Simultaneous EEG-fNIRS to explore sensory prediction as a screening tool for neurodevelopmental disorders Marais, A-L. 1 *, Dumont, V. 1 , Anquetil, M. 2 , Roche-Labarbe, N. 1 * anne-lise.marais@unicaen.fr

• Predictive coding proposes that the brain is inherently predictive about the environment [START_REF] Friston | A theory of cortical responses[END_REF] • Predictive coding is associated with two related mechanisms :

• repetition suppression, the decrease of cerebral activity when a stable representation of a repeated stimulation is formed • sensory prediction, the neural anticipation of future stimulation on the basis of previous sensory inputs

• Predictions are necessary to optimize behavioral responses and the use of attentional and energy resources

• Sensory prediction and repetition suppression can be altered in prematurity and neurodevelopmental disorders (NDD) like attention deficit disorders [START_REF] Emberson | Deficits in Top-Down Sensory Prediction in Infants At Risk due to Premature Birth[END_REF][START_REF] Gonzalez-Gadea | Predictive coding in autism spectrum disorder and attention deficit hyperactivity disorder[END_REF] • The rate of disorders among children born premature is twice higher for any psychiatric disorders including NDD [START_REF] Johnson | Preterm Birth and Childhood Psychiatric Disorders[END_REF] • Predictive abilities were recently described in preterm infants in the tactile modality [START_REF] Dumont | Prediction of tactile stimuli in the premature newborn brain[END_REF] • Predictive abilities could be early markers of NDD Investigate somatosensory prediction and repetition suppression from birth to 6 years old in both neurotypical and neuroatypical children.

Hypothesis

We hypothesize that neurotypical children will have a larger repetition suppression, response to deviance and sensory prediction in the somatosensory and frontal cortices compared to children born preterm or children with NDD.

We hypothesize that these neuroimaging results will match with the cognitive, motor and behavioral evaluations and that children born preterm or children with NDD will have poorer results.

Why the tactile modality ?

• The earliest sensory modality to develop during ontogeny • A fundamental sensory input in newborns for motor and social development [START_REF] Cascio | Somatosensory processing in neurodevelopmental disorders[END_REF] • Is often altered in both prematurity and NDD [START_REF] Bröring | Sensory modulation in preterm children : Theoretical perspective and systematic review[END_REF][START_REF] Zoenen | Treatment of sensory information in neurodevelopmental disorders[END_REF] Why HR-EEG and fNIRS ?

• HR-EEG offers a great temporal resolution and measures direct neuronal synchronization • fNIRS measures hemodynamic changes induced by neurovascular coupling • Coupling EEG and fNIRS allows us to evaluate the techniques consistency and determine if one is reliable for screening purposes.

Preliminary observations :

• Repeated stimulations elicit weaker event-related activity in both EEG and fNIRS : we observe repetition suppression in adults with this protocol.

• Omission elicits a frontal hemodynamic response and a somatosensory post-omission response in EEG

• Responses are dissociated in location : somatosensory area for the EEG and frontal area for the fNIRS

• EEG might be more relevant for the study of response to deviance.

Conclusion :

The aim of this study is to investigate early mechanisms necessary for the development, sensory prediction and repetition suppression, using the tactile modality in children from birth to 6 years old to understand early developmental trajectories of children born preterm and children with NDD.

• Homer 3 (https://github.com/BUNPC/Homer3) is used to preprocess the data.

After converting the data to hemoglobin concentration, they are bandpass filtered (0.02-0,3 Hz) and segmented per condition. Segments containing movements artifacts are discard. Data are block-averaged to obtain the mean responses per condition.

• 128 channels EEG (Magstim EGI, Eugene OR, USA), sampling rate : 1000 Hz

Somatosensory deviance Frontal omission Frontal repetition suppression

  • 8 channels fNIRS (Imagent, ISS, Champaign IL, USA), sampling rate : 12.5 Hz Population Oddball-omission protocol Newborn-size matrix and children-size matrix A 12 months old child wearing the EEG net EEG and fNIRS acquisition 1 Normandie Univ, UNICAEN, INSERM, COMETE, GIP CYCERON, 14000 Caen, France; 2 Normandie Univ, UNICAEN, LPCN, 14000 Caen, France. , data are bandpass-filtered (1-20 Hz) and segmented (100 ms before to 900 ms after stimulation and 7000 ms for the omissions). Segments are visually inspected to remove artifacts before averaging. We apply baseline correction to all the segments at 100ms before stimulus onset. Tha data are averaged and analized with MATLAB. Participants' characteristics • We evaluated the quality of our protocol during a pretest on 5 adults • We recorderd simultaneous EEG and fNIRS • Event-related analysis EEG net and fNIRS placed on a preterm doll head A 5 years old child ready to get the tactile protocol A child taking the psychomotor evaluation EEG pretest results fNIRS pretest results

A. The amplitude of the electrical response is weaker during the control phase compared to the familiarization for the N140 and the P200 in the somatosensory cortex.

B. The amplitude of the electrical response during the postomission is greater at P200 in the somatosensory cortex. C. The amplitude of the electrical response is greater at P100, N140 and P200 during the deviance in the somatosensory cortex. D. There is an weaker increase of HbO and decrease of HbR during the control phase compare to the familiarization in the frontal cortex. E. There is an increase of HbR and a decrease of HbO during the omission in the frontal cortex.


Ana Neacs

Jean-Christophe Pesquet

Corneliu Burileanu

EMG-Based Automatic Gesture Recognition Using Robust Neural Networks (Extended version)

Keywords: Recognition, Machine Learning, Perturbations, Stability, Lipschitz regularity, Optimization, EMG

This paper introduces a novel approach for building a robust Automatic Gesture Recognition system based on Surface Electromyographic (sEMG) signals, acquired at the forearm level. Our main contribution is to propose new constrained learning strategies that ensure robustness against adversarial perturbations by controlling the Lipschitz constant of the classifier. We focus on positive neural networks for which accurate Lipschitz bounds can be derived, and we propose different spectral norm constraints offering robustness guarantees from a theoretical viewpoint. Experimental results on two distinct datasets highlight that a good trade-off in terms of accuracy and performance is achieved. We then demonstrate the robustness of our models, compared to standard trained classifiers in three scenarios, considering both white-box and black-box attacks.

Introduction

In recent years, the concept of human-computer interaction (HCI) has been at the core of many scientific and sociological developments. Combined with the power of machine learning algorithms, it has led to some of the most outstanding achievements in nowadays technology which are used successfully in an ever-increasing number of areas impacting our lives, e.g. medicine [START_REF] He | The practical implementation of artificial intelligence technologies in medicine[END_REF], autonomous driving [START_REF] Li | Stereo R-CNN based 3D object detection for autonomous driving[END_REF], natural language processing [START_REF] Widiastuti | Convolution neural network for text mining and natural language processing[END_REF], etc. Researchers all around the world focus on providing new intuitive and accurate ways of interacting with devices around, based on gesture, voice, or vision analysis [START_REF] Kurakin | A real time system for dynamic hand gesture recognition with a depth sensor[END_REF].

Gestures constitute a universal and intuitive way of communication, with the potential of bringing the Internet of Things (IoT) experience to a different, more organic level [START_REF] Qi | Intelligent human-computer interaction based on surface EMG gesture recognition[END_REF]. Automatic gesture recognition (AGR) algorithms can be successfully used in various applications, from sign language recognition (SLR) [START_REF] Cheok | A review of hand gesture and sign language recognition techniques[END_REF] to VR games [START_REF] Wen | Machine learning glove using self-powered conductive superhydrophobic triboelectric textile for gesture recognition in VR/AR applications[END_REF].

Various solutions for AGRs based on image or video stream analysis, leveraging on computer vision algorithms have been proposed; see for example [START_REF] Gao | Automatic gesture recognition in robot-assisted surgery with reinforcement learning and tree search[END_REF][START_REF] Kopuklu | Motion fused frames: Data level fusion strategy for hand gesture recognition[END_REF][START_REF] Darrell | Task-specific gesture analysis in real-time using interpolated views[END_REF]. A multi-stream solution for dynamic hand-gesture recognition is described in [START_REF] Yang | Dynamic gesture recognition using surface EMG signals based on multi-stream residual network[END_REF]. Multi-modal approaches for gesture classification have been also studied [START_REF] Neverova | Moddrop: adaptive multi-modal gesture recognition[END_REF]. A novel method showing a fully neurmorphic implementation [START_REF] Ceolini | Hand-gesture recognition based on EMG and event-based camera sensor fusion: A benchmark in neuromorphic computing[END_REF] achieves good results (96% accuracy while reducing the inference time by 30%). Although a good performance is achieved on synthetic data, in real-life scenarios these systems may be sensitive to environmental conditions, e.g. light conditions, background, etc. Additionally, these systems are often computationally demanding and consequently not always suited for real-time applications. Accelerometers and electromyography (EMG) sensors provide an alternative low-cost technology for gesture sensing [START_REF] Jiang | Multi-category gesture recognition modeling based on sEMG and IMU signals[END_REF]. sEMG stands for surface electromyography and represents the electrical manifestation of the neuromuscular activation related to the contraction of the muscles [START_REF] Atzori | Electromyography data for non-invasive naturally-controlled robotic hand prostheses[END_REF]. In [START_REF] Peng | Gesture recognition by ensemble extreme learning machine based on surface electromyography signals[END_REF] the authors propose a method combining feature selection with ensamble learning, achieving around 78% classification accuracy for 52 gestures.

The applications of sEMG-based classification systems are focused on, but not limited to, assertive devices and rehabilitation or postural control therapy for physically impaired persons [START_REF] Khushaba | Electromyogram (EMG) feature reduction using mutual components analysis for multifunction prosthetic fingers control[END_REF]. With the continuous development of more versatile signal processing techniques, the applications of EMG signal classification expanded to a wide range of domains including augmented reality, gaming industry, military applications, etc. [START_REF] Kim | EMG-based hand gesture recognition for realtime biosignal interfacing[END_REF][START_REF] Orjuela-Cañón | Deep neural network for EMG signal classification of wrist position: Preliminary results[END_REF].

Two critical issues need to be addressed when developing AGR algorithms: fast enough inference to ensure real-time feeling for the end-user, and accurate and robust classification to guarantee that the gesture is correctly identified no matter the environmental conditions. Machine learning methods have become ubiquitous tools in a wide range of tasks including AGR, on account of their ability to solve a great variety of problems, from simple regressions to complex multi-modal classification.

However, deep neural networks, which are probably the most powerful methods, may appear as black boxes whose robustness is not always wellcontrolled. For real-life applications, it is mandatory to guarantee the reliability of such techniques. Nowadays, the main difficulty to overcome consists in developing high-performance systems that are also trustable and safe. An additional challenge is to avoid implementation heaviness during the learning phase.

In [START_REF] Szegedy | Intriguing properties of neural networks[END_REF], the authors showed that slightly altering data inputs that were correctly classified by the network can lead to a wrong classification [START_REF] Kurakin | Adversarial machine learning at scale[END_REF][START_REF] Carlini | Hidden voice commands[END_REF][START_REF] Takeru | Spectral normalization for generative adversarial networks[END_REF]. This finding was at the origin of the concept of adversarial inputs, which constitute malicious input data that can deceive machine learning models. For example, [START_REF] Carlini | Hidden voice commands[END_REF] shows how voice interfaces can be fooled by creating carefully crafted artificial audio inputs of unintelligible voice that are miss-classified as specific vocal commands by the system. Also, [START_REF] Goodfellow | Explaining and harnessing adversarial examples[END_REF] introduces several methods for generating adversarial examples on ImageNet that are so close to the original data that differences are indistinguishable for the human eye.

It must be emphasized that adversarial inputs are not necessarily artificially created with the intention to sabotage the system. As other physiological signals, e.g. EEG or EKG, EMG signals have low frequency components (usually between 10 -150Hz), and low amplitudes (≤ 10 mV Peak to Peak). This makes them very sensitive to noise and outside perturbations that can occur innately, under the form of noise stemming from acquisition devices, imperfect sensor contact, etc. Those can seriously flaw the performance of real-life applications based on pre-trained models [START_REF] Neacşu | Accuracy-robustness trade-off for positively weighted neural networks[END_REF]. An empirical way of training more robust AGR systems is detailed in [START_REF] Fatayer | sEMG-based gesture recognition using deep learning from noisy labels[END_REF], where a strategy of training using noisy labels is proposed.

As highlighted in [START_REF] Goodfellow | Explaining and harnessing adversarial examples[END_REF], the Lipschitz behaviour of the network is tightly correlated with its robustness against adversarial attacks. The Lipschitz constant allows to upper bound the output perturbation knowing the magnitude of the input one, for a given metric [START_REF] Scaman | Lipschitz regularity of deep neural networks: analysis and efficient estimation[END_REF]. Controlling this constant thus represents a feasible solution to limit the effect of adversarial attacks. Computing the exact Lipschitz constant of a neural network is however a very complex problem, so the main challenge is to find clever ways to approximate this constant effectively.

Recently, several techniques to ensure the Lipschitz stability of neural networks have been explored. For example, [START_REF] Takeru | Spectral normalization for generative adversarial networks[END_REF] proposes a novel weight spectral normalization technique applied to stabilize the training of the discriminator in Generative Adversarial Networks (GANs). The Lipschitz constant of the network is viewed as a hyper-parameter that can be tuned in the training process of the image generation task. Doing so leads to a model with improved generalization capabilities. In [START_REF] Anil | Sorting out Lipschitz function approximation[END_REF] norm-constraint GroupSort based architectures are proposed and it is shown that they can be used as universal Lipschitz function approximators. The authors apply gradient norm preservation to create Lipschitzian networks that offer adversarial robustness guarantees. In [START_REF] Cisse | Parseval networks: Improving robustness to adversarial examples[END_REF] the authors introduce Parseval networks, another approach for designing networks which are intrinsically robust to adversarial noise, by imposing the Lipschitz constant of each layer of the system to be less than 1. In [START_REF] Fazlyab | Efficient and accurate estimation of lipschitz constants for deep neural networks[END_REF] a convex optimization framework is introduced to compute tight upper bounds for the Lipschitz constant of Deep Neural Networks (DNNs).

They make use of the observation that commonly used activation operators are gradients of convex functions. Semi-definite programming approaches to ensure robustness are also explored in [START_REF] Pauli | Training robust neural networks using Lipschitz bounds[END_REF].

The main contributions of this paper are:

• To propose a robust real-time Automatic Gesture Recognition system based on sEMG signals. The robustness is ensured by using a novel learning algorithm for training feedforward neural networks.

• To show that a good accuracy-robustness balance can be reached. To do so, we train the system under carefully crafted spectral norm constraints, allowing us to finely control its Lipschitz constant. A tight Lipschitz constant is efficiently estimated by focusing on neural networks with positive weights as in [START_REF] Chorowski | Learning understandable neural networks with nonnegative weight constraints[END_REF].

• To demonstrate the performance of the final architecture in real-life ex-periments where we show that the proposed robust model outperforms those trained conventionally.

• To analyze how our system behaves when the input is affected by different noise levels, simulating perturbations that may occur in real scenarios.

• To show the validity of our solution by experimenting on two distinct publicly available sEMG gestures datasets.

The rest of the paper is structured as follows. The theoretical background of our work is detailed in Section 2. In Section 3, we present the proposed optimization algorithm and we investigate the way of dealing with the constraints. The application and the results are discussed in Section 4, while Section 5 deals with how our model behaves when facing adversarial data.

Finally, Section 6 contains some concluding remarks.

Robustness solutions in the context of nonnegative neural networks

Problem formulation

Any feedforward neural network is obtained by cascading m layers associated with operators (T i ) 1≤i≤m . The neural network can thus be expressed as the following composition of operators:

T = T m • • • • • T 1 . (1)
Each layer i ∈ {1, . . . , m} has a real-valued vector input x i of dimension N i-1 which is mapped to where Softmax). Figure 1 shows a graphical representation of this concept.

T i (x i ) = R i (W i x i + b i ), (2)
W i ∈ R N i ×N i-1 , b i ∈ R N i are
Even though the choice of the activation R i may differ depending on the task at hand, it has been shown in [START_REF] Combettes | Lipschitz certificates for layered network structures driven by averaged activation operators[END_REF][START_REF] Combettes | Deep neural network structures solving variational inequalities[END_REF] that most of them are actually α iaveraged operators with

α i ∈]0, 1]. Recall that R i is an α i -averaged operator if, for every pair (x i , y i ) ∈ (R N i ) 2
, the following inequality holds:

∥R i (x i ) -R i (y i ) -(1 -α i )(x i -y i )∥ ≤ α i ∥x i -y i ∥. (3)
When α i = 1/2, R i is said to be firmly nonexpansive. For standard choices of activation operators, R i is firmly nonexpansive since it is the proximity operator of a proper, lower-semicontinous function (see [START_REF] Combettes | Deep neural network structures solving variational inequalities[END_REF] for more details).

Note that, in [START_REF] Fazlyab | Efficient and accurate estimation of lipschitz constants for deep neural networks[END_REF], it is assumed that R i operates component-wise and is slopebounded. The authors emphasize that the most common case corresponds to lower and upper slope values equal to 0 and 1, respectively. It follows from [START_REF] Combettes | Proximal thresholding algorithm for minimization over orthonormal bases[END_REF]Proposition 2.4] that a function satisfies this property if and only if it is the proximity operator of some proper lower-semicontinuous convex function, so that similar assumptions to those made in [START_REF] Combettes | Deep neural network structures solving variational inequalities[END_REF] are recovered.

As explained in [START_REF] Combettes | Lipschitz certificates for layered network structures driven by averaged activation operators[END_REF], examples of activation operators R i which are α iaveraged with α i > 1/2 can be encountered. They basically correspond to over-relaxations of firmly nonexpansive operator. An example of such operators is the Swish activation function [START_REF] Ramachandran | Searching for activation functions[END_REF]. Another famous example is the group-sort operator:

∀x i =      x i,1 . . . x i,M      ∈ R N i R i (x i ) =      x ↑ i,1 . . . x ↑ i,M      , (4)
where the vector x i has been decomposed in M subvectors x i,j with j ∈ {1, . . . , M }, of dimension B (N i = BM ) and x ↑ i,j designates the vector of components of x i,j sorted in ascending order. R i is then purely nonexpansive, i.e. α i = 1. Note that max-pooling can be achieved by composing this group sort operation with a linear operator. Indeed, if i < m, M = N i+1 , and W i+1 is the matrix extracted from the N i × N i identity matrix Id N i by selecting the matrix rows with indices multiple of B, then W i+1 • R i corresponds to a max-pooling.

Lipschitz robustness certificate

Consider a neural network T as described in Fig. 1. let x ∈ R N 0 be the input of the network and let T (x) ∈ R Nm be its associated output. By adding some small perturbation z ∈ R 0 to the input, the perturbed input is x = x + z. The effect of the perturbation on the output of the system can be quantified by the following inequality:

∥T (x) -T (x)∥ ≤ θ m ∥z∥, (5)
where θ m ≥ 0 denotes a Lipschitz constant of the network. θ m represents thus an important parameter that allows us to assess and control the sensitivity of a neural network to various perturbations. It needs however to be accurately estimated to provide valuable information. A standard approximation to the Lipschitz constant [START_REF] Goodfellow | Explaining and harnessing adversarial examples[END_REF] is given by

θ m = m i=1 ∥W i ∥ S , (6)
where ∥ • ∥ S denotes the spectral norm of a matrix. Although simple to compute, this approximate bound is over-pessimistic. Different methods for obtaining tighter estimates of the Lipschitz constant have been presented in the recent literature; see for example [START_REF] Scaman | Lipschitz regularity of deep neural networks: analysis and efficient estimation[END_REF][START_REF] Combettes | Lipschitz certificates for layered network structures driven by averaged activation operators[END_REF][START_REF] Fazlyab | Efficient and accurate estimation of lipschitz constants for deep neural networks[END_REF][START_REF] Latorre | Lipschitz constant estimation of neural networks via sparse polynomial optimization[END_REF][START_REF] Chen | Semialgebraic optimization for Lipschitz constants of ReLU networks[END_REF]. Local estimates of the Lipschitz constant can also be performed which may appear more relevant. But they are more complex to compute and, as we will see, controlling the global Lipschitz constant is usually sufficient to get a good performance. Estimating the global Lispchitz constant of the network is an NP (non-deterministic polynomial-time)-hard problem [START_REF] Scaman | Lipschitz regularity of deep neural networks: analysis and efficient estimation[END_REF]. Although there exist efficient approaches to approximate an accurate bound [START_REF] Fazlyab | Efficient and accurate estimation of lipschitz constants for deep neural networks[END_REF][START_REF] Latorre | Lipschitz constant estimation of neural networks via sparse polynomial optimization[END_REF][START_REF] Chen | Semialgebraic optimization for Lipschitz constants of ReLU networks[END_REF],

computing these estimates may be expensive for wide or deep networks. In addition, using these bounds within a training procedure is a difficult task [START_REF] Pauli | Training robust neural networks using Lipschitz bounds[END_REF]. In this work, we will make the following assumption.

Assumption 2.1 Let a neural network be given by [START_REF] He | The practical implementation of artificial intelligence technologies in medicine[END_REF] where the i-th layer with i ∈ {1, . . . , m} is given by (2). We assume that (i) all the activation layers, except possibly the last one, consist of separable averaged operators, that is, for every i ∈ {1, . . . , m -1}, there exist averaged functions (ρ i,k

) 1≤k≤N i from R to R such that R i : (ξ i,k ) 1≤k≤N i → ρ i,k (ξ i,k ) 1≤i≤k ;
(ii) at the last activation layer, R m is an averaged operator.

Our approach will be grounded on the following result.

Proposition 2.2 [START_REF] Combettes | Lipschitz certificates for layered network structures driven by averaged activation operators[END_REF] Suppose that Assumption 2.1 holds. For every i ∈ {1, . . . , m}, let A i be the matrix whose elements are the absolute values of those of W i . Then,

ϑ m = ∥A m • • • A 1 ∥ S ( 7
)
is a Lipschitz constant of T . In addition

∥W m • • • W 1 ∥ ≤ ϑ m . (8)
In particular if, for every i ∈ {1, . . . , m},

W i ∈ [0, +∞[ N i ×N i-1 , ϑ m is equal
to the lower bound in [START_REF] Gao | Automatic gesture recognition in robot-assisted surgery with reinforcement learning and tree search[END_REF].

Based on this proposition, the best estimate for the Lipschitz constant of a given feedforward neural network having nonnegative weights simplifies to the spectral norm of the product of all the weight matrices composing the network. More precisely, the obtained Lipschitz constant

ϑ m = ∥W m • • • W 1 ∥ S
is the Lipschitz constant of a purely linear network, where all the non-linear activation operators have been replaced with the identity operator.

The above result is guaranteed to be valid only in the case when all the weights are nonnegative. In the general case of networks with weights having arbitrary signs, it can be proved that

∥W m • • • W 1 ∥ S represents only
a lower bound of the Lipschitz constant established in [START_REF] Combettes | Lipschitz certificates for layered network structures driven by averaged activation operators[END_REF]. It is also worth mentioning that the proposed results hold for any algebraic structure of the weight matrices (W i ) 1≤i≤m .

Optimization methods for training robust feedforward networks

Stochastic gradient descent -projected variant

Standard training in neural networks consists in the minimization of a nonconvex cost function with respect to the model parameters by means of an iterative strategy. Let L be the cost function defined as follows:

L(η) = K k=1 ℓ(z k , η), (9)
where η = (η i ) 1≤i≤m is a vector encompassing all the model parameters. For each layer i ∈ {1, . . . , m}, η i denotes a vector of dimension N i (N i-1 + 1) that contains the scalar variables associated with the weight matrices W i and the corresponding bias components b i . The data information is represented by

(z k ) 1≤k≤K .
For every k ∈ {1, . . . , K}, z k is a pair consisting of an input of the system and the associated desired output (ground truth). Also, ℓ represents the loss function assumed to be differentiable (almost everywhere)

with respect to η.

To ensure robustness, we shall impose spectral norm constraints on the weight matrices. In other words, the vector of parameters η is constrained to belong to a closed set S that will be described in the next section. We propose to use an extension of a standard optimization techniques for training neural networks [START_REF] Combettes | Fixed point strategies in data science[END_REF]. More specifically, we will implement a projected stochastic gradient algorithm. A momentum parameter is introduced in this algorithm to accelerate the convergence process.

Algorithm 1 describes the iterations performed at each epoch n > 0.

We see that there are two nested loops: the outer loop operates on the batch index q and the second one on the layer index i. In this algorithm,

γ n ∈]0, +∞[ is the learning rate, while ζ n ∈ [0, +∞[ denotes the inertia
parameter for momentum. The algorithm is very similar to block-iterative techniques used in convex optimization [START_REF] Combettes | Fixed point strategies in data science[END_REF]. The parameters of each layer are indeed updated successively by performing a gradient step on the data in the current mini-batch (which can be epoch-dependent). ∇ i represents the gradient, computed by standard backpropagation mechanism, with respect to η i for each i ∈ {1, . . . , m}. This stochastic gradient step is followed by a projection P S i,n onto the constraint set S i,n . The definition of this set as well as the way of handling this projection are detailed in the following.

Algorithm 1: Projected SGD Algorithm Partition {1, . . . , K} into minibatches (L q,n ) 1≤q≤Q foreach q ∈ {1, . . . , Q} do foreach i ∈ {1, . . . , m} do ∆ i,n = (1 + ζ n )η i,n -ζ n η i,n-1 η i,n = [(η ⊤ j,n+1 ) j<i ∆ ⊤ i,n (η ⊤ j,n ) j>i ] ⊤ η i,n+1 = P S i,n ∆ i,n -γ n k∈Lq,n ∇ i ℓ(z k , η i,n ) where S i,n = η i | [(η ⊤ j,n+1 ) j<i η ⊤ i (η ⊤ j,n ) j>i ] ⊤ ∈ S .

Constraint sets

As mentioned before, this work revolves around feed-forward networks with positive weights. Thus, the first condition that we impose is nonnegativity for each layer i ∈ {1, . . . , m}, which is modeled by the constraint set

D i = {W i ∈ R N i ×N i-1 | W i ≥ 0} (10)
Moreover, based on our standing assumptions and Proposition 2.2, we must impose a spectral norm constraint on the weight matrices to control the robustness of the system. This translates mathematically as the following upper bound constraint:

∥W m • • • W 1 ∥ S ≤ ϑ, (11)
where ϑ represents the target maximum Lipschitz constant of the network.

This bound constitutes a direct measure of the system level of robustness against adversarial inputs. We need to handle these two constraints simultaneously during the training process. Imposing nonnegativity is fairly easy since (10) defines a simple convex constraint. By contrast, constraint [START_REF] Yang | Dynamic gesture recognition using surface EMG signals based on multi-stream residual network[END_REF] does not satisfy the convexity property. Since (11) corresponds to a closed set in the underlying space of weight matrices and this set has a nonempty intersection with D 1 ו • •×D m , the projection onto the intersection of the two sets can be defined but it is not guaranteed to be unique. To cirmcumvent this difficulty, it can be noticed that [START_REF] Yang | Dynamic gesture recognition using surface EMG signals based on multi-stream residual network[END_REF] actually defines a multi-convex constraint in the sense that if, for every i ∈ {1, . . . , m}, (W j ) 1≤j≤m,j̸ =i are given, then [START_REF] Yang | Dynamic gesture recognition using surface EMG signals based on multi-stream residual network[END_REF] imposes a convex constraint on W i . This suggests to introduce the following closed and convex set:

C i,n = {W i ∈ R N i ×N i-1 | ∥A i,n W i B i,n ∥ S ≤ ϑ} (12)
in order to control the Lipschitz constant. Hereabove, the matrices A i,n and B i,n represent the product of the weight matrices for the previous and the posterior layers, respectively. By adopting the convention that A i,n = Id if i = m and B i,n = Id if i = 1, we define these matrix products as

A i,n = W m,n • • • W i+1,n , B i,n = W i-1,n+1 • • • W 1,n+1 , (13)
where (W j,n ) 1≤j≤m denote the estimates of the weight matrices at each iteration n, as it appears in Algorithm 1.

Thus, our objective will be to perform the projection onto the set S i,n = D i ∩ C i,n , for each layer i ∈ {1, . . . , m} and at each iteration n. Several algorithms can be envisaged to solve this convex optimization problem.

Before describing our proposed algorithmic solution, let us recall the expressions of the required elementary projections. For every W ∈ R S×T , the

projection of W onto [0, +∞[ S×T is P [0,+∞[ S×T (W ) = ( W s,t ) 1≤s≤S,1≤t≤T , (14)
where, for every s ∈ {1, . . . , S} and t ∈ {1, . . . , T },

W s,t =      W s,t if W s,t ≥ 0 0 otherwise. (15)
Let B(0, ϑ) be the closed spectral ball of center 0 and radius ϑ defined as 1

B(0, ϑ) = {W ∈ R S×T | ∥W ∥ S ≤ ϑ}. ( 16
)
For every W = (W s,t ) 1≤s≤S,1≤t≤T ∈ R S×T , let U ΛV ⊤ be the singular value decomposition of W , where U ∈ R S×R and V ∈ R T ×R are matrices such that

U ⊤ U = Id and V ⊤ V = Id , R = min{S,
P B(0,ϑ) (W ) = U ΛV ⊤ ( 17
)
where Λ = Diag( λ 1 , . . . , λ r ) and

(∀i ∈ {1, . . . , r}) λ i =      λ i if λ i ≤ ϑ ϑ otherwise. ( 18
)
1 To simplify our notation, B(0, ϑ) will designate any spectral ball of this kind whatever the dimensions of the involved matrices.

To compute the projection onto S i,n of a matrix W i ∈ R N i ×N i-1 , we propose to employ the FISTA (Fast Iterative Shrinkage-Thresholding Algorithm) version of a dual forward-backward method in Algorithm 2. This algorithm is based on a dual proximal approach [START_REF] Komodakis | Playing with duality: An overview of recent primal-dual approaches for solving large-scale optimization problems[END_REF] and constitutes an extension of the optimization method originally proposed in [START_REF] Combettes | Dualization of signal recovery problems[END_REF]. The rationale for this algorithm is given in the appendix.

Algorithm 2: FISTA-like accelerated version of DFB algorithm Let Y 0 ∈ R Nm×N 0 Set γ = 1/(∥A i,n ∥ S ∥B i,n ∥ S ) 2 Set α ∈]2, +∞[ for l = 0, 1, . . . do η l = l l+1+α Z l = Y l + η l (Y l -Y l-1 ) V l = P D i (W i -A ⊤ i,n Z l B ⊤ i,n ) Y l = Z l + γA i,n V l B i,n Y l+1 = Y l -γP B(0,ϑ) (γ -1 Y l ) return V l

Handling looser constraints

The Lipchitz constant of the network can be controlled in multiple ways.

Besides the solution formulated in Section 3.2, a more standard approach to control it [START_REF] Szegedy | Intriguing properties of neural networks[END_REF] consists in imposing

m i=1 ∥W i ∥ S ≤ ϑ. ( 19
)
Two strategies have been implemented to enforce this constraint.

(i) The first one consists in imposing a uniform bound on the spectral norm of each weight matrix (W i ) 1≤i≤m , which leads to the following convex constraint sets:

(∀i ∈ {1, . . . , m}) C i = {W i ∈ R N i ×N i-1 | ∥W i ∥ S ≤ ϑ 1/m }. ( 20
)
(ii) The second strategy aims at introducing more flexible bounds on the spectral norms of each layer. It is based on the following choice for the individual convex constraint sets:

(∀n ∈ N \ {0})(∀i ∈ {1, . . . , m}) Či,n = W i ∈ R N i ×N i-1 | ∥W i ∥ S ≤ ∥W i,n ∥ S ϑ m j=1 ∥W j,n ∥ S 1/m .
For every i ∈ {1, . . . , m}, projecting onto C i or Či,n is performed by truncating a singular value decomposition, similarly to the technique described at the end of Section 3.2. The projections onto C i ∩ D i and Či,n ∩ D i can then be computed by using the same iterative method as in Algorithm 2 with

A i,n = B i,n = Id .
In all the proposed constrained optimization methods, the projection P B(0, ϑ) onto a spectral ball with radius ϑ > 0 plays a prominent role. The ball radius depends on the handled constraint [START_REF] Yang | Dynamic gesture recognition using surface EMG signals based on multi-stream residual network[END_REF], [START_REF] Szegedy | Intriguing properties of neural networks[END_REF], or [START_REF] Darrell | Task-specific gesture analysis in real-time using interpolated views[END_REF]. A complex operation such as a singular value decomposition may be very demanding in terms of computational resources when dealing with large size matrices. In that case, we propose to use an approximate projection [START_REF] Takeru | Spectral normalization for generative adversarial networks[END_REF] defined as

(∀W ∈ R S×T ) P B(0, ϑ) (W ) ≃        W if ∥W ∥ S ≤ ϑ ϑ ∥W ∥ S W otherwise. ( 21
)
Figure 2: 13-gestures Dataset [START_REF] Andronache | Towards extending realtime EMG-based gesture recognition system[END_REF] Using this approximation in Algorithm 2 yields approximate projections

( P C i,n ∩D i ) 1≤i≤m,n>0
. Note however that we then lose the theoretical guarantees of convergence Algorithm 2, even if this issue was not observed in our implementation.

An additional advantage of Formula ( 21) is that it allows the nonnegativity of the elements of the input matrix to be kept. This allows us to derive cheap approximate versions of the projection onto C i ∩ D i with i ∈ {1, . . . , m} by first projecting onto D i and then applying the approximate projection onto C i . The resulting approximate projection is denoted by (

P C i ∩D i ) 1≤i≤m .
A similar procedure can be followed to compute approximate projections Each EMG box represents a column vector containing 8 time-descriptors.

( P Či,n ∩D i ) 1≤i≤m,n>0 onto ( Či,n ∩ D i ) 1≤i≤m,n>0 .

AGR Experimental Setup

sEMG datasets

We test our proposed training scheme on three online datasets containing EMG information of different hand gestures. All three were acquired using Myo armband, a device developed by Thalmic Labs, equipped with eight sEMG sensors displayed circularly.

The first dataset, detailed in [START_REF] Côté-Allard | Deep learning for electromyographic hand gesture signal classification using transfer learning[END_REF] contains EMG signals characterizing 7 hand gestures correlated to the primary movements of the hand. There are four mobility gestures (i.e., wrist flexion and extension, ulnar, and radial deviation) and two gestures used for grasping and releasing objects (i.e., spread fingers and close fist). The 7 th gesture characterizes the neutral position, corresponding to the relaxation of the muscles.

The second dataset includes 13 gestures: the same 7 gestures described above, plus 6 additional classes. It contains gestures from 50 different subjects and two sets of trials per user. All 13 gestures are depicted in Figure 2.

More details about the dataset can be found in [START_REF] Andronache | Towards extending realtime EMG-based gesture recognition system[END_REF].

The third dataset is a subset of NinaPro DB5 dataset, detailed in [START_REF] Pizzolato | Comparison of six electromyography acquisition setups on hand movement classification tasks[END_REF].

The dataset is acquired using two Myo armbands, one positioned just below the elbow and the other one closer to the arm. For our experiments, we considered the subset C, which contains sEMG data associated to 24 gestures.

We also validate our models in a real-context scenario. For the reallife predictions, we recorded the EMG activity associated with each gesture at forearm level using Myo armband. The information collected from each channel is transmitted to a computer via Bluetooth protocol where it is processed to extract relevant time domain features that will be used by the classifier to determine which gesture has been performed.

Proposed Architecture

The raw 8 channels EMG signal is split using a 250 ms sliding window, with 50% overlap. From each window of each channel a series of 8 time descriptors are extracted. The information from all the channels is then concatenated, forming a 64-dimensional vector. The 7-gestures dataset contains around 200k vector samples, the 13-gestures dataset has around 59k vector samples, while the 24-gestures dataset has around 20k vector samples. Those are split in training, validation, and test sets at user level according to the ratio: 70%, 20%, 10%. These vectors are fed to the network in mini-batches of size 2048. The considered architectures consists of a 6-hidden layer (m = 6) fully connected neural networks, with different parameters depending on the considered datasets, but the same core structure, as displayed in Figure 3.

Let x = (x k ) 0≤k≤K-1 be the vector of EMG samples acquired on a window from one channel. For this work we considered some of the most relevant features to describe sEMG data, as follows.

(i) Mean Absolute Value (MAV) -the mean of the absolute values of the signal is given by

MAV(x) = 1 K K-1 k=0 |x k |. (22)
(ii) Zero Crossing Rate (ZCR) -this feature counts the frequency at which the signal passes through zero. A threshold α ≥ 0 is used in order to lessen the noise effect. This feature can be computed in an incremental manner and it is defined as

ZCR(x) = k ∈ {1, . . . , K -1} | |x k -x k-1 | ≥ α and x k x k-1 < 0 . (23)
(iii) Waveform Length (WL) -this feature offers a simple characterization of the signal waveform. It corresponds to the following total variation seminorm:

WL(x) = K-1 k=1 |x k -x k-1 |. (24)
(iv) Slope Sign Changes (SSC) -measures the frequency at which the sign of the signal slope changes. It amounts in checking a condition on three consecutive samples x k , x k-1 , x k+1 with k ∈ {2, . . . , K -2}:

SSC(x) = {k ∈ {2, . . . , K -2} | (x k -x k-1 )(x k -x k+1 ) ≥ α} , (25)
where the threshold α > 0 is employed to reduce the influence of the noise.

(v) Root Mean Square (RMS) -this feature, also related to the quadratic mean or local energy of the signal is given by

RMS(x) = 1 K K-1 k=0 x 2 k . (26)
(vi) Hjorth parameters -are a set of three features originally developed for characterizing electroencephalography signals and then successfully applied to sEMG signal recognition. The most relevant Hjorth activity parameter can be thought of as the integrated power spectrum and basically corresponds to the variance of the signal calculated as follows:

σ 2 (x) = 1 K K-1 k=0 (x k -µ(x)) 2 , (27)
where µ(x) represents the mean value of the signal. The standard deviation and RMS(x) are equal when the mean of the signal is zero.

(vii) Skewness -measures the overall asymmetry of probability distribution of the data:

Skew(x) = 1 K K-1 k=0 x k -µ(x) σ(x) 3 . (28)
(viii) Integrated Square-root EMG (ISEMG) -is a feature returning the sum of the fully-rectified signal:

ISEMG(x) = K-1 k=0 | x k |. (29)

Performance analysis in terms of accuracy and robustness

The performance of our AGR system trained conventionally achieves state-of-art performance [START_REF] Neacsu | Automatic EMG-based hand gesture recognition system using time-domain descriptors and fully-connected neural networks[END_REF][START_REF] Andronache | Towards extending realtime EMG-based gesture recognition system[END_REF][START_REF] Jiang | Multi-category gesture recognition modeling based on sEMG and IMU signals[END_REF], of over 99% accuracy for the first two system is a very difficult task [START_REF] Combettes | Lipschitz certificates for layered network structures driven by averaged activation operators[END_REF], but we can easily bound θ m between the estimate given by ( 6) and the spectral norm of the product of all the weight matrices from the network. We found that the Lipschitz constant estimate θ m ∈ [1.56×10 12 , 1.59×10 14 ] for all three datasets. This suggests that despite the high performance of the classifiers, their robustness is poorly controlled, leaving the systems vulnerable to adversarial perturbations.

A first step towards controlling the Lipschitz constant of the classification algorithm and implicitly its robustness is to impose the nonnegativity condition associated with constraint D. Training under such a nonnegativity constraint is shown to improve the network operation interpretability [START_REF] Chorowski | Learning understandable neural networks with nonnegative weight constraints[END_REF] and acts as a regularization, reducing overfitting. On the other hand, it for the 24-classes dataset. We can however conclude from these tests that imposing the nonnegativity of the weight coefficients is not sufficient to reach satisfactory robustness.

To further control the robustness of the systems, we have to manage the Lipschitz constant of the networks by training them under additional spectral norm constraints, as described by [START_REF] Yang | Dynamic gesture recognition using surface EMG signals based on multi-stream residual network[END_REF]. Searching for the optimal accuracy robustness trade-off, we trained several models considering each of the three aforementioned constraints, namely (C i,n ) 1≤i≤m,n∈N in ( 12), ( C i ) 1≤i≤m in [START_REF] Szegedy | Intriguing properties of neural networks[END_REF], and ( Či,n ) 1≤i≤m,n∈N in [START_REF] Darrell | Task-specific gesture analysis in real-time using interpolated views[END_REF].

By adjusting the upper bound ϑ, we were able to assess the effect of a robustness constraint on the overall performance of the neural network-based classifiers, and finally to achieve the optimal trade-off. All our models were trained using Algorithm 1 as the optimizer.

The obtained results are summarized in Table 2. As expected, obtaining a good robustness-accuracy trade-off requires paying attention to the way we design our constrained networks. In all the cases, we show that using tight constraints during the training phase to approximate the Lipschitz bound improves the overall performance of the classifier, proving the generaliza-tion properties of our solution. For comparison, for each of the proposed constraints, we also evaluated the use of an inexact projection, designated by P (see Section 3.3). It can be observed that using an exact projection yields significantly better results. By combining tight constraints and exact projection techniques, we observe that the robustness of the network can be properly ensured while keeping a good accuracy in both cases. Indeed, we succeeded in ensuring a Lipschitz constant around 1 for a 95% accuracy. The observed loss in accuracy with respect to a standard training is consistent with the "no free lunch theorem" [START_REF] Tsipras | There is no free lunch in adversarial robustness (but there are unexpected benefits)[END_REF].

Training neural networks subject to tight spectral norm constraints can be challenging,2 and the cost of obtaining a good performance is the training time. We used a learning rate scheduler strategy during training, reducing the learning rate by a factor of 2 if the performance does not improve for 1000 epochs. Figure 4 shows the training curves for both validation and training sets in the context of the unconstrained baseline model (yellow and green lines), and in the case of training a constrained version (red and blue lines) using the optimal projection P C i,n ∩D i , with ϑ m = 0.95. Even though it requires more iterations, the constrained model is capable of reaching an accuracy comparable with the baseline, while providing a robustness certificate.

Since the training curves may show some slight variations, we measured the accuracy variations in two ways: by computing the classical standard deviation (std), and by employing median absolute deviation (mad). For a MAD with a factor equal to 1.4826. The latter estimate is known to be more robust to outliers for Gaussian distributed data, especially in the case of small populations. The results are summarized in Table 3. It can be observed that the empirical standard deviation is below 1.6% and the robust estimate of it is below 1.1% for all three datasets. These deviations values are normal considering the size of the dataset and shows that the presented results are relevant and consistent.

Next, we have also evaluated how the positivity constraint impacts the overall accuracy of our system. We trained a robust network by allowing the weights to have arbitrary signs. For this purpose, we control individually the Lipschitz constant of each layer i ∈ {1, . . . , m} to be less than a given value ϑ were computed as described previously. In this case ϑ represents an upper bound on the Lipschitz constant of the system. Table 4 summarize the results for different values of ϑ, for two datasets. We compare our method for dealing with Lipschitz constraints with the approach proposed in [START_REF] Serrurier | Achieving robustness in classification using optimal transport with hinge regularization[END_REF]. This approach which is implemented in the deel-lip library allows the user to train robust networks in a convenient manner, offering a robustness certificate by performing a spectral normalization for each layer. It can be observed on these datasets that our method yields similar results when using the approximate projection, but better ones when using the exact projection. These results underline again the importance of carefully managing the projections and the effect it has on the accuracy of the system.

Robustness validation

In this section we investigate to what extent the theoretical concepts described in the previous sections help in improving the robustness of the classifier in different settings. To this goal, we consider the following three scenarios. In the first one, we examine the impact of adversarial attacks on the performance of the classifier. The second scenario takes into account the effect of noise in the acquisition process. In the case of sEMG signals, this noise may come from imperfect skin-sensor contact caused by hairs or drops of sweat. In the last scenario we perform a real-life experiment using 10 able-bodied volunteers.

Sensitivity to adversarial attacks

We evaluate our robust model on purposely designed perturbations, by studying their influence on the overall performance of the system. We lead attacks on our best robust model in terms of accuracy and robustness achieving 92.95% accuracy and a Lipschitz constant ϑ = 0.87 for the 7-gesture dataset.

We compare the results with two conventionally trained models: the best one in terms of performance, which achieves 99.78% prediction accuracy on non-adversarial data, and another one trained to have similar performance as our robust model reaching 92.99% accuracy on the original test set.

To create the adversarial samples we used some of the most popular whitebox attackers, namely: Fast gradient sign method (FGSM) [START_REF] Goodfellow | Explaining and harnessing adversarial examples[END_REF] -generates adversarial data based on the gradient of the cost function with respect to the input data; Jacobian Saliency Map Attacker (JSMA) [START_REF] Papernot | The limitations of deep learning in adversarial settings[END_REF] -computes a distance to compute the optimal adversarial perturbation.

We also show a comparison with another popular technique of ensuring the robustness of neural network-based models, namely Adversarial training. This implies training an extended version of the dataset, containing the original training data together with a perturbed version of the samples in an effort to increase the system stability against adversarial inputs. Note that this method is purely empirical and gives no theoretical robustness certificates. We implemented an adversarial training strategy detailed in [START_REF] Madry | Towards deep learning models resistant to adversarial attacks[END_REF],

training the system using an augmented version of the dataset which was updated every 25 epochs. The adversarial samples were created using PGD attack and then the model was validated using data containing perturbations computed with various attacks.

The results summarised in Table 5 show the performance obtained for the 7-gesture test set. Note that the robust model performance is barely affected by the adversarial perturbations, whereas the baseline models show a huge drop in accuracy. It can be observed that adversarial training helps to increase the robustness, but our method of controlling the Lipschitz constant the network provides better results when facing data perturbed with other attackers than PGD. This shows that our method is more versatile, since its performance remains stable whatever the attacker.

Noisy input behaviour

To simulate the effect of underlying noise generated during the acquisition process, we added synthetic noise directly to the raw sEMG data, prior to the feature extraction step. The noise is chosen independent and identically distributed according to a Gaussian mixture law (1 -p)N (0, σ 2 0 ) + pN (0, σ 2 1 ). The mixture comprises a background component, corresponding to the intrinsic electronic noise in the armband, such as thermal or quantization noise, and an impulsive component accounting for outliers. Those may be related to imperfect wiring that can generate impulse-like artifacts. In our experiments, we consider background and impulse noises with standard deviations σ 0 = α and σ 1 = 10α with α ∈ [0, +∞[. We generate different levels of noise, by varying the parameter α. The probability of peaks p ∈ [0, 1] is also adjusted to simulate more or less severe scenarios in terms of outliers.

From the resulting noisy signals, we extract the features described in Section 4 and pass them to the classifier, using our robust models reaching an accuracy of 92.95% (ϑ = 0.87) for the 7-gestures dataset, and 93.05% (ϑ = 0.98) in the case of the 13-gestures dataset, trained with non-altered data. We compared the results achieved with our robust training with those The experimental results obtained on two datasets are depicted in Figure 5.

The red, blue, and green lines correspond to the unconstrained, constrained, and adversarial models, respectively. We observe that the constrained model is significantly less affected by the presence of noise in the inputs than the one This experiment emphasizes that controlling the Lipschitz constant of a network improves its robustness not only against targeted adversarial attacks, as shown previously, but also in the case of black-box attacks, where no prior information about the model is used.

Real-life scenario validation

To illustrate the practical applicability of our findings, we proceed to validate our model in a real-life context. For this purpose, we designed an experiment to compare a conventionally trained model with the constrained one. We integrated both models in a real-time application that controls a 3D hand on a screen, as well as a game that can be controlled by gestures, to give the user a tangible feedback. We used the Unity3 platform to design and control a 3D hand and then encapsulated our models in an application which performed real-time inference and the hand was moving on the screen in accordance with the predicted gesture. We asked 10 volunteers (males and females) to test both models by performing each gesture 20 times. We emphasize that the user had no prior knowledge about what model was implemented, since it was randomly selected at the beginning of each new trial.

Pictures of the experimental setup are provided in Figure 6. Table 6 details on a user level, how many (out of the 20) trials were erroneously classified.

U and C denote the Unconstrained and the Constrained models, respectively.

Note that, despite obtaining very good results on the test set, the unconstrained model loses a lot in terms of performance (up to 15%) when facing real-life data. We can observe that training a positive neural networks subject to Lipschitz constraints improves the overall robustness of the classifier against adversarial perturbations, not only from a theoretical viewpoint, but also practically by leading to more reliable systems with greater generalization power.

As for the other application, we asked the volunteers to play 2 rounds of a gesture-controlled game, one with each model. The game was inspired by the famous Temple Run4 , and consists of a moving cube which the user controls via gestures. The player can move his/hers hand left or right to move the character to either side of the screen to avoid obstacles. The player can also move the hand up to jump or spread its fingers to shoot and clear the obstacles ahead. The game is over when the player fails to take a turn or to jump/ clear an obstacle. We observed that 70% of the users were able to obtain higher scores when they used the constrained model, showing again that our solution is more stable when it comes to real-life applications.

Limitations

Increased training time is one of the main limitations of our proposed approach. Indeed, to compute the true projection, the proposed method uses an iterative algorithm which performs singular value decomposition at each iteration, which is a resource consuming operation, especially when performed on large matrices. We propose several lower complexity solutions, which have proved to offer a good trade-off between training time, robustness and performance.

Another limitation is related to the fact that our method for controlling the Lipschitz constant of the system is currently applicable in the context of nonnegative-weighted fully connected feed-forward neural networks. Although, the performance remains good for the considered AGR systems, the nonnegativity constraint might lead to a loss of expressivity of the neural networks in other inference tasks. In a future work, we plan to extend our method towards more general neural network architectures, including convolutional layers, skip connections, etc.

Conclusion

This work has shown the usefulness of designing robust feed-forward neural networks for automatic gesture recognition based on sEMG physiological signals. More precisely, we proposed to finely control the Lipschitz constant of these nonlinear systems by considering positively weighted neural architectures. To offer robustness certificates, we also developed new optimization techniques for training classifiers subject to spectral norm constraints on the weights. We studied various constrained formulations and showed that robustness can be secured without sacrificing accuracy when using a combination of tight constraints and exact projections. We also provide several lower-complexity solutions, which reduce the training time significantly.

Experiments on three distinct datasets illustrated the good performance of our approach. We further demonstrated the effectiveness of our robust classifier, compared to classically trained ones, when facing white-box and black-box attacks, as well as in real-life usage.

In future works, it would be interesting to apply such a robust training procedure to other applications in pattern recognition involving data acquired in real-time.

Since P D i is a nonexpansive operator, the latter function has a Lipschitz gradient with constant β = ∥A i,n ∥ 2 S ∥B i,n ∥ 2 S . The dual problem [START_REF] Pauli | Training robust neural networks using Lipschitz bounds[END_REF] thus corresponds to the minimization of the sum of a smooth convex function and a proper lower-semicontinuous function. Consequently, it can be minimized by a proximal algorithm. Such a strategy will require to calculate the proximity operator of γι * B(0,ϑ) for some scaling parameter γ ∈]0, +∞[. By using Moreau's formula [START_REF] Bauschke | Convex analysis and monotone operator theory in Hilbert spaces[END_REF], this proximity operator is expressed as

(∀Y ∈ R Nm×N 0 ) prox γι * B(0,ϑ) (Y ) = Y -γP B(0,ϑ) (γ -1 Y ). (35)
A classical solution for solving the dual problem consists in using the standard forward-backward algorithm [START_REF] Combettes | Signal recovery by proximal forward-backward splitting[END_REF][START_REF] Combettes | Proximal thresholding algorithm for minimization over orthonormal bases[END_REF]. This leads to Algorithm 3 [START_REF] Combettes | Dualization of signal recovery problems[END_REF]. Another solution consists in using the FISTA-like algorithm in [START_REF] Chambolle | On the convergence of the iterates of the fast iterative shrinkage/thresholding algorithm[END_REF], which leads to the accelerated version in Algorithm 2. The sequences (Y ℓ ) ℓ∈N generated by these two algorithms is guaranteed to converge to a solution Y to the dual problem.

In addition, from Kuhn-Tucker conditions, the solution to the primal problem W i = P S i,n (W i ) is equal to ∇f * (-A ⊤ i,n Y B ⊤ i,n ). It follows from [START_REF] Combettes | Deep neural network structures solving variational inequalities[END_REF] and the continuity of P D i that the sequence (V ℓ ) ℓ∈N converges to W i .

∥ S ∥B i,n ∥ S ) 2 -ϵ] V ℓ = P D i (W i -A ⊤ i,n Y ℓ B ⊤ i,n ) Y ℓ = Y ℓ + γ ℓ A i,n V ℓ B i,n Y ℓ+1 = Y ℓ -γ ℓ P B(0,ϑ) (γ -1 ℓ Y ℓ )

Figure 1 :

 1 Figure 1: Representation of a NN as a composition of operators

  T }, and Λ = Diag(λ 1 , . . . , λ R ), (λ r ) 1≤r≤R ∈ [0, +∞[ R being the singular values of W . Then the projection of W onto B(0, ϑ) is expressed as

Figure 3 :

 3 Figure 3: Proposed neural network architecture for AGR. All the layers except the last one use ReLU activation functions; the last layer uses Softmax. The number of neurons considered for each layer is: 128, 128, 128, 64, 32, 16, in the case of 7-gestures dataset and 256, 256, 256, 128, 64, 32 in the case of 13-gesture dataset. The last layer has 7 or 13 neurons representing the gesture number being recognized.

  can affect its approximation capability and potentially lead to a performance decay. Training the proposed system subject to constraint D results in an overall accuracy of 96.92 %, 95.87%, and 84.75 % for the case of 7, 13, and 24 classes, respectively. The performance decay was balanced by an increase in the robustness, since the Lipschitz constant, computed as indicated in Proposition 2.2, equals θ m = 9.69×10 10 for 7 classes, θ m = 9.73×10 10 for 13 classes and θ m = 1.03 × 10 11 for 24 classes. We observed that the accuracy reduction can be overcome by adding additional layers to the architecture. Indeed, we were able to obtain a similar accuracy to the baseline by adding an extra layer to the existing architecture and retraining both systems subject to D, i.e. 98.68%, 97.21% and 85.12% for the 7-gesture, 13-gesture, and 24-gesture datasets, respectively. Furthermore, compared to the unconstrained models, we managed to maintain a high performance while improving the robustness with respect to unconstrained training, i.e. θ m = 1.02 × 10 11 for the 7-classes dataset, θ m = 9.96 × 10 10 for the 13-classes dataset and θ m = 4.24 × 10 11

Figure 4 :

 4 Figure 4: Accuracy vs. Iterations -constrained and unconstrained models in the context of 7-gesture dataset. The training and validation curves are displayed in green and yellow, respectively, for the unconstrained model. The training and validation curves are displayed in blue and red, respectively, in the case of constrained training, with the bound ϑ = 0.95.

  (a) σ 0 = α; σ 1 = 10α; p = 0.15 (b) σ 0 = α; σ 1 = 10α; p = 0.3 (c) σ 0 = α; σ 1 = 10α; p = 0.45 (d) σ 0 = α; σ 1 = 10α; p = 0.15 (e) σ 0 = α; σ 1 = 10α; p = 0.3 (f) σ 0 = α; σ 1 = 10α; p = 0.45

Figure 5 :

 5 Figure 5: Accuracy vs. α in the context Noisy Inputs training. First row: 7-gesture dataset; Second row: 13-gestures dataset. Red line: robust model; Blue line: baseline model; Green line: adversarial trained model

(a) 3 -

 3 D hand control (b) Gesture-control game

Figure 6 :

 6 Figure 6: Real-life experimental setup

Algorithm 3 :

 3 Dual Forward-backward algorithm Let Y 0 ∈ R Nm×N 0 Set ϵ ∈]0, 1/(∥A i,n ∥ S ∥B i,n ∥ S ) 2 [ for l = 0, 1, . . . do Set γ ℓ ∈ [ϵ, 2/(∥A i,n

Table 1 :

 1 Comparison to other State of the Art sEMG-based AGR systems

	Method	Dataset	# of gestures Accuracy [%] Year
	Fusion-Lohi [13] DVS-EMG	5	96.04	2020
	EELM [16]	NinaPro DB5	52	77.90	2022
	MResLSTM [11] NinaPro DB1	52	89.65	2021
	GRU-Res [14]	sEMG-IMU	20	99.49	2022
	EMG-CNN [45] 15Myo-sEMG	15	98.67	2022
	7-DNN (ours)	Myo-sEMG	7	99.67	2020
	13-DNN (ours)	13Myo-sEMG	13	99.31	2021
	24-DNN (ours)	NinaPro DB5	24	86.20	2023
		(Exercise C)

datasets and around 86% in the case of the 24-gestures dataset

[START_REF] Peng | Gesture recognition by ensemble extreme learning machine based on surface electromyography signals[END_REF][START_REF] Fatayer | sEMG-based gesture recognition using deep learning from noisy labels[END_REF]

. A more detailed comparison with other new sEMG-based AGR systems is presented in Table

1

. Since in this case the weights are not guaranteed to be positive, the lower bound introduced in Proposition 2.2 does not constitute a valid Lipschitz constant. Computing the exact Lipschitz constant θ m of the

Table 2 :

 2 Lipschitz constant obtained with various constrained optimization strategies for different accu-

racies -7-gestures dataset.

  1/m . The exact projection onto C i , P C i , as well as the approximate one P C i

		Accuracy 75% 80% 85% 90% 95%
	7-gestures dataset	empirical std 0.65 1.22 0.56 1.35 1.10
	Model Variation	robust std 1.02 0.94 0.53 0.87 1.07
	13-gestures	empirical std 0.65 1.05 0.75 0.75 0.72
	Model Variation	robust std 0.77 0.81 0.72 0.97 0.59
		Accuracy 65% 70% 75% 80% 85%
	24-gestures	empirical std 0.68 0.95 0.87 0.77 0.76
	Model Variation	robust std 0.89 0.74 0.79 0.89 0.64

Table 3 :

 3 Standard deviation of accuracy computed on 15 epochs, after convergence, on the test set for constrained models.

Table 4 :

 4 Deel-lip[START_REF] Serrurier | Achieving robustness in classification using optimal transport with hinge regularization[END_REF] 77.21 125.63 1120 2.04 × 10 4 4.5 × 10 8 Lipschitz constant for networks trained with arbitrary signs -7-gestures / 13-gestures datasets.

		Accuracy	75%	80%	85%	90%	95%
	7-gestures dataset Lipschitz constant	72.03 127.5 52.06 102.49 905.45 7.23 × 10 4 8.14 × 10 8 1296 8.75 × 10 4 5.43 × 10 9 Deel-lip[48] 75.81 126.9 1283.6 8.70 × 10 4 5.43 × 10 9 P Ci C i P Ci
	13-gestures dataset Lipschitz constant	C i	P Ci P Ci	76.59 125.20 1016 2.03 × 10 4 4.3 × 10 8 61.22 99.74 740 1.26 × 10 4 6.7 × 10 7

Table 5 :

 5 White-box attack results. We consider out best constrained model, having a Lipschitz constant θ = 0.97, two models trained conventionally: the best baseline and another one having similar performance as the constrained one. On the last columns we feature an adversarial trained model using PGD-generated perturbations.perturbation based on ℓ 2 distance metric by iteratively selecting the input sample that will increase the chance of miss-classification; Projected gradient descent (PGD)[START_REF] Madry | Towards deep learning models resistant to adversarial attacks[END_REF] -uses local first order information about the network to create adversarial examples; Carlini and Wagner (C&W)[START_REF] Carlini | Towards evaluating the robustness of neural networks[END_REF] -utilizes ℓ 2

Table 6 :

 6 Experiment results

trained without robustness guarantees. It is also worth noting that training with adversarial inputs also leads to satisfactory results, although usually slightly less accurate. The Lipschitz lower and upper bounds computed for the networks trained in an adversarial manner are indeed much lower than those with standard training, but they remain quite large ((1845.23, 79534.2) for 7-gestures dataset and (1754.74, 64595.8) for 13-gestures dataset).

A code in TensorFlow will be made available upon the acceptance of the paper.

https://unity.com/

https://play.google.com/store/apps/details?id=com.imangi.templerun&hl= en&gl=US&pli=1

Acknowledgements

This project was supported by the BRIDGEABLE ANR Research and Teaching Chair in AI and by the Romanian National Authority for Scientific Research and Innovation, UEFISCDI, project EGMP-AI, agreement 425PED/2020, grant PN-III-P2-2.1-PED-2019-2392.

Movement

User #1 User#2 User#3 User#4 User#5 User#6 User#7 User#8 User#9 User#10

is equivalent to solve the following matrix optimization problem: minimize

where ∥•∥ F is the Frobenius norm and ι S denotes the indicator of a set S (this function is equal to 0 on this set and +∞ otherwise.) The dual optimization problem associated to this strongly convex minimization problem reads minimize

where for a given function g, g * denotes its Fenchel-Legendre conjugate. In

From standard conjugation rules [START_REF] Komodakis | Playing with duality: An overview of recent primal-dual approaches for solving large-scale optimization problems[END_REF], f * is equal to

where ι D i is the Moreau envelope of ι * D i given by

The Moreau envelope of a proper lower-semincontinuous convex function is differentiable. Thus f * is differentiable and its gradient is [START_REF] Bauschke | Convex analysis and monotone operator theory in Hilbert spaces[END_REF]Example 17.33] ∇f * (W i ) = P D i (W i + W i ). [START_REF] Combettes | Deep neural network structures solving variational inequalities[END_REF] We deduce that the gradient of Y → f * (-


Simultaneous EEG-fNIRS to explore somatosensory prediction in the premature neonate brain Marais, A-L. 1 *, Dumont, V. 1 , Anquetil, M. 2 , Rossi, S. 2 , Trentesaux, A-S 3 , Roche-Labarbe, N. 1 * anne-lise.marais@unicaen.fr 00 1 Normandie Univ, UNICAEN, INSERM, COMETE, GIP CYCERON, 14000 Caen, France; 2 Normandie Univ, UNICAEN, LPCN, 14000 Caen, France; 3 Unité de Néonatalogie, CHU, Caen, France.

00

• Predictive coding proposes that the brain is inherently predictive about the environment (Friston, 2005). These predictions can be observed through various phenomena such as:

• sensory prediction, the neural anticipation of future stimulation on the basis of previous sensory inputs • repetition suppression, the decrease of cerebral activity to a repeated stimulus after a stable representation is formed, thus correctly predicted

• Predictions are necessary to optimize behavioral responses and the use of attentional and energy resources

• Sensory prediction and repetition suppression can be altered in neurodevelopmental disorders (NDD) like attention deficit disorders (Gonzalez-Gadea et al., 2015) • Predictive abilities were recently described in preterm infants in the tactile modality (Dumont et al., 2022) • Neonates will show a larger early response in the somatosensory cortex and a late frontal response to deviance (rare stimuli in the sequence).

01

• Neonates will have an increase of HbO during the omission in the somatosensory cortex, and a late frontal response on EEG.

00

• Repeated stimulations elicit weaker HbO changes in the somatosensory cortex but increased HbO changes in the frontal cortex. We expected activation and not deactivation in the somatosensory cortex. In the frontal cortex, fNIRS and EEG show RS and are consistent with hypotheses.

• Deviance elicited a strong increase in HbO as well as an increased early electrical response in the frontal cortex. An increase in neuronal activity was observed only on EEG in the somatosensory cortex. Future measurements are needed to interpret fNIRS data.

• Omission elicited no change in the somatosensory cortex but elicited a decrease in HbO in the frontal cortex coupled with neuronal activity on EEG.

Preterm neonates form predicitons and detect an error in the tactile environment.

The late negative components found on EEG during the deviance and the omission in the frontal cortex suggest that these prediction mechanisms could rely on a common frontal process as suggested by the predictive coding theory.

fNIRS measurement provide complementary information on tactile processing but more participants are needed to interpret fNIRS data further. N = 30 of 90 (32,64 ± 2,24 SA at birth, 13 ♀), 13 had simultaneous EEG/fNIRS

Tactile modality

• Somatosensory inputs are numerous from birth and touch ontogenetic anteriority makes it the foundation of neurosensory integration, and motor, cognitive and affective development (Cascio, 2010) • The tactile modality and the cognitive functions relying on it are often altered in NDD (Zoenen & Delvenne, 2018) Oddball-omission protocol -0.1 0.1 0.3 0.5 0.7 0.9 1.1 1.3 1.5 1.7 1.9 2.1 2.3 2.5 2.7 2.9

Somatosensory familiarization -1.6 -1.1 -0.6 -0.1 0.4 0.9 -0.1 0.1 0.3 0.5 0.7 0.9 1.1 1.3 1.5 1.7 1.9 2.1 2.3 2.5 2.7 2.9

Frontal familiarization -1.6 -1.1 -0.6 -0.1 0.4 0.9 -0.1 0.1 0.3 0.5 0.7 0.9 1.1 1.3 1.5 1.7 1.9 2.1 2.3 2.5 2.7 2.9

Frontal control -1.6 -1.1 -0.6 -0.1 0.4 0.9 -0.1 0.1 0.3 0.5 0.7 0.9 1.1 1.3 1.5 1.7 1.9 2.1 2.3 2.5 2.7 2.9

Somatosensory control P100 ⬂ for the deviant stimulations compared to the standard -0.5 -0.3 -0.1 0.1 0.3 0.5 0.7 0.9 -0.1 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 1.1 1.2 1.3 1.4 1.5 1.6 1.7 1.8 1.9 2 2.1 2.2 2.3 2.4 2.5 2.6 2.7 2.8 2.9 3 Somatosensory deviance -0.5 -0.3 -0.1 0.1 0.3 0.5 0.7 0.9 -0.1 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 1.1 1.2 1.3 1.4 1.5 1.6 1.7 1.8 1.9 2 2.1 2.2 2.3 2.4 2.5 2.6 2.7 2.8 2.9 3 -0.1 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 1.1 1.2 1.3 1.4 1.5 1.6 1.7 1.8 1.9 2 2.1 2.2 2.3 2.4 2.5 2.6 2.7 2.8 2.9 3 -0.1 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 1.1 1.2 1.3 1.4 1.5 1.6 1.7 1.8 1.9 2 2.1 2.2 2.3 2.4 2.5 2.6 2.7 2.8 2.9 3

Somatosensory omission

Repetition suppression

Deviance Omission

Early negative components and late positive components ⬀ during the omission in the frontal cortex.

HbO HbR HbO HbR

HbO HbR

Right hand stim

•

  Dehaene S, Dehaene-Lambertz G. (2014). A hierarchy of cortical responses to sequence violations in three-month-old infants. Cognition. 132(2).137-50. doi: 10.1016/j.cognition.2014.03.013 Dehaene-Lambertz, G., & Dehaene, S. (1994). Speed and cerebral correlates of syllable discrimination in infants. Nature, 370(6487), 292-295. https://doi.org/10.1038/370292a0 Cascio, C. J. (2010). Somatosensory processing in neurodevelopmental disorders. Journal of Neurodevelopmental Disorders, 2(2), 62-69. https://doi.org/10.1007/s11689-010-9046-3 Dumont, V., Giovannella, M., Zuba, D., Clouard, R., Durduran, T., Guillois, B., & Roche-Labarbe, N. (2022). Somatosensory prediction in the premature neonate brain. In Developmental Cognitive Neuroscience (Vol. 57, p. 101148). Elsevier BV. https://doi.org/10.1016/j.dcn.2022.101148 Friston, K. (2005). A theory of cortical responses. Philosophical Transactions of the Royal Society B: Biological Sciences, 360(1456), 815-836. https://doi.org/10.1098/rstb.2005.1622 Gonzalez-Gadea, M. L., Chennu, S., Bekinschtein, T. A., Rattazzi, A., Beraudi, A., Tripicchio, P., Moyano, B., Soffita, Y., Steinberg, L., Adolfi, F., Sigman, M., Marino, J., Manes, F., & Ibanez, A. (2015). Predictive coding in autism spectrum disorder and attention deficit hyperactivity disorder. Journal of Neurophysiology, 114(5), 2625-2636. https://doi.org/10.1152/jn.00543.2015 Nelson, C., Ellis, A., Collins, P., Lang, S. (1990). Infants neuroelectric responses to missing stimuli: can missing stimuli be novel stimuli ? Developmental neuropsychology. 6(4), 339-349. Spackman, L. A., Towell, A., & Boyd, S. G. (2010). Somatosensory discrimination : An intracranial eventrelated potential study of children with refractory epilepsy. Brain Research, 1310, 68-76. https://doi.org/10.1016/j.brainres.2009.10.072 Zoenen, D., & Delvenne, V. (2018). Treatment of sensory information in neurodevelopmental disorders. Reve Medicale de Bruxelles, 39(1), 29-34. https://doi.org/10.30637/2018.17-073 EEG acquisition and preprocessing 04 PRELIMINARY RESULTS (N EEG =30, N NIRS =13) Neonates will show repetition suppression in the somatosensory and frontal cortices : decrease of the neuronal activation between the familiarization and the control phases of the tactile stimulation sequence.

•

  128 channels EEG (Magstim EGI, Eugene OR, USA), sampling rate : 1000 Hz Current population Counter-balanced standard vs. deviant stimulation on the custom-made vibratory matrix, then placed on a fully-/annelisemarais.github.io/ https://github.com/annelisemarais anne-lise.marais@unicaen.fr @ SEP amplitude for the last 40 stimulations (Control) and the first 40 stimulations (Familiarization) in the frontal cortex& 830 nm (Imagent, ISS, Champaign IL, USA), 1 detector, 4 sources over fronto central areas