Camille Teruel
email: camille.teruel@inria.fr

Stéphane Ducasse
email: stephane.ducasse@inria.fr

Damien Cassou
email: damien.cassou@inria.fr

Marcus Denker
email: marcus.denker@inria.fr

Access Control to Reflection with Object Ownership

Keywords: D.3.3 [Programming languages]: Language Constructs and Features Keywords reflection, encapsulation, object ownership

de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Reflection is a powerful ability that allows programs to examine and modify their own structure and behavior [START_REF] Smith | Reflection and semantics in lisp[END_REF]. Reflection helps writing highly generic code and frameworks. It can alter program interpretation to create language extensions, to perform dynamic analyses or to factor non-functional concerns. It is a basis for the implementation of development tools, dynamic software updates and selfadaptive programs. Early, reflection has been considered to fit the object paradigm well [START_REF] Maes | Concepts and experiments in computational reflection[END_REF][START_REF] Ferber | Computational reflection in class-based object-oriented languages[END_REF], making object-oriented languages the vehicles of choice to implement reflective architectures.

However, most reflective operations break object encapsulation. For example with object state introspection objects can break into the encapsulation boundaries of other objects to obtain new references. This reflective operation is available in many languages e.g., instance_variable_get() in Ruby, getattr() in Python, Field.get() in Java, instVarNamed: in Smalltalk. Consider an example consisting of two person objects, Alice and Bob, each holding a reference to its own private wallet object. In this context, if Alice has a reference to Bob, she can use object state introspection to access Bob's wallet without his consent. For example in Smalltalk:

bobWallet := bob instVarNamed: #wallet.

Alice can now access the content of Bob's wallet, like is credit card. Such leaked object reference can in turn be introspected: from a reference to one object, all indirectlyconnected objects become reachable. So once Alice has obtained Bob's credit card she can introspect it to get its PIN: creditCard := bobWallet creditCard. pin := creditCard instVarNamed: #pin.

From a security point of view the tension between reflection and object encapsulation is problematic. An unrestricted access to advanced reflective features allows any code to inspect and corrupt any code loaded in the runtime or any computation running therein. The deployment of an application requiring reflection support in a shared runtime relies on trusting this application to not misuse reflection. This situation is not satisfactory.

This tension is also problematic because reflection is used to implement security mechanisms [START_REF] Riechmann | Meta objects for access control: Extending capability-based security[END_REF][START_REF] Ancona | Reflective authorization systems: Possibilities, benefits, and drawbacks[END_REF]. If still available, reflection can easily bypass these mechanisms. Consequently these mechanisms must implement policies that forbid reflection except for their own implementation. Rather than forbidding reflection or most of its applications, we want to control it.

In this article, we reconcile reflection and object encapsulation via an access control policy to reflective operations. Such policy has to determine when breaking into the encapsulation boundary of an object is legitimate. To this end, we explore the notion of dynamic object ownership [START_REF] Noble | Object ownership for dynamic alias protection[END_REF][START_REF] Gordon | Dynamic ownership in a dynamic language[END_REF]) that organizes object graphs around a notion of ownership. We use the object ownership relation to determine access rights to reflective operations on a per-object basis. These access rights are thus based on the dynamic arrangement of objects rather than on static relations between structural entities (e.g., classes and packages) as it is the case for visibility modifiers in most languages. Ownership information becomes our basis to decide when it is legitimate for an object to break into the encapsulation boundary of another one using reflection.

The contributions of this article are:

• a description of the problem of object encapsulation violations caused by reflection, a presentation of the existing solutions and their shortcommings (Section 2);

• a presentation of an access control policy to reflective operations based on dynamic object ownership (Section 3);

• an evaluation of this access control policy through a prototype Metaobject protocol (Section 4).

Problem

Most reflective operations break object encapsulation. To reconcile reflection and encapsulation we want an access control policy to reflective operations. The purpose of such policy is to decide when an object can legitimately use a reflective operation on another object and thus potentially break the encapsulation of the latter. In this section we set up the context of the discussion to explain the tension between encapsulation and reflection. To stress this tension we analyse it through the point of view of a security model where object encapsulation is a central requirement: the Object-Capability Model (OCap model). This brief introduction to the OCap model also introduces some vocabulary.

Object-Capability Model

The Object-Capability Model [START_REF] Miller | Robust Composition: Towards a Unified Approach to Access Control and Concurrency Control[END_REF][START_REF] Miller | Paradigm regained: Abstraction mechanisms for access control[END_REF]) is a capability-based security model that builds upon the object paradigm. In capability-based security, a capability is an unforgeable reference to a resource together with a set of access rights to this resource. Capabilities are unforgeable i.e., it is impossible to counterfeit a capability. A capability grants subjects holding it the permission to invoke operations of the associated resource according to the associated access rights. In a capability system it is impossible to designate a resource without having the permission to access this resource: a capability is at the same time a designation and a permission.

The OCap model applies capability-based security to object-oriented programming by treating objects both as subjects and resources. An object is a resource for objects holding a reference to it and a subject for objects it holds a reference to. In a memory-safe language a capability is encoded as an object reference: the absence of pointer arithmetic ensures that object references are unforgeable. A capability grants a subject the right to send messages to the resources.

In the context of our wallet example, if Alice holds a capability on Bob, she can send him messages. On his side, Bob encapsulates its capability to its wallet: he is the only one to decide if he gives its wallet away to strangers. That is to say, it is up to the code of Bob to take care of exercising its wallet capability himself and not to return or introduce this capability to collaborating objects. For example, if Alice were to ask Bob to pay her for some item, Bob would have to take some coins out of his wallet and give them to Alice, but he would not give away his wallet for Alice to take these coins herself.

The OCap model relies crucially on object encapsulation: a capability only permits a subject object to send messages to the associated resource object, but not to access the capabilities of the resource without its consent. In the introduction we saw that the global availability of object state introspection allows any object to access all the objects indirectly connected to it. This is unacceptable because any capability would bring as much authority than the sum of capabilities in its connected object graph.

The integration of reflection and the OCap model in a same language is thus challenging. Consequently OCap languages provide limited reflective abilities. For example, Joe-E [START_REF] Mettler | A security-oriented subset of java[END_REF], an object-capability subset of Java, limits reflection to introspection of public members. Another example is the E language [START_REF] Miller | Robust Composition: Towards a Unified Approach to Access Control and Concurrency Control[END_REF]) that limits reflection to the execution and interception of message sends.

An OCap language could allow an object to perform many reflective operations on itself. An object inspecting its own state and behavior, instrumenting its own code or altering its own interpretation does not contradict the principles of the OCap model as soon as these reflective operations affect only the object itself. Only the reflective operations that an object performs on another object needs to be controlled. More precisely, an object should not be able to perform a reflective operation that produces an effect that could not have been carried out without reflection. This corresponds to the principle of reflection protection formulated by De Meuter et al. in the context of the ChitChat language (De [START_REF] Meuter | Flexible object encapsulation for ambient-oriented programming[END_REF]. The reflection protection principle states that, by default, an object does not expose more of itself at the metalevel than it does at the base-level. An object can still expose more at the meta-level than it does at the base-level, but only if it chooses to do so. The set of reflective operations that respect the reflection protection principle depends on the host language. For example in Java, the accessibility of a field or a method has to be taken into account. Reflection protection allows method calls, field readings and field writings but only if the corresponding member is accessible from the subject object according to the visibility restrictions. Another example is Smalltalk, where instance variables are private to each object and all methods are public. In this case reflection protection allows every message send but no access to instance variables.

While the reflection protection principle reconciles reflection with the OCap model, it also constrains it and limits its power. We are looking for a more permissive approach.

Reflection as Separate Capabilities

A first step toward the reconciliation of reflection and the OCap model is to encapsulate reflective operations in separate objects. Likewise the capability to send messages to an object and the capability to reflect on it are kept distinct. Additionally this separation prevent name clashes between the base-level operations and the reflective operations. The objects that expose the reflective operations are called metaobjects.

To allow fine-grained access control, a reflective architecture should provide metaobjects that grant a subject the right to perform reflection on a single object. In the rest of this paper we consider reflective architectures that fulfill this requirement. For example, the reflective API of Java does not fulfills this requirement: in Java, the method getClass() returns a reification of the receiver's class (instance of the class Class), that allows subjects to inspect and modify any instance they reference. Reflective architectures that expose reflective operations via metaobjects can be divided in two categories: those where metaobjects are accessed directly from objects and those where metaobjects are acceded indirectly via an external provider.

Direct Access to Metaobjects

Many reflective architectures grant base-level objects the right to access the metaobject of any other object directly. When the access to a metaobject is negotiated via message passing, and when the corresponding accessing methods can be redefined, objects may restrict the set of reflective operations they provide [START_REF] Meuter | Flexible object encapsulation for ambient-oriented programming[END_REF]. Typically, this kind of solution has two drawbacks.

The first drawback is a lack of principal information: an object has no easy mean to know which subject object is asking for its metaobject. One solution can rely on the different method visibilities provided by the language to grant different subjects different levels of authority. But in most languages method visibilities are based on static criteria, like the package or the hierarchy of the class defining the method. Such solution prevents fine-grained access control by making the assumption that all instances of a class have necessary the same rights. And more often than not, different instances need different access rights to properly encapsulate their respective private state from each other. In the context of our wallet example, restricting the reflective access of someone's wallet to instances of the Person class (like Java's private modifier) would imply that Alice has the permission to access Bob's wallet reflectively. Likewise, restricting the reflective access of linked-list nodes to instances of the LinkedList class would imply that any linked list has the permission to access any other linked-list nodes. Also, if a malicious program manages to take over one instance, it can then take over all other instances it can access. Such solution also makes the assumption that principal boundaries matches the visibility scopes provided by the language. A more satisfying solution is to take the identity of subjects into account for more finegrained control. This is what the access controlled policy presented in this article does. Of course this is only possible if the language offers a way to know the sender of a message.

A second drawback is that this kind of access to metaobjects forces the repetitive redefinition of these access methods and may lead to duplicated code. Also, developers may either implement over-restricting access policies and prevent the usage of development tools and dynamic analyses or implement over-permissive policies and introduce security breaches. To avoid these repetitive redefinitions, the default accessing methods must provide a sensible default access control policy. This is one of the contributions of this article.

Indirect Access to Metaobjects

Access to metaobjects can also be done indirectly via an external provider. This is the case in mirror-based reflective architectures [START_REF] Bracha | Mirrors: Design principles for metalevel facilities of object-oriented programming languages[END_REF], where all reflective operations are performed via metaobjects called mirrors. A mirror-based reflective architecture follows three design principles:

• Encapsulation: The implementation of reflective operations is encapsulated. It is then possible the substitute one implementation with another, e.g., for adapting existing development tools to a different runtime or to provide reflection on remote objects.

• Stratification: The meta-level is totally separated from the base-level. Mirrors are not accessed directly via base-level objects but instead via a mirror factory.

• Ontological correspondence: The reflective API describes the reflected language in its entirety and distinguishes between static and dynamic aspects of the language.

In our context, stratification is the most important principle.

To perform reflection upon a resource, a subject needs a capability over the resource and a capability over a mirror factory. Without access to a mirror factory, a subject cannot use reflection at all. Typically, a default mirror factory creates mirrors that expose all available reflective operations. A capability over the default mirror factory thus grants a subject the right to reflect upon any object it references directly or indirectly.

Thanks to the adherence to the Abstract Factory design pattern, mirror-based reflective architectures make it possible to design custom mirror factories that produce mirrors with less authority. But such mirror factories still need to keep track of access permissions to determine which rights it grants to different subjects. Our policy uses ownership information to keep track of these permissions.

Access Control Policy to Reflective Operations

An access control policy to reflective operations has to decide when a subject object can legitimately perform a reflective operation on a resource object. Ideally such policy should be permissive enough to retain most of the power of reflection and restrictive enough to prevent abuses. A policy should also be generic enough to be a sensible default for most situations. Consider the case where the subject and the resource are the same object. In this case we consider all reflective operations legitimate, i.e., an object can always access its own metaobject. An object should have the right to decide for itself how it behaves: it should have the right to inspect and alter its own state as it intends. The problematic case is when the subject and the resource are different objects. Specifying access rights on a per-class basis is not a satisfactory solution because all instances of a class would have the same rights. Rather our policy takes the dynamic relations between objects into account. We can observe that the relation between Alice and Bob is not the same than the relation between Alice and her wallet. While Alice should not be able to get access to Bob's wallet, she should have a privileged access to her own wallet and then to the credit card it contains. She should be able to use reflection to alter the behavior of her credit card. Likewise she can monitor and limit withdrawals when she lands it to an untrustworthy friend. The relationship between a person and his wallet is stronger than the relationship between persons: while Alice owns her wallet, she simply refers to Bob. The distinction between this owning relationship and the standard referencing relationship is embodied by the concept of Object Ownership.

Object Ownership

Object ownership was originally introduced to control the effects of object aliasing in the context of Flexible Alias Protection [START_REF] Noble | Flexible alias protection[END_REF]. It was first embodied as a type system with ownership types [START_REF] Clarke | Ownership types for flexible alias protection[END_REF]) and was then adapted in the context of dynamically-typed languages with dynamic ownership [START_REF] Noble | Object ownership for dynamic alias protection[END_REF][START_REF] Gordon | Dynamic ownership in a dynamic language[END_REF]. In this paper we consider the latter. Note that we do not use object ownership to control object aliasing but to keep track of reflection permissions on a per-object basis.

The notion of object ownership comes from the observation that objects are rarely autonomous but instead form aggregates. An aggregate object is composed of objects that constitute its representation and it refers to other objects that constitute its arguments. An aggregate owns its representation but simply refers to its arguments. A typical example is a linked-list: the list owns its nodes (its representation) but simply refers to the elements it contains (its arguments).

Figure 1 shows the ownership relation in the context of our wallet example. Alice and Bob refer to each other, and both own their respective wallet and credit card. Such object graph could be the result of the following code.

Ownership-Based Access Control to Reflective Operations

We now present our ownership-based access control to reflective operations. Each object refers to its direct owner, which by default is the object that instantiated it. 1 This forms the direct ownership tree. Depending on the execution model of the host language, the root of this tree is either the first object instantiated or a special object. For example, for Java there would need to be a special object to act as the owner of objects instantiated within the main method. The ownership relation we consider is the transitive reflexive closure of the direct ownership relation. In other word, we say that an object A owns an object B if:

• A directly owns B (i.e., A is the direct owner of B), or

• there exists an object C such that A owns C and C directly owns B, or

• A and B are the same object.

The access control policy is to grant an object the permission to perform any reflective operation on the objects it owns. For example, in the context of Figure 1, Alice owns her credit card and can alter its behavior to monitor or limit withdrawals. If the subject object does not own an object the policy falls back to the reflection protection principle i.e., only the reflective operations that perform an action that could have been carried out without reflection are available. Reflection is not entirely forbidden: the subject object can still perform some reflective operations. In the context of Figure 1, Alice does not own Bob but can still reflectively send messages to Bob. But she cannot introspect Bob to obtain a capability to his wallet.

Root Object as Superuser Because the direct ownership relation forms a tree, the object at the root indirectly owns all objects. Consequently, this root object has the permission to perform any reflective operation on any object. This root object can thus use development tools and perform dynamic on any object. For example, an application in production should be able to monitor all hash messages sent from each hash-table to determine which hash methods are slow or produce too many collisions. To perform such analysis this application should be able to reflect unrestrictedly on all its objects. At the same time, that same application may use a library that it does not trust completely. This library can use reflection but only on its own objects. About Ownership Transitivity. Unlike other notions of object ownership our ownership relation is transitive. This transitivity stems from the power of reflective abilities. Consider three objects A, B and C such that A directly owns B and B directly owns C. Even without this transitivity, A could exercise its full reflective power over B to change its behavior at will. Doing so, A could easily obtain B's authority to have full reflective power over C.

Implementation

To demonstrate our access control policy we consider its application in the context of a simple Metaobject Protocol 2 (MOP) [START_REF] Kiczales | The Art of the Metaobject Protocol[END_REF] for Pharo, a programming language and environment of the Smalltalk family. A MOP is an object-oriented model of the interpreter of the host language. A MOP provides behavioral intercession by allowing the substitution of default metaobjects by custom ones. This 2 http://rmod.lille.inria.fr/archives/demos/OwnershipMOP/mop.zip alters the interpretation of the program and thus the default semantics of the language. Here, each object behavior is described by a unique metaobject. The base-level object that a metaobject controls is called its referent. This kind of MOP has been described in detail in the literature [START_REF] Maes | Concepts and experiments in computational reflection[END_REF][START_REF] Ferber | Computational reflection in class-based object-oriented languages[END_REF][START_REF] Mostinckx | Mirror-based reflection in ambienttalk[END_REF]) and we refer to them as object-centric MOPs (sometime referred in literature as the metaobject model). In a class-based language with an objectcentric MOP, the metaobject of an object is distinct from its class: the metaobject is responsible for the interpretation of the structure the class defines.

Our MOP consists of the following reflective operations:

Object state introspection: via the method read: aVariableName.

Object state modification: via the method write: anObject in: aVariableName.

Message reception: via the method receive: aSelector3 withArguments: argumentArray.

Ownership Encoding

Conceptually, encoding ownership information consists in adding a directOwner instance variable to the root class Object.

In practice, Pharo's virtual machine imposes some limits on the memory layout of some special classes so we use an external table to map objects to their direct owner instead.

To initialize the direct owner of a newly-created object, this object receives the message initializeDirectOwner after instantiation. The default implementation of initializeDirec-tOwner determines the direct owner of the newly-created object by traversing the call-stack. The receiver associated with each stack frame receives the message wantsOwnership: with the new object as argument: the first receiver that answers true become the owner of the new object. The default implementation of wantsOwnership: in Object unconditionally returns true but a class can redefine this behavior if needed.

Customisation of Ownership Tree Construction. The construction of the ownership tree can be customized for different situations. In object-oriented design, some engineering practices, like Dependency Injection frameworks and design patterns such as Factory Method and Abstract Factory, strive for reducing coupling between software components. These practices have in common that instantiation is performed by a third party. If these practices are followed systematically, no object instantiates objects that are part of their representation. Without special care, the resulting ownership tree would be very large and very shallow. In this context, the object that instantiates another object has to be able to let its clients become owner of that newly-created object or to transfer ownership.

For example, a factory can let its clients become the owners of the object it creates by redefining wantsOwnership:

to answer false for the classes it instantiates. For example, a widget factory would implement wantsOwnership: as follows.

WidgetFactory>>wantsOwnership: anObject ^(anObject class inheritsFrom: Widget) not

Another situation where customisation of object ownership is desirable is when an inversion of control scheme takes place. This is for exemple the case of dependency injection frameworks where the framework has to be able to transfer ownership of the object it creates. Our implementation allows changing the direct owner of an object. This operation is only available from an object's metaobject, so only an owner of an object can change its direct owner.

Another situation where the ownership tree construction needs to be customized is when a class wants all its instances to be owned by the same object. This is the case of immutable objects denoting values, like numbers, characters, points, etc, that are unconditionally owned by the object nil, the root of the ownership tree. This saves some space by not using the ownership map for these objects.

Implementation of Ownership-based Access Control

Our ownership-based access control policy grants an object the permission to access the metaobjects of the objects it owns. When a subject requests the metaobject of a resource it does not own, the policy is to restrict the available reflective operations. Only the reflective operations that perform an action that could have been carried out without reflection are allowed, following the reflection protection principle. In the context of Pharo, where all instance variables are objectprivate and all methods are public, these restrictions only allow message reception. In our implementation, wrapper objects encapsulate metaobjects to enforce these restrictions.

The method meta implements the access control to metaobjects. This method is context-sensitive: it checks whether the sender of the message is an owner of the receiver or not. If the sender is not an owner the metaobject is wrapped. These access rules extends to metaobjects returned by reflective operations. For example, if the metaobject of an object A is about to return the metaobject of another object B that A does not own, the metaobject of A wraps the metaobject of B before returning it. Since a wrapped metaobject is used by clients that do not own the referent, a wrapped metaobject always return wrapped metaobjects.

Our access control policy does not need to be implemented with metaobject wrappers. The restrictions could be implemented in the metaobject directly. We choose the wrapper approach because it has two advantages. First, the implementation is simpler because only the method meta is context sensitive. If the restrictions were implemented in the metaobjects directly, each methods would have to check whether the corresponding reflective operation is permitted or not. This would imply code duplication and slower execution. Second, an object can choose to pass the metaobject of an object it owns to an external object it trusts. If the restrictions were implemented in the metaobjects, they would apply to the external object and prevent delegation of reflective rights as capabilities.

Also it should not be possible to use reflection to bypass the access control mechanism implementing our policy. In our context, this mechanism is the metaobject wrapper. So it should not be possible to reflect on a wrapper to leak its wrapped metaobject. To ensure this, the owner of a wrapper is its wrapped metaobject. If an object asking for a metaobject gets a wrapper, it means that it does not own the referent. Consequently it does not own the referent's metaobject, nor the wrapper. So if this same object asks for the metaobject of the wrapper, it will get another wrapper for the metaobject of the first wrapper.

The Policy at Work

We now show our policy at work, first with proxies, a reflective mechanism that can be used as an access control mechanism, then in the context of a reflective tower. Proxies shows that our policy enables the reflective implementation of a security mechanism and prevents reflection to be used to bypass this mechanism. Reflective towers shows that our policy can control reflection at any meta-level.

Proxy-based Behavioral Intercession. Performing behavioral intercession on an object consists in replacing its metaobject. Proxies provide another way to perform behavioral intercession at a finer-granularity [START_REF] Pascoe | Encapsulators: A new software paradigm in smalltalk-80[END_REF][START_REF] Büchi | wrappers[END_REF][START_REF] Eugster | Uniform proxies for Java[END_REF]Van Cutsem andMiller 2010, 2013;[START_REF] Peck | Ghost: A uniform and general-purpose proxy implementation[END_REF]. A proxy is an object whose behavior is defined in terms of the behavior of another object called its target. Instead of enabling some behavioral variation for every access to an object, a proxy object enables this behavioral variation for itself but not for its target. The target continues to behave regularly but the proxy can be passed around to scope the behavioral variation to certain client objects only. A proxy is like an alter-ego of its target with a different meta-level behavior.

Proxies can be provided as an independent language feature but in the context of an object-centric MOP a proxy is a pattern: a proxy is an object whose metaobject forwards some of its operation to the metaobject of its target. Figure 2 shows an example of proxy-based behavioral intercession via message interception. Bob has created a proxy for its credit card and passed it to Alice. When Alice sends a message to the proxy, the proxy can decide if it forwards the message to the credit card or not depending on the policy Bob chose to enforce: withdrawal limit, mere logging of the operations, revocation, etc. The policy applies to Alice who references the proxy but not to Bob who references the credit card directly.

Proxies are thus good candidates to implement access control. A proxy interposes an arbitrary policy between a client and a resource. OCap patterns like caretakers, facets or membranes [START_REF] Miller | Robust Composition: Towards a Unified Approach to Access Control and Concurrency Control[END_REF][START_REF] Van Cutsem | Trustworthy proxies[END_REF] . Bob has created a proxy for its credit card and passed it to Alice. When Alice sends a message to the proxy (1), the proxy sends a receive message to its metaobject with a reification of Alice message (2). The metaobject of the proxy can then decide whether to forward the message to the metaobject of the credit card (3). Bob can still use his credit card directly.

are naturally expressed with proxies. When using proxies as a security mechanism, one has to face the problem of leaking target references [START_REF] Eugster | Uniform proxies for Java[END_REF]). To avoid leaking its target object, a proxy should check if its target returns selfreferences and return itself instead. More generally, when a proxy implements a security policy, it is often desirable that the returned objects are also protected by the same policy. In this case a proxy has to ensure that the objects it returns are also wrapped with proxies implementing the same policy. Finally to avoid "Trojan Horse Attacks" [START_REF] Riechmann | Meta objects for access control: Extending capability-based security[END_REF], where the target pass itself or another supposedly protected object as argument to a potentially malicious object, a proxy can also wraps the arguments of the message it intercepts. These arguments are not wrapped to apply the security policy directly but to ensure that any object passed to them are. These wrapping rules are at the heart of membranes. A similar mechanism is described by Riechmann et al. and is discussed in Section 5. The creator (i.e., the direct owner) of a proxy has to be sure that no object apart its owners can bypass the policy the proxy enforces. In Figure 3 Alice asks Bob to lend her his credit card. Because Bob does not trust Alice entirely, he creates a proxy for his credit card to limit withdrawals to a certain amount. Alice hopes to bypass the withdrawal policy imposed by the proxy. To do so she asks the proxy for its metaobject to then access the metaobject of the proxy's target (i.e., the credit card). But since Alice does not own the proxy, she obtains a wrapper on the proxy's metaobject instead. The wrapper allows her to send messages to the proxy (as she 2) Bob creates a proxy for his credit card to limit withdrawals and returns it, (3) Alice asks for the metaobject of the proxy to leak the credit card (target of the proxy), (4) but Alice does not own the proxy: she obtains a wrapper on the metaobject of the proxy and cannot leak the credit card. can do at the base-level) but do not permit her to access the state of the proxy's metaobject to obtain a reference to the metaobject of Bob's credit card.

But the owner of a proxy does not have to own the target. In that case the proxy owner can only access a wrapper of the target's metaobject. Only message sends can be intercepted as it is the only operation that the proxy's metaobject can forward to the wrapper. This is enough to implement capability patterns such as caretakers, facets and membranes.

Reflective Tower. When performing reflection upon the meta-level, one attains the meta-meta-level (or meta-level 2). This is useful to record which meta-level operations are performed on an object (meta-tracing for optimization), to query the meta-level behavior for analysis, to debug the implementation of the meta-level, etc.

More generally one can reflect on the meta-level n at the meta-level n + 1. This virtually infinite stack of meta-levels is called a reflective tower [START_REF] Smith | Reflection and semantics in lisp[END_REF]. Each level interprets operations performed at the level below. The tower is not actually infinite: the host language interpreter takes over level reification whenever operations at a level n are interpreted according to the default semantics.

Reflective towers appear naturally in the context of an object-centric MOP. Each base-level object is the first floor of its own reflective tower. The metaobject of a base-level object belongs to meta-level 1. But like other objects, the behavior of a metaobject is also defined by another metaobject, which belongs to meta-level 2. The reflective tower is embodied by a virtually infinite chain of metaobjects as depicted in Figure 4.

The ability to jump from one meta-level to the meta-level above should not jeopardize the access control policy. That is to say that if the access control policy states that an object A has restricted access rights to the metaobject of another object B, A must not be able to circumvent this restriction by manipulating the metaobject of that metaobject. To ensure that, we customize ownership tree construction so that the direct owner of a metaobject is always its referent. Thereby, a metaobject at meta-level n owns its metaobject at meta-level n + 1. Consequently, an object owns all the metaobjects of its tower. It follows that only the owners of an object have the authority to reflect on this object at any level.

Related Work

Object Ownership. A lot of research has been done on object ownership through ownership types [START_REF] Clarke | Ownership types for flexible alias protection[END_REF][START_REF] Clarke | Simple ownership types for object containment[END_REF] and dynamic object ownership [START_REF] Gordon | Dynamic ownership in a dynamic language[END_REF][START_REF] Noble | Object ownership for dynamic alias protection[END_REF]. Originally, object ownership has been devised to control the effect of object aliasing. Later, many different ownership systems have been used for many other applications [START_REF] Clarke | Ownership types: A survey[END_REF]): concurrency control, memory management, security, etc.

Since our access control policy relies on ownership information, it would be interesting to leverage this information with other applications. The first application that comes to mind is object alias control since it is the original application of object ownership. So an interesting question is to know if an effective alias control discipline can be compatible with our access control policy.

This seems difficult because one principle of the original ownership-based alias control (known as the owner-asdominator discipline) is "no representation exposure". This means that external objects can not reference the representation objects of an aggregate. The transitivity of our ownership relation contradicts with this principle. An alias control discipline has to rely on a transitive ownership relation to be compatible with our access control policy to metaobjects.

Whether such alias control discipline can be devised or not remain an open question.

Security Mechanisms Implemented Reflectively Because of its ability to factor non-functional concerns, reflection has been used to implement security mechanisms. Ancona et al. provide an overview of these approach [START_REF] Ancona | Reflective authorization systems: Possibilities, benefits, and drawbacks[END_REF].

For example, Riechmann et al. [START_REF] Riechmann | Meta objects for access control: Extending capability-based security[END_REF] propose to extend the OCap model with Security Metaobjects (SMO). They note that the frequent exchange of object references make hard to check which part of an application can access a given capability. A SMO can be attached to an object reference to control the messages that can be performed via this reference. Also an SMO can attach itself or other SMOs to incoming references (message arguments) and outgoing references (message returns). They show how this facility can implement SMOs that implicitly propagate an access control policy to all exchanged references, in a similar fashion than membranes [START_REF] Miller | Robust Composition: Towards a Unified Approach to Access Control and Concurrency Control[END_REF][START_REF] Van Cutsem | Trustworthy proxies[END_REF]). Riechmann et al. later proposed an extension of this model in the context of a role-based access control mechanism [START_REF] Riechmann | Meta objects for access control: Role-based principals[END_REF]. In this extension, they use two kind SMOs: principal SMOs provides principal information that access control SMOs use to check access.

For any security mechanism that is implemented reflectively, it is important to ensure that reflection cannot be used to bypass them. Consequently these mechanisms must either rely on policies that forbid reflection except for their own implementation or rely on a reflective architecture that is already secured. We showed that our access control policy to reflective operations ensures that the access control policy of a proxy cannot be bypassed by subjects that do not own it. Since the functionality provided by SMOs can be emulated using a proxy-based approach, our access control policy can ensure that the resulting base-level access control policies cannot be bypassed reflectively.

Secure MOP. Caromel et al. (Caromel and Vayssière 2001;Caromel et al. 2001) presents concerns about MOP and security in the context of component-based applications in Java. These works do not concern the access control to reflective operations but the security implications of implementing a MOP within the security framework of Java. The security framework of Java is based on inspecting the call stack to determine whether the execution of a sensible operation is permitted or not. In this context, the type of MOP used greatly influences the necessary propagation of permissions from meta-level code to base-level code. This is problematic because the implementation of a MOP typically requires many permissions. The authors show that within a proxy-based run-time MOP, it is possible to capture the set of permissions before reflective calls and restore them after. MOP implementation gets more permission than base-level code even though the call stack contains stack frames from different levels.

Conclusion

We explored the problem of encapsulation violation caused by reflective operations and its implications on the OCap model. The tension between the need for object encapsulation on the one hand and the need of reflection on the other hand led us to the conclusion that we need a way to track when breaking into an encapsulation boundary is legitimate. To this end we have explored the concept of dynamic object ownership that has been originally used to tame object aliasing. Instead of object aliasing, we showed how this notion of object ownership can be used to design an access policy to reflective operations. Thanks to this access control policy, owners of an object can perform any reflective operations on that object. An object that does not own another target object can only perform reflective operations whose effect could have been carried out without reflection. This simple policy reconcile reflection and security in the context of multiple interacting software components.

We implemented this policy in the context of a prototype MOP. In this context, we showed that this policy can ensure that domain-level access-control policies, implemented reflectively with proxies, cannot be bypassed using reflection at any meta-level.

  Figure2. Bob has created a proxy for its credit card and passed it to Alice. When Alice sends a message to the proxy (1), the proxy sends a receive message to its metaobject with a reification of Alice message (2). The metaobject of the proxy can then decide whether to forward the message to the metaobject of the credit card (3). Bob can still use his credit card directly.

Figure 3 .

 3 Figure3. Proxy protection: (1) Alice asks Bob for his credit card, (2) Bob creates a proxy for his credit card to limit withdrawals and returns it, (3) Alice asks for the metaobject of the proxy to leak the credit card (target of the proxy), (4) but Alice does not own the proxy: she obtains a wrapper on the metaobject of the proxy and cannot leak the credit card.

Figure 4 .

 4 Figure 4. A chain of metaobjects forming a reflective tower with their respective owner. The owner of the object can reflect on this object at any level.

  An example showing the ownership relation. Bob and Alice each own their own wallet and credit card. Each wallet owns its respective linked-list and each linked-list own its respective nodes. Bob and Alice only refer to each other just like each node refers to its contents.

	Alice's			Bob's
	credit			credit
	card	...		card	...
	node	node	...	node	node	...
	Linked-			Linked-
	list			list
	Alice's			Bob's
	wallet			wallet
					Legend
	Alice			Bob	reference owner
	Figure 1.

Other methods are possible to specify the direct owner of an object e.g., with annotations.

In Smalltalk's terminology, a selector is the name of a method or a message.

Acknowledgments

We thank Walter Rudametkin for his valuable comments about this work and the French General Directorate for Armament (Direction Générale de l'Armement) for sponsoring.


Sabrina Tartu
email: tartu.sabrina@gmail.com

Adam Lendvai

Pierre Blévin

Dorte Herzke

Paco Bustamante

Geir Børge Moe

Wing Gabrielsen

Jan Ove Bustnes

Olivier Chastel

Geir Wing Gabrielsen

Increased adrenal responsiveness and delayed hatching date in relation to polychlorinated biphenyl exposure in Arctic-breeding black

Keywords: Corticosterone, ACTH, Dexamethasone, Adrenal gland, PCBs, Reproduction

à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Species breeding in extreme environments, such as Polar Regions, are often subjected to a wide range of stressors (e.g., harsh weather, unpredictable food shortage, presence of predators) and an efficient response to these various stressors is vital to ensure self or brood survival [START_REF] Wingfield | What are extreme environmental conditions and how do organisms cope with them?[END_REF][START_REF] Wingfield | Ecological processes and the ecology of stress: the impacts of abiotic environmental factors[END_REF]. At the endocrine level, an environmental perturbation will stimulate the hypothalamic-pituitary-adrenal (HPA) axis: specifically corticotropinreleasing hormone (CRH) will be released from the hypothalamus and will then stimulate the secretion of adrenocorticotropic hormone (ACTH) from the anterior pituitary, which in turn will activate the synthesis of glucocorticoid hormones (corticosterone in birds, CORT henceforth) from the adrenal cortex [START_REF] Wingfield | Ecological processes and the ecology of stress: the impacts of abiotic environmental factors[END_REF]. Concurrently, glucocorticoids will provide negative feedback signals for ACTH and CRH release [START_REF] Wingfield | Ecological processes and the ecology of stress: the impacts of abiotic environmental factors[END_REF]. This hormonal cascade will trigger an array of physiological and behavioral adjustments that shift energy investment away from reproduction and redirect it towards survival [START_REF] Wingfield | Reproduction and Resistance to Stress: When and How[END_REF]. In birds, CORT has therefore a strong connection with fitness traits such as breeding success, individual quality and survival (Angelier et al., 2009a[START_REF] Angelier | Hormonal correlates of individual quality in a long-lived bird: a test of the "corticosterone-fitness hypothesis[END_REF][START_REF] Bonier | Do baseline glucocorticoids predict fitness?[END_REF][START_REF] Bókony | Stress Response and the Value of Reproduction: Are Birds Prudent Parents?[END_REF][START_REF] Breuner | In search of relationships between the acute adrenocortical response and fitness[END_REF]Goutte et al., 2010aGoutte et al., , 2011b;;[START_REF] Lendvai | Reproduction and modulation of the stress response: an experimental test in the house sparrow[END_REF][START_REF] Kitaysky | Dynamics of food availability, body condition and physiological stress response in breeding Black-legged Kittiwakes[END_REF][START_REF] Schultner | Migration and stress during reproduction govern telomere dynamics in a seabird[END_REF]. Polar seabirds are top predators which often bear elevated levels of various environmental contaminants (e.g., [START_REF] Gabrielsen | Levels and effects of persistent organic pollutants in arctic animals[END_REF][START_REF] Verreault | The Svalbard Glaucous Gull as Bioindicator Species in the European Arctic: Insight from 35 Years of Contaminants Research[END_REF]. Contaminants are well present in aquatic biota [START_REF] Gabrielsen | Pollution in the Barents sea[END_REF] and diet is the principal route of contamination: persistent organic pollutant (POPs) which includes polychlorinated biphenyls (PCBs) and organochlorine pesticides (OCPs) and some heavy metals such as mercury (Hg) can bio-accumulate into individuals and bio-magnify along the food web (e.g., [START_REF] Dietz | Comparison of contaminants from different trophic levels and ecosystems[END_REF]. Several of these environmental contaminants are endocrine disruptors [START_REF] Ottinger | Assessing effects of environmental chemicals on neuroendocrine systems: potential mechanisms and functional outcomes[END_REF][START_REF] Tyler | Endocrine disruption in wildlife: a critical review of the evidence[END_REF]. Indeed those substances are able to mimic, antagonize, alter or modify endogenous hormone functions (e.g., Amaral [START_REF] Amaral Mendes | The endocrine disrupters: a major medical challenge[END_REF]. In free-living bird species, several studies have found significant relationships between contaminants and reproductive hormones such as steroids [START_REF] Colborn | Developmental effects of endocrine disrupting chemicals in wildlife and humans[END_REF][START_REF] Giesy | Review of the effects of endocrine-disrupting chemicals in birds[END_REF]Vos et al., 2000) and more recently with hormones from the HPA axis [START_REF] Nordstad | Relationships between POPs and baseline corticosterone levels in black-legged kittiwakes (Rissa tridactyla) across their breeding cycle[END_REF][START_REF] Tartu | The stress of being contaminated? Adrenocortical function and reproduction in relation to persistent organic pollutants in female black legged kittiwakes[END_REF]Tartu et al., , 2015a;;[START_REF] Verboven | Adrenocortical function of Arctic-breeding glaucous gulls in relation to persistent organic pollutants[END_REF]. Specifically, in black-legged kittiwakes Rissa tridactyla, baseline and stressinduced CORT levels were positively associated with ∑PCB concentrations [START_REF] Nordstad | Relationships between POPs and baseline corticosterone levels in black-legged kittiwakes (Rissa tridactyla) across their breeding cycle[END_REF][START_REF] Tartu | The stress of being contaminated? Adrenocortical function and reproduction in relation to persistent organic pollutants in female black legged kittiwakes[END_REF]Tartu et al., , 2015b)). Also, in the most PCB-exposed Arctic seabird species, the glaucous gull Larus hyperboreus, a higher POP burden (including 58 PCB congeners, organochlorine pesticides, brominated flame retardants and their metabolically-derived products) was associated with higher baseline CORT levels in both sexes [START_REF] Verboven | Adrenocortical function of Arctic-breeding glaucous gulls in relation to persistent organic pollutants[END_REF]. Moreover, in incubating snow petrels Pagodroma nivea, stress-induced CORT levels increased with increasing ∑POPs (including 7 PCBs congeners and organochlorine pesticides, Tartu et al., 2015a). However the mechanisms through which contaminants may influence CORT regulation are poorly known, it is likely that such compounds may disrupt one of the many steps of CORT regulation causing dysfunction of the HPA axis. For instance, energy costs related to detoxification of POPs (Parkinson and Ogilvie, 2008;[START_REF] Preston | Gene toxicology[END_REF] might stimulate CORT secretion. Additionally, the adrenal gland is suspected to be vulnerable to hazardous effects of POPs due to its high lipid content and multiple sites for interference [START_REF] Hinson | Effects of endocrine-disrupting chemicals on adrenal function[END_REF][START_REF] Odermatt | Glucocorticoid and mineralocorticoid action: Why should we consider influences by environmental chemicals?[END_REF].

When it comes to other environmental contaminants such as Hg, studies of seabirds' eggs from the Canadian Arctic show an increasing trend of Hg levels from 1975 to 2005 in several species [START_REF] Braune | Temporal trends of organochlorines and mercury in seabird eggs from the Canadian Arctic, 1975-2003[END_REF][START_REF] Mallory | Tracking contaminants in seabirds of Arctic Canada: Temporal and spatial insights[END_REF]. Hg is a well-known endocrine disruptor (reviewed in [START_REF] Tan | The endocrine effects of mercury in humans and wildlife[END_REF] and some studies on free-ranging birds have reported inconclusive patterns between CORT and Hg concentrations [START_REF] Franceschini | The corticosterone stress response and mercury contamination in free-living tree swallows, Tachycineta bicolor[END_REF][START_REF] Herring | Mercury Exposure May Suppress Baseline Corticosterone Levels in Juvenile Birds[END_REF]Tartu et al., 2015a;[START_REF] Wada | Suppressed Adrenocortical Responses and Thyroid Hormone Levels in Birds near a Mercury-Contaminated River[END_REF][START_REF] Wayland | Immune Function, Stress Response, and Body Condition in Arctic-Breeding Common Eiders in Relation to Cadmium, Mercury, and Selenium Concentrations[END_REF]. Specifically, in common eiders Somateria mollissima borealis, stress-induced CORT levels were not related to liver Hg concentrations [START_REF] Wayland | Immune Function, Stress Response, and Body Condition in Arctic-Breeding Common Eiders in Relation to Cadmium, Mercury, and Selenium Concentrations[END_REF], in adult tree swallows Tachycineta bicolor, baseline CORT concentrations were negatively related to blood Hg concentrations [START_REF] Franceschini | The corticosterone stress response and mercury contamination in free-living tree swallows, Tachycineta bicolor[END_REF] and in chicks sampled in a Hg contaminated area, stress-induced CORT levels were lowered compared to less contaminated chicks [START_REF] Wada | Suppressed Adrenocortical Responses and Thyroid Hormone Levels in Birds near a Mercury-Contaminated River[END_REF]. In Forster's tern chicks Sterna forsteri fecal CORT metabolites decreased with increasing blood Hg concentrations [START_REF] Herring | Mercury Exposure May Suppress Baseline Corticosterone Levels in Juvenile Birds[END_REF] and in snow petrels, baseline and stress-induced CORT concentrations were not related to blood Hg concentrations (Tartu et al., 2015a). Therefore, it is difficult to draw a general picture of contaminants-CORT relationships.

The aim of this study was to investigate the relationships between Hg, PCBs and OCPs and some aspects of the HPA axis of an Arctic seabird, the black-legged kittiwake (hereafter 'kittiwake'). Svalbard kittiwakes bear significant amounts of blood Hg, PCBs and OCPs [START_REF] Nordstad | Relationships between POPs and baseline corticosterone levels in black-legged kittiwakes (Rissa tridactyla) across their breeding cycle[END_REF][START_REF] Savinova | Chlorinated hydrocarbons in seabirds from the Barents sea area[END_REF][START_REF] Tartu | The stress of being contaminated? Adrenocortical function and reproduction in relation to persistent organic pollutants in female black legged kittiwakes[END_REF][START_REF] Tartu | The stress of being contaminated? Adrenocortical function and reproduction in relation to persistent organic pollutants in female black legged kittiwakes[END_REF], and three recent studies performed in the same breeding population where the present study was conducted have reported positive relationships between baseline and/or stress-induced CORT concentrations and blood PCB concentrations [START_REF] Nordstad | Relationships between POPs and baseline corticosterone levels in black-legged kittiwakes (Rissa tridactyla) across their breeding cycle[END_REF][START_REF] Tartu | The stress of being contaminated? Adrenocortical function and reproduction in relation to persistent organic pollutants in female black legged kittiwakes[END_REF]Tartu et al., , 2015b)). However, it is still unknown whether these positive relationships are due to an increased adrenocortical responsiveness, a decreased negative feedback during acute stress, or both.

We specifically tested whether different aspects of the HPA axis of incubating male kittiwakes were related to blood Hg, PCBs and OCPs concentrations. Males only were chosen since they are more contaminated than females [START_REF] Nordstad | Relationships between POPs and baseline corticosterone levels in black-legged kittiwakes (Rissa tridactyla) across their breeding cycle[END_REF][START_REF] Tartu | The stress of being contaminated? Adrenocortical function and reproduction in relation to persistent organic pollutants in female black legged kittiwakes[END_REF], thus hypothetically more susceptible to the hazardous effects of contaminants. To test these relationships, we measured the CORT response to a capture-restraint stress protocol [START_REF] Wingfield | Modulation of the adrenocortical response to stress in birds[END_REF] and birds were then injected with exogenous dexamethasone (DEX, a potent CORT receptor agonist, [START_REF] Astheimer | Gender and Seasonal Differences in the Adrenocortical Response to ACTH Challenge in an Arctic Passerine, Zonotrichia leucophrys gambelii[END_REF] to test the efficiency of the negative feedback. The purpose of the DEX injection was also to induce inhibitory feedback of the HPA axis, thereby reducing confounding effects of endogenous ACTH release. Whereupon birds were injected with exogenous ACTH, a protocol used in several bird species to test the adrenal responsiveness (Angelier et al., 2009b;[START_REF] Dickens | Initial transference of wild birds to captivity alters stress physiology[END_REF][START_REF] Rich | Exposure to chronic stress downregulates corticosterone responses to acute stressors[END_REF][START_REF] Schmidt | Regulation of the HPA axis is related to song complexity and measures of phenotypic quality in song sparrows[END_REF]. If the exacerbated CORT release is connected to a higher adrenal activity in the most contaminated kittiwakes [START_REF] Tartu | The stress of being contaminated? Adrenocortical function and reproduction in relation to persistent organic pollutants in female black legged kittiwakes[END_REF](Tartu et al., , 2015b)), we should observe a positive relationship between blood contaminant concentrations and plasma ACTH-induced CORT concentrations.

Furthermore, contaminants may represent stressors [START_REF] Bustnes | Antiparasite treatment removes negative effects of environmental pollutants on reproduction in an Arctic seabird[END_REF]; we therefore investigated the relationships between contaminant exposure and reproductive outputs such as hatching date and hatching success. We predicted that if Hg, PCBs or OCPs stimulate CORT secretion, and since reproductive phenology and success are influenced by CORT levels in kittiwakes (Goutte et al., 2011a), then clutch size, hatching date and hatching success would be negatively associated with blood contaminants.

Material and method

Ethic statement and study area

The sampling of birds was approved by the Governor of Svalbard and by the Norwegian Animal Research Authority (NARA, permit number 4214). The study was conducted at Kongsfjorden, Svalbard (78°54'N, 12°13'E) from June 19th to July 4th 2012 during the incubating period of kittiwakes.

CORT stress series: DEX and ACTH injections

Thirty-four male kittiwakes were caught on their nests with a noose at the end of a 5 m fishing rod. A first blood sample (ca. 0.2 ml) was collected immediately after capture, from the alar vein with a 1 ml heparinised syringe and a 25-gauge needle to assess baseline CORT concentrations (CORTBL henceforth). Bleeding time (i.e., time elapsed from capture to the end of the first blood sample: 2 min 24 s ± 28 s (SD) on average) was not related to CORTBL concentrations (GLM, F1,32 = 0.7, P = 0.395). Birds were then placed into a cloth bag and a second blood sample (ca. 0.2 ml) was collected from the alar vein 30 min later (30 min 13 s ± 1 min 22 s) to assess stress-induced CORT concentrations (CORT30min). Immediately following this blood sample, (30 min 58 s ± 1 min 26 s), 30 birds were injected with DEX then put back into the cloth bag. Fifteen minutes later, we collected a third blood sample (CORT45min, at 46 min 43 s ± 2 min 03 s) and then immediately injected ACTH (47 min 29 s ± 2 min 05 s), after which the birds were placed back into the bag again. Fifteen minutes following the ACTH injection (at 63 min 08 s ± 2 min 33 s), we collected a fourth and final blood sample (CORT60min). The volume of the final blood sample was 1.5 ml, and this sample was used to measure the concentration of contaminants (see below). All injections were given intramuscularly in the pectoral muscle. Concentrations were adapted to a body mass of 400 g, which was the average body mass of incubating male kittiwakes in 2011. We therefore injected 0.2 ml of DEX (Dexazone 2 mg/ml Virbac, France) and 0.1 ml porcine ACTH (Sigma Aldrich, 100 IU A6303 dissolved in 0.5 ml Ringer's physiological solution), to obtain doses of 1 mg/kg dexamethasone (DEX) and 50 IU/kg ACTH which are considered as sufficient to elicit maximal CORT decrease and increase, respectively in other bird species [START_REF] Dickens | Initial transference of wild birds to captivity alters stress physiology[END_REF][START_REF] Rich | Exposure to chronic stress downregulates corticosterone responses to acute stressors[END_REF][START_REF] Schmidt | Regulation of the HPA axis is related to song complexity and measures of phenotypic quality in song sparrows[END_REF].

The stress series were shortened compared to those used in laboratory studies: blood samples were collected 15 min after each injection versus 45 min normally used in song sparrows to elicit maximal CORT responses induced by DEX and ACTH [START_REF] Schmidt | Regulation of the HPA axis is related to song complexity and measures of phenotypic quality in song sparrows[END_REF].

We shortened the stress series to avoid leaving the nests unattended for a long period (which may increase the risk of the eggs being predated) sampled males were kept for 60 min (in total, from baseline sampling to post ACTH injection sample) versus 120 min in total in other studies (e.g., [START_REF] Schmidt | Regulation of the HPA axis is related to song complexity and measures of phenotypic quality in song sparrows[END_REF]. Four birds were used as control and injected Ringer's physiological solution to validate the effects of DEX and ACTH injections. We then calculated CORT induced changes following capture/handling protocol, DEX and ACTH injections. Stressinduced CORT: CORTSI = CORT30min -CORTBL; CORTDEX = CORT45min -CORT30min and CORTACTH = CORT60min -CORT45min. Since absolute CORT concentrations may vary with age as in other seabird species (e.g., Goutte et al., 2010b), we decided to consider relative differences although using absolute or relative CORT values is currently open to debate [START_REF] Romero | Physiological stress in ecology: lessons from biomedical research[END_REF].

Clutch size, hatching dates and hatching success

Kittiwakes were individually marked with metal rings and PVC plastic bands engraved with a three-letter code and fixed to the bird's tarsus for identification from a distance. Birds were weighed to the nearest 2 g using a Pesola spring balance, and their skull length (head + bill) was measured to the nearest 0.5 mm with a sliding calliper. For each bird we calculated a scaled mass index as a measure of body condition (Mi [L0/Li] b SMA), where Mi and Li are the body mass and the skull length of individual i respectively; bSMA is the scaling exponent estimated by the SMA regression of M on L; L0 is the average skull length, [START_REF] Peig | New perspectives for estimating body condition from mass/length data: the scaled mass index as an alternative method[END_REF].Kittiwakes were marked with spots of dye on the forehead to distinguish them from their partner during subsequent observation and then released. Using a mirror at the end of an 8 m fishing rod, we checked the whole plot (ca. 117 nests) every two days to monitor the clutch size, the exact hatching date for the first egg (thereafter called ''hatching date'') and the number of eggs that hatched. The exact hatching date of the first egg laid was obtained for 25 individuals (21 birds injected with DEX and ACTH and 4 birds injected with Ringer's physiological solution). For 9 individuals the nest content was not visible for several checks as the parents would not stand when we approached the mirror. Consequently, we were not able to monitor the precise hatching date. Hatching date could be related to POPs for 19 treated birds (for 2 individuals blood volumes were too small) and to Hg for the 25 birds. We then considered the ''hatching success'' binomially: 0 = no eggs at all have hatched and 1 = at least one egg has hatched.

Molecular sexing and hormone assay

For the 34 focal birds, blood samples were centrifuged, and plasma was decanted and stored at -20 °C until assayed. After centrifugation, red cells were kept frozen for molecular sexing as well as for Hg analysis. The sex was determined by polymerase chain reaction amplification of part of two highly conserved genes (CHD) present on the sex chromosomes at UMR 7372 -CNRS Université de La Rochelle, as detailed in [START_REF] Weimerskirch | Population sex ratio variation in a monogamous long-lived bird, the wandering albatross[END_REF].

Plasma concentrations of CORT were determined by radioimmunoassay at UMR 7372 -CNRS-Université de La Rochelle, as previously described [START_REF] Lormée | Sex-specific patterns in baseline corticosterone and body condition changes in breeding Red-footed Boobies Sula sula[END_REF]. The radioimmunoassay used to assay CORT has been validated for kittiwakes [START_REF] Angelier | Corticosterone and time-activity budget: an experiment with black-legged kittiwakes[END_REF][START_REF] Chastel | Modulation of prolactin but not corticosterone responses to stress in relation to parental effort in a long-lived bird[END_REF]Goutte et al., 2011a;[START_REF] Nordstad | Relationships between POPs and baseline corticosterone levels in black-legged kittiwakes (Rissa tridactyla) across their breeding cycle[END_REF]. All samples were run in one assay. To measure intra-assay variation, we included 4 different referents 10 times in the assay and kittiwake plasma samples from previous years. From this, the intra-assay variation was 6.7%. Plasma CORT levels were measured in baseline, stress-, DEX-(or control) and ACTHinduced (or control) CORT samples (Fig. 1).

POPs determination in plasma

POPs were analyzed from whole blood of 27 birds injected with DEX and ACTH, for MSD were performed as described by [START_REF] Herzke | Perfluorinated and other persistent halogenated organic compounds in European shag (Phalacrocorax aristotelis) and common eider (Somateria mollissima) from Norway: A suburban to remote pollutant gradient[END_REF]. The limit for detection (LoD) was threefold the signal-to-noise ratio, and for the compounds investigated the limit ranged from 1.1 to 632.7 pg/g wet weights (ww). For validation of the results, blanks (clean and empty glass tubes treated like a sample, 3 in total) were run for every 10 samples, while standard reference material (3 in total, 1589a human serum from NIST) also was run for every 10 samples. The accuracy of the method was between 70% and 108%. For further investigations, concentrations below LoD were assigned by LoD value, and only compounds detected in at least 70% of the individuals were included into the statistical analyses [START_REF] Noël | Persistent organic pollutants (POPs) in killer whales (Orcinus orca) from the Crozet Archipelago, southern Indian Ocean[END_REF]. In incubating male kittiwakes the following PCBs (CB-28, -99, -105, -118, -138, -153, -180, -183 and -187) and OCPs (p,p'-DDE, HCB, oxychlordane, trans-, cis-nonachlor and mirex) were detected in at least 70% of the individuals (means ± SD and ranges are given in Table 1).

Hg determination in red blood cells

Total Hg was measured for 34 individuals at LIENSs (La Rochelle), as described by [START_REF] Bustamante | Total and organic Hg concentrations in cephalopods from the North Eastern Atlantic waters: Influence of geographical origin and feeding ecology[END_REF] from freeze-dried and powdered red blood cells (hereafter called 'blood') in an Advanced Hg Analyzer spectrophotometer (Altec AMA 254). At least two aliquots ranging from 5 to 10 mg were analyzed for each individual and quality assessment was measured by repeated analyses of certified reference material TORT-2 (lobster hepatopancreas, NRCC; certified value 0.27 ± 0.06 µg/g with recoveries of 98-102%). Hg concentrations are expressed in µg/g dry weight (dw).

Statistics

All statistical analyses were performed using R 2.13.1 (R Development Core Team 2008). To validate the effects of DEX and ACTH injections on CORT secretion, we used generalized linear mixed models (GLMM) with bird identity as a random effect (dependent variable: 'CORT'; independent factors 'Time' and 'Treatment'). Then we tested whether CORT would vary following handling stress and injections (controls, DEX, ACTH) and tested whether CORT responses following DEX and ACTH injections were related to body mass and to the hour of the day. In order to do so, we used generalized linear models (GLM) with a normal error distribution and an identity link function. We summed POPs as follows: ∑PCBs (n = 9 congeners) and ∑OCPs (n = 6 congeners). First, we tested whether absolute concentration of 'CORTBL, CORT30min, CORT45min and CORT60min' and contaminants '∑PCBs, ∑OCPs and Hg'

were related to 'sampling date' and 'scaled mass index'. Second, we tested whether CORT responses to stress series 'CORTBL, CORTSI, CORTDEX and CORTACTH' were related to contaminants '∑PCBs, ∑OCPs and Hg' and. Finally, we tested if 'clutch size', 'hatching date' and 'hatching success' were related to 'scaled mass index' and contaminants '∑PCBs, ∑OCPs and Hg'. Clutch size and hatching success were tested using a GLM with a Poisson/binomial error distribution and a log/logit link function, respectively. Diagnostic plots were used to assess whether the data sufficiently met the assumptions of the model, ∑PCBs and ∑OCPs were log-

Results

CORT stress series

CORT concentrations were significantly related to the time of blood sampling, the treatment and their interaction (GLMM, time: F3,96 = 340.5, P < 0.001; treatment: F1,32 = 6.3, P = 0.017; time x treatment: F3,96 = 12.15, P < 0.001). Considering the significant relationship between the interaction of time x treatment on CORT: CORTBL and CORT30min were not different between ''treated'' and ''control'' birds (GLMM, CORTBL: F1,32 < 0.1, P = 0.846;

CORT30min: F1,32 = 0.1, P = 0.743) whereas CORT45min and CORT60min were significantly lower in the ''treated'' birds compared to the ''control'' birds (GLMM, CORT45min: F1,32 = 16.6, P < 0.001; CORT60min: F1,32 = 15.3, P < 0.001). In treated birds, CORT concentrations significantly increased following the capture-restraint protocol (GLMM, F1,29 = 449.3, P < 0.001) and CORT concentration significantly decreased over 15 min after the DEX injection (GLMM, F1,29 = 160.0, P < 0.001). Lastly, ACTH injection did not result in a significant increase of CORT within ~15 min of action (GLMM, F1,29 = 1.7, P = 0.208). However, we observed a large interindividual variation (Fig. 1A): for some individuals CORT concentration did not increase or even decreased following ACTH injection, yet in some kittiwakes CORT increased as depicted by positive CORT values on Fig. 2B. Incubating male kittiwakes were heavier than the average body mass used for DEX and ACTH concentrations (427.2 ± 31 g, range: 360-490), however, CORT responses were not related to body mass or to its interaction with time (GLMM, body mass: F1,32 = 0.18, P = 0.673; time x body mass: F3,96 = 0.76, P = 0.519). In control birds, CORT significantly increased following the capture-restraint protocol (GLMM, F1,3 = 78.5, P = 0.003) then remained steady (GLMM, from CORT30min to CORT45min F1,3 = 2.4, P = 0.220, from CORT45min to CORT60min, F1,3 < 0.1, P = 0.983 Fig. 1B). The hour of the day was not related to CORTDEX and CORTACTH (GLM, F1,28 = 0.4, P = 0.526 and F1,28 < 0.1, P = 0.986, respectively).

Contaminants and CORT in relation to sampling date and scaled mass index

Absolute concentrations of CORTBL, CORT30min, CORT45min and CORT60min were not related to sampling date nor to scaled mass index which was used as a measure of body condition (GLM, F1,28 < 1.3, P > 0.269 for all tests). Hg, ∑PCBs or ∑OCPs were not related to sampling date (GLM, Hg: F1,32 = 0.6, P = 0.428; ∑PCBs: F1,25 = 0.1, P = 0.745 and ∑OCPs:

GLM, F1,25 = 0.2, P = 0.674). Hg concentrations were not related to scaled mass index (GLM, F1,32 = 0.1, P = 0.757), however ∑PCBs and ∑OCPs increased with decreasing scaled mass index (GLM, ∑PCBs: F1,25 = 4.3, P = 0.048 and ∑OCPs F1,25 = 4.9, P = 0.037).

Relationships between the HPA activity and contaminants

CORTBL, CORTSI and CORTDEX (Fig. 2A) were not related to contaminants (Hg, ∑PCBs, ∑OCPs, Table 2). CORTACTH was not related to Hg or ∑OCPs (Table 2). However, CORTACTH was positively associated with ∑PCBs (Fig. 2B, Table 2).

Clutch size, hatching dates and hatching success in relation to scaled mass index and contaminants

Clutch size (1, 2 or 3 eggs were laid) was not related to scaled mass index (GLM, χ² < 0.1, P = 0.886) or contaminants (GLM, ∑PCBs: χ² = 0.1, P = 0.721; ∑OCPs: χ² < 0.1, P = 0.977 and Hg: χ² = 0.4, P = 0.529). Hatching date was not related to scaled mass index (GLM, F1,23 = 0.2, P = 0.663) but was positively related to ∑PCBs (GLM, F1,17 = 16.3, P < 0.001; Fig. 3) and ∑OCPs (GLM, F1,17 = 9.2, P = 0.008). The relationship between hatching date and Hg was only close to statistical significance (GLM, F1,23 = 3.4, P = 0.076). With regard to hatching success, individuals with no chicks that hatched tended to have a lower scaled mass index (GLM, χ² = 3.7, P = 0.055). Hatching success was not related to contaminants (GLM, ∑PCBs: χ² = 0.2, P = 0.635; ∑OCPs: χ² < 0.1, P = 0.820 and Hg: χ² < 0.1, P = 0.904).

Discussion

HPA activity and contaminants

The aim of this study was to test whether the positive association between CORT secretion and PCB contamination, which has been repeatedly observed in this Svalbard population of kittiwakes [START_REF] Nordstad | Relationships between POPs and baseline corticosterone levels in black-legged kittiwakes (Rissa tridactyla) across their breeding cycle[END_REF][START_REF] Tartu | The stress of being contaminated? Adrenocortical function and reproduction in relation to persistent organic pollutants in female black legged kittiwakes[END_REF]Tartu et al., , 2015b)), resulted from an inefficient negative feedback mechanism or from a higher adrenal activity. We also investigated if other contaminants (Hg or OCPs) would be related to some aspect of the HPA axis activity.

Contrary to what has been reported in previous studies on kittiwakes from the same breeding colony, we did not find any relationship between contaminants, CORTBL and CORTSI [START_REF] Nordstad | Relationships between POPs and baseline corticosterone levels in black-legged kittiwakes (Rissa tridactyla) across their breeding cycle[END_REF][START_REF] Tartu | The stress of being contaminated? Adrenocortical function and reproduction in relation to persistent organic pollutants in female black legged kittiwakes[END_REF]Tartu et al., , 2015b)). CORTDEX was not related to contaminants, suggesting that environmental contaminants may not alter the functioning of glucocorticoid receptors on the hypothalamus or the pituitary. According to our prediction, the adrenal responsiveness (CORTACTH) was positively associated to ∑PCBs in male kittiwakes.

Administration of a standardized dose of ACTH is an alternative approach to measure the stress response that is specifically due to variation in the sensitivity of the adrenal cortex to ACTH.

Response to exogenous ACTH may also provide a more accurate measure of glucocorticoid production than response to restraint stress [START_REF] Wada | Development of stress reactivity in white-crowned sparrow nestlings: Total corticosterone response increases with age, while free corticosterone response remains low[END_REF][START_REF] Schmidt | Regulation of the HPA axis is related to song complexity and measures of phenotypic quality in song sparrows[END_REF]. However, in some birds ACTH injection was not effective and CORT levels even decreased in birds with lower levels of PCBs. These results are surprising but could be the consequence of a too short time of action of ACTH or maybe the dose of ACTH we used was too low to elicit a maximal CORT release. The time necessary to elicit a maximal CORT release post-ACTH injection in song sparrows was 45 min (e.g., [START_REF] Schmidt | Regulation of the HPA axis is related to song complexity and measures of phenotypic quality in song sparrows[END_REF] and our experimental kittiwakes were only exposed for 15 min. Also we were not able to previously validate if the ACTH dose we used would elicit a maximal CORT release in kittiwakes. Further studies would be needed to test the dose-response between ACTH injection and CORT secretion in kittiwakes. However, relative CORT differences in response to ACTH injection (CORTACTH) were significantly related to blood PCB concentrations in incubating male kittiwakes. Consequently, this result suggests that the adrenal activity of male kittiwakes bearing high levels of PCBs is exacerbated.

An exacerbated adrenal activity may result from increased number of ACTH-receptors (ACTH-R) on the adrenals. In mammals, ACTH is one of the few polypeptide hormones having a positive trophic effect on its own receptors [START_REF] Penhoat | Corticotropin positively regulates its own receptors and cAMP response in cultured bovine adrenal cells[END_REF][START_REF] Beuschlein | ACTH-receptor expression, regulation and role in adrenocortial tumor formation[END_REF].

Although there is no evidence for such a relationship in birds, we may assume that a similar effect to what is observed in mammals would occur in birds. Thus, the positive association between adrenal activity and PCB contamination in kittiwakes may be related to an excess of ACTH input to adrenals. In experimental studies, causal effects of POPs on ACTH-R have already been described: PCB126 can increase ACTH-R levels in human adrenocortical cells [START_REF] Li | PCB126 Induces Differential Changes in Androgen, Cortisol, and Aldosterone Biosynthesis in Human Adrenocortical H295R Cells[END_REF], and a pesticide, the methyl thiophanate, could mimic ACTH and directly activate ACTH-R on the adrenal glands of lizards Podarcis sicula [START_REF] De Falco | The Effects of the Fungicide Methyl Thiophanate on Adrenal Gland Morphophysiology of the Lizard, Podarcis sicula[END_REF]. The present study and other recent findings on male and female kittiwakes [START_REF] Nordstad | Relationships between POPs and baseline corticosterone levels in black-legged kittiwakes (Rissa tridactyla) across their breeding cycle[END_REF][START_REF] Tartu | The stress of being contaminated? Adrenocortical function and reproduction in relation to persistent organic pollutants in female black legged kittiwakes[END_REF]Tartu et al., , 2015b) ) show that PCBs and not OCPs are associated with CORT secretion in this species and that Hg does not seem related to the adrenocortical response or to the adrenal activity in kittiwakes. Relationships between CORT and PCBs could also be environmentdependent. Indeed, in the present study, CORTBL or CORTSI were not related to PCBs contrary to results found in kittiwakes from the same breeding colony [START_REF] Nordstad | Relationships between POPs and baseline corticosterone levels in black-legged kittiwakes (Rissa tridactyla) across their breeding cycle[END_REF][START_REF] Tartu | The stress of being contaminated? Adrenocortical function and reproduction in relation to persistent organic pollutants in female black legged kittiwakes[END_REF]Tartu et al., , 2015b)). The nature of the relationship between CORT and PCBs could depend of the level of contamination (Tartu et al., 2015b). In 2011, when significant relationships were found between CORT (baseline and stress-induced levels) and ∑PCBs, the levels of some CB congeners differed: CB-28 and CB-194 were detected in less and more than 70% of the individuals, respectively. Seven individuals were caught in 2012 (the present study) and in 2011 and when considering indicator PCBs (i.e., which are highly bioaccumulative in a wide range of polar seabird species [START_REF] Gabrielsen | Chlorinated hydrocarbons in glaucous gulls (Larus hyperboreus) in the southern part of Svalbard[END_REF][START_REF] Savinova | Chlorinated hydrocarbons in seabirds from the Barents sea area[END_REF], the levels were significantly lower in 2012 than in 2011 (GLMM, F1,6 = 14.21, P = 0.009). If we consider that CORT-PCB relationships could depend of the level of contamination, and follow an inverted U-shaped pattern as depicted by Tartu et al., 2015b, we may suppose that at lower concentrations PCBs may stimulate CORT secretion whereas at higher concentrations the relationship between CORT and PCBs could reach a plateau and therefore not be observable. In the present study, ∑POPs significantly increased with decreasing body-condition as depicted by scaled mass index. Since POPs are stored into fatty tissues it is not surprising that male kittiwakes with poor body reserves show higher concentrations of PCBs and OCPs in their plasma. Such relationships have been observed in several bird species, such as kittiwakes [START_REF] Henriksen | Levels and congener pattern of polychlorinated biphenyls in kittiwakes (Rissa tridactyla), in relation to mobilization of body-lipids associated with reproduction[END_REF][START_REF] Tartu | The stress of being contaminated? Adrenocortical function and reproduction in relation to persistent organic pollutants in female black legged kittiwakes[END_REF], glaucous gulls L. hyperboreus [START_REF] Sagerup | Persistent organic pollutants and mercury in dead and dying glaucous gulls (Larus hyperboreus) at Bjørnøya (Svalbard)[END_REF], common eiders Somateria mollissima [START_REF] Bustnes | Strongly increasing blood concentrations of lipid-soluble organochlorines in high arctic common eiders during incubation fast[END_REF][START_REF] Bustnes | Temporal Dynamics of Circulating Persistent Organic Pollutants in a Fasting Seabird under Different Environmental Conditions[END_REF], sparrowhawks Accipiter nisus [START_REF] Bogan | Redistribution of DDE in sparrowhawks during starvation[END_REF] and white-tailed eagle Haliaeetus albicilla [START_REF] Kenntner | Organochlorine contaminants in body tissue of free-ranging white-tailed eagles from northern regions of Germany[END_REF]. Body-condition in birds predicts a wide range of fitness related traits, such as incubation pattern, breeding success or survival (see [START_REF] Labocha | Morphometric indices of body condition in birds: a review[END_REF] for a review). And because lower body-condition is positively associated with blood POP concentrations, POPs could therefore become more available for more sensitive vital organs such as brain, kidneys and liver [START_REF] Henriksen | Levels and congener pattern of polychlorinated biphenyls in kittiwakes (Rissa tridactyla), in relation to mobilization of body-lipids associated with reproduction[END_REF][START_REF] Fuglei | Environmental contaminants in arctic foxes (Alopex lagopus) in Svalbard: Relationships with feeding ecology and body condition[END_REF].

Fitness in relation to contaminants

In our study, we observed a positive relationship between ∑PCBs, ∑OCPs and hatching date. The first egg of the most contaminated male kittiwakes hatched later in the season. The same pattern has been found in female south polar skuas Catharacta maccormicki (Bustnes et al., 2007). A delayed hatching date could be the consequence of an impaired incubation behavior. Previous studies on captive American kestrels Falco sparverius and free-ranging glaucous gulls have reported altered incubation behaviors in relation to increasing PCB burden [START_REF] Bustnes | Patterns of incubation and nest-site attentiveness in relation to organochlorine (PCB) contamination in glaucous gulls[END_REF][START_REF] Fisher | Behavioral variation and its consequences during incubation for American kestrels exposed to polychlorinated biphenyls[END_REF][START_REF] Verboven | Nest temperature and parental behaviour of Arctic-breeding glaucous gulls exposed to persistent organic pollutants[END_REF]. Although behavior and egglaying date were not measured in incubating male kittiwakes, we could assume that high PCBs and OCPs burden may alter incubation behavior leading in a delayed hatching date. Further studies would be needed to support this assumption. Contrary to our prediction, blood contaminants were not negatively associated with hatching success. However, in case of poor foraging conditions when CORT secretion is stimulated [START_REF] Kitaysky | Dynamics of food availability, body condition and physiological stress response in breeding Black-legged Kittiwakes[END_REF][START_REF] Goutte | Annual variation in the timing of breeding, pre-breeding foraging areas and corticosterone levels in an Arctic population of black-legged kittiwakes[END_REF], it is possible that male kittiwakes bearing high levels of PCBs would be more sensitive to environmental stress and would be less able to properly incubate their eggs than less polluted individuals. More generally, an exacerbated adrenal responsiveness to stress, as depicted by the CORT response to ACTH, often mirrors poor fitness related traits such as poor parental investment (Angelier et al., 2009a,b;[START_REF] Bókony | Stress Response and the Value of Reproduction: Are Birds Prudent Parents?[END_REF]Goutte et al., 2011b;[START_REF] Lendvai | Reproduction and modulation of the stress response: an experimental test in the house sparrow[END_REF] or lower adult survival [START_REF] Blas | Stress response during development predicts fitness in a wild, long lived vertebrate[END_REF]Goutte et al., 2010a;[START_REF] Romero | Using the reactive scope model to understand why stress physiology predicts survival during starvation in Galápagos marine iguanas[END_REF]. Thus, although most legacy POPs show decreasing trend in Arctic seabirds (e.g., [START_REF] Helgason | POPs) in seabird eggs from Northern Norway and Svalbard[END_REF], the prevalence of PCBs could make individuals more susceptible to other environmental stressors such as ongoing climate change [START_REF] Jenssen | Endocrine-Disrupting Chemicals and Climate Change: A Worst-Case Combination for Arctic Marine Mammals and Seabirds?[END_REF].

Table 1. Concentrations of red blood cells' Hg (µg/g dw) and whole blood persistent organic pollutants (pg/g ww) in incubating male black-legged kittiwakes.

Table 2. Parameter estimates for generalized linear models (GLM) assessing the relationships between contaminants (Hg, ∑PCBs and ∑OCPs) and A) [CORTBL], B) CORTSI, C) CORTDEX and D) CORTACTH in incubating male black-legged kittiwakes.

Bold values refer to statistically significant relationships (P < 0.05).

  three individuals blood volumes were too small for POP measurements. Analyses were performed at the Norwegian Institute for Air Research (NILU) in Tromsø and the following compounds were searched for: the PCBs, and the organochlorine pesticides (OCPs: o,p' DDT, p,p' DDT, p,p' DDE, o,p' DDE, o,p' DDD, p,p' DDD, α-, β-, γ-HCH, HCB, trans-, cis-chlordane, oxychlordane, trans-, cis-nonachlor and mirex). To a blood sample of 0.5-1.5 ml, an internal standard solution was added ( 13 C-labeled compounds from Cambridge Isotope Laboratories: Woburn, MA, USA). The sample was extracted twice with 6 ml of n-hexane, after denaturation with ethanol and a saturated solution of ammonium sulfate in water. Matrix removal on florisil columns, separation on an Agilent Technology 7890 GC and detection on an Agilent Technology 5975C

Figure 1 .

 1 Figure 1. Stress series to characterize the hypothalamo-pituitary-adrenal (HPA) activity in

Figure 2 .

 2 Figure 2. CORTDEX and CORTACTH in relation to ∑PCBs. In incubating male black-legged

Figure 3 .

 3 Figure 3. Hatching date in relation to ∑PCBs. In male black-legged kittiwakes increasing blood

Acknowledgments: This project was supported by Institut Polaire Français (IPEV project 330 to O. Chastel), Agence National de la Recherche (ANR project PolarTop to O. Chastel), the Norwegian Research Council and the FRAM Centre (COPOL to G.W. Gabrielsen & J.O. Bustnes) and Svalbard Science Forum (Arctic Field Grant 1786 to S. Tartu). The authors are grateful to the Plateforme Analyses Elémentaires for the access to their analytical facilities. The authors thank C. Parenteau, C. Trouvé, S. Dano, for their excellent technical assistance in hormones assays and molecular sexing, the NILU staff for their assistance during the chemical analyses, C. Churlaud and M. Brault-Favrou for their help in Hg determination, and two anonymous referees for their very useful comments on a previous version of the manuscript.