Matthieu Glachant
email: glachant@ensmp.fr.

Cerna

Non-Binding Voluntary Agreements

Keywords: environmental policy, voluntary agreements, bargaining, lobbying, enforcement. JEL classi…cation: D72, Q28

In reality, most voluntary agreements with polluters (VAs) are not enforceable in the sense that no legal tools are available to enforce …rms'commitments. We examine whether such VAs are able to achieve an e¢ cient level of environmental protection when they are obtained under the legislative threat of a pollution quota.

We show that they can improve social welfare relative to legislative intervention when lobbying Congress is very e¤ective and when the polluter and the regulator do not discount future costs and bene…ts heavily. These …ndings suggest that VAs should be used selectively, taking into account sector characteristics and the degree of in ‡uence of lobbying on Congress.

Introduction

In environmental policy, a Voluntary Agreement (VA hereafter), whereby polluting …rms voluntarily commit to control pollution, has become a major policy innovation of the last decade. While the use of VAs was limited initially to a few countries (e.g., Germany, Japan), they are now used extensively around the world, particularly to deal with industrial greenhouse gas emissions and waste. The use of the term "voluntary" has long been disputed since many agreements are in fact obtained under the threat of an alternative legislative intervention. The present paper focuses on such agreements preempting legislation.

In most countries, VAs are not binding. As a result, no legal tools are available to enforce …rms'commitments. For instance, this is the case in Canada, France, Germany and the United States. To the best of our knowledge, the only exceptions are the UK Climate Change agreements and the Dutch "covenants" which are made enforceable through their connection with mandatory regulation. A few countries (e.g., Belgium) have tried to set up a legal framework to promote enforceable agreements with varying results essentially because most companies are reluctant to enter into binding schemes.

Non-enforceability contributes to a widespread suspicion among observers about

VAs ability to genuinely improve the environment. However, this property does not imply that compliance incentives are completely lacking. The legislative threat which initiates the voluntary commitment of polluters also promotes compliance ex post since the parties to the VA contract are all aware that, in case of noncompliance, the threat will be acted upon. But non-compliance cannot be observed immediately after the contract comes into force. Furthermore, once it is discov-ered, enacting a new legislation takes time. In the end, several years necessarily elapse before the non-complying polluters bear the cost of the legislation. This obviously creates adverse incentives. In particular, …rms may enter strategically into voluntary agreements without any willingness to comply, just to postpone legislative intervention.

In this paper, we develop a model of a non-enforceable agreement between a polluter and a benevolent regulator to address these issues. We examine whether this type of VA can lead to an e¢ cient level of pollution abatement and how this level compares to both the …rst-best level and the level that might have been imposed legislatively. We make two crucial assumptions. First, the legislative threat is determined endogenously. More speci…cally, we explicitly model a legislative process in which the polluter lobbies a Congress, thereby reducing the stringency of mandated abatement. Otherwise, a benevolent regulator would have absolutely no reason to use a VA since it could impose the …rst-best legislation directly. Second, we assume that the regulator can only punish a non-complying polluter by implementing the threat in the future. In this context, the polluter's propensity to comply is driven by the endogenous stringency of the legislative quota and by the rate at which he discounts the cost of future legislation.

We do not know of any previous contribution dealing with non-enforceable VAs [START_REF] Amacher | Bargaining in environmental regulation and the ideal regulator[END_REF] . Some work in this …eld has explored the role of legislative threats in triggering voluntary abatement [4, 9, 10, 14] [START_REF] Arguedas | Bargaining in environmental regulation revisited[END_REF] . But they all assume perfect compliance. This obviously in ‡uences the analysis and the results obtained. In particular, polluters do not enter into perfectly enforceable VAs to delay legislative intervention as in our case. Amacher and Malik [1] or Arguedas [2] do not speci…cally deal with VAs but address related issues. They examine bargaining between a polluter and a regulator over the value of an emission standard. In contrast with the papers on VAs previously mentioned, they do not assume perfect compliance. But in contrast with ours, the standard is enforceable, albeit imperfectly. In fact, they deal with the negotiation taking place during the process of setting traditional mandatory emission standards. In this context, they analyze a situation in which the regulator is ready to accept a more lenient standard if it leads the polluter to adopt an abatement technology which reduces enforcement costs. In our setting, the regulator's gain is totally di¤erent. It enters into the VA in order to avoid a politically distorted legislative quota.

The paper is organized as follows. Section 2 provides an overview of real-world voluntary agreements. Section 3 introduces the model. Section 4 identi…es the circumstance under which a non-enforceable VA can emerge in equilibrium. The analysis rests on the key property that entering into a VA is a dominant strategy for the polluter. Indeed, either the Polluter enters into the VA to postpone legislative intervention without any intention to abate pollution, or it does so to comply with its commitments because the discounted cost of the legislation is su¢ ciently high.

Accordingly, Section 5 focuses on the regulator's motives to rely on VAs. We show that the VA is more e¢ cient than legislation in cases where lobbying Congress is very e¤ective and when polluters and the regulator do not discount the future heavily. In Section 6, we discuss the robustness of these results and present an extension of the model in which the Polluter competes with a green lobby group to in ‡uence the Congress.

In Section 7, we conclude and discuss policy implications, particularly for climate change policies where VAs are widespread. The key lesson is that non-enforceable voluntary schemes are weak instruments that are potentially useful when political constraints are severe. This is probably the case when regulators seek to cut carbon emissions of energy-intensive industries.

VAs in practice

This section o¤ers an insight into real-world voluntary agreements. It aims to identify key properties which should be incorporated into a relevant model of VAs.

It rests mainly on case studies of real-world voluntary agreements presented in a recent OECD report [13] and in the book by Morgenstern and Pizer [11] who deal more speci…cally with voluntary schemes in the …eld of climate change.

In every VA, a …rm or a group of …rms agree to make environmental e¤orts beyond regulatory compliance. But the design of these voluntary commitments varies signi…cantly. A usual classi…cation distinguishes three broad categories [13].

Each type ultimately di¤ers with respect to the degree of involvement of the regulator. Under public voluntary programs, the …rms agree to make abatement e¤orts to meet goals which are established by the regulator. This is the most common form of VA in the USA. The 33/50 Program aiming at reducing the release of toxic substances is a well known example [6]. In the case of a negotiated agreement, the …rms and the regulator jointly devise the commitments through bargaining. This type of VA is frequently used in Europe. As an illustration, the European Commission secured negotiated agreements during the 1990s with European (ACEA), Japanese (JAMA) and Korean (KAMA) car manufacturers to reduce new car CO2 emissions.

Under self-regulation or unilateral commitments, the Polluter takes the initia-tive. He freely sets up a program of environmental actions without any formal in ‡uence from public authorities. A good example is the Responsible Care initiative undertaken by the International Council of Chemical Associations which is run in 52 countries. In section 6, we consider di¤erent allocations of bargaining power between the regulator and the polluters.

The e¢ ciency of the level of environmental protection achieved by VAs is a major practical concern. Two features are of particular concern to some observers: that VAs are voluntary, suggesting little abatement e¤ort, and that VAs are mostly not enforceable, causing concerns about compliance.

As argued in the introduction, the fact that most agreements are developed in the face of a threat of regulation 3 partly mitigates these concerns. Despite this threat, the environmental outcomes of actual VAs are arguably modest. According to the OECD report, "there are only a few cases where such approaches have been found to contribute to environmental improvements signi…cantly di¤erent from what would have happened anyway" [13]. In the book by Morgenstern and Pizer [11], where 7 climate change VAs are assessed, conclusions are slightly more optimistic. Most estimates of the environmental e¤ect beyond business-as-usual are in the 5-10% range.

The modest impact of many VAs suggests that legislative threats are typically weak. This weakness is due to the existence of political constraints impeding legislative action. An illuminating example is provided by the climate change VAs adopted in most EU countries in the mid-nineties. In 1994, just before the adoption of these VAs, an EU carbon tax project had been withdrawn under the pressure of lobby groups representing European energy-intensive industries. All parties were thus aware that legislation was not an easy alternative path. But, the on-going discussions at the international level -in which the European Union was playing a leading role and which led to the adoption of the Kyoto Protocol in 1997 -was also making clear that mandatory intervention would take place if the industry did not commit to cut emissions of greenhouse gases. This section has attempted to highlight three key points associated with VAs, which are developed more fully in the model in the following sections. First, …rms' participation in VAs and compliance are frequently driven by legislative threats.

Second, lobbying usually lessens the strictness and the credibility of these threats. [START_REF] Glachant | Voluntary agreements in a rent seeking environment[END_REF] Finally, most VAs are not enforceable.

The model

We depict a policy game with three players: a benevolent Regulator, a …rm (which we call the Polluter) and a Congress responsible for enacting legislation. In the …rst stage, the Regulator and the Polluter negotiate a Voluntary Agreement specifying a level of pollution abatement B to be met by the Polluter. In case of persisting disagreement, the Regulator can ask the Congress to enact legislation. What makes the problem non-trivial is the existence of lobbying in the Congress which prevents the enactment of the socially e¢ cient mandatory policy. In this context, the regulator must choose between two evils: either a piece of legislation distorted by lobbying or a non-enforceable VA.

In reality, certain VAs involve a coalition of polluters represented by an industry association. In our setting, the Polluter can either be a single …rm or an industry.

In the latter case, we assume that the members of the coalition have solved their collective action problem.

We now enter into the details of the model. Abating pollution entails a cost borne by the Polluter which is described by an increasing and convex function C(B), with C 0 (0) < 1 and C(0) = 0: We do not grant any cost advantage to the VA: abatement costs are the same under the VA and the legislative quota.

Abatement also yields an environmental bene…t. We assume that this bene…t equates with the abatement level B; so that social welfare can be written as

W (B) B C(B) (1)
The linearity of the bene…t function simpli…es the notations without altering any results. Under these hypotheses, the abatement level B , which maximizes social welfare, solves:

C 0 (B ) 1 (2)
If the Regulator and the Polluter fail to agree, a piece of legislation mandating a level of abatement L is implemented. In contrast to the VA, we assume that the Polluter perfectly complies with the quota [START_REF] Grossman | Special Interest Politics[END_REF] . The abatement quota L is the outcome of a legislative process initiated by the Regulator. This process is subject to lobbying which is modelled using the approach popularized by Grossman and Helpman (see [5], chapters 7-8). We assume that the Polluter is the only lobby group exerting an in ‡uence in the Congress by making campaign contributions to a median legislator. In section 5, we analyze a variant where the polluter competes with a green lobby group.

Contributions can be in kind -by working for the legislators, by communicating, or by convincing citizens -or in cash. The Legislator maximizes his probability of re-election facing an implicit challenger by maximizing a weighted sum of the campaign contributions and social welfare. In fact, the Legislator is imagined as a democratically elected legislator who, during a term in Congress, collects campaign contributions he will use in a later, unmodelled, election. In this situation, he is facing a trade-o¤ between (i) higher campaign contributions that help him to convince undecided or uninformed voters but at the cost of distorting policy choices in favor of the contributing group and (ii) a higher social welfare which increases the probability of re-election, given that voters take their welfare into consideration in their choice of candidate. Formally, his utility function is

V (L; x) = W (L) + (1 )x; (3)
where L is the legislative quota, x the campaign contribution o¤ered to the Legislator and 2 [0; 1], the exogenously given weight that the Legislator places on social welfare relative to the campaign contribution. One can interpret as re ‡ecting the responsiveness of the Congress to lobbying.

The timing of the legislative subgame is as follows:

1. The Regulator initiates the legislative process by asking Congress to mandate an abatement quota.

The Polluter o¤ers the median Legislator a campaign contribution schedule

x(L) which is contingent on the adopted legislative quota L; this o¤er is assumed to be binding.

Then, the Legislator proposes and rati…es the quota L and receives from the

Polluter the contribution associated with the policy selected.

Note that, in this political procedure, the Regulator does not set the agenda of the Congress. It can not stipulate a particular abatement level to be voted on; instead, it requests that Congress enacts legislation. If the Regulator could stipulate an abatement level, it would propose the …rst-best quota B : Since V (L; x) 0 for any L and x, this quota would be approved by Congress. Thus, the political distortions described above would be circumvented.

If a VA is adopted, but the Polluter chooses not to comply, we suppose that the Regulator initiates the legislative process leading to the quota L. As this takes place in a future period, the Polluter discounts the cost of the sanction. Hence, he complies only if the cost of meeting the target B is less than the discounted cost of the sanction:

C(B) [C(L) + x(L)] (4)
where is a multiplicative discount factor 2 (0; 1) re ‡ecting the Polluter's patience [START_REF] Khanna | The 33/50 voluntary program[END_REF] .

We assume that the Regulator does not observe the Polluter's discount factor, and hence is not perfectly informed about the Polluter's propensity to comply with the VA:

Assumption 1 is a random variable whose realization is only known to the Polluter when the game begins, but whose distribution is common knowledge. The distribution of is uniform over the interval ; + [0; 1]. [START_REF] Lyon | Self-regulation, taxation and public voluntary environmental agreements[END_REF] Introducing uncertainty of compliance can be justi…ed on two grounds. First, it is realistic. The cost of waiting is speci…c to each Polluter or industry as it depends on the weight of irreversible investments, the …rm's …nancial structure and similar idiosyncratic features. [START_REF] Lyon | Corporate Environmentalism and Public Policy[END_REF] Second, the assumption is justi…ed on theoretical grounds:

if the Regulator knew , the outcome of the game would entail a corner solution.

If exceeded a certain threshold, the Polluter would perfectly comply with the VA; if fell below that threshold, the Polluter would not comply at all, and the Regulator would never use a VA.

Assumption 1 implies that the Regulator only knows the compliance probability, denoted p(B); at the beginning of the game. Formally, given the distribution properties, the probability function is

p(B) = Pr (C(B) [C(L) + x(L)]) = 8 > > > > < > > > > : 1; if B B min 1 2 + C(B) C(L)+x(L) ; if B min < B < B max 0; if B B max (5)
where B min and B max denote the abatement levels such that

C(B min ) (C(L) + x(L)) ; C(B max ) + (C(L) + x(L)) :
Finally, we assume that the Regulator also discounts the social bene…t of future legislation, using the weight "; which is positive but less than one.

Figure 1 shows the decision tree of the model. We begin the analysis by identifying the conditions under which an agreement between the Polluter and the Regulator is feasible. Note that any feasible agreement necessarily improves social welfare relative to legislation since it satis…es the participation constraint of the welfare-maximizing Regulator.

The legislative subgame

We …rst characterize the legislation which emerges in equilibrium. Recall that the median Legislator's utility is

V (L; x) = W (L)+(1 )x = [L C(L)]+(1 )x.
Any feasible contribution must leave him with at least the same utility under the policy L as he would achieve with no contribution. Otherwise, he would reject the o¤er and implement B (his ideal policy when x = 0). Thus, for a contribution to be feasible, we require

V (L; x) V (B ; 0) = [B C(B )].
The Polluter o¤ers a contribution that minimizes his disutility, C(L) + x, subject to the feasibility constraint. Since his disutility is increasing in x, the feasibility constraint will bind. This contribution is implicitly de…ned by V (L; x) = V (B ; 0). Thus, the campaign contribution will depend on the quota as follows:

x(L) = 1 [W (B ) W (L)] (6)
In light of eqs ( 1) and ( 6), the Polluter minimizes

C(L) + x(L) = W (B ) L + C(L) 1 (7)
As the function ( 7) is convex, there is a unique value L that minimizes the Polluter's disutility, where C 0 (L ) = . The Polluter o¤ers the campaign contribution x(L ) in exchange for adoption of the quota L . We collect these …ndings in Lemma 1 The equilibrium legislation L is such that C 0 (L ) = while the equi-

librium campaign contribution is x(L ) = 1 [W (B ) W (L )].
Since < 1, it follows that L < B .

The VA subgame

We turn next to the analysis of the VA. When negotiating over the level of voluntary abatement B, the Polluter's utility obviously depends on his compliance decision. Given the compliance condition (4), his payo¤ is thus given by

max f C(B); [C(L ) + x(L )]g (8)
It follows that entering into a VA is a dominant strategy for the Polluter since Lemma 2 The Polluter's payo¤ under a VA is higher than his legislative payo¤ for any level of voluntary abatement:

Proof. Recall that legislative payo¤ is simply C(L ) x(L ): If C(B) [C(L ) + x(L )] ; then C(B) [C(L ) + x(L )] since < 1: Alternatively, if C(B) > [C(L ) + x(L )] ; we obviously have [C(L ) + x(L )] > [C(L ) + x(L )] :
The intuition of the lemma is simple. The Polluter is willing to participate in any VA because discounting makes the sanction cost [C(L ) + x(L )] strictly less than his disagreement disutility C(L )+x(L ). As a result, the Polluter enters into a VA either because it is less costly than legislation (when B is low), or because he anticipates non-compliance (when B is higher).

This property greatly simpli…es the analysis: non-enforceable VAs are only driven by the preferences of the Regulator.

We now de…ne the Regulator's payo¤ under the VA route:

W V A (B) p(B)W (B) + [1 p(B)] "W (L ) (9)
where " is the rate at which it discounts the social bene…t of future legislation in case of non-compliance. Note that, as is usual in the political economy literature, we assume that the Regulator does not care about the campaign contribution as it is a transfer between the Polluter and the Congress. The alternative assumption that the contribution is a cost included in the welfare function would not reverse the results. It would simply make a VA more likely by creating an additional incentive for the Regulator to use this instrument.

Assumption 1 introduces (one-sided) asymmetric information in the game. In this case, bargaining theory tells us that satisfying players' participation constraints may not be su¢ cient to ensure the existence of ex post e¢ cient bargaining outcomes when payo¤s are correlated (see [12] for a general discussion) [START_REF] Manzini | A bargaining model of voluntary environmental agreements[END_REF] . Intuitively, this is so because the informed player has an incentive to manipulate the information he transmits to the uninformed player. More precisely, he has an incentive to pretend he will comply with the VA. As the Regulator is aware of this 'incentive to lie', the minimal level of abatement it might be willing to accept may be strictly higher than the reservation level of the 'high type'Polluter who complies with the VA. However, this general argument does not apply to our case since the Regulator is aware that the polluter is willing to accept any VA (see Lemma 2): We establish the argument more rigorously in Lemma 3 If there exists a level of abatement B such that W V A (B) > W (L ), then there exists a bargaining procedure such that bargaining yields an ex-post e¢ cient Bayes Nash equilibrium.

Proof. Consider the following bargaining procedure. The Polluter makes an o¤er to the Regulator. If the o¤er is accepted, the agreement is struck and the game ends. But if the Regulator rejects the o¤er, then the game ends with no agreement.

Letting B( ) denoting the Polluter's o¤er when his type is ; the following set of strategies is a Bayes Nash equilibrium: 8 2 ; + , B( ) = B such that

W V A (B ) = W (L )
; and the Regulator accepts the o¤er. The outcome is obviously Pareto e¢ cient, because any deviation from B makes one player worse o¤. This bargaining procedure allocates all the bargaining power to the Polluter. Under the hypothesis that the Regulator has the bargaining power, it would make an o¤er maximizing her payo¤ which will also be accepted since the Polluter agrees in every case.

5 Regulator' s bargaining payo¤

General properties

Lemma 3 tells us that a necessary and su¢ cient condition for the existence of a VA is the existence of an abatement level B such that

W V A (B) > W (L ), or alternatively max W V A (B) : B 0 > W (L ); (10)
the highest VA welfare must exceed the equilibrium legislative welfare. In this section, we investigate the properties of W V A in order to identify the circumstances under which condition ( 10) is satis…ed.

Combining ( 5) and ( 9) yields

W V A (B) = 8 > > > > < > > > > : W (B) if B B min F (B) if B min < B < B max "W (L ) if B B max
where

F (B) 1 2 + C(B) C(L ) + x(L ) [W (B) "W (L )] + "W (L ); (11)
Then, we establish a set of properties of F which will be used to represent W V A diagrammatically.

Lemma 4

We have:

1) F 0 (0) > W 0 (0):

2) F (0) = 0: Proof. See the appendix.

3) If W (B max ) < "W (L ); then F 0 > 0 for any B 2 B min ; B max : 4) If W (B max ) "W (
Using these properties, Figures 2a,2b, and 2c show W V A as a function of B in the di¤erent cases: In all cases, W V A (B) equals W (B) when B B min (since p(B) = 1) and "W (L ) when B B max . Between B min and B max , W V A is either strictly decreasing (Fig. 2a), non-monotonic (Fig. 2b) or strictly increasing (Fig. 2c).

Figure 2a about here

Figure 2b here Figure 2c about here Looking at Fig. 2a-c, it is evident that the highest level of VA social welfare is given by 2) If W (B max ) < "W (L ); there never exists a VA yielding a higher welfare than the legislative quota.

max W V A (B) : B 0 = 8 > > > > < > > > > : W (B min ) if W (B max ) "W (L ) and F 0 (B min ) 0 F ( B) if W (B max ) "W (L )and F 0 (B min ) > 0 "W (L ) if W (B max ) < "W (L ) Hence, Proposition 1
Proof. The proof is straightforward since we know max W V A (B) : B 0 in the di¤erent cases. In the particular case where W (B max ) < "W (L ), no VAs are feasible since max W V A = "W (L ) which is strictly less than W (L ) (since " < 1):

Proposition 1 is the main proposition of the paper. It establishes that, depending on parameters'values, we can either observe a VA or not. In addition, a VA may involve a risk of non-compliance or not. For instance, assuming that the Regulator has all the bargaining power, it selects the abatement level B maximizing W V A when W (B max ) "W (L ) and F 0 (B min ) > 0. And we know from (5) that p( B) < 1. Alternatively, if F 0 (B min ) 0; the Regulator chooses B min with a compliance probability equal to 1:

Interpretation of Proposition 1

Proposition 1 does not allow us to see how the di¤erent parameters in ‡uence the likelihood of a VAs existence. For instance, the condition B min > L does not necessarily imply that should be less than a certain level to obtain a VA since both L and B min increase with . To further the interpretation of the model, we now investigate the properties of the equilibrium when abatement costs are quadratic, with C(B) = 1 2 B 2 ; where > 0. 10 Calculations included in the appendix characterize the key relationships between the conditions of Proposition 1 and the parameters ; ; and ": They show that Proposition 2 The VA outcome is closer to the …rst-best one than the legislative quota when the Congress is strongly responsive to lobbying (a low ) and when the Polluter and the Regulator are patient (high and ").

The in ‡uence of the lobbying parameter is not so intuitive as a high responsiveness to lobbying a¤ects VA welfare in two contradictory ways. On the one hand, it reduces the stringency of the legislative quota L , thereby increasing the Regulator's interest in VAs. On the other hand, it increases the risk of noncompliance associated with VAs since the size of the sanction (C(L ) + x(L )) directly depends on the strictness of the quota. Proposition 2 tells us that the former e¤ect unambiguously outweighs the latter.

The result that the more patient the Polluter, the larger the scope for welfareimproving VAs is not surprising as a low discount rate mitigates the VA compliance problem by increasing the size of the sanction (C(L ) + x(L )) borne by the Polluter. The reason for a patient Regulator's tendency to prefer VAs is also simple. Key in explaining this is the way the Regulator values non-compliance: In the case where the Polluter fails to comply, the Regulator's utility is "W (L ) which corresponds to the delayed implementation of the legislative quota. This bene…t obviously increases with "; making the use of VAs more attractive.

Robustness of the results

The model presented here is fairly simplistic. It is worth discussing the robustness of the insights it gives and some possible extensions. Three criticisms/questions come quickly to mind: the impact of bargaining power on outcomes, the fact that there is no green lobby group acting in the Congress and the assumption that polluters have solved their collective action problem. We now consider these points.

Bargaining power

When interpreting Proposition 1 in subsection 5.2, we assume that the Regulator has all the bargaining power. How do di¤erent allocations of bargaining power in ‡uence the results obtained? This question echoes the classi…cation previously mentioned which distinguishes three categories of VAs: public voluntary programs developed by public authorities, to which companies are invited to participate, negotiated agreements between polluters and public authorities, and unilateral commitments made by polluters. In settings, like ours, where VAs are driven by Regulator's threats, this classi…cation ultimately describes di¤erent allocations of bargaining power between the regulator and the polluters. [START_REF]Reality Check: The Nature and Performance of Voluntary Environmental Programs in the US, Europe, and Japan[END_REF] Given that the Regulator seeks to maximize welfare, it is very intuitive that Proposition 3 Social welfare associated with a non-enforceable VA increases with the Regulator's bargaining power.

Proof. See the appendix.

Lobbying by a green group and free riding

The fact that the Polluter is the only active lobby group in the Congress and that free riding does not hinder its lobbying e¤orts may pose a problem as one could expect better legislative outcomes once these assumptions are relaxed.

In this subsection, we adopt a common agency framework in which the Legislator is the agent of two principals -the Polluter and a green lobby group -both o¤ering contributions. For the sake of tractability, we only consider VAs involving perfect compliance in equilibrium (p(B V A ) = 1) and we assume that the Regulator has all the bargaining power. Formally, the Legislator's utility function is now

V (L; x) = W (L) + (1 ) (x P (L) + x G (L)) ; (12)
where x P (L) and x G (L) are the Polluter's and the green group's contingent contribution schedules, respectively.

We also introduce free riding considerations, admittedly roughly, by assuming that the Polluter's lobbying cost is x P (L)=( 1) for making a contribution x P (L)

to the median legislator with 0 < 1. is a new parameter capturing the idea that, when some …rms within an industry fail to cooperate, remaining contributors should make additional e¤orts. Note that is inversely related to lobbying e¤ectiveness. Under this assumption, Polluter's legislative pay o¤ is now

C(L) x P (L) 1
Turning next to the green lobby group, we suppose that it is only concerned with the environmental bene…t of legislation so that its utility under legislation is

L x G (L) 1
with 0 < 1: Note that, when > , the green group is less e¤ective in lobbying activities than the Polluter.

The derivation of the political equilibrium closely follows Grossman and Helpman [5] and is left out for ease of presentation. When the lobby groups choose their contributions, the key di¤erence from the previous sections is that "walk-ing away" no longer implies that the Legislator will implement the optimal quota B : Rather, if a group abstains from lobbying, the Legislator implements the best legislation given the other group's contribution.

In addition, we assume that contributions schedules are globally compensating.

This means that each contribution function "compensates" the group for its di¤erent evaluations of the two policy options. Accordingly, the contribution functions are given by

x P (L) 1 = C(L P ) C(L) and x G (L) 1 = L L G (13)
where L P and L G denote the legislative quotas when the Polluter or the green group are not involved, respectively. This assumption is routinely made in the literature because it is necessary to pin down equilibrium contributions (for detailed explanations and justi…cations, see [5], pp 265-270) [START_REF] Muthoo | Bargaining Theory with Applications[END_REF] . Plugging (13) in the Legislator's objective function (12) and omitting constant terms, we obtain the following maximization problem

max L W (L) + (1 ) [(1 ) L (1 ) C(L)]
We derive the …rst-order condition and solve for L so that equilibrium legislation is

L = 1 1 (1 ) 1 (1 ) (14)
Note that the quota ( 14) coincides with the …rst-best quota (B ) when lobby groups are equally e¤ective ( = ): This obviously implies that Proposition 4 When groups are equally e¤ective in lobbying activities ( = );

VAs never dominate legislative intervention in equilibrium since the legislative quota is socially optimal.

This proposition illustrates a general feature of contribution-based lobbying games. Distortions are driven by the existence of a political asymmetry between the groups a¤ected by the policy, either because lobby groups are not equally e¤ective ( 6 = ) or because one group is not represented in the lobbying game like in the previous sections.

By contrast, if lobbying e¤ectiveness is heterogeneous, calculations provided in the appendix show that Proposition 5 When 6 = ; a VA yields a higher welfare than legislation when the lobbying parameter is low, when the Polluter is patient (a high ), when the Polluter's lobbying e¤ectiveness is low (as re ‡ected by a high ), or when the green group's lobbying e¤ectiveness is high (as re ‡ected by a small ).

If is su¢ ciently low -that is, if < (1 )

p = 1 p -the
VA even yields the …rst-best abatement level B :

Proof. See the appendix.

The …rst part of Proposition 5 is in line with previous results (the impact of and ). The in ‡uence of lobbying e¤ectiveness' parameters and is less intuitive. And the fact that voluntary abatement can be socially optimal when is su¢ ciently low is clearly a new and striking result. In order to understand the underlying intuition of these results, recall that the Regulator'ability to implement a strict VA is constrained by the compliance condition

C(B) < C(L ) + x P (L ) 1 (15)
This expression makes clear that the higher the value of , the wider the room for a strict VA with which the Polluter will comply. The reason is extremely simple. As compared to the preceding sections in which was set to zero, our new assumption increases the Polluter's lobbying cost x P (L )=( 1) and thus the scope for VAs by increasing the size of compliance incentives.

Now, let substitute ( 13) in (15). The compliance condition becomes

C(B) < C(L P )
It is then clear that the room for a strict VA increases with L P . And L P is high when the green lobby is very e¤ective (a small ) or when the Legislator is strongly responsive to lobbying (a low ). If L P is su¢ ciently high, we can perfectly observe a VA involving B . This occurs when C(B ) < C(L P ) as we observe perfect compliance with B V A = B :

Therefore, this extension does not change the general message that VAs are suitable in contexts in which the responsiveness of the Congress to lobbying is high. But, in addition to this, it shows that the introduction of competition with a green lobby group or a decrease in the Polluter's lobbying e¤ectiveness (by setting 6 = 0) tend to increase the scope for VAs by raising the Polluter's lobbying cost and thus his propensity to comply.

However, note that the robustness of the particular result that the VA can be socially optimal is questionable. In fact, the size of the left hand side of (15) directly depends on the assumption that the Polluter's contribution schedule is globally compensating. This assumption, though a usual and a necessary tool to derive equilibrium contributions, clearly determines a high level of contribution since it essentially means that the Legislator is able to extract the entire lobbying surplus from the two groups.

Conclusion

We have developed a model of non-enforceable VAs under the threat of a legislative quota with two main assumptions. The …rst is that the Polluter is an active lobby group in the Congress in ‡uencing the legislative process. This political distortion makes possible the entry of the Regulator into a VA which avoids the enactment of a piece of politically distorted legislation. The fact that the VA contract is non-binding is the second key assumption. As a result, the Regulator can only punish a non-complying Polluter by implementing the legislation at a later stage.

We show that a non-enforceable VA can be a better instrument than a legislative quota in speci…c circumstances. This is particularly the case when lobbying exerts a strong in ‡uence on the Congress. Interestingly, the result is not very intuitive because a distorted legislative process yields two opposite e¤ects. On the one hand, it obviously reduces the strictness of the legislative quota. On the other hand, it damages VA social welfare since a lax legislative quota provides lower compliance incentives. Our analysis shows that the former e¤ect is stronger that the latter.

This …nding contradicts the recurrent policy recommendation that VAs should be developed under credible legislative or regulatory threats (for instance, see [13]). When threats are credible and su¢ ciently strong, we show that legislation is preferable. VAs are also shown to yield a higher social welfare than legislative quotas when the polluter and the regulator do not discount future costs and bene…ts heavily.

To conclude, the main …nding of the paper is that non-binding VAs are weak instruments which are potentially useful in adverse political contexts. In practice, they are particularly widespread in climate change policies. Do our results suggest that VAs are suitable for these policies? To a large extent, answering this question is speculative as political contexts vary greatly across countries and the key parameters of the model (e.g., ) are not quanti…able in a consistent and comparable way.

Nevertheless, our model pinpoints two arguments in favor of climate change VAs. First, they have mostly been developed in energy-intensive industries (steel, glass, cement, chemicals, etc.) which are typically very e¤ective in lobbying activities. One reason being that free riding is less likely in sectors where companies are few and large and in which energy (and thus abatement) costs represent a signi…cant share of production costs. Second, climate change is a long term policy concern for which immediate action is less crucial than mid-or long-term policy strategies. As a result, the regulators' cost of waiting is probably low in comparison with other policy areas. This promotes the adoption of VAs since a key risk associated with their use is to delay legislative intervention in the event of non-compliance.

Our model is quite simplistic and several extensions or improvements could be pursued. In our view, the two most promising lines of research are the following.

First, one should try to be more speci…c as to the type of VAs analyzed. [START_REF]OECD, Voluntary Approaches for Environmental Policy: E¤ectiveness, E¢ciency and Usage in Policy Mixes[END_REF] In this regard, it would be interesting to investigate speci…cally the case of industry-wide agreement while relaxing the assumption that …rms fully overcome their free-rider di¢ culties. Second, the hypothesis of perfect information about abatement cost 4) If W (B max ) "W (L ); then F is concave for any B 2 B min ; B max since

F "(B) = 1 2 [C"(B)=C(L ) + x(L )] [W (B) "W (L )] 1 [C 0 (B)= (C(L ) + x(L ))] W 0 (B) p(B)C " (B)
which is obviously negative (since C 0 (B); C " (B) and W 0 (B) > 0): In addition,

F 0 (B max ) = C 0 (B max )= ((2 ) (C(L ) + x(L ))) [W (B max ) "W (L )] < 0
It implies that there exists a unique interior maximum de…ned by the …rst order condition F 0 ( B) = 0 for any B 2 B min ; B max if F 0 (B min ) > 0 while:

5) F 0 (B) 0 if F 0 (B min ) 0:

Proof of Proposition 2

We interpret …rst Part 1) of Proposition 1 where W (B max ) "W (L ). Then, we consider Part 2) where W (B max ) < "W (L ):

9.2.1 Case 1: W (B max ) "W (L )
In this case, Proposition 1 tells us that a welfare-improving VA exists if either a)

F 0 (B min ) 0 and B min > L or b) F 0 (B min ) > 0 and F ( B) > W (L ): Moreover, assuming that the Regulator has all the bargaining power, the equilibrium VA is which is observed when F 0 (B min ) > 0 and F ( B) > W (L ): Let g( ; "; ) the function such that g( ; "; ) = F ( B) W (L ). We now study the properties of g to identify how ; "; and in ‡uence its sign.

B V A = B min if F 0 (B min ) 0 and B V A = B if F 0 (B min
It is convenient to develop g( ; "; ) as follows g( ; ";

) = p( B) h W ( B) "W (L ) i (1 ") W (L ) (17)
Di¤erentiating (17) with respect to " and , substituting F 0 ( B) = 0 and rearranging yields

@g @" = h 1 p( B) i W (L ) @g @ = 1 2 h W ( B) "W (L ) i
Both derivatives are positive, meaning that rising " and/or promotes the existence of welfare-improving VAs.

Turning next to the parameter ; note that L B min is equivalent to 2 In between these two values of L ; simulations available upon request con…rm that g is positive for small values of and then becomes positive beyond a certain threshold.

9.2.2 Case 2: W (B max ) < "W (L )

In this case, the legislative quota Pareto dominates the VA . Here, we establish that, if ; "; and are such that W (B max ) < "W (L ); this implies that L > max n B min ; Lo : Put di¤erently, the condition W (B max ) < "W (L ) is not binding and the properties of ; "; and identi…ed in Case 1 are su¢ cient to de…ne the scope for a welfare-improving agreement.

From W (B max ) < "W (L ) follows B max < L since " < 1. This directly implies L > B min : Fig. 2b also shows that W (B max ) > F ( B): This implies that L > L;

or alternatively W (L ) > F ( B), since W (B max ) < "W (L ) < W (L ):

Summary

According to subcase 1a, there exists a welfare-improving VA if and are such that < : If + ; the analysis of subcase 1b tells us that we have a VA if is not too high and/or if and " are su¢ ciently high. Finally, the condition of Case 2 is not binding. These elements converge to establish that VAs emerge when is low and/or when and " are high. Let us …rst identify L 0 : Developing W (L 0 ) = W (B min ) and rearranging, we obtain

L 0 1 2 (L 0 ) 2 L + 1 2 (L ) 2
which is a polynomial of degree 2. Solving for L 0 , the two roots are (2= ) L and L : From L 0 < B obviously follows that L 0 = (2= ) L :

As a result, B min > L 0 is equivalent to B min > (2= ) L : Substituting ( 14) and (19) in this inequality and rearranging leads to

Figure 1 about here 4

 4 Figure 1 about here

2 B

 2 L ) and F 0 (B min ) > 0; then F admits a unique interior maximum, denoted B; over B min ; B max .5) If W (B max )"W (L ) and F 0 (B min ) 0; then F 0 0 for any B min ; B max .

1 )

 1 If W (B max ) "W (L ); a welfare-improving VA exists if either a) F 0 (B min ) 0 and B min > L or b) F 0 (B min ) > 0 and F ( B) > W (L ):

) > 0 :

 0 We now examine the in ‡uence of the parameters ; "; on these results by distinguishing two subcases L < B min and L B min . Subcase a: L < B min : In this case, Proposition 1 already tells us that VAs dominate legislation if F 0 (B min ) 0: Here, we show that the same is true when F 0 (B min ) > 0: For ease of presentation, let L denote the value of L implicitly de…ned by the two conditions W L = F B and L < B. Using this notation, F ( B) > W (L ) is the same as L < L: Diagrammatically, Fig. 2b immediately shows that B min < B: Hence, L < B min necessarily implies that L < L: Note that L < B min is equivalent to < . Subcase b: L B min : In this case, the only feasible agreement is B V A = B

; 1 :

 1 In the particular case where L = B min , or = ; g > 0 since B > B min By contrast, if = 1, or L = B ; we have g(1; "; ) = F ( B) W (B ) < 0.

2 :

 2 Contrary to Case 1, W is no longer monotonic between B min and L , implying that the condition W (B min ) > W (L ) does not simplify to B min > L : As W is single-peaked, W (B min ) > W (L ) is now equivalent to B min > L 0 where L 0 is de…ned by W (L 0 ) = W (L ) and L 0 < B .

1 ( 1 ) 1 : 1 p 0 Figure 2a :

 111102a Figure 2a:W V A (in bold) and W if W (B max ) "W (L) and F 0 (B min ) 0

Figure 2b :

 2b Figure 2b: W V A (in bold) and W if W (B max ) "W (L) and F 0 (B min ) > 0

If one does not need to compute equilibrium contributions, assuming di¤erentiability of contribution functions is su¢ cient to derive the political equilibrium.Di¤erentiability implies that contributions are locally compensating in equilibrium.

[START_REF]OECD, Voluntary Approaches for Environmental Policy: E¤ectiveness, E¢ciency and Usage in Policy Mixes[END_REF] As done by Lyon and Maxwell[START_REF]OECD, Voluntary Approaches for Environmental Policy: E¤ectiveness, E¢ciency and Usage in Policy Mixes[END_REF] for instance.

should be relaxed. This would probably reduce the scope for VAs since information asymmetry is particularly detrimental in bargaining contexts.

Acknowledgements

I would like to thank John Maxwell, two anonymous referees and many seminar participants at the University of Cergy-Pontoise, Université Catholique de Louvain and CIRED for their helpful comments. The usual disclaimer applies. 9 Appendix

Proof of Lemma 4

To begin with, we di¤erentiate F which leads to F 0 (B) = C 0 (B)= ((2 ) (C(L ) + x(L ))) [W (B) "W (L )] + p(B)W 0 (B) (16) Then we consider the di¤erent properties in turn.

2) Given (11),

Therefore, the …rst term of ( 16) is positive in the same interval. The second term is also positive since W 0 > 0 when B < B . Hence F 0 > 0.

Proof of Proposition 4

We obviously restrict the analysis to the case where a VA is feasible, that is when

When the Regulator has all the bargaining power, we have seen that B V A = max n B min ; Bo which maximizes expected welfare. Now we show that B V A = L in the opposite case in which the Polluter has all the bargaining power. Given (8), his …rst-best VA is simply B V A = 0: But this does not satisfy the Regulator's participation constraint

Polluter would choose the abatement level maximizing his payo¤, that is either

L P is the equilibrium of the single-lobby game in which the contribution

x G (L) is still given by ( 6) while the green group maximizes L x G (L): Deriving the …rst order condition immediately yields

)) = . Plugging this expression in (18) and solving for B min leads to

Establishing the second part of the proposition is now straightforward. The condition 2 A few papers have analyzed VAs obtained in exchange of a subsidy (see for instance [7]) or VAs driven by demand considerations [3].

3 Some VAs are proposed in the absence of legislative threats. For instance, U.S. climate change programs such as Climate Wise are used by EPA whereas the agency had no statutory authority to take formal regulatory actions in this …eld. In these cases, companies join public voluntary agreements in order to obtain technical assistance and/or favorable publicity from the government ( [13], p 1457).

Our paper does not deal with such agreements. 35 [START_REF] Glachant | Voluntary agreements in a rent seeking environment[END_REF] Put di¤erently, VAs are used in contexts where mandatory intervention is di¢ cult. This is very intuitive. Why would public authorities rely on voluntary actions by polluters if legislation was easy to pass? [START_REF] Grossman | Special Interest Politics[END_REF] Imperfect compliance with mandatory standards is sometimes observed in reality. However, such standards are at least enforceable in contrast with most VAs.

Our assumption makes this di¤erence very clear-cut. [START_REF] Khanna | The 33/50 voluntary program[END_REF] In (4), x(L) is discounted in line with the idea that discovering non-compliance and launching a legislative process takes time. One may rightly argue that the lobby group contributes before legislation is enacted. This could justify the introduction of a speci…c discount factor for x(L). This alternative assumption would not alter the results qualitatively. It would simply modify the composition of the sanction cost, by giving more weight to x(L) than to C(L): [START_REF] Lyon | Self-regulation, taxation and public voluntary environmental agreements[END_REF] The uniformity of the distribution simpli…es the presentation of the results.

The results will be valid with other distributions, assuming the cumulative and density are positive and increasing on the whole interval. [START_REF] Lyon | Corporate Environmentalism and Public Policy[END_REF] Note that, when the VA involves a sector, discount rates may di¤er across …rms. We assume here that …rms have solved their collective action problem. This implies that, inter alia, they have reached a consensus on a collective discount rate. [START_REF] Manzini | A bargaining model of voluntary environmental agreements[END_REF] A bargaining outcome is said to be ex post e¢ cient if and only if after all the information is revealed the players' payo¤s associated with the bargaining outcome are Pareto-e¢ cient. Payo¤s are said to be correlated when the piece of private information (here ) a¤ects both players'payo¤s. [START_REF] Maxwell | Self regulation and social welfare: the political economy of corporate environmentalism[END_REF] Under this assumption,

and the compliance probability of Eq.( 7) is

for any B 2 B min ; B max . [START_REF]Reality Check: The Nature and Performance of Voluntary Environmental Programs in the US, Europe, and Japan[END_REF] Common to all types is the fact that the participation constraints of the pol-36 luter and of the regulator are jointly satis…ed. This is so even for self regulation where the Regulator is seemingly absent. It necessarily agrees with the unilateral voluntary commitment, albeit implicitly, because, otherwise, it would implement the threat.

Implement B

The regulator initiates the legislative process

The polluter selects x

The Congress enacts a quota L

The polluter does not comply The polluter complies

The regulator initiates the legislative process

The polluter selects x

The Congress enacts a quota L Regulator-polluter bargaining Agree Disagree


Benjamin Mathon
email: benjamin.mathon@gipsa-lab.grenoble-inp.fr

Patrick Bas
email: patrick.bas@gipsa-lab.grenoble-inp.fr

François Cayre
email: francois.cayre@gipsa-lab.grenoble-inp.fr

Benoît Macq
email: benoit.macq@uclouvain.be

Comparison of secure spread-spectrum modulations applied to still image watermarking

Keywords: Watermarking, Security, Still images

This article shows the results obtained when using secure spread-spectrum watermarking on grayscale images in the watermark only attack (WOA) framework. Two secure modulations, natural watermarking (NW) and circular watermarking (CW), are compared with classical insecure modulations, spread spectrum (SS) and improved spread spectrum (ISS), from distortion, robustness, and security points of view. Implementations of CW and NW for still images are proposed: they use a wavelet transform and variable strength embedding with bounded distortion. Robustness of these schemes is assured by using JPEG compression and security is quantified by using a source separation technique: independent component analysis (ICA). Finally, tests are conducted on 2,000 natural images. They allow to distinguish between WOA security classes.

Introduction

The problem of security for watermarking applications has recently become a major concern for both researchers and industrialists. For specific setups, a security flaw can considerably reduce the usability of a watermarking scheme. In [START_REF] Cayre | Watermarking security: theory and practice[END_REF], the authors propose a classification of attacking scenarios for watermarking depending on the kind of knowledge of the adversary. Following the Diffie-Hellman classification, they came up with various scenarios, among which is the watermarked only attack (WOA) framework, where the adversary only owns several watermarked images (he knows neither embedded messages nor original images). Also in watermarking, security is based on Kerckhoffs' principle [START_REF] Kerckhoffs | La cryptographie militaire[END_REF] and relates to the estimation of a part or all of the secret key [START_REF] Comesaña | Fundamentals of data hiding security and their application to spread-spectrum analysis[END_REF]. In multi-bit watermarking, the key is the location of a set of codewords in a private subspace. Under the assumption that digital contents are represented by their feature vectors, embedding of a message in a host content consists of moving the feature vector into the decoding region of the right codeword. From [START_REF] Cayre | Kerckhoffs-based embedding security classes for woa data hiding[END_REF], one can devise four embedding security classes in the WOA framework:

1. Insecurity. In this class, the conditional distribution (given the key) of the marked contents is different for all keys. By exhaustive search (or a more advanced technique), the adversary can estimate both the private subspace and the codewords. 2. Key security. A watermarking scheme belongs to the second class, key security, if, for a subset of keys (including the actual secret key), the conditional distribution of the marked contents is the same.

The adversary can find this subset of keys and he can find the secret subspace but he cannot obtain more information about the codewords. 3. Subspace security. The third class is called subspace security. In this case, the conditional distribution of marked contents is the same for all possible keys. Therefore, the adversary cannot gain any information about the key (he has no access to the secret subspace where the keys actually live). 4. Stego security. This last class relates to steganography: the distribution of marked contents is the same as the distribution of the host's contents. The adversary cannot decide whether the contents are marked or not.

The secret part of a watermarking scheme can be seen as twofold: on the one hand, there is the very private subspace in which the decoding regions are located, and on the other hand, there is the location of these decoding regions in the private subspace. In practice, the key-secure class determines the limitation between robustness and security: the optimal attack consists of focusing on the private subspace in order to minimize the attack distortion. However, the estimation of the location of the coding regions is more precise information and can be used to tamper the embedded message. We have the following relationships among the classes: stego security ⊂ subspace security ⊂ key security and key security ∩ insecurity = ∅. In [START_REF] Cayre | Watermarking security: theory and practice[END_REF], the authors propose the notion of security level for insecure watermarking (number of observations that are necessary to improve the adversary's knowledge about the secret key by an order of magnitude). Classical spread-spectrum modulations, such as spread spectrum (SS) [START_REF] Cox | Secure spread spectrum watermarking for multimedia[END_REF] and improved spread spectrum (ISS) [START_REF] Malvar | Improved spread spectrum: a new modulation technique for robust watermarking[END_REF], are proved to be in the insecurity class. Recently, two secure modulations have been proposed in the WOA framework: the natural watermarking (NW), which can be made stego-secure, subspace-secure, or keysecure, and the circular watermarking (CW), which is key-secure. The main goal of this article is to assess and to compare the security of the four previous modulations in a practical case: image watermarking. Section 2 lists notational conventions used in the article. Section 3 recalls basics on SS watermarking schemes (insecure and secure modulations). Section 4 considers two points of view, namely distortion and robustness, to compare insecure and secure modulations over natural images and presents improvements regarding psychovisual constraints. Section 5 deals with the security of the SS schemes. In this section, we present techniques used to estimate the secret key and the different levels of security of the schemes. Key estimation is cast into a blind source separation problem where independent component analysis is used to find codeword locations (or, conversely, decoding regions in the private subspace, when possible). Also in this section, we compare the security of the modulations in the practical case of image watermarking.

Notations

We first list some notational conventions used in this article. Data are written in small letters. Vectors and matrices are set in bold fonts. Vectors are written in small letters and matrices in capital ones. x(i) is the i-th component of vector x. As for the C programming language, all indexes start from zero. We write (x(0), x(1), x(2), ...) the content of a vector x. Functions are noted in roman fonts, sets in calligraphy fonts, and variables in italic fonts. span (A) represents the vector space spanned by A. p x j denotes the distribution of vectors x j . σ 2 x represents the unbiased variance of a signal x and .|. denotes the usual scalar product. x denotes the Euclidean norm of a vector x.

Spread-spectrum-based watermarking schemes

This section presents SS techniques and different modulations that are either insecure (SS and ISS) or that belong to a given security class (NW and CW).

Construction of marked signals

We want to hide a message m of N c bits (m

∈ F N c
2 ) in a host Gaussian vector x ∈ R N v . This feature vector is obtained by selecting information from a linear transform (for example, DCT or DWT) of the content we want to watermark. The message is coded using N c carriers u i ∈ R N v . We generate the carriers with a pseudo-random number generator (PRNG) initialized with a seed K, the secret key. Carriers come as zero-mean Gaussian vectors obtained with the PRNG and are further orthogonalized (using Gram-Schmidt procedure) with unit variance in order to provide a basis of the private subspace, i.e., ∀i = j , u i |u j = 0. Moreover, we have u i 2 = N v -1 (because we use the unbiased estimation of the variance). In WOA framework, security attacks are linked with the estimation of the carriers u i . It is not necessary to go back to the PRNG key K to successfully perform a security attack: contrarily to the arithmetics used in cryptography, in watermarking, it is enough to have a good estimate of the secret carriers [START_REF] Cox | Watermarking is not cryptography[END_REF]. To create the watermark signal, we use a modulation. A modulation is an application s :

F 2 × R N v → R.
The watermark signal w is constructed as follows:

w = N c -1 i=0 s (m(i), x) u i . (1)
As a convention, we set s (1, x) > 0 and s (0, x) < 0.

We obtain the watermarked signal by a summation of x and w:

y = x + w. (2)
Distortion is assessed by means of the watermark-tocontent ratio (WCR):

WCR [dB] = 10 log 10 σ 2 w σ 2 x . (3)
One objective of watermarking schemes is to guarantee that the embedded watermark survives genuine signal processing operations (in the case of still images, one may want to resist compression or noise addition). These attacks are generally not intentional. We model robustness attacks by adding a Gaussian noise n to y and we consider the attacked vector r = y + n. Attack strength is assessed by means of the watermarked content-to-noise ratio (WCNR):

WCNR [dB] = 10 log 10 σ 2 y σ 2 n . (4)
Decoding is performed by computing the normalized correlations z between carriers and (possibly) attacked signal:

z r,u i = 1 u i 2 r|u i = 1 N v -1 r|u i . (5)
We have:

z r,u i = z x,u i + s (m(i), x) + z n,u i . (6)
The first term represents host interference, which can be used for side-informed embedding but which is negligible statistically compared to the second term for the classical SS modulation because of the normalization by N v -1 (see Section 3.2). The third term is unpredictable at the time of embedding because it depends on the power of the attacking signal. If m denotes the estimated message, for each bit, we have:

m(i) = 0 if z r,u i < 0, 1 if z r,u i > 0. (7)
It comes from the classical decoding rule of SS communications. We measure decoding performance with bit error rate (BER) figures between the estimated and the original message:

BER(m, m) = 1 N c N c -1 i=0 m(i) ⊕ m(i). (8)

Various spread-spectrum modulations

The general formula for the modulation s of SS is given by:

s(m(i), x) = α(i, x)(-1) m(i)⊕1 -λ(x)z x,u i . (9)
where:

α(i, x) allows to adjust the distortion of each carrier.

λ(x) allows to adjust informed embedding.

Spread spectrum (SS)

The SS classical modulation is the analog of the binary phase shift keying (BPSK) modulation for numerical communications. We have:

α SS (i, x) = σ 2 x 10 WCR/10 N c , (10)
and

λ SS (x) = 0. (11)
The value of α(i, x) is proportional to the strength of the embedding: the higher the value, the more robust but the less imperceptible the embedding. Note that informed embedding is not enabled (λ(x) = 0).

Improved spread spectrum (ISS)

In the previous modulation, the embedding process does not depend on the host interference z x,u i . However, it can be interesting to cancel this interference to improve both robustness and error probability. In [START_REF] Malvar | Improved spread spectrum: a new modulation technique for robust watermarking[END_REF], the authors propose a new modulation, the ISS with:

α ISS (i, x) = 1 - λ 2 N c N v 10 WCR/10 , (12)
and

λ ISS (x) = 1 2   1 + 10 NCR/10 + N v 10 WCR/10 N c - 1+10 NCR/10 + N v 10 WCR/10 N c 2 -4 N v 10 WCR/10 N c   . (13)
α(i, x) and λ(x) are computed to achieve hostinterference rejection and error probability minimization given a target noise-to-content power ratio:

NCR [dB] = 10 log 10 σ 2 n σ 2 x , (14)
where n denotes Gaussian noise (possibly added to the watermarked signal).

If λ(x) = 0, this scheme is reduced to the classical SS scheme, and if λ(x) = 1, the host interference is totally achieved.

Natural watermarking (NW)

In [START_REF] Bas | Natural watermarking: a secure spread spectrum technique for woa[END_REF], a new modulation is proposed, namely, NW. Its goal is to preserve the distribution of z x,u i , which is supposed to have circular (cf. Eq. 21) pdf, possibly scaled by a factor η ≥ 1 (in order to set distortion):

α NW (i, x) = η|z x,u i |, (15)
and

λ NW (x) = 1, (16)
with η = N v -1 N c 10 WCR/10 -1. For each carrier u i , one has:

|z y,u i | = |η||z x,u i |. (17)
If η = 1, considering the Gaussian hypothesis of the host signals, the distribution of host and marked contents in the subspace spanned by the carriers is the same. The higher this value, the more robust the embedding. However, we change the security of the scheme. Section 5.2 shows a discussion on the choice of the parameters and on the security of NW. In the remainder, this modulation is called NW when η = 1 and robust natural watermarking (robust-NW) when η > 1.

Circular watermarking (CW)

One drawback of NW is the fact that, since a great number of watermarked contents are close to the decoding regions borders, the robustness of the scheme is not very high. In [START_REF] Bas | Achieving subspace or key security for woa using natural or circular watermarking[END_REF], another modulation, namely CW, based on ISS modulation is proposed:

α CW (i, x) = d(i)α ISS (i, x), (18)
and

λ CW (x) = λ ISS (x). ( 19
)
Parameter d is generated at each embedding from a zero mean Gaussian signal g. This perturbation is used to randomly spread the correlations of the mixed signals on the whole decoding regions: ,c,d,e) over the carriers. These distributions have been generated with 2,000 host Gaussian signals,

d(i) = |g(i)| g . ( 20
)
N v = 256, N c = 2, WCR = -20 dB (a) (b) (c) (d) (e)
Perturbation d enables the following property of circularity:

p z y,u 0 , ..., z y,u Nc-1 = p   N c -1 i=0 z 2 y,u i   . (21)
Circularity means that the distribution of the correlations can be reduced to a distribution that depends only on the Euclidean norm of the correlations. However, in this implementation, correlations can be spread on a wrong codeword region due to the host interference. This problem can occasionally lead to decoding errors (even in an attack-free context). We propose to replace the usual CW implementation with a new stochastic version of CW, called "zero-error-bit CW." The process consists of randomly generating a new perturbation d until the watermarked content y is located inside the right decoding region after embedding (this is checked using Eq. 7). Note that the complexity of this process depends on the host interference rejection, if λ(x) = 1, the watermarked content is always in the right decoding region. This way, we have a CW implementation that has zero BER in an attack-free context without changing the probability density function of y. In the remainder of the article, CW means "zero-error-bit CW" since it has intrinsically better performance than the original implementation.

Figure 1 shows correlations of host and marked signals for the four modulations over two secret carriers. We can see that, for each modulation, the four decoding regions depend on the sign of each secret carrier.

Implementation on still images

Theoretical watermarking schemes assume a Gaussian host signal x. However, this model does not match usual distributions of feature vectors: DCT coefficients are traditionally modeled by a Laplace distribution and wavelet coefficients are usually modeled by a generalized Gaussian distribution. In order to get closer to this assumption (mainly for NW testing), we adopt the following trick: we perform a projection of the host feature vector on a set of pseudo-random signals, so that the vector that will be used for watermarking will be composed of the values of the projected host vector over the pseudo-random signals. This projected host feature vector can be assumed to have Gaussian pdf.

Note that embedding produces dependencies along the directions of the carriers, and independent component analysis (ICA) might be used to recover these directions. However, this is not possible in practice: ICA cannot be used on very high-dimensional observations (here, the vectors are more than 200,000 samples long) and only second-order analysis like principal component analysis can be reliably performed.

Image watermarking scheme

The scheme of the implementation of secure modulations on images is presented in Fig. 2. We want to watermark 8-bit grayscale images of M × N pixels. After a three-level 9/7 Daubechies wavelet forward transform, we arrange the nine first subbands (high-pass coefficients) of the host image into a vector x t ∈ R N t . In order to have a Gaussian distribution, we construct the host signal x ∈ R N v as follows:

x(i) = 2 √ 3 √ N t N t -1 j=0 x t ( j)a i ( j). ( 22
)
a i are pseudo-random, uniformly distributed vectors and the ratio 2 √ 3 is used to account for the variance of a uniformly distributed variable. This projection is orthogonal. Then, the watermark vector w is produced by SS watermarking from a random message m and carriers u i .

Distortion is assessed by means of the peak signal-tonoise ratio (PSNR). The link between PSNR and WCR is given by (proof in Appendix):

WCR = 10 log 10 255 2 σ 2 x × M × N N v -PSNR. ( 23
)
Retroprojection of w in the wavelet domain is defined by:

w t (i) = 2 √ 3 √ N t N v -1 j=0 w( j)a j (i). (24)
Finally, we construct the marked signal y t in the wavelet domain by constant strength embedding:

y t = x t + w t , (25)
and we produce a marked image by applying the inverse wavelet transform.

Psychovisual constraints

It is possible to exploit the weaknesses of the human visual system (HVS) in order to better embed the watermark signal. The following assumptions hold in practice:

-HVS is less sensitive to high-activity areas (e.g., textures). -HVS is more sensitive to low-activity areas (e.g., flat areas). Exploitation of these weaknesses in the current watermarking algorithm is made by adding psychovisual masking in the wavelet domain. We use variable strength embedding [START_REF] Piva | DCT-based watermark recovering without resorting to the uncorrupted original image[END_REF]:

y t = x t + w t with w t (i) = |x t (i)| E[|x t |] 2 w t (i), i ∈ {0, ..., N t -1}. ( 26
)
The factor 1 E[|x t |] 2 is used in order to preserve correlations in the N c -dimensional private space and to avoid detection errors [START_REF] Furon | Broken arrows[END_REF]. Therefore, the relationship between PSNR and WCR becomes (proof in Appendix):

WCR = 10 log 10 255 2 σ 2 x × M × N N v × E[|x t |] 2 E[x t 2 ] -PSNR. ( 27
)

Numerical values and assessment

In practice, we use M = N = 512, N t = 258,048, N v = 256. We want to hide N c = 10 bits on each image. We set a constant target PSNR of 45 dB for the four modulations: SS, ISS, robust-NW, and CW. Unless it is ex-plicitly mentioned otherwise, we use constant strength embedding. Implementation of stego-secure NW is not evident because of the weakness of this modulation. In fact, variance of the watermark signal is too low and produces a fragile mark (because of the quantization of the marked image on 8 bpp). A way to circumvent this problem is to produce the mark in the medium frequencies subbands of the host image. Section 5.4.1 presents a practical implementation of NW. Moreover, we use N c = 2 on the figures in order to have a 2D representation of the distribution of the contents before and after embedding. This allows for intuitive reasoning on the BPSK constellation. However, one could hide as many bits as needed. Tests are made on 2,000 of the BOWS2-original images [START_REF] Bas | Break our watermarking system[END_REF].

Distortion

We have implemented the four modulations on the image database, and the distortion is computed on average on the marked contents. However, the quantization that consists of writing the marked image on 8 bpp causes a negligible variation on the target distortion.

Table 1 shows results obtained by implementation on the image database by setting a distortion equal to 45 dB. 3). PSNR is 30 dB. Modulation: CW Robust-NW modulation is the one which exceeds the target distortion with the higher standard deviation. Because of the correct quality of embedding (45 dB), the visual distortion is negligible.

We have applied the previous psychovisual masking on CW modulation. Figure 3 shows an example of a picture marked with constant strength embedding (Eq. 25) and variable strength embedding (Eq. 26) with E[PSNR] = 30 dB (in order to highlight the differences between the two approaches). Figure 4 shows zooms on the upper-right corners of the pictures of Fig. 3.

Robustness assessment

We have tested the robustness of the four modulations against JPEG compression, a very frequent attack on images, see Fig. 5. For each image, we embed a random message in it, we compress it, and we measure the BER. We measure BER on average with relation to JPEG quality factor on 2,000 marked images.

Figure 5 depicts the superior robustness of SS and ISS modulations against robust-NW and CW modulations: this is not surprising since the former do not have any security constraint to meet. In fact, there is a

Y = X + W = X + US, (28) with:
-

Y ∈ M N v ,N o (R) watermarked signals -X ∈ M N v ,N o (R) host signals -W ∈ M N v ,N o (R) watermark signals -U ∈ M N v ,N c (R) carriers -S ∈ M N c ,N o (R) modulations of embedded messages
The problem of disclosing U and S is a blind source separation (BSS) problem, where Y represents the observations, X stands for a matrix representing noise, U represents the mixing matrix, and S represents the sources. ICA [START_REF] Hyvärinen | Independent component analysis[END_REF] performs BSS when modulations are independently drawn. We assume the following hypothesis: the information bits that are embedded in the images are independently drawn.

Principal component analysis

Principal component analysis deals with subspace security. It allows for an adversary to estimate the N cdimensional private subspace spanned by the carriers U (the private key), if the embedding alters the covariance matrix of the contents. Principal component analysis (PCA) is a technique used to reduce multidimensional data sets to lower dimensions for analysis. It involves the calculation of the eigenvalues of the covariance matrix of Y (taken column-wise). PCA has the distinction of being the optimal linear transformation that keeps the subspace with the largest variance (message embedding increases the variance of the signal in the directions of the carriers). The knowledge of this subspace for an adversary allows him/her to tamper with the hidden channel at minimum distortion.

Independent component analysis

In the context of SS embedding, ICA enables to establish whether a scheme is key-secure or insecure. It allows, after PCA, for an estimation of the carriers U when modulations are independently drawn and are not Gaussian. Note that the first assumption is relevant for SS and ISS in the case of WOA attack because the messages are supposed to be independent. ICA finds independent components by maximizing the statistical independence of the estimated components. However, ICA has three limitations:

-It can only estimate the carriers up to their sign. Gaussian distributed or dependent.

Security classes of spread-spectrum modulations

We use the assumption that host vectors are Gaussiandistributed. Since it is possible estimate the carriers u i [START_REF] Cayre | Watermarking attack: security of wss techniques[END_REF] for SS and ISS the WOA setup, these modulations are insecure. CW only allows for estimation of the private span(u i ). The circularity of the distribution allows to say that, for a subset of keys (all bases of span({u i })), the distribution of marked signals will be identical (CW belongs to the so-called key-secure security class). NW modulation can theoretically be used for steganography. In fact, we have D KL (p(x) p(y)) = 0, where D KL denotes the Kullback-Leibler divergence. With this hypothesis, one cannot decide whether a content is marked or not. In the case of NW on a circular (cf Eq. 21) pdf for the host feature vector, things go differently, depending on η, N c , and N v :

-If N c = N v :

-If η = 1, then NW is stego-secure, -If N c < N v :

-If η = 1, then NW is subspace-secure, -If η > 1, then NW is key-secure.

5.3 Assessment of key security

Comparison of distributions of original and watermarked contents

Figure 6 represents the distribution of the host contents in the secret subspace spanned by the carriers. As expected, this distribution is asymptotically Gaussian. We further show the distributions of these contents after embedding using SS, ISS, CW, and robust-NW.

Figure 7 shows, respectively, SS and ISS distributions on two carriers. We can see the presence of four clusters (i.e., a constellation in classical communications), which correspond to the four possible messages with N c = 2: (0, 0), (0, 1), (1, 0) and (1, 1). As expected, ISS modulation decreases the variance of the correlations in order to improve robustness. By PCA, the adversary can find the private subspace spanned by the carriers; by ICA, he/she can locate codewords. These schemes are insecure.

Figure 8 shows robust-NW distribution and Fig. 9 shows CW distribution on two carriers. These distributions are circular, and we can conclude that, for all bases ( û0 , û1 ) of span(u 0 , u 1 ), the distribution p(y 1 , ..., y N o | û0 , û1 ) will be identical (i.e., rotations of the secret subspace). It is consistent with the definition of circularity and, consequently, these schemes are keysecure, so that the adversary can access the subspace of the codewords but has no information about the decoding regions. Figure 10 shows CW correlations with variable strength embedding. As can be seen, the variance of the correlations is stronger than with constant strength embedding. However, it does not impair security: N cdimensional private subspace can still be found but codeword locations are kept unknown to an adversary.

Carriers estimation

In the WOA framework, the adversary has no access to the embedded messages. He/she can only assume that the messages are independently drawn. Moreover, we have seen in Section 5.1 that source separation techniques have limitations: they can only recover the carriers up to the sign and they cannot recover the order of the carriers. According to Kerckhoffs' principle, the adversary has access to the source code of the watermarking scheme. He/she can, therefore, estimate the projections of several marked contents in the N v -dimensional space. Because of ICA limitations, we have to construct the following score S, obtained by the adversary, in order to quantify accuracy of the carrier estimation:

S = 1 N c i max 1 j |z(u j , ûi )| -max 2 j |z(u j , ûi )| , (29)
where ûi are the carriers estimated by ICA [START_REF] Hyvarinen | Fast and robust fixed-point algorithm for independent component analysis[END_REF], and max 1,resp. 2 is the first (resp. second) maximum of the absolute value of the normalized correlation z between each correct carrier u i and each estimated carrier û j . This process was already successfully used [START_REF] Bas | Practical security analysis of dirty paper trellis watermarking[END_REF].

Because u i = j represents a basis of the secret N cdimensional space, we can conclude that a correct estimation of the carriers will produce a score S close to one when the number of contents that the adversary has access to is large enough. On the contrary, a wrong carrier estimation will produce a score S that will be close to zero or, equivalently, that will never converge. On Fig. 11, it is clear that the scores obtained by an adversary for the four modulations further illustrate the difference between embedding security classes: robust-NW and CW do not allow for a correct estimation of the carriers. Moreover, the score for these secure modulations does not depend on the number of observed contents.

5.4 Towards subspace-secure, spread-spectrum-based schemes

Robustness constraint for natural watermarking

Since NW provides subspace security, we also tried to provide an implementation of this method for digital images. However, we have seen in Section 4.3 that NW modulation cannot be applied directly because of the weakness of the modulation on high-pass wavelet coefficients when η = 1. To circumvent this problem, we propose the new following parameters of the experimental watermarking scheme:

-We use four levels for wavelet decomposition.

-We arrange the subbands HL4 and LH4 of the host image in the vector x t . -N t = 2,048.

With these parameters, we obtain an average PSNR between host and marked images, which equals 46.7 dB. Here, we consider an average of the distortions in order to avoid to average infinite values when no modification of the host is needed during the embedding. Note that NW produces variable strength embedding and the PSNR is not fixed for each image. Although this scheme is not very robust, the main goal of this section is to illustrate the subspace-security property of NW (since we have N c = N v ). We use PCA to estimate the subspace spanned by the carriers and we compare the results with CW (which does not allow for subspace security).

Comparison of NW and CW under a tampering attack

We have implemented NW on the image database. Figure 12 shows, respectively, host-and NW-marked distributions on two carriers. As can be seen, the distribution of correlations after NW is the same as the distribution of host correlations up to the variance, so that it is consistent with the definition of subspace security.

To assess the security of implementations of NW and CW, we propose a watermark tampering attack based on PCA, which aims at tampering the embedded message by putting the whole attack power into the estimated subspace. If an adversary can construct a basis of this subspace, he/she can make embedded messages unreadable. More precisely, the adversary recovers a basis with a PCA: { û j } j=0,...,N c -1 of the subspace defined by the carriers {u i } i=0,...,N c -1 . For each marked signal y, the adversary constructs the attacked signal r:

r = y - N c -1 j=0 y| û j û j | û j û j . (30)
The tampering process tends to remove the components of y that are collinear with each estimated carrier û j in order to make the decoded bit random during the actual decoding step.

We have implemented this attack with NW and CW modulations on the 2,000 images. Results are shown in Table 2. In the case of CW, after attack, the distortion is correct and only 71% of the bits are correctly read. Therefore, we have verified that CW does not allow for subspace security. For NW, the attack is not efficient since 94% of the bits are decoded. In this case, the attack behaves as a classical AWGN attack. In fact, PCA on NW returns random mixing matrix (carriers) and sources (modulations). In accordance with theoretical approaches, subspace security of NW is verified.

Conclusions and perspectives

This paper presents a comparison between secure and insecure SS watermarking schemes for digital images that are either key-secure or subspace-secure; such schemes significantly differ from the classical modulations SS and ISS, which are insecure. We have shown that the implementations of the theoretical robust-NW and CW modulations on still images are possible considering robustness, security, and distortion constraints. Moreover, they provide a security level that is satisfactory for sensible applications.

One important conclusion is the fact that the security constraint has an impact on both the robustness and the induced distortion of the whole scheme. Parallel works show that it is possible to optimize the embedded distortion while guaranteeing security [17], and future works will focus on the joint optimization of security, robustness, and distortion. Other open research lines include the design of truly stego-secure schemes and the study of a scheme that does not need the trick we presented to obtain Gaussian-distributed host feature vectors.

Fig. 1

 1 Fig. 1 Distributions of the correlations of the host signals (a) and of the marked signals (b, c, d, e) over the carriers. These distributions have been generated with 2,000 host Gaussian signals, N v = 256, N c = 2, WCR = -20 dB

Fig. 2

 2 Fig. 2 Experimental watermarking scheme

Fig. 3

 3 Fig. 3 Comparison between constant (top) and variable (bottom) strength embedding. PSNR is 30 dB. Modulation: CW

Fig. 4

 4 Fig.[START_REF] Cayre | Kerckhoffs-based embedding security classes for woa data hiding[END_REF] Comparison between constant (top) and variable (bottom) strength embedding (zoom on the upper-right corner of Fig.3). PSNR is 30 dB. Modulation: CW

Fig. 5

 5 Fig. 5 Robustness of the four proposed modulations against JPEG compression. For each modulation, the legend includes the standard deviation of the experiments

Fig. 6 Fig. 7 -

 67 Fig. 6 Distribution of the projections of the host signals over two carriers

Fig. 8

 8 Fig. 8 Distribution of the projection of the marked signals for robust-NW over two carriers

Fig. 9 2 Fig. 10

 9210 Fig. 9 Distribution of the projection of the marked signals over two carriers for CW, N c = 2

Fig. 11 Fig. 12

 1112 Fig. 11 Carrier estimation for the four modulations with relation to the number of observed marked contents. We apply ICA on marked signals (N v by N o matrix) to obtain the estimated carriers û j . Next, we compute the score S according to Eq. 29. A score S close to one is equivalent to a correct estimation. Note that we just add columns to the matrix of marked signals when N o grows up

Table 1

 1 Distortion caused by message embedding

	Modulation	E[PSNR](dB)	σ PSNR (dB)
	SS	44.75	1.2e-1
	ISS	44.75	2.15e-1
	Robust-NW	45.18	1.9e0
	CW	44.76	2.16e-1
	Target PSNR is 45 dB

Table 2

 2

	Tampering attack for NW and CW	Before attack E(PSNR) original/marked	BER	After attack E(PSNR) marked/attacked	BER
	NW	46.74	0.01	45.91	0.06
	CW	46.65	0.04	45.55	0.29

Acknowledgements Benjamin Mathon, Francois Cayre, and Patrick Bas are partly supported by the European Commission through the National French projects Nebbiano ANR-06-SETIN-009, ANR-05-RIAM-01903 Estivale, and ARA TSAR. Moreover, Benjamin Mathon is partly supported by BCRYPT project, a Belgian Interuniversity Attraction Pole IAP-VI fund program. We also would like to thank the reviewers for their insightful and suggestive comments on this article.

Appendix A: Distortion specifications

We want to link the target PSNR for embedding with the theoretical WCR, used in the formulae of the four modulations. We give proofs of Eqs. 23 and 27.

A.1 Constant strength embedding

The first point is that, thanks to the nice normalization of retroprojection (Eq. 24), distortion stays constant in the wavelet domain and in the projected space:

With renormalization against space dimensions, one gets:

So, we obtain:

Mean square error in the spatial domain is:

therefore, PSNR equals:

From the previous equation, one gets:

which gives, once plugged into Eq. 3, WCR = 10 log 10 255 2

A.2 Variable strength embedding From [START_REF] Piva | DCT-based watermark recovering without resorting to the uncorrupted original image[END_REF], watermark signal varies with the absolute value of the current wavelet coefficient we want to watermark, assuming that x t (i) is independent from w t (i). We have:

Equation 34 becomes:

The same lines as above lead to the final equation for variable strength embedding: WCR = 10 log 10 255 2

(43)