Keywords: affective norms, French words, valence, arousal, age differences

de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

In the field of emotion and cognition, a wide range of studies have examined how emotional words are processed by comparing them to neutral words. These studies have used various experimental paradigms, including the emotional Stroop task (e.g., [START_REF] Dresler | Emotional Stroop task: Effect of word arousal and subject anxiety on emotional interference[END_REF][START_REF] Koven | Relationships of Distinct Affective Dimensions to Performance on an Emotional Stroop Task[END_REF], the lexical decision task (e.g., [START_REF] Kuchinke | Pupillary responses during lexical decisions vary with word frequency but not emotional valence[END_REF][START_REF] Syssau | L'influence de la richesse sémantique dans la reconnaissance visuelle des mots émotionnels[END_REF][START_REF] Windmann | Dissociating prelexical and postlexical processing of affective information in the two hemispheres: Effects of the stimulus presentation format[END_REF], immediate serial recall [START_REF] Majerus | Verbal short-term memory reflects the organization of long-term memory: Further evidence from short-term memory for emotional words[END_REF]Monnier & Syssau, 2008;[START_REF] Tse | The word concreteness effect occurs for positive, but not negative, emotion words in immediate serial recall[END_REF], and the directed-forgetting paradigm [START_REF] Korfine | Directed forgetting of emotional stimuli in borderline personality disorder[END_REF]Minnema & Knowlton, 2008). However, these studies would not have been possible without the efforts of researchers to establish norms for the emotional characteristics of words.

In 1999, Bradley and Lang published the now-authoritative Affective Norms for English Words (ANEW) database. This database was developed within the dimensional theory of emotions, in line with Osgood's semantic differential theory (Osgood, Suci, & Tannebaum, 1957). This view posits that emotional meaning can be described by two main dimensions, valence and arousal, and a third less strongly-related dimension, dominance or control.

Emotional valence and arousal can be represented in a bidimensional framework called the affective space. The ANEW database provides valence, arousal, and dominance norms for 1,034 English words compiled from Self-Assessment Manikin evaluations (SAM; [START_REF] Lang | Behavioral treatment and bio-behavioral assessment: Computer applications[END_REF]. SAM is a picture-based instrument, in which each dimension is represented graphically (with a character) on a 9-point scale. For the valence dimension, the SAM scale ranges from a happy-looking, smiling character on the left to a frowning, sad-faced character on the right.

For the arousal dimension, the character on the left is wide-eyed and looks excited, while the character on the right has his eyes closed and looks calm and sleepy. For the dominance dimension, the character on the left is small to show that it is dominated, and the character on The ANEW database provides means and standard deviations for valence, arousal and dominance ratings averaged across all participants, then averaged across both male and female participants.

The ANEW American database has been adapted to other languages, such as Spanish [START_REF] Redondo | The Spanish adaptation of ANEW (Affective Norms for English Words)[END_REF], Portuguese [START_REF] Soares | The adaptation of the Affective Norms for English words (ANEW) for European Portuguese[END_REF], and Italian (Montefineses, Mabrosini, Fairfield, & Mammarella, 2013). These works have clearly demonstrated that the emotional meaning of words varies with languages and cultures. This finding underlines the need for specific tools in every language. In French, FAN provides valence and arousal for 1,031 words rated by young adults with the standard Self-Assessment Manikin (Monnier & Syssau, 2014).

Another factor of variability of the emotional meaning of words seems to be sex.

Although some studies have found no difference between the affective ratings made by males and females (e.g., [START_REF] Redondo | The Spanish adaptation of ANEW (Affective Norms for English Words)[END_REF], or only minimal sex-related differences (e.g., [START_REF] Stevenson | Characterization of the Affective Norms for English Words by discrete emotional categories[END_REF], other studies have shown that levels of reactivity to emotional words were higher for females than for males (e.g., Monnier & Syssau, 2014;Montefineses et al., 2013).Therefore, since sex may be a differentiating factor in word evaluations and, thusly, participant performance in a wide range of cognitive tasks, researchers need a tool that would allow them to take into account sex-related differences.

In addition to language and sex differences, the emotional meaning of words also seems to vary with age. Age-related differences in emotional content have been evidenced when words were rated by young and older adults [START_REF] Gilet | Valence, arousal, and imagery ratings for 835 French attributes by young, middle-aged, and older adults: The French Emotional Evaluation List (FEEL)[END_REF][START_REF] Grühn | Characteristics for 200 words rated by young and older adults: Age-Dependent Evaluations of German Adjectives (AGE)[END_REF][START_REF] Keil | Changes in the sensitivity to appetitive and aversive arousal across adulthood[END_REF]. [START_REF] Grühn | Characteristics for 200 words rated by young and older adults: Age-Dependent Evaluations of German Adjectives (AGE)[END_REF] and for 21% of the adjectives in arousal ratings. Furthermore, positive adjectives were more positive and more arousing for older adults than for young ones. In contrast, negative adjectives were evaluated as less arousing by older adults than by young ones. At the other end of the age range, [START_REF] Syssau | Children's emotional norms for 600 French words[END_REF] found that the emotional meaning of words changed substantially between the ages of 5 and 9 years. The number of neutral words increased between 5 and 7 years, whereas the number of positive words decreased between 5 and 9 years. Only the number of negative words remained stable with age. From a purely quantitative point of view, there was a significant change in valence with age for 5% of the words evaluated by the children. Such findings underline the importance of providing ageadapted tools to researchers so they may examine, from a developmental point of view, how emotional words are processed.

Studies interested in how emotional stimuli are processed by children remain scarce, but a significant increase in their number is noticeable. For instance, recent studies have focused on the cost effects associated with processing emotional distractors in children and adolescents [START_REF] Heim | Early adolescents show sustained susceptibility to cognitive interference by emotional distractors[END_REF][START_REF] Cohen-Gilbert | Inhibitory control during emotional distraction across adolescence and early adulthood[END_REF], emotional reactions to facial emotional expression during childhood [START_REF] Mancini | Facial expressions of emotions: Recognition accuracy and affective reactions during late 28 adolescents on the dot probe task[END_REF], affective reactions in anxious children [START_REF] Kotta | Affective reactions to images in anxious children[END_REF], attentional or memory bias for emotional information in both child and adolescent emotionally disordered samples (Moradi, Taghavi, Neshat-Doost, Yule, & Dalgleish, 2000;Neshat-Doost, Moradi, Taghavi, Yule, & Dalgleish, 2000), false memory [START_REF] Brainerd | Developmental reversals in false memory: Effects of emotional valence and arousal[END_REF][START_REF] Howe | Valence and the development of immediate and long-term false memory illusions[END_REF],and the influence of emotional valence on children's recall [START_REF] Syssau | L'influence de la valence émotionnelle positive des mots sur la mémoire des enfants. = The influence of the emotional positive valence of words on children memory[END_REF]Van Bergen, Wall, & Salmon, 2014) Vasa, Carlino, London, & Min, 2006 in English;Ho, Mak, Yeung, Duan, Tang, Yeung, & Ching, 2015 in Chinese). In [START_REF] Syssau | Children's emotional norms for 600 French words[END_REF], we collected valence ratings of 200 words at age 5, 588 words at age 7 and 600 words at age 9 using a 3point pictorial scale of face drawings with a sad mouth for negative valence, a straight mouth for neutral valence, and a smiling mouth for positive valence. [START_REF] Vasa | Valence ratings of emotional and non-emotional words in children[END_REF] provided valence ratings for a preselected list of 81 words from three emotional categories (threat, positive, and neutral) rated by children 9, 10, and 11 years of age using the SAM scale reduced to five points. [START_REF] Ho | Emotional valence, arousal, and threat ratings of 160 Chinese words among adolescents[END_REF] collected ratings of valence, arousal and threat for 160 Chinese words among adolescents aged between 12 and 17 years. To date, these databases are still underused in this domain of research; this is probably due to the facts that a) two of them provide valence but not arousal ratings, and b) the number of words rated by children was rather small. Though researchers have not specifically used children norms to carry out their studies, they have usually selected emotional stimuli on the basis of pilot studies in which another sample of children rated material on emotional characteristics (i.e., [START_REF] Syssau | L'influence de la valence émotionnelle positive des mots sur la mémoire des enfants. = The influence of the emotional positive valence of words on children memory[END_REF]. Occasionally, researchers selected the experimental words on the basis of valence and arousal ratings collected from adults rather than children (i.e., [START_REF] Brainerd | Developmental reversals in false memory: Effects of emotional valence and arousal[END_REF]. This kind of strategy raises questions. Indeed, [START_REF] Kensinger | Effects of normal aging and Alzheimer's disease on emotional memory[END_REF] observed that the effects of age on recall of positive and negative words could depend on the criteria used for word selection. When the positive and negative words were categorized on the basis of how they were evaluated by young and older adults, older adults recalled more negative words than positive ones, whereas young adults recalled more positive words than negative ones. Conversely, when the positive and negative words were categorized on the basis of the evaluations included in the ANEW, both older and younger adults recalled more positive words than negative ones. Consequently, it is important The objective of our work was to provide French-speaking researchers with a tool which would allow them to more closely examine how a word's emotional characteristics influence its processing in children and adolescents. Our database provides emotional evaluations obtained from four different age groups (7-, 9-, 11-year-old children and 13-yearold adolescents). This age range allowed us to determine whether the perception of word's emotional signification changes with age. Our database provides both valence and arousal evaluations: Researchers will thusly be able to manipulate and/or control both of these dimensions in children and adolescents. The Self-Assessment Manikin (SAM, [START_REF] Lang | Behavioral treatment and bio-behavioral assessment: Computer applications[END_REF] was used to assess valence and arousal. Since this scale is a nonverbal, pictographic selfreport measure, it can easily be implemented with children.

Method

Participants

We recruited 908 participants for the study. All were native speakers of French. Our

Materials and procedure

The stimulus set contained 720 French nouns drawn from the FAN emotion database compiled by Monnier and Syssau (2014). The 720-word corpus was selected on the basis of age of acquisition (7 years) as defined in [START_REF] Ferrand | Normes d'âge d'acquisition pour 400 mots monosyllabiques. = Age-of-acquisition norms for 400 monosyllabic French words[END_REF], [START_REF] Lachaud | CHACQFAM: Une base de données renseignant l'âge d'acquisition estimé et la familiarité pour 1225 mots monosyllabiques et bisyllabiques du français. = CHACQFAM: A lexical data base for the estimated age of acquisition and familiarity of 1225 monosyllabic and bisyllabic French words[END_REF], and [START_REF] Niedenthal | A prototype analysis of the French category "émotion[END_REF]. We divided the entire corpus into 12 questionnaires of 60 words and developed two versions of a questionnaire with the same words arranged in two different randomized orders.

The 60 words in each questionnaire were printed in an 8-page (A4 size) test booklet. The front page included a section in which participants gave personal information (first name, sex, date of birth and school) and presented two practice words. Pages two to seven contained nine words and page eight contained six words. Each word was printed in the center of the page in Times 14-point font. The valence and arousal scales from the paper and pencil version of the 9-point SAM scale [START_REF] Lang | Behavioral treatment and bio-behavioral assessment: Computer applications[END_REF] were printed under each word, with the valence scale on the left and the arousal scale on the right(see FAN, Monnier & Syssau, 2014).

We followed identical procedures for the 7-and 9-year-old children, who were tested in groups in a quiet room at their school. Each child rated two questionnaires of 60 words each in two separate sessions, carried out within a period ranging from one day to one week. The first session lasted approximately 45 minutes; the second session lasted approximately 30 minutes. The instructions were adapted from Lang, Bradley and Cuthbert (2008, instructions for child participants). The experimenter first described the valence and arousal scales, and explained how to use both scales to evaluate personal feelings. The booklets were then given out and the children were asked to fill in their personal information. Next, the two practice

F o r R e v i e w O n l y
9 words were reviewed. The experimenter and the children read each word aloud together and the children were instructed to put an X above the picture of the manikin that best described their initial feeling upon hearing the word. They were told to do this first for the valence scale and then for the arousal scale. The aim of the practice trials was two-fold: first, we wanted to ascertain that the children perfectly understood the instructions; second, we meant to show that many answers were possible, i.e., that there were no right or wrong answers. After the two practice trials, the experimenter read aloud the first word of the questionnaire and asked the children to fill in the valence and arousal scales. Once the children had done so, the next word was read aloud. If any of the children needed more time, testing was paused so they could be helped. A similar procedure was used for the second testing session, except that the children did not rate any practice words.

The 11-year-old children and the adolescents were tested in groups in a quiet room at their middle school. Each participant rated two booklets of 60 words each in a single session lasting approximately 45 minutes. The instructions were adapted from [START_REF] Lang | International affective picture system (IAPS): Affective ratings of pictures and instruction manual[END_REF] instructions for adults participants). After listening to the instructions and rating the two practice words, the participants read each word silently and rated it on the valence and arousal scales, proceeding at their own pace.

Results and discussion

Description of FAN child

Each word was rated by at least 31 seven year-old children, 27 nine-year-old children, 40 eleven-year-old children and 36thirteen-year-old adolescents. For each word, we calculated mean valence and mean arousal scores for each age group and sex, and compiled the affective ratings into a database. The database lists the mean valence and arousal ratings for each word according to age group and sex. Column 1 of the database lists the 720 words in alphabetical order. An English translation is given in column 2. Although our materials consisted of words, column 3 lists picture sources (when available: "AF" for [START_REF] Alario | A set of 400 pictures standardized for French: Norms for name agreement, image agreement, familiarity, visual complexity, image variability, and age of acquisition[END_REF]; "B" for [START_REF] Bonin | A new set of 299 pictures for psycholinguistic studies: French norms for name agreement, image agreement, conceptual familiarity, visual complexity, image variability, age of acquisition, and naming latencies[END_REF]; this information may prove helpful in future studies, especially those involving children. Column 4 indicates the number assigned to each picture.

Columns 5 to 52 show the valence and arousal mean ratings (Mean) and standard deviations (SD) for each of the 720 words. For each age group, these data are given for the total sample (All) and for the girl and boy samples separately.

Descriptive statistics for both valence and arousal ratings and for each age group are reported in Table 1.

(Table 1 about here)

Words with the highest and lowest emotional scores

In order to examine whether the participants understood the rating procedure, we analyzed the three words with the highest and lowest valence and arousal scores for each group of participants, as determined by age and sex (Table 2). For the valence dimension, words generally associated with positive emotions obtained an average score close to 9 on the valence scale (e.g., present, happiness), whereas words associated with negative emotions obtained low valence scores (e.g., sadness, illness). For the arousal dimension, words generally associated with a high degree of excitement were given high arousal ratings (e.g., party, surprise), whereas words suggesting a feeling of calm (e.g., quietness, tiredness) or words connoting little or no excitement(e.g., furniture, leek) were given low arousal ratings. Thus, the general direction of the participants' responses was as expected and demonstrated that the rating procedure employed had been correctly understood. However, it is also interesting to note that responses varied with age. Specifically, only 3 of the most positive words (out of 12) were shared by two age groups (laughter, party and present). Four of the For the words with the highest arousal ratings, only 2 words (out of 12) were shared by three age groups (party and surprise). Finally, the 12 words with the lowest arousal ratings were never the same for the various age groups.

(Table 2 about here)

Reliability of valence and arousal ratings

In order to estimate inter-rater reliability, we formed two subgroups of participants within each of the four age groups (odd and even participants) and calculated the mean ratings for each word. We then correlated the mean ratings from both odd and even participants for the two affective dimensions (i.e., valence and arousal). The adjusted correlation coefficients (Spearman-Brown formula) were all positive and highly significant, ranging from .89 at age 7 to .94 at age 13 for emotional valence, and from .73 at age 7 to .88 at age 11 for the arousal affective dimension (ps < .05). It is also worth noting that, although we found high inter-rater reliability for both valence and arousal for the four age groups, word assessments seemed to be more consensual on the positive-negative continuum than on the calm-excited continuum.

These findings are in line with previous ones (e. g., Hinojora, [START_REF] Hinojosa | Affective norms of 875 Spanish words for five discrete emotional categories and two emotional dimensions[END_REF]Montefinese et al., 2013;Moors, De Houwer et al., 2013).

Consistency of present and previous ratings

To further test the generalizability of our ratings, we compared them with those collected from children in our previous study [START_REF] Syssau | Children's emotional norms for 600 French words[END_REF]. The present study's corpus included 565 words from that our previous work. The comparison focused on the ratings shared by the two studies, i.e., valence ratings collected from7-and 9-year-old children. We obtained significant Pearson correlations between the words tested in both 12 studies at ages 7 and 9, r = .79 and r = .83, respectively, ps < .001. The similarities between our present results and our previous ones suggest that the words elicited similar emotional reactions despite the use of different scales to assess the valence dimension.

Associations between valence and arousal dimensions

Figure 1 shows the location of each word in a two-dimensional affective space defined by the mean valence and mean arousal ratings of each word at ages 7, 9, 11 and 13. In order to examine the relationship between the valence and arousal dimensions, we carried out a series of regression analyses with emotional valence as the independent factor and arousal as the dependent factor for each of the four age groups taken separately. We observed that both the quadratic and linear relations between valence and arousal ratings were significant for all four age groups. At age 7, the quadratic relation explained 55% of the variance, whereas the linear relation accounted for 48% of the variance (R = .74, p < .001 and R = .69, p < .001, respectively). At age 9, 65% of the variance was explained by the quadratic relationship and 53% of the variance was explained by the linear relationship (R = .80, p < .001 and R = .73, p < .001, respectively). At age 11, the quadratic and the linear functions explained respectively 57% and 50% of the variance (R = .75, p < .001 for the quadratic function and R = 71, p < .001 for the linear function). Finally, at age 13, the quadratic relation explained 37% of the variance, whereas the linear relation accounted for 32% of the variance (R = .61, p < .001 and R = .56, p < .001, respectively).

The finding that words rated as highly pleasant or highly unpleasant are also rated as more arousing, and that words rated as neutral are rated as less arousing is classic in the literature on adults [START_REF] Eilola | Affective norms for 210 British English and Finnish nouns[END_REF][START_REF] Redondo | The Spanish adaptation of ANEW (Affective Norms for English Words)[END_REF][START_REF] Soares | The adaptation of the Affective Norms for English words (ANEW) for European Portuguese[END_REF][START_REF] Võ | The Berlin Affective Word List Reloaded (BAWL-R)[END_REF] [START_REF] Sharp | Children's subjective emotional reactivity to affective pictures: Gender differences and their antisocial correlates in an unselected sample of 7-11-year-olds[END_REF] asked children aged between 7 and 11 years to evaluate pictures selected from the IAPS (Lang, Bradley, & Cuthbert, 1999). Based on the results, these authors reported a quadratic relation between valence and arousal. On the other hand, whereas McManis et al. (2001, Experiment 1, n=60 pictures) reported that the valence and arousal dimensions were linearly independent for children, Sharp et al. (2006, n=27 pictures) found, as we did in the present study, that the relationship between valence and arousal ratings was both linear and quadratic, with the quadratic model explaining more of the variance than the linear model. This result also parallels the results of Keil and Freund's study (2009) at the other end of the life continuum. These authors asked young, middle-aged and older participants to evaluate the valence and arousal dimensions of 90 German verbs. They found that the relationship between valence and arousal ratings was clearly quadratic for young adults (the linear model being nonsignificant), and that both quadratic and linear relations were observed for middle-aged and older groups. However, the linear relation accounted for less of the variance than the quadratic relation, which is not the case in our study. One potential reason for the inconsistency between those findings may be rooted in the characteristics of our corpus: Indeed, the latter contained few negative words (i.e., 47 negative words at age 7, 70 at age 9, 71 at age 11 and 66 at age 13 when a criterion of mean valence ratings < 4 was adopted). As mentioned above, our 720-word corpus was selected from the FAN emotional database on the basis of age of acquisition ( < 7), and recent evidence has suggested that words learned early in life are perceived as more positive, whereas words acquired later are perceived as more negative (e.g., Bonin, Méot et al., 2003;[START_REF] Citron | Evaluation of lexical and semantic features for English emotion words[END_REF]Moors et al., 2013).

Thusly, from a developmental point of view, our study provides evidence for agerelated changes in the affective space between 7-and 13-year-old children. However, the (Figure 1 about here)

Impact of age and sex on emotional evaluations

In order to compare valence and arousal ratings across the age and sex dimensions, we first examined the associations between the ratings of 7-, 9-, 11-and13-year-olds, and between those of girls and boys within each of the four age groups. Tables 3 and4 give Pearson correlations between the evaluations of children and adolescents, and between those of girls and boys (values on the diagonal) for both the valence and the arousal dimensions.

Valence ratings for 7-, 9-, 11-and 13-year-olds were significantly correlated (.81 ≤ r ≤ .93), suggesting a general consensus among age groups on which words are considered more positive and which more negative. Correlations between girls' and boys' valence ratings within each of the four age groups were also significant (.62 ≤ r ≤ .79), indicating that girls and boys generally agreed on the words' rankings in the valence dimension. Arousal ratings for 7-, 9-, 11-and 13-year-olds were significantly correlated, but the correlations were more modest than those of the valence ratings (.54 ≤ r ≤ .84). Hence, participants in the four age groups showed a degree of consensus upon which words were slightly, moderately or highly arousing. Nevertheless, there were also significant differences between their evaluations. A similar phenomenon was observed when comparing the two sexes: The correlation between the arousal ratings made by girls and those made by boys was only moderate, suggesting a rather weak consensus on arousal evaluations (.35 ≤ r ≤ .74).

Thus, perceptions of the valence of words and their positions on the positive-negative continuum were relatively similar between children and adolescents, and between girls and boys. In contrast, agreement between ages and sexes on the arousal dimension was weaker, (Tables 3 and4 about here) We further addressed the question of age and sex differences in emotional ratings by classifying the whole set of words as either negative (M valence < 4), neutral (4 ≤ M valence ≤ 6), or positive (M valence > 6) on the basis of their overall valence scores (combined across 7-, 9-, 11and 13-year-olds). The criteria used to classify the words were the same as those used by [START_REF] Ferré | Affective norms for 380 Spanish words belonging to three different semantic categories[END_REF]. This procedure resulted in 53 negative (7.4% of the database), 385 neutral (53.5%), and 282 positive words (39.1%).

Mean valence and arousal ratings across the entire corpus and for each valence category are reported by age and by sex in Table 5 Although judgments of negative words were rather similar across the four age groups, positive words were judged as less pleasant with increasing age and neutral words gradually moved to the middle point of the scale. These results support our previous ones, reported in [START_REF] Syssau | Children's emotional norms for 600 French words[END_REF], in which we asked 5-, 7-and 9-year-old children to evaluate the valence of words on a 3-point scale (positive, neutral, negative). We found that the ratings of 5-to 9-year-old children tend to shift from the positive to the neutral area of the valence scale.

Although the number of negative words remained stable with age, the number of positive words decreased and the number of neutral words increased. From a developmental point of view, it is interesting to note that the effect of age on valence judgments continues after childhood. In this respect, [START_REF] Grühn | Characteristics for 200 words rated by young and older adults: Age-Dependent Evaluations of German Adjectives (AGE)[END_REF] demonstrated an effect of age on valence evaluations of positive words, with older adults evaluating positive words more positively than young adults. In the same vein, [START_REF] Keil | Changes in the sensitivity to appetitive and aversive arousal across adulthood[END_REF] showed an effect of age on valence ratings of negative words, with older adults making more negative judgments than young adults. Valence ratings also differed according to sex, with girls providing more extreme valence judgments than boys for both negative and positive words. This phenomenon was observed in the four age groups -except at age 11 -for positive words. It supports the results reported by [START_REF] Vasa | Valence ratings of emotional and non-emotional words in children[END_REF] for 9-to 11-year-old children in a study using words, and by McManis et al. (2001, Experiment 2) for 7-to 10-year-old children in a study using pictures. [START_REF] Sharp | Children's subjective emotional reactivity to affective pictures: Gender differences and their antisocial correlates in an unselected sample of 7-11-year-olds[END_REF], whose participants were children between 7-and 10-years-old, only found sex-related differences when using negative pictures. The results are also consistent with previous studies on young adults (e.g., [START_REF] Bellezza | Words high and low in pleasantness as rated by male and female college students[END_REF][START_REF] Soares | The adaptation of the Affective Norms for English words (ANEW) for European Portuguese[END_REF].

( .05. There was also a significant three-way interaction of Age Group X Sex X Valence Category, F(6, 2151) = 8.7, p < .001, η 2 p = .02. To examine this three-way interaction, three separate ANOVAs were conducted, one for each valence category, with the factors of age and sex. For the negative words, the ANOVA showed main effects of both age group, F(3, 156) = 5.2, p < .01, η 2 p = .09 and sex, F(1, 52) = 9.3, p < .01, η 2 p = .15. However, these main effects were qualified by a significant interaction, F(3, 156) = 14.9, p < .001, η 2 p = .22. Post hoc analyses (Tukey Test) indicated that, according to age, there were no differences in arousal ratings of negative words for boys. The same pattern of results was observed for girls, except that 13-year-old girls rated negative words as more arousing than 7-, 9-, and 11-year-old girls, ps < .001. Moreover, 7-, 9-, and 11-year-old boys evaluated negative words as more arousing than 7-, 9-, and 11-year-old girls, whereas girls judged negative words as more arousing than boys at age 13, ps < .05. For the positive words, the ANOVA revealed main effects of both age group, F(3, 843) = 40.5, p < .001, η 2 p = .12 and sex, F(1, 281) = 4.93, p < .05, η 2 p = .01, as well as a significant age group by sex interaction, F(3, 843) = 19.49, p < .001, η 2 p = .06.

Further post hoc analyses showed a significant decrease in arousal ratings of positive words for boys (ps < .001), except between age 9 and age 11, where the difference was not significant. For girls, there were no differences in arousal ratings of positive words between ages 9, 11 and 13. But 7-year-old girls judged positive words more arousing than girls in the

F o r R e v i e w O n l y
19 other age groups, ps < .001. Moreover, boys provided higher arousal ratings for positive words than girls both at ages 9 and 11, ps < .05. For the neutral words, the ANOVA showed main effects of both age group, F(3, 1152) = 137.9, p < .001, η 2 p = .26 and sex, F(1, 384) = 83.7, p < .001, η 2 p = .18. These main effects were qualified by a significant interaction, F(3, 1152) = 36.0, p < .001, η 2 p = .08. Post hoc analyses (Tukey Test) indicated that 7-year-old boys rated neutral words as more arousing than 9-year-old boys, and that 11-year-old boys judged neutral words as more arousing than 9-year-old boys did (ps < .001), with no arousal rating difference between age 11 and age 13. For girls, the post hoc analyses revealed that arousal ratings were higher at age 7 than at age 9, and that the arousal ratings significantly increased with age, ps < .001. Moreover, boys evaluated neutral words as more arousing than girls of any age did (p< .001) -except at age 13, where no significant difference was observed between boys and girls.

With respect to changes in arousal ratings with age for each valence category, we found a tendency for positive words to be evaluated as less arousing with increasing age. This tendency was particularly true for boys. Arousal ratings of negative words did not really change with age, except at age 13 for girls, with whom a peak was observed. Neutral words were evaluated as more arousing by 7-than 9-year-olds; the opposite trend was observed between ages 9 and 13 for girls, who showed an increase in arousal ratings. These findings are in line with those reported by [START_REF] Sharp | Children's subjective emotional reactivity to affective pictures: Gender differences and their antisocial correlates in an unselected sample of 7-11-year-olds[END_REF] for evaluations of pictures by 7-to 11-yearold children. From a lifespan point of view, [START_REF] Keil | Changes in the sensitivity to appetitive and aversive arousal across adulthood[END_REF] showed that arousal ratings for negative words increase during adulthood. [START_REF] Grühn | Characteristics for 200 words rated by young and older adults: Age-Dependent Evaluations of German Adjectives (AGE)[END_REF] showed that older adults judged positive words as more arousing than young adults did. In terms of changes in arousal ratings by sex, boys generally rated words as more arousing than girls.

This was true for negative words at ages 7 and 9, positive words at ages 9 and 11 and neutral words at ages 7, 9 and 11. The only exception concerned 13-year-old adolescents, among Experiment 2) and [START_REF] Sharp | Children's subjective emotional reactivity to affective pictures: Gender differences and their antisocial correlates in an unselected sample of 7-11-year-olds[END_REF] reported no effect of sex on 7-to 11-year-old children's arousal ratings of pictures, and the literature on adults classically reports no effect of sex (e.g., [START_REF] Redondo | The Spanish adaptation of ANEW (Affective Norms for English Words)[END_REF] or more extreme arousal ratings by women than by men (e.g., [START_REF] Soares | The adaptation of the Affective Norms for English words (ANEW) for European Portuguese[END_REF], i.e., the opposite of what we found for children.

Conclusion

The objective of this work was to provide French researchers with valence and arousal norms for a corpus of words rated by 7-, 9-, 11-year-old children and 13-year-old adolescents as a function of sex. To do this, we asked participants in these four age groups to evaluate, using the paper-and-pencil version of the SAM [START_REF] Lang | Behavioral treatment and bio-behavioral assessment: Computer applications[END_REF], the valence and arousal of 720 words acquired by age 7 years. The resulting data were used to develop the FAN child database.

This work goes further than our previous French language study of children's emotional ratings [START_REF] Syssau | Children's emotional norms for 600 French words[END_REF] in two main ways. First, we obtained ratings for both arousal and valence; future French studies with children and adolescents will therefore be able to select emotional words on the basis of both dimensions. Second, we obtained ratings from both children and adolescents, thereby extending the developmental period for which emotional data will be available. In future work, we plan to expand the FAN child database to include a larger number of words, particularly negative words (only 7.4% of the words in the current database are negative). In order to provide experimental material suitable for studies involving children as young as 7 years, we were careful to choose only words that have been acquired at this age.

This constraint indirectly led us to select a much greater number of positive and neutral words than negative words. In fact, several studies have found that most of the words children learn at a young age are perceived as positive (Bonin, Méot et al., 2003;[START_REF] Citron | Evaluation of lexical and semantic features for English emotion words[END_REF]Moors et al., 2013).

In addition, it would be desirable to include ratings from other age groups between the ages of 13 years and adulthood. Obtaining valence and arousal evaluations for different periods of children's development would allow comparisons to be made with populations of children with emotional disorders. The FAN child database could also be extended to older adults, as emotional evaluations of words change throughout life.

To conclude, we hope that the FAN child database enables researchers to use emotional words suited to the age and the sex of their studies' participants, and to more reliably investigate the development of the relationship between emotion and cognition.

F

  Dr.: Université Paul-Valéry Montpellier, Laboratoire Epsylon, Route de Mende, 34 199 Montpellier Cedex 5, France, E-mail: catherine.monnier@univ-montp3.fr Arielle Syssau, Dr.: Université Paul-Valéry Montpellier, Laboratoire Epsylon, Route de Mende, 34 199 Montpellier Cedex 5, France, E-mail: arielle.syssau@univ-montp3.fr Short title: Children's affective norms for French words Address for correspondence: Catherine Monnier Université Paul-Valéry Montpellier, Laboratoire Epsylon, Route de Mende,

  large to show maximum control.

  developed the AGE database (Age-Dependent Evaluations of German Adjectives) which was compiled with ratings of 200 German adjectives by young (20-30 years of age) and older adults (65-76 years of age). Age-related differences were observed for 31% of the adjectives in valence ratings

  that the emotional words selected for a study are suited to the participants' age.

  sample included 674 children and 234 adolescents. Of the 674 children, 208 were secondgraders (109 girls; mean age = 7 years 7 months; range = 7 years 1 month-8 years 1 month; SD = 4 months), 204 were fourth-graders (107 girls; mean age = 9 years 7 months; range = 9 years 1 month-10 years 1 month; SD = 4 months) and 262 were sixth-graders (126 girls; mean age = 11 years 7 months; range = 11 years-12 years 2 months; SD = 4 months). The adolescents sample comprised 234 eighth-graders (119 girls; mean age = 13 years 8 months; range = 12 years 8 months-14 years 2 months; SD = 4 months). The entire sample was recruited from a number of elementary and middle schools located in or around the cities of Arles and Montpellier in the south of France. These areas include a broad range of Parental informed consent was obtained for all children and adolescents who participated voluntarily to the study.

  words (out of 12) were shared by only two age groups (grief, illness, pain and sadness).

  words should be increased in order to better understand the affective space and how it changes with age.

  the way children vs.adolescents and girls vs.boys perceived words on the calm-excited continuum.

  negative words as more arousing than boys did. These results deserve further investigation as they contrast with previous ones. In fact,McManis et al. (2001,

  Figure caption

  . Despite the increasing interest in emotional word processing within a developmental perspective, few norms providing children's or adolescents' emotional ratings have been published yet(Syssau & Monnier,

	2009 in French;
	F o
	r
	R e v i e w
	O n
	l y
	6

  . Studies on children have generally used pictures (i.e., photographs) instead of words. McManis, Bradley, Berg, Cuthbert, and Lang (2001, Experiment 1) and

	F o
	r
	R e v i e w
	O n
	l y
	13

  . A mixed three-way ANOVA with age (age 7 vs. age 9 vs. age 11 vs. age 13) and sex (girls vs. boys) as within-words factors and valence category (negative vs. positive vs. neutral) as a between-words factor was carried out on fact that girls rated negative words as more negative than boys did (M girls = 2.78, SD girls = .85; M boys = 3.49, SD boys = .95). The interaction between age and sex was not significant, F(3,156) = .37, p = .77. For the positive words, the ANOVA showed main effects

	p = .20, due to a significant decrease in due to the of both age group, F(3,843) = 70.9, p < .001, η 2 Hence, valence judgments varied according to both age and word valence categories.
	valence ratings between 7-and 11-year-old-children (ps< .001), and sex, F(1,281) = 36.2, p <
	.001, η 2 p = .11 with girls rating positive words as more positive than boys did (M girls = 7.05,
	SD girls = .93; M boys = 6.77, SD boys = .91). These main effects were qualified by a significant
	F o interaction, F(3,843) = 19.0, p < .001, η 2 boys rated positive words as less positive with increasing age (ps < .001) -except at ages 9 p = .06. Post hoc analyses (Tukey Test) indicated that F o
	r r
	valence ratings. This analysis revealed main effects of valence category, F(2,717) = 1381.1, p R e v i e w 001, η 2 p = .25, due to a R e v i e w
	< .001, η 2 < .001, η 2 F(6,2151) = 5.8, p < .001, η 2 p = .79, age group, F(3,2151) = 68.7, p < .001, η 2 p = .08, and sex, F(1,717) = 17.6, p p = .02, and significant interactions between age group and valence category, p = .01, sex and valence category, F(2,717) = 39.9, p < .001, η 2 p = .10, age group and sex, F(3,2151) = 10.5, p < .001, η 2 p = .01. There was also a significant O n l y significant decrease in valence ratings between 7-and 11-year-old-children (ps< .001) and sex, F(1, 384) = 5.77, p < .05, η 2 p = .01, with girls providing lower valence ratings than boys O n (M girls = 5.06, SD girls = .92; M boys = 5.16, SD boys = .84); and a significant age group by sex interaction, F(3, 1152) = 16.23, p < .001, η 2 p = .04. Further post hoc analyses showed that, for l y
	three-way interaction of Age Group X Sex X Valence Category, F(6,2151) = 2.7, p < .05, η 2 p boys, valence ratings of neutral words significantly decreased with increasing age between
	= .01. To examine this three-way interaction, three separate ANOVAs were conducted, one age 7 and age 11 (ps < .001); the 11-year-olds' valence ratings tended to be superior to those
	for each valence category, with the factors of age and sex. For the negative words, there was a of the 13-year-olds (p = .09). The same pattern of results was observed for girls (i.e., a
	main effect of age group, F(3,156) = 3.3, p < .05, η 2 p = .06. Further post hoc analysis (Tukey decrease of valence ratings with increasing age, ps < .01), except that 13-year-old girls
	16 17

Test) showed that 7-year-olds rated negative words as less negative than 13-year-olds, p < .05. The main effect of sex was also significant, F(1,52) = 59.5, p < 001, η 2 p = .53, and was and 11,when the difference did not reach significance. With regard to girls, valence ratings of positive words significantly decreased between 9-and 11-year-old children, p < .001.

Nonsignificant differences in valence ratings of positive words were observed between 7-and 9-year-olds and between 11-and 13-year-olds. Moreover, girls rated positive words as more positive than boys did at ages 7, 9 and 13, ps < .001. For the neutral words, the ANOVA revealed main effects of both age group, F(3, 1152) = 132.4, p < .

provided significantly higher ratings than 11-year-olds, p < .001. Moreover, girls provided significantly lower valence ratings than boys at both ages 7 and 11, ps < .001.

  Table 5 about here) -way ANOVA with age (age 7 vs. age 9 vs. age 11 vs. age 13) and sex (girls vs. boys) as within-words factors and valence category (negative vs. positive vs. neutral) as a between-words factor was carried out on arousal ratings. It revealed main effects of valence

	A mixed threecategory, F(2, 717) = 270.7, p < .001, η 2	p = .43, age group, F(3, 2151) = 49.9, p < .001, η 2	p =
	.06, and sex, F(1, 717) = 35.7, p < .001, η 2	p = .04, and significant interactions between age
	group and valence category, F(6, 2151) = 18.9, p < .001, η 2	p = .05, sex and valence category,
	F(2, 717) = 6.9, p < .01, η 2 p = .01, and age group and sex, F(3, 2151) = 43.2, p < .001, η 2	p =
	F o
	r
	R e v i e w
			O n
				l y
			18

  In line withMcManis et al. (2001), our study confirms that, from the age of 7 years on, children are able to use the pictorial 9-point SAM scale to rate words on the valence and arousal dimensions. Despite the significant correlations between the four age groups' ratings (i.e., age 7, age 9, age 11, and age 13), we found age-related differences. Although judgments of negative words were rather similar across the four age groups, positive words were judged as less pleasant and less arousing with increasing age, and neutral words gradually moved to the middle point of the scale. These differences show that of words may change with age. Therefore, it is important to systematically check that the emotional words selected for a study are suited to the age of the participants.

	the emotional perception
	F o
	r
	R e v i e w
	O n
	l y
	21

Table 1 .

 1 Bradley, M. M., Berg, W. K., Cuthbert, B. N., & Lang, P. J. (2001). Descriptive statistics for both valence and arousal ratings for 7-, 9-, 11-and 13-year-

	o
	r
	R e v i e w
	O n
	l y

Neshat-Doost, H. T., Moradi, A. R., Taghavi, M. R., Yule, W., & Dalgleish, T.

(2000)

. Lack of attentional bias for emotional information in clinically depressed children and

Table 2 .

 2 Words with the highest and lowest valence and arousal scores for each age group, according to total sample (All), girls and boys.

				Valence				Arousal
		WHS			WLS		WHS		WLS
		dolphin	8.77	misfortune	1.51	party	8.39	quietness	2.91
	7 all	television	8.61	temperature	2.07	surprise	7.91	furniture	2.94
		present	8.60	grief	2.12	present	7.86	distress	2.97
		spaghetti	9.00	misfortune	1.81	tiger	8.44	basin	2.69
	7 boys	top	9.00	dress	1.88	surprise	8.25	illness	2.70
		sandwich	8.94	grief	2.15	sandwich	8.06	tiredness	2.75
		present	9.00	misfortune	1.26	party	8.87	man	1.94
	7 girls	surprise	9.00	lie	1.26	snow	8.39	tear	1.94
		dolphin	8.89	nightmare	1.53	money	8.22	bird cage	2.00
		party	8.63	sadness	1.41	medal	8.21	beard	2.21
	9 all	present	8.56	mistake	1.53	party	8.07	gas	2.21
		circus	8.56	badness	2.25	circus	7.97	screw	2.22
		money	8.69	sadness	1.57	ski	8.86	sadness	1.57
	9 boys	circus	8.57	mistake	1.64	dragon	8.47	eyelid	1.94
		father	8.57	tear	2.14	medal	8.43	yesterday	2.00
		happiness	9.00	nightmare	1.20	dog	9.00	cap	1.10
	9 girls	party	9.00	sadness	1.28	party	8.60	pencil	1.50
		kindness	9.00	mistake	1.44	horse	8.33	screw	1.50
		party	8.70	sadness	1.67	surprise	8.33	dust pan	2.64
	11 all	laughter	8.69	illness	1.73	party	8.09	sadness	2.76
		joy	8.69	pain	1.76	ski	7.91	illness	2.80
		laughter	8.91	illness	1.50	surprise	8.77	sadness	2.10
	11boys	surprise	8.86	sadness	1.67	joy	8.73	quietness	2.33
		pancake	8.68	cigarette	1.73	laughter	8.41	illness	2.50
		present	8.93	pain	1.35	present	8.19	nap	1.85
	11 girls	party	8.86	misfortune	1.47	party	8.13	leek	2.00
		friend	8.79	suffering	1.53	dementia	8.00	tiredness	2.14
		laughter	8.57	illness	1.32	laughter	8.14	tiredness	2.50
	13 all	pancake	8.35	grief	1.54	surprise	8.03	nap	2.72
		mother	8.32	pain	1.65	joy	7.78	boredom	2.76
		laughter	8.25	illness	1.45	sport	8.21	distress	1.94
	13 boys	pleasure	8.23	badness	1.50	surprise	8.20	leek	2.25
		dream	8.21	sadness	1.50	laughter	7.90	nap	2.27
		pancake	8.94	illness	1.18	beach	8.41	tiredness	2.18
	13 girls	laughter	8.94	mosquito	1.18	laughter	8.41	sleep	2.65
		beach	8.88	pain	1.24	joy	8.12	boredom	2.86

Table 3 .

 3 Correlations between valence ratings for 7-, 9-, 11-and 13-year-olds.Note. Values on the diagonal are correlations between valence ratings for girls and boys. *p <

	Age

Table 4 .

 4 Correlations between arousal ratings for 7-, 9-, 11-and 13-year-olds.Note. Values on the diagonal are correlations between arousal ratings for girls and boys. *p < .01.

	Age

author for peer review, but marked to be sent

Author Note

The authors are grateful to the children and adolescents who participated in the study, and to their teachers for their cooperation. We thank Lisa Auvray, Julie Bégora, Margaux Bougier, Mégane Brenot, Marie-Frédérique Buy, Eva Engheben, Marine Fournel, Agnès Furlan, Nadège Maffre, Aurélie Sala and Raphaëlle Scappaticci for their valuable assistance in recruiting the participants and collecting the data. We also wish to thank our colleague Jean-Luc Roulin for his help with the statistical analyses.

F o r R e v i e w O n l y

34 Table 5. Mean valence and arousal ratings (and standard deviations) for the entire corpus and for subgroups of 53 negative, 385 neutral and 282 positive words. At each age level, data are given for the total sample (All) and for the girls and boys samples separately.


Gurvan Le Guernic
email: gurvan.le_guernic@irisa.fr

Anindya Banerjee

Thomas Jensen
email: jensen@irisa.fr

David A Schmidt
email: schmidt@cis.ksu.edu

Automata-based Confidentiality Monitoring ⋆

Non-interference is typically used as a baseline security policy to formalize confidentiality of secret information manipulated by a program. In contrast to static checking of non-interference, this paper considers dynamic, automaton-based, monitoring of information flow for a single execution of a sequential program. The monitoring mechanism is based on a combination of dynamic and static analyses. During program execution, abstractions of program events are sent to the automaton, which uses the abstractions to track information flows and to control the execution by forbidding or editing dangerous actions. The mechanism proposed is proved to be sound, to preserve executions of well-typed programs (in the security type system of Volpano, Smith and Irvine), and to preserve some safe executions of ill-typed programs.

Introduction

With the intensification of communication in information systems, interest in security has increased. This paper deals with the problem of confidentiality, more precisely with non-interference in sequential programs. This notion has first been introduced by Goguen and Meseguer [START_REF] Goguen | Security Policies and Security Models[END_REF] as the absence of strong dependency [START_REF] Cohen | Information Transmission in Computational Systems[END_REF].

A sequential program, P, is said to be non-interfering if the values of its public (or low) outputs do not depend on the values of its secret (or high) inputs. Formally, non-interference of P is expressed as follows: given any two initial input states σ 1 and σ 2 that are indistinguishable with respect to low inputs, the executions of P started in states σ 1 and σ 2 are low-indistinguishable; i.e. there is no observable difference in the public outputs. In the simplest form of the low-indistinguishable definition, public outputs include only the final values of low variables. In a more general setting, the definition may additionally involve intentional aspects such as power consumption, computation times, etc.

Static analyses for non-interference have been studied extensively and are well surveyed by Sabelfeld and Myers [START_REF] Sabelfeld | Language-Based Information-Flow Security[END_REF]. The novelty of the approach developed in this paper lies in:

1. its ability to give a judgment for a single execution alone and not only for all the executions of a program as a whole, 2. the monitoring mechanism used to ensure the confidentiality of secret data.

The bulk of previous research [START_REF] Banerjee | Stack-based Access Control and Secure Information Flow[END_REF][START_REF] Myers | JFlow: Practical Mostly-Static Information Flow Control[END_REF][START_REF] Pottier | Information flow inference for ML[END_REF][START_REF] Abadi | A Core calculus of Dependency[END_REF][START_REF] Barthe | Partial evaluation and non-interference for object calculi[END_REF][START_REF] Sabelfeld | A Per Model of Secure Information Flow in Sequential Programs[END_REF][START_REF] Mizuno | A Security Flow Control Algorithm and Its Denotational Semantics Correctness Proof[END_REF][START_REF] Volpano | A Sound Type System for Secure Flow Analysis[END_REF] associates the notion of non-interference to a program and develops static analyses that accept a program only if all its executions ensure the confidentiality of secrets. In contrast, this paper presents a dynamic analysis that uses the results of a static analysis: the dynamic analysis accepts or rejects a single execution of a program without necessarily doing the same for all other executions. The monitoring mechanism introduced guarantees confidentiality of secret data: either the monitor deduces that the current execution is non-interfering or it alters the behavior of the execution to obtain a non-interfering execution. The feasibility of this approach is shown by Hamlen et al. [START_REF] Hamlen | Computability classes for enforcement mechanisms[END_REF] who prove that any policy that can be statically asserted is enforceable using monitors which have access to the program's source.

There are three main benefits to using a monitoring mechanism rather than a static analysis. First, the security levels of inputs and outputs may be different from one execution to another; and a monitoring mechanism lets the security levels vary before each execution while still enforcing non-interference. For example, consider the effect of monitoring the Unix command more that takes as input a file divided into blocks and displays the blocks sequentially while waiting for the user to press a key between each block. A monitor for more would display a block only if the security level of the block is lower than the security level of the user; otherwise a default security message will be displayed. The monitor behavior depends on the particular file given as input, not on all possible inputs. This feature makes the monitoring mechanism a "lazy" polyvariant static analysis. A second benefit of monitors is their ability to safely use a program which has not been proved to respect a given property -maybe because one of its executions does not respect it; the monitor can run the safe executions -i.e. non-interferent executions -of an unsafe program. Finally, a monitoring mechanism follows the precise control flow of a program and thus calculation of control dependences (as might be performed in static analyses) can be more accurate. Section 5 contains an example showing how the work presented in this paper benefits from this improved accuracy.

A distinguishing feature of this dynamic analysis, compared to other program monitors, lies in the property overseen. Monitoring information flow is more complicated than, e.g., monitoring divisions by zero, since it must take into account not only the current state of the program but also the execution paths not taken during execution. For example, executions of the following programs (a) if h then x :=1 else skip and (b) if h then skip else skip in an initial state where h is false are equivalent concerning executed commands. In contrast, (b) is obviously a non-interfering program, while (a) is not. The execution of (a), with a low-equivalent initial state where h is true and x is 0, does not give the same final value for the low output x.

This paper presents the semantics of a confidentiality monitoring mechanism which is proved to be sound. This mechanism is useful, for example, for the exe-cution of programs downloaded from untrusted sources. Based on the semantics presented here, the monitoring mechanism can be implemented as a program transformation or as a virtual machine. To the best of our knowledge, this work is the first that presents a non-interference monitoring mechanism supported by formal proofs of soundness. Because of its dynamic nature, the mechanism is more expressive than the non-interference type system of Volpano et al. [START_REF] Volpano | A Sound Type System for Secure Flow Analysis[END_REF]. The next section defines terminology and introduces the scope of the work. Section 3 defines the monitoring semantics, which is automata-based. The properties of monitored executions and a comparison with type systems are contained in Sect. 4. Section 5 discusses related work and concludes. Proofs of theorems in this paper can be found in the companion technical report [START_REF] Guernic | Automaton-based Non-interference Monitoring[END_REF].

Language and Non-interference Monitoring Principles

The work presented aims at monitoring executions in order to enforce noninterference. The novelty and difficulty of this objective, compared to standard works on monitoring, lies in the monitoring mechanism. Monitors which see executions as a sequence of executed actions, like standard execution monitors [START_REF] Schneider | Enforceable security policies[END_REF], are not sufficient to enforce non-interference. This particular point is supported by works of McLean and Schneider. McLean [START_REF] Mclean | A General Theory of Composition for Trace Sets Closed Under Selective Interleaving Functions[END_REF] proved that information flow policies equivalent to non-interference are not properties; and Schneider [START_REF] Schneider | Enforceable security policies[END_REF] concluded that execution monitors are limited to the enforcement of properties. An information theoretic viewpoint why this is the case is given by Ashby:

"the information carried by a particular message depends on the set it comes from. The information conveyed is not an intrinsic property of the individual message." [16, § 7/5 page 124].

In order to enforce strong constraints on the information flow (like non-interference), the monitoring mechanism must be aware of the commands that are not evaluated by a given execution [START_REF] Vachharajani | RIFLE: An Architectural Framework for User-Centric Information-Flow Security[END_REF]Sect. 4.2.2]. This is part of the approach taken in the work presented in this paper. Conceptually, the monitor has a partial access to the target program's source code.

The notion of non-interference is intrinsically linked to the notion of information flow. This paper distinguishes three types of information flows: direct flows from the right part to the left part (or target) of assignments, explicit indirect flows from the context of execution to targets of executed assignments and implicit indirect flows from the context of execution to targets of un-executed assignments. The context of execution of a command is the set of entities that influence whether this command is executed or not.

The language: syntax and semantics. We study a simple imperative sequential language with loops and outputs. The work proposed in this paper can be extended to more complex languages. The main requirement is to have a precise knowledge of the control flow. The grammar of the studied language follows: The only constraints put on expressions (e) are that their evaluation must be deterministic and without side effects. Statements (S) are either sequences (S ; S), conditionals and while loops (B), or atomic actions (A). The output statement, "output e", is a generic statement used to represent any kind of public (or low) output, e.g., the action of printing the value of expression e on the terminal, producing a sound, or laying out a new window on the desktop. Only public outputs (i.e. outputs that are visible by standard users) are coded with the output statement; secret outputs are simply ignored. For example, sending a message m on a public network is represented by "output m," but sending an encrypted message n on a public network is abstracted by "output c", where c is a constant which emphasizes the fact that the content of an encrypted message cannot be revealed. Finally, sending a message on a private network, to which standard users do not have access, does not appear in the code of the programs studied.

Non-terminating executions leaks information through timing channels; such channels are not in the scope of this work. Consequently, the paper focuses on terminating executions, which allows the use of big-step operational semantics (also called natural semantics [START_REF] Kahn | Natural Semantics[END_REF]). The standard semantics of the language (Fig. 2) is described using evaluation rules, written σ ⊢ S o = ⇒ σ ′ . This reads as follows: statement S executed in state σ yields state σ ′ and output sequence o. Let D be the semantic domain of values, and X the domain of variables. The definition of program states (X → D) is extended to expressions, so that σ(e) is the value of the expression e in state σ. An output sequence is a word in D ⋆ .

σ ⊢ x := e ǫ = ⇒ σ[x → σ(e)] σ ⊢ output e σ(e) = == ⇒ σ σ ⊢ skip ǫ = ⇒ σ σ ⊢ S1 o 1 = = ⇒ σ ′ σ ′ ⊢ S2 o 2 = = ⇒ σ ′′ σ ⊢ S1 ; S2 o 1 o 2 = === ⇒ σ ′′ σ(e) = v σ ⊢ Sv o = ⇒ σ ′ σ ⊢ if e then Strue else Sfalse end o = ⇒ σ ′ σ(e) = true σ ⊢ S ; while e do S done o = ⇒ σ ′ σ ⊢ while e do S done o = ⇒ σ ′ σ(e) = false σ ⊢ while e do S done ǫ = ⇒ σ Figure 1.

Semantics outputting the values of low-outputs

The monitoring principles. Non-interference formalizes that there is no information flow from secret (or high) inputs to public (or low) outputs. For any program P, let S(P) ⊆ X be the set of variables whose initial values are the secret inputs. The only public output is the output sequence resulting from the execution. Contrary to the majority of works on non-interference, the values of the variables in the program state are never directly accessible (even at the end of the execution). Consequently, the values of the variables in the program state are never considered public outputs. We made this choice in order to be more flexible with regard to what is considered as publicly accessible. All, and only, the values which are visible to low users must be displayed using an output statement at the position inside the program where they are visible. If the desired behavior is that low users have access to the values of low variables at the end of the execution, those values must be output at the end of the program.

The main monitoring mechanism principle is based on information transmission notions of classical information theory [START_REF] Ashby | An Introduction to Cybernetics[END_REF]. Cohen states it as follows:

"information can be transmitted from a to b over execution of H [(a sequence of actions)] if, by suitably varying the initial value of a (exploring the variety in a), the resulting value in b after H's execution will also vary (showing that the variety is conveyed to b)." [START_REF] Cohen | Information Transmission in Computational Systems[END_REF]Sect. 3].

Hence, for preventing information flows from secret inputs to public outputs, the monitoring mechanism must ensure that variety -which can be seen as the property of variability or mutability -of the initial values of the variables in the set S(P) is not conveyed to the output sequence. This means that the monitoring mechanism, which works on a single execution, must ensure that even if the initial values of the variables belonging to S(P) were different, the output sequence would be identical.

The monitoring automaton has two jobs. The first is to track "variety," that is, to track entities (program variables, program counter, . . . ) having different values when the initial values of variables in S(P) are different. Its second job is to prevent conveying of variety to the output sequence, that is, to ensure that the output sequence would be identical for any execution having the same public inputs (the initial values of the variables not in S(P)). To complete the first job, the states of the monitoring automaton are pairs. The first element of this pair is a set of variables. At any step of the computation, it contains all the variables that have "variety" (i.e., have a different value if the initial values of the variables belonging to S(P) are different). The second element of the pair is a word in {⊤, ⊥} ⋆ . This word tracks "variety" in the context of the execution (the value of the program counter). The second job (avoiding transfer of variety to the output sequence) is accomplished by authorizing, denying, or editing output statements depending on the current state of the monitoring automaton.

Definition of the Monitoring Mechanism

The monitoring mechanism is divided into two main elements. The first is an automaton similar to edit automata [START_REF] Ligatti | Edit automata: enforcement mechanisms for run-time security policies[END_REF]. Inputs to the automaton are abstractions of the actions accomplished during an execution. The automaton tracks information flow and authorizes, forbids or edits the actions of the monitored execution to enforce non-interference. The second element of the monitoring mechanism is a semantics of monitored executions that merges together the behavior of the monitoring automaton and that of the standard output semantics in Fig. 2.

The Automaton

The automaton's transition function is independent of the monitored program, but the initial automaton's state is not. The automaton enforcing non-interference is the tuple

A(P) = (Q, Φ, Ψ, δ, q 0 ) where: Q is a set of states (Q = 2 X ×{⊤, ⊥} ⋆ ), Φ is the input alphabet, Ψ is the output alphabet, δ is a transition function (Q × Φ) -→ (Ψ × Q), and q 0 ∈ Q is the start state (q 0 = (S(P), ǫ)).
An automaton state is a pair (V, w). V ⊆ X contains all the variables whose current value may have been influenced by the initial values of the variables in S(P); w, which belongs to {⊤, ⊥} ⋆ , can be seen as a stack that tracks variety in the context of the execution. In our approach, the context consists of only the program counter's value. If ⊤ occurs in w, then the statement executed belongs to a conditional whose test may have been influenced by the initial values of S(P). Hence the statement may not have been executed for a different choice of initial values of S(P). The input alphabet of the automaton (Φ) consists of abstractions of events that occur during an execution. It is defined below. The output alphabet (Ψ ) is composed of the following: ACK, OK, N O, and atomic actions of the language. An atomic action is the answer of the monitoring automaton whenever an action other than the current one has to be executed.

Figure 2 specifies the transition function of the automaton. A transition is written (q, φ) ψ -→ q ′ . It reads as follows: in the state q, on reception of the input φ, the automaton moves to state q ′ and outputs ψ. Let V(e) be the set of variables occurring in e and modified(S) be the set of all variables whose value may be modified by an execution of S.

Figure 2 shows that the automaton forbids (N O) or edits (output θ) only executions of output statements. For other inputs, it merely tracks, in the set V , the variables that may contain secret information (have variety), and it tracks, in w, the variety of the branching conditions.

Inputs "branch e" are generated at exit point of conditionals. On reception of such inputs in state (V, w), the automaton checks if the value of the branching condition (e) might be influenced by the initial values of S(P): only if some variable occurring in e belongs to V . If this is the case then the automaton pushes ⊤ at the end of w; otherwise it pushes ⊥. In either case, the automaton acknowledges the reception of the input by outputting ACK.

Whenever execution exits a branch -which is a member of a conditional c -the input "exit" is sent to the automaton. The last letter of w is then removed. As any such input matches a previous input "branch e" -generated by the same conditional c -which adds a letter to the end of w, the effect of "exit" is to restore the context to its state before the conditional was processed.

Inputs "not S" are generated at exit point of conditionals. It means that, due to the value of a previous branching condition, statement S has not been

((V, w), branch e) ACK ---→ (V, w⊤) iff V(e) ∩ V = ∅ ((V, w), branch e) ACK ---→ (V, w⊥) iff V(e) ∩ V = ∅ ((V, wa), exit) ACK ---→ (V, w) ((V, w), not S) ACK ---→ (V ∪ modified(S), w) iff w ∈ {⊥} ⋆ ((V, w), not S) ACK ---→ (V, w) iff w ∈ {⊥} ⋆ ((V, w), skip) OK --→ (V, w) ((V, w), x := e) OK --→ (V ∪ {x}, w) iff w ∈ {⊥} ⋆ or V(e) ∩ V = ∅ ((V, w), x := e) OK --→ (V \ {x}, w) iff w ∈ {⊥} ⋆ and V(e) ∩ V = ∅ ((V, w), output e) OK --→ (V, w) iff w ∈ {⊥} ⋆ and V(e) ∩ V = ∅ ((V, w), output e) output θ ------→ (V, w) iff w ∈ {⊥} ⋆ and V(e) ∩ V = ∅ ((V, w), output e) N O --→ (V, w) iff w ∈ {⊥} ⋆ Figure 2.
Transition function of monitoring automata executed. This detects implicit indirect flows. On input "not S" in state (V, w), the automaton verifies whether S may have been executed with differing values for S(P). This is the case if the context of execution carries variety (i.e. if w does not belong to {⊥} ⋆ ). Let (V ′ , w ′ ) be the new state of the automaton. If the context carries variety then V ′ is the union of V with the set of variables whose values may be modified by an execution of S. Otherwise, nothing is done. Atomic actions (assignment, skip or output) are sent to the automaton for validation before their execution. The atomic action skip is considered safe because the non-interference definition considered in this work is not time sensitive. Hence the automaton always authorizes its execution by outputting OK.

When executing an assignment (x := e), two types of flows are created. The first is a direct flow from e to x. The second flow is an explicit indirect flow from the context of execution to x. For example, the execution of the assignment in "if b then x := y else skip end" creates such a flow from b to x. Both forms of flows are always created when an assignment is executed. What is important is to check if secret information is carried by one of the flows (i.e., if variety in S(P) is conveyed by one of the flows). Hence, on input x := e, the automaton checks if the value of the origin of one of those two flows is influenced by the initial values of S(P). For instance, if b is true in "if b then x := y else skip end", y is the origin of a direct flow to x and b is the origin of an explicit indirect flow to x. The origin of the explicit indirect flow is influenced by S(P) only if w contains ⊤, meaning that the condition of a previous (but still active) conditional was potentially influenced by the initial values of S(P). The origin of the direct flow is influenced by S(P) only if V(e) and V are not disjoint. If the value of e is influenced by the initial values of S(P) then at least one of the variables appearing in e has been influenced by S(P). Such variables are members of V . Let (V ′ , w ′ ) be the new automaton state after the transition. If the origin of either the direct flow or the explicit indirect flow is influenced by the initial values of S(P), then x (the variable modified) is added to V : V ′ = V ∪ {x}. On the other hand, if none of the origins are influenced by the initial values of S(P), then x receives a new value which is not influenced by S(P). In that case, V ′ equals V \ {x}. This makes the mechanism flow-sensitive.

The rules for the automata input, "output e," prevent bad flows through two different channels. The first one is the actual content of what is output. In a public context, (w ∈ {⊥} ⋆ ), if the program tries to output a secret (i.e., the intersection of V and the variables in e is not empty), then the value of the output is replaced by a default value. This value can be a message informing the user that, for security reasons, the output has been denied. To do so, the automaton outputs a new output statement to execute in place of the current one. The second channel is the behavior of the program itself. This channel exists because, depending on the path followed, some outputs may or may not be executed. Hence, if the automaton detects that this output may not be executed with different values for S(P) (the context carries variety) then any output must be forbidden; and the automaton outputs N O.

The Semantics

The semantics merging the standard output semantics in Fig. 2 with the monitoring automaton is given in Fig. 3. The semantics is described using evaluation rules written: (q, σ) S o = ⇒ (q ′ , σ ′ ) . This reads: statement S executed in automaton state q and program state σ yields automaton state q ′ , program state σ ′ , and output sequence o. There are three rules for atomic actions: skip, x := e and output e. There is one rule for each possible automaton answer to the action executed. Either the automaton authorizes the execution (OK), denies the execution (N O), or replaces the action by another one. The rules use the standard semantics (Fig. 2) when an action must be executed. In the case where the execution is denied, the evaluation omits the current action (as if the action was "skip"). For the case where, on reception of input A, the monitoring automaton returns A ′ , the monitoring semantics executes A ′ instead of A. Note from Fig. 2, that A ′ can only be the action that outputs the default value (output θ).

For conditionals, the evaluation begins by sending to the automaton the input "branch e" where e is the test of the conditional. Then, the branch designated by e is executed (in the case of a while statement whose test is false, the branch executed is "skip"). The execution follows by sending the automaton input "not S" where S is the branch not executed (in case of a while statement whose test is true, what happens is equivalent to sending the automaton input "not skip"). Finally, the input "exit" is sent to the automaton and the execution proceeds as usual. In the case of a while statement with a condition equals to true, the execution proceeds by executing the while statement once again.

(q, A) OK ---→ q ′ σ ⊢ A o = ⇒ σ ′ (q, σ) A o = ⇒ (q ′ , σ ′ ) (q, A) A ′ --→ q ′ σ ⊢ A ′ o = ⇒ σ ′ (q, σ) A o = ⇒ (q ′ , σ ′ ) (q, A) N O ---→ q (q, σ) A ǫ = ⇒ (q, σ) (q, σ) S 1 o 1 = = ⇒ (q 1 , σ 1 ) (q 1 , σ 1 ) S 2 o 2 = = ⇒ (q 2 , σ 2 ) (q, σ) S 1 ; S 2 o 1 o 2 = === ⇒ (q 2 , σ 2 ) σ(e) = v (q, branch e) ACK ----→ q 1 (q 1 , σ) Sv o = ⇒ (q 2 , σ 1 ) (q 2 , not S¬v) ACK ----→ q 3 (q 3 , exit) ACK ----→ q 4 (q, σ) if e then Strue else Sfalse end o = ⇒ (q 4 , σ 1 )
σ(e) = true (q, branch e)

ACK ----→ q 1 (q 1 , σ) S o l = = ⇒ (q 2 , σ 1 ) (q 2 , exit) ACK ----→ q 3 (q 3 , σ 1 )
while e do S done ow = = ⇒ (q 4 , σ 2 ) (q, σ) while e do S done

o l ow = === ⇒ (q 4 , σ 2 )
σ(e) = false (q, branch e)

ACK ----→ q 1 (q 1 , not S) ACK ----→ q 2 (q 2 , exit) ACK ----→ q 3 (q, σ)
while e do S done ǫ = ⇒ (q 3 , σ)

Figure 3. Semantics of monitored executions

Example of monitored execution

Table 1 is an example of monitored execution. The monitored program is given in column "Program P". Its inputs are h and l. The execution monitored is the one for which h equals true and l equals 22. S(P), the set of secret inputs of P, is {h}. So the initial state of the automaton is ({h}, ǫ). Column "input" contains the inputs which are sent to the automaton, "output" contains the output sent back to the semantics, and "new state" shows the new internal state of the automaton after the transition. Finally, the last column shows the actions which are really fulfilled by the monitored execution.

In this example, there are only two alterations of the execution (on lines 5 and 8). The first occurs when the program attempts to output a value influenced by S(P)output y. At this point of the execution, the value contained in y has been influenced by the initial values of the variables belonging to S(P). This is known because y belongs to the first element of the automaton state before execution of line 5. Consequently, the automaton disallows the output of this value. However, the fact of outputting something in itself is safe because the context of execution (the program counter) has not been influenced by S(P) (the second element of the automaton state belongs to {⊥} ⋆ ). Hence, the automaton replaces the current action by an output action whose value is a default one (therefore not influenced by S(P)). This value lets the user know that an output action has been denied for security reasons.

On line 8, the program tries to output something while the current context of execution has been influenced by S(P). Hence, if the output occurs, the sequence Table 1. Example of the automaton evolution during an execution.

generated by the execution is influenced by some secret values. Therefore the automaton denies any output; it does not even give another action to execute in place of the current one. The semantics does as if the action was "skip".

Properties of the Monitoring Mechanism

A first theorem states soundness: any monitored execution is a non-interfering execution. A second one states "pseudo-completeness": the monitor does not alter observable behavior of a non-trivial set of non-interfering executions. Complete proofs of these theorems can be found in the companion technical report [START_REF] Guernic | Automaton-based Non-interference Monitoring[END_REF].

Soundness. The soundness property is based on the notion of non-interference between the secret inputs and the output sequence of an execution. An execution is considered safe -knowing that the program's source is public -if and only if it does not convey the variety in its secret inputs to the sequence output, that is, if the secret inputs have no influence on the execution's outputs. For all programs P, with set of secret inputs S(P), and value store σ, let [[P]]σ be the output sequence obtained via the monitored execution of P in the initial state ((S(P), ǫ), σ). This definition is formally stated as follows:

[[P]]σ = o if and only if ∃ q ′ , σ ′ : ((S(P), ǫ), σ) P o = ⇒ (q ′ , σ ′ )
The following theorem states that every monitored execution is safe, i.e. it is non-interfering. Let X = be an equivalence relation between value stores. Let σ 1 X = σ 2 assert that σ 1 and σ 2 are indistinguishable for X, i.e., σ 1 and σ 2 associate the same value to every variable in X. Let X c be the complement of set X in X.

Theorem 1 (Soundness: monitored executions are non-interfering). For all programs P, whose set of secret inputs is S(P), and value stores σ 1 and σ 2 ,

σ 1 S(P) c = σ 2 ⇒ [[P]]σ 1 = [[P]]σ 2
Proof (sketch). The proof -which can be found in [START_REF] Guernic | Automaton-based Non-interference Monitoring[END_REF] -goes by induction on the derivation tree of [[P]]σ 1 . It relies on the fact that, after any "step" in the evaluation of [[P]]σ 1 and "equivalent step" in the evaluation of [[P]]σ 2 , the automaton states of both executions are equal and the value stores are indistinguishable for the complement of the first element of the automaton states.

Pseudo-completeness. Thus any terminating monitored execution is non-interfering. However, to achieve this goal, the monitor sometimes modifies the output sequence of the execution. The sequence of outputs resulting from the execution of program P with initial state σ might differ according to the semantics used, the standard one (Fig. 2) or the monitoring semantics (Fig. 3). The sequel gives a lower bound on the set of non-interfering executions on which the monitoring mechanism has no impact. It shows that the mechanism proposed in this paper preserves the output sequence of any execution of a program which is well-typed under a security type system similar to the one of Volpano et al. [START_REF] Volpano | A Sound Type System for Secure Flow Analysis[END_REF].

Figure 4 shows the security type system. It is the same one as that of Volpano et al. [START_REF] Volpano | A Sound Type System for Secure Flow Analysis[END_REF] except for a small modification of the typing environment and the addition of a rule for output statements (which are not in the language of [START_REF] Volpano | A Sound Type System for Secure Flow Analysis[END_REF]). The typing environment, γ, prescribes types for identifiers and is extended to handle expressions. γ(e) is the type of the expression e in the typing environment γ. The lattice of types used has only two elements and is defined using the reflexive relation ≤ (L ≤ H). L is the type for public data and H the type for secrets. A program P is well-typed if it can be typed under a typing environment γ in which every secret input is typed secret (i.e. ∀x ∈ S(P), γ(x) = H).

γ(e) = τ ′ τ ′ ≤ τ γ ⊢ e : τ γ(x) = τ ′ γ ⊢ e : τ ′ τ ≤ τ ′ γ ⊢ x := e : τ cmd τ ≤ H γ ⊢ skip : τ cmd γ ⊢ e : L γ ⊢ output e : L cmd γ ⊢ S1 : τ cmd γ ⊢ S2 : τ cmd γ ⊢ S1 ; S2 : τ cmd γ ⊢ e : τ ′ γ ⊢ S1 : τ ′ cmd γ ⊢ S2 : τ ′ cmd τ ≤ τ ′ γ ⊢ if e then S1 else S2 end : τ cmd γ ⊢ e : τ ′ γ ⊢ S : τ ′ cmd τ ≤ τ ′
γ ⊢ while e do S done : τ cmd The problem of non-interference is neither dynamically nor statically decidable. Consequently, the monitoring mechanism proposed in this paper is not complete or transparent. However, Theorem 2 states that the monitoring mechanism does not alter executions of well-typed programs. To show that the inclusion is strict, consider the following program: x := h; x :=0; output x. h is the only secret input. Every execution is non-interfering. But as the type system is flow insensitive, this program is ill-typed. However, the monitoring mechanism does not interfere with the outputs of this program while still guaranteeing that any monitored execution is non-interfering.

Theorem 2 (Monitoring preserves type-safe programs). For all programs P with secret inputs S(P), typing environments γ with variables belonging to S(P) typed secret, types τ , and value stores σ and σ ′ ,

γ ⊢ P : τ cmd σ ⊢ P o = ⇒ σ ′ ⇒ [[P]]σ = o
Proof (sketch). The proof goes by induction on the derivation tree of the unmonitored evaluation of P. It relies on the fact that the unmonitored evaluation of any well-typed command is matched by an equivalent monitored evaluation.

Conclusion

This paper addresses the security problem of confidentiality from the point of view of non-interference. It presents a monitoring mechanism enforcing noninterference of any execution. This monitoring mechanism is based on a semantics that communicates with a security automaton. During the execution, the semantics generates automaton inputs abstracting the events occurring. The automaton tracks the flows of information between the secret inputs and the current value of the program's variables. It also validates the execution of atomic actions (mainly outputs) to ensure confidentiality of the secret inputs.

Because the monitoring mechanism enforces non-interference, it significantly differs from standard monitors [START_REF] Schneider | Enforceable security policies[END_REF][START_REF] Viswanathan | Foundations for the Run-time Analysis of Software Systems[END_REF]. Usually, monitors are only aware of statements which are really executed. With the mechanism proposed, when exiting a conditional, the branch which has not been executed is analyzed. This takes into account implicit indirect flows between the test of a conditional and those variables whose values would be modified by the execution of the branch which is not executed. As noticed -but not elaborated on -by Vachharajani et al. [START_REF] Vachharajani | RIFLE: An Architectural Framework for User-Centric Information-Flow Security[END_REF]Sect. 4.2.2], this feature is required in order to enforce non-interference.

Section 4 shows that any monitored execution is non-interfering. Thus a user having access to the low outputs of a monitored execution is unable to deduce anything about the values of the secret inputs. In addition, the monitoring mechanism is proved not to alter executions of a program which is well-typed under a type system similar to the one of Volpano, Smith and Irvine [START_REF] Volpano | A Sound Type System for Secure Flow Analysis[END_REF].

Future work, which is under way, addresses the extension of the monitoring mechanism to a concurrent setting that includes a synchronization command. The goal is to achieve more precision than a type system equivalent to, e.g., the concurrent one due to Smith and Volpano [START_REF] Smith | Secure Information Flow in a Multi-threaded Imperative Language[END_REF].

Related work.

Reference monitors is a widely studied area [START_REF] Schneider | A Language-Based Approach to Security[END_REF][START_REF] Erlingsson | The Inlined Reference Monitor Approach to Security Policy Enforcement[END_REF]. The use of automata to monitor "good behaviors" led Schneider to formalize reference monitors as truncation automata that enforce safety properties [START_REF] Schneider | Enforceable security policies[END_REF]; and develop, with Erlingsson, a monitoring tool called SASI [START_REF] Erlingsson | SASI Enforcement of Security Policies: A Retrospective[END_REF]. Among other works on the subject, Hamlen et al. worked on an extension to the .NET Common Intermediate Language called Mobile [START_REF] Hamlen | Certified In-lined Reference Monitoring on[END_REF]. Their extension supports a type system that certifies in-lined reference monitors. In a successful attempt to increase the power of monitors, Ligatti et al. [START_REF] Ligatti | Edit automata: enforcement mechanisms for run-time security policies[END_REF] introduced monitors, based on edit automata, able to modify the sequence of actions executed and to enforce infinite renewal properties [START_REF] Ligatti | Enforcing Non-safety Security Policies with Program Monitors[END_REF]. Such properties include every safety property, some liveness properties and some properties that are neither. Because such monitors are limited to the enforcement of trace properties, it is not immediately obvious that they can handle non-interference (which is not a trace property).

The vast majority of research on non-interference concerns static analyses and involves type systems [START_REF] Sabelfeld | Language-Based Information-Flow Security[END_REF][START_REF] Pottier | Information flow inference for free[END_REF]. Some "real size" languages together with security type system have been developed (for example, JFlow/JIF [START_REF] Myers | JFlow: Practical Mostly-Static Information Flow Control[END_REF] and FlowCaml [START_REF] Pottier | Information flow inference for ML[END_REF]).

Information flow monitoring is not as popular as static analyses for information flow, but there has been interesting research. For example, RIFLE [START_REF] Vachharajani | RIFLE: An Architectural Framework for User-Centric Information-Flow Security[END_REF] is a complete runtime information flow security system; which however lacks formal analysis and proofs. The majority of those works, including RIFLE, does not take into consideration flows created by un-executed commands. It has been shown [START_REF] Guernic | Monitoring Information Flow[END_REF] that this feature can be used to gain information about secrets in some cases. The only exception known by the authors -in the domain of information flow monitoring -is the work by Masri et al. [START_REF] Masri | Detecting and Debugging Insecure Information Flows[END_REF] which presents a dynamic information flow analysis for structured or unstructured languages. However, their work does not study deeply the dynamic correction of "bad" flows and lacks formal statements and proofs of the correctness of the correction mechanism. The solution proposed is to stop the execution as soon as a potential flow from a secret data to a public sink is detected. In some cases, this can create a new covert channel revealing secret information -see, e.g., [START_REF] Guernic | Monitoring Information Flow[END_REF].

Benefits of monitoring compared to static analyses. Monitoring an execution has a cost. So, what are the main benefits of non-interference monitoring compared to static analyses? The first concerns the possibility that a monitoring mechanism can be used to change the security policy for each execution. In the majority of cases, running a static analysis before every execution would be more costly than using a monitor. The second reason is that non-interference is a rather strong property. Many programs are rejected by static analyses of non-interference. In such cases it is still possible to use a monitoring mechanism with the possibility that some executions will be altered by the monitoring mechanism. However behavior alteration is an intrinsic feature of any monitoring mechanism. Monitoring non-interference ensures confidentiality while still allowing testing with regard to other specifications using unmonitored executions as perfect oracleat least as perfect as the original program.

There are two main reasons why it is interesting to use a non-interference monitor on a program rejected by a static analysis. The first one lies in the granularity of the non-interference property. Static analyses have to take into consideration all possible executions of the program analyzed. This implies that if a single execution is unsafe then the program (thus all its executions) is rejected. Whereas, even if some executions of a program are unsafe, a monitor still allows this program to be used. The unsafe executions, which are not useful, are altered to respect the desired property while the safe executions are still usable.

The second one is that a monitoring mechanism may be more precise than static analyses because during execution the monitoring mechanism gets some accurate information about the "path behavior" of the program. As an example, let us consider the following program where h is the only secret input and l the only other input (a public one).

i f ( t e s t 1 ( l ) ) then tmp := h e l s e s k ip end; i f ( t e s t 2 ( l ) ) then x := tmp e l s e s k ip end; output x Without information on test1 and test2 (and often, even with), a static analysis would conclude that this program is unsafe because the secret input information could be carried to x through tmp and then to the output. However, if test1 and test2 are such that no value of l makes both predicates true, then any execution of the program is perfectly safe. In that case, the monitoring mechanism would allow any execution of this program. The reason is that, l being a public input, only executions following the same path as the current execution are taken care of by the monitoring mechanism. So, for such configurations where the branching conditions are not influenced by the secret inputs, a monitoring mechanism is at least as precise as any static analysis -and often more precise.

A

  ::= x := e | skip | output e B ::= if e then S else S end | while e do S done S ::= S ; S | B | A

  modified(x := e) = {x} modified(output e) = modified(skip) = ∅ modified(S1 ; S2) = modified(S1) ∪ modified(S2) modified(if e then S1 else S2 end) = modified(S1) ∪ modified(S2) modified(while e do S done) = modified(S)

Figure 4 .

 4 Figure 4. The type system used for comparison

Acknowledgments. The authors are grateful to the reviewers for their remarks; and to Jay Ligatti, David Naumann and Andrei Sabelfeld for insightful and helpful comments on an earlier version of this paper.

⋆ Banerjee and Le Guernic were partially supported by NSF grants CNS-0627748, CNS-0209205, CCF-0296182 and ITR-0326577. Schmidt was partially supported by NSF grants ITR-0326577 and ITR-0086154. Le Guernic was also partially supported by the PoTestAT project (ACI Sécurité).