Hazaël Jones
email: hazael.jones@gmail.com

Nicolas Sabouret
email: nicolas.sabouret@limsi.fr

Ionut Damian
email: damian@hcm-lab.de

Tobias Baur
email: baur@hcm-lab.de

Elisabeth André
email: andre@hcm-lab.de

Kaśka Porayska-Pomsta
email: k.porayska-pomsta@ioe.ac.uk

Paola Rizzo
email: p.rizzo@ioe.ac.uk

Interpreting social cues to generate credible affective reactions of virtual job interviewers

Keywords: I.6.5 [Computing Methodologies]: Simulation and Modelling-Model Development; J.4 [Computer Applications]: Social and Behavioural Sciences Perceptions, Social cues, Communicative performance, Affective model, Job interview

In this paper we describe a mechanism of generating credible affective reactions in a virtual recruiter during an interaction with a user. This is done using communicative performance computation based on the behaviours of the user as detected by a recognition module. The proposed software pipeline is part of the TARDIS system which aims to aid young job seekers in acquiring job interview related social skills. In this context, our system enables the virtual recruiter to realistically adapt and react to the user in real-time.

INTRODUCTION

The number of young people who are not in employment, education or training (NEETs) is increasing across Europe. According to Eurostat 1 , in March 2012, 5.5 million of 16 to 25 years old European youngsters were unemployed, amounting to 22.6% of the youngster global population, which is 1 ec.europa.eu/eurostat 10 points above the entire world's population. These statistics highlight European youth unemployment as a significant problem.

NEETs often lack self-confidence and the essential social skills needed to seek and secure employment [START_REF] Bynner | Social Exclusion and the Transition from School to Work: The Case of Young People Not in Education, Employment, or Training (NEET)[END_REF]. The young unemployed often find it difficult to present themselves in a good light to prospective employers, which may put them at further risk of marginalisation. Social coaching workshops, organized by youth inclusion associations across Europe, constitute a common approach to helping people in acquiring and improving their social competencies, especially in the context of job interviews. However, this is an expensive and time-consuming approach that relies on the availability of trained practitioners as well as a willingness of the young people to discuss their strengths and weaknesses in front of practitioners and often also in front of their peers.

Digital games offer a promising way of supporting the training and coaching of young people, providing them with a safe and private environment in which they can practice their skills repeatedly. TARDIS2 [START_REF] Anderson | The TARDIS framework: intelligent virtual agents for social coaching in job interviews[END_REF] is a project funded by the FP7, whose aim is to build a scenario-based serious-game simulation platform that supports social training and coaching in the context of job interviews. It relies on the use of virtual agents that are capable of reacting in real-time to a human interlocutor's affect, based on the interlocutor's nonverbal cues that are automatically detected and analysed in the context of simulated job interviews.

The goal of this paper is to present the TARDIS' mechanisms involved in the detection and interpretation of social cues and in informing the behaviours of virtual recruiters. We show how the system builds affective states and beliefs about a real user during an interaction with a virtual character. Specifically, the TARDIS game relies on real-time social cue recognition, communicative performance computation and affective computation/decision making by the virtual recruiter. Building a credible job interview simulation involving a reactive virtual agent requires real-time information about the youngster in order to allow for an assessment of the appropriateness of the youngster's reactions and their communicative performance. Such assessment is done through the perception of a number of relevant social cues that are interpreted in term of performance, relative to the social expectations that are associated with a given situation. This assessment allows the TARDIS system to compute both an affective reaction for the virtual recruiter and the future steps in the interaction dialogue.

The next section presents a brief overview of related work. We then present the different components of our architecture that have been implemented in the TARDIS system.

STATE OF THE ART

Several research projects have already considered using virtual agents to help humans improve their social skills and, more generally, their emotional intelligence [START_REF] Goleman | Social intelligence: The new science of human relationships[END_REF][START_REF] Tartaro | Playing with virtual peers: bootstrapping contingent discourse in children with autism[END_REF][START_REF] Aylett | Affective agents for education against bullying[END_REF]. However, while the existing approaches use a reactive approach to the user inputs, our efforts focus on deriving an affective reaction of the virtual recruiter, based on the analysis of the user's beliefs and social cues.

Social Cue Recognition

Using signal processing techniques to detect behavioural patterns is not a new idea (for an overview see [START_REF] Vinciarelli | Bridging the gap between social animal and unsocial machine: A survey of social signal processing[END_REF]). However, most research to date focused on a reduced number of modalities, such as speech [START_REF] Vogt | Comparing feature sets for acted and spontaneous speech in view of automatic emotion recognition[END_REF] or facial expressions [START_REF] Zeng | A survey of affect recognition methods: Audio, visual, and spontaneous expressions[END_REF], to infer user states, with little attention having been paid to gestures or postures [START_REF] Kapoor | Multimodal affect recognition in learning environments[END_REF][START_REF] Kleinsmith | Form as a cue in the automatic recognition of non-acted affective body expressions[END_REF]. Furthermore, signal processing work is aimed for offline analysis of recordings, rather than real-time interactive applications. One interesting example is the public training system presented by Batrinca et al. [START_REF] Batrinca | Cicerotowards a multimodal virtual audience platform for public speaking training[END_REF], where the user is able to practice public speaking with the help of a virtual crowd. However, the behaviour analysis that they propose does not happen in real-time during the interaction, but rather post-hoc and offline. This means that the system is not able to react to the user's behaviour as they interact with the system.

There are, of course, exceptions. One recent example is the job interview simulation system presented by Hoque et al. [START_REF] Mohammed Ehsan Hoque | Mach: My automated conversation coach[END_REF]. Their system is able to detect a limited number of social cues in real-time, including smiles and audio features as well as perform speech recognition. While, owing to the large number of languages that TARDIS aims to support, our system does not implement speech recognition, it does recognise a much broader range of social cues, including bodily social cues, such as movement energy, gestures and postures, physiological features and eye gaze.

Job interview assessment based on social cues

Several researchers show that diverse interaction scenarios, including job interviews, negotiations or group meetings, are heavily impacted by the interactants' nonverbal behaviours.

For instance [START_REF] Thomas | Comparison of professional versus student ratings of job interviewee behavior[END_REF] and [START_REF] Arvey | The employment interview: A summary and review of recent research[END_REF] found that the assessment of candidates by job interviewers is significantly influenced by social cues such as tone of voice, eye gaze contact and body movement. For these reasons, the contemporary research in this field increasingly focuses on the relationship between nonverbal behaviours and the outcome of interactions. Specifically to job interviews, [START_REF] Curhan | Thin slices of negotiation: predicting outcomes from conversational dynamics within the first 5 minutes[END_REF] studied how the success of simulated job interviews can also be predicted by conversational engagement, vocal mirroring, speech activity, and prosodic emphasis.

The training of social skills has informed several computerbased simulation environments for domains that include bullying at school [START_REF] Aylett | Affective agents for education against bullying[END_REF], intercultural communication [START_REF] Kistler | Natural interaction with culturally adaptive virtual characters[END_REF] and job interviews [START_REF] Prendinger | The empathic companion: A character-based interface that addresses users' affective states[END_REF]. However, in the case of job interview situations a major difficulty is that the interviewees tend to suppress their emotions and avoid showing social cues, which may result in an undesirable impression being given to the interviewer and ultimately it may impact negatively on the interview outcome. Emotional expression in job interviews is heavily governed by display rules, and most job applicants feel obliged to hide their feelings, especially if those feelings are negative [START_REF] Sieverding | Be Cool!': Emotional costs of hiding feelings in a job interview[END_REF]. The fact that in job interview situations, young job seekers tend to avoid showing emotions has been confirmed by our own studies, which will be reported in future publications. In these studies, subjects involved in both mock interviews with human recruiters and in simulated job interviews with virtual recruiters displayed very few or no bodily social cues that could be detected reliably and consistently by our current technologies. For this reason, we are currently focusing on voice cues.

Affects and Theory of Mind

Several approaches to building credible virtual humans have been proposed in the domain of affective computing3 , including cognitive models of emotions [START_REF] Ortony | The Cognitive Structure of Emotions[END_REF][START_REF] Marsella | Expressive behaviors for virtual worlds[END_REF], models of personality [START_REF] Prendinger | Social role awareness in animated agents[END_REF] and of social relations [START_REF] Ochs | Simulation of the Dynamics of Non-Player Characters' Emotions and Social Relations in Games[END_REF]. However, to our best knowledge, no computational model of social attitudes has been proposed. Social attitudes are socially conditioned expressions of the personality of an agent as manifested in its behaviours and emotional displays. The social conditioning derives from the specific social and cultural norms of a given community or situational contexts. For example, in the context of a job interview, social attitudes provide the recruiter with information about the interviewee's personality and feelings towards the job. This information influences the way in which the virtual recruiter will progress the interview and how it will perceive the suitability of the interviewee for the given job. Many of the processes involved in interpreting the beliefs and emotions of the TARDIS' users are cognate with and draw from the studies related to Theory of Mind [START_REF] Meltzoff | Understanding the Intentions of Others: Re-Enactment of Intended Acts by 18-Month-Old Children[END_REF] and reverse appraisal [START_REF] Hareli | What emotional reactions can tell us about the nature of others: An appraisal perspective on person perception[END_REF].

Theory of mind (ToM) [START_REF] Leslie | ToBy, and agency: Core architecture and domain specificity[END_REF][START_REF] Baron-Cohen | Mindblindness[END_REF], is the ability of a person to attribute mental states (beliefs, intentions, desires and affects) to others. Numerous studies have been conducted in relation to the reasoning process of an agent about the cognitive process of another agent [START_REF] Bosse | A two-level BDI-agent model for theory of mind and its use in social manipulation[END_REF][START_REF] Dastani | A logic of emotions: from appraisal to coping[END_REF]. In our work, we want to model the reasoning process of an agent that deduces the preferences of an human (the interviewee). This particular configuration raises additional difficulties and leads to a novel formulation of the ToM. As a way of illustrating the novelty of our approach, consider for example Pynadath's approach [START_REF] David | PsychSim : Modeling Theory of Mind with Decision-Theoretic Agents[END_REF], where an agent has subjective beliefs about others. Artificial agent A has beliefs about another artificial agent B, which beliefs follow the real structure of agent B's beliefs. However, since in TARDIS, agent B is human (the interviewee), we do not have access to prior access to its belief structure, which must be inferred from the outputs of the affect recognition module.

ARCHITECTURE OVERVIEW

The TARDIS architecture is composed of five main components as shown in Figure 1.

The Social Cue Recognition (SCR). This module detects and recognises various social cues that are produced by the youngsters during the simulated interviews. The module sends the detected cues to the on-line user model. To facilitate detection, the module requires the use of different sensors, such as microphones or cameras. In this paper, we will focus on the audio cues perceived with the help of a head-mounted microphone.

The Online User Model. This module receives information about the youngster's social cues detected by the SCR module, it computes a performance index based on the average values of audio social cues that can be considered suitable to a job interview, and it sends this information to the Affective Core, described in Section 6.

The Interview Scenario. This component provides the virtual recruiter with the expectations that it should have in relation to the interviewed youngster's emotions and attitudes, based on the specific stage in the interview. In the current version of TARDIS, the agent has no understanding of the youngster's actual answers to the questions. It simply follows a predetermined scenario, while focusing on the affective recognition and adaptation, based on its knowledge of the scenario and the specific interview questions that have been asked at any given point. It is well known the virtual character research community that the definition of contextsensitive interactive scenario often requires expert programmers and typically results in a hard-to-maintain code. To avoid this, a visual authoring approach for virtual character applications is used. This tool is based on an existing authoring tool, the Visual SceneMaker that allows the scenario to be built by non computer programmers. The scenario provides a context to the virtual recruiter model, specifically -the expectations of the recruiter with respect to the desirable emotions and attitudes of the youngsters.

The Affective and Decision Model of the Virtual Recruiter. The affective and decision model represents the beliefs of the virtual recruiter about the youngster's mental states (specified in terms of affect). It also represents the recruiters intentions with respect to its possible best next interview action. The affective core periodically computes the new affective states for the Virtual Recruiter, based on the perceptions and scenario-based expectations, and current affective states of the youngsters. The difference between the expected and the actually expressed affective states of the youngster are key in the update of the virtual recruiter's own affective states (see next section). Based on the system's theory of mind of the youngster, the decision module selects the next actions in the scenario.

The Virtual Recruiter Animation. The animation module is responsible for rendering the virtual recruiter's affective state through its behaviours. To achieve realistic behaviour displays, we developed a new motion capture pipeline able to process the data captured more efficiently. The expression of affects relies on a model of interpersonal stance, which in turn is based on different time windows. This new pipeline is integrated with Greta4 and it uses MPEG-4, BML and FML standards to allow the user to define the agent's behaviours in XML like form. This allowed us the easy integration of the Charamel5 agent Gloria.

In order to determine the social cues and affects that are relevant during job interviews, a knowledge elicitation study was conducted with ten users in France 6 . These experiments involved enactments of job interviews as they are normally conducted in the participating organisation. The studies allowed us to determine the affective states of the youngsters that are relevant to this domain of interaction and that are integrated in our youngster and recruiter models. Based on the knowledge elicited from these studies, the TARDIS' dialogue model has also been designed.

The rest of this paper focuses on three important modules in the TARDIS simulation. In Section 4, we present the social cue recognition module, Section 5 focuses on the communicative performance computation, while the recruiter affective and decisional model is discussed in Section 6.

SOCIAL CUE RECOGNITION

The Social Cue Recognition module is based on the Social Signal Interpretation framework [START_REF] Wagner | The social signal interpretation (SSI) frameworkmultimodal signal processing and recognition in real-time[END_REF]. SSI provides an interface to diverse sensing devices, as well as a variety of tools for real-time recording and pre-processing of data of human behaviours. The functionality of the module regarding the recognition of body social cues, such as gestures, postures or facial expressions, has been presented in our previous work [START_REF] Damian | Investigating social cue-based interaction in digital learning games[END_REF][START_REF] Baur | A job interview simulation: Social cue-based interaction with a virtual character[END_REF][START_REF] Baur | Nova: Automated analysis of nonverbal signals in social interactions[END_REF]. In this paper, we will focus on the detection, analysis and interpretation of the audio cues. Table 1 summarizes the relevant cues.

As a first step in the recognition of social cues, the raw data coming from the sensors is filtered and transformed with the help of an SSI pipeline and various third party libraries, such as PRAAT [START_REF] Boersma | Praat: doing phonetics by computer [computer program[END_REF] and OpenSMILE [START_REF] Eyben | Opensmile: the munich versatile and fast open-source audio feature extractor[END_REF]. The data streams are then forwarded to the individual social cue recognisers which trigger social cue occurrence events.

The SCR module is able to detect two types of social cues: discrete and continuous. In the case of discrete social cues, the recogniser triggers an event as soon a sufficiently strong occurrence of the respective social cue has been detected. Assessing the quality of a given social cue is either performed using a threshold approach or machine learning algorithms. The event contains information on the recognised social cue and the time of the occurrence, which is meant to be processed by the online user model that makes inferences about The pitch (F0) of the audio signal jitter, shimmer, voice breaks, harmonicity Quality-of-voice features [START_REF] Boersma | Praat: doing phonetics by computer [computer program[END_REF] computed from pitch speech rate

Rate of user's speech [8] length of speech segments

The duration in seconds of the user's speech segments determined by voice activity detection Table 1: Audio cues recognised by the SCR module the user's complex mental states.

Continuous social cues are sent once per second and contain information on the current magnitude or probability of the observed social signal.

USING AUDIO CUES TO COMPUTE COMMUNICATIVE PERFORMANCE

The online user model, currently being implemented, compares the audio cues data produced by users with a set of expected or desirable cues, i.e. audio features that are deemed suitable for each part of a job interview. Based on this comparison, the model computes an index between the values of -1 (negative performance) and +1 (positive performance), and sends it to the Affective Core. 0 represents neutral performance. The index is a weighted sum of the differences between each desired cue value and the actual value produced by the youngster regarding speech duration, speech rate, speech volume, pause before speech, etc.

The following are examples of expected cues:

• interviewer's questions that are complex or sensitive in nature, e.g. "do you have any weaknesses?" requires an answer that goes beyond a simple "yes" or a "no". An appropriate answer should be elaborate and thus, a short speech duration in response to a complex question such as exemplified, would be assigned a perfor-mance index close to -1;

• the voice should not be too loud (intense), as it might sound aggressive, nor too quiet, as it might give the impression of lacking self-confidence;

• the speech should not be too fast, because it might be considered a sign of anxiety, nor too slow, as it might indicate boredom or disengagement;

• the interviewee should not begin to answer too long after the interviewer's questions, because this could be deemed a sign of hesitation, but equally, it the interviewee should not start answering before the interviewer finishes their question;

• the voice should have a good variability of pitch, so as not to sound boring.

Our studies of human-to-human mock job interviews have shown that there are strong individual differences among youngsters' social cues. For this reason the on-line user model requires a calibration phase to take place during an initial part of the interview (over at least the first 3 turns), and then it continuously compares the youngster's behaviours to their typical baseline as established during calibration, it identifies peaks (i.e. behaviours significantly above or below the baseline), and compares them with the expected cues in order to compute the communicative performance index.

AFFECTIVE & DECISIONAL CORE

The perception module and the scenario module provide the input to this module, which is a performance index of the youngster in the range of [-1, +1]. This index is used to compute recruiter affects and decision.

6.1 Affective Core

Overview of the model

The Affective Module is based on a set of rules that compute categories of emotions, moods and attitudes for the virtual recruiter, based on the contextual information given by the scenario and the detected affects (emotions, moods and attitudes) of the participant. The computation of the virtual agent's emotions is based on the OCC model [START_REF] Ortony | The Cognitive Structure of Emotions[END_REF] and the computation of the agent's moods is based on the ALMA model [START_REF] Gebhard | ALMA -A Layered Model of Affect[END_REF]. The details of the computation of emotions and moods will not be presented in this paper; it can be found in [START_REF] Jones | TARDIS -A simulation platform with an affective virtual recruiter for job interviews[END_REF].

The Affective Core receives a performance index as its input. The performance index, which fall in the range of [-1, +1], represents the overall performance of the youngster (its attitude, its affects, its vocal performance). The detected (d) performance is denoted as P d . Similarly, a set of expected (e) performance index is received from the scenario module. This expected performance index is linked to the difficulty of the question. For example, if a question is easy, e.g. "Did you find us easily?", the performance index will be near of 1.

Formally,in our model, all affects of the recruiter correspond to a value in the interval of [0, 1] and we use A to denote the set of all affects. The different affects are categorised in terms of three subsets: E(t) (emotions), M (t) (moods) and A(t) (attitudes) are virtual recruiter's simulated affects. These emotions are computed using expert rules based on the values of P d (t) and Pe(t). All these rules are described in [START_REF] Jones | TARDIS -A simulation platform with an affective virtual recruiter for job interviews[END_REF].

The list of virtual recruiter's possible affects (emotions, moods and attitudes) that are represented in the model is given in Table 2. Note that this set is different from the affects that are actually detected and expected. It is based on the literature and on the mock interview corpus analysis (especially the knowledge elicitation phases mentioned in sections 4 and 5). The emotions are a simple subset of the OCC model [START_REF] Ortony | The Cognitive Structure of Emotions[END_REF] that was selected based on what practitioners, acting as recruiters, expressed during the mock interviews analysed. The moods originated from the ALMA model [START_REF] Gebhard | ALMA -A Layered Model of Affect[END_REF] are defined on 3 dimensions (Pleasure, Arousal and Dominance), but we limited them to the positive dominance zone (since recruiters do not show submissive moods in the context of job interviews). Moods of The computation of moods is based on emotions following ALMA [START_REF] Gebhard | ALMA -A Layered Model of Affect[END_REF]. In the context of our interview simulation, the period is determined by the number of cycle question/answer. Each answer leads to the computation of a new emotions set and these emotions influence the interviewer's mood. The basis for the calibration is as follows: after five cycles of a specific emotion (anger for example), the virtual recruiter will be in the corresponding mood (hostile). More details about the mood computation can be found in [START_REF] Jones | TARDIS -A simulation platform with an affective virtual recruiter for job interviews[END_REF].

The way we compute attitudes follow this principle: an agent can adopt an attitude according to its personality [START_REF] Snyder | The influence of individuals on situations: Implications for understanding the links between personality and social behavior[END_REF] or according to its actual mood [START_REF] Wegener | Effects of mood on high elaboration attitude change: The mediating role of likelihood judgments[END_REF]. For example, an agent with a non-aggressive personality may still show an aggressive attitude if its mood becomes very hostile. The mood compensates the personality and vice versa. For this reason, we use a logical-OR as condition on these two dimensions. As a consequence, in our model, the attitude can be triggered by one of these two dimensions. Then, the maximum value (mood or personality) is kept to compute the corresponding attitude, as is classically done in Fuzzy logics.

Decisional Core

Our main objective is to deduce real user beliefs from the real user/virtual agent interaction. In this interaction, inputs (affective states of the user) are given by non verbal signals deduced from social signal interpretation. It can be used on different simulations involving the interaction of a human with a virtual agent: teaching, formation, training, amongst other. The common feature of these simulations is the use of questions by the agent. Our model considers the use of questions in order to manage the context of the answers of the person interacting with the TARDIS.

To summarize, our theory of mind model has three main properties:

• The theory of mind is about a real person who interacts with the system

• It is centred on affective states interpretation of the person in front of the simulation

• It uses the context of questions to analyse user responses.

Context management

Labels are given to the questions/sentences of the virtual character in order to interpret the answer/reaction of the human in terms of beliefs with respect to some topics. A list of topics can be constructed for each specific application. The set of topics settopic contains N topics: {topic1, topic2, . . . , topicN }. Each subject is application dependent and based on the domain of the simulation. A question is defined by 0 to n topics.

Building a Beliefs Model

In order to build beliefs about the human who interacts with the system, we consider the questions/sentences that were just expressed by the virtual agent (identified by labels about topics) and the quality of the answer of the human from an affective point of view (which is obtained by the social cue recognition module) and the performance index P d . Based on this information, the agent updates its beliefs about the human on a particular subject. We denote the beliefs of the agent about the human as BHuman(topici) for i in {1, . . . , N }.

According to the topic(s) raised by the question/remark of the agent, beliefs will be updated. In pursuance of building the beliefs of the human, we consider its answer (perceived via SSI) and based on P d decide the degree to which the youngster's answer can be categorised as positive (+1), negative (-1) or neutral (0).

Based on the human's average answer (P d ) and the topic tags of the question/remarks just posed/made by the agent, the beliefs can be computed. Updates of each belief is done with the following formula for each topic :

Algorithm 1 Beliefs computation for topici ∈ settopic do BHuman(topici) ← BHuman(topici) + α × P d
α is a weight between 0 and 1 that can be altered if we want the recruiter beliefs about the human to evolve quickly (α = 1) or not (α near of 0). It can rely on the personality of the agent. An impulsive agent has an α near the value of 1 and a moderate one close to 0.

Desires and goals

The desires are used to define the strategic intentions of the agent. Desires are denoted by D(BHuman(topici), because desires in an interaction are about beliefs of the human on a particular topic. It corresponds to the beliefs that every person process during an interaction according to the reaction of the interlocutor. For instance D(B John (f ootball) is the desire of the agent about John's knowledge in the f ootball topic.

Dynamics of goals

Social attitudes used can be defined on Leary circumplex [START_REF] Leary | Interpersonal circumplex[END_REF]. As shown by Leary, attitudes can be separated into two categories: the positive ones (friendly, supportive, etc.) and the negative ones (aggressive, dominant, etc.).

Based on these two types of attitudes, we define the Algorithm 2 in order to enable for the desires of the agent to be updated. This algorithm works as follows: if the agent has a negative attitude, its will intend to select topics with a negative answer for the human. On the other hand, if the agent has a positive attitude, its desires are about topics with a positive answer from the human.

Goal selection

Several strategies can be defined to enable the selection of one of the desires in the list of possible desires. The simplest strategy is to select the desire with the maximum value in the available desires. At any given point in the interview dialogue, every possibilities (topics) will not be suitable for preserving a logical sequence of the conversation (a scenario for instance).

CONCLUSION

In this article, we propose a pipeline to compute the affective reactions in a virtual recruiter from user behaviour. To this end, we employ the use of the SSI framework [START_REF] Wagner | The social signal interpretation (SSI) frameworkmultimodal signal processing and recognition in real-time[END_REF] to recognize user social cue in real time. The social cues are then forwarded to a online user model which uses them to compute a performance index of the user' behaviour. Based on the performance index as well as on the scenario, affects of the virtual recruiter are computed and a ToM approach allows to reason about the user's preferences.

Within the TARDIS training system, which is meant to aid young job seekers in acquiring job interview pertinent social skills, the pipeline will allow the virtual recruiter to react and adapt to the user's behaviour in real time, thus generating credible interaction.

As part of our future work, we aim to conduct studies to evaluate and validate the functionality of the described methodologies. On the technical side, we aim to improve the robustness of the pipeline, for example, by implementing mechanisms to explicitly deal with recognition errors. Furthermore, we plan to extend the online user model to compute other behavioural characteristics as well as to handle more social cues, such as expressivity features, physiological cues or eye gaze.

Figure 1 :

 1 Figure 1: Global architecture

Algorithm 2

 2 Desires computationif (Attitude ∈ set(attitude-)) then for BHuman(topic) ∈ settopic do if (P d < 0) then D(topic) ← D(topic) + α × |P d | else D(topic) ← D(topic) -α × |P d | if (Attitude ∈ set(attitude+)) then for BHuman(topic) ∈ settopic do if (P d < 0) then D(topic) ← D(topic) -α × |P d | else D(topic) ← D(topic) + α × |P d |

Table 2

 2

			are with positive or neu-
	tral dominance.
		Positive	Negative
		Joy	Distress
	Emotions	Relief	Disappointment
		Admiration	Anger
		Hope	Fear
		Relaxed	Hostile
	Moods	Exuberant	Bored
			Disdainful
		Friendly	Aggressive
	Attitudes Supportive
			Dominant
		Attentive	Inattentive
			Gossip

Table 2 :

 2 Recruiter affects

http://www.tardis-project.eu

See the Humaine project: emotion-research.net

GRETA is an Embodied Conversational Agent used in the SEMAINE project.

http://charamel.de/

The study was conducted at Mission Locale, which is a French network of organisation that helps youngster in their social course and professional career.

Acknowledgment

The research leading to this paper has received funding from the European Union Information Society and Media Seventh Framework Programme FP7-ICT-2011-7 under grant agreement 288578.


Hazaël Jones
email: hazael.jones@supagro.inra.fr

Mathieu Chollet
email: mathieu.chollet@telecom-paristech.fr

Magalie Ochs
email: magalie.ochs@telecom-paristech.fr

Nicolas Sabouret
email: nicolas.sabouret@limsi.fr

Catherine Pelachaud
email: catherine.pelachaud@telecom-paristech.fr

Expressing social attitudes in virtual agents for social coaching

Keywords: Attitudes sociales, motions, informatique affective, agent virtuel, comportement non-verbal Social Attitudes, Emotions, Affective computing, Virtual Agent, Non-verbal behaviour

L'utilisation des agents virtuel pour le coaching social a connu une forte croissance ces dernires annes. Dans ce domaine, l'agent virtuel doit tre capable d'exprimer diffrentes attitudes sociales pour permettre l'utilisateur de s'entraner surmonter des situations de la vie relle. Dans cet article, nous proposons un modle d'attitudes sociales qui permet un agent virtuel de raisonner sur l'attitude sociale la plus approprie exprimer au cours d'une interaction avec l'utilisateur, en s'appuyant sur un modle d'agent affectif. L'expression de cette attitude se fait travers le comportement nonverbal.

Introduction

Social coaching workshops constitute a common approach to help people in acquiring and improving their social competencies. The main difficulty with this approach is that it relies on the availability of trained practitioners as well as the willingness of the people to engage in exploring their social strengths and weaknesses in front of their peers and practitioners. For this reason, the use of virtual agents in social coaching has increased rapidly in the last decade [START_REF] Tartaro | Playing with virtual peers: bootstrapping contingent discourse in children with autism[END_REF][START_REF] Aylett | Affective agents for education against bullying[END_REF][START_REF] Hoque | MACH: My Automated Conversation coacH[END_REF]. However, most of the proposed models focus on the simulation of emotions and do not take into account the different social roles that the virtual agent may embody. Yet, given its role and the course of the interaction, the virtual agent should be able to express different social attitudes to train the user in different situations that can occur in real life. For this reason, one of the key elements of a virtual agent in the domain of social coaching is its ability to reason on social attitudes and to express them through its behaviour. This is why, in this research work, we propose a model of social attitudes for expressive virtual agents. Social attitude can be defined as "an affective style that spontaneously develops or is strategically employed in the interaction with a person or a group of persons, colouring the interpersonal exchange in that situation (e.g. being polite, distant, cold, warm, supportive, contemptuous)" [START_REF] Scherer | Appraisal considered as a process of multilevel sequential checking. Appraisal processes in emotion: Theory, methods, research[END_REF]. As highlighted in [START_REF] Wegener | Effects of mood on high elaboration attitude change: The mediating role of likelihood judgments[END_REF], one's social attitude depends on one's personality but also one's moods that is directly influenced by the course of the interaction. One's social attitude is mainly conveyed by one's non-verbal behaviour [START_REF] Argyle | Bodily Communication[END_REF]. Our aim is to develop a model of social attitudes that can be used by virtual agents to select determine expressive behaviours given its simulated affective state and the course of the interaction. The model we propose in this paper considers user's emotions, mood and personality and compute and display agent's appropriate social attitudes, based on classical work from the literature in affective computing [START_REF] Gebhard | ALMA -A Layered Model of Affect[END_REF][START_REF] Ortony | The Cognitive Structure of Emotions[END_REF]. Moreover, it enables the virtual agent to display its social attitude through its non-verbal behaviour, based on models of social attitude expression for virtual agents such as [START_REF] Ballin | A framework for interpersonal attitude and non-verbal communication in improvisational visual media production[END_REF]. Our model has been developed in the context of job interview (JI) simulation. This context is interesting for several reasons: 1) social attitude plays a key role in JI: the applicant tries to fit the social norm and 2) the recruiter is in a role-play game, which can be simulated with a virtual agent. Moreover, job interview is a type of social coaching situation with high social impact. The methodology used to develop such a model combined a theoretical and an empirical approach. Indeed, the model is based both on the literature in Human and Social Sciences on social attitudes but also on the analysis of an audiovisual corpus of job interviews and on post-hoc interviews with the recruiters on their expressed attitudes during the job interview.

General Architecture

Our interview simulation for social coaching involves two main actors, namely the participant (i.e. the person that is training on the system) and the interlocutor (i.e. person or virtual agent that respond to the trainee). In our platform, the interlocutor is replaced by a virtual agent. Although the model presented here is general and can be applied to different interaction situations, our corpus and the derived cognitive architecture and non-verbal behaviour are designed in the context of job interview simulations when the agent acts as recruiter. Fig. 1 presents our general architecture. This architecture is organized as follows. First, a scenario describes the context of the interaction and the expectations at the different stages of the interview in terms of affects expression1 . For example, after a tough question, the interviewer will expect negative affects from the interviewee (distress, agitation). The affective module (described in ection 4) takes as inputs the scenario information and the detected social cues. It computes a social attitude for the virtual agent (the recruiter in our case). These attitudes are turned into non-verbal behaviours in the virtual agent animation module (Section 5) and used in the next interaction step. This module is based on the Greta platform [START_REF] Poggi | GRETA: a believable embodied conversational agent[END_REF] and is composed of an intent planner that generates the communicative intentions (what the agent intents to communicate) based on the scenario, and a behaviour planner that transforms the communicative intentions into a set of signals (e.g. speech, gestures, facial expressions) based on the agent's attitude and mental states. In the following sections, we first present the corpus that was used to build our social attitude model. We explain how the corpus was collected, based on mock job-interviews, and it was annotated. We then give details of the Affective Module and the Animation Module and we show their interrelation.

Corpus

We have collected a corpus of real interpersonal interaction between professional recruiters and job seekers interviewees. The recordings consisted in creating a situation of job interviews between 5 recruiters and 9 interviewees. The setting was the same in all videos. The recruiter and the interviewee sat on each side of a table. A single camera embracing the whole scene recorded the dyad from the side. This resulted in a corpus of 9 videos of job interview lasting between 15 and 20 minutes each. We discarded 4 videos as the recruiter was not visible due to bad position of the camera. Out of the 5 remaining videos, we have so far annotated 3, for a total of 50 minutes and 10 seconds of video. The non-verbal behaviours of the recruiters during the job interview have been annotated. We also annotate information on the interaction: the turn taking (i.e. who is speaking), the topic of the discussion (i.e. document related or general), the perceived affects of the interviewee (e.g. embarassed, relieved, bored...), and the attitude of the recruiter (i.e. the level of perceived dominance and friendliness of the recruiter). Different modalities of the recruiter's non-verbal behaviour have been annotated (e.g. the gaze behaviour, the gesture, the posture, the head movements, etc). The coding scheme, the resulting annotations, and the interannotators agreements are described in more details in [START_REF] Chollet | A multimodal corpus for the study of non-verbal behavior expressing interpersonal stances[END_REF]. These annotations have been used to construct the animation module for the virtual agent's expression of social attitudes (Section 4). Moreover, the annotation on the recruiter's social attitude has been used pressions.

for the evaluation of the affective model to check that it produces outputs that correspond to the human behaviour (Section 6). In addition to these videos, post-hoc interviews with the recruiters were used to elicit knowledge about the expectations and mental states during the interview, following the methodology proposed by [START_REF] Porayska-Pomsta | Knowledge elicitation methods for affect modelling in education[END_REF]. This knowledge was used in the affective module to select the relevant social attitudes and to set up the rules to give the capability to the virtual agent to select the appropriate social attitude to express.

Reasoning on social attitudes

The Affective Module is based on a set of rules that compute categories of emotions, moods and attitudes for the virtual recruiter, based on the contextual information given by the scenario and the detected affects (emotions, moods and attitudes) of the participant (Section 3). The computation of the virtual agent's emotions is based on the OCC model [START_REF] Ortony | The Cognitive Structure of Emotions[END_REF] and the computation of the agent's moods in the PAD space [START_REF] Mehrabian | Pleasure-arousal-dominance: A general framework for describing and measuring individual Differences in Temperament[END_REF] is based on the ALMA model [START_REF] Gebhard | ALMA -A Layered Model of Affect[END_REF]. The personality is representy by a vector in the OCEAN space [START_REF] Costa | Revised NEO Personality Inventory (NEO PI-R) and NEO Five-Factor Inventory (NEO FFI): Professional Manual[END_REF]. The details of the computation of emotions and moods will not be presented in this paper; it can be found in [START_REF] Jones | TARDIS -A simulation platform with an affective virtual recruiter for job interviews[END_REF].

Virtual recruiter's social attitudes

Several research has shown that one's social attitude is influenced by one's affective state (e.g. his emotions and moods [START_REF] Joseph | The influence of mood on perceptions of social interactions[END_REF]) and the course of the interaction (e.g. the affective reaction of the other [START_REF] Wegener | Effects of mood on high elaboration attitude change: The mediating role of likelihood judgments[END_REF]). For instance in [START_REF] Wegener | Effects of mood on high elaboration attitude change: The mediating role of likelihood judgments[END_REF], Wegener et al. show that a positive mood can help influence a change of attitude in the interlocutor, and that people tend to feel a higher likelyhood toward interlocutors that are in a positive mood. Relations between attitudes and personality and moods and attitudes [START_REF] Wegener | Effects of mood on high elaboration attitude change: The mediating role of likelihood judgments[END_REF] has been exhibit in literature. Although we cannot give all the details of these papers here, their results show that one's mood has an influence not only on the interlocutor's attitude, but also on one's own reaction to events. This knowledge has been turned into expert rules that compute values for the attitude of the virtual agent.

Computation of attitudes. The way we compute attitudes follow this principle: an agent can adopt an attitude according to its personality [START_REF] Snyder | The influence of individuals on situations: Implications for understanding the links between personality and social behavior[END_REF] and to its actual mood [START_REF] Wegener | Effects of mood on high elaboration attitude change: The mediating role of likelihood judgments[END_REF]. For example, an agent with a nonaggressive personality may still show an aggressive attitude if its mood becomes very hostile. The mood compensates the personality and vice versa. For this reason, we use a logical-OR as condition on these two dimensions. As a consequence, in our model, the attitude can be triggered by one of these two dimensions. Then, the maximum value (mood or personality) is kept to compute the corresponding attitude, as is classically done in Fuzzy logics. We also use a threshold θ to define the minimum value for a trait to have an influence on the attitude. As an example, the definition of the attitude "friendly" is based on Agreeableness (as was shown by Costa [START_REF] Costa | Revised NEO Personality Inventory (NEO PI-R) and NEO Five-Factor Inventory (NEO FFI): Professional Manual[END_REF]) and positive and arroused moods (as proposed by Isbister [START_REF] Isbister | Better Game Characters by Design: A Psychological Approach[END_REF]), i.e. exhuberance in the PAD space:

If (Pa > θ) ∨ (Mp > θ ∧ Ma > θ), then: val(f riendly) = max( Mp + Ma 2 , Pa)
with P a the value of the Agreeable personality trait in the OCEAN model, M p and M a the values of pleasure and arrousal in the PAD space.

Using similar rules, we compute 7 categories of attitudes: friendly, aggressive, dominant, supportive, inattentive, attentive and gossip. Details on that computation can be found in [START_REF] Sabouret | Expressing social attitudes in virtual agents for social training games[END_REF].

Interpersonal circumplex

The non-verbal behaviour model of our agent, presented in the next section, does not work directly with the categories that were identified in the Knowledge elicitation phase of the corpus collection. It makes use of continuous values that relies on the annotation of corpus which uses the Friendly and Dominant dimensions of the interpersonal circumplex [START_REF] Isbister | Better Game Characters by Design: A Psychological Approach[END_REF]. For example, the aggressive attitude is defined on the circumplex as a vector (-0, 5, 0, 5) (friendly at -0.5 and dominant at 0.5).

To convert the attitudes represented by categories into continuous values of dimensions, we rely on the work by Isbister [START_REF] Isbister | Better Game Characters by Design: A Psychological Approach[END_REF].When several attitudes are triggered at the same time, we compute the global attitude (that is the attitude that emerges) as the average of the associated vectors of these attitudes. The vectors' magnitudes influence this average giving more importance to an attitude with a large magnitude (i.e. intensity)).

For n attitudes a i ∈ a 1 , ..., a n :

-----→ attitude = 1 n i=1...n - → a i
with a i the attitudes in the circumplex.

Evaluation of the affective model

To evaluate the affective module, we compare the affects that are computed from the affective module with the manual annotation of emotions from the job interview corpus. To perform such an evaluation, we chose arbitrarily one video of this corpus. The affective states of the interviewee and the social attitudes of the recruiter have been manually annotated. Our evaluation consists in comparing if, given the affective states of the interviewee, the affective module computes social attitudes for the recruiter that are identical (i.e. similar in terms of dimensions representation) as the manually annotated social attitude of the recruiter in the video.

The interview in the selected video is composed of 8 speaker turns. In the first 4 questions/answers turns, the interviewee is confident and gives good answers to the recruiter (positive detected affects). The interviewer expectations has been annotated positively during this first sequence. Then, the 4 following questions appear more difficult for the interviewee; he shows expression of negative affects. On the other hand, expectations of the recruiter were annotated positive for questions 5 and 6 and negative for questions 7 and 8. Fig. 2 shows the recruiter affects. Fig. 2(up) shows the output for the recruiter's affects after each of its question. We can notice that positive affects (triangles) are positively correlated with supportive attitude while negative affects (squares) are positively correlated with aggressive attitude. Fig. 2(bottom) displays the annotated social attitudes of the recruiter as it evolves during the interaction. Positive values mean that the recruiter is perceived supportive by the user while negative values as aggressive. We also indicate where the 8 questions happen in the course of the interaction.

Comparing both data, the outputs of the affective module and the manual annotation, we can remark that the results are not really comparable in term of intensity of social attitudes. However the attitudes computed by the affective module coincide with the manually annotated attitudes. The variation of attitudes from supportive to aggressive happens in both cases. This example shows that our affective module computes, for a given input (the affect states of the interviewee), similar attitudes for the recruiter of those that are perceived in real human-human job interview.

Expression of attitudes

Research has shown that interpersonal attitude are conveyed through non-verbal behaviours (see Section 1). However it is insufficient to look at signals independently of the other surrounding signals: a smile is a sign of friendliness, but a smile preceded by head and gaze aversion conveys submissiveness [START_REF] Keltner | Signs of appeasement: Evidence for the distinct displays of embarrassment, amusement, and shame[END_REF]. In our work, to give the capability to a virtual agent to convey attitudes, we choose a corpus-based approach to find how attitudes are expressed through signal sequences.

We then use this knowledge to generate new sequences of non-verbal behavior for animating our ECA. In the following section, we present an algorithm that extract sequences of non-verbal signal.

Frequent sequences extraction

In order to extract significant sequences of non-verbal signals conveying interpersonal attitudes from our corpus, we used a sequence mining technique. Using the attitude annotation files described in section 3, we segmented our corpus in time intervals preced- ing attitude variations. With a clustering technique, we regrouped together these attitude variations, such as small (resp. large) increases (resp. decreases) of friendliness (resp. dominance). The next step consisted of applying the Generalized Sequence Pattern (GSP) frequent sequence mining algorithm described in [START_REF] Srikant | Mining sequential patterns: Generalizations and performance improvements[END_REF]. This nets us a set of frequent sequences for each type of attitude variation, we can characterize each of these sequences with several quality measures: Support, i.e. how many times the sequence appears in the data ([0; ∞] ∈ N) ; Confidence, i.e. the proportion of a sequence's occurrences happening before one type of attitude variation ([0; 1] ∈ R). Keeping sequences with a support of at least 10, we extracted a set of 879 sequences for dominance variations and 329 for friendliness variations. For instance, the HeadN od → Smile sequence was found frequently before large friendliness increases (Support = 32, Conf idence = 0.59).

In the following section, we describe the algorithm for generating non-verbal signals sequences conveying attitudes.

Sequence generation

Given an input attitude that an ECA should express and an input utterance tagged with communicative intentions defined in the Functional Markup Language (FML) [START_REF] Mancini | The FML -APML language[END_REF], the objective of our model is to generate a sequence of non-verbal signals that conveys the appropriate attitude. Our algorithm follows three steps: Selecting the final sequence -For selecting the final sequence, we defined a score variable of a candidate sequence s as Sc(s) = P (s) * Conf (s), where P (s) is the probability of s computed by the appropriate Bayesian Network (BN for dominance or friendliness depending on the input attitude), and Conf (s) is equal to the sequence's confidence. The sequence with the highest score Sc is selected. In the next section, we present an study we realized to evaluate our model.

Evaluation

We evaluated our model with an online study realized using Adobe Flash technology. Participants were asked to compare 8 pairs of videos of a virtual character acting as a job recruiter expressing non-verbal signals when speaking (see Figure 3). For every pair of videos, the virtual recruiter said a different job interview question of the scenario . The character's speech was identical in both videos, however, the nonverbal behavior of the recruiter was different. The left video was generated with Greta's existing Behavior Planner, which does not consider attitudes and therefore considered neutral, while the right video was generated with our model with one of the 8 following attitudes high dominance, low dominance, high low submissiveness, high submissiveness, high friendliness, low friendliness, low hostility, high hostility. For every pair of videos, the participants answered were asked (Q1 ) how the right video compared to the left in terms of attitude (e.g. much more dominant) and how they would rate the attitude's intensity (Q2 ). Eighty-one participants took part in our study. The results of the study validate partially our model: the results of Q1 showed that the expression of dominance, friendliness and hostility were recognized, however submissiveness was not recognized. All four results were statistically significant. For Q2, the only significant difference was found between intensity of large and small decreases in friendliness, however the participants identified large decreases as small decreases, and vice-versa. Therefore, it seems that our model cannot simulate attitudes of different intensities.

Concluding remarks

This paper proposes a new architecture for expressive agents that can reason about and display social behaviours. Unlike classical reactive models, our approach combines an affective reasoner that generates affects for the virtual character with a sequence selection mechanism based on a domain corpus annotated on two dimensions: dominance and friendliness. The methodology we propose contains several stages, from corpus collection and annotation, knowledge elicitation with experts for the definition of rules, implementation of behaviours corresponding to sequences and sequence selection based on the generated internal affects. This architecture, whose components have been tested separately, has been integrated using the SEMAINE platform [START_REF] Schröder | Building autonomous sensitive artificial listeners[END_REF] and is currently being tested with real users. This will allow us to validate the global behaviour of our platform in the context of social coaching. However, several components can still be improved. One first limit of our model is that we assume exact inputs from the perception module. In addition, we intend to provide the affective reasoner with a representation of the interaction from the recruiter's point of view. We believe that allowing the recruiter to reason about the actual and potential behaviour of the applicant, following a Theory of Mind paradigm, will allow a more credible decision process. We will also take the sequence extraction procedure further to take into account the user's non-verbal signals. This will require the sequence selection model to plan for and react to user signals.

Figure 1 :

 1 Figure 1: General architecture

Figure 2 :

 2 Figure 2: Computed recruiter affects after each question (up). Annotated recruiter state in real time (bottom)

Figure 3 :

 3 Figure 3: The main screen of the online study.

  Building minimal sequences -In a conversation, communicative intentions can be expressed through non-verbal behavior as well as through speech. For instance, in Western culture, it is possible to convey uncertainty by performing a particular hesitation gesture. We specified behavior sets for every possible input communicative intention, i.e. the different nonverbal signals that can be displayed by an ECA to express the intention. The first step in our algorithm builds non-verbal signals sequences expressing an input message by selecting one signal in the behavior set of each communicative intention of the input message. Such a resulting sequence is called a minimal sequence. Generating candidate sequences -For each minimal sequence obtained in the previous step, we retrieve all the time intervals where it is possible to insert other signals. For instance, if there is enough time between two head signals, we might insert a head nod or a head shake. For this purpose, we represent the extracted frequent sequences (Section 5.1) with a Bayesian Network (BN). This enables us to represent the causal and non deterministic relation of the attitudes on the signals (e.g. there might be more smiles for friendliness increases) and the sequences of signals (e.g. hands rest pose changes appear after gestures). An interesting feature of this model is that non-verbal signals sequences that did not occur in our data can still be generated, and their likelihood can be evaluated. Starting with the minimal sequences obtained after the previous step, we use the BN to add new signals in the available intervals, pruning out sequences that are too unlikely. The remaining sequences are called candidate sequences.

In our work, we use the SSI framework that recognizes the user's emotions expressed through his voice and his facial ex-


Bonan Cuan
email: bonan.cuan@insa-lyon.fr

Aliénor Damien
email: alienor.damien@laas.fr

Claire Delaplace
email: claire.delaplace@irisa.fr

Mathieu Valois
email: mathieu.valois@unicaen.fr

Malware Detection in PDF Files Using Machine Learning

Keywords: Malicious PDF detection, SVM, Evasion attacks, Gradient-Descent, Feature Selections, Adversarial Learning

We present how we used machine learning techniques to detect malicious behaviours in PDF files. At this aim, we first set up a SVM (Support Machine Vector) classifier that was able to detect 99.7% of malware. However, this classifier was easy to lure with malicious PDF files, which we forged to make them look like clean ones. For instance, we implemented a gradient-descent attack to evade this SVM. This attack was almost 100% successful. Next, we provided counter-measures to this attack: a more elaborated features selection and the use of a threshold allowed us to stop up to 99.99% of this attack. Finally, using adversarial learning techniques, we were able to prevent gradient-descent attacks by iteratively feeding the SVM with malicious forged PDF files. We found that after 3 iterations, every gradient-descent forged PDF file were detected, completely preventing the attack.

INTRODUCTION

Billions of Portable Document Format (PDF) files are available on the web. Not all of them are as harmless as one may think. In fact, PDF files may contain various objects, such as JavaScript code or binary code. Sometimes, these objects may be malicious. A malware may try to exploit a flaw in a reader in order to infect the machine.

In 2017, sixty-height vulnerabilities were discovered in Adobe Acrobat Reader (CVEDetails, 2017). More than fifty of them may be exploited to run arbitrary code. Every reader has its own vulnerabilities, and a malicious PDF file may find ways to make use of them.

In this context, several works propose the use machine learning to detect malicious PDF files, (e.g. [START_REF] Kittilsen | Detecting malicious pdf documents[END_REF][START_REF] Maiorca | A Pattern Recognition System for Malicious PDF Files Detection[END_REF][START_REF] Borg | Real time detection and analysis of pdffiles[END_REF][START_REF] Torres | Malicious pdf documents detection using machine learning techniques[END_REF]). These works rely on the same main idea: select discriminating features (i.e. features that are more likely to appear in malicious PDF files) and build what is called a classifier. For a given PDF file, this classifier will take as input the selected features and, considering the number of occurrences of each of them, will try to deter-mine if the PDF file contains malware or not. Many approaches may be considered, both for the choice of the features and for the design of the classifier. In fact there are many classification algorithms that can be utilised: Naive Bayes, Decision Tree, Random Forest, SVM... The authors of [START_REF] Maiorca | A Pattern Recognition System for Malicious PDF Files Detection[END_REF] first describe their own way to select features, and use a Random Forest algorithm in their classifier, while the author of [START_REF] Borg | Real time detection and analysis of pdffiles[END_REF] relies on the choice of features proposed by Didier Steven [START_REF] Stevens | Didier stevens blog[END_REF], and uses a SVM (Support Vector Machine) classifier. Both approaches seem to provide accurate results. However, it is still possible to bypass such detection algorithms. Several attacks have been proposed (e.g. [START_REF] Ateniese | Hacking smart machines with smarter ones: How to extract meaningful data from machine learning classifiers[END_REF][START_REF] Biggio | Evasion Attacks against Machine Learning at Test Time[END_REF]). In [START_REF] Biggio | Evasion Attacks against Machine Learning at Test Time[END_REF], the authors propose to evade SVM and Neural Network classifiers using gradientdescent algorithms. Meanwhile, the authors of [START_REF] Ateniese | Hacking smart machines with smarter ones: How to extract meaningful data from machine learning classifiers[END_REF] explain how to learn information about the training dataset used by a given target classifier. To do so, they build a meta-classifier, and train it with a set of classifiers that are themselves trained with various datasets. These datasets have different properties. Once their meta-classifier is trained, they run it on the classifier they aim to attack. Doing so, their goal is to detect interesting properties in the training dataset utilised by this classifier. Hopefully they can take advantage of this knowledge to attack said classifier.

We worked on three aspects of malware detection in PDF files.

First we implemented our own PDF file classifier, using SVM algorithm, as it provides good results. We explored different possibilities for features selection: our initial choice was based on [START_REF] Stevens | Didier stevens blog[END_REF] selection. We refined this choice the following way: from the set of available features, we selected those which appeared to be the most discriminating in our case. We trained and tested our SVM with a dataset of 10 000 clean and 10 000 malicious PDF files from the Contagio database [START_REF] Dump | Contagio: Malware dump[END_REF], and we also tuned the SVM to study its behavior. We came up with a classifier that had more than 99% success rate.

In the second part of our work, we study evasion techniques against our classifier: how to edit malicious PDF files such that they are not detected by our classifier. One first naive attack consists in highly increasing the number of occurrences of one arbitrary feature but can be easily countered using a threshold. A more interesting one is the gradient-descent attack. We implemented this attack following the description of [START_REF] Ateniese | Hacking smart machines with smarter ones: How to extract meaningful data from machine learning classifiers[END_REF].

Finally, we propose ways to prevent this attack. Our first intuition is to set up a threshold value for each feature. We also present a smarter features selection to make our SVM more resistant against gradientdescent attacks. Finally we suggest updating our SVM using adversarial learning. We tested these counter-measures and they allowed us to stop almost all gradient-descent attacks.

MALWARE CLASSIFIER

In this section, we present the technical tools for PDF file analysis, machine learning, and the different settings we used in our methodology. Then we present the first results for that classifier using different optimization approaches.

Useful Tools

We first recall the structure of a PDF file, and explain how this knowledge can help us to detect malware. PDF file Analysis. A PDF file is composed of objects which are identified by one or several tags. These tags stand for features that characterise the file. There are several tools made to analyse PDF files. In this work, [START_REF] Stevens | Didier stevens blog[END_REF]. Stevens also selected a list of 21 features that are commonly found in malicious files. For instance the feature /JS indicates that a PDF file contains JavaScript and /OpenAction indicates that an automatic action is to be performed. It is quite suspicious to find these features in a file, and sometimes, it can be a sign of malicious behaviour. PDFiD essentially scans through a PDF file, and counts the number of occurrences of each of these 21 features. It can also be utilised to count the number of occurrences of every features (not only the 21) that characterise a file.

Figure 1 shows an output example of PDFiD. For each feature, the corresponding tag is given on the first column, and the number of occurrences on the second one.

We can represent these features by what we call a feature vector. Each coordinate represents the number of occurrences of a given feature. Supervised Learning and PDF file Classification. Machine Learning is a common technique to determine whether a PDF file may or may not contain malware. We consider a classifier function class that maps a feature vector to a label whose value is 1 if the file is considered as clean and -1 otherwise. To infer the class function, we used what is called Supervised Learning techniques.

We considered a dataset of 10 000 clean PDF files and 10 000 containing malware from the Contagio database [START_REF] Dump | Contagio: Malware dump[END_REF]. By knowing which files are clean, and which are not, we were able to label them. We then split our dataset into two parts. The first part has been used as a training dataset. In other words, for every feature vector x of every file in the dataset, we set class(x) to 1 if the PDF file was clean and x = -1 if it contains malware. We used a classification algorithm to infer the class function using this knowledge. The second part of our dataset was then used to test if the predictions of our classifier were correct.

Usually, between 60% and 80% of the dataset is used for training. Bellow 60%, the training set may be to small, and the classifier will have poor performances when trying to infer class. On the other hand, if more than 80% of the dataset is used for training, the risk of overfitting the SVM increases. Overfitting is a phenomena which happens when a classifier learns noise and details specific to the training set. Furthermore, if one uses more than 80% of the dataset for training, one will have to test the classifier with less than 20% of the data, which may not be enough to provide representative results. For these reasons, we first chose to use 60% of our dataset for training, and saw how the success rate of our classifier evolved when we increased the size of the training set up to 80%.

We used a Support Vector Machine algorithm (SVM) as the classification algorithm. Basically this algorithm considers one scatterplot per label, and finds a hyperplan (or a set of hyperplans when more than two labels are considered) to delimit them. Usually, it is unlikely that the considered set is linearly separable. For this reason, we consider the problem in a higher-dimensional space that will hopefully make the separation easier. Furthermore, we want the dotproduct in this space to be easily computed, with respect to the coordinates of the vectors of the original space. We define this new dot-product in term of the kernel function k(x, y), where x and y are two vectors of the original space. This well known trick is due to [START_REF] Aizerman | Theoretical foundations of the potential func-tion method in pattern recognition learning[END_REF] and was first applied to a SVM in [START_REF] Boser | A training algorithm for optimal margin classifiers[END_REF]. It allows us to work in a higher dimensional space, without having to compute the coordinates of our vectors in this space, but only with dot-products, which is computationally less costly.

We denote by n f eatures the number of features we consider (i.e. the size of our vector), and we choose to use a Gaussian Radial Basis Function (RBF) kernel:

k(x, y) = exp(-γ • ||x -y|| 2 ), with parameter γ = 1/n f eatures .

Experimentations

We implemented our classifier in Python, using the Scikit-learn package. We initially used PDFiD with the 21 default features to create our vectors. Then, we trained our SVM on 60% of our shuffled dataset. We used the remaining 40% data to test our SVM and calculate its accuracy: the ratio (number of well classified PDF files)/(total number of PDF files). After having split our dataset, we obtained an accuracy of 99.60%. Out of 2 622 PDF files containing malware, only 29 have been detected as clean (1.11%). Out of 5 465 clean files, only 3 were considered containing malware (0.05%). To compare with related work, the SVM used in [START_REF] Kittilsen | Detecting malicious pdf documents[END_REF] has a success rate of 99.56%, out of 7 454 clean PDF files, 18 were detected as containing malware. Out of 16 280 files containing malware, 103 were detected as clean. Using different settings. To go further in our experimentations, we slightly modify our SVM. For instance, we tested other values of the gamma parameter in the RBF kernel. We also tested the other kernels proposed by Scikit-learn package. We figured out that using the RBF kernel with default γ = 1/n f eatures parameter yields to the best results, considering all the settings we tried. Change splitting ratio. We changed how we split the initial dataset into training and testing sets. We saw that if 80% of our dataset is used for training and 20% for testing, then the success rate was slightly higher. We also used cross-validation: we restarted our training/testing process several times with different training sets and testing sets, and combined the results we obtained. We did not notice any overfitting issue (i.e. our SVM does not seem to be affected by the noise of the training set). Change the default features. Instead of choosing the default 21 features proposed by Didier Stevens [START_REF] Stevens | Didier stevens blog[END_REF], we tried other features selections. In the whole set, we found more than 100 000 different tag types. Considering that it requires 12Gb of memory to compute the vectors of each PDF file in a SVM, using 100 000 tags would be too much. A first strategy implemented was to select features by their frequency in the files (e.g. "90% frequency" means that 90% of the files in the dataset have this feature). In one hand, we chose the most common features in the clean PDF files, in the other, we chose the most frequently used features in the malicious files, and combine them into a sublist of features. Once this selection was made, the resulting list could be merged with the 21 default features. A second strategy, that we call better sublist selection, was to remove nonsignificant features from the first sublist, by removing features one by one and computing the SVM (with cross-validation) to check if accuracy improved or deteriorated. Note that these two strategies can be combined together. In practice, we selected initial sublist : from 21 default features and/or frequency selection and apply the better sublist selection. Table 1 shows some results found by applying these two strategies, regarding the original result. Frequency (80%) 99,64% 10 15,89s + default features + Sublist method did not improve the accuracy of our SVM, and increased significantly the number of features, making the training and testing of the SVM much slower. Applying the better sublist selection method improved the SVM's accuracy significantly and kept a reasonable amount of features. We also saw that applying the better sublist selection method to the 21 default features, improved the accuracy (+0.25%). The resulting set contains only 11 features, significantly reducing the time to train and test the SVM.

Results. The application of the frequency selection

EVASION ATTACKS

In this section, we propose some evasion attacks to trick the trained SVM. The main goal of these attacks is to increase the amount of objects in the infected PDF files so that the SVM considers them as clean. To this end, the modifications performed on the files should not be noticeable by the naked eye. Removing objects is a risky practice that may, in some cases, change the display of the file. On the other hand, adding empty objects seems to be the easiest way to modify a PDF file, without changing its physical appearance.

We consider a white box adversary. In this model, the adversary has access to everything the defender has, namely: the training dataset used to train the classifier, the classifier algorithm (here SVM), the classifier parameters (kernel, used features for vector, threshold, ...), and infected PDF files that are detected by the classifier This attacker is the most powerful one, since she knows everything about the scheme she's attacking. Naive attack. The first implemented attack to lure the classifier is the component brutal raise. Given the feature vector of a PDF file, the attacker picks one feature and increments it until the vector is considered as clean by the classifier. The choice of the feature is either done arbitrarily or with the same process as feature selection in section 2.2.

A quick counter-measure that can be applied is to ignore the surplus number of features when this number is too high, and consider it as the maximum permitted value. To implement this idea, we used a threshold value. A threshold is a value that is considered as the maximum value a feature can take. For example, if the threshold is 5, the original feature vector x = (15, 10, 2, 3, 9, 1) would be cropped to become the vector x = (5, 5, 2, 3, 5, 1).

We experimented this naive attack with the default features from PDFiD, and figured out that, if we set up a threshold of 1, this naive attack is completely blocked. Gradient-Descent. The gradient-descent is a widely used algorithm in machine learning to analytically find the minimum of a given function. Among its various applications, we were particularly interested in how it can be utilised to attack SVM classifiers. Given a PDF file of feature vector x, that contains malware and has been correctly classified, the goal is to find a vector x on the other side of the hyperplan, so that the difference between x and x is the smallest possible. Usually, to quantify this difference, the L 1 distance is utilised. In other words, given a feature vector x such that class(x) = -1, we aim to find a vector x such that class(x ) = 1 and

||x -x || 1 = ∑ i |x i -x i |,
is minimized. The gradient-descent algorithm tries to converge to this minimum using a step-by-step approach: first, initialise x 0 to x, then at each step t > 0, x t is computed to be equal to:

x t = x t-1 -ε t • ∇class(x t-1 ),
with ε t a well chosen step size and ∇class(x t-1 ) is the gradient of the class at point x t-1 . The iteration terminates when class(x t ) is equal to 1.

An illustration of the result of this attack is shown on Figure 2 where features 1 and 2 are slightly increased to cross the hyperplan. This attack does not consider components individually but as a whole, allowing the algorithm to find a shorter difference vector than with the naive attack. Hence the L 1 distance between the crafted and the original vector is significantly lower than with the naive attack, it results in a crafted PDF file that has been way less modified.

Using this attack we conducted two experiments: the first was to compute its theoretical success rate and the second its success rate in practice. Theoretical success rate: to compute the theoretical success rate, we took the feature vector of every infected file and ran the gradient-descent to get the feature vector that lures the classifier. By this experiment, we found that 100% of the forged vectors are detected as clean by the classifier (namely every gradient-descent succeeded).

Practical success rate: to compute the practical success rate of the attack, we ran the gradient-descent on the vectors of every PDF files and then reconstructed new file according to the crafted feature vector.

Remark: If we denote by m the number of selected features considered by the SVM, the gradient-descent computes a vector x ∈ R m , however only an integer number of objects can be added to the PDF file, thus a rounding operation is needed in practice. For this attack we rounded component values to the nearest integer (the even one when tied).

Due to the rounding operation, this practical attack had a 97.5% success rate instead of a 100% theoretical success rate. In previous work [START_REF] Biggio | Evasion Attacks against Machine Learning at Test Time[END_REF], the success rate was about the same, even if they made a deeper analysis of it using various settings of their SVM.

COUNTER-MEASURES

The gradient-descent attack has an impressively high success rate. This is due to the huge degree of freedom the algorithm has. Every component of the vector can be increased as much as required.

Hence, to counter the gradient-descent attack, one would reduce the degree of freedom of the algorithm. This can be achieved in three different ways: applying a threshold, smartly selecting features that are the hardest to exploit, and finally a mix of both solutions.

Another approach to counter this attack is to restart the training of the SVM with maliciously forged files: it is called adversarial learning.

Vector Component Threshold

Once again, the threshold is defined by t ∈ N * due to the discreteness of the number of PDF file objects. To choose t, we have used algorithm 1. We considered a SVM with the 21 default features of PDFiD.

Algorithm 1 Calculate the best threshold to block as many attacks as possible t ← 20 s(20) ← success rate of gradient-descent with t = 20 while t > 0 do apply t on each forged feature vector x compute success rate s(t) of gradient-descent if s(t) > s(t + 1) then return t + 1 end if t ← t -1 end while return t Algorithm 1 decreases the threshold until a local minimum success rate of the gradient is found (namely when most attacks are blocked).

Remark: Algorithm 1 assumes that the function s(t) is continuous. Hence, by the intermediate value theorem, algorithm 1 can converge. Moreover, we only retrieve a local minimum, not a global one. Despite these imprecisions, our counter-measure is rather efficient in practice (cf. Table 2).

All in all, a threshold of 1 allows the SVM to block almost every attack while keeping a reasonably good accuracy (the difference between no threshold and a threshold of 1 is about 0,10%).

We also applied a threshold of 1 on a SVM constructed from different lists of features (see section 2.2). The corresponding results are presented in Table 3. Results Threshold usage allows to keep a very good accuracy while reducing the success rate of gradientdescent attack, but this reduction is not optimal and depends a lot on the features list utilised in the SVM.

Features Selection -Prevent Gradient-Descent

Because the gradient-descent attack uses some vulnerable features, another idea of counter-measure is to select only features that are less vulnerable to this attack. As shown by Figure 3, we selected the features that an adversary has no interest in modifying, in order to make a malicious file pose as a clean one.

In other words, increasing the number of occurence of these features will never allow the gradient-descent to get closer to the hyperplan we aim to cross. To detect the vulnerable features from a list, we used algorithm 2. This algorithm computes a SVM with the current feature list and performs the gradientdescent attack on it. At each iteration, the features used by the gradient-descent attack are removed from the current feature list. The algorithm stops when the feature list is stable (or empty).

Algorithm 2 Find the features vulnerable to Gradient-Descent attack and remove them f eatures list ← initial list GD f eatures used ← initial list while GD f eatures used = ⊥ do compute SVM for f eatures list apply gradient-descent attack to current SVM GD f eatures used ← features used by gradientdescent Attack f eatures list.remove(GD f eatures used) end while return f eatures list Global features selection. To select the final list of features, the following steps are applied: We selected the initial sublist : from 21 default features and or frequency selection (see 2.2), apply the better sublist selection (see 2.2), apply gradient-descent resistant selection (Algorithm 2), apply Better Sublist selection (see 2.2) We used different parameters here (frequency, force 21 default features or not), and the corresponding results are presented in Table 4.

Remark: accuracy is not taking into account the forged file, only the initial dataset of 10 000 clean and 10 000 malicious PDF files. Results. This features selection method drastically reduces the number of features (between 1 and 3, except without application of the better selection method first), resulting in very bad accuracy results. The application of the global method on the 95% frequently used features + 21 default features only gives quite good results (98,22% of accuracy), but it is far less from the initial SVM. Combination of Threshold & Features selection counter-measures. The threshold counter-measure previously proposed, significantly reduces the attacks whilst keepingg very good accuracy, but was not sufficient to block every gradient-descent attacks. The features selection counter-measure stopped all gradientdescent attacks, but significantly reduced accuracy and had very different results depending on the initial features list. Hence, we tried to combined both counter-measures to obtain both good accuracy and total blocking of gradient-descent attack. Table 5 presents the results obtained by applying both of these Results. We obtained in each case a 100% theoretical resistance of gradient-descent, but only the initial features sets including the default 21 features (and with or without the frequency-selected features) had good accuracy (more than 99%).

Practical results. Table 6 summarizes the best results obtained by applying each counter-measure. The conclusion we can make is that the best compromise between accuracy and attack prevention is when both the threshold and the gradient-descent resistant tures selection are applied. In this case, we are able to prevent 99,99% of gradient-descent attacks while conserving a reasonably good accuracy of 99,22%.

Adversarial Learning

One of the major drawbacks concerning the supervised learning that we used so far is that the SVM is only trained once. The decision is then always the same and the classifier does not learn from its mistakes.

The Adversarial Learning solves this issue by allowing the expert to feed the SVM again with vectors it wrongly classified. Hence, the classifier will learn step-by-step the unexplored regions that are used by the attacks to bypass the SVM. Algorithm 3 describes how we iteratively fed our SVM to implement the adversarial learning. Note that we used the 21 default features from PDFiD.

The results of this counter-measure are presented in Table 7. With n = 10 we found that 3 rounds are enough for the SVM to completely stop the gradientdescent attack. Furthermore, at each round, we see that the gradient-descent algorithm requires more and more steps to finally converge, and thus the attack becomes more and more costly. The Support Vectors column represents the number of support vectors the SVM has constructed. The accuracy represents the number of correct classifications of the SVM. One interesting fact using this counter-measure is that the Algorithm 3 Adversarial learning n ← number of PDF files to give to c at each iteration c ← trained SVM s 0 ← success rate of gradient-descent s 1 ← -1 while s 0 = s 1 do s 0 ← s 1 feed c with n gradient-descent-forged files relaunch the learning step of c s 1 ← success rate of gradient-descent end while return c accuracy of the SVM barely changes. Furthermore, we did not need a more elaborated choice of features.

CONCLUSION AND PERSPECTIVES

We implemented a naive SVM, that we easily tricked with a gradient-descent attack. We also implemented counter-measures against this attack: first, we set up a threshold over each considered feature. This alone enabled us to stop almost every gradientdescent attack. Then, we reduced the number of selected features, in order to remove features that were used during the gradient-descent attack. This makes the attack even less practical, at the cost of reducing the accuracy of the SVM. We also proposed another approach to reduce the chances of success of the gradient descent attack, using adversarial learning, by training the SVM with gradient-descent forged PDF files, and re-iterating the process. Our SVM was resistant to gradient-descent attacks after only three iterations of the process.

Obviously more can be said about the topic. For instance, it can be interesting to see what can happen if the adversary does not know the algorithms and fea-

Figure 2 :

 2 Figure 2: Example of attack using gradient-descent

Figure 3 :

 3 Figure3: Suppression of features vulnerable to gradientdescent attack (Feature 1 is vulnerable here, and Feature 2 is not)

Table 1 :

 1 Results of features selection using: PDFiD default features (D), frequency selection on all features (F), the merge of these two lists (M), and better sublist selection (BS) applied to each of these feature set.

		Features selection	Accuracy	Nb of	Time to
			(cross-validation) features compute SVM
	(D)	Default 21 features	99,43%	21	21,17s
	(F)	Frequency (90%)	99,22%	31	54,49s
	(M)	Frequency (95%)	99,40%	39	47,66s
		+ default features
	(D+BS) Sublist from 21 default features	99,68%	11	7,03s
	(F+BS)	Frequency (80%)	99,63%	13	11,30s
		+ Sublist
	(M+BS)

Table 2 :

 2 Percentage of Gradient-Descent attacks stopped depending on the threshold value

	Threshold Attack prevention Accuracy of SVM
		(theory)
	5	0%	99,55%
	4	0%	99,57%
	3	29%	99,63%
	2	38%	99,74%
	1	99,60%	99.48%

Table 3 :

 3 Features selection global method application results. D means that we used the default features, and F the frequency selection.

	Features set	Attacks Accuracy #features
		stopped
		(theory)
	21 D	99,60%	99,37%	7
	F (80%)	91,00%	99,45%	9
	F (90%)	100,00%	98,00%	30
	F (80%) + D	21,00%	99,61%	17
	F (90%) + D	96,40%	99,46%	29

Table 4 :

 4 Features selection global method application results

	Initial features set	Attack prevention Accuracy Nb of features
		(theory)
	21 default features (GD resistant selection only)	100%	98,03%	6
	21 default features	100%	55,68%	2
	Frequency (80%)	100%	67,64%	1
	Frequency (90%)	100%	95,12%	3
	Frequency (80%) + default features	100%	55,66%	1
	Frequency (90%) + default features	100%	55,79%	3
	Frequency (95%) + default features	100%	98,22%	3
	techniques.

Table 5 :

 5 Features selection global method with threshold application results

	Initial features set	Attack prevention Accuracy Nb of features
		(theory)
	21 default features	100%	99,11%	6
	Frequency (80%)	100%	94,36%	5
	Frequency (90%)	100%	98,00%	30
	Frequency (80%) + default features	100%	98,10%	8
	Frequency (90%) + default features	100%	99,05%	6

Table 6 :

 6 Results of Counter-measures Threshold and Features Selection application

		Attack prevention Accuracy	Nb of features
		(in practice)
	Treshold only	94,00%	99,81%	20
	Features selection only	99,97%	98,05%	2 (/JS and /XFA)
	Threshold + Features selection	99,99%	99,22%	9

Table 7 :

 7 Adversarial learning resultsRound # Support Vectors Accuracy (%) Steps number of GD Success rate of GD (%) tures that have been used in the classifier. We could also perform a gradient-descent attack using other algorithms (e.g. Naive Bayes, Decision Tree, Random Forest) and see how many files thus forged can bypass our SVM. The adversary could also use other types of attacks, like Monte-Carlo Markov Chains (MCMC) techniques. Other attacks may exploit some properties that are inherent in the training set. To avoid them, it may be interesting to have a look at unsupervised learning techniques, and try to identify a malicious behaviour with clustering. We could also use deep learning algorithms like Generative Adversarial Network (GAN), in order to generate a classifier and test its resistance against various attacks.

	0	293	99,70	800	100
	1	308	99,68	1 800	90
	2	312	99,67	3 000	0

ACKNOWLEDGEMENTS

This work has been accomplished during the french working session REDOCS'17. We thank Pascal Lafourcade for his support, as well as Boussad Addad, Olivier Bettan, and Marius Lombard-Platet for having supervised this work.


Jacques Fages

Didier Mathon

Béatrice Poirier

Patrick Frayssinet

André Autefage

Daniel Larzul

Faster osseointegration and viral safety of bone allografts after supercritical co2 extraction

à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

A new bone tissue process using supercritical fluid (SCF) technology has recently been described (Fages et al. 1994).

Due to their unique properties of diffusivity, density and viscosity, supercritical fluids are used as selective extraction solvents. They are particularly adapted for extraction of components entrapped in a solid microporous matrix, which is the case of bone tissue.

Supercritical CO 2 extraction leads to a total range in-depth delipidation of the bone porosity. Three additional steps complete the bone processing: Hydrogen peroxide is used for protein and cellular debris elimination. Sodium hydroxide for the inactivation of potentially present prions, and ethanol for final cleansing and for its well-known virucidal properties. Such treated allografts were implanted in sheep femur condyles and tibial epiphyses in comparison with non-treated allografts. Implantation times were 1, 4 and 8 months.

After one month, treated allografts trabeculae were already linked with those of the recipient bone tissue. At the external surface of the allograft trabeculae, new bone formation could be observed. This immature new bone tissue was edged by several layers of active osteoblasts. Some Howship lacunae were visible indicating an osteoclastic resorption.

Non-treated implants showed no link with the recipient tissue. A thick rich-cell conjunctive tissue was found between the implant and the recipient bone tissue. No sign of new bone apposition could be seen. Implant pores at the outer sides were filled with fibrous tissue containing lymphocytes and plasmocytes. Other pores were filled with necrotic tissue, remnant of the allogenic medullary tissue. A heavy resorption due to plurinucleated cells had begun. These cells had morphology of giant cells and not of osteoclasts.

After 4 months, osteointegration of treated allografts had progressed and was almost completed. Non-treated allografts were resorbed and replaced by a conjunctive tissue harbouring lymphocytes and activated macrophages. A few trabeculae fragments were integrated.

After 8 months treated allografts were completely integrated and the graft could no longer be distinguished. On the contrary, non-treated allografts were almost completely resorbed leaving cellular conjunctive tissue and necrotic zones within pores.

This experiment gives clear confirmation that this allograft treatment brings enhanced integration potential to the graft. A lowering of immunitary reactions linked with the removal of medullary cells and cellular components could be involved as well as an improved graft recolonisation due to the cleansing of the graft porosity. page2

The major concern of bone banking remains the risk of viral disease transmission. HIV-1 transmission by bone allografts has been reported twice while three cases of transmission of the hepatitis C virus by tissue transplantation have been published.

Despite an increasing safety level in bone banking procedures (donor screening, serological testing,...), a small but irreducible risk is always present. Moreover, there is still a large proportion of bone allografts which are just stored frozen. The most used sterilisation processes are: β or γ irradiation, ethylene oxide or autoclaving. None of these methods have proved to be totally satisfactory, either due to the resistance of some viruses to physicochemical processing or due to the loss of inductive or mechanical properties.

One of the principal approaches to control potential viral contamination of biologicals is to test the capacity of the preparation process to remove or inactivate viruses. Each of these four processing stages have been checked for virus inactivation by spiking of a significant amount of a virus to the material and the determination of the virus removal or inactivation during the tested step . Four viruses chosen according to the EC guideline on virus inactivation validation (EC III/8115/89) were used:

HIV-1 (RNA enveloped retrovirus) Sindbis virus (RNA enveloped virus, model for Hepatitis C virus) Polio Sabin virus (RNA non enveloped virus, model for Hepatitis A virus) Pseudorabies virus (DNA enveloped virus as the Hepatitis B virus).

The ability of each studied step to inactivate and/or eliminate the viruses was evaluated from two pieces of human femoral head treated independently. The samples obtained from the bone pieces, spiked and then treated or not were assayed for virus contents by infectivity measurements. The table below summarizes the reduction factors which are the log10 of the ratio of the virus load before and after the treatment. These results clearly indicate that this process is efficient in eliminating or inactivating the tested viruses. It is proposed that this process could become a new way for processing bank bones alternatively or additionally to the procedures presently used.

page1FASTER

  , * D. Mathon, ² B.Poirier, P. Frayssinet, * A. Autefage and ² D. Larzul Bioland, 132 route d'Espagne F-31100 Toulouse, France * ENVT, 23 chemin des Capelles F-31076 Toulouse, France ² Institut Pasteur Texcell, 25 rue du Dr Roux F-75015 Paris, France

th annual meeting of the European Association of Musculo Skeletal Transplantation, Florence, Italy, May 1996