time of all algorithms is set to six decimal places.The signature scheme mainly contains three algorithms, namely KeyGen, SigGen, and SigVer. We will evaluate the running time of these three algorithms and the size of the generated signature. The test results are shown in The purpose of using schnorr signatures to achieve improvements is mainly as follows: (1) Schnorr has higher security than ECDSA. Using it to achieve optimization can further enhance the security of the solution. (2) The size of the signature generated by schnorr is smaller than that of ECDSA. Therefore, this improvement can further reduce the size of transaction. (3) The schnorr signature is linear, so the zero-knowledge proof based on it also has this property. It provides the possibility for subsequent scalability improvements. We will test the proof generation and verification algorithm of Szkp and compare the results with the original scheme ZKP in RZcash. The test results are shown in N to denote the maximum bit length of the object (ie number) allowed by the range proof. In its performance test, we will gradually adjust N from 2 to 64 to evaluate the influence of N on the size of returned result. The test results are shown in We use bulletproof to reduce the size of range proofs. Therefore, we mainly focus on the comparison between it and the range proof scheme RP of RZcash in the size of the generated proof. We use N to denote the maximum bit length of the object (ie number) allowed by the range proof. In the performance test of RZcoin’s algorithm, we will gradually adjust N from 2 to 64 to evaluate the influence of N on the algorithm running time and the size of returned result. These data are the average of the results obtained after 20 tests. To facilitate evaluation, the accuracy of the calculation time of all algorithms is set to six decimal places.The above evaluation results of these improvements show that although they increase the running time to a certain extent, the size of generated proof (or signature) is much smaller than that before optimization. In addition, the security of RZcoin has also been improved. Overall, these are some good improvements. However, by simplifying RZcoin’s model algorithms, we achieved good performance in the operation of the overall system. The algorithm description for RZcoin is shown in N. The size of secret initial transactions will also not change as N grows.N. However, the running time of N. The size of secret transactions will gradually increase as N grows.N. However, the running time of N. In addition, N grows, but N.N, regardless of the account used by the payee. The running time of the generation algorithm of secret transactions that the payer needs to call and the verification algorithm of secret transactions that the full node needs to call will also show a positive growth trend with the change of N. The running time of all algorithms is in the millisecond level. This shows that RZcoin has good performance.By summarizing and comparing the above test results, we observe that as long as the payer uses his secret account to initiate transactions, the size of transactions will increase with the growth of Based on our previous work, called RZcash, we will further improve its core algorithm and propose a decentralized payment called RZcoin that provides the optional privacy protection service. For the key redundancy caused by the secret account, we propose a signature scheme called CEs based on the ciphertext equivalent test scheme. We also use Schnorr signature and bulletproof to reduce the size of proof required for services. We implement the above decentralized payment scheme based on the Ethereum test chain and evaluate its performance. At the same time, we also propose the adversarial model it faces and give the corresponding security analysis. The result shows that the scheme can provide the privacy service to users with good performance and lower communication cost while ensuring security. Next, we will further explore how the privacy protection scheme for smart contracts can be combined with RZcoin.