Marvin Benzaqui

Renjith S Pillai

Anahid Sabetghadam

Virginie Benoit

Perine Normand

Jérôme Marrot

Nicolas Menguy

David Montero

William Shepard

Antoine Tissot

Charlotte Martineau

Clémence Sicard

Mihail Mihaylov

Florent Carn

Isabelle Beurroies

Philip L Llewellyn

Guy De Weireld

Konstantin Hadjiivanov

Jorge Gascon

Freek Kapteijn

Guillaume Maurin

Nathalie Steunou

Christian Serre

Revisiting the Case of the Microporous Aluminum Trimesate-based MOF (MIL-96): from Structure Determination and Synthesis of Nanoparticles to the Processing of Mixed Matrix Membranes for CO 2 Capture

Keywords: MOF, Polymer, Aluminum, MIL-96(Al), mixed matrix membrane, CO 2 capture

A microporous Al trimesate-based Metal Organic Framework (MOF), denoted MIL-96(Al), was selected as a porous hybrid filler for the processing of Mixed Matrix Membranes (MMMs) for CO 2 /N 2 post combustion separation. First, the structural model of MIL-96(Al) initially reported was revisited using a combination of synchrotron-based single crystal X-ray diffraction (XRD), solid state Nuclear Magnetic Resonance (NMR) spectroscopy and Density Functional Theory (DFT) calculations. In a second step, pure MIL-96 (Al) crystals differing by their size and aspect ratio, including anisotropic hexagonal platelets and nanoparticles of about 70 nm in diameter, were prepared. Then, a combination of in situ IR spectroscopy, single gas and CO 2 /N 2 co-adsorption experiments, calorimetry and molecular simulations revealed that MIL-96(Al) nanoparticles show a relatively high CO 2 affinity over N 2 owing to strong interactions between CO 2 molecules and several adsorption sites such as Al 3+ Lewis centers, coordinated water and hydroxyl groups. Finally, the high compatibility between MIL-96(Al) nanoparticles and the 6FDA-DAM polymer allowed the processing of homogeneous and defect-free MMMs with a high MOF loading (up to 25 wt%) that outperform pure polymer membranes for CO 2 /N 2 separation.

 INTRODUCTION

Metal Organic Frameworks (MOFs) have developed rapidly due to their outstanding properties and myriad of potential applications such as gas storage, separations, catalysis, biomedicine, electronic devices, and information storage among others. 1,[START_REF]Themed issue[END_REF] These hybrid porous crystalline materials consist of periodic coordination networks composed of inorganic building blocks and organic multifunctional ligands and can be rationally designed through crystal engineering. The explosion of interest in this class of materials stems from their endless chemical variability and unprecedented diversity of pore structure (shape and diameter of pores) and topology (two-to three-periodic extended frameworks), enabling the fine-tuning of their physico-chemical features for a targeted application. 1,[START_REF]Themed issue[END_REF][START_REF] Almeida Paz | Ligand Design for Functional Metal-Organic Frameworks[END_REF][START_REF] Padial | Highly Hydrophobic Isoreticular Porous Metal-Organic Frameworks for the Capture of Harmful Volatile Organic Compounds[END_REF] As a result of their crystallinity, these materials are well suited to the in-depth characterization of their structure as well as establishing clear structure-property relationships. [START_REF] Trickett | The Chemistry of Metal-Organic Frameworks for CO 2 Capture, Regeneration and Conversion[END_REF][START_REF] Cadiau | Hydrolytically Stable Fluorinated Metal-Organic Frameworks for Energy-Efficient Dehydration[END_REF] However, the synthesis and/or structure determination of numerous MOFs remains a hurdle particularly due to the high reactivity of their precursors and thus their low crystallinity. [START_REF] Assi | Titanium Coordination Compounds: from Discrete Metal Complexes to Metal-Organic Frameworks[END_REF] In addition, the complexity of their architecture associated with a possible structural disorder (water molecules, guest molecules, free ions, defects,…) and more importantly the existence of crystals with large unit cells and low symmetry have led to the development of methodologies that combine X-ray or neutron diffraction to advanced complementary experimental (solid state NMR, EXAFS, transmission electron microscopy…) and computational tools. [START_REF] Maurin | Role of Molecular Simulations in the Structure Exploration of Metal-Organic Frameworks : Illustrations through recent advances in the field[END_REF] For instance, solid-state NMR experiments integrating high magnetic field, specific pulse sequences, multiple-resonance decoupling and ultrafast magic-angle spinning (MAS) has become a powerful tool to provide information on the local environment of atoms (symmetry, coordination shell…) and probe their spatial proximity and connectivity, thereby constraining the possible structural solutions. [START_REF] Martineau | NMR Crystallography: Applications to Inorganic Materials[END_REF][START_REF] Bonhomme | First-Principles Calculation of NMR Parameters Using the Gauge Including Projector Augmented Wave Method: A Chemist's Point of View[END_REF] Moreover, modelling tools involving energy minimization techniques at the force field (interatomic potential) and/or electronic (quantum) levels were combined with experimental information for the structure resolution of numerous MOFs with low symmetry and/or poor crystallinity. [START_REF] Maurin | Role of Molecular Simulations in the Structure Exploration of Metal-Organic Frameworks : Illustrations through recent advances in the field[END_REF][START_REF] Férey | A Chromium Terephthalate-Based Solid with Unusually Large Pore Volumes and Surface Area[END_REF][START_REF] Alvarez | The Structure of the Aluminum Fumarate Metal-Organic Framework A520[END_REF][START_REF] Rouquerol | In Adsorption by Powders and Porous Solids[END_REF][START_REF] Maurin | The Chemistry of Metal Organic Frameworks : Synthesis, Characterization and Applications[END_REF] Here, this paper intends to reinvestigate the crystallographic structure of the microporous aluminum trimesate MIL-96(Al), [START_REF] Loiseau | MIL-96, a Porous Aluminum Trimesate 3D Structure Constructed from a Hexagonal Network of 18-Membered Rings and  3 -Oxo-Centered Trinuclear Units[END_REF] with a subtle combination of advanced experimental (X-ray diffraction, Solid State NMR, Infra-red spectroscopy) techniques and Density Functional Theory calculations. The periodic aluminum-oxo framework including the coordination sphere of Al centers was carefully determined. Moreover, the location of water molecules and hydroxo groups has allowed the description of the hydrogen-bond network in the porosity of the material. Narrow pores MOFs are a sub-class of porous materials of special interest owing to their pore aperture sizes below 4-7 Å that can potentially address key challenges such as carbon capture and separation of olefin/paraffin, acetylene/ethylene, linear/branched alkanes, xenon/krypton. [START_REF] Adil | Gas/vapour Separation using Ultra-microporous Metal-Organic Frameworks: Insights into the Structure/Separation Relationship[END_REF] The separation ability of MIL-96(Al) was previously demonstrated for several relevant applications of interest. [START_REF] Maes | Separation of C5-Hydrocarbons on Microporous Materials: Complementary Performance of MOFs and Zeolites[END_REF][START_REF] Knebel | Comparative Study of MIL-96(Al) as Continuous Metal-Organic Frameworks Layer and Mixed-Matrix Membrane[END_REF][START_REF] Qiu | Rapid Controllable Synthesis of Al-MIL-96 and Its Adsorption of Nitrogenous VOCs[END_REF][START_REF] Lan | Investigation of Metal Organic Frameworks for the Adsorptive Removal of Hydrochloride from Dilute Aqueous Solution[END_REF][START_REF] Zhang | Al-1,3,5benzenetricarboxylic Metal-Organic Frameworks : A Promising Adsorbent for Defluoridation of Water with pH Insensitivity and Low Aluminum Residual[END_REF] Moreover, its rigid framework with relative small pores incorporating diverse potential adsorption sites (Al acid sites, hydroxyl groups and coordinating water) makes this MOF attractive for the selective capture of CO 2 over N 2 . This has been here further confirmed by a subtle combination of single component CO 2 and N 2 and their binary mixture adsorption measurements and grand canonical Monte Carlo simulations.

Due to its high thermal and hydrothermal stability, MIL-96(Al) was further envisaged for the processing of mixed matrix membrane (MMM) for post-combustion CO 2 capture. These composite membranes which consist of filler particles dispersed into an organic polymer phase potentially combine the gas transport and separation properties of the incorporated particles with the good processability and mechanical properties of the polymers. Indeed, MOFs were recently proposed as fillers due to their outstanding gas separation properties. [START_REF] Trickett | The Chemistry of Metal-Organic Frameworks for CO 2 Capture, Regeneration and Conversion[END_REF] However, MOF-based MMMs suffer from several limitations mainly related to a possible physico-chemical mismatch between MOFs and polymers. [START_REF] Zornoza | Metal Organic Framework based Mixed Matrix Membranes: An Increasingly Important Field of Research with a Large Application Potential[END_REF][START_REF] Seoane | Metal-Organic Framework based Mixed Matrix Membranes: a Solution for Highly Efficient CO 2 Capture?[END_REF][START_REF] Qiu | Metal-Organic Framework Membranes: from Synthesis to Separation Application[END_REF][START_REF] Zhang | Challenges and Recent Advances in MOF-polymer Composite Membranes for Gas Separation[END_REF][START_REF] Denny | Metal-organic Frameworks for Membrane-based Separations[END_REF] Such a lack of chemical compatibility between both components limits the MOF loading of numerous MMMs and thus their performance. [START_REF] Zornoza | Metal Organic Framework based Mixed Matrix Membranes: An Increasingly Important Field of Research with a Large Application Potential[END_REF][START_REF] Seoane | Metal-Organic Framework based Mixed Matrix Membranes: a Solution for Highly Efficient CO 2 Capture?[END_REF][START_REF] Qiu | Metal-Organic Framework Membranes: from Synthesis to Separation Application[END_REF][START_REF] Zhang | Challenges and Recent Advances in MOF-polymer Composite Membranes for Gas Separation[END_REF][START_REF] Denny | Metal-organic Frameworks for Membrane-based Separations[END_REF] Indeed, for numerous MOF based MMMs, the transport properties and thus the selectivity of the membrane are driven by the polymer matrix which is the dominant component. In addition, a poor dispersion of MOFs fillers in the polymer matrix may take place thereby creating interphase defects (macro or nanovoids). [START_REF] Perez | Mixed-Matrix Membranes Containing MOF-5 for Gas Separations[END_REF][START_REF] Ordonez | Molecular Sieving Realized with ZIF-8/Matrimid(R) Mixed-Matrix Membranes[END_REF] Such voids provide bypasses through the MMMs that reduce the separation efficiency and compromise performance. [START_REF] Benzaqui | Toward an Understanding of the Microstructure and Interfacial Properties of PIMs/ZIF-8 Mixed Matrix Membranes[END_REF] In the present study, the shaping of MMMs requires the synthesis of MIL-96(Al) particles at the nanoscale. Therefore, the synthesis of MIL-96(Al) crystals of different morphology and diameter was achieved in water or water/DMF solvents. Two sets of nanoparticles of MIL-96(Al) with a monodisperse size distribution (200 and 70 nm in diameter) were then selected as inorganic fillers for the processing of MMMs. The glassy and high free-volume polyimide 6FDA-DAM was selected owing to its high CO 2 permeability, good mechanical properties and easy processability. Defect-free membranes were prepared that consist of homogeneously distributed MIL-96(Al) particles in the polymer matrix with adequate interfacial properties. Their gas sorption properties were fully characterized, showing very encouraging performances for post-combustion CO 2 /N 2 separation. Such results are very promising in the field of MMMs for CO 2 capture.

 EXPERIMENTAL SECTION.

Microwave Synthesis of MIL-96(Al) hexagonal platelets (MIL-96(Al)-HP). MIL-96(Al)

hexagonal platelets were synthesized by microwave assisted hydrothermal synthesis. Aluminum nitrate nonahydrate (191.7 mg, 0.511 mmol) and trimesic acid (70.4 mg, 0.335 mmol) were dissolved in distilled water (45 mL) under vigorous stirring. Acetic acid (14 µL, 0.25 mmol) was added, and the reaction mixture was stirred for 10 min at room temperature (RT) and then introduced into the microwave oven. After hydrothermal treatment at 200 °C (1600 W) for 2 min, the resulting mixture was cooled down with an ice bath and centrifuged at 14500 rpm for 15 min.

The liquid fraction was discarded and the white product was washed twice with deionized water (30 mL) and twice with EtOH (30 mL). After a final centrifugation, the powder was dried in air at RT.

Synthesis of MIL-96(Al) nanoparticles in water (MIL-96(Al)-NP1). A first solution was

prepared by dissolving trimesic acid (210 mg, 1 mmol) in 70 mL of deionized water under reflux conditions. A second solution was obtained by dissolving aluminum nitrate nonahydrate (570 mg, 1.5 mmol) in 65 mL of deionized water. Both solutions were heated separately under reflux and then the Al solution was poured into the ligand solution. Reflux was kept for about 3 hours and the white powder was cooled down in an ice bath before centrifugation at 14500 rpm for 15 min. The solid was washed twice with deionized water (30 mL) and twice with EtOH (30 mL). Pure MIL-96(Al) nanoparticles were finally obtained and dried in air at RT.

Synthesis of MIL-96(Al) nanoparticles in water/DMF (MIL-96(Al)-NP2 and NP3).

Aluminum nitrate nonahydrate (4.5 g, 12 mmol) and trimesic acid (2.52 g, 12 mmol) were dissolved in 300 mL of a H 2 O/DMF (v:v =1/1) mixture. Acetic acid (1.68 mL, 30 mmol) was added and the mixture was heated under reflux for 16 hours. The resulting white mixture was centrifuged at 14500 rpm for 15 min, and then washed once with deionized water (30 mL), one more time with a H 2 O/EtOH (1/1) mixture (30 mL) and finally with EtOH (30 mL). The obtained white powder was dried at RT and pure MIL-96(Al) NP (i. e. MIL-96(Al)-NP2) of 200 nm in diameter were obtained, with no traces of trimesic acid, nitrates or DMF. MIL-96(Al) NP of 70 nm in diameter (i. e. MIL-96(Al)-NP3) were also prepared at the gram scale by using the same reactants but with concentrations two times lower.

Preparation of MIL-96(Al)-6FDA-DAM MMMs.

A high free-volume 6FDA-DAM copolymer supplied by Akron was used. 6FDA-DAM was degassed at 453 K under vacuum overnight. A polymer solution was prepared by dissolving 0.4 g of polymer in 3 mL of tetrahydrofuran (THF). MIL-96(Al) crystals (NP2 and NP3) were dispersed in 1.5 mL of THF by ultrasonication and stirring for 30 min. Then, 10 % of the volume of the polymer solution was added to the MOF suspension followed by further stirring for 2 h (priming). The remaining volume of polymer solution was added to the MOF suspension and stirred overnight. This slurry solution was poured on the glass plate and casted by Doctor Blade technique tuning the thickness to about 80 µm. The solvent/(filler + polymer) weight ratio was kept constant (90/10) for all MMMs. MMMs were prepared with a MOF loading of 25 wt.%. Then, membranes were covered with a top-drilled box, and dried overnight under THF-saturated atmosphere. Finally, they were peeled off and heat treated at 433 K for 24 h under vacuum.

 RESULTS AND DISCUSSION

Synthesis of MIL-96(Al) and structure resolution by combining single-crystal X-ray

Diffraction, solid-state NMR and DFT calculations.

The microporous MIL-96(Al) (see Figures 1 and2) was first reported using hydrothermal conditions from a mixture of trimesic acid (BTC) and aluminum nitrate. [START_REF] Loiseau | MIL-96, a Porous Aluminum Trimesate 3D Structure Constructed from a Hexagonal Network of 18-Membered Rings and  3 -Oxo-Centered Trinuclear Units[END_REF] However these conditions have to be strictly controlled since two larger-pore Al trimesates, MIL-100(Al) and MIL-110(Al), among others, can be produced in the same reaction system. [START_REF] Qiu | Rapid Controllable Synthesis of Al-MIL-96 and Its Adsorption of Nitrogenous VOCs[END_REF][START_REF] Khan | Phase-Selective Synthesis and Phase-Conversion of Porous Aluminum-Benzenetricarboxylates with Microwave Irradiation[END_REF][START_REF] Haouas | In Situ NMR, Ex Situ XRD and SEM Study of the Hydrothermal Crystallization of Nanoporous Aluminum Trimesates MIL-96, MIL-100, and MIL-110[END_REF][START_REF] Seoane | Metal Organic Framework Synthesis in the Presence of Surfactants: Toward Hierarchical MOFs[END_REF][START_REF] Qiu | Controllable Assembly of Al-MIL-100 via an Inducing Occupied effect and Its Selective Adsorption Activity[END_REF] Indeed, it was reported that MIL-100(Al) is the kinetic phase of this system and forms at short reaction times and low pH, whereas MIL-96(Al) is mainly obtained for longer reaction times following a crystallizationhydrolysis-recrystallization process. [START_REF] Haouas | In Situ NMR, Ex Situ XRD and SEM Study of the Hydrothermal Crystallization of Nanoporous Aluminum Trimesates MIL-96, MIL-100, and MIL-110[END_REF] In addition, this route involves the use of HF and tetraethoxysilane. [START_REF] Loiseau | MIL-96, a Porous Aluminum Trimesate 3D Structure Constructed from a Hexagonal Network of 18-Membered Rings and  3 -Oxo-Centered Trinuclear Units[END_REF] We also failed to reproduce single crystals of MIL-96(Al) of a suitable size following this method. Thus, we developed first an alternative easier and friendlier hydrothermal route by using a mixture of trimesic acid and aluminum nitrate in water at 180°C (rather than The structure of MIL-96 (Al), initially described by Loiseau et al., [START_REF] Loiseau | MIL-96, a Porous Aluminum Trimesate 3D Structure Constructed from a Hexagonal Network of 18-Membered Rings and  3 -Oxo-Centered Trinuclear Units[END_REF] presents four non-equivalent aluminum sites. The fourth aluminum labelled as Al4, exhibits very short and unrealistic Al-O distances which suggests a crystallographic disorder of the initial structure. Therefore, in the present article, this structure has been reinvestigated using first microfocused beam synchrotron-based single crystal X-ray diffraction (see SI for details). As previously described, the structure results from the assembly of two distinct building units (see Figures 2(a) and(b)). The first one is an oxocentered trimer {Al(1)} of crystallographically equivalent Al(1) octahedra which are coordinated to bridging trimesate and  3 -O ligands (see Figure 2(c). The second building unit consists of a 2D hexagonal network containing 18-membered rings built by sinusoidal chains of aluminum octahedra. These chains contain two non-equivalent types of aluminum, Al (2) and Al (3), which are coordinated to four and two trimesate oxygen atoms and two and three bridging  2 -hydroxo moieties (Figures 2(d) and (e) respectively. The hexagonal 18-membered rings are interconnected each other by another type of trimer. This 'unusual' {Al(3)} trimer, seldom observed so far in the field of MOFs, is composed of three Al(3) octahedra that are corner-linked by µ 2 -OH groups. The connection of the {Al(1)} trimer with the 2D network of Al(2) and Al(3) octahedra through the trimesate ligands results in a 3D framework with a complex arrangement of three types of cavities (see Figure S2 and Table S1 of SI). The microporosity of MIL-96(Al) consists of one spherical cage A with a cavity-free diameter of about 11 Å, an elongated cavity B with dimensions of 9.5 x 12.6 x 11.3 Å and a narrow cavity C with dimensions of 3.6 x 4.5 Å. The complex packing and connectivity between cavities as described in Figure S3 shows that cavities of the same type (A-A, B-B or C-C) are not connected.

According to the size of the windows between two cavities that could be estimated from the van der Waals radius of oxygen atoms, windows between cavity B and cavity C are relatively narrow (≈ 4.5 Å x 3.6 Å) and hence accessible to H 2 , CO 2 and to a lesser extent to N 2 (Figure S4) which is crucial for high CO 2 /N 2 selectivity. On the other hand, no connection between cavity A and cavities B/C is possible which means that cavity A is isolated in the structure. Consequently, MIL-96(Al) presents a two-dimensional (2D) pore structure that consists of "zig-zag" channels between cavities B and C (Figure S3). The nitrogen adsorption isotherm of MIL-96(Al) at 77 K (Figure S5(a)) is of type I(a) from the IUPAC classification which is characteristic of a microporous adsorbent. A BET area of ~ 60010 m².g -1 and a pore volume of 0.23 cm 3 .g -1 are obtained. In addition, the semi-logarithmic plot of the N 2 isotherm is consistent with a narrow pore size distribution (Figure S5(b)).

In contrast to the previously reported structure, [START_REF] Loiseau | MIL-96, a Porous Aluminum Trimesate 3D Structure Constructed from a Hexagonal Network of 18-Membered Rings and  3 -Oxo-Centered Trinuclear Units[END_REF] no electronic residue could be attributed to a fourth octahedral aluminum site. This observation contradicts the initial set of [START_REF] Perez | Mixed-Matrix Membranes Containing MOF-5 for Gas Separations[END_REF] Al MAS NMR spectroscopy data which evidenced the presence of four [START_REF] Perez | Mixed-Matrix Membranes Containing MOF-5 for Gas Separations[END_REF] Al NMR signals in MIL-96(Al). [START_REF] Loiseau | MIL-96, a Porous Aluminum Trimesate 3D Structure Constructed from a Hexagonal Network of 18-Membered Rings and  3 -Oxo-Centered Trinuclear Units[END_REF] In order to explain such a deviation, this phase was thoroughly investigated by combining solid state NMR, thermogravimetric analysis (TGA), and density functional theory (DFT) calculations. First, the [START_REF] Perez | Mixed-Matrix Membranes Containing MOF-5 for Gas Separations[END_REF] Al MQMAS NMR spectrum (see Figure S6(a) of SI) of the hydrated MIL-96(Al) shows only three [START_REF] Perez | Mixed-Matrix Membranes Containing MOF-5 for Gas Separations[END_REF] Al signals at  iso of 3.2, 3.4 and 6.2 ppm, which, according to the deconvolution of the [START_REF] Perez | Mixed-Matrix Membranes Containing MOF-5 for Gas Separations[END_REF] Al MAS NMR spectrum (Figure 3(a)) have respective relative intensity close to 1:1:2 (see Table S2 for the NMR parameters). This is consistent with the presence in the crystal structure of three Al sites with different multiplicity (the multiplicity of Al(1) and Al(2) is 6 while that of Al(3) is 12), and indicates that Al(3) corresponds to the line at 6.2 ppm. Al(1) and Al(2) can be distinguished based on the [START_REF] Perez | Mixed-Matrix Membranes Containing MOF-5 for Gas Separations[END_REF] Al- [START_REF] Perez | Mixed-Matrix Membranes Containing MOF-5 for Gas Separations[END_REF] Al double-quantum single-quantum (DQ-SQ) NMR spectrum, in which close spatial proximities between [START_REF] Perez | Mixed-Matrix Membranes Containing MOF-5 for Gas Separations[END_REF] Al nuclei are observed. This spectrum (Figure 3 S2), and thus are assigned to Al(3'), Al(2), Al(1) and Al(3), respectively. Note that the [START_REF] Perez | Mixed-Matrix Membranes Containing MOF-5 for Gas Separations[END_REF] Al NMR spectrum reported previously by Loiseau et al [START_REF] Loiseau | MIL-96, a Porous Aluminum Trimesate 3D Structure Constructed from a Hexagonal Network of 18-Membered Rings and  3 -Oxo-Centered Trinuclear Units[END_REF] was similar to our spectrum with the presence of 4 signals (one was assigned to the fourth aluminum site not present in our new model). However, the relative intensity of the signals is different, suggesting that the corresponding NMR spectrum was initially collected on a partially hydrated sample. This observation points out the importance of accurately controlling the hydration state of hydrophilic MOFs prior to NMR measurements. In the [START_REF] Perez | Mixed-Matrix Membranes Containing MOF-5 for Gas Separations[END_REF] Al- [START_REF] Perez | Mixed-Matrix Membranes Containing MOF-5 for Gas Separations[END_REF] Al DQ-SQ NMR spectrum, the Al(3) resonance is no longer associated with a diagonal peak but strongly correlates with the signal of Al(3'). All these results are consistent with the presence of one Al(3) and two equivalent Al(3)' sites in each {Al(3)} trimer of the dehydrated MIL-96(Al).

According to the single crystal X-ray structure and TGA analysis (Figure S7 The structural model of the anhydrous MIL-96(Al) thus proposed was geometry optimized at the DFT-level (Figure S29). These calculations included the relaxation of the atomic positions of the MOF framework while the unit cell parameters were fixed at the values determined experimentally.

The same procedure was applied to the hydrated form of MIL-96(Al) starting with the experimental structural model containing a concentration of free water present in the pores as determined by TGA (58 H 2 O/u.c.) (Figure S7). In this case, the positions of both the atoms of the MOF framework and the free water molecules were relaxed. The so-obtained structural models were further validated by a good agreement between the first-principle calculated [START_REF] Perez | Mixed-Matrix Membranes Containing MOF-5 for Gas Separations[END_REF] Al NMR parameters including isotropic chemical shifts as well as quadrupolar coupling constants/asymmetric constants and the corresponding experimental data (see Table S2). The DFT predicted structure for the hydrated form reveals that the free water molecules make strong hydrogen bonds with the framework (Al centres or hydroxy groups, trimesate ligands, or coordinating water molecules) (see Fig. 4(a)). between water and water coordinated to framework (blue), between water and hydroxyl group coordinated to framework (orange), between the water and the μ 2 -OH functions (green) and between the water and the carboxylate group Oc (purple). Hydrogen bonds are involved between free water molecules and coordinative water molecules at the Al(1) sites (blue). Water molecules located near to the Al(2) sites are arranged in such a way to form hydrogen bonds with the framework between 1) their oxygen atoms Ow and the proton of the µ 2 (OH) functions (orange) and 2) their protons Hw and the oxygen atoms of the carboxylate group (purple). In addition, the water molecules located near to Al(3) sites make hydrogen bonds with framework between 1) their protons Hw and the oxygen atoms of either the hydroxyl group (orange) or water coordinated to Al(3') and/or Al(3) sites (blue) and 2) their oxygen atoms Ow and the proton of the nearby water molecules (black).

(a) (b)

The characteristic distances between two water/host oxygen atoms range from 2.6 and 3.05 Å, which fit well with those evidenced from the experimentally-refined structure. The confined water molecules form a relatively strong hydrogen bond network with corresponding Ow-Ow distances (2.77 Å) as short as those usually observed for water in the bulk state. This H 2 O network is extended throughout the porosity by hydrogen bonded water molecules between cavities B and C as shown in Figure S9. Finally, a theoretical accessible surface area of 700 m².g -1 was evaluated, in fair agreement with the BET area of 600 m².g -1 (see vide supra), thereby providing additional evidence of the reliability of the so-built structural models.

Control of the particle size and morphology: synthesis of nanoparticles of MIL-96(Al).

The characteristic morphology of MIL-96(Al) crystals, as initially described, is that of a truncated hexagonal bipyramid. [START_REF] Loiseau | MIL-96, a Porous Aluminum Trimesate 3D Structure Constructed from a Hexagonal Network of 18-Membered Rings and  3 -Oxo-Centered Trinuclear Units[END_REF] Several solvo-and hydrothermal routes led to MIL-96(Al) crystals with such a morphology but with different diameters (ranging from 0.8 µm to 40 µm) using Me 3 BTC or trimesic acid. [START_REF] Qiu | Rapid Controllable Synthesis of Al-MIL-96 and Its Adsorption of Nitrogenous VOCs[END_REF][START_REF] Haouas | In Situ NMR, Ex Situ XRD and SEM Study of the Hydrothermal Crystallization of Nanoporous Aluminum Trimesates MIL-96, MIL-100, and MIL-110[END_REF][START_REF] Sindoro | Shape-Selected Colloidal MOF Crystals for Aqueous Use[END_REF][START_REF] Liu | Size-and Morphology-Controllable Synthesis of MIL-96(Al) by Hydrolysis and Coordination Modulation of Dual Aluminum Source and Ligand Systems[END_REF] . Finally, nanoparticles of MIL-96(Al) (from 160 nm to 55 nm) were recently reported by Knebel et al. [START_REF] Knebel | Comparative Study of MIL-96(Al) as Continuous Metal-Organic Frameworks Layer and Mixed-Matrix Membrane[END_REF] following a solvothermal synthesis in a mixture of H 2 O/DMF solvents.

We report here several synthesis routes yielding to pure MIL-96(Al) with various morphology and size, down to the nanoscale as required for further MMM preparation. Microwave (MW)-assisted synthesis is known to reduce the size and the polydispersity of the particles due to fast and homogeneous heating favoring the nucleation process. [START_REF] Reinsch | High-throughput Studies of Highly Porous Al-based MOFs[END_REF] In contrast to the synthesis conditions of MIL-96(Al)-HR, the initial aqueous solution of both aluminum and ligand precursors was diluted and an amount of acetic acid was added. A 2 minute microwave assisted hydrothermal synthesis performed at 473 K led to pure MIL-96(Al) hexagonal platelets (i. e. MIL-96(Al)-HP), with a diameter of a few micrometers and an average thickness of a few 100 nm as determined by SEM (see Figure 1(b)). This process shows that MIL-96(Al) can be isolated even at short reaction times as a pure phase without the presence of MIL-100(Al) or MIL-110(Al). Noteworthy, PXRD of both MIL-96(Al)-HR and -HP (Figure 5(a)) show changes in relative intensity of several Bragg peaks indicating a preferential orientation of such crystals with a shape anisotropy. This phenomenon is noticeable by comparing PXRD recorded with reflection (Bragg-Brentano method) and transmission (Debye-Sherrer method) geometry for HR (Figure S10) and HP (Figure S11).

Hexagonal rods present a strong (010) reflection while the intensity of (00l) peaks is reduced, and (002) almost extinct. On the other hand, (00l) and (0kl) reflections are much more intense in crystals with hexagonal platelet morphologies. Therefore, (0k0) (and thus (h00)) reflections can be assigned to the long facets of hexagonal rods while (0kl) (and by symmetry (h0l)) reflections correspond to the trigonal facets present on top of the hexagonal platelets (see Figure 5 (b,c)), in agreement with that previously reported for MIL-96(Al) crystals of similar morphology. [START_REF] Knebel | Comparative Study of MIL-96(Al) as Continuous Metal-Organic Frameworks Layer and Mixed-Matrix Membrane[END_REF] Since acetic acid may act as a modulator as reported for several polycarboxylate based MOFs, [START_REF] Zahn | Insight into the Mechanism of Modulated Syntheses: in situ Synchrotron Diffraction Studies on the Formation of Zr-fumarate MOF[END_REF][START_REF] Schaate | Modulated Synthesis of Zr-Based Metal-Organic Frameworks: From Nano to Single Crystals[END_REF] it can be suggested that the presence of acetic acid impacts the nucleation and growth of MIL-96(Al) crystals and thus its morphology. However, even without this modulator, MIL-96(Al)-HP was also obtained along with MIL-100(Al) as a by-product. Such results emphasize that the formation of trimesate Al-based MOFs strongly depends on the speciation of molecular Al complexes in solution. The MW synthesis conditions were transferred to reflux synthesis in water. An aqueous diluted solution of Al salt, trimesic acid and acetic acid was heated at reflux (~100°C) for a variable period of time. After that synthesis conditions without acetic acid led to MIL-96(Al) nanocrystals with a similar size and shape, however with a larger polydispersity in diameter (i. e. diameter of particles of 190±100 nm, see Figure S14). Such results are consistent with those previously reported by Sindoro et al. SI). Nitrogen adsorption/desorption measurements (77 K) can be used to extract an 'external surface area' (i.e. without the porosity) and it would be expected that the smaller the particles, the higher the external surface area. The t-plot analysis was used which leads to values of 6, 40 and 100 m²/g for the -HR, -NP2 and -NP3 samples highlighting the increasing nanoparticular size of this series.

(Figure S17). Dilute solutions of MIL-96(Al)-NP2 and MIL-96(Al)-NP3 in water were then studied by Small Angle X-Ray Scattering (SAXS). The SAXS curves (Figure 5 region), [START_REF] Leclerc | Infrared Study of the Influence of Reducible Iron(III) Metal Sites on the Adsorption of CO, CO 2 , Propane, Propene and Propyne in the Mesoporous Metal-Organic Framework MIL-100[END_REF][START_REF] Lieb | MIL-100(V) -A Mesoporous Vanadium Metal Organic Framework with Accessible Metal Sites[END_REF] (ii) a significant amount of adsorbed water (OH stretching band at 3388 cm -1 and combination band at 5215 cm -1 , as well as a (D 2 O) band at ca. 1205 cm -1 recorded with the deuterated sample) [START_REF] Hadjiivanov | Identification and Characterization of Surface Hydroxyl Groups by Infrared Spectroscopy[END_REF] and (iii) the existence of some amount of "free" -OH groups that are not involved in H-bonding with adsorbed water (combination band around 4690 cm -1 and deformation band at 1071 cm -1 ). [START_REF] Hadjiivanov | Identification and Characterization of Surface Hydroxyl Groups by Infrared Spectroscopy[END_REF] The position of the latter IR bands indicates a very low acidity of (at least part of) the OH groups. Since the activation procedure for MOFs strongly impacts their sorption capacity, FTIR spectra of the MIL-96(Al)-HR sample were recorded after outgassing at increasing temperature. Water trapped in the MOF is mostly removed by outgassing at RT as evidenced by the strong decrease in intensity of the bands at 5215 and 3388 cm -1 (Figure 6(A), spectrum b). Only Further, the remaining water is removed after evacuation at 423-448 K, in agreement with TGA results. The removal of the water leads to the appearance of "free" OH groups, as shown by two characteristic combination bands at 4688 and 4640 cm -1 . In addition, a set of bands appears in the (OH) region, the assignment of which is more complicated due to the possible overlapping between OH vibrations of adsorbed water and free hydroxyl groups. [START_REF] Hadjiivanov | Identification and Characterization of Surface Hydroxyl Groups by Infrared Spectroscopy[END_REF] For a correct assignment, partly deuterated samples were also investigated, thereby showing that all bands above 3600 cm -1 are due to -OH groups (see details in Figure S19 of SI). Therefore, the water OH modes appear below 3600 cm -1 which suggests that the two protons of residual adsorbed water are involved in Hbonding with basic sites (presumably oxygen atoms of carboxylates) from the MOF structure. The T-type species (3695, 3681 cm -1 ) are assigned to structural terminal Al-OH hydroxyl while the B type species (3650, 3639, 3623 cm -1 ) can be attributed to bridging  2 -OH type groups. [START_REF] Hadjiivanov | Identification and Characterization of Surface Hydroxyl Groups by Infrared Spectroscopy[END_REF] In addition, stable H-bonded OH groups (C-type) were also detected by a band at 3275 cm -1 . (Figure 6B, spectrum d). The low (OH) frequency and the large band width indicate that these hydroxyls are also involved in strong H-bonding with basic sites from the walls and are likely confined in small pores (presumably cages C). The bands of the terminal hydroxy develop after evacuation at RT as a result of the breaking of OH(H 2 O) bonds which confirms the very weak acidity of these hydroxyls. Upon evacuation, the intensity of these bands decreases above 323 K pointing out some possible dеhydroxylation process (for details see Figure S20). Bridging and C-type hydroxy groups are thermally stable. (see Figures S19-20 and the SI for more details). As shown by [START_REF] Perez | Mixed-Matrix Membranes Containing MOF-5 for Gas Separations[END_REF] Al NMR spectroscopy, a modification of the Al environment takes place at temperatures higher than 473 K: a [START_REF] Perez | Mixed-Matrix Membranes Containing MOF-5 for Gas Separations[END_REF] Al resonance centred around 35 ppm, corresponding to five-coordinated Al sites, appears (Figure S21). Finally, we studied samples activated at different temperatures and then subjected to water vapor and evacuated again at ambient temperature (Figure S22). Noteworthy, the reversibility of water adsorption/desorption and the excellent stability of MIL-96(Al) under water atmosphere or after thermal evacuation treatments was confirmed as the final spectra are essentially the same for samples evacuated up to 473 K.

In order to probe the accessibility of the cavities of MIL-96(Al)-HR for gas sorption and to assess the Brønsted and Lewis acidity, adsorption of different probe molecules (CO, [START_REF] Loiseau | MIL-96, a Porous Aluminum Trimesate 3D Structure Constructed from a Hexagonal Network of 18-Membered Rings and  3 -Oxo-Centered Trinuclear Units[END_REF] at 2155-2152 cm -1 42 which develops with the pre-evacuation temperature up to 473 K (due to an increase in accessibility) and then decreases as a result of a possible dehydroxylation. Since two kinds of terminal OH groups (T1 and T2) differ only in the extent of H-bonding to the framework, the formation of OHCO adducts leads to a red shift of the two OH modes to one band at 3669 cm -1 . This phenomenon indicates breaking of the pre-existing H-bond and the shift value is consistent with the very weak acidity of the hydroxyls. The same phenomena are observed with the bridging hydroxyls. Some Al 3+ coordinatively unsaturated sites (CUS) are also detected by CO or [START_REF] Loiseau | MIL-96, a Porous Aluminum Trimesate 3D Structure Constructed from a Hexagonal Network of 18-Membered Rings and  3 -Oxo-Centered Trinuclear Units[END_REF] N 2 (adsorbed at 100 K) with a sample evacuated at temperatures as high as 423 K. In contrast to the low-temperature experiments, adsorption of CO 2 on a sample evacuated at RT leads to the formation of Al 3+ OCO ( 3 (CO 2 ) at 2345 cm -1 ) and OHOCO adducts (2338 cm -1 ). [START_REF] Mihaylov | Adsorption of CO 2 on MIL-53(Al): FTIR Evidence of the Formation of Dimeric CO 2 Species[END_REF][START_REF] Serre | An Explanation for the Very Large Breathing Effect of a Metal-Organic Framework during CO 2 Adsorption[END_REF] The amount of the former species increases with the pre-evacuation temperature up to 473 K due to the removal of coordinated water while that of OHOCO decreases. According to IR spectroscopy, MIL-96(Al) needs to be activated by outgassing the sample to around 423 K in order to remove all the free water or residual free trimesic acid. Single gas adsorption experiments were first performed on MIL-96(Al)-NP2 samples. Figure 7(a) shows the excess adsorption isotherms of pure single gas components CO 2 and N 2 obtained at 303 K for MIL-96(Al)-NP2 activated at 423 K (see Fig. S27 for comparison with isotherms on MIL-96(Al)-HR).

At 1 bar , the adsorption capacities are 3.2 mmol.g -1 for CO 2 while much lower capacity of about 0.2 mmol.g -1 for N 2 is obtained. Grand Canonical Monte Carlo (GCMC) simulations were carried out at 303 K to predict the single component adsorption of CO 2 , and N 2 (see SI for details). The experimental findings are qualitatively reproduced by the GCMC simulations (see Figure 7(a)), even though the calculated amounts adsorbed slightly overestimate the experimental data for the two gases. This discrepancy is likely due to the fact that GCMC simulations consider that both gases can adsorb in the entire porosity available in the solid. As explained above, the adsorption of gas in MIL-96(Al) might be restricted to cavities B and C since cavities A seem to be isolated in the framework. Interestingly, the experimental adsorption uptakes of CO 2 at 1 bar (~3.2 mmol.g -1 at 303 K) and 10 bar (~6.3 mmol.g -1 ) are among the best performances for small pore MOFs previously reported for CO 2 separation such as MIL-91(Ti) (~3.0 mmol.g -1 at 1 bar/303K and ~4.5 mmol.g -1 at 10 bar/303 K), [START_REF] Benoit | MIL-91(Ti), a Small Pore Metal-organic Framework Which Fulfils Several Criteria: An Upscaled Green Synthesis, Excellent Water Stability, High CO 2 Selectivity and Fast CO 2 Transport[END_REF] MIL-53(Al)-NH 2 (1.6 mmol.g -1 at 283 K and 1 bar), [START_REF] Stavitski | Complexity behind CO 2 Capture on NH 2 -MIL-53(Al)[END_REF] Sc 2 (BDC-NO 2 ) 3 (1.1 mmol.g -1 at 303 K and 1 bar), [START_REF] Pillai | Highly Selective CO 2 Capture by Small Pore Scandium-Based Metal-Organic Frameworks[END_REF] UiO-66(Zr)-2COOH (1.0 mmol.g -1 at 303 K and 1 bar) [START_REF] Yang | A Water Stable Metal-Organic Framework with Optimal Features for CO 2 Capture[END_REF] and SIFSIX-3-Zn (2.3 mmol.g -1 at 308 K and 1 bar). [START_REF] Nugent | Porous Materials with Optimal Adsorption Thermodynamics and Kinetics for CO 2 Separation[END_REF] However, this CO 2 adsorption capacity value is lower than both that of a benchmark zeolite 13X (5.0 mmol.g -1 at 1 bar and 298 K) [START_REF] Cavenati | Adsorption Equilibrium of Methane, Carbon Dioxide, and Nitrogen on Zeolite 13X at High Pressures[END_REF] and Mg-MOF-74 (8.0 mmol.g -1 at 1 bar and 298 K), although the latter is not water stable. [START_REF] Caskey | Dramatic Tuning of Carbon Dioxide Uptake via Metal Substitution in a Coordination Polymer with Cylindrical Pores[END_REF] The initial slope of the CO 2 adsorption isotherm is significantly higher than that of N 2 and this emphasizes a much stronger affinity of MIL-96(Al) for CO 2 . Such results are fully consistent with FT-IR, showing a strong adsorption of CO 2 at both the Lewis acid Al 3+ sites (2345 cm -1 ) and terminal/bridging hydroxyl groups (2338 cm -1 ) of MIL-96(Al)-HR (see Figure S26). The enthalpy of adsorption for CO 2 in MIL-96(Al)-NP2 as a function of loading is given in Figure 7 kJ.mol -1 and -30 kJ.mol -1 throughout the CO 2 uptake except at lower coverage. This relatively flat energetic profile indicates a homogeneous energetic interaction with the adsorption sites.

Interestingly, this adsorption enthalpy for CO 2 is substantially higher or comparable to other MOFs (i. e. UiO-66(Zr) :∼ -26 kJ mol -1 , [START_REF] Yang | Functionalizing Porous Zirconium Terephthalate UiO-66(Zr) for Natural Gas Upgrading: a Computational Exploration[END_REF] UiO-66(Hf)-(OH) 2 : -28.4 kJ mol -1 , [START_REF] Hu | Modulated Hydrothermal Synthesis of UiO-66(Hf)-Type Metal-Organic Frameworks for Optimal Carbon Dioxide Separation[END_REF] and UiO-66(Hf) : ∼ -22.8

kJ mol -1 , [START_REF] Hu | Modulated Hydrothermal Synthesis of UiO-66(Hf)-Type Metal-Organic Frameworks for Optimal Carbon Dioxide Separation[END_REF] however lower than other highly efficient CO 2 adsorbents such as zeolite 13X (-38 kJ mol -1 ), [START_REF] Cavenati | Adsorption Equilibrium of Methane, Carbon Dioxide, and Nitrogen on Zeolite 13X at High Pressures[END_REF] and MIL-91(Ti) :~ -43 kJ.mol -1 ), [START_REF] Benoit | MIL-91(Ti), a Small Pore Metal-organic Framework Which Fulfils Several Criteria: An Upscaled Green Synthesis, Excellent Water Stability, High CO 2 Selectivity and Fast CO 2 Transport[END_REF] MIL-53(Al)-NH 2 : ~ -40 kJ.mol -1 46,54 , Mg-MOF-74 (∼ -50 kJ.mol -1 ), [START_REF] Caskey | Dramatic Tuning of Carbon Dioxide Uptake via Metal Substitution in a Coordination Polymer with Cylindrical Pores[END_REF][START_REF] Britt | Highly Efficient Separation of Carbon Dioxide by a Metal-Organic Framework Replete with Open Metal Sites[END_REF] SIFSIX-3-Zn (-45 kJ.mol -1 ), [START_REF] Nugent | Porous Materials with Optimal Adsorption Thermodynamics and Kinetics for CO 2 Separation[END_REF] and SIFSIX-3-Co (-47 kJ.mol -1 ). [START_REF] Elsaidi | Hydrophobic Pillared Square Grids for Selective Removal of CO 2 from Simulated Flue Gas[END_REF] Such a moderate adsorption enthalpy suggests an easy reversibility of adsorption-desorption cycles which is highly desirable for the adsorbent regeneration process as a balance between separation performance and energy cost is required in real industrial operations. Experimental and simulated enthalpy values of N 2 adsorption are lower than that of CO 2 , confirming the much lower affinity of MIL-96(Al) for this guest molecule. However, this value is higher than many medium to large pore MOFs but less than those containing CUS sites, suggesting that the small amount of nitrogen adsorbed is relatively confined, as reported for other MOFs with small pores size (3.0-4.0Å). [START_REF] Adil | Gas/vapour Separation using Ultra-microporous Metal-Organic Frameworks: Insights into the Structure/Separation Relationship[END_REF][START_REF] Benoit | MIL-91(Ti), a Small Pore Metal-organic Framework Which Fulfils Several Criteria: An Upscaled Green Synthesis, Excellent Water Stability, High CO 2 Selectivity and Fast CO 2 Transport[END_REF] The sorption-based binary gas separation performance of MIL-96(Al)-NP2 was evaluated by considering post-combustion CO 2 capture, in which 10% to 15% of CO 2 needs to be removed from flue gas mixtures containing N 2 . Co-adsorption measurements were performed on about 10 g of MIL-96(Al)-NP2. Such real co-adsorption data, rarely reported in the literature, were collected by using an advanced homemade device that combines a volumetric apparatus and gas chromatography analysis (see SI for more details). The measurements were performed at 303 K for a gas mixture S6). The almost unchanged CO 2 /N 2 selectivity of MIL-96(Al)-NP2/6FDA-DAM MMM for increased CO 2 concentration is in line with the nearly constant selectivity for the CO 2 /N 2 co-adsorption of pure MOF (see vide supra). Although the permeability of the membrane decreased (~27 %) with increased CO 2 concentration, ascribed to saturation of adsorption sites in the membrane matrix, [START_REF] Paul | Gas Sorption and Transport in Glassy Polymers[END_REF] the CO 2 flux through the membrane nevertheless increases with concentration. The influence of the humidity on the CO 2 /N 2 separation properties of the neat 6FDA-DAM and MIL-96(Al)-NP3/6FDA-DAM membranes was further evaluated (see details in SI). As shown in Table S7, similar results of CO 2 /N 2 permeability and selectivity were obtained for MIL-96(Al)-NP3/6FDA-DAM membranes exposed to air humidity after two cycles of adsorption/desorption of water. The impact of humidity on the permeation of neat 6FDA-DAM membrane is almost negligible.

Finally, the performance in terms of permeability and selectivity of the MIL-96(Al) based MMMs regarding the Robeson 2008 limit is illustrated in Figure S33. [START_REF] Robeson | Correlation of Separation Factor Versus Permeability for Polymeric Membranes[END_REF][START_REF] Robeson | The Upper Bound Revisited[END_REF] A comparison of their performance with membranes prepared with 6FDA-based polymer is also shown (see Fig. S33 and Table S8). Although the Robeson upper bound is not exceeded, the addition of the filler significantly improved the overall performance of the neat polymeric membrane. Moreover, in comparison to MMMs previously reported, the composite membranes based on MIL-96(Al) present promising performances for post combustion application with enhanced CO 2 /N 2 selectivity.  CONCLUSION

In the present study, by using a wide variety of advanced complementary experimental and computational tools, the crystalline structure of the microporous Al trimesate MIL-96(Al) (anhydrous or hydrated) was reinvestigated allowing a clear description of the local environment of Al sites (symmetry, nature of oxygen ligands). This refinement was required in order to fill gaps in the original structural model reported for MIL-96(Al), [START_REF] Loiseau | MIL-96, a Porous Aluminum Trimesate 3D Structure Constructed from a Hexagonal Network of 18-Membered Rings and  3 -Oxo-Centered Trinuclear Units[END_REF] which remained questionable due to inconsistencies between solid state NMR and single crystal XRD experiments. The complex hydrogen bond network formed by the adsorbed water molecules within the MOF framework and its hydroxyl groups was fully described. Several synthesis routes were reported leading pure MIL-

  Figure 1(a) and Figure S1 of SI).

Figure 1 .

 1 Figure 1. SEM images of the different MIL-96(Al) particles: a) Hexagonal rods (HR), b) hexagonal platelets (HP); c) nanoparticles from reflux in water (NP1); d) nanoparticles from reflux in H 2 O/DMF (NP2); e) SEM image of NP3 and f) TEM-bright field image of NP3.

Figure 2 .

 2 Figure 2. (a) Framework of MIL-96(Al) along c axis; (b) Framework of MIL-96(Al) along a axis; (c-e) Structural description of the different inorganic sub-units of MIL-96(Al): (c) {Al(1)}trimer (d) Sinusoidal chain composed of two Al(3) bridged by Al(2); (e) {Al(3)} trimer.

  (c)) shows a pair of crosspeak between Al(3) and the line at 3.4 ppm, which is thus assigned to the connected Al(2) center. A strong diagonal peak for the Al(3) resonance is observed, in agreement with the presence of connected Al(3) octahedra. For Al(1), only a diagonal peak is detected in agreement with the presence of isolated Al(1) sites. Upon dehydration of the MIL-96(Al) at 423 K, removal of water molecules entrapped in the porosity of MIL-96(Al) takes place without altering the crystallographic structure of MIL-96(Al) as shown both by TGA and temperature-dependent Powder X-ray Diffraction (PXRD) (see Figures S7 and S8). However, the dehydration provokes a modification of the local environment of Al 3+ cations since a fourth 27 Al resonance (labelled Al(3')) is detected in the 27 Al 1D MAS, (Figure 3(b)) MQMAS (Figure S6(b) of SI) and 27 Al-27 Al DQ-SQ NMR spectra (Figure 3(d)).

Figure 3 .

 3 Figure 3. Experimental (Exp.) and deconvoluted (Dec.) 27 Al MAS NMR spectra of MIL-96(Al) (a) hydrated, (b) dehydrated (i.e. previously dried overnight at 423 K). The individual contributions are shown below. 27 Al-27 Al DQ-SQ correlation NMR spectra of (c) hydrated MIL-96(Al) and (d) dehydrated MIL-96(Al). The diagonal has a slope of 2. For (c) the auto-correlations Al(3)-Al(3) and Al(1)-Al(1) are the diagonal peaks while the cross-correlation Al(3)-Al(2) is indicated by the dashed line. For (d) the auto-correlations Al(3')-Al(3') and Al(1)-Al(1) are the diagonal peaks while the cross-correlation Al(3)-Al(3') and Al(3)-Al(2) are indicated by the dashed lines. (e,f) A view of the {Al(1)} and {Al(3)} trimers sub-units of (e) hydrated MIL-96(Al) and (f) dehydrated MIL-96(Al).Moreover, deconvolution of the[START_REF] Perez | Mixed-Matrix Membranes Containing MOF-5 for Gas Separations[END_REF] Al MAS NMR spectrum indicates that the four signals at  iso =

  ), MIL-96(Al) with the chemical formula Al 12 O(OH) 16 (H 2 O) 5 [BTC] 6 .nH 2 O (n=29) contains one {Al(1)} trimer for two {Al(3)}trimers. The oxo-core of this formula unit is composed of one µ 3 -O, twelve µ 2 -OH and nine terminal oxygen ligands (OH or H 2 O). For electroneutrality purposes, these terminal groups correspond to four hydroxyl groups and five water molecules that are linked either to Al(1) or Al(3)/Al(3') sites. Indeed, Al(2) cations are not coordinated to any terminal oxygen ligands. Since Al(1) centers are chemically equivalent in the dehydrated MIL-96(Al), they are coordinated to one type of terminal oxygen ligand (OH or H 2 O) while the non-equivalent Al(3) and Al(3') centers are presumably not linked to the same terminal oxygen groups. Taking into account the total number of terminal OH and H 2 O and the symmetry of the Al(1)} and {Al(3)} trimers, the only possible configuration is that both Al(1) and Al(3) centers are coordinated to terminal water molecules while Al(3)' is covalently attached to a hydroxyl group. However, a statistical distribution of hydroxyl groups and water molecules over the terminal oxygen ligands of Al(3)/Al(3') cannot be ruled out.

Figure 4 .

 4 Figure 4. Crystal structure of the MIL-96(Al) in its hydrated form. (a) DFT optimized model, (b) refined experimental model. (Gray, carbon; white, hydrogen; red, oxygen; pink, aluminum) Interatomic distances are in Angströms. The dashed lines represent a selection of representative interactions between the water molecules themselves (black),between water and water coordinated to framework (blue), between water and hydroxyl group coordinated to framework (orange), between the water and the μ 2 -OH functions (green) and between the water and the carboxylate group Oc (purple). Hydrogen bonds are involved between free water molecules and coordinative water molecules at the Al(1) sites (blue). Water molecules located near to the Al(2) sites are arranged in such a way to form hydrogen bonds with the framework between 1) their oxygen atoms Ow and the proton of the µ 2 (OH) functions (orange) and 2) their protons Hw and the oxygen atoms of the carboxylate group (purple). In addition, the water molecules located near to Al(3) sites make hydrogen bonds with framework between 1) their protons Hw and the oxygen atoms of either the hydroxyl group (orange) or water coordinated to Al(3') and/or Al(3) sites (blue) and 2) their oxygen atoms Ow and the proton of the nearby water molecules (black).

only 3

 3 hours at reflux, the colorless solution becomes cloudy indicating the formation of MIL-96(Al) nanoparticles (i. e. MIL-96(Al)-NP1) as shown by PXRD (Figure 5(a)). As observed by SEM (Figure 1(c)), hexagonal nanorods with a dimension up to 500 nm are formed by this route. This is, to our knowledge, the first synthesis producing pure MIL-96(Al) nanoparticles in water under reflux conditions, with however a quite low yield (150 mg, Y = 45 % based on Al). Increasing the concentration of the reactants failed to produce MIL-96(Al). The formation of MIL-96(Al)-NP1 under reflux in water is certainly mainly limited by the poor solubility of trimesic acid in pure water. Therefore, half of the volume of water was replaced by DMF to dissolve the entire 12 mmol of trimesic acid. After 16h of reflux, nanoscale MIL-96(Al) crystals were obtained as indicated by the presence of broad Bragg peaks on the XRD pattern (i.e. MIL-96(Al) NP2, see Figure 5(a)). As shown by the structureless refinement (Figure S12) and SEM images (Figure 1(d) and Figure S13), MIL-96(Al) NP2 consists of pure nanocrystals with a diameter of 200±30 nm. It is worth noting,

34

 34

Figure 5 .

 5 Figure 5. (a) PXRD of the different MIL-96(Al) particles. All patterns were normalized using the (012) reflection; (b, c) 3D representation of the crystal morphology and the (hkl) planes of MIL-96(Al) b) Hexagonal rods and c) Hexagonal platelets. (d) SAXS curves of MIL-96(Al)-NP2 (black square) and MIL-96(Al)-NP3 (green triangle) solutions at 0.1 g/L in water obtained at Alba and Soleil synchrotrons respectively. The red lines correspond to the best fit with the ellipsoid form factor with radius indicated in the inset and log-normal polydispersity. For the continuous line the polydispersity index (PD) are: PD R 1 = 0.01 and PD R 2 =0.15 while for dash-dot line PD R 1 = 0.1 and PD R 2 =0.2. Following this synthetic route, a large amount of MIL-96(Al)-NP2 (e.g. 13 g in one batch with Y =

  (d)) are fairly well fitted on the whole q-range by the form factor of ellipsoids with rather low index of polydispersity. The dimensions extracted from fit (R 1 = 55 nm (PD = 0.1) and R 2 = 48 nm (PD = 0.2) for MIL-96(Al)-NP3; R 1 = 100 nm (PD = 0.01) and R 2 = 80 nm (PD = 0.15) for MIL-96(Al)-NP2) are in fair agreements with SEM observations. Noteworthy, no nanoparticle aggregation could be detected in the available q-range. Finally, dynamic light scattering (DLS) experiments with 1.25 wt% MIL-96(Al)-NP2 and -NP3 dispersed in pure tetrahydrofuran (THF) were performed to better characterize the colloidal stability. This solvent is currently used for dissolving 6FDA-DAM. DLS measurements (FigureS18) have shown only one population centered at 220 nm and 70 nm in diameter for MIL-96(Al)-NP2 and -NP3, respectively, indicating the absence of any aggregation even at such high concentrations (1.25 wt% ≈ 10 g.L -1 ) that are used for MMMs preparation. The colloidal solution is stable for at least 6 hours, which is of high interest for the preparation of MMMs since the drying process takes generally a few hours.In situ IR spectroscopy: characterization of adsorbed water, hydroxyl groups and Al 3+ sites.FTIR spectra were recorded to study the stability and location of adsorbed water, characterize both the hydroxyl groups and Al sites of the MOF and finally probe the interactions between the MOF and different guest molecules. Detailed interpretations of the IR spectra are provided in the SI. The IR spectrum of the as-prepared hydrated MIL-96(Al)-HR sample (see Figure6A, spectrum a) shows (i) the lack of free trimesic acid (evidenced by the absence of bands in the 1740-1710 cm -1

H 2 O

 2 coordinated to Al sites remains in the pores after evacuation at 323 K, as shown by a weak (OH) band at 3415 cm -1 , two weak combination bands at 5364 and 5288 cm -1 and, for the deuterated sample, two (D 2 O) components at 1218 and 1209 cm -1 (Figure6(B), right inset).

Figure 6 .

 6 Figure 6. (A) IR spectra of MIL-96(Al)-HR: (a) as prepared sample and (b) after activation at RT. The left inset shows the spectrum in the (+) region. The right inset shows the (D 2 O) mode with a deuterated sample (g) under D 2 O vapour and (h) after activation at RT. (B) IR spectra of MIL-96(Al)-HR in the (OH) and (OH) regions. Sample activated at (b) RT, (c) 373 K, (d) 423 K, (e) 473 K and (f) deuterated sample activated at 473 K. The left and the middle insets show the spectra in the (+) region of H 2 O and OH groups, respectively. The right inset shows the (D 2 O) mode with a deuterated sample after activation at (h) RT, (i) 323 K, (j) 348 K, (k) 373 K, (l) 398 K, (m) 423 K and (n) 448 K.

  N 2 and CO 2 ) was monitored by in situ FTIR spectroscopy. Before such experiments, MIL-96-(Al)-HR was evacuated at different temperatures. Details are described in the SI (Figures S23-26 of SI). While the pores of MIL-96(Al)-HR evacuated at RT are not accessible to CO or 15 N 2 at T = 100 K, a slight accessibility of the pores is observed after activation at 423 K that increases with the activation temperature (up to 573 K). Upon CO adsorption, OH groups are detected through a carbonyl band

CO 2 /

 2 N 2 gas sorption properties of MIL-96(Al)-NP2: single gas adsorption, CO 2 /N 2 coadsorption and molecular simulations.

  (b). The high experimental enthalpy values at low coverage are certainly due to the interaction of CO 2 molecules with Al 3+ CUS. Experimental and simulated enthalpy values of CO 2 adsorption remain between -35

Figure 7 .

 7 Figure 7. Experimental (empty symbols) and simulated (full symbols) CO 2 (black circle) and N 2 (red square) single gas adsorption at 303 K on MIL-96(Al)-NP2 activated at 423 K; (a) adsorption isotherm (i.e amount adsorbed as a function of pressure) and (b) adsorption enthalpies as a function of the coverage collected by microcalorimetry.

CO 2 /

 2 N 2 = 10/90 and 15/85 at 1.0 bar and 3.0 bar, i.e. the typical industrial concentration and pressure conditions for the membrane separation of flue gas emitted from power plants or cement plants. Each mixture point was repeated several times and an average selectivity value was given. The co-adsorption selectivity of ~36 was obtained at 1 bar and 303 K for the case of CO 2 /N 2 = 10/90, and remains nearly constant on increasing the CO 2 concentration (CO 2 /N 2 = 15/85). The selectivity values are slightly modified by increasing the pressure to 3 bar (i. e. S EXP = 29 for CO 2 /N 2 = 15/85). Such results are in excellent agreement with data obtained by GCMC simulations (i. e. S GCMC = 34 for CO 2 /N 2 = 15/85 at 1 bar and 303 K) (see Fig. S31 of SI). Processing of Mixed Matrix Membrane and post-combusion CO 2 /N 2 separation. Due to the excellent colloidal stability of MIL-96(Al)-NP2 and -NP3 in THF, MMMs with a high MOF content (25 wt%) could be prepared by dispersing both MIL-96(Al)-NP's in a solution of 6FDA-DAM in THF. PXRD of both MIL-96(Al)-NP2/6FDA-DAM and MIL-96(Al)-NP3/6FDA-DAM MMMs (Figure 8(A)) superimpose well with the one of MIL-96(Al)-NP, confirming that the crystalline structure of MIL-96(Al) is preserved upon its association with 6FDA-DAM. SEM images (Figure 8(B) and Figures S32) of the top-surface of MMMs show the excellent dispersion of MIL-96(Al)-NP2 in the polymer matrix with the absence of any significant aggregation. Such results are confirmed by cross-sectional SEM images (Figures 8 (C, D) and Figure S32), showing a homogeneous distribution of MIL-96(Al) nanocrystals in the volume of the membranes. The thickness of the supported membranes lies between 60 and 65 m. Similar results were obtained with MMMs based on MIL-96(Al)-NP3. According to SEM images, no defects or voids of about a few nanometers in size could be observed at the interface between the MIL-96(Al) NP and polymer.The CO 2 adsorption isotherms of membranes with 25 wt % loading of MIL-96(Al)-NP2 and -NP3 in 6FDA-DAM are illustrated in Figure9(a). To illustrate the possible effect of filler on adsorption properties of MMMs, theoretical isotherms were calculated assuming the additive CO 2 adsorption in 25 wt% MOF and 75 wt% polymer (see Figure9(a)) corresponding to the composition of the MMM. Noteworthy, the experimental CO 2 adsorption capacity of MMMs based on MIL-96(Al)-NP2 is lower than the theoretical one, whereas experimental and calculated CO 2 adsorption are almost similar for MMMs based on MIL-96(Al)-NP3. This is tentatively attributed to a better dispersion of the smaller NP3 particles in the polymer and thus a higher accessibility to gas molecules.

Figure 8 .

 8 Figure 8. (A) PXRD of the MIL-96(Al)-NP2/6FDA-DAM and MIL-96(Al)-NP3/6FDA-DAM MMMs in comparison with the pure polymer and MIL-96(Al) NP; (B) SEM image of the top-surface of MIL-96(Al)-NP2/6FDA-DAM; (C) cross-section SEM image of MIL-96(Al)-NP2/6FDA-DAM. The high dispersion of MIL-96(Al)-NP2 in the volume of the membrane is confirmed with higher magnification SEM images (D).The CO 2 and N 2 separation (15/85 vol%) at 298 K, 2 bar (abs) feed pressure and helium sweep

Figure 9 .

 9 Figure 9. (a) CO 2 adsorption isotherms at 273 K of MIL-96(Al)-NP2 and -NP3, neat 6FDA-DAM, experimental and calculated isotherms of MMMs with 25 wt %. MIL-96(Al)-NP2 and -NP3 loading; (b) Permeation properties for a CO 2 and N 2 mixture (15/85) of MMMs comprising 25 wt.% of MIL-96(Al)-NP2 and -NP3 as filler and 6FDA-DAM as polymer matrix at 298 K and 2 bars feed pressure. Permeate side atmospheric with helium as sweep gas.

  96(Al) crystals with various morphology and size, down to the nanoscale as required for MMM preparation. Monodisperse MIL-96(Al) nanoparticles were obtained at high yield under reflux conditions and the colloidal solutions present an excellent stability in different solvents (water, THF). The complete characterization of the CO 2 /N 2 gas sorption properties of MIL-96(Al) including in-situ FT-IR, CO 2 /N 2 adsorption/co-adsorption experiments, calorimetry and GCMC simulations has shown that MIL-96(Al) presents a high CO 2 uptake at low concentration due to the high affinity of CO 2 molecules to Al 3+ CUS and OH ligands of MIL-96(Al). Finally, MMMs based on MIL-96(Al)-NP and 6FDA-DAM with a high MOF loading (~25 wt%) were casted, showing an excellent dispersion of the MOF fillers in the polymer matrix and very promising CO 2 /N 2 performance (permeability and selectivity). Such properties are likely to be due to the excellent chemical compatibility between MIL-96(Al) and 6FDA-DAM and the absence of any defects or voids at the MOF/polymer interface. Such results pave the way for the processing of composite membranes with a higher MOF content (>30 wt%). ASSOCIATED CONTENT Supporting Information. Crystal structure of MIL-96(Al) (CIF);[START_REF] Perez | Mixed-Matrix Membranes Containing MOF-5 for Gas Separations[END_REF] Al MQMAS NMR and FTIR spectra; TGA; PXRD pattern and structureless refinement of MIL-96(Al) samples; Size distribution of MIL-96(Al)-NPs; Single adsorption isotherms; Simulated CO 2 /N 2 selectivity; SEM images and

Table 1 .

 1 Vibrational bands of the hydroxyl groups of MIL-96(Al).

	Type of OH group	Notation (OH) (OD) (OH) (+)(OH)
	Terminal	T1	3695	2724	962	4640
	Terminal	T2	3681	2714	997	-
	Bridging	B1	3650	2692	1011	4640
	Bridging	B2	3639	2683	1075	4690
	Bridging	B3	3623	2672	1087	4665
	H-bonded in C cages	C	3275	2448	1160	-

CO 2 /N 2 separation experiments of membranes; This information is available free of charge via the Internet at http://pubs.acs.org/.

 AUTHOR INFORMATION

Corresponding author *Tel.: 33 1 39 25 43 73. E-mail: nathalie.steunou@uvsq.fr.

 ACKNOWLEDGMENT

The authors would like to acknowledge the European Community Seventh Program (FP7/2007-


Keywords: ML Watermarking, Federated Learning, Intellectual Property, Security

Federated Learning (FL) is a technique that allows multiple participants to collaboratively train a Deep Neural Network (DNN) without the need to centralize their data and therefore comes with privacy-preserving properties making it attractive for application in sensitive contexts. However, it requires sharing participant models during the training process which makes them vulnerable to theft or unauthorized distribution by malicious actors. To address the issue of ownership rights protection in the context of Machine Learning (ML), DNN Watermarking methods have been developed during the last five years. Most existing works have focused on watermarking in a centralized manner, but only a few methods have been designed for FL and its unique constraints. In this paper, we provide an overview of recent advancements in Federated Learning watermarking, shedding light on the new challenges and opportunities that arise in this field.

Securing Intellectual Property in Federated Learning

Mohammed Lansari * † , Reda Bellafqira * , Katarzyna Kapusta † , Vincent Thouvenot † , Olivier Bettan † , Gouenou Coatrieux *

I. INTRODUCTION

Sophisticated ML models require good and non-synthetic data that are often hard and costly to acquire. Government regulations, such as the European General Data Protection Regulation, have made the training process even harder by requiring to preserve privacy of the data subjects. Thus, companies and institutions have to face the issue of lack of data on the one hand and the complexity of usage of sensitive data on the other. Indeed, very often the data exists but is distributed over multiple locations and/or belongs to different owners. Centralizing it would be very costly in terms of bandwidth. Moreover, it is almost impossible if the decentralized data is private or classified.

Federated Learning [START_REF] Mcmahan | Communication-efficient learning of deep networks from decentralized data[END_REF] is a promising solution that allows multiple data owners (or distributed agents belonging to one data owner) to train a global Deep Neural Network (DNN) without directly sharing their data. It opens new possibilities in domains such as health or military, as it allows to train a model over multiple distributed datasets without centralizing the local data. Combined with privacy-preserving techniques, such as Homomorphic Encryption, Multi-Party Computation, or Differential Privacy, it can ensure a high level of protection of sensitive data. In the civil domain, it may be applied by a consortium of hospitals, where each of the hospitals possesses its own data that is impossible to share due to regulation constraints. In the military domain, it could find application for instance in the case of predictive maintenance, where multiple cooperating parties would like to benefit from the information collected by others but fear about revealing classified information.

From the point of view of ownership rights protection, the complex context combining both AI and collaboration of owners and users raises new challenges. ML watermarking techniques have been proposed since 2018. They enable to identify a ML model and thus can be applied for model theft detection. However, the majority of them address the problem of local training of a single model. The collaborative setting of FL raises new challenges in the context of ownership protection. How to identify that a participant contributed to the training of a model resulting from FL? How to be sure that the final model will not be misused by the aggregation party that coordinates the FL? These issues may slow down parties from joining the learning consortium.

II. OUTLINE

We start with a brief presentation of the FL and DNN watermarking concepts in Section III. Then, we proceed with a definition of watermarking for FL in Section IV followed by an overview of the six existing works combining FL and DNN.

In Section V, we analyze the different elements that have to be taken into consideration while designing a watermarking scheme for collaborative training settings. We identify the unsolved challenges and thus give an insight into possible future works.

III. BACKGROUND

In this section, we remind the definition of FL and give a brief overview of its different existing settings. Then we introduce DNN watermarking.

A. Federated Learning

FL is a ML setting where K ∈ N * entities called clients collaborate to train a global model M G while keeping the training data

D C = {D Ci } K i=1 decentralized [2].
The most popular framework is called Client-Server FL. In this setting, the server train M G by receiving and aggregating the client models weights W C = {W Ci } K i=1 (see e.g. [START_REF] Brendan Mcmahan | Communication-efficient learning of deep networks from decentralized data[END_REF]). However, the presence of the server is not mandatory to perform FL. In a decentralized setting, clients can perform FL without the supervision of a server. BrainTorrent [START_REF] Roy | Braintorrent: A peer-to-peer environment for decentralized federated learning[END_REF] proposes a server-less and peer-to-peer Federated framework. In this solution, a random client is selected to be the aggregator. Then, it checks if other clients have an updated version of the model. If yes, they send it to the aggregator who performs an averaging of the model weights. Then it updates its own model with the previous result.

The FL setting is also characterized by the features partition. We distinguish three types of partition: horizontal, vertical, and hybrid FL. In horizontal FL, all clients have the same features but not the same samples. On the other hand, vertical FL assumes that all clients have the same samples but not the same features. Finally, hybrid FL supposes that samples and features are different from one client to another.

In contrast with previous settings, Split-Learning [START_REF] Vepakomma | Split learning for health: Distributed deep learning without sharing raw patient data[END_REF] consists of splitting the DNN between the server and the clients. Many configurations are possible but the most common for client privacy is the U-shaped configuration. The aim is that each client has the first and last layers of the DNN and the server has the rest of the layers. In such a way, clients perform the forward/backward pass keeping their data (inputs and labels) private, and send/receive only the activations/gradients to update the whole model.

B. DNN Watermarking

DNN watermarking is a promising solution for the ownership protection of ML models. Inspired by image watermarking, it consists of introducing a secret change into the model parameters or behavior during its training, in order to enable its identification in the future. As image watermarking, DNN watermarking must respect some requirements to be effective for IP protection. Table I [START_REF] Guo | Watermarking deep neural networks for embedded systems[END_REF] watermarking. Each technique is defined by the type of access to the model during the verification process.

In the White-Box setting, we assume that the owner will have full access to the model (architecture, weights, activations, etc.). In this way, to insert a watermark into a DNN, the owner will hide a vector of bits b into the model's parameters or activations. One of the first proposed method in [START_REF] Uchida | Embedding watermarks into deep neural networks[END_REF], uses a regularization term to embed b with a secret key S into the model's parameters. Several techniques have been published to meet the associated challenges. DeepSigns [START_REF] Darvish Rouhani | Deepsigns: An end-to-end watermarking framework for ownership protection of deep neural networks[END_REF] proposes to use the probability density function of the output for selected layers to embed the information. Tartaglione et al.

[9] defines a strategy that consists in embedding the watermark before the training and then training the model while adding a constraint that penalizes the model for small perturbations on the watermarked parameters.

On the other hand, Black-Box setting assumes that the owner can perform the verification process only through an API: he can interact with the model only by giving inputs and receiving associated predictions. Knowing that the owner watermarks the model by changing its behavior. The common technique consists training of the model using a trigger set T = (X i , Y i ) i=1 , which is composed of crafted inputs X i with their associated outputs Y i [START_REF] Adi | Turning your weakness into a strength: Watermarking deep neural networks by backdooring[END_REF]. Zhang et al. [START_REF] Zhang | Protecting intellectual property of deep neural networks with watermarking[END_REF] propose to use the same technique but with different types of inputs. In addition to unrelated images, they use training examples with two types of trigger: random noise and a textual pattern. The trigger set can also be built using adversarial examples [START_REF] Merrer | Adversarial frontier stitching for remote neural network watermarking[END_REF] or a filter as a mapping function [START_REF] Guo | Watermarking deep neural networks for embedded systems[END_REF].

To evaluate the performances of the watermarking embedding, White-Box setting relies on the Binary-Error-Rate between the reconstructed message b and the original one b. In Black-Box watermarking, we evaluate the accuracy of the model on the trigger set T .

IV. WATERMARKING FOR FEDERATED LEARNING

In this section, we introduce and define what is watermarking for FL including the different possible scenarios. Then, we formulate requirements for watermarking deployed in a FL context. Finally, we analyze the six state-of-the-art methods.

A. Definition

In centralized DNN watermarking, the goal is to simply prove the model's ownership after the training process. In FL, ownership rights protection becomes a more complex problem due to the presence of multiple participants and multiple exchanges between them that have to be taken into account during the threat model formulation. To illustrate this issue, [START_REF] Tekgul | Waffle: Watermarking in federated learning[END_REF] shows that existing methods can naively be applied to FL in two manners. The first one consists of watermarking the model after the training. For example, by using finetuning to embed the watermark into the model. Without taking the fidelity requirement into account, any participant who receives the model (client or server) can steal the DNN before the last round. The second way is to embed the watermark before the training. Even if the watermark will resist during the first rounds, it will be removed after several aggregation rounds. Thus, it is important to design a specific watermarking technique for FL that will be persistent from the first round to the model deployment.

We define Watermarking for FL as the process for a participant or multiple participants to insert a watermark into the shared model.

Following the client-server FL framework, the first question is to determine which part of the federation can watermark the model. Is the server more to be trusted since it manages the federation? Or the clients since their data are used? During this study, we distinguish four watermarking scenarios for

Fidelity

The watermarked model needs to have the same performances compared to the model without watermark

Capacity

The capacity of a technique to embed multiple watermarks Generality

The capacity of a watermarking technique to be applied independently of the architecture of the model Efficiency

The performance cost generated by the embedding and verification process of the watermarking Robustness The capacity to resist against attacks aiming at removing the watermark Secrecy

The watermark should be secret and undetectable All watermarking requirements defined in Table I are also true in the federated context. However, due to the new constraints and the extension to several participants, we can add precision to three of them:

1) Capacity : When multiple clients want to insert their own message b Ci , the watermarking technique needs to avoid possible conflict between the different inserted b Ci . The number of bits needs to be enough. 2) Generality : In a real FL scenario, many additional mechanisms are added for security and privacy such as robust aggregation functions (Section V-B) or Differential Privacy [START_REF] Abadi | Deep learning with differential privacy[END_REF] (Section V-E). The watermarking technique must be applied independently to these mechanisms. 3) Efficiency : The cost generated by the embedding process is more crucial in FL. For example, in a cross-device architecture, clients have low computation power and they cannot perform many operations. The watermarking techniques must take this parameter into account.

B. Related works 1) WAFFLE: WAFFLE [START_REF] Tekgul | Waffle: Watermarking in federated learning[END_REF] is the first DNN Watermarking technique for FL. In this solution, the server embeds the watermark (S 1 ) using a black-box watermarking technique using a trigger set. Any trigger set that does not need any knowledge concerning the clients' data can be used but the authors present a specific set that is more suitable for FL: the WAFFLEPattern. WAFFLEPattern is defined as a set of images containing random patterns with a noisy background. Basically, the server will embed the watermark into the global model using the two following functions :

• PreTrain : Train an initialized model with the trigger set until • ReTrain : Fine-tune (using FTAL) the model with the trigger set until PreTrain is used to embed the watermark in the model before the first round. During each round, after the aggregation process, the server uses ReTrain to re-embed the watermark into the model.

2) FedIPR: FedIPR [START_REF] Li | Fedipr: Ownership verification for federated deep neural network models[END_REF] is both a Black-Box and White-Box technique. This technique allows all clients to embed their own watermark in the global model (S 2 ) without sharing secret information. Each watermark can be described as follow :

• Black-Box Watermark : Each client generates a trigger set using Projected Gradient Descent technique in a small CNN trained with the local data. • White-Box Watermark : Each client generates a random secret matrix and a location in the Batch-Normalisation layers to embed its message. Both White-Box and Black-box watermarks are inserted using an additional loss during the local training. For Black-Box Watermark, the loss is exactly the same as the loss used for the main task but with a batch of the trigger set as input. For the White-Box Watermark, the loss used is a Hinge-like loss between the original message and the reconstructed message.

3) FedTracker: FedTracker [START_REF] Shao | Fedtracker: Furnishing ownership verification and traceability for federated learning model[END_REF] is a watermarking technique that allows the server to embed a global Black-box watermark (S 1 ) but also a White-box watermark specific to each client. Each watermark can be described as follow :

• Global Black-Box Watermark : A trigger set is generated using the WAFFLEPattern method [START_REF] Tekgul | Waffle: Watermarking in federated learning[END_REF]. • White-Box Watermark : Server generates a random secret matrix and a fingerprint for each client. After the aggregation, the server embeds the Global Black-Box Watermark using the intuition of Continual Learning [START_REF] Lange | A continual learning survey: Defying forgetting in classification tasks[END_REF] to avoid forgetting the main task. Then, for the White-Box Watermark, the loss used is a Hinge-like loss between the original message b and the reconstructed message b. 4) Client-side Black-box watermarking: Liu et al. [START_REF] Liu | Secure federated learning model verification: A client-side backdoor triggered watermarking scheme[END_REF] propose a client-side Black-box watermarking scheme (S 2 ). This technique is designed to embed a watermark only from one client. The latter creates a trigger set composed of Gaussian noise images with a given label as a trigger set. Then, the client's model will over-fit with this set like in [START_REF] Adi | Turning your weakness into a strength: Watermarking deep neural networks by backdooring[END_REF]. To tackle the fact that this particular client will probably not be selected at each round, the authors introduce a scaling factor

λ = N n ,
where N is the number of clients and n is the number of clients selected at each round. The client will then send its model weights multiplied by λ. According to the authors, this will be approximately equivalent to the case that this client is selected every iteration and the watermark will be embedded more easily.

5)

Merkle-Sign: Merkle-Sign [START_REF] Li | Towards practical watermark for deep neural networks in federated learning[END_REF] is a framework focusing on ownership verification in a collaborative Clients-Server setting (S 3 ). The authors propose a public verification protocol that uses the Merkle-tree [START_REF] Becker | Merkle signature schemes, merkle trees and their cryptanalysis[END_REF]. In this framework, the server use at each round an embedding function to insert two identity information (i.e keys) into M G : one that identify the server and the other one the client that will receives the model. In parallel, the server uploads the tuple of keys and the tuple of verification function (which are generated by the watermarking embedding function) into a Merkle-tree with the recording time. At the final round, the server embeds also all keys generated by the clients into M G and updates the Merkle-tree. This framework is also compatible in a Peer-to-Peer context. The associated Black-Box watermarking schema relies on the training of an Auto-Encoder [START_REF] Bank | Autoencoders[END_REF] (AE) for each client. Then the server averages the received AE to obtain a final AE from which it can generate a trigger set using the keys as input for the decoder part.

6) FedRight: FedRight [START_REF] Chen | Fedright: An effective model copyright protection for federated learning[END_REF] is a solution for the server to fingerprint the model in the FL framework (S 3 ). DNN fingerprinting is a process in which instead of embedding a watermark in the model, we extract a fingerprint to identify this model [START_REF] Cao | Ipguard: Protecting intellectual property of deep neural networks via fingerprinting the classification boundary[END_REF]. To do so, the server generates adversarial examples from a set of inputs (key samples). Then the server extracts the probability distribution of each prediction and feeds it to a detector with the key samples target. Then, during the verification process, this detector is used to predict whether the corresponding model is the good one or not.

V. DISCUSSION

In this section, we identify and discuss specific challenges related to watermarking in FL. In particular, we evaluate how existing methods deal or not with these new challenges.

A. Black-Box watermarking in the Server side Black-Box watermarking consists in changing the behavior of the model. To do so, most methods let the model overfit on the trigger set by adding a regularization term in the loss function. Usual DNN watermarking techniques can easily be applied in S 2 , S 3 and S 4 . However, it is not so easy in S 1 . When the client C k wants to watermark its model M C k , he can rely on two things :

1) Have an access to its private dataset D C k 2) Train the model on both the main task dataset D C k and its trigger set T C k at the same time A large number of Black-Box watermarking techniques need to build T C k using D C k = (X i , Y i ) i=1 (as discussed in III-B). Using such techniques is motivated by the fact that training the model from these datasets is a multi-task learning. Building T C k from D C k helps to reduce the negative impact on learning from two domains. Moreover, learning these two tasks together avoids "catastrophic forgetting" [START_REF] French | Catastrophic forgetting in connectionist networks[END_REF].

In S 1 , since the server does not have its own dataset, it cannot perform such type of watermarking. The choice is limited by using unrelated or noise-based inputs as WafflePattern [START_REF] Tekgul | Waffle: Watermarking in federated learning[END_REF].

The problem is that this limitation leads to an exposure to evasion attacks. During the Black-Box verification process, the owner will ask the suspicious Application Programming Interface (API) that possibly contains his DNN. However, the attacker may evade this verification using a query detector [START_REF] Hitaj | Have you stolen my model? evasion attacks against deep neural network watermarking techniques[END_REF]. Since the trigger-set is built using images that are qualified to be Out-Of-Distribution (OOD), this implies an easier detection for the attacker [START_REF] Yang | Generalized out-of-distribution detection: A survey[END_REF]. WAFFLE [START_REF] Tekgul | Waffle: Watermarking in federated learning[END_REF] authors confirm the intuition that the performances of such detector depends a lot on the data quantity and capacities of the attacker.

B. Aggregation functions

The most common aggregation function is FedAvg [START_REF] Mcmahan | Communication-efficient learning of deep networks from decentralized data[END_REF] which consists on averaging clients' weights after they perform multiple epochs on mini-batches. Each client weight matrix is multiplied by a scaling factor defined as

n C k n where n C k is the number of samples in D C k and n = K k n C k .
Many aggregation functions emerged to meet various challenges in FL. Since the clients do not necessarily know which aggregation function the server is using, the proposed methods must be independent of this parameter.

For the Byzantine-attacks problem in which one or multiple clients try to disturb the FL process. These attacks can be simple noise weights or complex label-flipping backdoors. To leverage this problem, multiple aggregation functions appear to select only benign updates such as Krum [START_REF] Blanchard | Machine learning with adversaries: Byzantine tolerant gradient descent[END_REF] Trim-mean or Bulyan [START_REF] Guerraoui | The hidden vulnerability of distributed learning in byzantium[END_REF]. Since clients' watermarking techniques are sensitive to the embed message b and the trigger set T , they keep their updates far from each other. A part of updates can be rejected for this reason if we use defensive aggregation techniques. As an example, FedIPR shows that the White-Box Watermark results are similar to FedAvg with a detection rate of 97.5% using Trim-mean. However, the Black-Box Watermark reaches only 63.25% of the watermark detection rate at the end of the FL process. Even if this score is enough to detect plagiarism, using a defensive aggregation function has a huge impact on the watermark. Liu et at. [START_REF] Liu | Secure federated learning model verification: A client-side backdoor triggered watermarking scheme[END_REF] have not tested yet their solution with a defensive aggregation function but we can guess that multiplying weights by a so big scaling factor λ can be easy to detect for Krum as a Byzantine attack as shown in similar example [START_REF] Gu | Detecting malicious model updates from federated learning on conditional variational autoencoder[END_REF].

Another problem is that FedAvg performs well when the data are statistically homogeneously distributed among the clients. However, in real use cases, data are heterogeneous which may lead to difficulty for the model to converge to the global minimum or diverge using FedAvg. Existing watermarking techniques for FL have not evaluated methods that tackle this problem such as FedProx [START_REF] Li | Federated optimization in heterogeneous networks[END_REF], FedNova [START_REF] Wang | Tackling the objective inconsistency problem in heterogeneous federated optimization[END_REF] or SCAFFOLD [START_REF] Karimireddy | Scaffold: Stochastic controlled averaging for federated learning[END_REF]. If we want to use the proposed solution in a real Secure FL framework, these methods need to be tested in such a context.

C. Client selection

For communication efficiency and when the number of clients is too high, we introduce a client selection. To do so, we simply randomly select cK clients with c ∈ ]0, 1[. This simple mechanism can have a big effect on the watermarking. In (S 1 ), this effect should be insignificant, since the server embeds the watermark at each round regardless of cK. Unfortunately, WAFFLE and FedTracker have not tested this effect. On the other hand, (S 2 ) is more able to be sensitive to the client selection process. Since each client wants to insert its watermark, the watermark of not selected clients risks to be degraded or removed in the global model. Authors of FedIPR show that for c > 0.2 the detection rate for both White-Box and Black-Box watermark is near to 100%. When c ≤ 0.2 the detection rate associated with a feature-based watermark is still near 100%. However, the detection rate for the backdoor falls to 62%.

D. Cross-device setting

All proposed papers are treating the case in which we have a small amount of clients. The worse scenario is tested in Merkle-Sign in which 200 clients are enrolled in the federation. However, there is no solution that takes into account the cross-device setting. In this setting, a large number of clients (up to 10 10 devices), are enrolled in the FL procedure [START_REF] Kairouz | Advances and open problems in federated learning[END_REF]. These clients are not always reachable and they have a low dedicated computational power which is defined as a performance condition by the authors of WAFFLE.

In the Black-Box setting, the problem can come from the low computation power that does not allow the client to perform more computations to increase the batch size using trigger-set methods. For the White-Box setting, the bottleneck would be the Capacity as mentioned in Section IV-A. In particular in cases where the proposed methods are tested using Normalization layers such as FedIPR or FedTracker which limits the overall embedding capacity. It leads to a difficulty for each client to embed its vector b without conflicting in face of other clients' watermarks.

E. Differential Privacy

Since FL keeps the client's data private, DNNs are shared between the server and the clients or directly between clients. The model himself can give to an attacker private information in such a way that he can identify the presence of an exact data point (such an attack is called membership inference) [START_REF] Melis | Exploiting unintended feature leakage in collaborative learning[END_REF].

To tackle this problem, we can use Differential Privacy (DP) which is a strong standard for providing privacy guarantees for algorithms operating on aggregate databases [START_REF] Abadi | Deep learning with differential privacy[END_REF]. In FL, a usual DP technique consists of adding a Gaussian random noise to the gradients sent to the aggregator. Among related works, FedIPR is the only article for which the proposed method is tested with a DP mechanism. The presented results show that adding a small noise to the weights does not affect a lot the watermarking accuracy.

F. Homomorphic Encryption

In Client-Server FL, the server has access to all client updates. Then, it can use this privilege to try to learn information about the private datasets. A cryptographic solution to prevent such misuse from the server is, for the clients, to protect the model using Homomorphic Encryption (HE). By using this technique, clients can easily cipher their updates using public keys. Then the server will perform the aggregation, in general using FedAvg, in the cipher space. Then, when clients receive the updated global model, they use their private key to decipher the model weights.

In the context of watermarking, the use of HE fits perfectly for (S 2 ) since the clients can access their model weights to watermark the model. However, so far no solution has been provided for (S 1 ) given the fact that the server cannot decipher the model weights to perform watermarking embedding.

G. Watermarking for Non Client-Server framework

Decentralized FL (S 2 ) is an interesting framework in which clients do not need a server to perform the model aggregation. The proposed methods seem to be applicable to this setting since watermarking the model from the client side does not require the server. However, Merkle-Sign is the unique solution that extends to the decentralized setting (S 4 ). We can also cite Split-Learning in which the server has a part of the network and clients have another part. Performing White-Box watermarking as in [START_REF] Uchida | Embedding watermarks into deep neural networks[END_REF] can be more difficult for the server or clients. In both cases, they have access to a part of the model weights that can be arbitrarily small. In the U-shape Split Learning architecture, the server has only the middle part of the model and the client has the first and last layers. In this setting, performing a Black-Box watermarking on the server side is hard since it cannot use its inputs and labels on the model.

H. Attacks from clients and server

When we analyze (S 1 ) and (S 2 ) scenarios, we can see that each one has different parameters to play with whether for watermarking or disrupt it. The server can control the selected participants or how to aggregate the weights. It has also sometimes a clear view of clients' weights at each round. However, it does not have data and it cannot fully control if clients are strictly following the training process. On the other hand, clients have their private dataset and they can send the weights that they want. Nevertheless, they have no control over what happens with their updates in the server level.

If the server wants to avoid a subset of clients to watermark the model, it can use methods proposed for Byzantine attacks [START_REF] Shi | Challenges and approaches for mitigating byzantine attacks in federated learning[END_REF] detection. In particular, attacks that consist of multiplying the weights by a scaling factor to replace or have a bigger impact in the global model are easy to detect [START_REF] Gu | Detecting malicious model updates from federated learning on conditional variational autoencoder[END_REF]. The proposed method by Liu et al. [START_REF] Liu | Secure federated learning model verification: A client-side backdoor triggered watermarking scheme[END_REF] is then easily removable and the global model will not be watermarked. A solution to catch backdoor-ed models was presented in [START_REF] Tolpegin | Data poisoning attacks against federated learning systems[END_REF] [START_REF] Xi | Batfl: Backdoor detection on federated learning in e-health[END_REF]. Then all proposed solutions that rely on a backdoor-based watermarking can be rejected.

Clients can also try to disturb the watermarking process. FedIPR (S 2 ) [START_REF] Li | Fedipr: Ownership verification for federated deep neural network models[END_REF] authors present the free-riders problem in which some clients do not contribute to the training of M G and the watermarking process. Even if with their solution, they have no important impact on the watermarking, no testing has yet been done on (S 1 ). Another attack that is specific to FL as described in FedRight [START_REF] Chen | Fedright: An effective model copyright protection for federated learning[END_REF] and WAFFLE [START_REF] Tekgul | Waffle: Watermarking in federated learning[END_REF] consists of the fact that multiple clients will use their models and private datasets. As mentioned in Section V-A, evasion attack works better when using multiple datasets to train the detector. But it is also possible to fine-tune the model with the combined dataset.

VI. CONCLUSION

Watermarking for FL is taking great interest since classical DNN watermarking cannot be naively applied in a collaborative context. In particular, constraints such as data distribution, new distributed threat models, and additional security mechanisms have to be taken into account while designing an efficient solution for collaborative ML watermarking. This paper provides a comprehensive overview of existing methods and exposes the different problems they face off. Several of the analyzed methods have tried their model against each Secure FL mechanisms separately. Unfortunately, none of them has tried to test their solutions in a complete and realistic Secure FL framework, including defensive aggregation functions, non I.I.D data, DP, and HE in the same experiment.

  Figure 1 according to who is watermarking the model : (S 1 ) Server : The server is in charge of watermarking the global model. (S 2 ) Clients : One or multiple clients among the federation watermark their updates to spread that are embedded into the global model. (S 3 ) Server and clients : The server and the clients collaborate to watermark the global model together. (S 4 ) Clients in a decentralized context : Only clients collaborate to watermark the global model together (decentralized FL).

Fig. 1 :

 1 Fig. 1: An example of each possible scenario of watermarking in FL with one server and three clients. Green rectangles are the participants who follow the same watermarking procedure together. Red rectangles are those who are not enrolled in the watermarking procedure.

TABLE I :

 I

DNN Watermarking requirements centralized FL, which we illustrate in