S Smaoui

F Mathieu

L Elleuch

Y Coppel

G Merlina

I Karray-Rebai

L Mellouli
email: lotfi.mallouli@cbs.rnrt.tn

Á L Elleuch

Á I Karray-Rebai

Á L Mellouli

F Mathieu De

Keywords: Streptomyces sp. TN256, Taxonomy, Bioactive compounds, Purification, Chemical characterization

A new actinomycete strain designated TN256, producing antimicrobial activity against pathogenic bacteria and fungi, was isolated from a Tunisian Saharan soil. Morphological and chemical studies indicated that strain TN256 belonged to the genus Streptomyces. Analysis of the 16S rDNA sequence of strain TN256 showed a similarity level ranging between 99.79 and 97.8% within Streptomyces microflavus DSM 40331 T and Streptomyces griseorubiginosus DSM 40469 T respectively. The comparison of its physiological characteristics showed significant differences with the nearest species. Combined analysis of the 16 S rRNA gene sequences (FN687758), fatty acids profile, and results of physiological and biochemical tests indicated that there were genotypic and phenotypic differentiations of that isolate from other Streptomyces species neighbours. These date strongly suggest that strain TN256 represents a novel species with the type strain Streptomyces TN256 (=CTM50228 T ).

Experimental validation by DNA-DNA hybridization would be required for conclusive confirmation. Four active products (1-4) were isolated from the culture broth of Streptomyces TN256 using various separation and purification steps and procedures. 1: N-[2-(1H-indol-3-yl)-2 oxo-ethyl] acetamide 'alkaloid' derivative; 2: di-(2-ethylhexyl) phthalate, a phthalate derivative; 3: 1-Nonadecene and 4: Cyclo (L-Pro-L-Tyr) a diketopiperazine 'DKP' derivative. The chemical structure of these four active compounds was established on the basis of spectroscopic studies NMR and by comparing with data from the literature. According to our biological studies, we showed in this work that the pure compounds (1-4) possess antibacterial and antifungal activities.

Taxonomy, purification and chemical characterization of four bioactive compounds from new Streptomyces sp. TN256 strain Introduction Actinomycetes are gram-positive, free living and saprophytic bacteria widely distributed in soil, water and colonizing plants. They show marked chemical and morphological diversity and form a distinct evolutionary line of organisms. They constitute a potential source of many bioactive compounds [START_REF] Vining | Secondary metabolism, inventive evolution and biochemical diversity-a review[END_REF]. The species belonging to the Streptomyces genus represent 50% of the total population of soil actinomycetes. Moreover, 75-80% of the commercially and medicinally useful antibiotics have been derived from this genus [START_REF] Miyadoh | Research on antibiotic screening in Japan over the last decade: a producing microorganisms approach[END_REF]. The classification of the genus Streptomyces in the current edition of Bergey's Manual of Systematic Bacteriology [START_REF] Williams | Bergey's manual of systematic bacteriology[END_REF]) is not based on the combination of genotypic and phenotypic properties, but on the extensive numerical taxonomic survey of [START_REF] Williams | Numerical classification of Streptomyces and related genera[END_REF]. Given the presence of a phylogenetic branching pattern, a combination of properties such as wall chemotype, peptidoglycan type, whole-cell sugars, fatty acid and phospholipid profiles, and menaquinones facilitate the delineation of actinomycete genera from neighboring taxa [START_REF] Kroppenstedt | Taxonomic revision of the actinomycete genera Actinomudura and Microtetruspora[END_REF]). The isolation of novel Streptomyces species is in great need as they are very potent producers of secondary metabolites [START_REF] Mellouli | Isolation, purification and partial characterization of antibacterial activities produced by a newly isolated Streptomyces sp. US24 strain[END_REF].

Streptomyces have been the most fruitful source of microorganisms for all types of bioactive metabolites that have important applications in human medicine and in agriculture [START_REF] Watve | How many antibiotics are produced by the genus Streptomyces?[END_REF]. The great number of diverse antibiotics that produce these bacteria can be classified in different ways based on bacterial spectrum, the type of biological activity and the chemical structure. This latter way is the most useful and several classes of antibiotics can be distinguished, as: alkaloid derivatives which possess a diverse range of biological activities, e.g. anticancer and antimicrobial [START_REF] Chatterjee | Phencomycin, a new antibiotic from a Streptomyces species HIL Y-9031725[END_REF][START_REF] Gebhardt | Endophenazines A-D, New phenazine antibiotics from the arthropod associated endosymbiont Streptomyces anulatus. Taxonomy, fermentation, isolation and biological activities[END_REF]; phthalate derivatives which are biologically active compounds [START_REF] Marchetti | Effects pf phtalate esters on actin cytoskeleton of Py1a rat osteoblasts[END_REF]; nonadecene compounds known for their antioxidant [START_REF] Yassa | Chemical composition and antioxidant activity of the extract and essential oil of Rosa damascena from Iran, population of Guilan[END_REF]) and antifungal activities [START_REF] El-Sakhawy | Composition and antimicrobial activity of the essential oil of Murraya exotica[END_REF]; diketopiperazine (DKP) derivatives having useful biological properties (Ben Ameur [START_REF] Ameur Mehdi | Purification and structure elucidation of two biologically active molecules from a new isolated Streptomyces sp. US24 strain[END_REF][START_REF] Ameur Mehdi | Purification and structure determination of four bioactive molecules from a newly isolated Streptomyces sp. TN97 strain[END_REF], etc. Despite the large number of species with validly published names, the genus Streptomyces as a whole is underspeciated [START_REF] Kim | Streptomyces avermitilis sp. nov., a taxonomic home for the avermectin-producing streptomycetes[END_REF]. Through molecular systematic data some established species described using phenotypic criteria should be reduced to synonyms of previously described species [START_REF] Lanoot | BOX-PCR fingerprinting as a powerful tool to reveal synonymous names in the genus Streptomyces. Emended descriptions are proposed for the species Streptomyces cinereorectus, S. fradiae, S. tricolor, S. columbiensis, S. filamentosus, S. vinaceus and S. phaeopurpureus[END_REF][START_REF] Liu | Classification of Streptomyces griseus (Krainsky 1914) Waksman and Henrici 1948 and related species and the transfer of 'Microstreptospora cinerea' to the genus Streptomyces as Streptomyces yanii sp. nov[END_REF]. Active molecules of Streptomyces species are generally extracellular and their isolation in highest purity from the complex fermentation broth needs the application of a combination of various separation steps such as solvent extraction, chemical precipitation, ion exchange chromatography, HPLC purification, etc.

In the present work, we describe the identification of a Streptomyces strain, designated TN256, isolated from a Tunisian Saharan soil sample by conventional and molecular methods as well as the description of extraction, purification (using different chromatographic techniques) and structure elucidation of four different bioactive molecules (1-4) from a liquid culture broth of this strain. The biological activities of these pure compounds are also addressed.

Materials and methods

Organisms

Strain TN256 was isolated from Saharan soil of Tunisia. The strain was maintained by cultivation on ISP 2 agar medium that contained: 4 g l -1 glucose, 4 g l -1 yeast extract, 5 g l -1 malt extract and vitamin-amino acid mixture (1 mg l -1 vitamin B1; 1 mg l -1 vitamin B2; 1 mg l -1 vitamin B6; 1 mg l -1 biotin; 1 mg l -1 nicotinic acid; 1 mg l -1 phenylalanine; 0.3 g l -1 alanine) at pH 7.2, incubated at 28°C for 2 weeks. The strain was maintained on yeast extract-malt extract-dextrose (YMD) agar medium at 4°C [START_REF] Williams | Isolation, purification, cultivation and preservation of actinomycetes[END_REF]. The isolate is screened for its ability to produce antimicrobial agents against Gram-positive and Gram-negative bacteria and filamentous fungi. Broth from the isolate was cultured in Bennett, medium that contained: 2.0 g l -1 peptone, 10.0 g l -1 glucose, 1.0 g l -1 yeast extract and 1.0 g l -1 beef extract at pH 7.5 for 3 days at 28°C.

Antimicrobial activity determination

Indicator microorganisms were grown overnight in LB medium at 30°C for Micrococcus luteus LB14110 (Grampositive bacterium) and at 37°C for Staphylococcus aureus ATCC 6538 (Gram-positive bacterium), Salmonella enterica ATCC43972 and Escherichia coli ATCC 8739 (Gram-negative bacteria), then diluted 1:100 in LB medium and incubated for 5 h under constant agitation on 200 rpm at the appropriate temperature. Fusarium sp. was grown in potato dextrose agar (PDA) for 7 days at 30°C. Spores were collected in sterile distilled water and then adjusted to a spore density of approximately 10 4 spores l -1 . Antimicrobial activities were determined by the agar diffusion test: a paper disk (8 mm Ø) was impregnated with 50 ll of the corresponding sample and then laid on the surface of an agar plate containing 3 ml of top agar inseeded with 40 ll of a 5-h-old culture of the corresponding microorganism. For antifungal activity against the Fusarium sp., 100 ll of spore suspension were added to 3 ml of top agar. After 2 h at 4°C, plates containing M. luteus LB 14110 and Fusarium sp. were incubated at 30°C and those inoculated with S. aureus ATCC 6538 and E. coli ATCC8739 were incubated overnight at 37°C. The antimicrobial activities of the four pure compounds (1-4) were determined under the same conditions mentioned above. The quantity used for each pure active compound was 50 lg per disk. Plates were examined for evidence of antimicrobial activities represented by a zone of growth inhibition of the corresponding indicator microorganisms around the paper disk. As negative control (NC), we have used the dry extract of the culture medium without inoculation with the studied Streptomyces sp. TN256 strain. This culture was incubated and treated exactly in the same conditions of those of the inoculated culture. As positive control (PC), we have used the active dry extract of the Streptomyces sp. TN262 strain. This strain has been isolated, identified and studied in our laboratory [START_REF] Elleuch | Bioactive secondary metabolites from a new terrestrial Streptomyces sp. TN262[END_REF]. The corresponding dry extract possesses inhibitory activity against the five used indicator microorganisms: Micrococcus luteus LB14110, Staphylococcus aureus ATCC 6538, Salmonella enterica ATCC43972, Escherichia coli ATCC 8739 and Fusarium sp. [START_REF] Elleuch | Bioactive secondary metabolites from a new terrestrial Streptomyces sp. TN262[END_REF].

Phenotypic characterization

The cultural characteristics and the colours of mature sporulating aerial and substrate mycelia were monitored on 7, 14 and 21 day-old cultures of the isolate TN256. These characteristics were tested on the bases of the observations made on International Streptomyces Project (ISP) media recommended by [START_REF] Shirling | Methods for characterization of Streptomyces species[END_REF], Bennett agar, nutrient agar and Sabouraud agar. Colour determination was carried out using ISCC-NBS colour charts [START_REF] Kenneth | Prepared research paper RP 2911, central natations for the revised ISCC-NBS color name blocks[END_REF]. Melanin production was tested in peptoneyeast extract-iron (ISP medium 6) agar and trypsine (ISP medium 7) agar.

Chemotaxonomic studies

Biomass for most of chemotaxonomic studies was obtained after incubation at 28°C for 3 days by growing in shake flasks of ISP 2 broth. The isomeric form of Diaminopimelic acid (DAP), glycine and sugars in the whole cell hydrolysates were analysed by TLC [START_REF] Staneck | Simplified approach to the identification of aerobic actinomycetes by thin-layer chromatography[END_REF]. Phospholipids were examined by two-dimensional TLC and identified using several spray reagents and through comigration with authentic standards [START_REF] Collins | Lipids in the classification and identification of coryneform bacteria containing peptidoglycan based on 2, 4-diaminobutyric acid[END_REF][START_REF] Minnikin | Fatty acid and polar lipid composition in the classification of Cellulomonas, Oerskovia and relatedtaxa[END_REF]. Biomass for a quantitative fatty acid analysis was prepared by scraping cell mass from plates containing trypticase soy broth (BBL; 3% w/v) and Bacto agar (Difco; 1.5% w/v), that had been incubated for 3 days at 28°C. Fatty acids were extracted, methylated and analysed by gas chromatography (GC) using the standard Microbial Identification System (MIDI) [START_REF] Sasser | Identification of bacteria by gas chromatography of cellular fatty acids[END_REF]).

Physiological tests

The ability of the strains to use 15 compounds as sole carbon sources and 16 compounds as sole nitrogen sources for energy and growth was examined on ISP medium 9 for 3 days at 28°C. Each source was added at a final concentration of 1% (w/v) and 0.1% (w/v) respectively. The utilization of sole carbon and sole nitrogen sources was investigated according to [START_REF] Shirling | Methods for characterization of Streptomyces species[END_REF] and [START_REF] Tsukamura | Adansonian classification of mycobacteria[END_REF]. Glycerol was used as carbon source when testing nitrogen sources [START_REF] Tsukamura | Adansonian classification of mycobacteria[END_REF]. Sodium salts (acetate, alginate, benzoate, butyrate, citrate, desoxycholate, hydrogen carbonate, nitrate, oxalate, perchlorate, propionate, pyruvate, succinate, sulfite, tartrate, tetraborate and thiosulfate) were added to a final concentration of 0.1% (w/v) for testing the ability to use a sole carbon source [START_REF] Gordon | Nocardia coeliaca, Nocardia autotrophica and the nocardin strains[END_REF]. The purpose of testing sodium salts was to study their effect in cellular growth and active secondary metabolites production. In this context, [START_REF] Voelker | Nitrogen source governs the patterns of growth and pristinamycin production in 'Streptomyces pristinaespiralis[END_REF] reported that the addition of sodium nitrate to the culture medium of the Streptomyces pristinaespiralis affect positively the pristinamycin production.

Esculin and arbutin (1.0% w/v) degradations were determined by the methods of [START_REF] Gordon | Nocardia coeliaca, Nocardia autotrophica and the nocardin strains[END_REF] at 28°C and examined after 3 days. The degradation of casein (1.0% w/v) was determined by the method of [START_REF] Gordon | Nocardia coeliaca, Nocardia autotrophica and the nocardin strains[END_REF] at 28°C and examined after 3, 7 and 14 days; clearing of the areas under and around the growth was scored as positive. Gelatin (0.4% w/v) and starch (1.0% w/v) degradations were read after 3 days in nutrient agar at 28°C by flooding plates with trichloroacetic acid (3.0% v/v) and iodine solutions [START_REF] Covan | Manual for identification of medical bacteria[END_REF] respectively, and scoring zones of clearing as positive.

The degradation of tyrosin, hypoxanthin, xanthin, adenine and guanine (1.0%, w/v) was investigated according to [START_REF] Gordon | Nocardia coeliaca, Nocardia autotrophica and the nocardin strains[END_REF] at 28°C, and observed at 14 and 21 days. The hydrolysis of Tween 80 was measured using the method of [START_REF] Sierra | A simple method for the detection of lipolytic activity of microorganisms and some observations on the influence of the contact between cells and fatty substrates[END_REF].

The effects of salt on growth were determined in TSB media supplemented with graded doses of sodium chloride (1, 4, 5, 7 and 10% w/v) at 28°C and examined after 3 days. Maximum sodium chloride concentration in the medium allowing any growth was recorded by [START_REF] Williams | Numerical classification of Streptomyces and related genera[END_REF].

Tolerance to temperatures (4, 10, 15, 25, 30, 37, 40, and 45°C) and pH (4.0 * 10.0 in 0.5 unit increments) were tested on ISP 2 agar plates incubated for 7-14 days.

Tolerance to lysozyme was examined using glycerol broth containing 0.005% lysozyme. After 2 and 4 weeks of incubation at 28°C, the cultures were observed for growth [START_REF] Gordon | Resistance to rifampin and lysozyme of strains of some species of Mycobacterium and Nocardia as a taxonomic tool[END_REF]. Tolerance to phenol (0.05, 0.1, 0.2, 0.5 and 1.0%), and sodium azide (0.001 and 0.01%) was tested using GYEA media [START_REF] Athalye | Numerical classification of Actinomadura and Nocardiopsis[END_REF] at 28°C and examined after 3 days.

Resistance to antibiotics was examined using: erythromycin, streptomycin, penicillin at (10 mg l -1 ), rifampicin, gentamicin, vancomycin at (5 mg l -1 ) and chloramphenicol, oxytetracyclin, kanamycin at (25 mg l -1 ) incorporated into glucose yeast extract agar (Lechevalier and Lechevalier 1970a, b) as a basal medium. Readings were taken at 28°C and examined after 1, 3, 7 and 14 days: organism is scored as resistant (?) when growth on the test plates was greater or equal to that of positive control plates lacking inhibitors and inhibition zones observed were scored as negative.

Genotypic characterization

DNA isolation and manipulation

Total DNA preparation from TN256 strain was carried out according to [START_REF] Hopwood | Genetic manipulation of Streptomyces: a laboratory manual[END_REF]. Small-scale plasmid preparations from E. coli were performed as described by [START_REF] Sambrook | Molecular cloning: a laboratory manual[END_REF]. Digestion with restriction endonucleases, separation of DNA fragments by agarose gel electrophoresis, dephosphorylation with alkaline calf intestinal phosphatase, ligation of DNA fragments, and transformation of E. coli were done according to [START_REF] Sambrook | Molecular cloning: a laboratory manual[END_REF].

PCR amplification of the 16S rRNA gene of TN256 strain PCR amplification of the 16S rRNA gene of TN256 strain was performed using two primers 5 0 -AGAGTTTGATCCTGG CTCAG-3 0 and 5 0 -AAGGAGGTGATCCAGCCGCA-3 0 as described by [START_REF] Edwards | Isolation and direct complete nucleotide determination of entire Table 4 Antimicrobial activities of compounds: (1) the N-[2-(1H-indol-3-yl)-2 oxo-ethyl] acetamide, (2) the di-(2-ethylhexyl) phthalate, (3) the 1-Nonadecene and (4) the Cyclo (L-Pro-L-Tyr) Test organism Diameter of inhibition zones (mm) 1 2 3 4[END_REF]. Approximately 200 ng of the genomic template DNA was used with 150 pmol of each primer per 50 ll reaction volume. To improve the denaturation of the DNA, 5% (v/v) DMSO was added to the reaction mixture. Amplification was performed in an automatedthermoclycer (Perkin Elmer) using 1 U Pfu DNA polymerase (Stratagene) and the recommended buffer system according to the following amplification profile: 94°C (3 min) followed by 45 cycles of denaturation at 94°C (30 s), annealing at 60°C (1 min), and extension at 72°C (3 min). The PCR reaction mix was analyzed by agarose gel electrophoresis, and the DNA of the expected size was purified and then cloned into pCR-Blunt vector yielding pLE1.

DNA sequencing and analysis

Nucleotide sequence of the 16S rRNA gene of TN256 strain was determined on both strands by an automated 3100 Genetic Analyzer (Applied Biosystems) using specific primers. Homology search was performed using BLAST Search algorithm. The nucleotide sequence of the whole 16S rRNA gene (1.430 pb) of TN256 strain has been assigned in the GenBank (EMBL) under accession number FN687758. Multiple sequence alignment was carried out using CLUSTAL W [START_REF] Thompson | The Clustal X windows interface: flexible strategies for multiple sequence alignment aided by quality analysis tools[END_REF]) at the European Bioinformatics Institute website (http://www.ebi.ac. uk/clustalw/). Phylogenetic analyses were performed using programs from the PHYLIP package [START_REF] Felsentein | Confidence limits on phylogenies: an approach using the bootstrap[END_REF] and phylogenetic tree was constructed by the neighbour joining (NJ) algorithm [START_REF] Saitou | The neighbour-joining method: a new method for reconstructing phylogenetic tree[END_REF] using Kimura 10-parameter distance. The robustness of the inferred tree was evaluated by bootstrap (100 replications).

Isolation and purification of antimicrobial products

Thirty litres of Bennett culture broth was centrifuged to remove the biomass. The cell-free supernatant was extracted with ethyl acetate (29) and the obtained organic extract was concentrated in vacuum to dryness, affording 3.0 g of a brown crude extract. The resulting dry extract was recuperated in 2 ml ethyl acetate and assayed against indicator microorganisms, by paper disk diffusion method. Preparative chromatography with silica gel plates (Merck Art. 5735, Kiesselgel 60F 254) was used for the partial purification of antimicrobial products. A dry crude extract, dissolved in ethyl acetate, was spotted and developed in the solvent system dichloromethane-methanol (96:4 v/v). The developed plates were air dried overnight to remove all traces of solvents. Seven well separated bands were visualized under UV at 254 nm (absorbance) and at 365 nm (fluorescence) and for each band the corresponding compounds were recovered yielding seven fractions (FI-FVII). These fractions were tested for their biological activity against indicator microorganisms using the paper disk diffusion method. Four fractions possess biological activity (FI, FIII, FV and FVII) and their retention factor (Rf) were measured. The active fractions of all prepared plates were collected separately, concentrated (FI 228 mg; FIII 133 mg; FV 189 mg and FVII 205 mg) and then fractioned by HPLC (waters: controller 600, pump 600, dual k absorption detector 2487, Linear Recorder); column C18 (250 9 7) 8 mm UP ODS). Elution was at a flow rate of 1 ml min -1 with a linear gradient of two solutions A (water) and B (acetonitrile) from 100% buffer A to 50% buffer A and 50% buffer B over the first 35 min, followed by a linear gradient to 100% buffer B from 35 to 45 min. Detection was carried out by using a wavelength of 280 nm. For each active fraction, different well-developed peaks having a retention time between 5 min and 45 min were collected separately, concentrated and then tested for the inhibitory activity against the used indicator microorganisms. The four pure active products (1-4) were obtained as follow. 1 (58.33 mg) from FI; 2 (18 mg) from FIII; 3 (23.8 mg) from FV and 4 (33 mg) from FVII.

Characterization of compounds

NMR sample was prepared by dissolving the pure compounds (1-4) in 600 ll of CD 3 OD. 1D and 2D 1 H and 13 C experiments were recorded on a Bruker Avance 500 spectrometer equipped with a 5 mm triple resonance inverse Z-gradient probe (TBI 1 H, 31 P, BB) or a Bruker Avance 600 spectrometer equipped with a 5 mm triple resonance inverse (TCI 1 H, 13 C, 15 N) Z-gradient cryoprobe. All chemical shifts for 1 H and 13 C are relative to TMS using 1 H (residual) or 13 C chemical shifts of the solvent as a secondary standard. The temperature was set at 298 K. All the 1 H and 13 C signals were assigned on the basis of chemical shifts, spin-spin coupling constants, splitting patterns and signal intensities, and by using 1 H-1 H COSY, 1 H-1 H NOESY, 1 H-13 C HMQC and 1 H-13 C HMBC experiments.

Results and discussion

Morphology characteristics

Strain TN256 was a Gram-positive bacterium. Morphological observation of the 7-15 day old culture of strain TN256 grown on yeast -malt extract agar (ISP2) [START_REF] Shirling | Methods for characterization of Streptomyces species[END_REF] revealed that both aerial and vegetative hyphae were abundant. The isolate developed well on several media including ISP2, ISP3, ISP4, ISP5, Bennett agar and nutrient agar. The detailed cultural characteristics of strain TN256 are given in Table 1. Aerial mycelium was abundant, well-developed and varied from white to yellow on all media tested. The substrate hyphae varied from yellowish white to yellowish brown. Diffusible pigments were not produced on any tested media and melanin was not produced. Strain Streptomyces sp. TN256 (TN256) has been deposited in the CTM under the number CTM50228 T .

Chemotaxonomic analysis

The cell wall peptidoglycan of strain TN256 contained only LL-diaminopimelic acid and glycine, indicating that strain TN256 has a chemotype cell-wall type I (Lechevalier and Lechevalier 1970a, b). The diagnostic phospholipids was phosphatidylethanolamine (PE) (phospholipids type II sensu Lechevalier and Lechevalier 1970b). No diagnostic sugars were found in the cell wall constituents. The fatty acid profile included mainly saturated iso-and anteisobranched-chain and straight-chain fatty acids (fatty acid type 2c sensu [START_REF] Kroppenstedt | Fatty acid and menaquinone analysis of actinomycetes and related organisms[END_REF]. The major cellular fatty acids were C 14:0 2-OH (12.08%), C 14:0 3-OH (24.19%) and C 16:0 (43.12%), and smaller amounts of C 15:0 (2.84%), anteiso C 15:0 (1.18%), iso C 16:0 (3.52%), C 16:0 2-OH (6.81%), C 16:1 w 9 (2.45%) and iso C 17:0 (2.03%) were also present. The chemical and morphological properties of strain TN256 are clearly consistent with its assignment to the genus Streptomyces [START_REF] Williams | Bergey's manual of systematic bacteriology[END_REF]).

Phylogenetic analysis

The almost complete 16S rRNA gene sequence of strain TN256 (1.430 nucleotides) was determined in this study and has been deposited in the GenBank database (FN687758). This sequence was subjected to similarity searches against public databases to infer possible phylogenetic relationships of strain TN256. The phylogenetic tree (Fig. 1) from representative strains of the related species indicated that strain TN256 should be placed in the genus Streptomyces. In the comparison of 16S rRNA gene sequences, TN256 was mostly related with Streptomyces microflavus DSM 40331 T (NBRC 13062 T ) (99.79%) and Streptomyces griseorubiginosus DSM 40469 T (NBRC 13047 T ) (99.71%). Strain TN256 T also shared relatively high 16S rRNA gene sequence similarity values with the type strains of Streptomyces griseus NBRC 13350 T and Streptomyces erumpens NBRC 15403 T (99.36%).

Physiological characteristics

A comparative study between strain TN256 T and closely related species of the genus Streptomyces revealed that it differed from Streptomyces microflavus DSM 40331 T and Streptomyces griseorubiginosus DSM 40469 T in morphological and cultural characteristics as summarised in Table 2.

The three strains of Streptomyces share some physiological characters like utilization of sole carbon and nitrogen sources: L-arabinose, D-galactose, glucose, glycerol, Meso-Inositol, D-xylose, sucrose, D-trehalose and D-ribose (sole carbon sources) and L-aspartic acid, L-alanine, L-tryptophane, L-tyrosine, L-histidine, L-isoleucine, L-methionine, L-phenylalanine, L-proline, L-serine, L-threonine and L-glutamic acid (sole nitrogen sources). The differences consisted of the degradation of D-fructose, D-lactose, L-rhamnose, D-mannose, D-raffinose and maltose (sole carbon sources). L-asparagine, L-leucine, L-cysteine and L-arginine (sole nitrogen sources).

The aerial mycelium of strain TN256 T varied from yellow to white. In contrast, the substrate mycelium of strain TN256 T is yellow, Streptomyces microflavus DSM 40331 T and Streptomyces griseorubiginosus DSM 40469 T are greyish yellow. In any cases, soluble pigments were not produced.

Growth of the three Streptomyces strains (TN256 T , DSM 40331 T and DSM 40469 T ) was observed at a wide range of temperatures (30-40°C) and concerning the TN256 T strain, the optimal temperature of growth was ranged between 30 and 35°C. The pH range for the growth of the Streptomyces microflavus DSM 40331 T and the Streptomyces griseorubiginosus DSM 40469 T was between pH 5-8, however for the studied TN256 T strain, the pH range for the growth between 5 and 9 with an optimum at 7.5. The two strains TN256 T and Streptomyces griseorubiginosus DSM 40469 T were capable to grow in the presence of 7% NaCl and 0.2% of phenol while Streptomyces microflavus DSM 40331 T , grow only in the presence of maximum 5% NaCl but tolerate 0.5% of phenol. In addition, the three Streptomyces strains reduced nitrate to nitrite and degraded starch, casein, gelatin and adenine. Contrary to strains DSM 40331 T and DSM 40469T, the studied TN256 T strain was not able to degrade guanine.

The detailed fatty acid profile of strain TN256 T given in Table 3 was clearly different from that of Streptomyces microflavus DSM 40331 T and Streptomyces griseorubiginosus DSM 40469 T . For Streptomyces microflavus DSM 40331 T , the major cellular fatty acids were C 14:0 3-OH (28.93%) and C 16:0 (33.64%), and smaller amounts of C 14:0 2-OH (7.39%) and iso C 16:0 (9.87%). For Streptomyces griseorubiginosus DSM 40469 T , The major cellular fatty acids were C 14:0 2-OH (23.27%) and C 14:0 3-OH (35.71%) and smaller amounts of iso C 16:0 (11.79%) and C 16:0 2-OH (12.78%).

Genotypic and phenotypic results strongly suggest that strain TN256 is a new species of the genus Streptomyces, for which the name Streptomyces sp. TN256. Nevertheless, experimental validation by DNA-DNA hybridization would be required for conclusive confirmation.

Isolation and structural elucidation of antimicrobial compounds

Compound 1: N-[2-(1H-indol-3-yl)-2 oxo-ethyl] acetamide (1), was obtained as a white coloured solid. In CD 3 OD, the HSQC and HMBC spectra show 10 carbon signals.

From the 13 C data, it was possible to discern one ketone (d c 190.3), one carbonyl group (d c 172.2), six sp 2 -hybridized carbons (d c from 132.5 to 111.3), one sp 3 -hybridized carbon bearing an electronegative heteroatom (d c 45.5) and one methyl group (d c 21.1). From observed HMBC and NOE correlations (Fig. 2) compound 1 and based on the revealed spectral data and search in AntiBase was identified as N-[2-(1H-indol-3-yl)-2 oxo-ethyl] acetamide (Fig. 2). The corresponding molecular formula is C 12 H 12 O 2 N 2 with a MW of 216. Compound 2: Di-(2-ethylhexyl) phthalate ( 2) was obtained as a white coloured solid. In CD 3 OD, the 13 C and HSQC spectra show 12 carbon signals. From the 13 C data, it was possible to discern one carbonyl group (d c 168.0), three sp 2 -hybridized carbons (d c 132.3, 130.9 and 128.3), one sp 3 -hybridized carbon bearing an electronegative heteroatom (d c 67.6), five sp 3 -hybridized carbon (d c 38.7-23.5) and two methyl groups (d c 12.9 and 10.0). The 1 H NMR spectrum showed a characteristic AA'BB' system at 7.74 and 7.64 ppm (J AA' = 0.7 Hz, J AB = J A'- B' = J BB' = 7.8 Hz and J AB' = J A'B = 1.1 Hz obtained from simulation). These data established a compound that have a di ortho-substitued aromatic ring. The 2D 1 H-1 H and 1 H-13 C correlations and based on the revealed spectral data and search in AntiBase permitted to determine that the compound is Di-(2-ethylhexyl) phthalate (Fig. 3). The corresponding molecular formula is C 24 H 38 O 4 with a MW of 390. Compound 3: 1-Nonadecene (3) was obtained as a white coloured solid. In CD 3 OD, the combined analysis of 1 H, 13 C and HSQC spectra showed that compound 3 contain two sp 2 -hybridized carbons (d c 139.2 and 113.2), 16 sp 3 -hybridized carbon (d c 33.4-22.7) and one methyl group (d c 12.9). The structure of compound 3 was identified as 1-Nonadecene (Fig. 4). Compound 4: Cyclo (L-Pro-L-Tyr) (4) was obtained as a yellowish UV-absorbing solid. In CD 3 OD, the 13 C and HSQC spectra show 12 carbon signals. From the 13 C data, it was possible to discern two carbonyl groups (d c 169.2 and 165.5), four sp 2 -hybridized carbons (d c from 156.4 to 114.7), three sp 3 -hybridized carbons bearing an electronegative heteroatom (d c 58.7, 56.4 and 44.4), three sp 3hybridized carbon (d c 36.3, 27.9 and 21.2). The 2D 1 H-1 H and 1 H-13 C experiments permitted to assigned two fragments to proline and tyrosine. The structure of compound 4 was determined to be cyclo (L-Pro-L-Tyr) (Fig. 5). The corresponding molecular formula is C 14 H 16 O 3 N 2 with a MW of 260.

1 H NMR (CD 3 OD, 500 MHz) d 7.06 (2H, d, J = 8.6, Tyr-H5), d 6.72 (2H, d, J = 8.6 Tyr-H6), d 4.38 (1H, dd, J = 5.2, 4.7, Tyr-H2), d 4.08 (1H, dd, J = 11.0, 6.3, Pro-H2), d 3.58 (1H, m, Pro-H5), 3.38 (1H, m, Pro-H5), d 3.10 (1H, dd, J = 14.0, 5.2, Tyr-H3), 3.05 (1H, dd, J = 14.0, 4.7, Tyr-H3), 2.12 (1H, m, Pro-H3), 1.83 (2H, m, Pro-H4), 1.25 (1H, m, Pro-H3); 13

Biological activities of the four characterised compounds

The new isolated Streptomyces sp. strain TN256 produced simultaneously four active compounds belonging to four different structure types.

The first active compound (1) is the N-[2-(1H-indol-3yl)-2 oxo-ethyl] acetamide, an alkaloid indole derivative. This active molecule has been already described from Streptomyces sp. [START_REF] Chatterjee | Phencomycin, a new antibiotic from a Streptomyces species HIL Y-9031725[END_REF][START_REF] Gebhardt | Endophenazines A-D, New phenazine antibiotics from the arthropod associated endosymbiont Streptomyces anulatus. Taxonomy, fermentation, isolation and biological activities[END_REF] and terrestrial Pseudomonas sp. [START_REF] Ge | Phenazine-1carboxylic acid is negatively regulated and pyoluteorin positively regulated by gacA in Pseudomonas sp. M18[END_REF]) as well as marine Streptomycete [START_REF] Pusecker | Dihydrophencomycin methyl ester, a new phenazine derivative from a marine Streptomycete[END_REF]. Besides its antitumor activity, compound (1) possesses antimicrobial activities [START_REF] Chatterjee | Phencomycin, a new antibiotic from a Streptomyces species HIL Y-9031725[END_REF][START_REF] Gebhardt | Endophenazines A-D, New phenazine antibiotics from the arthropod associated endosymbiont Streptomyces anulatus. Taxonomy, fermentation, isolation and biological activities[END_REF]. According to our antimicrobial tests, we have observed that this compound presents antibacterial activities against Gram-positive and Gram-negative bacteria as well as antifungal activities (Table 4).

The second active compound produced by the Streptomyces sp. TN256 is the di-(2-ethylhexyl) phthalate (2). Phthalate compounds are petrochemicals used as plasticisers or solvents in a variety of industrial products. Nevertheless, many phthalate derivatives have been isolated from terrestrial and marine organisms including plants [START_REF] Lee | Anti-leukaemic and antimutagenic effects of di (2-ethylhexyl) phthalate isolated from Aloe linne[END_REF], fungal and bacterial culture broths, especially those belonging to the genus Streptomyces. Compound 2 has been already described from Streptomyces bangladeshiensis (Al- [START_REF] De | Characterization and antimicrobial activities of a phthalic acid derivative produced by Streptomyces bangladeshiensis a novel species collected in Bangladesh[END_REF]. Other phthalate derivatives have been isolated from Streptomyces species, such as the dibutyl phthalate (El-Naggar 1997; [START_REF] Roy | Dibutyl phthalate, the bioactive compound produced by Streptomyces albidoflavus 321.2[END_REF]. Phthalate derivatives which possess several antimicrobial activities are also effective compounds against demodicidosis, as well as endocrine disruptors with estrogenic activity [START_REF] Marchetti | Effects pf phtalate esters on actin cytoskeleton of Py1a rat osteoblasts[END_REF] and drug channelling agents [START_REF] Makhija | Controlled porosity osmotic pump-based controlled release systems of pseudoephedrine I. Cellulose acetate as a semipermeable membrane[END_REF]. Our antimicrobial studies show that compound 2 possesses antibacterial activities against Gram-positive bacteria and fungi (Table 4).

The third active molecule (3) is the 1-Nonadecene. This molecule was extracted from the plant Rosa damascene and possesses antioxidant activities [START_REF] Yassa | Chemical composition and antioxidant activity of the extract and essential oil of Rosa damascena from Iran, population of Guilan[END_REF]). The essential oils of fresh flowers, leaves and fruits of Murraya exotica L., contained the 1-Nonadecene, 4, we have observed that compound (3), in addition to its antifungal activity, this compound possesses antibacterial activities against Gram-positive bacteria. The fourth active compound (4) is the Cyclo (L-Pro-L-Tyr) a diketopiperazine (DKP) derivative. DKP derivatives, produced naturally by many organisms and microorganisms, display a very wide diversity of structures and biological functions, making them useful chemical entities for the discovery and development of new drugs. Useful biological properties have already been demonstrated for some of them, such as antibacterial, fungicidal, herbicidal, antiviral, immunosuppressor, antitumour activities, etc. [START_REF] Magyar | Identifying the bicyclomycin binding domain through biochemical analysis of antibiotic-resistant Rho proteins[END_REF]. Several DKP derivatives have been purified and characterised especially from Streptomyces species [START_REF] Rhee | Isolation and characterization of Streptomyces sp. KH-614 producing anti-VRE (vancomycin-resistant enterococci) antibiotics[END_REF][START_REF] Ameur Mehdi | Purification and structure elucidation of two biologically active molecules from a new isolated Streptomyces sp. US24 strain[END_REF], 2006). Concerning compound 4, it has been previously described as a natural product from Streptomyces species or obtained by chemical synthesis. According to our antimicrobial studies, compound 4 possesses antibacterial activities against Gram-positive and Gram-negative bacteria as well as antifungal activities (Table 4).

Conclusions

A new aerobic bacterium TN256 was isolated from Tunisian Saharan soil and has been selected for its antimicrobial activity against Gram-positive and Gram-negative bacteria and fungi. Based on the results of cellular morphology, physiological and chemotaxonomic characterization, nucleotide sequence analysis (1,430 pb) of the whole 16S rRNA gene (accession no. FN687758) of the TN256 strain and phylogenetic analysis, this isolate has been assigned as Streptomyces sp. TN256 strain (=CTM50228 T ). Four active compounds from the culture supernatant this strain where extracted, purified. The corresponding chemical structure of these active compounds was established by different spectroscopic techniques (HPLC, LCMS/MS and NMR) and compared with reference data. 1: N-[2-(1H-indol-3-yl)-2 oxo-ethyl] acetamide; 2: di-(2-ethylhexyl) phthalate; 3: 1-Nonadecene and 4: cyclo (L-Pro-L-Tyr). This study reveals that the strain TN256 is promising microorganism producing antibiotics and anti-tumor active compounds.

Fig. 1

 1 Fig. 1 Phylogenetic trees derived from 16S rDNA sequence of Streptomyces sp. TN256 strain. This strain was mostly related with Streptomyces microflavus DSM 40331 T and Streptomyces griseorubiginosus DSM 40469 T . All the sequences used here were from Streptomyces type strains. Numbers at nodes indicate levels of

  1 H NMR (CD 3 OD, 600 MHz) d 8.56 (1H, br s, NH-4), d 8.25 (1H, s, H5), d 8.24 (1H, d, J = 7.8, H6), d 7.26 (1H, m, H8), d 7.23 (1H, m, H7), d 7.48 (1H, d, J = 7.9, H9), d 4.61 (2H, s, H11), d 2.09 (3H, s, H15); 13 C NMR (CD 3 OD, 150 MHz) d 190.3 (C, C10), d 172.2 (C, C14), d 132.5 (CH, C5), d 122.9 (CH, C8), d 121.6 (CH, C7), d 121.3 (CH, C6), d 114.3 (C, C1), d 111.3 (CH, C9), d 45.5 (CH 2 , C11), d 21.1 (CH 3 , C15).

  1 H NMR (CD 3 OD, 500 MHz) d 7.74 (1H, m, H3), d 7.64 (1H, m, H4), d 4.25 (1H, dd, J = 10.8, 5.6, H1'), d 4.22 (1H, dd, J = 10.8, 6.0, H1'), d 1.71 (1H, m, H2'), d 1.46 (2H, m, H7'), d 1.40 (2H, m, H3'), d 1.36 (4H, m, H4',

  C NMR (CD 3 OD, 125 MHz) d 169.2 (C, Pro-C1), d 165.5 (C, Tyr-C1), d 156.4 (C, Tyr-C7), d 130.7 (CH, Tyr-C5), d 126.1 (C, Tyr-C4), d 114.7 (CH, Tyr-C6), d 58.7 (CH, Pro-C2), d 56.4 (CH, Tyr-C2), d 44.4 (CH 2 , Pro-C5), d 36.3 (CH 2 , Tyr-C3), d 27.9 (CH 2 , Pro-C3), d 21.2 (CH 2 , Pro-C4).

Fig. 5

 5 Fig. 4 Molecular structure of compound 3

Table 1

 1 Culture characteristics of strain TN256 T on various media

	Medium	Growth	Sporulation	Aerial mycelium	Substrate mycelium
	Yeast -malt extract agar (ISP T medium 2)	Good	Good	Yellow	Soft yellowish brown
	Oatmeal agar (ISP T medium 3)	Good	Good	White	Pale yellow
	Inorganic salt-starch agar (ISP T medium 4)	Moderate	Good	White	Soft yellowish white
	Glycerol-asparagine agar (ISP T medium 5)	Good	Good	Yellow	Moderate brown
	Bennett agar	Good	Good	Yellow	Pale yellow
	Nutrient agar	Good	Moderate	Yellow	Soft yellow
	Sabouraud agar	Moderate	Moderate	Yellow	Pale yellow

Table 3

 3 Cellular fatty acid contents (%) of (1) TN256; (2) Streptomyces griseorubiginosus DSM 40469 T ; (3) Streptomyces microflavus DSM 40331 T

							HMBC
							COSY
	Fatty acids	1	2	3			NOE	O
									NH
	C 10:0 2-OH	-	-	4.755
	C 11:0	-	-	1.032					O
	C 12:0	-	3.101	1.576
	C 12:0 2-OH	0.316	-	-
	C 12:0 3-OH	-	-	1.001
	C 13:0	0.579	-	1.78					N
	C 14:0	-	-	2.673					H
	C 14:0 2-OH	12.082	23.277	7.396
	C 14:0 3-OH	24.192	35.708	28.937	Fig. 2 HMBC, COSY and NOE correlations of compound 1
	C 15:0	2.846	4.104	1.277
	Iso C 15:0	-	-	-
	Anteiso C 15:0	1.184	4.639	-
	C 16:0	43.124	-	33.644
	Iso C 16:0	3.523	11.79	9.875
	C 16:0 2-OH	6.812	12.782	3.836
	C 16 :1 w 9	2.54	4.209	-
	C 17:0	2.035	-	2.212
	Iso C 17:0	0.515	-	-
	Anteiso C 17:0	-	-	-
	C 18:0	-	-	-
	C 18:1 w 9 (cis)	0.064	0.384	-
	C 18:1 w 9 (trans)	0.182	-	-
	C 18:2 w 9,12	-	-	-
	C 19:0	-	-	-
	Iso C 19:0	-	-	-
	C 20:0	-	-	-
						HMBC
						COSY
								O	7'
					4	3	2	1	O	1'	3'	5'
									O
								O
					Fig. 3 HMBC and COSY correlations of compound 2

Acknowledgments This work was supported by the CMCU project No: 06/S 0901 ''MELLOULI/AIGLE '' 2006-2009.


Joseph Pedersen

Rafael Muñoz Gómez

Jiangnan Huang

Haozhe Sun

Wei-Wei Tu

Isabelle Guyon

Rafael Mu Ñoz-Gómez

LTU Attacker for Membership Inference

à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Large companies are increasingly reluctant to let any information out, for fear of privacy attacks and possible ensuing lawsuits. Even government agencies and academic institutions, whose charter is to disseminate data and results publicly, must be careful. Hence, we are in great need of simple * Correspond to: joseph.m.pedersen@gmail.com and provably effective protocols to protect data, while ensuring that some utility can be derived from them. Though critical sensitive data must never leave the source organization (Source) -company, government, or academia -, an authorized researcher (Defender) may gain access to them within a secured environment to analyse them and produce models (Product). Source may desire to release Product, provided that desired levels of Utility and Privacy are met. We consider the most complete release of model information, including the Defender trainer, with all its settings, and the trained model. This enables "white-box attacks" from potential attackers (Nasr, Shokri, and Houmansadr 2019). We devise an evaluation apparatus to help Source in its decision whether or not to release Product (Figure 1). The setting considered is that of "membership inference attack", in which an attacker seeks to uncover whether given samples, distributed similarly as the Defender training dataset, belong or not to such dataset [START_REF] Shokri | Membership inference attacks against machine learning models[END_REF]. The apparatus includes an Evaluator and an LTU Attacker. The Evaluator performs a hold-out leave-two-unlabeled (LTU) evaluation, giving the LTU Attacker access to extensive information: all the Defender and Reserved data, except for the membership label of one sample from each. The contributions of our paper include this new evaluation apparatus. Its soundness is backed by some initial theoretical analyses and by preliminary experimental results, which indicate that Defender models can protect data privacy while retaining utility in such extreme attack conditions.

Related work

Membership inference attacks (MIA) have been extensively studied in the last years. [START_REF] Li | Membership privacy: a unifying framework for privacy definitions[END_REF]) developed a privacy framework called "Membership Privacy", establishing a family of related privacy definitions. [START_REF] Shokri | Membership inference attacks against machine learning models[END_REF] explored the first MIA scenario, in which an attacker has black-box query access to a classification model f and can obtain the prediction vector of the data record x given as input. (Long, Bindschaedler, and Gunter 2017) proposed a metric inspired from Differential Privacy to measure the privacy risk of each training record, based on the impact it has on the learning algorithm. Similarly, [START_REF] Song | Systematic evaluation of privacy risks of machine learning models[END_REF] incorporate a fine-grained analysis on his systematic evalua- tion of privacy risk. The Bayesian metric proposed is defined as the posterior probability that a given input sample is from the training set after observing the target model's behavior over that sample. [START_REF] Jayaraman | Revisiting membership inference under realistic assumptions[END_REF]) explores a more realistic scenario. They consider skewed priors where only a small fraction of the samples belong to the training set, and its attack strategy is focused on selecting the best inference thresholds. In contrast, our LTU Attacker is not trying to address a realistic scenario. [START_REF] Yeom | Privacy risk in machine learning: Analyzing the connection to overfitting[END_REF]) studied the connection between overfitting and membership inference, showing that overfitting is a sufficient condition to guarantee success of the adversary. [START_REF] Truex | Demystifying membership inference attacks in machine learning as a service[END_REF]) continued exploring MIAs in the blackbox model setting, considering different scenarios according to the prior knowledge that the adversary has about the training data: black-box, grey-box and white-box. Recent work also addressed membership inference attacks against generative models [START_REF] Hayes | Logan: Membership inference attacks against generative models[END_REF]Hilprecht, Härterich, and Bernau 2019;[START_REF] Chen | Gan-leaks: A taxonomy of membership inference attacks against generative models[END_REF]. This paper focuses on the attack of discriminative models in an 'all knowledgeable scenario', both from the point of view of model and data.

Several frameworks have been proposed to mitigate at-tacks, among which Differential Privacy [START_REF] Dwork | Calibrating noise to sensitivity in private data analysis[END_REF] has become a reference method. Work in [START_REF] Abadi | Deep learning with differential privacy[END_REF][START_REF] Xie | Differentially private generative adversarial network[END_REF] show how to implement this technique in deep learning. Using DP to protect against attacks comes at the cost of decreasing the model's utility. Regularization approaches have been investigated, in an effort to increase model robustness against privacy attacks, while retaining most utility. One of them inspired our idea to defend against attacks in an adversarial manner: Domain-adversarial training [START_REF] Ganin | Domain-adversarial training of neural networks[END_REF]) introduced in the context of domain adaptation. (Nasr, Shokri, and Houmansadr 2018) will later use this technique to defend against MIA. [START_REF] Huang | Damia: Leveraging domain adaptation as a defense against membership inference attacks[END_REF] helped bridge the gap between membership inference and domain adaptation. Most literature addressing MIA considers a black-box scenario, where the adversary only has access to the model through an API and very little knowledge about the training data. Closest to the scenario considered in this paper, the work of (Nasr, Shokri, and Houmansadr 2019) analyzes attackers having all information about the neural network under attack, including inner layer outputs; allowing them to exploit privacy vulnerabilities of the SGD algorithm. How-ever, contrary to the LTU Attacker we are introducing, the authors' adversary executes the attack in an unsupervised way; without having access to membership labels of any data sample. Bayes optimal strategies have been examined in [START_REF] Sablayrolles | White-box vs black-box: Bayes optimal strategies for membership inference[END_REF]; showing that, under some assumptions, the optimal inference depends only on the loss. Recent work in [START_REF] Liu | Mace: A flexible framework for membership privacy estimation in generative models[END_REF]) also aims to design the best possible adversary, defined in terms of the Bayes Optimal Classifier, to estimate privacy leakage of a model.

Problem statement and methodology

We consider the scenario in which an owner of a data Source D S wants to create a predictive model trained on some of those data, but needs to ensure that privacy is preserved.

In particular, we focus on privacy from membership inference. The data owner entrusts an agent called Defender with creating such a model, giving him access to a random sample D D ⊂ D S (Defender dataset). We denote by M D the trained model (Defender model) and by T D the algorithm used to train it (Defender trainer). The data owner wishes to release M D , and eventually T D , provided that certain standards of privacy and utility of M D and T D are met. To evaluate such utility and privacy, the data owner reserves a dataset D R ⊂ D S , disjoint from D D , and gives both D D and D R to a trustworthy Evaluator agent. The Evaluator tags the samples with dataset "membership labels": Defender or Reserved. Then, the Evaluator performs repeated rounds, consisting in randomly selecting one Defender sample d and one Reserved sample r, and giving to a LTU Attacker an almost perfect attack dataset D A = D D -{membership(d)} ∪ D R -{membership(r)}, removing only the membership labels of the two selected samples. The two unlabeled samples are referred to as u 1 and u 2 , with each being equally likely to be from the Defender dataset. We refer to this procedure as "Leave Two Unlabeled" (LTU), see Figure 1. The LTU Attacker also has access to the Defender trainer T D (with all its hyper-parameter settings), and the trained Defender model M D . He is tasked to correctly predict which of the two samples d and r belongs to D D (independently for each LTU round, forgetting everything at the end of a round).

We use the LTU membership classification accuracy A ltu from N independent LTU rounds (as defined above), to define a global privacy score as:

Privacy = min{2 (1 -A ltu ), 1} ± 2 A ltu (1 -A ltu )/N , (1)
where the error bar is an estimator of the standard error of the mean (approximating the Binomial law with the Normal law, see e.g. [START_REF] Guyon | What size test set gives good error rate estimates[END_REF]). The weaker the performance of the LTU Attacker (A ltu ≃ 0.5 for random guessing), the larger Privacy, and the better M D should be protected from attacks. We can also determine an individual membership inference privacy score for any sample d ∈ D D by using that sample for all N rounds, and only drawing r ∼ D R at random 1 (see example in Appendix C).

1 Similarly, we can determine an individual non-membership in-

The Evaluator also uses D uE = D R to evaluate the utility of the Defender model M D . We focus on multi-class classification, and measure utility with the classification accuracy A D of M D , defining utility as:

Utility = max{(c A D -1)/(c -1), 0} ± c A D (1 -A D )/|D R | , ( 2
)
where c is the number of classes.

While the LTU Attacker is all knowledgeable, we still need to endow it with an algorithm to make membership predictions. In Figure 2 we propose a taxonomy of LTU Attackers. In each LTU round, let u 1 and u 2 be the samples that were deprived of their labels. The taxonomy has 2 branches: • Attack on M D alone: (1) Simply use a generalization

Gap-attacker, which classifies u 1 as belonging to

D D if the loss function of M D (u 1 ) is smaller than that of M D (u 2 ) (works well if M D overfits D D ); or, ( 2

Theoretical analysis of naïve attackers

We present several theorems outlining weaknesses of the Defender that are particularly easy to exploit by a black-box LTU Attacker, not requiring training a sophisticated attack model M A (we refer to such attackers as "naïve"). First, we prove, in the context of the LTU procedure, theorems related to an already known result connecting privacy and over-fitting: Defender trainers that overfit the Defender data lend themselves to easy attacks [START_REF] Yeom | Privacy risk in machine learning: Analyzing the connection to overfitting[END_REF]). The attacker can simply exploit the loss function of the Defender (which should be larger on Reserved data than on Defender ference privacy score for any sample r ∈ DR by using that sample for all N rounds, and only drawing d at random. We show that the LTU Attacker can defeat them with 100% accuracy, under mild assumptions. Thus Defenders must introduce some randomness in their training algorithm to be robust against such attacks [START_REF] Dwork | Calibrating noise to sensitivity in private data analysis[END_REF].

Throughout this analysis, we use the fact that our LTU methodology simplifies the work for the LTU Attacker since it is always presented with pairs of samples for which exactly one is in the Defender data. This can give it very simple attack strategies. For example, for any real valued function f (x), with x ∈ D S , let r be drawn uniformly from D R and d be drawn uniformly from D D , and define:

p R = P r u1∼D R u2∼D D [f (u 1 ) > f (u 2 )]
(3)

p D = P r u1∼D R u2∼D D [f (u 1 ) < f (u 2 )] (4)
Thus p R is the probability that discriminant function f "favors" Reserved data while p D is the probability with which it favors the Defender data. p R > p D occurs if for a larger number of random pairs f (x) is larger for Reserved data than for Defender data. If the probability of a tie is zero, then p R + p D = 1. Theorem 1. If there is any function f for which p R > p D , a LTU Attacker exploiting that function can achieve an accuracy

A ltu ≥ 1 2 + 1 2 (p R -p D ). Proof.
A simple attack strategy would be predict that the unlabeled sample with the smaller value of f (x) belongs to the Defender data, with ties (i.e. when f (u 1 ) = f (u 2 )) decided by tossing a fair coin. This strategy would give a correct prediction when f (r) > f (d), which occurs with probability p R , and would be correct half of the time when f (r) = f (d), which occurs with probability (1 -(p r + p d )). This gives a classification accuracy:

A ltu = p R + 1 2 (1 -p R -p D ) = 1 2 + 1 2 (p R -p D ) . (5)
This is similar to the threshold adversary of [START_REF] Yeom | Privacy risk in machine learning: Analyzing the connection to overfitting[END_REF], except that the LTU Attacker does not need to know the exact conditional distributions, since it can discriminate pairwise. The most obvious candidate function f is the loss function used to train M D (we call this a naïve attacker), but the LTU Attacker can mine D A to potentially find more discriminative functions, or multiple functions to bag, and use D A to compute very good estimates for p R and p D . We verify that an LTU Attacker using an f function making perfect membership predictions (e.g., having the knowledge of the entire Defender dataset and using the nearest neighbor method) would get A ltu = 1, if there are no ties. Indeed, in that case, p R = 1 and p D = 0.

In our second theorem, we show that the LTU Attacker can attain an analogous lower bound on accuracy connected to overfitting as the bounded loss function (BLF) adversary of [START_REF] Yeom | Privacy risk in machine learning: Analyzing the connection to overfitting[END_REF].

Theorem 2. If the loss function ℓ(x) used to train the Defender model is bounded for all x, without loss of generality 0 ≤ ℓ(x) ≤ 1 (since loss functions can always be re-scaled), and if e R , the expected value of the loss function on the Reserved data, is larger than e D , the expected value of the loss function on the Defender data, then a lower bound on the accuracy of the LTU Attacker is given by the following function of the generalization error gap e R -e D :

A ltu ≥ 1 2 + 1 2 (e R -e D ) (6)
Proof. If the order of the pair (u 1 , u 2 ) is random and the loss function ℓ(x) is bounded by 0 ≤ ℓ(x) ≤ 1, then the LTU Attacker could predict u 1 ∈ D R with probability ℓ(u 1 ), by drawing z ∼ U (0, 1) and predicting u 1 ∈ D R if z < ℓ(u 1 ), and u 1 ∈ D D otherwise. This gives the desired lower bound, derived in more detail in Appendix A:

A ltu = 1 2 P r u1∼D R [z < ℓ(u 1 )] + 1 2 1 -P r u1∼D D [z < ℓ(u 1 )] = 1 2 E u1∼D R [ℓ(u 1 )] + 1 2 - 1 2 E u1∼D D [ℓ(u 1 )] = 1 2 + e R -e D 2 (7)
where e R := E This is only a lower bound on the accuracy of the attacker, connected to the main difficulty in machine learning -overfitting of the loss function. Other attack strategies may be more accurate. However, neither of the attack strategies in Theorems 1 and 2 is dominant over the other: shown in Appendix B. The strategy in Theorem 1 is more widely applicable, since it does not require the function to be bounded.

In the special case when the loss function used to train the Defender model is the 0-1 loss, and that is used to attack (i.e., f = ℓ), the strategies in Theorems 1 and 2 are different, but have the same accuracy:

p R = P r u∼D R [ℓ(u) = 1](1 -P r u∼D D [ℓ(u) = 1]) p D = (1 -P r u∼D R [ℓ(u) = 1]) P r u∼D D [ℓ(u) = 1] p R -p D = P r u1∼D R [ℓ(u) = 1] -P r u∼D D [ℓ(u) = 1] = e R -e D
Note that u is a dummy variable. The first line of the derivation is due to the fact that the only way the loss on the Reserved set can be greater than the loss on the Defender set is if the loss on the Reserved set is 1, which has probability P r u∼D R [ℓ(u) = 1], and the loss on the Defender set is zero, which has probability 1 -P r u∼D D [ℓ(u) = 1]. The second line is derived similarly. Theorem 3. If the Defender trainer T D is deterministic, invariant to the order of the training data, and injective, then the LTU Attacker has an optimal attack strategy, which achieves perfect accuracy.

Proof. The proof uses the fact that the LTU Attacker knows all of the Defender dataset except one sample, and knows that the missing sample is either u 1 or u 2 . Therefore, the attack strategy is to create two models, one trained on u 1 combined with the rest of the Defender dataset, and the other trained on u 2 combined with the rest of the Defender dataset. Since the Defender trainer is deterministic, one of those two models will match the Defender model, revealing which unlabeled sample belonged in the Defender dataset.

Formally, denote the subset of D A labeled "Defender" as D D -{d}, and the two membership unlabeled samples as u 1 and u 2 . The attacker can use the Defender trainer with the same hyper-parameters on (D D -{d}) ∪ {u 1 } to produce model M 1 and on (D D -{d}) ∪ {u 2 } to produce model M 2 .

By definition of the LTU Attacker , the missing sample d is either u 1 or u 2 , and D D ∩ D R = ∅, so u 1 ̸ = u 2 . There are two possible cases. If u 1 = d, then D D = (D D -{d}) ∪ {u 1 }, so that M 1 = M D , since T D is deterministic and invariant to the order of the training data. However,

D D ̸ = (D D -{d}) ∪ {u 2 }, since u 2 ̸ = u 1 , so M 2 ̸ = M D ,
since T D is also injective. Therefore, the LTU Attacker can know, with no uncertainty, that u 1 has membership label "Defender" and u 2 has membership label "Reserved". The other case, for u 2 = d, has a symmetric argument.

Under the hypotheses above, the LTU Attacker achieves the optimal Bayesian classifier using:

P r[u i ∈ D D |M i = M D ] = 1 P r[u i ∈ D R |M i = M D ] = 0 P r[u i ∈ D D |M i ̸ = M D ] = 0 P r[u i ∈ D R |M i ̸ = M D ] = 1

Data and experimental setting

We are using two datasets in our experiments: CIFAR-10 (Krizhevsky, Hinton, and others 2009), and QMNIST [START_REF] Yadav | Cold case: The lost mnist digits[END_REF]. CIFAR-10 is an object classification dataset with 10 different classes, well-known as a benchmark for membership inference attacks [START_REF] Rahman | Membership inference attack against differentially private deep learning model[END_REF]Hilprecht, Härterich, and Bernau 2019;[START_REF] Shokri | Membership inference attacks against machine learning models[END_REF]. QMNIST [START_REF] Yadav | Cold case: The lost mnist digits[END_REF]) is a handwritten digit recognition dataset, similarly preprocessed as the wellknown MNIST (LeCun et al. 1998), but including the whole original NIST Special Database 192 data (402953 images). QMNIST includes meta-data that MNIST was deprived of, including writer IDs and its origin (high-school students or Census Bureau employees), which could be used in future studies of attribute or property inference attack. They are not used in this work.

To speed up our experiments, we preprocessed the data using a backbone neural network pretrained on some other dataset, and used the representation of the second last layer of the network. For QMNIST we used VGG19 (Simonyan and Zisserman 2014) pretrained on Imagenet [START_REF] Deng | Imagenet: A large-scale hierarchical image database[END_REF]. For CIFAR-10, we rely on Efficient-netv2 (Tan and Le 2021) pretrained on Imagenet21k and finetuned on CIFAR-100.

The data were then split as follows: The 402953 QM-NIST images were shuffled, then separated into 200000 samples for Defender data and 202953 for Reserved data. The CIFAR-10 data were also shuffled and split evenly (30000/30000 approximately).

Results

Black-box attacker

We trained and evaluated various algorithms of the scikitlearn library as Defender model and evaluated the Utility and Privacy, based on two subsets of data: 1) 1600 random examples from the Defender (training) data and 2) 1600 random examples from the Reserved data (used to evaluate Utility and Privacy). We performed N = 100 independent LTU rounds and then computed Privacy based on the LTU membership classification accuracy through Equation 1. The Utility of the model was obtained with Equation 2. We used a Black-box LTU Attacker (number (3) in Figure 2). The results shown in Table 1 are averaged over 3 trials 3 . The first few lines (gray shaded) are deterministic methods (whose trainer yields to the same model regardless of random seeds and sample order). For these lines, consistent with Theorem 3, Privacy is zero, in all columns. 4 The algorithms use default scikit-learn hyper-parameter values. In the first two result columns, the Defender trainers are forced to be deterministic by seeding all random number generators. In the first column, the sample order is fixed to the order used by the Defender trainer, while in the second one it is not. Privacy in the first column is near zero, consistent with the theory. In the second column, this is also verified for methods independent of sample order. The third result column corresponds to varying the random seed, hence algorithms including some level of randomness have an increased level of privacy.

The results of Table 1 show that there is no difference between the column 2 and 3; suggesting that, just with the randomness associated to altering the order of the training samples, is enough to make the strategy fails. These results also expose one limitation of black-box attacks: example-based methods indicated in red (e.g., SVC), which store examples in the model, obviously violate privacy. However, this is not detected by a black-box LTU Attacker , if they are properly regularized and/or involve some degree or randomness. White-box attackers solve this problem.

White-box attacker

We implemented a white-box attacker based on gradient calculations (method (4) in Figure 2). We evaluated the effect of the proposed attack with QMNIST on two types of Defender models: A Deep Neural Networks (DNN) trained with supervised learning or with unsupervised domain adaptation (UDA) [START_REF] Wang | Deepda: Deep domain adaptation toolkit[END_REF]. 5 For supervised learning, we used ResNet50 [START_REF] He | Deep residual learning for image recognition[END_REF] as the backbone neural network, which is pre-trained on ImageNet [START_REF] Deng | Imagenet: A large-scale hierarchical image database[END_REF]). We then retrained all its layers on the Defender set of QMNIST. The results are reported in Table 2, line "Supervised". With the very large Defender dataset we are using for training (200000 examples), regardless of variations on regularization hyper-parameters, 3 Code is available at https://github.com/ JiangnanH/ppml-workshop/blob/master/ generate_table_v1.py.

4 Results may vary depending upon which scikitlearn output method is used (predict proba(), decision function(), density function()), or predict(). To achieve zero Privacy, consistent with the theory, the method predict() should be avoided. 5 Code is available at https://github.com/ JiangnanH/ppml-workshop#white-box-attacker. In an effort to still improve Privacy, we used Unsupervised Domain Adaptation (UDA). To that end, we use as source domains a synthetic dataset, called Large-Fake-MNIST [START_REF] Sun | Omniprint: A configurable printed character synthesizer[END_REF], which are similar to MNIST. Large-Fake-MNIST has 50000 white-on-black images for each digit, which results in 500000 images in total. The target domain is the Defender set of QMNIST. The chosen UDA method is DSAN [START_REF] Zhu | Deep Subdomain Adaptation Network for Image Classification[END_REF][START_REF] Wang | Deepda: Deep domain adaptation toolkit[END_REF], which optimizes the neural network with the sum of a cross-entropy loss (classification loss) and a local MMD loss (transfer loss) [START_REF] Zhu | Deep Subdomain Adaptation Network for Image Classification[END_REF]. We tried 3 variants of attacks of this UDA model. The simplest is the most effective: attack the model as if it were trained with supervised learning. Unfortunately, UDA did not yield improved performance. We attribute that to the fact that the supervised model under attack performs well on this dataset and already has a very good level of privacy.

Discussion and further work

Although an LTU Attacker is all knowledgeable, it must make efficient use of available information to be powerful. We proposed a taxonomy based on information available or used (Figure 2). The most powerful Attackers use both the trained Defender model M D and its trainer T D .

When the Defender trainer T D is a black box, like in our first set of experiments on scikit-learn algorithms, we see clear limitations of the LTU Attacker which include the fact that it is not possible to diagnose whether the algorithm is example-based.

Unfortunately, white-box attacks cannot be conducted in a generic way, but must be tailored to the trainer (e.g., gradient descent algorithms for MLP). In contrast, black-box methods can attack T D (and M D ) regardless of mechanism. Still, we get necessary conditions for privacy protection by analyzing black-box methods. Both theoretical and empirical results using black-box attackers (on a broad range of algorithms of the scikit-learn library on the QMNIST and CIFAR-10 data), indicate that Defender algorithms are vulnerable to a LTU Attacker if it overfits the training Defender data or if it is deterministic. Additionally, the degree of stochasticity of the algorithm must be sufficient to obtain a desired level of privacy.

We explored white-box attacks neural networks trained with gradient descent. In our experiments on the large QM-NIST dataset (200,000 training examples), Deep CNNs such as ResNet seem to exhibit both good Utility and Privacy in their "native form", according to our white-box attacker. We were pleasantly surprised of our white box attack results, but, in light of the fact that other authors found similar networks vulnerable to attack (Nasr, Shokri, and Houmansadr 2019), we conducted the following sanity check. We performed the same supervised learning experiment by modifying 20% of the class labels (to another class label chosen randomly), in both the Defender set and Reserved set. Then we incited the neural network to overfit the Defender set. Although the training accuracy (on Defender data) was still nearly perfect, we obtained a loss of test accuracy (on Reserved data): 78%. According Theorem 2, this should result in a loss of privacy. This allowed us to verify that our whitebox attacker correctly detected a loss of privacy. Indeed, we obtained a privacy of 0.55.

We are in the process of conducting comparison experiments between our white-box attacker and that of (Nasr, Shokri, and Houmansadr 2019). However, their method does not easily lend itself to be used with the LTU framework, because it requires training a neural network for each LTU round (i.e., on each D A = D D -{membership(d)} ∪ D R -{membership(r)}). We are considering doing only one data split to evaluate privacy, with D A = 50% D D ∪ 50% D R and using the rest of the data for privacy evaluation. However, we can still use the pairwise testing of the LTU methodology, i.e., the evaluator queries the attacker with pairs of samples, one from the Defender data and the other from the Reserved data. In Appendix C, we show on an example that this results in an increased accuracy of the attacker.

In Appendix C, we use the same example to illustrate how we can visualize the privacy protection of individuals. Further work includes comparing this approach with [START_REF] Song | Systematic evaluation of privacy risks of machine learning models[END_REF].

Further work also includes testing LTU Attacker on a wider variety of datasets and algorithms, varying the number of training examples, training new white-box attack variants to possibly increase the power of the attacker, and testing various means of improving the robustness of algorithms against attacks by LTU Attacker . We are also in the process of designing a competition of membership inference attacks.

Conclusion

In summary, we presented an apparatus for evaluating the robustness of machine learning models (Defenders) against membership inference attack, involving an "all knowledgeable" LTU Attacker . This attacker has access to the trained model of the Defender, its learning algorithm (trainer), all the Defender data used for training, minus the label of one sample, and all the similarly distributed non-training Reserved data (used for evaluation), minus the label of one sample. The Evaluator repeats this Leave-Two-Unlabeled (LTU) procedure for many sample pairs, to compute the efficacy of the Attacker, whose charter is to predict the membership of the unlabeled samples (training or non-training data). We call such LTU Attacker the LTU-attacker for short. The LTU framework helped us analyse privacy vulnerabilities both theoretically and experimentally.

The main conclusions of this paper are that a number of conditions are necessary for a Defender to protect privacy:

• Avoid storing examples (a weakness of example-based method, such as Nearest Neighbors).

• Ensure that p R = p D for all f , following Theorem 1 (p R is the probability that discriminant function f "favors" Reserved data while p D is the probability with which it favors the Defender data).

• Ensure that e R = e D , following Theorem 2 (e R is the expected value of the loss on Reserved data and e D on Defender data). • Include some randomness in the Defender trainer algorithm, after Theorem 3.

Figure 1 :

 1 Figure 1: Methodology Flow Chart. (a) Defender: Source data are divided into Defender data, to train the model under attack (Defender model) and Reserved data to evaluate such model. The Defender model trainer creates a model optimizing a utility objective, while being as resilient as possible to attacks. (b) LTU Attacker: The evaluation apparatus includes an LTU Attacker and an Evaluator: The evaluation apparatus performs a hold-out evaluation leaving two unlabeled examples (LTU) by repeatedly providing the LTU Attacker with ALL of the Defender and Reserved data samples, together with their membership origin, hiding only the membership label of 2 samples. The LTU Attacker must turn in the membership label (Defender data or Reserved data) of these 2 samples (Attack predictions). (c) Evaluator: The Evaluator computes two scores: LTU Attacker prediction error (Privacy metric), and Defender model classification performance (Utility metric).

  ) train a M D -attacker M A to predict membership, using as input any internal state or the output of M D , and using D A as training data. Then use M A to predict the labels of u 1 and u 2 .• Attack on M D and T D : Depending on whether the Defender trainer T D is a white-box from which gradients can be computed, define M A by: (3) Training two mock Defender models M 1 and M 2 , one using (D D -{d})∪{u 1 } and the other using (D D -{d}) ∪ {u 2 }, with the trainer T D . If T D is deterministic and independent of sample ordering, either M 1 or M 2 should be identical to M D , and otherwise one of them should be "closer" to M D . The sample corresponding to the model closest to M D is classified as being a member of D D . (4) Performing one gradient learning step with either u 1 or u 2 using T D , starting from the trained model M D , and compare the gradient norms. A variety of Defender strategies might be considered: • Applying over-fitting prevention (regularization) to T D . • Applying Differential Privacy algorithms to T D . • Training T D in a semi-supervised way (with transfer learning) or using synthetic data (generated with a simulator trained with a subset of D D ). • Modifying T D to optimize both utility and privacy.

Figure 2 :

 2 Figure 2: Taxonomy of LTU Attacker . Top: Any LTU Attacker has available the Defender trainer T D , the trained Defender model M D , and attack data D A including (almost) all the Defender data D D and Reserved data D R D A = D D -{membership(d)} ∪ D R -{membership(r)}. But it may use only part of this available knowledge to conduct attacks. r and d are two labeled examples belonging D R and D D respectively, and u 1 and u 2 are two unlabeled examples, one from D R and one from D D (ordered randomly). Left: Attacker M A targets only the trained Defender model M D . Right: M A targets both M D and its trainer T D .

Table 1 :

 1 Utility and Privacy on QMNIST and CIFAR-10 of different scikit-learn models with three levels of randomness: Original sample order + Fixed random seed (no randomness); Random sample order + Fixed random seed; Random sample order + Random seed. The Defender data and Reserved data have both 1600 examples. All numbers shown in the table have at least two significant digits (standard error lower than 0.004). For model implementations, we use scikit-learn (version 0.24.2) with default values. Results with Utility or Privacy > 0.90 are highlighted and those meeting both criteria are underlined. Shaded in gray: fully deterministic models with Privacy≡ 0.

		Orig.	Rand.	Not
	QMNIST	order +	order +	Seeded
	Utility | Privacy	Seeded	Seeded
	Logistic lbfgs	0.92|0.00 0.91|0.00 0.91|0.00
	Bayesian ridge	0.92|0.00 0.92|0.00 0.89|0.00
	Naive Bayes	0.70|0.00 0.70|0.00 0.70|0.00
	SVC	0.91|0.00 0.91|0.00 0.88|0.00
	KNN*	0.86|0.27 0.86|0.27 0.83|0.18
	LinearSVC	0.92|0.00 0.92|0.69 0.91|0.63
	SGD SVC	0.90|0.03 0.92|1.00 0.89|1.00
	MLP	0.90|0.00 0.90|0.97 0.88|0.93
	Perceptron	0.90|0.04 0.91|1.00 0.92|1.00
	Random Forest	0.88|0.00 0.88|0.99 0.85|1.00
		Orig.	Rand.	Not
	CIFAR-10	order +	order +	Seeded
	Utility | Privacy	Seeded	Seeded
	Logistic lbfgs	0.95|0.00 0.95|0.00 0.95|0.00
	Bayesian ridge	0.91|0.00 0.90|0.00 0.90|0.00
	Naive Bayes	0.89|0.00 0.89|0.01 0.89|0.00
	SVC	0.95|0.00 0.94|0.00 0.95|0.00
	KNN*	0.92|0.44 0.91|0.49 0.92|0.49
	LinearSVC	0.95|0.00 0.95|0.26 0.95|0.22
	SGD SVC	0.94|0.32 0.94|0.98 0.93|0.99
	MLP	0.95|0.00 0.94|0.98 0.95|0.97
	Perceptron	0.94|0.26 0.94|1.00 0.93|0.96
	Random Forest	0.92|0.00 0.93|0.99 0.91|0.92
	we could get ResNet50 to overfit. Consequently, both Utility
	and Privacy are good.

Table 2 :

 2 Utility and Privacy of DNN ResNet50 Defender models trained on QMNIST.

	Defender model	Utility	Privacy
	Supervised	1.00 ± 0.00 0.97 ± 0.03
	Unsupervised Domain Adaptation 0.99 ± 0.00 0.94 ± 0.03

https://www.nist.gov/srd/ nist-special-database-19.

https://github.com/privacytrustlab/ml_ privacy_meter.

Acknowledgements

We are grateful to our colleagues Kristin Bennett and Jennifer He for stimulating discussion. This work is funded in part by the ANR (Agence Nationale de la Recherche, National Agency for Research) under AI chair of excellence HUMANIA, grant number ANR-19-CHIA-0022.

Supplemental material

A. Derivation of the proof of Theorem 2

If the loss function ℓ(x) used to train the Defender model is bounded for all x, without loss of generality 0 ≤ ℓ(x) ≤ 1 (since loss functions can always be re-scaled), and if e R , the expected value of the loss function on the Reserved data, is larger than e D , the expected value of the loss function on the Defender data, then a lower bound on the expected accuracy of the LTU Attacker is given by the following function of the generalization error e R -e D :

Proof. If the order of the pair (u 1 , u 2 ) is random and the loss function ℓ(x) is bounded by 0 ≤ ℓ(x) ≤ 1, then the LTU Attacker could predict u 1 ∈ D R with probability ℓ(u 1 ), by drawing z ∼ U (0, 1) and predicting u 1 ∈ D R if z < ℓ(u 1 ), and u 1 ∈ D D otherwise. This gives the desired lower bound on the expected accuracy, derived as follows:

When u 1 is drawn uniformly from D R , then:

Similarly, when u 1 is drawn uniformly from D D , then:

Substituting in these expected values gives:

where e R := E

C. LTU Global and Individual Privacy Scores

The following small example illustrates that the pairwise prediction accuracy in the LTU methodology is not a function of the accuracy, false positive rate, or false negative rate of predictions made on individual samples. Let f (x) be the discriminative function trained to predict the probability that a sample is in the Reserved set (i.e. predictions made using a threshold of 0.5), and for simplicity consider Defender and Reserved sets with three samples each, such that:

If c is either 0.6, 0.8, or 0.95, then in all three cases the overall accuracy for individual sample predictions is 2/3, and the false positive rate and false negative rate are both 1/3. However, in the LTU methodology, the LTU Attacker would get 9 different pairs to predict, and for those values of c, its accuracy would be 8/9, 7/9, or 6/9, respectively. We used the ML Privacy Meter python library of Shokri et al. 6 to run their attack of AlexNet, which achieved an attack accuracy of 74.9%. Their attack model predicts the probability that each sample was in the Defender dataset. The histograms of the predictions over the Defender dataset and Reserved dataset follow:


Bruno Pinaud
email: bruno.pinaud@univ-nantes.fr

Pascale Kuntz

Fabien Picarougne

The Website for Graph Visualization Software References (GVSR)

Graph drawing software are now commonly used. However, the choice of a well-adapted program may be hard for an inexperienced user. This poster presents a website (http://www.polytech.univ-nantes. fr/GVSR/) built to help users choose a program adapted to their problems. So far, this site uniformely presents fifty programs and aims at helping users both in their choices and in comparing the programs.

The current profusion of available graph drawing programs lets the nonspecialist user often confused. Some programs have been developed in close partnership with the scientific community (e.g. Pajek for social networks). But generally speaking, the choice of a program well-adapted to both the data and the methodology remains difficult for a user expert in his field but not in graph drawing. Recent books can be used as guides [START_REF]Drawing Graphs: Methods and Models[END_REF][START_REF] Mutzel | Graph Drawing Software[END_REF], and several websites present lists of general or specialized programs [3,4,5] or synthetic views of different types of layouts [6]. However, either the information is too complex for a nonspecialist or it is presented incompletely or in a heterogeneous form uneasy to explore. Consequently much effort is required to compare the various programs.

Those restrictions led us to develop a website called "Graph Visualization Software References" (http://www.polytech.univ-nantes.fr/GVSR/). Built as a directory, it presents the programs with a uniform text-based description along with a screenshot. This site keeps evolving and so far contains about fifty various software descriptions classified into five types: libraries, visualization tools, knowledge representation, 3D only tools, and specific tools. Our objectives are to facilitate the users' choices and to compare programs with common criteria.

Each program has its own description card (Fig. 1) made of a screenshot, general information (e.g. author(s)' name, website, . . . ), specific information on the visualization (e.g. possible uses, graph type(s), . . . ), technical information (e.g. operating system(s), license(s), . . . ) and references (e.g. publication(s), website(s)). Each card is described by an XML file. The files are managed with the native XML database "Exist ". Some of the existing functionalities are an automatic indexing of the data and an organization of the XML files in collections like in a computer hard-disk. The communication with the user's web browser is done with the Apache Tomcat servlet container via "JavaServer Pages (JSP)". This technology allows to easily create websites with a dynamic content independent from the server and client architectures. In addition, the site allows users to propose new programs by simply completing an enclosed form. Finally, the site has an XQUERY-based search engine. The content of the site keeps evolving by the addition of new programs and new functionalities. We are currently working on a benchmark for comparing different programs on the same graph base. However, as the graph description format is different for each program, we are working on a format converter via the Graph Exchange Language (GXL) [START_REF] Winter | Exchanging graphs with GXL[END_REF].

Fig. 1 .

 1 Fig. 1. Example of a software description card.