A Lallement

V Vinatier

M Brigante

L Deguillaume

A M Delort
email: marie.delort@uca.fr

G Mailhot
email: gilles.mailhot@uca.fr

FIRST EVALUATION OF THE EFFECT OF MICROORGANISMS ON STEADY STATE HYDROXYL RADICAL CONCENTRATIONS IN ATMOSPHERIC WATERS

Keywords: Cloud water, photochemistry, radical chemistry, oxidative capacity, microorganisms interaction

Clouds are complex multiphasic media where efficient chemical reactions take place and where microorganisms have been found to be metabolically active. Hydroxyl radical is the main oxidant in cloud water, and more generally in the atmosphere, during the day and drives the cloud oxidative capacity. However, only one measurement of the steady state hydroxyl radical concentrations in cloud water has been reported so far. Cloud chemistry models are used to estimate the hydroxyl radical concentrations with values ranging from 10 -12 to 10 -15 M that are surely overestimated due to a lack of knowledge about the speciation of the organic matter acting as a sink for hydroxyl radicals. The aim of this work is to quantify the concentration of hydroxyl radicals at steady state in rain and cloud waters and to measure the impact of native microflora on this concentration. First, the non-toxicity of terephthalic acid as probe is controlled before the analysis in real atmospheric water samples. Higher concentrations of hydroxyl radicals are found in cloud waters than in rain waters, with a mean value "1.6 ± 1.5" × 10 -16 M and "7.2 ± 5.0" × 10 -16 M for rain and cloud waters respectively and no real impact of microorganisms was observed. This method allows the measurement of steady state hydroxyl radical levels at very low concentrations (down to 10 -17 M) and it is biocompatible, fast and easy to handle. It is a useful tool, complementary to other methods, to give a better overview of atmospheric water oxidant capacity.

Introduction

Clouds are multiphasic systems where many chemical reactions occur, particularly in droplets [START_REF] Faust | Photochemistry of clouds, fogs, and aerosols[END_REF][START_REF] Herrmann | Tropospheric aqueous-phase chemistry: kinetics, mechanisms, and its coupling to a changing gas phase[END_REF][START_REF] Lelieveld | The role of clouds in tropospheric photochemistry[END_REF]. Very efficient photochemical processes take place inside droplets and chemical reactions within clouds can be faster than the equivalent reactions in the gas phase. The aqueous phase chemistry leads to oxidation processes that can be driven by reactions with radicals. Among the radicals, hydroxyl radical is the most efficient oxidant in the atmosphere [START_REF] Lelieveld | On the role of hydroxyl radicals in the self-cleansing capacity of the troposphere[END_REF].

Several works were carried out on hydroxyl radical chemistry in cloud to define • OH sources and reactivity [START_REF] Blough | Reactive oxygen species in natural waters[END_REF][START_REF] Chameides | The free radical chemistry of cloud droplets and its impact upon the composition of rain[END_REF][START_REF] Jacob | Chemistry of OH in remote clouds and its role in the production of formic acid and peroxymonosulfate[END_REF][START_REF] Mauldin | New insights on OH: measurements around and in clouds[END_REF]. Main sources of hydroxyl radical are i) hydrogen peroxide, nitrite and nitrate photolysis [START_REF] Yu | Hydrogen peroxide photolysis in acidic aqueous solutions containing chloride ions. I. Chemical mechanism[END_REF][START_REF] Zafiriou | Wavelength-dependent quantum yield of OH radical formation from photolysis of nitrite ion in water[END_REF][START_REF] Zellner | Absolute OH quantum yields in the laser photolysis of nitrate, nitrite and dissolved H 2 0 2 at 308 and 351 nm in the temperature[END_REF][START_REF] Zepp | Nitrate-induced photooxidation of trace organic chemicals in water[END_REF], ii) iron via ligand-to-metal charge-transfer reactions or photo-Fenton chemistry [START_REF] Deguillaume | The role of transition metal ions on HOx radicals in clouds: A numerical evaluation of its impact on multiphase chemistry[END_REF][START_REF] Deguillaume | Impact of radical versus nonradical pathway in the Fenton chemistry on the iron redox cycle in clouds[END_REF][START_REF] Faust | Photolysis of Fe (III)-hydroxy complexes as sources of OH radicals in clouds, fog and rain[END_REF][START_REF] Faust | Photochemistry of aqueous iron (III)-polycarboxylate complexes: Roles in the chemistry of atmospheric and surface waters[END_REF][START_REF] Nakatani | Contribution of the photo-Fenton reaction to hydroxyl radical formation rates in river and rain water samples[END_REF][START_REF] Weschler | Speciation, photosensitivity and reactions of transition metal ions in atmospheric droplets[END_REF], iii) the reaction of ozone towards the superoxide radicals and iv) the mass transfer of • OH from the gas phase to the aqueous phase [START_REF] Arakaki | Sources, sinks, and mechanisms of hydroxyl radical ( • OH) photoproduction and consumption in authentic acidic continental cloud waters from Whiteface Mountain, New York: The role of the Fe(r) (r = II, III) photochemical cycle[END_REF][START_REF] Faust | Aqueous-phase photochemical formation of hydroxyl radical in authentic cloudwaters and fog waters[END_REF]. In terms of • OH sinks, the main way is the reactivity with dissolved organic matter [START_REF] Arakaki | A general scavenging rate constant for reaction of hydroxyl radical with organic carbon in atmospheric waters[END_REF]. However, due to the complexity of this environmental matrix, the organic composition is poorly characterized [START_REF] Herckes | A review of observations of organic matter in fogs and clouds: Origin, processing and fate[END_REF];

for example, only 21% of the organic matter in cloud waters sampled at the puy de Dôme station is characterized [START_REF] Bianco | Improving the characterization of dissolved organic carbon in cloud water: Amino acids and their impact on the oxidant capacity[END_REF]. Furthermore, microorganisms are also present and metabolically active in cloud water. They can survive in spite of numerous stress factors like osmotic shocks, temperature changes and freeze-thaw cycles (Amato et al., 2007a;[START_REF] Joly | Survival of microbial isolates from clouds toward simulated atmospheric stress factors[END_REF]. In order to survive, they use organic matter as a source of carbon such as short chain aldehydes and carboxylic acids (Amato et al., 2007b;[START_REF] Ariya | Microbiological degradation of atmospheric organic compounds[END_REF]Vaïtilingom et al., 2011) but they also have an effect on the oxygenated compounds. As aerobic cells, they are able to consume or either neutralize Reactive Oxygen Species (ROS) like hydroxyl radical, singlet oxygen and hydrogen peroxide. Cloud microorganisms, present in cloud water, have the capacity to degrade hydrogen peroxide and can contribute to the degradation of organic compounds during the day and even more during the night [START_REF] Vaïtilingom | Contribution of microbial activity to carbon chemistry in clouds[END_REF][START_REF] Vaïtilingom | Potential impact of microbial activity on the oxidant capacity and organic carbon budget in clouds[END_REF].

Up to now, the hydroxyl radical concentrations have been estimated using cloud chemistry models. These models consider multiphase chemistry and the mass transfer from the gas to the aqueous phase. Simulated concentrations range from 10 -12 to 10 -15 M [START_REF] Deguillaume | The role of transition metal ions on HOx radicals in clouds: A numerical evaluation of its impact on multiphase chemistry[END_REF][START_REF] Deguillaume | Impact of radical versus nonradical pathway in the Fenton chemistry on the iron redox cycle in clouds[END_REF][START_REF] Herrmann | CAPRAM2.3: A chemical aqueous phase radical mechanism for tropospheric chemistry[END_REF], 2010;[START_REF] Mouchel-Vallon | CLEPS 1.0: A new protocol for cloud aqueous phase oxidation of VOC mechanisms[END_REF][START_REF] Tilgner | Radical-driven carbonyl-to-acid conversion and acid degradation in tropospheric aqueous systems studied by CAPRAM[END_REF][START_REF] Tilgner | Modelling multiphase chemistry in deliquescent aerosols and clouds using CAPRAM3.0i[END_REF] depending on the chemical scenarios and on the complexity of the chemical mechanisms. For example, the amounts of organic matter and iron are key parameters that drive the level of • OH. Moreover, formation rates of hydroxyl radical in irradiated rain or cloud waters are measured in the laboratory [START_REF] Faust | Aqueous-phase photochemical formation of hydroxyl radical in authentic cloudwaters and fog waters[END_REF][START_REF] Nakatani | Contribution of the photo-Fenton reaction to hydroxyl radical formation rates in river and rain water samples[END_REF] and are used to evaluate cloud chemistry models [START_REF] Bianco | A better understanding of hydroxyl radical photochemical sources in cloud waters collected at the puy de Dôme stationexperimental versus modelled formation rates[END_REF]; they express the maximum of • OH concentration formed without taking into account the different scavengers present in cloud water. The steady state hydroxyl radical concentrations have been estimated in different surface waters [START_REF] Arakaki | Photochemical formation and scavenging of hydroxyl radical in rain and dew waters[END_REF][START_REF] Brezonik | Nitrate-induced photolysis in natural waters: Controls on concentrations of hydroxyl radical photo-intermediates by natural scavenging agents[END_REF][START_REF] Haag | Photo-sensitized oxidation in natural water via OH radicals[END_REF][START_REF] Al Housari | Reactive photo-induced species in estuarine waters. Characterization of hydroxyl radical, singlet oxygen and dissolved organic matter triplet state in natural oxidation processes[END_REF][START_REF] Mill | Free-radical oxidants in natural waters[END_REF][START_REF] Qian | Photochemical production of the hydroxyl radical in Antarctic waters[END_REF][START_REF] Russi | Photoinduzierte hydroxylierungsreaktionen organischer chemikalien in natürlichen Gewässern-Nitrate als potentielle OH-radikalquellen[END_REF][START_REF] Zepp | Nitrate-induced photooxidation of trace organic chemicals in water[END_REF][START_REF] Zhou | Determination of photochemically produced hydroxyl radicals in seawater and freshwater[END_REF]) but, to our knowledge, the study of [START_REF] Anastasio | Chemistry of fog waters in California's Central Valley: 1. In situ photoformation of hydroxyl radical and singlet molecular oxygen[END_REF] is the only one on cloud water. In their experiments, they used benzene and benzoic acid as chemical probes at concentrations ranging from 50 to 1500 µM and analyzed reaction products by HPLC. Because the most concentrated species in cloud water are in the µM range, addition of a probe in high concentration can impact the biological activity which is controlled by the environment [START_REF] Metallo | Understanding Metabolic Regulation and Its Influence on Cell Physiology[END_REF][START_REF] Shingler | Integrated Regulation in Response to Aromatic Compounds: From Signal Sensing to Attractive Behaviour[END_REF][START_REF] Tropel | Bacterial Transcriptional Regulators for Degradation Pathways of Aromatic Compounds[END_REF]. Toxicity issues could also arise. Existing methods must then be adapted to study the impact of microorganisms. Moreover to take biological variability into account several experiments must be performed in parallel with strictly identical conditions.

The main goal of our study is to evaluate the stationary concentration of OH radicals in atmospheric waters and the potential impact of microorganisms on this concentration. For that purpose we had to develop a specific method which main characteristics are i) to take into account the native microorganisms, and their viability, ii) the use of small volume of sample (300 µL/well) for one measurement so 6 mL for a complete analysis, and iii) the direct and fast measurement by fluorescence, without chromatography technics.

Experimental section

Chemicals

Terephthalic

Irradiation setup

Lamps used for the irradiation setup are tropical terrarium bulb call Reptile UVB (13 W) from Exo Terra®. The polychromatic emission spectrum of the irradiation system reaching the solution is recorded using an optical fiber with a charge coupled device (CCD) spectrophotometer (Ocean Optics USD 2000 + UV-vis) which is calibrated using a DH-2000-CAL Deuterium Tungsten Halogen reference lamp. The total irradiance in the UV region of solar spectrum (290 and 400 nm) reaching the solution is then estimated to be 915 µW cm-2.

In Fig. 1, the lamp emission is compared with the solar spectrum measured at the puy de Dôme station under cloudy or clear sky conditions.

Sampling and analysis of natural atmospheric waters (cloud and rain)

Rain samples were collected in September 17 Cloud and rain samples are kept in the dark and stored at 4°C before the experimentation.

Chemical composition analyses are performed on cloud and rain samples through pH, total organic carbon (TOC) concentration, iron concentration and ionic species concentrations. The pH is measured before and after experimentation with a pH meter MP 225 (Mettler Toledo).

TOC analyses are performed with TOC 5050A analyzer (Shimatzu). Concentrations of Fe(II)

and Fe(III) are quantified by spectrophotometric assays after complexation with ferrozine (colorimetric complexing agent) as described by [START_REF] Parazols | Speciation and role of iron in cloud droplets at the puy de Dôme station[END_REF]. Ionic species are quantified by ion chromatography with a Dionex DX320 column for anions and a Dionex ICS1500 column for cations. For microbiological characterization, cells are counted by flow cytometry. Cultured microorganisms are grown on R2A medium at 5 and 17°C. ATP is measured with BioThema © ATP Biomass kit HS.

Measurements of hydroxyl radical concentrations in atmospheric waters are performed under irradiation and with filtered or non-filtered samples. Waters are filtered just before filling the plate, thanks to a Minisart® PES filter (pore size of 0.22 µm and filter diameter of 28 mm from Sartorius, Germany) under sterilized conditions.

All the vessels are washed with hydrochloric acid solution (2 M) and rinsed with ultrapure water and then sterilized.

Determination of steady state hydroxyl radical concentrations

The detection of • OH radical is based on the reaction with TA (Fig. 2):

Among the products formed 2-Hydroxyterephthalic acid (TAOH) is detected and quantified due to its strong fluorescence. However, TAOH is not the unique byproduct and could be instable under irradiation (Page et al., 2010). For these reasons, TAOH formation yield (γ TAOH ) was previously described and evaluated as a function of irradiation conditions, temperature and pH by [START_REF] Charbouillot | Performance and selectivity of the terephthalic acid probe for OH as a function of temperature, pH and composition of atmospherically relevant aqueous media[END_REF]. In the same work the second order rate constant between TA and • OH was determined, k TA = "4.1 ± 0.1" × 10 9 M -1 s -1 .

In order to obtain the real steady state concentration of • OH ([ • OH] ss ), with natural organic matter present in cloud sample, we used the formation rate of TAOH (Rf TAOH ) to calculate the steady state hydroxyl radical concentrations as follows:

(1)

So the steady state hydroxyl radical concentration can be calculated as follows:

(2)

To determine the steady state concentration, the linear part of the curve between Rf TAOH and

[TA] is used (Fig. S3). In fact, these conditions represent a low concentration of the probe in order to take into account the impact of all the natural scavengers present in cloud aqueous phase. The slope of the linear part of the equation is then divided by the second-order rate constant between TA and • OH (k TA ) and by the TAOH formation yield (γ TAOH ) as described in equation 2. These experimental conditions enable the determination of the real steady state concentration by taking into account the impact of all the chemical compounds present in the environment. Moreover, the use of TA as probe and the formation of TAOH which is detected by fluorescence spectroscopy, allows for reaching concentrations of

  

For blank determination 8 measures have been performed in the dark. Limit of detection was calculated as mean blank + 3SD blank whereas LOQ was determined as mean blank + 10SD blank .

All the experimental and calculation details are presented in the supplementary data file (Diagram S1, Fig. S1, S2, S3). Note that DMSO is used in order to stop the generation of TAOH during the experiments through light irradiation and/or different chemical processes occurring, thanks to its high reactivity with • OH (k DMSO = 6.6 10 9 M -1 s -1 ) [START_REF] Buxton | Critical review of rate constants for reactions of hydrated electrons, hydrogen atoms and hydroxyl radicals ( • OH/ • O -) in aqueous solution[END_REF]. The addition of 5 µL of DMSO (1 mM) immediately after the sampling does not change significantly the quantification of • OH (Fig. S4).

Finally we tested this protocol to measure OH radical concentrations at the steady state in controlled conditions using a microcosm mimicking cloud water conditions (artificial marine cloud medium, artificial light, H 2 O 2 and Fe-EDDS (ethylenediamine-N,N'-disuccinic acid) complex as a source of radicals). The results are reported in the Supplementary Data (Figures S5 andS6).

Wilcoxon test for paired data statistical analysis are performed on hydroxyl radical concentration values to see significant difference (R software 3.5.0 used with α = 5%).

Measurement of hydrogen peroxide concentration

H 2 O 2 concentrations are measured using an accurate enzymatic fluorimetric assay with a 4hydroxy-phenylacetic acid that produces a fluorescent dimeric compound with hydrogen peroxide. This method is described in detail in the paper of [START_REF] Vaïtilingom | Potential impact of microbial activity on the oxidant capacity and organic carbon budget in clouds[END_REF].

Assessment of the probe non-toxicity

The non-toxicity of TA to microorganisms was evaluated on Pseudomonas graminis 13b-3, DQ512786 isolated from cloud water sampled at the puy de Dôme station. Pseudomonas graminis 13b-3 is incubated in R2A medium at 17°C and 130 rpm. After one day of incubation, 6 mL of the culture are centrifuged for 3 min at 12 500 rpm. Cells pellets are washed with NaCl 0.8% and cloud artificial medium. Optical density (OD) is taken with a spectrophotometer (at λ = 575 nm) to obtain cell concentrations that are equal to 10 6 cells mL - 1 corresponding to concentration 10 times higher than in natural cloud water. Incubations are done in cloud artificial marine media mimic the typical cloud chemical composition deriving from marine influence. The used concentrations are also ten times higher than those reported in natural cloud water, in order to keep the same ratio between cell and organic compound concentrations. In fact, it has been showed that, at constant ratio "cell concentration/degraded chemical compound concentration" and in the range of concentrations investigated, biodegradation rates are independent of the absolute cell and chemical concentrations [START_REF] Vaïtilingom | Atmospheric chemistry of carboxylic acids: Microbial implication versus photochemistry[END_REF]: acetic acid 2.0 × 10 -4 M, formic acid 1.45 × 10 -4 M, oxalic acid

Results

Validation of the non-toxicity of terephthalic acid

In order to see the impact of microorganisms on hydroxyl radical concentration, it is crucial to check the non-toxicity of our probe. Pseudomonas graminis 13b-3 isolated in cloud water at the puy de Dôme station is chosen as a model strain because it is representative of the major actors of the cloud microbiota and on which we had already a lot of information available.

First it belongs to the Pseudomonas genus which is widely present in puy-de-Dôme cloud samples. From cultural experiments we found this genus in 60% of our samples [START_REF] Vaïtilingom | Long-term features of cloud microbiology at the puy de Dôme (France)[END_REF] and metatranscriptomics data showed that Pseudomonas strains are among the most active in cloud waters (Amato et al., 2017). In addition we choose the strain Pseudomonas graminis 13-b3 as a model strain because we already studied its metabolism in [START_REF] Vaïtilingom | Contribution of microbial activity to carbon chemistry in clouds[END_REF][START_REF] Vaïtilingom | Atmospheric chemistry of carboxylic acids: Microbial implication versus photochemistry[END_REF], [START_REF] Husarova | Biotransformation of methanol and formaldehyde by bacteria isolated from clouds. Comparison with radical chemistry[END_REF] and [START_REF] Wirgot | H 2 O 2 modulates the energetic metabolism of the cloud microbiome[END_REF].

This strain is incubated at a concentration of "1.5 ± 0.3" × 10 6 cells.mL -1 with 3 different probe concentrations (0, 4 and 10 µM) in "artificial marine" cloud medium. The evolutions of cell counts and of ATP concentrations as a function of time are presented in Fig. 3.

Whatever the TA concentration, the number of bacteria remains within the same order of magnitude and so no impact of probe concentration is detectable. Similarly, no major change in ATP concentrations is observed with time under all the tested conditions, ranging from 1.6 to 2.6 × 10 -6 pmol.cell -1 with a mean value of 2.0 × 10 -6 pmol.cell -1 . [START_REF] Wirgot | H 2 O 2 modulates the energetic metabolism of the cloud microbiome[END_REF] showed that Pseudomonas graminis 13-b3 metabolism and particularly its ATP content are very sensitive to environmental conditions. For instance the ATP concentration was highly impacted by the presence of H 2 O 2 , therefore Pseudomonas graminis 13-b3 is a good model to evaluate the impact of our probe on ATP concentration. In the same paper we showed that the results issued from the study of this model strain (a strong correlation between H 2 O 2 and ATP concentrations) was valid when 32 cloud samples were considered, containing a very diverse biodiversity. In this sense P. graminis 13-b3 was a pertinent model for all the cloud microbiota.

Therefore we can conclude from the results of the present study that terephthalic acid does not impact Pseudomonas graminis 13-b3 viability and energy. In addition we expect that all the microorganisms in cloud water behave in a similar way than our model strain concerning TA toxicity.

Consequently, this probe can be used for measuring microorganism's impact on hydroxyl radical concentration.

Hydroxyl radical steady state concentration in atmospheric waters

With this method, [ • OH] ss was evaluated under irradiation (2 hours) in various natural atmospheric waters, 5 rain waters and 5 cloud waters sampled in 2015 and 2016.

Characterization of these atmospheric waters (including meteorological, physicochemical and biological parameters) and their retro-trajectories over 120 h are presented in supplementary data (Tables S1 andS2 Measured hydroxyl radical concentrations for atmospheric waters range from 2.8 × 10 -17 M (in rain water) to 2.0 × 10 -15 M (in cloud water). Steady state hydroxyl radical concentrations in cloud waters are higher than in rain waters, with values in cloud water ranging from 2.6 × 10 -16 to 2.0 × 10 -15 M with a mean value of "7.2 ± 5.0" × 10 -16 M and values in rain water ranging from 2.8 × 10 -17 to 4.3 × 10 -16 M with a mean value of "1.6 ± 1.5" × 10 -16 M.

Thus the value of [ • OH] ss is more than four times higher in cloud waters than in rain waters.

On the contrary, no significant differences are observed between our 5 cloud samples or our 5 rain samples. Moreover, no real correlation is found between the main parameters (Fe, H 2 O 2 , NO 3 -and TOC) and OH radical concentration. The only tendencies observed are for the rain samples with the highest TOC concentrations where the calculated OH radical concentrations are the lowest and for the cloud samples where the OH radical concentrations increase with the increase of nitrate concentration. These tendencies support the fact that TOC is a major sink for OH radicals in natural water [START_REF] Arakaki | A general scavenging rate constant for reaction of hydroxyl radical with organic carbon in atmospheric waters[END_REF] and nitrate/nitrite could be an important photochemical source of OH radical in such medium [START_REF] Kaur | Light absorption and the photoformation of hydroxyl radical and singlet oxygen in fog waters[END_REF].

However, from our results, no major influence of the air mass origins of the studied clouds and rains could be detected on [ • OH] ss , 5 samples are not enough and more samples should be analyzed to really conclude on this point.

After assessing the concentration of hydroxyl radicals in real atmospheric waters, the same experiments are performed with filtered waters in order to see if microorganisms can impact [ • OH] ss (Fig. 4). Concentration of hydroxyl radicals without (filtered) or with (non-filtered) microorganisms in rain waters show similar results except for two samples where concentrations are higher with the presence of microorganisms (September 17 th , 2015 and September 15 th , 2016). This observation is even more obvious with cloud waters.

Systematically, the steady state concentrations of • OH are higher with microorganisms than without microflora. However the difference is not statistically significant (p-value = 0.81 for rain waters and 0.06 for cloud waters, paired Wilcoxon test used), microorganism impact seems to be low, but more data are needed to strengthen this observation.

Atmospheric implications and Conclusion

A convenient method has been developed for the determination of steady state hydroxyl radical concentration in real atmospheric waters. Indeed, terephthalic acid (TA) used as a probe is non-toxic for microorganisms and therefore allows working with natural samples and to study the impact of the microflora. Moreover, TA is soluble in water and not volatile so the experiments can be performed in open-air conditions that are essential to work on natural samples with microorganisms. Finally another positive aspect is that because of the formation of a fluorescent product (TAOH) on which basis to evaluate the concentration of • OH, the technique is very sensitive with a limit of quantification near 10 -17 M and the measurement is easy to perform and fast. So, the use of TA is a very sensitive probe allowing direct assessment of the steady state concentration of hydroxyl radicals considering the sinks naturally present in the sample; it is complementary to the evaluation of the hydroxyl radical formation rates obtained in many previous studies [START_REF] Faust | Aqueous-phase photochemical formation of hydroxyl radical in authentic cloudwaters and fog waters[END_REF] in cloud; [START_REF] Nakatani | Contribution of the photo-Fenton reaction to hydroxyl radical formation rates in river and rain water samples[END_REF] in rain and river, and [START_REF] Bianco | A better understanding of hydroxyl radical photochemical sources in cloud waters collected at the puy de Dôme stationexperimental versus modelled formation rates[END_REF] in cloud water). This result is thus important for atmospheric scientists as the steady state hydroxyl radical concentration is really a crucial parameter corresponding to the oxidant capacity of cloud water and more generally of the atmosphere.

In this study, the measured values of the steady state hydroxyl radical concentrations are within the range of few 10 -16 M with mean values found in cloud water of "7.2 ± 5.0" × 10 - 16 M and in rain water of "1.6 ± 1.5" × 10 -16 M.

As we can see in the Figure 5, our values are close to those published in different studies from cloud, rain and fog waters even though our average of steady state OH radical concentration in rain waters is around 10 times lower than those evaluated by [START_REF] Arakaki | Photochemical formation and scavenging of hydroxyl radical in rain and dew waters[END_REF] and [START_REF] Albinet | Photochemical generation of reactive species upon irradiation of rainwater: Negligible photoactivity of dissolved organic matter[END_REF]. This difference can be explained by the typology of the sampling sites.

Indeed, Clermont-Ferrand area is much smaller than Torino or Higashi-Hiroshima and so less polluted area with less photochemical sources of OH radical. This is confirmed by the average concentration of nitrate in rain water measured in each site; Torino: 2.05 mg L -1 , Higashi-Hiroshima 1.86 mg L -1 and Clermont-Ferrand 0.68 mg L -1 . On the other hand, our [ • OH] ss values found in cloud waters are within the same range than those measured by [START_REF] Anastasio | Chemistry of fog waters in California's Central Valley: 1. In situ photoformation of hydroxyl radical and singlet molecular oxygen[END_REF] in cloud waters and by [START_REF] Kaur | Light absorption and the photoformation of hydroxyl radical and singlet oxygen in fog waters[END_REF] in fog waters.

If we compare our mean values, the steady state hydroxyl radical concentration is four times higher in cloud water than in rain water. This higher concentration in cloud water can be also explained considering a higher concentration of photochemical sources of hydroxyl radicals in cloud than in rain waters [START_REF] Lin | Estimates of the contribution of below-cloud scavenging to the pollutant loadings of rain in Taipei, Taiwan. Terrestrial[END_REF]. For example, our average concentrations of nitrate are 11.06 mg L -1 in cloud water and 0.68 mg L -1 in rain water.

Our results and comparison with the other studies show that nitrate (nitrite) could be the major precursors for photoformed • OH in rain and cloud waters. This observation is in agreement with the results published in the paper of [START_REF] Kaur | Light absorption and the photoformation of hydroxyl radical and singlet oxygen in fog waters[END_REF] which found that nitrate/nitrite ions are responsible for 70% of photoformed • OH in fog waters. In contrast, the study of [START_REF] Bianco | A better understanding of hydroxyl radical photochemical sources in cloud waters collected at the puy de Dôme stationexperimental versus modelled formation rates[END_REF] concluded that hydrogen peroxide is the most significant source of this radical (between 70 and 90%) in cloud waters sampled at the the puy de Dôme station.

This discrepancy could be due to the origin of the air masses (continental, marine, polluted), but also to the different kind of water fog or cloud and so the physicochemical properties of the collected water which can drive the photochemical reactivity. In the study of [START_REF] Bianco | A better understanding of hydroxyl radical photochemical sources in cloud waters collected at the puy de Dôme stationexperimental versus modelled formation rates[END_REF] no polluted samples was analysed and the puy de Dôme station in a remote site from sources of pollution.

On the contrary, our values are much lower than most of the values estimated by cloud chemistry models. Depending on the chemical scenarios (emission/deposition rates and initial chemical conditions) and on the chemical mechanisms, the estimated • OH concentrations vary from 10 -12 M to 10 -15 M [START_REF] Deguillaume | Effect of iron dissolution on cloud chemistry: From laboratory measurements to model results[END_REF][START_REF] Herrmann | Tropospheric aqueous-phase free-radical chemistry: Radical sources, spectra, reaction kinetics and prediction tools[END_REF][START_REF] Mouchel-Vallon | CLEPS 1.0: A new protocol for cloud aqueous phase oxidation of VOC mechanisms[END_REF][START_REF] Tilgner | Radical-driven carbonyl-to-acid conversion and acid degradation in tropospheric aqueous systems studied by CAPRAM[END_REF][START_REF] Tilgner | Modelling multiphase chemistry in deliquescent aerosols and clouds using CAPRAM3.0i[END_REF]. The highest concentration measured in the present study (~10 -15 M) is close to the minimal value simulated by the cloud chemistry models. This demonstrates that the models tend to overestimate the hydroxyl radical concentration as previously mentioned by [START_REF] Arakaki | A general scavenging rate constant for reaction of hydroxyl radical with organic carbon in atmospheric waters[END_REF]. This can be explained by two reasons. First, the models are expected to underestimate the radical sinks because all the organic scavengers cannot be exhaustively considered in the aqueous chemical mechanism. Secondly, models are simulating the mass transfer of • OH from the gas to the aqueous phase and consequently take into account an additional source not considered in the present study. This additional source is estimated to represent 69% of the total OH radical concentration present in aqueous phase [START_REF] Kaur | Light absorption and the photoformation of hydroxyl radical and singlet oxygen in fog waters[END_REF].

Moreover, thanks to this useful method, we have shown that the endogenous microflora has no significant impact on the steady state hydroxyl radical concentrations. The microorganisms could be a sink of • OH radicals as any other organic matter present in clouds; however this quenching effect is suspected to be negligible as microorganisms represent a low fraction of the total organic carbon (evaluated to 1.7% by [START_REF] Bauer | The contribution of bacteria and fungal spores to the organic carbon content of cloud water, precipitation and aerosols[END_REF]. On the contrary they could This convenient tool will allow the evaluation of atmospheric water oxidant capacity; it should be applied now to measure numerous samples at different sites (various altitudes, latitudes, seasons, etc.). The • OH concentrations at the steady state will be used to evaluate and constrain cloud chemistry models that simulate the organic matter transformations in clouds and thus their composition, their evolution and lifetime. This will help to better assess the effect of cloud of the transformation of atmospheric organic matter that plays a crucial role on air quality and climate.

3. 0

 0 × 10 -5 M, succinic acid 1.5 × 10 -5 M, MgCl 2 -6H 2 O 1.0 × 10 -4 M, CaCl 2 -2H 2 O 4.0 × 10 - 4 M, K 2 SO 4 5.0 × 10 -5 M, NaCl 2.0 × 10 -3 M, NO 3 NH 4 8.0 × 10 -4 M, NaOH 1.1 × 10 -3 M and H 2 SO 4 3.15 × 10 -4 M. pH solution is adjusted to 6.1 close to the average pH of natural clouds representative of air mass from marine origin[START_REF] Deguillaume | Classification of clouds sampled at the puy de Dôme (France) based on 10 yr of monitoring of their physicochemical properties[END_REF]. The solution is sterilized with 0.22 µm PES filter (Polyethersulfone, diameter 28 mm, membrane of type 16532-k, Sartorius Stedium biotech, Germany) and kept in the dark at 17°C. After incubation of cells, the media is tested with different concentrations of TA. At 0, 47 and 72 min of incubation, culture is done in R2A plate incubated at 17°C and ATP concentration is measured with an ATP Biomass kit HS, BioThema © .

  , Fig.S5 and S6, respectively). During the two hours of irradiation the concentrations of • OH are evaluated at different sampling times. At the same time, hydrogen peroxide concentrations are followed and no decrease of the concentration is observed (data not shown). The steady state hydroxyl radical concentrations obtained in rain and cloud waters are shown in Fig. 4. The standard deviations for steady state concentration are calculated from plots of Rf TAOH versus TA concentrations.

  produce • OH radicals by a passive mechanism. Indeed[START_REF] Samake | The unexpected role of bioaerosols in the oxidative potential of PM[END_REF] have recently reported that dead microorganisms used as bioaerosol models (bacteria and fungi) can produce ROS, although the method used does not allow to identify the type of radicals formed. Finally our results can be interpreted in two ways: i) the production or quenching of • OH is too low due to the low concentration of microorganisms in clouds thus no change in [ • OH] ss can be measured; ii) the rates of production and consumption of • OH by microorganisms are not negligible but within the same range of order and thus the resulting [ • OH] ss remains constant.

Fig. 1 :

 1 Figure captions:

Fig. 2 :

 2 Fig. 2: Reaction between TA and • OH.

Fig. 3 :

 3 Fig. 3: Evolutions of the number of cells (A) and of the concentration of ATP (B) as a function of time

Fig. 4 :

 4 Fig. 4: Concentrations of hydroxyl radicals at steady state in rain and cloud waters without (white

Fig 5 :

 5 Fig 5: Measured of steady state hydroxyl radical concentrations by different research groups in different atmospheric waters (cloud, fog and rain).

  Fig. 1

  Fig. 3

Acknowledgements

This work was funded by the French ANR program BIOCAP (N° ANR-13-BS06-004-01). It was also supported by the French Ministry and CNRS. The authors acknowledge the financial support from the Observatoire de Physique du Globe de Clermont-Ferrand (OPGC) and from the Fédération des Recherches en Environnement through the CPER founded by Région Auvergne Rhône-Alpes, the French ministry, and FEDER from the European community


Matthieu Olivetto
email: matthieuolivetto@live.fr

Jérémie Bettoni
email: jeremiebettonie@gmail.comjebranebouaoud

Sylvie Testelin
email: testelin.sylvie@chu-amiens.fr

Stéphanie Dakpé
email: dakpe.stéphanie@chu-amiens.fr

Michel Lefranc
email: lefranc.michel@chu-amiens.fr

Bernard Devauchelle
email: devauchelle.bernard@chu-amiens.fr

Use of an Occlusal Splint and Intraoperative Imaging with an Intraoral Approach in the Management of Mandibular Subcondylar Fractures Original article

Keywords: Mandibular subcondylar fracture, Condylar process fracture, Open treatment, Intraoral approach, Intraoperative cone-beam CT, Bite splint

the

Management of Mandibular Subcondylar Fractures

Abstract had an associated mandibular fracture. The median duration of the condylar fracture surgery was 54.5 minutes (range38-79 min). All patients had satisfactory reduction and osteosynthesis with no complications.

Conclusion

It is feasible to safely manage subcondylar fractures with this surgical procedure that could facilitate open reduction using intraoral approaches. Occlusal splints maintain downward pressure on the rami bilaterally and symmetrically, helping to anatomically reposition condylar process fractures. Intraoperative imaging is used to monitor this step.

Introduction

To evaluate the feasibility of safely managing subcondylar fractures using an original surgical procedure combining an intraoral approach, the use of a custom-made occlusal overlay splint, and intraoperative imaging.

Materials and Methods

Condylar fragment was freed from surrounding soft tissues, was laterally exposed to the ramus, and a miniplate was fixed in place for osteosynthesis. An overlay splint maintaining the dental occlusion was used to facilitate reduction and stabilization during fixation. Intraoperative monitoring by cone-beam computed tomography (CBCT) was performed before completing the fixation.

Results

Between November 2018 and June 2019, 10 patients were treated using this procedure. The median length of the proximal condylar fragment was 29 mm (range 24-39 min). Five patients

Cop Edi ed Man c ip (In e nal e onl )

Introduction

Different treatment options for the management of mandibular subcondylar fractures can be considered with no consensus on optimal treatment. There are two different approaches: functional therapy (closed treatment) and surgical management by open reduction and internal fixation (ORIF). For fractures, it has been demonstrated that anatomical repositioning of the condylar process is critical for optimal functional recovery [START_REF] Baker | Current consensus on the management of fractures of the mandibular condyle. A method by questionnaire[END_REF]. To achieve this, functional treatment is effective in some conditions (in children, slightly displaced or greenstick fractures). In other cases, the surgical option allows anatomical repositioning of the fractured fragment by releasing the displaced fragment, often entrapped in the soft tissue [START_REF] Weinberg | Articular soft tissue injuries associated with mandibular condyle fractures and the effects on oral function[END_REF]. Several open approaches have been described that allow direct access to the fracture site.

Their main disadvantages are skin scars, risk of salivary fistulas, and facial nerve injury [START_REF] Louvrier | Does the surgical approach for treating mandibular condylar fractures affect the rate of seventh cranial nerve injuries ? A systematic review and meta-analysis based on a new classification for surgical approaches[END_REF][START_REF] Rozeboom | Open treatment of condylar fractures via extraoral approaches: A review of complications[END_REF]. An intraoral approach is an alternative that avoids these drawbacks, but it is challenging given the limited surgical field and the quantity of instruments needed [START_REF] Vajgel | Treatment of condylar fractures with an intraoral approach using an angulated screwdriver: results of a multicentre study[END_REF]. Although endoscopic assistance is offered for better intraoperative control, it demands extensive experience, a longer operating time, and precise monitoring of reduction, especially for high and medially tilted fractures [START_REF] Blumer | Outcome of Surgically Treated Fractures of the Condylar Process by an Endoscopic Assisted Transoral Approach[END_REF].

Regardless of the chosen approach, it is necessary to anatomically replace the fragment to restore dental occlusion. Open reduction requires pulling the mandibular ramus down to create a sufficient gap for fragment repositioning. Maintaining the fragment in an optimal reduction position for rigid fixation is a recurrent problem, particularly when the fracture is unstable and/or the fragment is medially tilted.

To facilitate anatomical repositioning and fixation of the condylar process while maintaining dental occlusion, the authors have developed an original surgical procedure. The aim of this study was to evaluate the feasibility of a surgical technique that combines the use of an occlusal overlay splint for reduction and intraoperative cone-beam computed tomography (CBCT) monitoring.

Materials and Methods

Patients, fracture classification, and outcomes

Between November 2018 and June 2019, all patients with a mandibular subcondylar fracture with or without a dentate portion fracture were included in a prospective single center study. All participants signed an informed consent before their inclusion, and the study was conducted in accordance with the Declaration of Helsinki. The exclusion criteria were: comminuted fractures and fractures occurring in completely edentulous patients.

All patients had a preoperative clinical examination and a CT scan evaluation. Based on the preoperative CT-scan, the longest portion of the fragment was measured on sagittal reconstruction slices, and fractures were classified according to Spiessl and Schroll classification criteria [START_REF] Spiessl | Ein kurzes Handbuch in fünf Bänden. Band I/1 Gesichtsschädel[END_REF]. The surgical indication was based on both the clinical (disturbance of dental occlusion) and the ramus shortening measured on the CT scan (> 2 mm). Other data such as sex, age, and affected side were collected. Outcomes were:

-The duration of subcondylar ORIF, measured in minutes, from the incision in an intraoral approach to closure; -The number of intraoperative CBCT checks needed; -The quality of the final subcondylar fracture repositioning: considered as anatomically acceptable or not acceptable by an independent surgeon in an intraoperative assessment by CBCT scan; -Postoperative complications in the perioperative period (7 days): facial nerve injury (facial paresis), visible scars, salivary fistulas, hematoma, infection

Fabrication of the splint

Maxillary and mandibular dental casts were made. Then, the mounted models were adjusted to the maximum intercuspation position by adding a maxillo-mandibular space of 7 mm. The occlusal splint was made of silicone for direct application (polyvinyl siloxane, Memosil® 2) (Supplementary data 1, Video). Asepsis was achieved by treating the splint with an aqueous sodium hypochlorite solution (5.25%) for 10 minutes. If there was an additional displaced mandibular fracture, a reduction in the molding was done to realign the dental arch. In cases of a partially edentulous dentition, the silicone application filled the toothless spaces.

Surgical procedure

For each patient, an intraoral approach and intraoperative CBCT monitoring were performed. To facilitate immobilization, the patient s head was placed on a radiolucent Mayfield skull clamp.

An O-arm® CBCT (Medtronic, Minneapolis, USA) was centered by 2D front and profile shots, then parked near the patient's feet to prevent obstruction during the operation.

The intervention starts with the placement of preformed rigid arch bars. If there are additional mandibular fractures, they are first reduced and fixed using osteosynthesis. Then, ORIF of the subcondylar fragment is performed. After the intraoral incision, similar to a sagittal split osteotomy, a periosteal elevation along the mandibular ramus to the fracture site is carried out.

Then, the pericondylar soft tissues and the periosteum of the condylar fragment are moved apart (Figure 2). At this point in the procedure, a dose of muscle relaxant is administered before the reduction to facilitate manoeuvres, and hemorrhage management is optimized with a hypotensive agent. If the condylar fragment is medially displaced by the pull from the lateral pterygoid muscle, the surgeon should manipulate it, moving it into a lateral override position (laterally to the ramus) and a luxation could be reduced if necessary. The fragment is thus more accessible for the placement of the osteosynthesis miniplate (Modus 2.0, Medartis®, Basel, Switzerland). A first screw is inserted into the condyle fragment with a 90° screwdriver (Modus Optofix 2.0, Medartis®, Basel, Switzerland), then tightened, but not fully, allowing plate rotation. The bite splint is then fixed in placed with an intermaxillary steel wire (Figure 3A). To complete the procedure, the plate is positioned before the ramus is pulled down by the splint to prevent possible medial displacement of the condyle fragment.

Anatomically correct repositioning of the fractured condylar process is achieved with a periosteal elevator under direct vision control (incisura notch alignment without fragment rotation) and by palpating the basilar edge with an angled periosteal elevator. After clinical reduction verification, one of the two standard cortical screws is placed into the proximal mandibular fragment.

Intraoperative O-arm® CBCT (Figure 3B) allows verification of the following in a few seconds:

-Reduction, which must be anatomical: alignment of the basilar border on the sagittal slides and the vertical axis on the coronal slices, no rotation on the axial slides, and maximum interfragmentary contact -Correct positioning of the plate (3D reconstruction) and the screws (90° angle with the cortical plane, on coronal slices) If the assessment is satisfactory, the fourth and last cortical screw is put in place. If the assessment is not satisfactory, the re-execution of the reduction-osteosynthesis sequence is necessary. At the end of the intervention, the intermaxillary fixation and the splint are removed.

Mouth opening-closing movements are done to check the restored occlusion, check for the absence of temporomandibular clicking, and verify the stability of the osteosynthesis plate. In the absence of complications, the arches are removed at the one-week follow-up consultation.

Results

Patients and fracture classification

Ten patients (9 males, 1 female), with a median age of 32 years (range 18 to 40), having a unilateral mandibular condyle fracture, were included in the study (Table 1). Patients and surgical characteristics are summarized in Table 1. All patients had occlusion disorders with a condylar fragment entrapped in muscle tissue, as noted in a surgical approach. No case of condyle fragmentation was found. For 5 patients, an additional mandibular fracture was associated with the studied fracture. The median length of the proximal fragment was 29 mm (range 24 to 39 mm), with an average of 30.3 mm.

Splint fabrication

After mounting the casts on the articulator, the silicone application time was 30 seconds, with a 3-minute drying time (Supplementary data 1, video).

Surgical procedure

For all patients, the anatomically correct repositioning of the condylar fragment was intraoperatively assessed with O-arm® CBCT. Repositioning of the fracture fragment and miniplate osteosynthesis were required in patients #3 and #5, which involved two intraoperative 3D CBCT checks. Converting to an extraoral approach was never required. Patient #10 had a partial edentulous posterior region that posed no problem when using the splint. The median duration of surgery for the condylar fractures was 54.5 minutes (range 38 to 79 min) after subtracting the time needed for arch bar placement and management of additional fractures). All the procedures were performed by the same surgeon, a junior collaborator, with one assistant and one operating-room nurse. There were no postoperative complications in the perioperative period.

Discussion

This study reports the management of 10 condylar fractures with a new surgical procedure using an occlusal splint, an intraoral approach, and intraoperative CBCT monitoring. According to the literature, ORIF seems to be more effective than closed reduction for displaced condyle fractures resulting in dental malocclusion [START_REF] Li | Open versus closed treatment for unilateral mandibular extra-capsular condylar fractures: A meta-analysis[END_REF][START_REF] Neff | Position paper from the IBRA Symposium on Surgery of the Head -The 2 nd International Symposium for Condylar Fracture Osteosynthesis[END_REF]. In many cases, the entrapment of the fragment in the masseter muscle fibers makes anatomical closed reduction impossible.

Therefore, a surgical approach is required to release it from the muscle fibers. Many approaches have been described for surgical management. An extraoral approach allows better control of reduction but exposes the patient to a risk of facial nerve injury and aesthetic sequelae. By contrast, an intraoral approach avoids neurological sequelae, but monitoring reduction presents its main challenge. Nevertheless, the main priority is to ensure stable osteosynthesis after the anatomical repositioning of the fractured fragment. Some reductions are not easy, particularly for an unstable fracture that requires pulling down the ramus to open the space required for reduction.

Open reduction techniques have been described using an Eckelt retractor, angular screws, or manual traction [START_REF] Sugamata | Open reduction of subcondylar fractures using a new retractor[END_REF][START_REF] Rao | Screw and Wire Technique for Condylar Fracture Reduction[END_REF][START_REF] Thakur | Use of a Heister mouth gag as an aid to reduction in open treatment of condylar fracture[END_REF]. All of these present various disadvantages: i) unilateral traction leads to rotation of the ramus in the sagittal axis, not ensuring optimal preservation of dental occlusion after rigid fixation of the fracture, ii) the procedure requires an operating-room assistant and/or additional instruments in a restricted surgical field, and iii) these methods do not guarantee stable maintenance of the reduction and the dental occlusion before the rigid fixation, or might require an intraoperative CBCT. This work highlights the advantages of using a new device (bite splint) to facilitate fragment repositioning. The splint is easily and quickly fabricated after taking dental impressions and applying silicone directly to the articulator-mounted casts starting from an optimal intercuspidation position and adding 7 mm of mouth opening. This space of 7 mm has been empirically determined and was found to be the most appropriate in several attempts previous to this study. Less than 7 mm is not sufficient for the downward traction needed for repositioning the fragment. More than 7 mm distends the condyle head too far from its glenoid fossa.

This system can be used with all surgical approaches. It allows the two mandibular rami to be pulled down in a stable and symmetrical direction, in contrast to other reduction methods. The general principles are: i) the plate positioned on the proximal fragment before splint traction prevents the medial tilting favored by the lateral pterygoid muscle (mechanical obstacle), ii) the surgeon can take advantage of the elasticity of the curarized muscle strap, creating a vertical condylar space, and can laterally and medially guide the anatomical positioning of the condylar process, iii) dental occlusion is maintained and oral mouth opening kinetics are achieved, and iv) the procedure facilitates surgery by reducing the number of instruments or hands in the restricted surgical field.

The use of intraoperative CBCT monitoring in this procedure solves the main problem of the intraoral approach, which is checking reduction. This includes the realignment of the posterior edge that is difficult to assess visually. Intraoperative imaging also avoids a radiological checkup at postoperative day 1, which could impose a new surgical procedure in the event of an unsatisfactory reduction. An O-arm confirmation with a low dose protocol is equivalent to less than 50% of the effective dose of a CT of the head (https://www.medtronic.com/usen/healthcare-professionals/products/neurological/surgical-imaging-systems/o-arm/doseconsiderations.html). Moreover, this procedure facilitates outpatient management of subcondylar fractures, supported by the intraoral approach in which no drainage is used. In this regard, the use of intraoperative CBCT will become widespread in facial bone surgery and will become part of the maxillofacial surgery technical platform.

In conclusion, the use of an occlusal splint overlay is a feasible and convenient method for ORIF condylar fracture management. It allows for an open anatomical repositioning of a fracture by continuously pulling down the rami bilaterally and symmetrically, creating a space for maneuvering the fragment. Additionally, intermaxillary fixation ensures the correct position of the dental occlusion. It is appropriate to use intraoperative CBCT monitoring that may contribute to easier techniques for open reduction using intraoral approaches. M: male; F: female; L: left; R: right a: Age at surgery (years) b: According to the Spiessl and Schroll classification [START_REF] Spiessl | Ein kurzes Handbuch in fünf Bänden. Band I/1 Gesichtsschädel[END_REF] Type I: fracture without displacement; Type II: low fracture with displacement; Type III:

Tables

Figure 1 :Figure 2 :Figure 3 :

 123 Figure 1: Final appearance of the splint fabricated on articulator-mounted casts with a 7 mm

Table 1 .

 1 Patient characteristics and surgical data

	Patient	Sex Age a	Affected side	Type of condylar fracture b	Fragment size c	Associated fracture	ORIF duration d	Number of CBCT e
	1	M	40	L	II	30	Symphysis	67	1
	2	M	19	R	II	28	no	44	1
	3	F	40	L	V	25	no	79	2
	4	M	33	L	IV	39	no	48	1
	5	M	31	R	IV	31	no	74	2
	6	M	18	R	II	32	Left parasymphysis 38	1
	7	M	31	R	II	28	Left parasymphysis 55	1
	8	M	19	R	IV	24	Symphysis	79	1
	9	M	52	L	II	38	Opposite angle Coronoid process	54	1
	10	M	47	L	II	28	no	51	1

d: Operating time of open reduction internal fixation (ORIF) of the condyle fragment disregarding other fractures, measured from incision to closure (minutes) e: Number of intraoperative O-arm® CBCT (cone-beam computer tomography)

Supplementary Materials

Supplementary material 1 (Video): Video illustrating all the steps of the bite splint construction process


Benoît Bonnet
email: benoit.bonnet@inria.fr

Teddy Furon
email: teddy.furon@inria.fr

Patrick Bas
email: patrick.bas@centralelille.fr

Forensics Through Stega Glasses: the Case of Adversarial Images

Keywords: Adversarial Examples, Steganography, Image Forensics

This paper explores the connection between forensics, counterforensics, steganography and adversarial images. On the one hand, forensicsbased and steganalysis-based detectors help in detecting adversarial perturbations. On the other hand, steganography can be used as a counterforensics strategy and helps in forging adversarial perturbations that are not only invisible to the human eye but also less statistically detectable. This work explains how to use these information hiding tools for attacking or defending computer vision image classification. We play this cat and mouse game using both recent deep-learning content-based classifiers, forensics detectors derived from steganalysis, and steganographic distortions dedicated to color quantized images. It turns out that crafting adversarial perturbations relying on steganographic perturbations is an effective counter-forensics strategy.

Introduction

Adversarial examples is an emerging field in Information Forensics and Security, addressing the vulnerabilities of Machine Learning algorithms. This paper casts this topic to Computer Vision, and in particular, to image classification, and its associated forensics counter-part: the detection of adversarial contents.

A Deep Neural Network (DNN) is trained to classify images by the object represented in the picture. This is for instance the well-known ImageNet challenge encompassing a thousand of classes. The state-of-the-art proposes impressive results as classifiers now do a better job than humans with less classification errors and much faster timings. The advent of the AlexNet DNN in 2012 is often seen as the turning point of 'Artificial Intelligence' in Computer Vision. Yet, the recent literature of adversarial examples reveals that these classifiers are vulnerable to specific image modifications. The perturbation is often a weak signal barely visible to the human eyes. Almost surely, no human would incorrectly classify these adversarial images. This topic is extremely interesting as it challenges the 'Artificial Intelligence' qualification too soon attributed to Deep Learning.

The connection between adversarial examples and forensics/anti-forensics is obvious. First, adding an adversarial perturbation to delude a processing is an image manipulation per se and therefore detecting adversarial examples is a forensic task by itself. Second, techniques forging adversarial examples are also used to fool forensics detectors as proposed in [START_REF] Güera | A counterforensic method for cnn-based camera model identification[END_REF] [START_REF] Barni | Adversarial multimedia forensics: Overview and challenges ahead[END_REF]. In this case, the adversarial attack is a counter-forensics strategy to conceal an image manipulation.

Paper [START_REF] Quiring | Forgotten siblings: Unifying attacks on machine learning and digital watermarking[END_REF] makes the connection between adversarial examples and information hiding (be it watermarking or steganography). Both fields modify images (or any other type of media) in the pixel domain so that the content is moved to a targeted region of the feature space. That region is the region associated to a secret message in information hiding or to a wrong class in adversarial examples. Indeed, paper [START_REF] Quiring | Forgotten siblings: Unifying attacks on machine learning and digital watermarking[END_REF] shows that adversarial examples benefits from ideas proven efficient in watermarking, and vice-versa.

This paper contributes to the same spirit by investigating what both steganography and steganalysis bring to the the "cat-and-mouse" game of adversarial examples. There are two natural ideas: Steganalysis aims at detecting weak perturbations in images. This field is certainly useful for the defender. Steganography is the art of modifying an image while being non-detectable. This field is certainly useful for the attacker.

These two sides of the same coin allow to mount a defense and to challenge it in return, as done in other studies [START_REF] Carlini | Adversarial examples are not easily detected: Bypassing ten detection methods[END_REF][START_REF] Athalye | Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples[END_REF][START_REF] Tramer | On adaptive attacks to adversarial example defenses[END_REF]. This paper aims at revealing the status of the game between the attacker and the defender at the time of writing, i.e. when both players use up-to-date tools: state-of-the-art image classifiers with premium steganalyzers, and best-in-class steganography embedders. As far as we know, this paper proposes three first time contributions:

-Assess robustness of recent models EfficientNet [START_REF] Tan | Efficientnet: Rethinking model scaling for convolutional neural networks[END_REF] and its robust version [START_REF] Xie | Adversarial examples improve image recognition[END_REF], -Apply one state-of-the-art steganalyzer (SRNet [START_REF] Boroumand | Deep residual network for steganalysis of digital images[END_REF]) for forensics purposes, i.e. to detect adversarial images, -Use the best steganographic schemes to craft counter-forensics perturbations reducing the detectability: HILL [START_REF] Li | A new cost function for spatial image steganography[END_REF] uses empirical costs, MiPod [START_REF] Sedighi | Content-adaptive steganography by minimizing statistical detectability[END_REF] models undetectability from a statistical point of view, while GINA [START_REF] Li | A strategy of clustering modification directions in spatial image steganography[END_REF][START_REF] Wang | Non-additive cost functions for color image steganography based on inter-channel correlations and differences[END_REF] synchronizes embeddings on color channels.

Section 2 reviews the connections between forensics, steganography, and adversarial examples. Our main contribution on counter-forensics and experimental results are detailed in Sect. 3 and 4.

2 Related Works

Steganalysis for forensic purposes

Steganalysis has always been bounded to steganography, obviously. Yet, a recent trend is to resort to this tool for other purposes than detecting whether an image conceals a secret message. For instance, paper [START_REF] Qiu | A universal image forensic strategy based on steganalytic model[END_REF] claims the universality of SRM and LBP steganalyzers for forensic purposes detecting image processing (like Gaussian blurring, gamma correction) or splicing. The authors of [START_REF] Farooq | A generic passive image forgery detection scheme using local binary pattern with rich models[END_REF] used this approach during the IEEE IFS-TC image forensics challenge. The same trend holds as well on audio forensics [START_REF] Luo | Improved audio steganalytic feature and its applications in audio forensics[END_REF]. As for camera model identification, the inspiration from steganalysis (co-occurrences, color dependencies, conditional probabilities) is clearly apparent in [START_REF] Tuama | Camera model identification based machine learning approach with high order statistics features[END_REF]. This reveals a certain versatility of steganalysis. It is not surprising since the main goal is to model and detect weak signals. Modern steganalyzers are no longer based on hand-crafted features like SRM [START_REF] Fridrich | Rich models for steganalysis of digital images[END_REF]. They are no more no less than Deep Neural Networks like Xu-Net [START_REF] Xu | Structural design of convolutional neural networks for steganalysis[END_REF] or SRNet [START_REF] Boroumand | Deep residual network for steganalysis of digital images[END_REF]. The frontier between steganalysis and any two-class image classification problem (such as image manipulation detection) is blurred. Yet, these networks have a specific structure able to focus on weak signal detection: They avoid subsampling or pooling operations in order to preserve high frequency signals, they need large databases combined with augmentation techniques and curriculum learning [START_REF] Yousfi | Breaking ALASKA: Color separation for steganalysis in jpeg domain[END_REF].

However, this general-purpose strategy based on steganalysis method has some drawbacks. It lacks fine-grained tampering localization, which is often an issue in forensics [START_REF] Fan | General-purpose image forensics using patch likelihood under image statistical models[END_REF]. Paper [START_REF] Chen | A gradient-based pixeldomain attack against svm detection of global image manipulations[END_REF] goes a step further in the cat-and-mouse game with an counter-forensic method: knowing that the defender uses a steganalyzer, the attacker modifies the perturbation (accounting for a median filtering or a contrast enhancement) to become less detectable.

As for adversarial images detection, this method is not new as well. The authors of [START_REF] Schöttle | Detecting adversarial examples -a lesson from multimedia security[END_REF] wisely see steganalysis detection as a perfect companion to adversarial re-training. This last mechanism fights well against small perturbations. It however struggles in correctly classifying coarser and more detectable attacks. Unfortunately, this idea is supported with a proof of concept (as acknowledged by the authors): the steganalyzer is rudimentary, the dataset is composed of tiny images (MNIST). On the contrary, the authors of [START_REF] Liu | Detection based defense against adversarial examples from the steganalysis point of view[END_REF] outline that steganalysis works better on larger images like ImageNet (ILSVRC-2016). They however use a deprecated classifier (VGG-16 [START_REF] Simonyan | Very deep convolutional networks for large-scale image recognition[END_REF]) with outdated steganalyzers based on hand-crafted features (SPAM and SRM).

Adversarial examples

This paper focuses on white-box attacks where the attacker knows all implementation details of the classifier. To make things clearer, the classifier has the following structure: a pre-processing T maps an image I o ∈ {0, 1, . . . , 255} n (with n = 3LC, 3 color channels, L lines and C columns of pixels) to x o = T(I o ) ∈ X n , with X := [0, 1] (some networks also use X = [-1, 1] or [-3, 3]). This preprocessing is heuristic, sometimes it just divides the pixel value by 255, sometimes this normalization is channel dependent based on some statistics (empirical mean and standard deviation). After normalization, x o feeds the trained neural network to produce the estimated probabilities (p k (x o )) k of being from class k ∈ {1, . . . , K}. The predicted class is given by:

ĉ(x o ) = arg max k pk (x o ). ( 1
)
The classification is correct if ĉ(x o ) = c(x o ), the ground truth label of image I o . An untargeted adversarial attack aims at finding the optimal point:

x a = arg min

x:ĉ(x) =c(xo) x -x o , (2)
where • is usually the Euclidean distance.

Discovering this optimal point is difficult because the space dimension n is large. In a white-box scenario, all attacks are sub-optimal iterative processes. They use the gradient of the network function efficiently computed thanks to the back-propagation mechanism to find a solution x a close to x a . They are compared in terms of probability of success, average distortion, and complexity (number of gradient computations). This paper considers well-known attacks ranked from low to high complexity: FGSM [START_REF] Goodfellow | Explaining and harnessing adversarial examples[END_REF], PGD [START_REF] Madry | Towards deep learning models resistant to adversarial attacks[END_REF], DDN [START_REF] Rony | Decoupling direction and norm for efficient gradient-based l2 adversarial attacks and defenses[END_REF], CW [START_REF] Carlini | Towards evaluating the robustness of neural networks[END_REF].

As outlined in [START_REF] Bonnet | What if adversarial samples were digital images?[END_REF], definition ( 2) is common in literature, yet it is incorrect. The final goal of the attacker is to create an adversarial image I a in the pixel domain, not x a in X n . Applying the inverse mapping T -1 is not solving the issue because this a priori makes non integer pixel values. Rounding to the nearest integer, I a = [T -1 (x a )], is simple but not effective. Some networks are so vulnerable (like ResNet-18) that T -1 (x a )-I o is a weak signal partially destroyed by rounding. The impact is that, after rounding, I a is no longer adversarial. DDN is a rare example of a powerful attack natively offering quantized values.

Paper [START_REF] Bonnet | What if adversarial samples were digital images?[END_REF] proposes a post-processing Q on top of any attack that makes sure

I q = Q(T -1 (x a )
) is (i) an image (integral constraint), (ii) remains adversarial, and (iii) has a low Euclidean distortion I q -I o . This paper follows the same approach but adds another constraint: (iv) be non-detectable.

Figure 1 shows the characteristic function measuring the probability of success of an attack [START_REF] Bonnet | What if adversarial samples were digital images?[END_REF] as a function of the distortion budget (L 2 -norm) against landmark classifiers in the history of ImageNet challenge. The characteristic function starts at 1 -η, where η is the accuracy of the classifier: a proportion 1 -η of original images are naturally adversarial since there are misclassified. As we know, the accuracy of the networks increases as time goes by: AlexNet (2012) [START_REF] Krizhevsky | Imagenet classification with deep convolutional neural networks[END_REF] < VGG-16 (2015) [START_REF] Simonyan | Very deep convolutional networks for large-scale image recognition[END_REF] < GoogLeNet (2015) [START_REF] Szegedy | Going deeper with convolutions[END_REF] < ResNet-50 [START_REF] He | Deep residual learning for image recognition[END_REF] (2016) < EfficientNet-b0 [START_REF] Tan | Efficientnet: Rethinking model scaling for convolutional neural networks[END_REF] (2019). On the other hand, the robustness to this attack can be measured by the average distortion necessary for hacking the images (cf. Table 1). This reveals a different hierarchy: ResNet-50 and VGG-16 are quite fragile contrary to the old AlexNet. Overall, the recent EfficientNet is both more accurate and more robust.

Defenses

The literature proposes four types of defenses or counter-attacks against adversarial examples white-box attacks: To detect: Being barely visible does not mean that the perturbation is not statistically detectable. This defense analyses the image and bypasses the classifier if detected as adversarial [START_REF] Ma | NIC: detecting adversarial samples with neural network invariant checking[END_REF]. This is a forensics analysis of adversarial signals.

To reform: The perturbation looks like a random noise that may be filtered out. This defense is usually a front-end projecting the image back to the manifold of natural images [START_REF] Meng | Magnet: a two-pronged defense against adversarial examples[END_REF].

To robustify: At learning, adversarial images are included in the training set with their original class labels. Adversarial re-training robustifies a 'vanilla' trained network [START_REF] Madry | Towards deep learning models resistant to adversarial attacks[END_REF].

To randomize: At testing, the classifier depends on a secret key or an alea. This blocks pure white-box attacks [START_REF] Taran | Defending against adversarial attacks by randomized diversification[END_REF][START_REF] Taran | Machine learning through cryptographic glasses: combating adversarial attacks by key based diversified aggregation[END_REF].

This paper evaluates steganalysis as a candidate for the first line of defense against white-box attacks targeting vanilla or robust networks.

Steganographic costs

Undetectability is usually tackled by the concept of costs in the steganographic literature: each pixel location i of a given cover image is assigned a set of costs (w i ( )) that reflects the detectability of modifying the i-th pixel by quantum. Usually, w i (0) = 0, w i (-) = w i ( ), and w i (| |) is increasing. The goal of the steganographer is to embed a message m while minimizing the empirical steganographic distortion:

D( ) := n i=1 w i ( i ).
(

) 3
This is practically achieved using Syndrome Trellis Codes [START_REF] Filler | Minimizing additive distortion in steganography using syndrome-trellis codes[END_REF]. This paper proposes to use the steganographic distortion (instead of L 1 , L 2 or L ∞ norms in adversarial literature) in order to decrease detectability. Note that this distortion is additive, which is equivalent to consider that each pixel modification yields a detectability independent from the others. Yet, one strategy takes into account potential interactions between neighboring modifications: The image is first decomposed into disjoint lattices to be sequentially embedded where costs are then updated after the embedding over one lattice [START_REF] Li | A strategy of clustering modification directions in spatial image steganography[END_REF].

This work uses three families of steganographic costs. The first one, HILL [START_REF] Li | A new cost function for spatial image steganography[END_REF], is empirical and naive, but has nevertheless been widely used in steganography thanks to its simplicity. The cost map w associated to ±1 is computed using two low-pass averaging filters L 1 and L 2 of respective size 3 × 3 and 15 × 15 and one high pass filter H: ( * means convolution)

w = 1 |I * H| * L 1 * L 2 , with H =   -1 2 -1 2 -4 2 -1 2 -1   . (4)
The second one, derived from MiPod [START_REF] Sedighi | Content-adaptive steganography by minimizing statistical detectability[END_REF], assumes that the residual signal is distributed as N (0, σ 2 i ) for the original image, and N ( i , σ 2 i ) for the stego image. The variance σ 2 i is estimated on each pixel using Wiener filtering and a least square approximation on a basis of cosine functions. The cost is the log likelihood ratio between the two distributions evaluated at 0, i.e.:

w i ( i ) = 2 i /σ 2 i . (5)
Unlike HILL, this model handles modifications other than ±1.

The last one is a cost updating strategy favoring coherent modifications between pixels within a spatial or color neighborhood. It is called GINA [START_REF] Wang | Non-additive cost functions for color image steganography based on inter-channel correlations and differences[END_REF] and it is derived from CMD [START_REF] Li | A strategy of clustering modification directions in spatial image steganography[END_REF]. It splits the color images into 4 disjoint lattices per channel, i.e. 12 lattices. The embedding performs sequentially starting by the green channel lattices. The costs on one lattice is updated according to the modifications done on the previous ones as:

w i ( i ) = 1 9 w i ( i ) , if sign( i ) = sign(µ i ), (6)
with µ i the average of the modifications already performed in the spatial or colour neighborhood of location i.

Looking at Adversarial Examples with Stega Glasses

First, note that adversarial images recently became a source of inspiration for steganography: paper [START_REF] Tang | CNN-based adversarial embedding for image steganography[END_REF] proposes the concept of steganography with an adversarial embedding fooling a DNN-based steganalyzer. References [START_REF] Bernard | Explicit optimization of min max steganographic game[END_REF] and [START_REF] Shi | Cnn-based steganalysis and parametric adversarial embedding: a game-theoretic framework[END_REF] propose both to cast the problem of adversarial embedding as a game-theoretical problem. A protocol to train efficiently new adversaries and to generate less detectable stego contents using a min max strategy is presented in [START_REF] Bernard | Explicit optimization of min max steganographic game[END_REF]. The reference [START_REF] Shi | Cnn-based steganalysis and parametric adversarial embedding: a game-theoretic framework[END_REF] solves the game between one embedder and one steganalyst using both different levels of adversarial perturbations. Paper [START_REF] Schöttle | Detecting adversarial examples -a lesson from multimedia security[END_REF] stresses however one fundamental difference between steganography and adverarial examples: Steganalysis has two classes, where the class 'cover' distribution is given by Nature, whereas the class 'stego' distribution is a consequence of designed embedding schemes. On the other hand, a perfect adversarial example and an original image are distributed as by the class ĉ(x a ) or c(x o ), which are both given by Nature.

We stress another major difference: Steganographic embedding is essentially a stochastic process. Two stego-contents derived from the same cover are different almost surely with STC [START_REF] Filler | Minimizing additive distortion in steganography using syndrome-trellis codes[END_REF]. This is a mean to encompass the randomness of the messages to be embedded. This is also the reason why steganographic embedders turns the costs (w i ( )) into probabilities (π i ( )) of modifying the i-th pixel by quantum. These probabilities are derived to minimize the detectability under the constraint of an embedding rate given by the source coding theorem:

R = -n -1 i i π i ( i ) log 2 (π i ( i )) bits. (7)
In contrast, an attack is a deterministic process always giving the same adversarial version of one original image. Adversarial imaging does not need these probabilities.

Steganographic Post-Processing

This section presents the use of steganography in our post-processing Q mounted on top of any adversarial attack.

Optimal post-processing

Starting from an original image, we assume that an attack has produced x a mapped back to I a = T -1 (x a ). The problem is that I a ∈ [0, 255] n , i.e. its pixel values are a priori not quantized. Our post-processing specifically deals with that matter, outputting I q = Q(I a ) ∈ {0, . . . , 255} n . We introduce p the perturbation after the attack and q the perturbation after our post-processing:

p := I a -I o ∈ R n , (8)
:= I q -I o ∈ Z n . (9)
The design of Q amounts to find a good . This is more complex than just rounding perturbation p. We first restrict the range of . We define the degree of freedom d as the number of possible values for each i , 1 ≤ i ≤ n. This is an even integer greater than or equal to 2. The range of i is centered around p i . For instance, when d = 2, i ∈ { p i , p i }. In general, the range is given by

L i := { p i -d/2, . . . , p i -1, p i , . . . , p i + d/2 -1}. ( 10
)
Over the whole image, there are d n possible sequences for . We now define two quantities depending on . The classifier loss at I q = I a -p + :

L( ) := log(p co (I a -p + )) -log(p ca (I a -p + )), (11)
where c o is the ground truth class of I o and c a is the predicted class after the attack. When the attack succeeds, it means that I a is classified as c a = c o because pca (I a ) > pco (I a ) so that L(p) < 0. Our post-processing cares about maintaining this adversariality. This constrains s.t. L( ) < 0. The second quantity is the detectability. We assume that a black-box algorithm gives the stego-costs (w i ( )) for a given original image. The overall detectability of I q is gauged by D( ) as given by (3). In the end, the optimal post-processing Q minimizes detectability while maintaining adversariality: = arg min :L( )<0

D( ).

(12)

Our proposal

The complexity for finding the solution of (12) a priori scales as O(d n ). Two ideas from the adversarial examples literature help reducing this cost. First, the problem is stated as an Lagrangian formulation as in [START_REF] Carlini | Towards evaluating the robustness of neural networks[END_REF]:

λ = arg min D( ) + λL( ). ( 13
)
where λ ≥ 0 is the Lagrangian multiplier. This means that we must solve this problem for any λ and then find the smallest value of λ s.t. L( λ ) < 0. Second, the classifier loss is linearized around I a , i.e. for around p: L( ) ≈ L(p) + ( -p) g, where g = ∇L(p). This transforms problem [START_REF] Filler | Minimizing additive distortion in steganography using syndrome-trellis codes[END_REF]

into λ = arg min n i=1 w i ( i ) + λ(p i -i ).g i . ( 14
)
The solution is now tractable because the functional is separable: we can solve the problem pixel-wise. The algorithm stores in d × n matrix W the costs, and in d × n matrix G the values ((p ii ).g i ) i for i ∈ L i [START_REF] Dohmatob | Generalized no free lunch theorem for adversarial robustness[END_REF]. For a given λ, it computes W + λG and looks for the minimum of each column 1 ≤ i ≤ n. In other words, it is as complex as n minimum findings, each over d values, which scales as O(n log d).

Note that for λ = 0, Q quantizes I a,i 'towards' I o,i to minimize detectability. Indeed, if i = 0 is admissible (0

∈ L i holds if |p i | ≤ d/2), then Q(I a,i ) = I o,i at λ = 0.
On top of solving [START_REF] Fridrich | Rich models for steganalysis of digital images[END_REF], a line search over λ is required. The linearization of the loss being a crude approximation, we make calls to the network to check that Q(I a ) is adversarial: When testing a given value of λ, λ is computed to produce I q that feeds the classifier. If I q is adversarial then L( λ ) < 0 and we test a lower value of λ (giving more importance to the detectability), otherwise we increase it. The search is performed over log 2 (n) steps. The images we used are of dimension 224×224×3 which gives 18 steps. Optimal λ varies widely in value between different images.

Simplification for quadratic stego-costs

We now assume that the stego-costs obey to the following expression: w i ( ) = 2 /σ 2 i as in [START_REF] Boroumand | Deep residual network for steganalysis of digital images[END_REF]. This makes the functional of ( 14) (restricted to the i-th pixel) equals to 2 i /σ 2 i -λg i i + λp i which minimizer is ˜ i = λg i σ 2 i /2. Yet, this value in general is not an integer belonging to L i (10). This issue is easily solved because a quadratic function is symmetric around its minimum, therefore the minimum over L i is its value closest to ˜ i as shown in Fig. 2. The range L i being nothing more than a set of consecutive integers, we obtain a closed form expression:

λ,i = min(max([λg i σ 2 i /2], p i -d/2), p i + d/2 -1), (15)
where [•] is the rounding to the nearest integer. The post-processing has now a linear complexity. In this equation, the min and max operate a clipping so that λ,i belongs to

L i . This clipping is active if ˜ i / ∈ L i , which happens if λ ≥ λi with λi :=    2 pi -d giσ 2 i + if g i < 0 2 pi +d-2 giσ 2 i + if g i > 0, (16)
where |a| + = a if a > 0, 0 otherwise. This remark is important because it shows that for any λ > max i λi , the solution λ of ( 15) remains the same due to clipping. Therefore, we can narrow down the line search of λ to [0, max i λi ].

4 Experimental Investigation

Experimental setup

Our experimental work uses 18,000 images from ImageNet of dimension 224×224×3. This subset is split in 1,000 for testing and comparing, 17,000 for training. An

+ + + + + +
Fig. 2. Rounding the minimizer when the stego-cost is quadratic.

image is attacked only if the classifier predicts its correct label beforehand. This happens with probability equaling the accuracy of the network Acc. We measure L 2 the average Euclidean distance of the perturbation and P suc the probability of a successful attack only over correctly labeled images.

We attack the networks with 4 different attacks: FGSM [START_REF] Goodfellow | Explaining and harnessing adversarial examples[END_REF], PGD 2 [START_REF] Madry | Towards deep learning models resistant to adversarial attacks[END_REF], CW [START_REF] Carlini | Towards evaluating the robustness of neural networks[END_REF] and DDN [START_REF] Rony | Decoupling direction and norm for efficient gradient-based l2 adversarial attacks and defenses[END_REF]. All these attacks are run in a best-effort fashion with a complexity limited to 100 iterations. This means that for FGSM and PGD 2 the distortion is gradually increased until the image is adversarial. For more complex CW and DDN attacks, different parameters are used over a total maximum of 100 iterations. The final attacked version is the adversarial image with the smaller distortion. Since DDN is the only attack that creates integer images, the other 3 are post-processed either by the enhanced quantization [START_REF] Bonnet | What if adversarial samples were digital images?[END_REF], which is our baseline, or by our method explained in Sect. 3.2.

The adversarial image detectors are evaluated by the true positive rate TPR 5 when the false positive rate FPR is fixed to 5%.

Robustness of recent classifiers: there is free lunch

Our first experiment compares the robustness of the famous ResNet-50 network to the recent classifiers: the vanilla version of EfficientNet-b0 [START_REF] Tan | Efficientnet: Rethinking model scaling for convolutional neural networks[END_REF] and its robust version trained with AdvProp [START_REF] Xie | Adversarial examples improve image recognition[END_REF]. Note that the authors of [START_REF] Xie | Adversarial examples improve image recognition[END_REF] apply adversarial re-training for improving accuracy. As far as we known, the robustness of this version was not yet established.

Figure 3 shows the same characteristic function as in Figure 1 with this time the vanilla EfficientNet-b0 against its robust version. Table 1 gives measurements P suc and L 2 as a summary of the characteristic function shown in Fig 1 . This confirms that modern classifiers are more accurate and more robust (lower P suc and/or bigger L 2 ). This is indeed a surprise: It pulls down the myth of 'No Free Lunch' in adversarial machine learning literature [START_REF] Tsipras | Robustness may be at odds with accuracy[END_REF][START_REF] Dohmatob | Generalized no free lunch theorem for adversarial robustness[END_REF] (the price to pay for robustifying a network is allegedly a lower accuracy).

Detection with forensics detectors

We use three steganalyzers to detect adversarial images. Their training set is composed of 15,651 pairs of original and adversarial images. The latter are crafted with best-effort FGSM against vanilla EfficientNet-b0. The first detector is trained on SRM feature vectors [START_REF] Fridrich | Rich models for steganalysis of digital images[END_REF], with dimensions 34,671. SRM is a model that applies to only one channel. It is computed on the luminance of the image in our experimental work. The classifier separating these high-dimensional vectors into two classes is the linear regularized classifier [START_REF] Cogranne | Is ensemble classifier needed for steganalysis in high-dimensional feature spaces?[END_REF]. The second detector is based on the color version of SRM: SCRMQ1 [START_REF] Goljan | Rich model for steganalysis of color images[END_REF] with dimension 18,157. The classifier is the same. The third detector is SRNet [START_REF] Boroumand | Deep residual network for steganalysis of digital images[END_REF], one of the best detectors in steganalysis. Training is performed on 180 epochs: The first 100 with a learning rate of 10 -3 , the remaining 80 with 10 -4 . Data augmentation is also performed during training. First, there is a probability p 1 = 0.5 of mirroring the pair of images. Then, there is another probability p 2 = 0.5 of rotating them by 90 degrees.

The attacks: Table 2 shows the results of detection on all 4 attacks. PGD 2 achieves a high P suc at almost a third of the distortion FGSM would obtain. DDN and CW being harder to optimize attain both lower P suc and higher distortion under the given constraints. For the rest of the study we therefore focus on PGD 2 to give the best attacking setup with reasonable complexity.

The detectors: Table 2 gives also the TPR 5 associated to the detectors. Although [START_REF] Liu | Detection based defense against adversarial examples from the steganalysis point of view[END_REF] achieves good performances with SRM, we do not obtain the high Table 2. Detection probabilities (TPR5) with forensics detectors of adversarial images targeting classifier vanilla EfficientNet-b0 [START_REF] Tan | Efficientnet: Rethinking model scaling for convolutional neural networks[END_REF] Psuc L2 SRM(%) SCRMQ1(%) SRNet(%) FGSM+ [START_REF] Bonnet | What if adversarial samples were digital images?[END_REF] detection rates reported in the reference. This cab be due to both finer attacks (best effort mode) and quantization. Our results show also that the detectors generalize well: although trained to detect images highly distorted by FGSM, they can detect as well and sometimes even better more subtle attacks like CW. Moreover, SRNet always outperforms SCRMQ1 and is the most accurate of the three detectors. From table 2, we can also deduce that PGD 2 + [START_REF] Bonnet | What if adversarial samples were digital images?[END_REF] is the worst-case scenario for defense. The probability of fooling both the classifier EfficientNet-b0 and the detector SRNet in this setup combines to only 0.88 × (1 -0.933) = 5.9%.

Post-processing with a Steganographic Embedder

We now play the role of the attacker. We use PGD 2 with best effort as the base attack to compare the detectability of four post-processings: The nonsteganographic insertion [START_REF] Bonnet | What if adversarial samples were digital images?[END_REF] as a baseline, HILL (4), MiPod (5), and GINA [START_REF] Carlini | Adversarial examples are not easily detected: Bypassing ten detection methods[END_REF]. GINA uses the quadratic method explained in Sect. 3.3 sequentially over the 12 lattices. Quadratic stego-costs are updated with CMD strategy [START_REF] Carlini | Adversarial examples are not easily detected: Bypassing ten detection methods[END_REF]. Each lattice contributes to a 1/12 of the initial classification loss.

Table 3 illustrates how each strategy is detected by either SCRMQ1 or SR-Net. Both detectors are trained on FGSM with [START_REF] Bonnet | What if adversarial samples were digital images?[END_REF] quantization as 'stego' images crafted on their respective network. Distortion increases with each method and along the degree of freedom d. The use of Steganographic costs therefore enables to reduce the detectability while increasing the L 2 distortion.

From the attacker perspective, the best strategy to fool the detector PGD 2 is GINA costs with d = 4. This scenario now has 48.0% chance of fooling both Vanilla EfficientNet-b0 and SRNet and 80.4% with SCRMQ1 as the detector. Fig. 4 shows the two examples with highest distortion on EfficientNet-b0 that still fool SRNet. The added distortion remains imperceptible to the human eye even in these cases.

The conclusion on Robust EfficientNet-b0 is however different. Since the distortion needed to attack the network is higher, it is consequently expected that the detectors will be more accurate. If SCRMQ1 detects GINA distortion slightly better than on Vanilla EfficientNet-b0, SRNet is however very efficient to detect each strategy even if it was trained on FGSM.

Training on adversarial images with GINA costs

We finally play the role of the defender again. We want to detect GINA perturbation with the highest possible TPR. To achieve this we retrain our detectors in the same setups as before, but with images using GINA perturbation as adversarial images. Since table 3 shows that in most cases d = 4 is indeed the worst-case for the defense side, we attacked the training set of "cover" images with PGD 2 and GINA costs with d = 4. The first result we report is that under the same setup, SRNet was never able to distinct both distributions of images. The average confidence on the whole test set is roughly 50%. Trying to train SRNet with a finer learning rate did not lead to any better result. There is probably a set of hyperparameters that would lead to a more effective training. However this result illustrates that GINA distortion is harder to detect.

Table 4 shows TPR 5 for SCRMQ1 under such training setup. The detector is able to detect GINA mechanism at a higher rate than in Table 3 but generalizes poorly on other attacks. A conclusion to this final experiment is that GINA can be stealthy to general detectors, but it is still better detected after another iteration of the defender. The detection accuracy is however lower when using GINA costs, and drops from 83.1% to 68.5%. The price of detecting GINA is also to become more specific and to lose performance on the other attacks.

Conclusions

This paper explores both sides of adversarial image detection with steganographic glasses.

On the Attack side, our work using distortions designed for steganographic purposes is able to reduce the detection rates. Steganographic distortion target specific regions and pixels of an image to quantize the attack. The L 2 distortion increases w.r.t. the original attack, but remains imperceptible by the human eye (Fig. 4) and less detectable by a targeted detector. This paper consequently shows the possibility of tweaking an attack to make it harder to detect while remaining invisible.

On the Defense side, we use SRNet [START_REF] Boroumand | Deep residual network for steganalysis of digital images[END_REF], state-of-the-art in steganalysis to detect adversarial images. Training it on images attacked with the basic FGSM shows excellent performance. Detection also generalizes well even on the finest attacks such as PGD 2 [START_REF] Madry | Towards deep learning models resistant to adversarial attacks[END_REF] and CW [START_REF] Carlini | Towards evaluating the robustness of neural networks[END_REF].

Finally both Attack and Defense are affected by the considered neural network. The effect of adversarial training on EfficientNet-b0 [START_REF] Xie | Adversarial examples improve image recognition[END_REF] is twofold: it increases the classification accuracy as well as robustifying the network. An increased robustness translates into a higher attacking distortion, which itself translates into a higher detectability.

Fig. 1 .

 1 Fig. 1. Characteristic function of attack [4] (PGD in best effort with quantization) against well known (vanilla) classifiers for ImageNet.

Fig. 3 .

 3 Fig. 3. Characteristic function of attack [4] (PGD in best effort with quantization) against Vanilla EfficientNet-b0 and its Robust counterpart.

'Fig. 4 .

 4 Fig. 4. Top row: Cover images with their label below. Bottom row: adversarial images with steganographic embedding GINA (d=4). Below them are their new label and the distortion

Table 1 .

 1 Robustness of recent classifiers against PGD2 followed by quantization[START_REF] Bonnet | What if adversarial samples were digital images?[END_REF]

		Acc (%) Psuc (%) L2
	Alexnet	57.0	100	104
	VGG-16	75.0	100	56.5
	GoogLeNet	77.2	99.8	72.9
	ResNet-50	80.0	97.2	81
	Vanilla EfficientNet-b0 [35]	82.8	99.1	115
	Robust EfficientNet [43]	84.3	98.5	192

Table 3 .

 3 Undetectability of steganographic embedding on PGD2 against the vanilla model (Van) and its robust version (Rob).

		89.7 286	72.00	83.3	93.5
	PGD2+[4] 98.6 113	65.02	83.1	93.8
	CW+[4]	89.7 97	68.78	83.6	94.5
	DDN	83.2 186	79.53	91.9	94.8

Table 4 .

 4 Detection on SCRMQ1 after training on adversarial images embedded with GINA (d=4)

		d SCRMQ1(%)
		Van	Rob
	[4]	2 55.9	56.7
	HILL 2 53.4	53.6
	HILL 4 50.4	53.9
	MiPod 2 56.1	55.9
	MiPod 4 53.9	54.9
	GINA 2 77.7 78.4
	GINA 4 68.5 79.7