Valentine Weydert

Pierre Desmet

Caroline Lancelot-Miltgen

Convincing consumers to share personal data: double-edged effect of offering money

Keywords: Control, Privacy, Regulatory focus, Data sharing, Monetary compensation

published or not. The documents may come

Convincing consumers to share personal data:

double-edged effect of offering money

Modern firms must leverage unbiased customer information to implement successful interactive marketing strategies and increase their marketing efficiency by offering more targeted and personalized offers [START_REF] Hofacker | Big data and consumer behavior: Imminent opportunities[END_REF].

Firms can build their own database using transactional data they gather from marketplaces as well as behavioral data from their own website. This data helps companies to better understand the customers already involved with their brands. Increasingly, to achieve this and appeal to prospective customers, they rely on data brokers' datasets. Third party data providers aggregate transactional and behavioral data from a network of retailers' and publishers' websites. They build strategic marketable audiences and then sell them on the digital and advertising markets.

Although a typical data broker business model is based on Business-to-Business relationships with online entities, more and more restrictive data protection legislation (such as the EU General Data Protection Regulation) requires active consent from consumers and calls on data brokers to display the name of their business partners before they can collect data. This regulation has already had an adverse effect on the volume of data collected and on its use. An alternative business model is used by some third party data providers such as Datacoup and Wibson, based on a direct relationship with internet users, i.e. a Business-to-Consumer model. To motivate internet users to share their personal information, these companies use compensation incentives such as control over data usage or money.

Offering control over data collection and usage should indeed alleviate privacy concerns [START_REF] Phelps | Privacy concerns and consumer intention to provide personal information[END_REF] as control is increasingly perceived as a right [START_REF] Novak | Understanding privacy concerns[END_REF].

Offering money is also a good way to increase data disclosure [START_REF] Gabisch | The impact of compensation on information ownership and privacy control[END_REF].

However, this technique may also be considered as an indicator of the profit that can be extracted from the data, thus possibly exacerbating privacy concerns [START_REF] Andrade | Self-disclosure on the web: the impact of privacy policy, reward and company reputation[END_REF][START_REF] Carrascal | Your browsing behavior for a big mac: economics of personal information online[END_REF] and reducing consumers' motivation to disclose their data.

As data brokers have already experienced issues with privacy [START_REF] Otto | The ChoicePoint dilemma: How data brokers should handle the privacy of personal information[END_REF] and data collection practices have only increased consumers' privacy concerns in recent years [START_REF] Baruh | Online privacy concerns and privacy management: A meta-analytical review[END_REF], identifying specific factors that could maximize consumers' willingness to share their personal data with data brokers is crucial, especially as research in this area is still sparse (e.g. [START_REF] Jai | Privacy versus reward: Do loyalty programs increase consumers' willingness to share personal information with third-party advertisers and data brokers[END_REF]. This paper addresses this research question: for data brokers, under which conditions could offering some form of compensation (specifically, control and money) be beneficial or, on the contrary, counterproductive for data sharing? Understanding the boundary conditions under which compensation strategies (through control or money) may work is crucial, especially as data brokers are mostly unknown to consumers. As trust cannot play a strong role here, consumers assess the situation and decide whether (or not) to share data based on other contextual or individual characteristics. This research focuses on two such variables (i.e. the level of sensitivity of the data collected and the level of regulatory focus) through the lens of regulatory focus theory. This theory serves to highlight the kind of focus (prevention-or promotion-based) individuals adopt when weighing the perceived sensitivity of the requested data against the perceived value of the bargaining offer. More specifically, this theory argues that individuals have a propensity to value concern, as a proxy of control, over personal gain, epitomized in this study by monetary compensation.

This research makes three main contributions. First, it addresses consumers' willingness to share data with firms that have not been studied previously, namely, data brokers. While the previous literature mostly focuses on known first parties, we study decision-making related to data sharing in the context of unknown third parties. Second, we study the conditions under which the positive effect of monetary compensation could be reversed, for example with money becoming an indicator of the value of the information collected. Third, this research also answers the call for the re-contextualization of privacy research [START_REF] Lowry | Why security and privacy research lies at the centre of the information system (IS) artefact: Proposing a bold research agenda[END_REF] and the diversification of cultural contexts [START_REF] Bélanger | Privacy in the digital age: A review of information privacy research in information systems[END_REF]. Indeed, both culture (e.g. [START_REF] Miltgen | Cultural and generational influences on privacy concerns: A qualitative study in seven European countries[END_REF] and regulation (e.g., [START_REF] Markos | Information sensitivity and willingness to provide continua: A comparative privacy study of the United States and Brazil[END_REF] are strong determinants of privacy concerns and data sharing. Up to now, privacy research has been heavily reliant on student-based and USA-centric samples. This research offers the opportunity to study privacy using non-US consumers.

The following section contains the theoretical framework, featuring several enablers and moderators of data sharing. After detailing the methodology used to collect the data, the key results are presented. The article concludes with some theoretical and managerial implications and suggestions for further research.

Theoretical framework and hypotheses

The key drivers of monetary compensation and control function as motivational tools to influence data sharing. Both perceived data sensitivity and individual regulatory focus should in turn moderate this process. In particular, Regulatory Focus theory considers a contextual evaluation of losses and gains [START_REF] Martin | The role of data privacy in marketing[END_REF].

Prior research emphasizes the potential efficiency of providing control over data sharing (e.g. [START_REF] Taylor | Privacy concern and online personalization: the moderating effects of information control and compensation[END_REF]. Increased data transparency is appealing [START_REF] Dommeyer | What consumers know and what they do: An investigation of consumer knowledge, awareness and use of privacy protection[END_REF], and offering active control over the collection and use of data is a key motivation that prompts consumers to disclose private data [START_REF] Gabisch | The impact of compensation on information ownership and privacy control[END_REF]. Such control should decrease privacy concerns [START_REF] Phelps | Privacy concerns and consumer intention to provide personal information[END_REF] and increase people's willingness to share personal information [START_REF] Phelps | Privacy concerns and consumer intention to provide personal information[END_REF], even sensitive information [START_REF] Prince | Do consumers want to control their personal data? Empirical evidence[END_REF].

However, the reassuring effect of control may depend on the kind of control offered. Some studies found no effect of control on either privacy concerns or disclosure [START_REF] Ward | Do incentives matter? An examination of online privacy concerns and willingness to provide personal and financial Information[END_REF], specifically when passive control is offered such as through the display of privacy policy or seals on websites [START_REF] Milne | Strategies for reducing online privacy risks: Why consumers read (or don't read) online privacy policies[END_REF]. In our study, we use a scenario that gives respondents active control over the collection of their data, i.e. they know exactly which data is being collected and the purpose of its usage. We thus assume this active control will positively influence respondents' decision to share their data with the data broker. Therefore: H1a: Offering active control increases willingness to share personal data.

While monetary compensation could be considered as an indicator of the profit companies can extract from consumers' data, thus reducing their intention to disclose data (Gomez-Barroso, 2018;[START_REF] Marreiros | Now that you mention it: A survey experiment on information, inattention and online privacy[END_REF], it may also be perceived more positively. In particular, based on the privacy calculus, consumers should agree to share personal data in exchange for some monetary compensation [START_REF] Phelps | Privacy concerns and consumer intention to provide personal information[END_REF][START_REF] Li | Understanding situational online information disclosure as a privacy calculus[END_REF]. Some studies have indeed concluded that offering a monetary reward could increase personal information disclosure [START_REF] Acquisti | Privacy in electronic commerce and the economics of immediate gratification[END_REF][START_REF] Hann | Analyzing online information privacy concerns: An information processing theory approach[END_REF][START_REF] Mukherjee | Money makes you reveal more: consequences of monetary cues on preferential disclosure of personal information[END_REF]. Consumers also seem to appreciate companies offering money in exchange for their personal data [START_REF] Gabisch | The impact of compensation on information ownership and privacy control[END_REF]. Therefore, following mainstream economic research in this area, we propose: H1b: Offering monetary compensation increases willingness to share personal data.

The sensitivity of the data collected is a widely studied situational factor that influences data sharing [START_REF] Malhotra | Internet users' information privacy concerns (IUIPC): The construct, the scale and a causal model[END_REF]. Perceived data sensitivity is situational and varies with the context, the nature of the data collected [START_REF] Li | Understanding situational online information disclosure as a privacy calculus[END_REF], and the individual sensitivities to personal data exploitation [START_REF] Acquisti | Privacy and rationality in individual decision making[END_REF]. For example, demographic and lifestyle data tend to be seen as less sensitive than financial or health-related information [START_REF] Phelps | Privacy concerns and consumer intention to provide personal information[END_REF]. According to [START_REF] Mosteller | To share and protect: using regulatory focus theory to examine the privacy paradox of consumers' social media engagement and online privacy protection behaviors[END_REF], data sensitivity stimulates people to think about preventing privacy invasions and thus reduces intentions to share personal data [START_REF] Acquisti | Privacy in electronic commerce and the economics of immediate gratification[END_REF][START_REF] Lwin | Consumer online privacy concerns and responses: a power-responsibility equilibrium perspective[END_REF]. Therefore: H2: Willingness to share personal data decreases with perceived sensitivity of the data.

The perceived value provided by offering control is related to data sensitivity. For low sensitive data, the perceived potential loss on privacy rights is low, the opposite being true for highly sensitive data. Therefore: H3: The higher data sensitivity, the lower the effect of offering control on willingness to share personal data Regulatory focus could directly influence willingness to disclose personal data and also moderate the effects of both forms of compensation. Regulatory Focus Theory informs investigations of consumer behavior and decision-making in various contexts, including information searches and preference construction [START_REF] Wang | The role of regulatory focus in preference construction[END_REF] as well as willingness to share personal data [START_REF] Mosteller | To share and protect: using regulatory focus theory to examine the privacy paradox of consumers' social media engagement and online privacy protection behaviors[END_REF]. Self-regulation theory stems from social science and psychology research [START_REF] Higgins | How self-regulation creates distinct values: The case of promotion and prevention decision making[END_REF], citing people's motivation and ability to direct their behavior and control their impulses to meet certain standards, achieve certain goals, or reach certain ideals. It examines the relationship between people's motivation and the path they choose to achieve a goal, in a way that maintains their own personal values and beliefs known as regulatory orientation. In the regulatory focus framework [START_REF] Higgins | How self-regulation creates distinct values: The case of promotion and prevention decision making[END_REF], individual decision-making is guided by motivational systems, or regulatory focus, which reflects desires either to approach (promotion) or avoid (prevention) a particular end state. With a promotion focus, people worry about advancement, growth and accomplishment; they need nurturing and their actions are motivated by hope and aspiration for reaching some achievement or ideal. Conversely, with a prevention focus, people are concerned with safety, protection and responsibility, so their actions are motivated by a sense of duty and necessity, enabling them to reach avoidance and "ought goals". Prevention-focused people exhibit more vigilance in their actions in order to reach avoidance goals [START_REF] Poels | Hope and self-regulatory goals applied to an advertising context: Promoting prevention stimulates goal-directed behaviour[END_REF] and should be less willing to share their data than those oriented toward promotion. They are more concerned about privacy [START_REF] Mosteller | To share and protect: using regulatory focus theory to examine the privacy paradox of consumers' social media engagement and online privacy protection behaviors[END_REF], assign more importance to privacy rights and consider that their personal data is an asset to protect and not a mean for specific goal achievement (e.g., personalized offer). Therefore: H4: For promotion-focused (prevention-focused) consumers, willingness to share personal data is higher (lower) Regulatory focus could moderate the effect of data sensitivity on willingness to share data.

Regulatory Focus theory suggests that consumers who seek to avoid loss and ensure the absence of negative outcomes (i.e. prevention-focused) adopt preventative behavior to protect their privacy and reduce the threat of unauthorized data access or usage, such that they should be less willing to share data, whatever the level of data sensitivity. On the contrary, consumers who pursue gains and favor the presence of positive outcomes (promotion-focused) prefer immediate monetary rewards (vs. control) and attach less value to privacy rights. Offering compensation will have a stronger effect on their decision. Nevertheless, this does not mean they are not concerned about privacy.

H5a: For promotion-focused (prevention-focused) consumers, the effect of data sensitivity on willingness to share personal data is larger (smaller).

Regulatory focus could moderate the moderating effect of data sensitivity on the effects of compensation strategies on willingness to share data. For prevention-focused consumers, control is mandatory and the moderating effect of data sensitivity on offering control should be low (i.e. small differences between high and low data sensitivity), unlike promotionfocused consumers, who value control only when highly sensitive data is at stake (i.e. high value placed on control only for highly sensitive data). The effect of monetary compensation also depend on an interaction between sensitivity of the information requested [START_REF] Xu | The role of push-pull technology in privacy calculus: the case of location-based services[END_REF] and regulatory focus. As promotion-focused people are more willing to give access to their personal data for monetary compensation [START_REF] Mosteller | To share and protect: using regulatory focus theory to examine the privacy paradox of consumers' social media engagement and online privacy protection behaviors[END_REF], it is expected that the effect of offering money will be larger for low sensitivity data. Therefore:

H5b: For promotion-focused (prevention-focused) consumers, the moderating effect of data sensitivity on the effect of offering control on willingness to share personal data is larger (smaller).

H5c: For promotion-focused (prevention-focused) consumers, the moderating effect of data sensitivity on the effect of offering monetary compensation on willingness to share personal data is larger (smaller).

The conceptual model (see Figure 1) describes the direct effect of the compensations offered by data brokers (control and monetary) on consumers' willingness to share personal data and the moderating effect of perceived data sensitivity. We also hypothesize that regulatory focus will moderate the effects of data sensitivity on the compensation effects.

Experiment design

Participants read a scenario that describes the offer of a data broker that wants to access their browsing data (e.g., Google searches, videos viewed), using a cookie that would be placed on their computer. The data broker is presented as an unknown third party, to avoid any potential bias effect of the broker's image on trust [START_REF] Hann | Analyzing online information privacy concerns: An information processing theory approach[END_REF]. The scenario explains that the broker will make the data anonymous, aggregate it with thousands of other users' data to obtain general trends that will be sold to marketers.

Compensations are manipulated in a 2 (monetary compensation yes/no) × 2 (control over data yes/no) between-subjects factorial design with random allocation. Previous research has often proposed a small amount of money to obtain disclosure. For example, Premazzi et al.

(2010) offer a $20 US coupon for personal identification and financial data. We retain a value of €60 ($67 US) per year as monetary compensation. This amount reflects the average amount offered by real-world data brokers for full access to Internet users' social media and purchasing behavior and is thus correlated with the real value of this data. For control over data usage, the scenario promises active transparency, "the ability to control to whom the data broker sells the data and what will be done with it" (presence case). In the absence of any compensation (money or control), respondents read a description of the intrinsic benefits of online data sharing, including the "benefit from personalized commercial offering, targeted advertising related to your browsing preferences."

A validation check with a national panel (Toluna) confirms the manipulation is effective for money (n = 98; t = -8.49, p < .01) and control (n = 99; t = -12.59, p < .01).

Measures

Measures, descriptive statistics and correlations are presented in Table 1. Willingness to share personal data [START_REF] Phelps | Privacy concerns and consumer intention to provide personal information[END_REF] and perceived data sensitivity [START_REF] Lancelot Miltgen | On-line consumer privacy concern and intention to provide personal data on the Internet[END_REF] are measured on a 7-point scales. Situational regulatory focus scale combines both emotional appraisal and outcome values, two different but correlated dimensions [START_REF] Higgins | How self-regulation creates distinct values: The case of promotion and prevention decision making[END_REF] and is the difference between promotion and prevention scores, themselves computed as combinations of two emotional appraisals and two perceived outcome value, such that a higher score implies a stronger focus on promotion.

< Insert Table 1 about here >

Control variables

Demographics (age and gender) are selected as control variables as they play an important role in privacy-related research and their role has been specifically identified in the case of data sharing with third-party firms [START_REF] Jai | Privacy versus reward: Do loyalty programs increase consumers' willingness to share personal information with third-party advertisers and data brokers[END_REF]. Privacy concerns seem to be greater amongst older consumers and women [START_REF] Cho | The effectiveness of short message service for communication with concerns of privacy protection and conflict avoidance[END_REF].

Statistical analysis and results

Although data were collected in one survey, common method bias assessed by Harman's single-factor test is not critical. Measured variables are mean-centered and statistical effects are estimated using a hierarchical regression. The assumption of homogeneity of variances for data sharing across the experimental cells is supported (Levene test (3, 197) = 2.08, p = .104).

Estimated coefficients for covariates (gender, age) are not significant. If gender has no significant effect, the effect of age on willingness to disclose is indeed supported but fully mediated by data sensitivity. Age does indeed decrease intention to share personal data when regulatory focus and data sensitivity are absent (t = -2.91, p < .01), but this effect vanishes when these variables are introduced as age is positively related to perceived data sensitivity (t = 3.91, p < .01) and negatively to promotion-oriented regulatory focus (t= -2.94, p < .01).

Results are presented in Table 2.

< Insert Table 2 about here >

The model is statistically significant (F (13, 187) = 9.13, p < .01; R² = 39.7%). Offering control over data usage has a positive effect on data sharing (F (1, 187) = 12.00; p < .01) (H1a supported) while the effect size is small (SP Eta² = .039). The estimated coefficient for monetary compensation is statistically significant but in the opposite direction of what was expected (H1b reversed): offering a high amount of money decreases willingness to share data.

As expected, data sensitivity has the strongest effect (SP Eta² = .237) on willingness to share personal data and reduces it (H2 supported). Data sensitivity moderates the effect of control (F (1,187) = 10.20; p < .01) (H3 supported) although the effect size is small (SP Eta² = .033). The higher data sensitivity, the lower the effect of offering control on willingness to share personal data.

Regulatory focus has no direct effect on willingness to share data (H4 not supported) and does not moderate the moderating effect of data sensitivity on the effect of control (H5a not supported). However, the moderated moderation of data sensitivity by regulatory focus is statistically significant for monetary compensation (F (1,187) = 4.07, p = .045). For prevention-focused consumers offering monetary compensation has no significant effect on willingness to share data; for promotion-focused consumers, offering a large amount of money as compensation significantly decreases willingness to share when collected data is of low sensitivity but has no effect for highly sensitive data (H5b supported).

The panel in Figure 2 presents interaction graphs. In a "pick-a-point" approach, three points are selected (mean-SD, mean, mean + SD) for both data sensitivity and regulatory focus. Panel (2.a) presents willingness to share (Y) by data sensitivity (X) for three levels of regulatory focus (prevention, neutral, promotion); Panels (2.b and 2.c) present willingness to share (Y) by data sensitivity (X) depending on the compensation (control, money), for the same three levels of regulatory focus (prevention, neutral, promotion).

<Insert Figure 2a, 2b and 2c about here> Several conclusions can be drawn. First, willingness to share data with a data broker is low and strongly decreases with data sensitivity. Second, the effect of perceived data sensitivity is moderated by regulatory focus: willingness to share is less influenced by data sensitivity for prevention-oriented people than for promotion-oriented people, who are less reluctant to share data they perceive as less sensitive. However, when the data is perceived as highly sensitive, willingness to share is the same, whatever the level of regulatory focus. Third, offering control is an effective way to increase data sharing but the size of the effect decreases as perceptions of data sensitivity increase. Both promotion-and prevention-oriented consumers value control. Fourth, although prevention-oriented consumers do not want to trade their privacy for money, it appears that offering money has an adverse effect on data sharing: a high amount of money decreases willingness to share data for promotion-oriented people when the sensitivity of the data is perceived as low.

Discussion and conclusion

For marketers, collecting data through data brokers is appealing as these third parties can simultaneously protect consumers' interests and privacy while still granting marketers access to personal data. Data brokers are currently extending their business model from B2B to B2C by collecting data directly from consumers. To stimulate data sharing, they offer compensation to consumers in the form of either monetary rewards or more control over data transmission and usage. For example, a consumer can decide to disclose anonymous information to Wibson about location and individual information about social media and Google accounts for $10 a month. In testing the effects of both forms of compensation on data sharing while taking into account the perceived sensitivity of the data, this study assesses the moderating effects of individual approaches (though their regulatory focus) to a situation.

The support for the main hypotheses regarding control and the notable results on monetary compensation in turn provide several pertinent insights for both researchers and marketers.

First, consumers exhibit low willingness to share personal data with a data broker, probably because the level of trust in the unknown data broker is low [START_REF] Premazzi | Customer information sharing with e-vendors: The roles of incentives and trust[END_REF].

Furthermore, the greater the perceived data sensitivity, the lower people's intentions to share. However, in line with [START_REF] Benndorf | The willingness to sell personal data, DICE Discussion Paper[END_REF], consumers do not just completely reject data usage by marketers.

Second, in line with previous research (e.g. [START_REF] Malhotra | Internet users' information privacy concerns (IUIPC): The construct, the scale and a causal model[END_REF]), this study confirms that the best way to increase data sharing is to reduce the risk associated with the use of personal data. Offering more control, by enhancing awareness about data collection, aggregation and usage, may be an effective strategy for reducing perception of risks, ensuring security and making people more comfortable with personal data sharing (see also [START_REF] Wu | The effect of online privacy policy on consumer privacy concern and trust[END_REF].

Globally, these results enrich previous findings by showing that a key challenge for ecommerce is to find ways to highlight the benefits of data collection and usage while providing assurances for minimal risk, to prompt individual data sharing. The current results bring control and transparency to light as tools that businesses can use to make consumers more comfortable with data sharing and ensure the success of their marketing relationship [START_REF] Culnan | Consumer privacy. In Information Privacy: Looking Forward[END_REF].

Third, the conclusions regarding the effectiveness of monetary-based compensation are stimulating. Experimental studies have indicated that monetary rewards could increase intentions to disclose [START_REF] Hann | Analyzing online information privacy concerns: An information processing theory approach[END_REF]. However, contextual information is important and the study demonstrates that, for an unknown third party, offering generous monetary compensation has no effect for prevention-oriented consumers and even a negative effect for promotion-focused consumers. As individuals do not seem to be fully aware of the monetary value of their personal data [START_REF] Malgieri | Pricing privacy -the right to know the value of your personal data[END_REF], amount of money offered is an indicator of the potential value of the data for the data broker and of the potential privacy protection loss for the consumer (Gabish and Milne, 2014). This conclusion supports another research stream that posits that monetary rewards reduce willingness to share personal data because they increase salience of privacy concerns [START_REF] Andrade | Self-disclosure on the web: the impact of privacy policy, reward and company reputation[END_REF][START_REF] Marreiros | Now that you mention it: A survey experiment on information, inattention and online privacy[END_REF] and consequently of trust [START_REF] Taylor | Privacy concern and online personalization: the moderating effects of information control and compensation[END_REF] through a signaling effect [START_REF] Boulding | A consumer-side experimental examination of signalling theory: do consumers perceive warranties as signals of quality[END_REF]. Alternatively, these results might arise because the data broker represents an unknown entity, unable to reach a minimum acceptable level of trust [START_REF] Olivero | Privacy versus willingness to disclose in e-commerce exchanges: The effect of risk awareness on the relative role of trust and control[END_REF].

Theoretical contributions

For research in this field, this article offers three main theoretical contributions. First, to the best of our knowledge, it is the only study that simultaneously considers control and monetary compensations. The comparison of these two forms of compensation reveals some important insights, such as that control has a strong, positive influence on data sharing while monetary rewards have a smaller, potentially negative influence.

Second, this research identifies some boundary conditions of monetary compensation which has a curvilinear effect: initially positive (e.g. [START_REF] Li | Understanding situational online information disclosure as a privacy calculus[END_REF], an increase of the amount has no effect [START_REF] Krafft | Permission marketing and privacy concerns-Why do customers (not) grant permissions[END_REF] and could even, as demonstrated in this research, reduce willingness to share data with unknown third parties.

Third, this study confirms that regulatory focus theory offers a relevant framework for analyzing people's attitudes and behavior with regard to personal data disclosure. [START_REF] Wirtz | Regulatory focus theory, trust and privacy concern[END_REF] show, in a personal data solicitation context, that trust predicts promotion-(but not prevention-) focused behavior, whereas privacy concerns predict prevention-(but not promotion-) focused behavior. Although previous findings using regulatory focus theory in the context of data privacy acknowledge what [START_REF] Higgins | Tranfer of value from fit[END_REF] calls 'the perceived outcome value' (i.e. the perceived value of the final object of the decision), the current findings also enrich the overall regulatory focus theory, especially the theory of transfer value from regulatory fit. Regulatory fit is experienced when people pursue a goal with a specific mindset (e.g. eagerness for a promotion focus and vigilance for a prevention focus) that sustains their regulatory orientation. This regulatory fit has been proven to increase people's perception that a decision they made was "right" which in turn transfers value to the decision outcome, including their willingness to pay more for a product than the people who chose the same product without regulatory fit. In that sense, this research highlights the importance of this mindset (also called value from proper mean [START_REF] Higgins | Tranfer of value from fit[END_REF]) and challenges the way regulatory focus has been computed in the past. [START_REF] Higgins | Tranfer of value from fit[END_REF] proved that when the value from proper mean calls upon the individual's correct regulatory orientation, that individual assigns greater monetary value to the outcome, i.e. the object of the decision (data sharing in this case).

This study goes further and shows that promotion-focused individuals assign greater monetary value to their data whatever the means used to motivate them as long as the data is not perceived as too sensitive. This result suggests that intangible characteristics of regulatory focus triggered by the overall situational context (i.e. needs, feelings and emotions) might be just as important as tangible characteristics materialized within usual scenarios (i.e. strategic mean, outcome value) in people's decision-making process. The current findings also demonstrate its moderating effect in combination with perceived data sensitivity and monetary compensation: offering monetary compensation has an effect only on promotionoriented consumers and for data of low sensitivity. No matter the regulatory focus, when highly sensitive data is at stake, no incentive can truly motivate individuals to share it. This research proves that even individuals looking for gains remain skeptical when they are offered money in exchange for their information. It appears that regulatory focus theory might help to understand the underlying characteristics of individuals that would explain how they assess data sensitivity.

Consumers looking for gains are more likely to consider the nature of the compensation being offered as a determining element of the decision reached (i.e. data sharing) and have greater potential to consider the monetary value of their data. As the amount proposed for data is a signal of the data value, the amount should stay low for data of low sensitivity.

Empirical and managerial contributions

This research emphasizes the influence of culture in privacy-related matters as our challenging findings might be the result of cultural differences. It would not be surprising to find different results using a sample of American or Indian respondents as cultural context has already been proved to have a strong influence in privacy-related studies (e.g. Lancelot [START_REF] Miltgen | Cultural and generational influences on privacy concerns: A qualitative study in seven European countries[END_REF].

Furthermore, this research offers useful and actionable managerial guidance for marketers in charge of e-commerce and digital and interactive marketing strategies, who need to stimulate consumers' data disclosure, as well as for data brokers seeking appropriate targets who might be interested in their specific services.

First, people's willingness to share personal data with data brokers is low, but it can be increased by granting them with more control. The first step is to reduce risk perceptions by increasing awareness and trust [START_REF] Marreiros | Now that you mention it: A survey experiment on information, inattention and online privacy[END_REF]. When their practices and offers will be more widely reported across media and online communities, data brokers may be more likely to attract Internet users' interest and encourage them to make use of the brokerage services.

Second, offering money, at least using the amounts currently proposed by data brokers, can have adverse effects. Firms may thus need to provide non monetary additional value to consumers, such as customized benefits (e.g., premium access to services), to get their data.

Third, the moderating effects of variables such as the regulatory focus emphasizes the need for marketers to adapt their offers to match the identified needs and desires of their targets. Specifically, they should adjust the level of transparency regarding who collects the data and how it will be used (if customers exhibit a prevention focus), or alter the monetary and premium rewards they offer in exchange (if customers have a promotion focus).

Limitations and further research

The limitations of this study suggest avenues for further research. The sample is from Europe (specifically, France), which has very strict data protection regulations. Noting the vast differences across countries when it comes to regulations (e.g., [START_REF] Gupta | Facilitation global e-commerce: A comparison of consumers' willingness to disclose personal information online in the USA and in India[END_REF] or cultural sensitivity to privacy (e.g. [START_REF] Miltgen | Cultural and generational influences on privacy concerns: A qualitative study in seven European countries[END_REF], the study should be replicated in different countries to determine which boundaries need to be taken into account.

Other extensions might investigate a replicable measure for regulatory focus, other variables such as privacy concerns, other measures such as behavioral measures or other methodologies such as experimental tests of data broker recruitment offers. Finally, the results could be extended to other contexts and types of data, beyond an e-commerce context in which the value of the information collected is inherently linked to personalized offers for consumers. In an e-commerce context, the perceived value for the consumer is low, especially compared with the value created in other domains such as health.

<

  Insert Figure 1 about here > Methodology Sample An online questionnaire (using Qualtrics) was administered to a sample of French consumers recruited on social media (Facebook and LinkedIn public groups) (n = 201). The sample characteristics are very similar to those of the French population in terms of gender split (49% of women), age (mean = 40), professional activity (17% students), use of browsers (Google Chrome and Firefox 71% versus 74%, ZDNet, 2016) and number of annual online purchases (21 in the sample versus 23 in the population, Fevad, 2016).


Vincent Ardourel
email: vincent.ardourel@univ-paris1.fr

Ihpst

Julie Jebeile
email: julie.jebeile@philo.unibe.ch

Numerical instability and dynamical systems

Keywords:

In philosophical studies regarding mathematical models of dynamical systems, instability due to sensitive dependence on initial conditions, on the one side, and instability due to sensitive dependence on model structure, on the other, have by now been extensively discussed. Yet there is a third kind of instability, which by contrast has thus far been rather overlooked, that is also a challenge for model predictions about dynamical systems. This is the numerical instability due to the employment of numerical methods involving a discretization process, where discretization is required to solve the differential equations of dynamical systems on a computer. We argue that the criteria for numerical stability, as usually provided by numerical analysis textbooks, are insufficient, and, after mentioning the promising development of backward analysis, we discuss to what extent, in practice, numerical instability can be controlled or avoided.

Introduction 2 Introduction

Mathematical models of dynamical systems are sometimes prone to instability. Instability is a serious issue in applied mathematics in that it poses problems for model predictions about dynamical systems. Informally, a model of a dynamical system is said to be unstable with respect to a given variable or property if small changes in the specification of the system entail significant changes in the predicted dynamical behavior with respect to that variable or property. Conversely, a model of a dynamical system is stable with respect to a given variable or property if small changes in the specification of the system entail similarly small changes in the predicted dynamical behavior with respect to that variable or property.1 Two kinds of instability have tended to be the focus of investigation in the philosophy of science. On the one hand, sensitive dependence on initial conditions makes dynamical systems unstable with respect to small changes in the initial conditions. This generates instability in some non-linear mathematical models, and is what leads to the famous "Butterfly effect" with its prejudicial impacts on model predictions, extensively studied (e.g. [START_REF] Batterman | Defining chaos[END_REF][START_REF] Kellert | In the wake of chaos[END_REF][START_REF] Smith | Explaining chaos[END_REF][START_REF] Werndl | What are the new implications of chaos for unpredictability?[END_REF]). On the other hand, philosophers of science interested in climate science modeling have more recently focused on sensitive dependence on model structure. In this case, structural instability is generated by an error in the model structure, and the resulting uncertainty, i.e. structural uncertainty, is the discrepancy between the model's predicted trajectories and the observations. The "Hawkmoth effect", so named to indicate it is the cousin of the "Butterfly effect", results from the amplification of this structural uncertainty over time; see [START_REF] Mayo-Wilson | Structural chaos[END_REF], for example, for insights into the notion of structural chaos. In particular, this effect lies at the heart of a philosophical debate between, on one side, Frigg and co-authors who argue that structural instability in regional climate models places in-principle limits on our confidence in model predictions (e.g. [START_REF] Frigg | Laplace's demon and the adventures of his apprentices[END_REF][START_REF] Frigg | An assessment of the foundational assumptions in high-resolution climate projections: the case of ukcp09[END_REF], and, on the other side, Winsberg and co-authors who put forward objections (e.g. [START_REF] Winsberg | The adventures of climate science in the sweet land of idle arguments[END_REF].

Yet there is a third kind of instability which also presents challenges for model predictions about dynamical systems. This numerical instability, on which we will focus here, stems from the use of numerical methods involving a discretization process, where such discretization is required to solve the differential equations of dynamical systems on a computer. Numerical instability is a frequent and important matter of concern in scientific practice, since numerical methods are ubiquitous in scientific modeling and are required to make predictions in computer-assisted sciences; yet this form of instability has not yet been subject to anywhere near the same level of philosophical investigation as the Butterfly and Hawkmoth effects. The time is now ripe, however, for the philosophy of applied mathematics to develop an analysis of numerical instability of dynamical systems for its own sake; it is this project that this paper encourages and to which it contributes.

The state-of-the-art philosophy of applied mathematics indeed provides ample resources for such an analysis. For instance, it investigates the various kinds of numerical errors affecting computer simulations (e.g. [START_REF] Humphreys | Extending ourselves: Computational science, empiricism, and scientific method[END_REF][START_REF] Lenhard | Calculated surprises: A philosophy of computer simulation[END_REF]); proposes to interpret numerical errors as modeling errors through the perspective of backward numerical analysis [START_REF] Fillion | On the epistemological analysis of modeling and computational error in the mathematical sciences[END_REF][START_REF] Fillion | Explanation and abstraction from a backward-error analytic perspective[END_REF]; puts forward definitions of the concepts of exact solutions [START_REF] Fillion | Numerical methods, complexity and epistemic hierarchies[END_REF][START_REF] Fillion | Concepts of solution and the finite element method: a philosophical take on variational crimes[END_REF]); explains why approximate numerical solutions are sometimes preferred to exact analytical solutions (Ardourel and Jebeile 2017); and discusses the available methods -e.g. perturbation methods, backward error analysis [START_REF] Corless | Backward error analysis for perturbation methods[END_REF] or effective validity for inferences [START_REF] Moir | Effective validity: a generalized logic for stable approximate inference[END_REF]) -used to produce satisfactory approximate solutions. 2Our aim here is to investigate numerical instability and the way in which it can hamper model predictions. We begin by offering a brief overview of the two above-mentioned kinds of instability affecting models of dynamical systems and their predictive capacity, and then provide a definition of numerical instability (Section 2). We go on to investigate cases of numerical instability occurring in a wide range of non-linear mathematical models (Section 3), and then argue that the criteria for stability of numerical methods, as usually provided by numerical analysis textbooks, are not always sufficient (Section 4). We finally discuss to what extent, in practice, numerical instability can be controlled or avoided (Section 5).

Numerical analysis is an important method by which to tackle numerical instability, and hence in this paper numerical analysis plays an important role. As a field of applied mathematics, numerical analysis has been brought to bear on the study of numerical (in)stability in relation to floating-point arithmetic, numerical linear algebra, and differential equations (e.g., [START_REF] Corless | A graduate introduction to numerical methods. from the viewpoint of backward error analysis[END_REF][START_REF] Hairer | Solving ordinary differential equations ii : Stiff and differential-algebraic problems[END_REF][START_REF] Higham | Accuracy and stability of numerical algorithms[END_REF][START_REF] Wilkinson | Modern error analysis[END_REF]. While numerical analysis considers forms of numerical instability generated by the broad class of numerical methods, in this paper we focus on the numerical instability that occurs more particularly in time-evolving trajectories of dynamical systems, described with differential equations and solved with discretization-based methods. Consequently, in this paper we are strictly interested in that part of numerical analysis which deals with differential equations, including the mathematical discussions on stiff problems, corresponding to instability in non-linear differential equations (e.g. [START_REF] Hairer | Solving ordinary differential equations i : Nonstiff problems[END_REF].

Three sources of instability

In this section we provide a brief overview of the three main kinds of instability that can affect model projections about dynamical systems. Sensitive dependence on initial conditions (SDIC) and sensitive dependence on model structure (SDMS) are at the origin of two kinds of instability that have been extensively discussed in the philosophy of science. We first briefly define these kinds of instability, before turning to the notion of numerical instability on which we focus in this paper.

The three cases have in common the general way instability manifests. Indeed, in all three cases instability is characterized by significant changes in the predicted dynamical behavior induced by only small changes in the specification of the system. The three cases differ in what is changed, namely: (i) initial conditions, (ii) model structure, and (iii) model by discretization.

In the three cases, we consider a dynamical system with time evolution x(t) = ϕ t (x(0)) and initial condition x(0). 3 We suppose that this flow is the solution to the following differential equation with initial condition x(0):

dx dt = f (x) (1)

Initial conditions

The dynamical system is sensitive to initial conditions if, for any initial condition x(0) = a and every small arbitrary distance , there exists an initial condition b close to a within , and an instant t, such that the difference between the two corresponding solutions of the dynamical system becomes greater than a quantity ∆, i.e. that d(ϕ t (a), ϕ t (b)) > ∆, with d the distance between the solutions (e.g., [START_REF] Mayo-Wilson | Structural chaos[END_REF], 1238;Nabergall, Navas, and Winsberg 2019, 6). Informally, the dynamical system is said to be unstable if small changes in the initial conditions entail significant changes in the dynamical solution over time. Of course, how significant is a vague notion, and in fact depends on the magnitude of ∆.4 Thus, a system will be more or less sensitive to initial conditions depending on the rate of change. An exponential rate is often considered as a typical rate of change in philosophical discussions, although it is not considered part of the definition of sensitivity on initial conditions. Not only the rate of change but also the time scale are important considerations in the philosophical discussions which seek to assess the consequences of such instability on predictions.

Model structure

Let us now keep the initial conditions fixed, and consider a change in the model structure, i.e. a change in the formulation of the equations. Roughly speaking, a dynamical system would be said to be sensitive to model structure or structurally unstable if small changes in the function f involve significant changes in the dynamical evolution.

More precisely, let us borrow the definition provided by Nabergall et al. (2019, 9). They define a space of time-evolution functions (or flows) Φ with a metric δ, the flow ϕ ∈ Φ, and they introduce a metric d in state space. In that case, Φ is sensitively dependent on model structure to degree ∆ at ϕ if for any initial state, there is a time t such that for almost all φ ∈ Φ with δ(ϕ, φ)) < , one has d(ϕ t , φt ) > ∆. 5In the example developed in [START_REF] Bradley | Model error and ensemble forecasting: A cautionary tale[END_REF]Frigg et al. 2014), not only do the nearby trajectories diverge under model error, but the whole distribution of trajectories -whose initial conditions are within a certain distance -also diverge over time. The authors thus define a probability distribution p 0 (x) around x supposed to represent uncertainty on initial conditions, and examine the time evolution of the probability distribution p t (x) = ϕ t [p 0 (x)] where ϕ t is the dynamics of the model.

Discretization

Let us now keep the initial conditions and the model structure fixed, and focus on equation 1 that needs to be numerically solved on a computer. One numerical method is chosen, among several options, to discretize the differential equation.

Like initial conditions and model structure, discretization, we argue, is itself a source of instability.

In this context, a model of a dynamical system -implemented and solved on a computer -will be said to be numerically unstable with respect to a given numerical method if the small differences between the original differential equation and its discretized version to be implemented on the computer entail significant changes in the numerical solution over time with respect to the exact solution. 6 For example, let us consider the basic numerical method, the forward Euler numerical method. This numerical method transforms the differential equation 1 into the following discrete equation :

(x k+1 -x k )/h = f (x k ) ( 2
)
where h is the time step. This discrete equation can be written as x k+1 = hf (x k ) + x k , which is an algorithm enabling one to successively calculate the value x 1 from x 0 , x 2 from x 1 , x 3 from x 2 , and so on, x n from x n-1 . This leads to a discrete sequence (x k ) for every integers k from 0 to n, which is the numerical solution of the differential equation 1 with the forward Euler discretizing method. In this case, numerical instability is present when, however small the discretization step h is, a significant discrepancy between the exact solution x(t) and the numerical solution (x k ) appears at some point. More precisely, let x(t k ) be the value of the exact flow (or solution) at the time t k . The model of a dynamical system is said to be numerically unstable with respect to numerical method m and a quantity ∆, if, after discretization with the numerical scheme m, for any arbitrarily small discretization step h, there exists a time t k such that distance d(x(t k ), x k ) > ∆.

Unlike sensitive dependence on initial conditions and sensitive dependence on model structure, numerical (in)stability does not stem directly and only from certain properties of the dynamical system. It also stems partly from the discretization method being used to solve the equation numerically. Numerical (in)stability comes from the transformation of a continuous flow into a discrete time evolution. Usually, in numerical analysis, numerical (in)stability is deemed to be a property of the algorithms or numerical methods used to solve the equations [START_REF] Corless | A graduate introduction to numerical methods. from the viewpoint of backward error analysis[END_REF], 29, Fillion and Corless 2014, 1464); for example, the forward Euler method is qualified as numerically stable or unstable without any reference to a particular dynamical system. However, while the use of an unstable numerical method likely leads to unstable trajectories of the dynamical system, a stable numerical method can, under some criteria, also lead to uncontrolled errors, as we will see (Section 3). There is therefore an important sense of (in)stability, on which we focus, as being a property of the models of dynamical systems -implemented and solved on computer -and relative to the chosen numerical method. In what follows, we further investigate cases of the numerical instability of dynamical systems.

Cases of numerical instability

Numerical instability due to discretization manifests in various cases of the numerical resolution of differential equations, including ordinary differential equations and partial differential equations.

A notable historical example was reported by meteorologist Norman A. [START_REF] Phillips | An example of non-linear computational instability[END_REF] who called it non-linear instability. When developing one of the very first general circulation models (an atmospheric model over a large geographical space), he encountered this instability in a numerical solution of the nonlinear barotropic vorticity equation. As illustrated in Figure 1, the numerical computation breaks down abruptly after several days of simulation run.

Figure 1: Disturbance kinetic energy as a function of time. The solid curve was obtained without smoothing, the computations breaking down at about 56 days. The dashed curve was obtained by periodically introducing a filtering procedure. (Phillips 1959, 503) In order to explain this instability, let us consider the following partial differential equation which contains a nonlinear term of type "u • ∂u ∂x ", such as ∂u ∂t + u • ∂u ∂x = 0. This describes a simple configuration of one-dimensional advection, where u(x, t) is the fluid velocity. 7 Suppose that the solution u is such that u = sin (kx). The non-linear term then becomes u• ∂u ∂x = 1 2 k sin (2kx). This corresponds to a wave whose length is half the length of the original wave. By iteration, the non-linear term "generates" new waves of ever-smaller lengths; this is called the aliasing effect. This process mirrors the natural phenomenon of transfer of energy to the smaller scales. The transfer of energy to smaller 7 Advection is the horizontal transport of properties such as heat, temperature, salinity or polluting material, by displacement of a fluid such as water or air. u • ∂u ∂t is the advected quantity over time; in the context of fluid dynamics, it is the fluid velocity. ∂u ∂x is its partial derivative against the spatial coordinate x. The fluid velocity, like any quantity in climate models, is decomposed into a Fourier series, i.e. into a sum of cosines and sines. In other words, it is represented as a wave packet, each wave being a perturbation.

scales goes on until the smallest wavelengths are produced and then eliminated by viscous dissipation.

The instability occurs when the size of the wave becomes shorter than twice the grid length, because now they can no longer be resolved in the model; this is "the smallest resolvable wave". As Phillips argued, "this instability arises because the grid system cannot resolve wave lengths shorter than about 2 grid intervals; when such wave lengths are formed by the non-linear interaction of longer waves, the grid system interprets them incorrectly as long waves" (Phillips 1959, 501). Yet even if the size of the discretization is taken to be arbitrarily small, there will always be new waves which could not be resolved, since the non-linear term always generates new waves of ever-smaller length. As Phillips emphasizes, "This "instability" cannot be eliminated by reducing ∆t [the discrete time step]" (1959,502). This example epitomizes the definition of numerical instability we offered in Section 2.3): however small the discretization step is, a significant discrepancy between the exact solution and the numerical solution appears at some point. In Section 5 we will discuss how it is, nevertheless, possible to overcome such numerical instability.

This numerical instability is connected to the class of stiff problems, extensively studied in numerical analysis. Roughly speaking, stiff problems are differential equations for which the typical time scale of the differential equation cannot be "resolved" by the numerical method. In other words, the size of the discretization step is not sufficiently small to resolve the time evolution of the differential equations. If the time-scale variation of the differential equation is unknown, is very small or, even worse, decreases over time, then numerical instability can occur at some point over the numerical resolution. There are many examples of such issues that cannot be discussed in this paper (see e.g. [START_REF] Bui | Numerical methods for extremely stiff systems of ordinary differential equations[END_REF][START_REF] Hairer | Solving ordinary differential equations ii : Stiff and differential-algebraic problems[END_REF][START_REF] Krivine | Discrete-time and continuous-time modelling: some bridges and gaps[END_REF]; an example of stiff problem is given in Appendix 7.1.

Moreover, numerical instability can occur even for problems which are not identified as stiff. Even very simple and apparently unproblematic dynamical systems can lead to numerical instability if the computer simulation is sufficiently long. An example comes with the use of another basic numerical method, namely the backward Euler method. This method transforms the differential equation 1 into the discrete equation:

(x k+1 -x k )/h = f (x k+1 ) (3)
Figure 2 represents the numerical resolutions of the simple pendulum by using this method, for different initial conditions. The differential equation is d 2 θ/dt 2 = -g/l sin (θ), where θ is the angle. [START_REF] Stern | Discrete geometric mechanics for variational time integrators[END_REF] show that numerical instability occurs in this one-dimensional dynamical system. The exact solutions of the dynamical system are known: they are ellipsoids in the phase space. Yet unlike the exact solutions, the numerical resolutions of the dynamical system with the numerical method significantly deviate from the exact trajectories; we will come back to this problem in Section 5. The explanation of this numerical instability is very basic: discretization errors accumulate at each step of the numerical resolutions. It is noteworthy that numerical instability can occur in dynamical systems that are not sensitive to initial conditions: as the example illustrates, the simple pendulum is a non-linear problem, but is not sensitive to initial conditions since it has periodic solutions. Furthermore the example shows that numerical instability may occur due to the use of numerical methods, even if the methods are supposed to be stable -under some criteria that we will discuss in Section 4. Given that, usually, the exact solutions to the models of dynamical systems are unavailable, how can scientists know that the models are numerically (un)stable? Criteria for stability are provided by numerical analysis textbooks, and it is to these we now turn.

Criteria for stability in numerical analysis

Numerical stability of differential equations is a crucial property for predictions requiring numerical computation. This notion attracts much attention in applied mathematics. We now review the main criteria for numerical stability usually provided by numerical analysis textbooks. We argue that, despite their importance, they are not sufficient to avoid the numerical instability of dynamical systems defined in Section 2.3 and illustrated in Section 3.

Zero-stability

In numerical analysis, a first important criterion for stability is zero-stability.8 Roughly speaking, a numerical method is zero-stable if a small difference between two initial conditions, does not entail significant change to the numerical solution. More precisely, let us consider a numerical method (such as the forward Euler method introduced in Section 2.3) with two initial conditions x 0 and x0 . The method is said to be zero-stable if there exists a quantity S (named the constant of stability) such that, for any integer k of the two numerical solutions (x k ) and (x k ) built from the two initial conditions satisfy:

|x k -x k | ≤ S|x 0 -x 0 | (4)
when time step h tends to zero. In other words, the distance between the two numerical solutions based on two distinct initial conditions remains bounded by a certain quantity. This first notion of stability refers to "the 'stability' of the numerical method with respect to 'small perturbations' in the starting conditions" (Süli and Mayers 2003, 332).9 Zero-stability is a crucial property that a numerical method has to meet. An example illustrating the importance of zero-stability is given in Appendix 7.2. However, there are numerical methods, which are zero-stable, and yet lead to numerical instabilities in the sense defined in Section 2.3. Our point is that a zero-stable numerical method can lead to numerical instabilities depending on the dynamical system to which it is applied. For instance, whereas both cases discussed in Section 3 use zero-stable numerical methods, they exhibit numerical instabilities. In particular, numerical instabilities can occur with a periodic dynamical system, such as the one-dimension simple pendulum system. Such examples reveal that this first criterion is not sufficient to avoid numerical instabilities. Thus, given a dynamical system, it is hard to know in advance whether numerical instabilities will occur despite the use of a zero-stable method. Therefore, a case-by-case analysis is needed.

Absolute stability

A second important criterion for stability is absolute stability. In order to define it, let us consider a numerical method, with a finite time step h, which provides the discrete sequence (x k ) for the numerical solution (such as the forward Euler method introduced in Section 2.3). The numerical method is said to be absolute stable if there exists a quantity C > 0 such that, for any value of x k :

|x k | ≤ C (5)
In other words, the numerical method is said to be absolute stable if the numerical solution (x k ) is asymptotically bounded (Palais and Palais 2009, 137; see also Hairer and Wanner 1991, 40;Süli and Mayers 2003, 348). Unlike zero-stability, absolute stability concerns the behavior of a numerical method as time t tends to infinity, with a fixed step size h. Absolute stability assesses to which extent the numerical solution to a stable problem can diverge, i.e. tends to infinity. Absolute stability does not concern small changes in the initial conditions. It only concerns the asymptotic behavior of the numerical solution, specifically whether this solution is likely to tend to infinity. The condition of absolute stability is particularly important for stiff problems. We discuss this notion in Appendix 7.3, which requires some mathematical details. Here, we contend that, despite its importance, absolute stability is not a sufficient condition for numerical stability based on an example. The simple pendulum problem, as presented in Section 3, can be affected by numerical instability even while it makes use of an absolute stable method, namely the backward Euler method that we defined in Section 3. In long-run numerical computations, the use of absolute stable methods can even lead to discrete solutions that significantly depart from the exact solution. The reason is that absolute stability guarantees that numerical solutions will not diverge. However, numerical solutions can still deviate to exact solutions without diverging, such as in the case of the simple pendulum where the numerical solutions are decreasing spirals (see Figure 2).

In a nutshell, the main criteria traditionally provided by numerical analysis textbooks, namely zero-stability and absolute stability, are insufficient conditions for numerical stability. However, a promising alternative approach called backward error analysis has recently attracted philosophical attention, and will be briefly presented in what follows.

Backward error analysis

We have so far discussed the predominant approach in numerical analysis textbooks, which can be called "forward error analysis". However, another approach, developed notably by [START_REF] Wilkinson | Modern error analysis[END_REF] and later by [START_REF] Corless | A graduate introduction to numerical methods. from the viewpoint of backward error analysis[END_REF], called "backward error analysis", provides the conditions for an a posteriori assessment of the numerical stability of the model of a dynamical system. Two concepts play an important in this approach: the backward error and the conditioning. An assessment of both is required to study whether the trajectories of the model of a dynamical system remain sufficiently close to the exact solution.

In the predominant forward error analysis, the main error to estimate -the forward error -is the discrepancy between the exact solution and the numerical (approximate) solution. By contrast, backward error analysis focusses on the backward error, which corresponds to the forward error being reflected back into a perturbation error in the initial conditions, and can thus be estimated more easily (see Fig. 3). In other words, within the backward perspective, the numerical solution is viewed as "the exact solution of a nearby problem" (Corless and Fillion 2013, 52). Accordingly, the approach aims to answer the question: "how much error in the input would be required to explain all output error? " (Fillion andCorless 2014, 1462). Conditioning is the other important notion in this approach. According to Corless and Fillion, "a problem is well-conditioned if small changes in the problem lead to small changes in the solution" (2013, 507). Thus, the conditioning of an initial value problem is related to the sensitive dependence of differential equations (see Sections 2.1 and 2.2): it is even "called 'stability' in the differential equations literature" (Ibid.).

In the approach, the backward error and the forward error are linked by a quantity termed the condition number κ. This number measures the sensitive dependence of the dynamical system in changes of its specification. 10 In practice, if one can estimate the condition number, one can also work out the relationship between the forward error and the backward error. This turns out to be possible, for example, using Matlab software (Corless and Fillion 2013, chap. 12). In the same way, the backward error can be evaluated a posteriori through the computation of the residual, a key quantity. In the case of dynamical systems, the residual corresponds to the error in the velocity of the trajectories (Corless and Fillion 2013, 519). One can thus in turn calculate the forward error, and evaluate how close to the exact solution the computed trajectories of a dynamical system are (e.g., see (Corless and Fillion 2013, 533).

While a detailed discussion of this approach is out of the scope of this paper, we should nonetheless mention that it comes with a number of advantages (see e.g. Moir 2010 for ordinary differential equations). In particular, it is a general approach which is not restricted to dynamical systems (Fillion andCorless 2014, 2019;[START_REF] Fillion | Explanation and abstraction from a backward-error analytic perspective[END_REF]. But, despite its incentives, backward analysis, to our knowledge, is yet not widely used in practice. It is therefore not easy to 10 Roughly speaking, the relative forward error (δy = ∆y/y) is bounded by the product of condition number with the relative backward error (δx = ∆x/x), so that:

δy ≤ κ • δx (6)
A problem, or a dynamical system, is called ill-conditioned if κ > 1, and well-conditioned if κ ≤ 1.

assess the exact extent to which backward analysis is and can be implemented to overcome numerical instability in dynamical systems. That said, in the scientific practice, besides these mentioned methods, other strategies are currently being developed by practitioners and are more often employed. We now turn to some of these strategies.

Dealing with the risk of numerical instability

There is a risk of numerical instability in non-linear mathematical models of dynamical systems that are being solved by computer. In some cases, like the simple pendulum, the instability can be easily identified because the exact behavior of the dynamical system is well known. But, more often, the exact solutions for dynamical systems are not known.11 In non-linear mathematical models, even the mere detection of numerical instability is sometimes not an easy task. How then to deal with the risk of numerical instability? It seems reasonable, given the risk of numerical instability, to ask scientists to gather evidence supporting the reliability of their non-linear models. However, the criteria for numerical stability, discussed in Sections 4.1 and 4.2 (i.e. zero-stability and absolute stability), are insufficient to guarantee a priori the absence of numerical instability. Backward analysis, presented in Section 4.3, constitutes a new and promising a posteriori method to overcome numerical instability, however. Besides the methods mentioned above, scientists have in practice also developed certain specific strategies. In this section, we will outline some of the strategies that scientists may adopt on a case-by-case basis, depending on the problem they are facing.

Developing new numerical methods

In order to avoid instability occurring in long numerical computations, a first important strategy is to develop new numerical methods. Several options are usually available. One option is to use variable discretization steps: instead of choosing a constant time step parameter h, one can choose a variable time step h k with respect to computation step k; or one can choose a technique to distribute mesh points (e.g., see [START_REF] Söderlind | Time-step selection algorithms: Adaptivity, control, and signal processing[END_REF], such as spectral methods for partial differential equations (e.g., Trefethen 1994, chap. 7). We also mention the defect-controlled methods, which are another dynamic approach to managing numerical stability (see, e.g., [START_REF] Corless | Defect-controlled numerical methods and. shadowing for chaotic differential equations[END_REF]. 12A second option, on which we will focus in the remainder of this section, is to turn to geometric integration and symplectic methods. Such methods have been proven to be efficient for long-run computations, and for some other kinds of problems, and in particular for dynamical systems.13 This is a lively topic within the field of numerical analysis. For example, although the two first textbooks by Hairer et al. are dedicated to numerical methods for non-stiff and stiff problems, the third is entirely devoted to Geometric Numerical Integration: Structure-Preserving Algorithms for Ordinary Differential Equations. The authors emphasize the importance and the specific character of these methods:

In the last few decades, the theory of numerical methods for general (non-stiff and stiff) ordinary differential equations has reached a certain maturity, and excellent general-purpose codes, mainly based on Runge-Kutta methods or linear multistep methods, have become available. [...] It turned out that the preservation of geometric properties of the flow not only produces an improved qualitative behaviour, but also allows for a more accurate long-time integration than with general-purpose methods.

An important shift of view-point came about by ceasing to concentrate on the numerical approximation of a single solution trajectory and instead to consider a numerical method as a discrete dynamical system which approximates the flow of the differential equationand so the geometry of phase space comes back again through the window. (Hairer, Lubich, and Wanner 2002, v) The main idea of this approach is the following: for some kinds of dynamical systems, such as Hamiltonian systems, numerical methods, which preserve -in a discrete sense -some invariants, e.g. momenta or symplectic forms, will lead to more stable numerical resolutions. Let us take an example discussed by [START_REF] Hairer | Geometric numerical integration: Structure-preserving algorithms for ordinary differential equations[END_REF]. This is the numerical resolution of the equations of a reduced solar system with the five outer planets relative to the Sun. Different numerical resolutions performed over a time period of 200,000 days are carried out with four numerical methods (Figure 4). Unlike the two first methods, the last two methods are symplectic numerical methods and lead to very stable long-run numerical computations. Moreover, according to [START_REF] Hairer | Geometric numerical integration: Structure-preserving algorithms for ordinary differential equations[END_REF]:

An integration over a much longer time of say several million years does not deteriorate this behaviour. (Hairer et al. 2002, 15) This long-time numerical stability is explained by the preservation of the symplectic form of the Hamiltonian system when the symplectic Euler method or the Störmer-Verlet scheme are used (see [START_REF] Ardourel | The representation of time in discrete mechanics[END_REF]). This strategy can, in principle, be applied to any Hamiltonian system. For example, we have seen previously that the numerical resolution of the simple pendulum is not stable with the backward Euler method (see Figure 2). By contrast, Hairer et al. show that the numerical resolutions become stable if a symplectic Euler method is used (2002,5; see also [START_REF] Stern | Discrete geometric mechanics for variational time integrators[END_REF]).

Figure 4: The trajectories of the planets of a reduced solar system computed with four numerical methods: forward Euler scheme, backward Euler scheme, symplectic Euler scheme, and Störmer-Verlet scheme. A 10-days time step is used with the forward and backward Euler integrators while a 100-days step is used with the symplectic Euler and a 200-days step with the Störmer-Verlet scheme. For each numerical computation, the initial conditions correspond to the positions of planets on September 5, 1994 at 0h00, and numerical resolutions are performed over a time period of 200,000 days (Hairer et al. 2002, 14).

Tuning, parameterizing and tinkering

Another approach is to consider models as autonomous mediators standing between experimentation and theoretical activity. Understood in this sense, models are not entirely grounded on theories but should also be shaped by data. Hence, matching the data becomes as high a priority as solving the equations in the most exact way, and may even be of higher priority, as claimed by Lenhard.

Lenhard and his co-author [START_REF] Lenhard | Computer simulation: The cooperation between experimenting and modeling[END_REF][START_REF] Lenhard | Reproducibility and the concept of numerical solution[END_REF] highlight that the discretization process is a part of simulation modeling. The steps of simulation modeling encompass the design of an initial continuous mathematical model, the transformation of this model into a discrete version by a discretization process, the implementation of this discrete version on computer, the simulation, and finally the evaluation, which can require iterative loops of the transformation of the continuous model into the discrete version (see Lenhard and Küster 2019, Fig. 2). Each step -the different operations and the resulting transformations -aims to fix specific possible problems at the different stages of the model build.

Importantly, in his 2007, Lenhard argues that the discretization process, which he considers to be an important task in scientific modeling, is not just a mathematical problem concerning the resolution of the equations and the obtaining of acceptable approximate solutions to the initial equations. For him, the discretization process should also be oriented toward fitting the data. In this context, fitting the data requires tuning the model parameters accordingly, making adequate parameterizations, and/or choosing an appropriate numerical scheme.

In other terms, the results of the discrete version should not be taken strictly as the "numerical solutions" to the continuous version, or "in any case, [they] correspond to these with an arbitrary precision" (Lenhard 2007, 189). On the contrary, taking the example of Arakawa's simulation of the atmosphere, he claims that "imitating the phenomena of the atmosphere is more important than solving the primitive equations" (Lenhard 2007, 184).

In this respect, the problem of instability has a different degree of epistemological difficulty: "The problem of the instability of long-term integrations could only be overcome when the construction of a discrete simulation model was seen as a task in its own right, oriented more at the imitation of phenomena than at solving the equations of the theoretical model" (Lenhard 2007, 177). As Lenhard highlights, Arakawa in his approach to the atmosphere makes an assumption that is inconsistent with our best knowledge in physics, i.e. he posits the conservation of kinetic energy in the atmosphere. Yet by doing so he is able to overcome numerical instability. "In terms of physics, one can say that Arakawa artificially limited the growth of instability by conserving kinetic energy" (Lenhard 2007, 185). In the same vein, [START_REF] Hollingsworth | An internal symmetric computational instability[END_REF] suggest a modification of the numerical scheme in order to overcome a problem of instability due to linear terms of definite difference equations not conserving momentum.

As Lenhard finally concludes:

The key point is that the consequences of a model, its properties, can be observed in experiments, and through this, by implementing different discretization schemes or by introducing, tuning, and adjusting parameters, one can obtain, in turn, a further change in the model that is driven directly by the phenomena or the data. The model becomes the object of a recursive process that runs repeatedly through numerical experiments, observations, and parameter adjustments. (Lenhard 2007, 191) We want to highlight that tinkering with the numerical scheme, i.e. developing ad hoc solutions, can indeed be a strategy to overcome numerical instability. This is the case when dealing with non-linear instability and the aliasing effect (see Section 3). Solutions to aliasing due to nonlinear terms have been developed to eliminate aliasing errors and are available to scientists. Examples include filtering wave components whose wavelengths are less than four grid intervals, as suggested by [START_REF] Phillips | An example of non-linear computational instability[END_REF] himself but also by [START_REF] Platzman | An approximation to the product of discrete functions[END_REF] and [START_REF] Baer | The extended numerical integration of a simple barotropic model[END_REF]; filtering out all waves whose wavelengths are between 2∆x and 3∆x as shown by [START_REF] Orszag | On the elimination of aliasing in finite difference schemes by filtering high-wavenumber components[END_REF]; and using a different difference scheme, e.g. a quadratic conserving scheme or a staggered-grids-based scheme (cf. Arakawa 1977, 48-51).

We agree with Lenhard that matching the data, possibly via tuning the model parameters, parameterizations, and tinkering with the numerical scheme, is an important aspect of dealing with numerical instability. That said, we are also aware that there is a risk of overfitting the data, which makes the model incapable of providing genuine novel predictions outside the range of the benchmark data. We believe that more work needs to be done to explore the tension between the capacity of the tuning of model parameters to fix numerical instability, and the risk of overfitting the data.14

Conclusion

In philosophical studies regarding mathematical models of dynamical systems, instability due to sensitive dependence on initial conditions, on the one side, and instability due to sensitive dependence on model structure, on the other, have by now been extensively discussed. Yet there is a third kind of instability, which by contrast has so far been overlooked, which also poses challenges for model predictions about dynamical systems: this is numerical instability due to numerical methods involving a discretization process, where discretization is required to solve the equations of dynamical systems on a computer.

After providing some definitions, our discussion in this paper turned to the question of how scientists can know that their models are numerically (un)stable.

To this end, we first considered the criteria for numerical stability, as usually provided by numerical analysis textbooks, and we argued that they are insufficient. After having briefly presented backward analysis, an approach which shows promise, we then outlined practical strategies that scientists might adopt to avoid numerical instability in practice.

We hope this contribution might encourage further investigation by philosophers of this important kind of instability, rooted in applied mathematics, which has so far been rather overlooked compared to the Butterfly effect and the Hawkmoth effect.

Appendix

This Appendix provides examples and mathematical details on some notions discussed in the paper, viz. stiff problems, zero-stability and absolute stability.

Stiff problems

Here is an one-dimensional example of stiff problem provided by [START_REF] Hairer | Solving ordinary differential equations ii : Stiff and differential-algebraic problems[END_REF]:15 dy dx = -50(y -cos x)

On the left of Figure 5 are the solution curves of the equation. They show a smooth solution, close to y = cos x, as well as a bunch of solutions that reach this smooth solution after a transient phase. However, some other numerical solutions do not behave the same way. On the right of Figure 5 are two solutions with initial value y(0) = 1, and respectively step sizes h = 1.974/50 and 1.875/50. These solutions have no transient phase, and enable us to infer that, as soon as the step size is larger than 2/50, the numerical solution goes too far beyond the equilibrium and violent oscillations occur (Hairer and Wanner 1991, 2). Specific numerical methods have been developed in order to solve stiff problems (see Section 7.3).

Zero-stability

In order to understand the importance of a numerical method being zero-stable, let us take the example of a dynamical system defined by the following partial differential equation:

∂u ∂t = ∂u ∂x (8)
with u(x, 0) = cos 2 x if |x| ≤ π/2, u(x, 0) = 0 otherwise. Let us take the leap frog numerical method, viz. the discretization u n+1 j = u n-1 j + λ(u n j+1 -u n j-1 ), with the space step h = 0.04π and time step k = λh, where λ is the mesh ratio (see Trefethen 1994, 148). Figure 6 shows the two numerical solutions with respectively λ = 0.9 and λ = 1.1. As we can see, for λ < 1 there is a propagation of the wave as predicted by the theory. This is the regime where the numerical method is zero-stable. On the contrary, for λ > 1 numerical artefacts appear in the propagation of the wave. This is the regime where the numerical method is not zero-stable.

As emphasized by [START_REF] Trefethen | Finite difference and spectral methods for ordinary and partial differential equations[END_REF], in the case where λ > 1: "The errors introduced at each step are not much bigger than before [i.e. for λ < 1] but they grow exponentially in subsequent time steps [...]. This rapid blow up of a sawtooth mode is typical of unstable finite difference formulas" (1994, chap 4, 148). It is important to emphasize that the instability is not generated by roundoff errors; it is generated by discretization errors which accumulate in the regime where the numerical method is not zero-stable. In both cases (λ < 1 and λ > 1) the numerical method is consistent. Nevertheless, the numerical solution to equation 8 would converge to the exact solution when h and k tend to zero in the regime of zero-stability, i.e. when λ < 1. 16 Thus, as we have just seen, in order to avoid numerical instability, it can be crucial to investigate whether a numerical method is zero-stable.

Zero-stability can be applied to numerical methods used for ordinary differential equations. In those cases, it concerns the behavior of the numerical method for a fixed time value t, as time step h tends to zero (see Hairer et al. 1987, 378, andFasshauer 2007, chap. 4). This is a particularly important condition for multi-step methods (Süli and Mayers 2003, 332;Hairer et al. 1987, 398;Trefethen 1994, chap. 1, 40). Zero-stability also concerns the numerical methods used for partial differential equations. In this case, it also concerns the behavior of the numerical method for a fixed time value t, as time step k tends to zero, but also as spatial step h tends to zero.

Consistency is a property required for a numerical method. A numerical method is said to be consistent if the local errors introduced at each step tend to zero when the discretization steps tend to zero. However, consistency is a necessary but not sufficient condition for solution convergence, which means that the discrete solution tends to the exact continuous one when the time step tends to zero. Zero-stability is also required: if a numerical method is consistent and zero-stable, then it is convergent. In other words, being zero-stable allows 16 There are mathematical results that state the conditions for which a finite difference formula can be zero-stable. This is for instance the case of the Courant-Friedrichs-Lewy (CFL) condition. Informally, the CFL condition states that a finite difference formula can be stable only if its numerical domain of dependence is at least as large as the mathematical domain of dependence (Trefethen 1994, 162).

a numerical method to be convergent. 17

Absolute stability and stiffness

In order to better understand what absolute stability is, and how it is connected with stiff problems, let us take the example of the initial value problem:

dx dt = -µx x(0) = a (9)
The solution is an exponential function such as x(t) = ae -µt with µ > 0.

The resolution of the initial value problem with the Euler forward method leads to the following discrete equation:

x k+1 = x k -hµx k , x 0 = a (10)
The exact discrete solution is: x k = a(1 -µh) k . If h < 2 µ , both continuous and discrete solutions tend to zero when t or k tends to infinity. Nevertheless, when h > 2 µ , the discrete solution increases with k. This illustrates that the Euler method is not absolutely stable for all values of h. It is a conditionally stable numerical method.

Let us now use the Euler backward method in order to solve this same problem. In that case, the discrete equation becomes:

x k+1 = x k -hµx k+1 , x 0 = a (11)
The exact discrete solution is: x k = x 0 /(1 + µh) k . Here, both continuous and discrete equations tend to zero when t and k tend to infinity, whatever the value of h is. This illustrates that the Euler backward method is an unconditionally stable numerical method. The Euler forward method is an explicit method: one just needs to know the value x k to directly infer the value x k+1 at the next time step by applying the discrete time evolution. On the contrary, the Euler backward method is implicit: one cannot directly derive the value of x k+1 with x k , instead one generally has to solve a non-linear equation with x k+1 . Generally, explicit methods are not suitable to solve stiff problems -something which is sometimes part of the definition of stiffness itself! Thus, [START_REF] Hairer | Solving ordinary differential equations i : Nonstiff problems[END_REF] assert that "stiff equations are problems for which explicit methods don't work" (1987,2). Implicit methods, on the contrary, are indeed generally suitable. 18 17 In the context of partial differential equations, this is linked to the main theorem of numerical analysis, called the Lax Equivalence Theorem. Informally, the Lax Equivalence Theorem says that, as soon as the numerical scheme is consistent and based on a linear finite difference model, stability is a necessary and sufficient condition for convergence (Trefethen 1994, 157). The notion of convergence is connected to consistency (e.g. Trefethen 1994, chap. 1, 53) but also to conditionning (e.g. Corless and Fillion 2013, 598; see Section 4.3).

18 There are mathematical results that state under which conditions a linear multistep numerical method is absolute stable (see [START_REF] Fasshauer | Numerical methods for differential equations/computational mathematics ii (spring 07)[END_REF], chap. 4, Hairer et al. 1987). The notion of L-stability can be introduced to further elaborate the idea of absolute stability (Bui and Bui 1970, 356).

Figure 2 :

 2 Figure 2: Numerical computations of the simple pendulum equation with backward Euler method. The trajectories are decreasing spirals because of numerical instabilities. (Stern and Desbrun 2008).

Figure 3 :

 3 Figure 3: Backward error and forward error. (Fillion and Corless 2014, 1462).

Figure 5 :

 5 Figure 5: On the left, solution curves with implicit Euler solution. On the right, explicit Euler solution for y(0) = 0, h = 1.974/50 and 1.875/50.(Hairer and Wanner 1991, 2)

Figure 6 :

 6 Figure 6: Stable and unstable leap frog approximations to ∂u ∂t = ∂u ∂x .(Trefethen 1994, 149, Fig. 4.1.1)

A model of a dynamical system can be stable under some respects, and unstable under others. For example, asCorless and Fillion (2013, 554) show, the Lorenz attractor is unstable with respect to the position, but stable with respect to the dimensions of the attractor. In the paper, the (in)stability in models of dynamical systems we discuss mainly concerns the systems' trajectories, and, for the sake of readability, this specification will remain implicit.

See also[START_REF] Moir | Structures in real theory application: A study in feasible epistemology[END_REF] for discussions on errors and stability in mathematical modeling.

We can define the dynamical system as < R, S, ϕ > with S the state space.

Practitioners may find the idea of relative error more useful than absolute error. Although the definition of sensitivity to initial conditions usually involves absolute error, it could certainly be revised.

 5 The definition of the structural instability is a question in itself, which is discussed in[START_REF] Frigg | Laplace's demon and the adventures of his apprentices[END_REF],[START_REF] Nabergall | An antidote for hawkmoths: on the prevalence of structural chaos in non-linear modeling[END_REF],Winsberg (2018, 232). It is out of the scope of this paper to address this question.

The small differences are non-eliminable since the discretization process changes the nature of the model, in that the continuous differential equation is replaced by a discrete algebraic equation.

So-named because, for the multi-step methods of ordinary differential equations, "zerostability" can be determined by considering only the differential equation y = 0(Süli and Mayers 2003, 332). It is also sometimes called D-stability in honor of Dalquist(Hairer et al. 1987, 380), or just stability.

 9 This presentation is simplified. In particular, it leaves aside small roundoff errors. For more details, see e.g.,(Bréhier n.d., 14; Palais and Palais 2009, 137). Moreover, for linear multi-step methods, one needs to take into account the initial values at the different steps (seeSüli and Mayers 2003, 332).

There are, however, cases where the use of numerical solutions is preferred although scientists know the exact solutions[START_REF] Ardourel | On the presumed superiority of analytical solutions over numerical methods[END_REF].

We are in debt to an anonymous reviewer for providing such insights.

Having recourse to adaptive time steps is compatible with resorting to geometric integration (e.g., seeArdourel and Barberousse 2017, 180).

For a recent attempt at showing how tuning the parameters can fix structural instability, see Baldissera Pacchetti (2020).

They borrow this example from[START_REF] Curtiss | Integration of stiff equations[END_REF].

Modern Physics, 54 , 9-17.