Siva Anantharaman

Sabine Frittella
email: sabine.frittella@insa-cvl.fr

Benjamin Nguyen
email: benjamin.nguyen@insa-cvl.fr

Distributed Transition Systems with Tags for Privacy Analysis

Keywords: Database, Privacy, Transition System, Probability, Distribution. 1

We present a logical framework that formally models how a given private information P stored on a given database D, can get captured progressively, by an agent/adversary querying the database repeatedly. Named DLTTS (Distributed Labeled Tagged Transition System), the framework borrows ideas from several domains: Probabilistic Automata of Segala, Probabilistic Concurrent Systems, and Probabilistic labelled transition systems. To every node on a DLTTS is attached a tag that represents the 'current' knowledge of the adversary, acquired from the responses of the answering mechanism of the DBMS to his/her queries, at the nodes traversed earlier, along any given run; this knowledge is completed at the same node, with further relational deductions, possibly in combination with 'public' information from other databases given in advance. A 'blackbox' mechanism is also part of a DLTTS. It is meant as an oracle, whose role is to tell if the private information has been deduced by the adversary at the current node, and if so terminate the run; an additional special feature is that the blackbox also gives information on how 'close', or how 'far', the knowledge of the adversary is, from the private information P at the current node. A value-wise metric is defined for that purpose, on the set of all 'type compatible' tuples from the given database, the data themselves being typed with the headers of the base. Despite the transition systems flavor of our framework, this metric is not 'behavioral' in the sense presented in some other works. It is exclusively database oriented, and allows to define new notions of adjacency and of -indistinguishabilty between databases, more generally than those usually based on the Hamming metric with a restricted notion of adjacency.

Examples are given all along to illustrate how our framework works.

Introduction

Data anonymization has been investigated for decades, and many privacy models have been proposed (k-anonymity, differential privacy, . . . ) whose goals are to protect sensitive information. Our goal in this paper is not to define a new anonymization model, but rather to propose a logical framework to formally model how the information stored in a database can get captured progressively by any agent repeatedly querying the database. This model can also be used to quantify reidentification attacks on a database.

The logical framework we propose below formally models how the information stored in a database can get captured progressively, by an agent/adversary querying repeatedly the database. The data can be of any following types: numerical, non-numerical,or literal. In practice however, some of the literals representing 'sensitive data' could be in a taxonomical relation; and part of the data could be presented, for 'anonymization' purposes, as finite intervals or sets, over the basic types. We shall therefore agree to consider the types of the data in an extended 'overloaded' sense. Cf. Example 1 below. (Only tree-structured taxonomies will be considered in this work.)

We assume given a data base D, with its attributes set A, usually divided in three disjoint groups: the subgroup A (i) of identifiers, A (qi) of quasi-identifiers, and A (s) of sensitive attributes. The tuples of the base D will be generally denoted as t, and their attributes denoted respectively as t i , t qi , and t s in the three subgroups of A. The attributes t i on any tuple t of D are conveniently viewed as defining a 'user' or a 'client' of the database D. Quasi-identifiers1 are informally defined in general, as a set of public attributes, which in combination with other attributes and/or external information, can allow to re-identify all or some of the users to whom the information refers. The base D itself could be 'distributed probabilistically' over a finite set (referred to then, as 'universe', and its elements named as possible 'worlds').

By a privacy policy P = P A (D) on D with respect to a given agent/adversary A is meant the stipulation that for a certain given set of tuples {t ∈ P ⊂ D}, the sensitive attributes t s on any such t shall remain inaccessible ('even after further deduction' -see below) to A. It is assumed that A is not the user identified by the attributes t i on these t's.

The logical framework we propose in this work, to model the evolution of the 'knowledge' that an adversary A can gain by repeatedly querying the given database D -with a view to get access to sensitive data meant to remain hidden for him/her under the given privacy policy P -, will be called Distributed Labeled-Tagged Transition System (DLTTS); The underlying logic for DLTTS is first-order, with countably many variables and finitely many constants (including certain usual dummy symbols like ' , $, #'). In this work, the basic signature Σ for the framework is assumed to have no non-constant function symbols. By 'knowledge' of A we shall mean the data that A retrieves as answers to his/her successive queries, as well as other data that can be deduced/derived, under relational operations on these answers; and in addition, some others derivable from these, using relational combinations with data (possibly involving some of the users of D) from finitely many external DBs given in advance, denoted as B 1 , . . . , B m , to which the adversary A is assumed to have free access. These relational and querying operations are all assumed done with a well-delimited fragment of the language SQL ; it is assumed that this fragment of SQL is part of the signature Σ underlying the DLTTSs. In addition, if n ≥ 1 is the length of the tuples forming the data in D, finitely many predicate symbols K i , 1 ≤ i ≤ n, each K i of arity i, will be part of the signature Σ; in the work presented here they will be the only predicate symbols in Σ. The role of these symbols is to allow us to see any data tuple of length r, 1 ≤ r ≤ n, as a variable-free first-order formula with top symbol K r , with all arguments assumed typed implicitly (with the help of the headers of the base D). In practice however, we shall drop these top symbols K i , and see any data tuple that is not part of the given privacy policy P A (D), directly as a first-order variable-free formula over Σ; data tuples t that are elements of the policy P A (D) will in practice be just written as ¬t.

As we shall see, the DLTTS framework is well suited for capturing the ideas on acquiring knowledge and on policy violation, in an elegant and abstract setup. A preliminary definition of this framework (Section 2) considers only the case where the data, as well as the answers to the queries, do not involve any notion of 'noise'. (By 'noise' we shall mean the perturbation of data by some external random (probabilistic mechanism.) But we shall extend this definition in a later section, as an option to also handle noisy data.The notion of violation of any given privacy policy on a database can then be (optionally) extended into a notion of violation up to some given ≥ 0 ( -violation, for short). In the first part of the work, we will be modeling the lookout for the sensitive attributes of certain given users, by a single adversary. In the second part of the work (Section 5 onwards), we propose a method for comparing the evolution of knowledge of an adversary at two different nodes on a given run, or on two different possible runs; the same method also applies for comparing the evolution of knowledge of two different adversaries A 1 , A 2 , both querying repeatedly (and independently) the given database.

But before formally defining the DLTTS, a couple of examples might help; they will also throw some light on how to delimit properly the fragment of SQL that we want included in our logical setup. And that confirms A's suspicion concerning John.

A couple of Examples

In this case, the DLTTS framework would function as follows: At the starting state s a transition with three branches would a priori be possible, corresponding to the three ('M') lines 2, 4 and 5 of Table 2, which represent the knowledge that would be acquired respectively along these branches. Now A is on the lookout for a possible CoVid case, so rules out the 'line 2 branch' (i.e., gives this branch probability 0). As for the remaining two branches (corresponding to lines 4 and 5 on Table 2), A chooses to go by the line 5 branch, considering it twice more likely to be successful, than the other (A had the impression that 'John was not too old'). That leads to the probability distribution 0, 1/3, 2/3 assigned respectively on the three possible branches for the transition. If s 0 , s 1 , s 2 are the respective successor states for the transition considered, the privacy policy of the Hospital (concerning John's CoVid information) would thus be violated at state s 2 (with probability 2/3), it wouldn't be at s 1 (probability 1/3); no information deduced at state s 0 .

As just seen, modeling an adversary's search for some specific information on a given data base D -as 'runs' on a suitable DLTTS and probability distributions over the successor steps along the runs -, depends in general on the nature(structure) of the information looked for. The probability distributions on the transitions along the runs would generally depend on some random mechanism, which could also reflect the choices the adversary might make.

The role of our next example is to point out that specifying Privacy policy policies will in general have some serious side effects on the functioning of the primitives and aggregate procedures of SQL. If the policies are to have some 'content', operationally speaking, the DBMS may have to stipulate that the queries employing these primitives either should have 'void outputs' in certain contexts, or 'get filtered by the Privacy policy'.

Example 2. Table 3 below is an imaginary record D of a bank L, containing a list of its clients: with client ids, their names, and their monthly balances. (Client id is the identifier attribute, Monthly-balance is sensitive.) The privacy policy P of the bank is that client Jean's Monthly-balance should 'be invisible' to others; formally, the policy P is the negated formula ¬(Jean, ≥ 420).

On the other hand, the bank is obliged administratively to render public a monthly statement, on its minimum total Monthly-balance; that is Table 4 The external Table 4 is freely accessible to A; so, if the functionalities COUNT and SUM are applied 'without any filter', A can easily deduce that Jean's Monthly-balance at L is ≥ 420; the bank's Privacy policy is thus violated.

Remark 1: In the above example, if the external DB (Table 4) was unavailable to A, the DBMS could have answered his/her query with a Table 5' where the entire tuple on Jean is deleted; in such a case, the privacy policy P on D (concerning Jean) would a priori remain unviolated; except if we assume that the DBMS accepts queries with aggregate operations on the database D that 'do not explicitly look' for Jean's sensitive attribute: For instance A could first retrieve the SUM on the entire Monthly-balance column, then ask for SUM(Monthlybalance) where 'Name <> Jean'. A relational deduction then leads to the violation of the policy P . The above two Examples show that the violation of privacy policies needs, in general, some additional 'outside knowledge'.

We may assume wlog that the given external bases B 1 , . . . , B m -to which A could resort, with relational operations for deducing additional information -are also of the same signature Σ as D; so all the knowledge A can deduce/derive from his/her repeated queries can be expressed as a first-order variable-free formula over the signature Σ.

Distributed Labeled-Tagged Transition Systems

The DLTTS framework presented in this section synthesizes ideas coming from various domains, such as the Probabilistic Automata of Segala ([13], Probabilistic Concurrent Systems, Probabilistic labelled transition systems ( [START_REF] Castiglioni | A Logical Characterization of Differential Privacy via Behavioral Metrics[END_REF][START_REF] Castiglioni | The metric linear-time branching-time spectrum on nondeterministic probabilistic processes[END_REF]. Although the underlying signature for the DLTTS can be rich in general, for the purposes of our current work we shall be working with a limited first-order signature (as mentioned in the Introduction) denoted Σ, with countably many variables, finitely many constants (including some 'standard dummies'), no nonconstant function symbols, and a finite limited set of predicate (propositional) symbols. Let E be the set of all variable-free formulas over Σ, and Ext a given subset of E. We assume given a decidable procedure C whose role is to 'satu-rate' any finite set G of variable-free formulas into a finite set G, by adding a finite (possibly empty) set of variable-free formulas, using relational operations on G and Ext. This procedure C will be internal at every node on a DLTTS; in addition, there will also be a 'blackbox' mechanism O, acting as an oracle telling if the given privacy policy on a given database is violated at the current node. More details will be given in Section 5 on the additional role the oracle will play in a privacy analysis procedure (for any querying sequence on a given DB), based on a novel data-based metric, which will be defined in that section.

Definition 1 A Distributed Labeled-Tagged Transition System (DLTTS), over a given signature Σ, is formed of:

-a finite (or denumerable) set S of states, an 'initial' state s 0 ∈ S, and a special state ⊗ ∈ S named 'fail':

-a finite set Act of action symbols (disjoint from Σ), with a special action δ ∈ Act called 'violation';

-a (probabilistic) transition relation T ⊂ S×Act×Distr(S), where Distr(S) is the set of all probability distributions over S, with finite support.

-a tag τ (s) attached to every state s ∈ S {⊗}, formed of finitely many first-order variable-free formulas over Σ; the tag τ (s 0 ) at the initial state is the singleton set { }.

-at every state s a special action symbol ι = ι s ∈ Act, said to be internal at s, completes/saturates τ (s) into a set τ (s) with the procedure C, by using relational operations between the formulas in τ (s) and Ext.

A (probabilistic) transition t ∈ T will generally be written as a triple (s, a, t(s)); and t will be said to be 'from' (or 'at') the state s, the states of t(s) will be the 'successors' of s under t. The formulas in the tag τ (s) attached to any state s will all be assigned the same probability as the state s in Distr(S). If the set τ (s) of formulas turns out to be inconsistent, then the oracle mechanism O will (intervene and) impose (s, δ, ⊗) as the only transition from s, standing for 'violation' and 'fail', by definition, Nondeterminism of transitions can be defined without difficulty on DLTTS, as a nondeterministic choice between the possible probabilistic transitions at any given state. We shall assume that nondeterminism is managed by the choice of a suitable scheduler; and in addition, that at most one probabilistic transition is firable from any state s ∈ S {⊗}, and none from the halting state ⊗.

DLTTS and Repeated queries on a database:

The states of the DLTTS will stand for the various 'moments' of the querying sequence, while the tags attached to the states will stand for the knowledge A has acquired on the data of D 'thus far'. This knowledge consists partly in the answers to the queries (s)he made so far, then completed with additional knowledge using the internal 'saturation' procedure C of the framework. In the context of DBs, this procedure would consist in relational algebraic operations between the answers retrieved by A for his/her repeated queries on D, all seen as tuples (variable-free formulas), and suitable tuples from the given external databases B 1 , . . . , B m . If the saturated knowledge of A at a current state s on the DLTTS (i.e., the tag τ (s) attached to the current state s) is not inconsistent, then the transition from s to its successor states represents the probability distribution of the likely answers A would expect to get for his/her next query.

Note that we make no assumption on whether the repeated queries by A on D are treated interactively, or non-interactively, by the DBMS. It appears that the logical framework would function exactly alike, in both cases.

Remark 2: (a) Suppose t is a transition from a state s, on the DLTTS corresponding to a querying sequence by an adversary A, and s is one of the successors of s under t; then, by definition, the 'fresh' knowledge τ (s ) of A at s resulting from this transition, is the addition to A's saturated knowledge τ (s) at s, the part of the response of the DBMS's answering mechanism for A's current query, represented by the branch of t going from s to s .

(b) As already mentioned, we assume that the relational operations needed for gaining further knowledge are done using a well delimited finite subset of the functionalities of SQL; and that 'no infinite set can get generated from a finite set' under these functionalities, assumed included in the signature Σ. (This corresponds to the bounded inputs outputs assumption, as in e.g., [START_REF] Barthe | Probabilistic relational reasoning for differential privacy[END_REF][START_REF] Barthe | Deciding Differential Privacy for Programs with Finite Inputs and Outputs[END_REF].) Proposition 1 Suppose given a database D, a finite sequence of repeated queries on D by an adversary A, and a first-order relational formula P = P A (D) over the signature Σ of D, expressing the privacy policy of D with respect to A. Let W be the DLTTS modeling the various queries of A on D, and the evolution of the knowledge of A on the data of D, resulting from these queries and the internal actions at the states of W, as described above.

(i) The given privacy policy P A (D) on D is violated if and only if the failure state ⊗ on the DLTTS W is reachable from the initial state of W.

(ii) The satisfiabiliity of the set of formulas τ (s) ∪ {¬P } is decidable, at any state s on the DLTTS, under the assumptions of Remark 2(b).

Proof: Assertion (i) is restatement. Observe now, that at any state s on W, the tags τ (s), τ (s) are both finite sets of first-order variable-free formulas over Σ, without non-constant function symbols. For, to start with, the knowledge of A consists of the responses received for his/her queries, in the form of a finite set of data tuples from the given databases, and some subtuples. And by our assumptions of Remark-2 (b), no infinite set can be generated by saturating this initial knowledge with procedure C. Assertion (ii) follows then from the known result that the inconsistency of any given finite set of variable-free first-order Datalog formulas is decidable, e.g., by the analytic tableaux procedure. (Only the absence of variables is essential.)

-indistinguishability, -local-differential privacy

Our objective now is to extend the result of Proposition 1 to the case when the violation to be considered can be up to some given ≥ 0, in a sense to be made precise. We stick to the same notation as above. The set E of all variable-free formulas over Σ is thus a disjoint union of subsets of the form

E = ∪{E K i | 0 < i ≤ n, K ∈ Σ}, the index i in E K i standing
for the common length of the formulas in the subset, and K for the common root symbol of its formulas; each set E K i will be seen as a database of i-tuples. We shall first look at the situation where the queries intend to capture certain (sensitive) values on a given tuple t in the database D. Two different tuples in E might correspond to two likely answers to such a query, but with possibly different probabilities in the distribution assigned for the transitions, by the probabilistic mechanism M (e.g., as in Example 1).

Given two such instances, and a real ≥ 0, we can also define a notion of their -local-indistinguishabilty, wrt the tuple t and the mechanism M answering the queries. This can be done in a slightly extended setup, where the answering mechanism may, as an option, also add 'noise' to certain numerical data values, for several reasons among which the safety of data. We shall then assume that the internal procedure C of the DLTTS at each of its states (meant to saturate the current knowledge of the adversary querying the database) incorporates the following three well-known noise adding mechanisms: the Laplace, Gauss, and exponential mechanisms. With the stipulation that this optional noise additions to numerical values can be done in a bounded fashion, so as to be from a finite prescribed domain around the values; it will then be assumed that tuples formed of such noisy data are also in E.

Definition 2 (i) Suppose that, while answering a given query on the base D, at two instances v, v , the probabilistic answering mechanism M outputs the same tuple α ∈ E. Given ≥ 0, these two instances are said to be -localindistinguishable wrt α, if and only if:

P rob[M(v) = α] ≤ e P rob[M(v ) = α] and P rob[M(v ) = α] ≤ e P rob[M(v) = α].
(ii) The probabilistic answering mechanism M is said to satisfy -local differential privacy ( -LDP) for ≥ 0, if and only if: For any two instances v, v of M that lead to the same output, and any set S ⊂ Range(M), we have

P rob[M(v) ∈ S] ≤ e P rob[M(v ) ∈ S].
We shall also be needing the following notion of -indistinguishability (and of -distinguishability) of two different outputs of the mechanism M: These definitions -as well that of -DP given below -are essentially reformulations of the same (or similar) notions defined in [START_REF] Dwork | Differential privacy[END_REF][START_REF] Dwork | The Algorithmic Foundations of Differential Privacy[END_REF].

Definition 3 Given ≥ 0, two outputs α, α of the probabilistic mechanism M answering the queries of an agent A, are said to be -indistinguishable, if and only if: For every pair v, v of inputs for M, such that P rob[M(v) = α] = p and P rob[M(v ) = α ] = p , we must have: p ≤ e p and p ≤ e p.

Otherwise, the outputs α, α will be said to be -distinguishable.

Remark 3: Given an ≥ 0, one may assume as an option, that at every state on the DLTTS the retrieval of answers to the current query (from the mechanism M) is done up to -indistinguishabilty; this will then be implicitly part of what was called the saturation procedure C at that state. The procedure thus enhanced for saturating the tags at the states, will then be denoted as C, when necessary (it will still be decidable, under the finiteness asumptions of Remark-2 (b)). Inconsistency of the set of formulas, in the ' C-saturated' tag at any state, will be checked up to -indistinguishabilty, and referred to as -inconsistency, or -failure. The notion of privacy policy will not need to be modified; that of its violation will be referred to as -violation, Under these optional extensions of -failure and -violation, it must be clear that the statements of Proposition 1 continue to be valid.

Two small examples of -local-indistinguishability, before closing this section.

(i) The two sub-tuples ([50-60], M, Maths) and ([40-50], M, Physics), from the last two tuples on the Hospital's published record in Example 1 (Table 2), both point to Viral-Infection as output; they can thus be seen as log(2)-localindististinguishable, for the adversary A.

(ii) The 'Randomized Response' mechanism RR ( [START_REF] Stanley | Randomized Response: A Survey Technique for Eliminating Evasive Answer Bias[END_REF]) can be modelled as follows. Input is (X, F 1 , F 2 ) where X is a Boolean, and F 1 , F 2 are flips of a coin (H or T ). RR outputs X if F 1 = H, T rue if F 1 = T and F 2 = H, and F alse if F 1 = T and F 2 = T . This mechanism is log(3)-LDP : the instances (T rue, H, H), (T rue, H, T ), (T rue, T, H) and (T rue, T, T ) are log(3)-indistinguishable for output T rue. (F alse, H, H), (F alse, H, T ), (F alse, T, H)and (F alse, T, T ) are log(3)-indistinguishable for output F alse.

-Differential Privacy

The notion of -indistinguishability of two given databases D, D for an adversary, is more general than that of -local-indistinguishability (of pairs of instances of a probabilistic answering mechanism giving the same output, defined in the previous section). -indistinguishability is usually defined only for pairs of databases D, D that are adjacent in a certain sense (cf. below).

There is no uniquely defined notion of adjacence on pairs of databases; in fact, several are known, and in use in the literature. Actually, a notion of adjacence can be defined in a generic parametrizable manner (as in e.g., [START_REF] Chatzikokolakis | Broadening the Scope of Differential Privacy Using Metrics[END_REF]), as follows. We assume given a map f from the set D of all databases of m-tuples (for some given m > 0), into some given metric space (X, d X ). The binary relation on pairs of databases in D, defined by f adj (D, D ) = d X (f (D), f (D )) is then said to define a measure of adjacence on these databases. The relation f adj is said to define an 'adjacency relation'. -The mechanism M is said to satisfy f adj -differential privacy (f adj -DP), if and only if the above condition is satisfied for every pair of databases D, D in D, and any possible output S ⊂ Range(M).

Comments: (i) Given ≥ 0, the 'usual' notions of -indistinguishability and -DP correspond to the choice of adjacency f adj = d h , where d h is the Hamming metric on databases -namely, the number of 'records' where D and D differ, plus the assumption d h (D, D ) ≤ 1 (cf. [START_REF] Chatzikokolakis | Broadening the Scope of Differential Privacy Using Metrics[END_REF]).

(ii) In Section 6, we propose a more general notion of adjacency, based on a different metric defined 'value-wise', to serve other purposes as well.

(iii) On disjoint databases, one can work with different adjacency relations, using different maps to the same (or different) metric space(s),

Comparing Two Nodes on one or more Runs

In the previous two sections, we looked at the issue of 'quantifying' the indistinguishability of two data tuples or databases, under repeated queries of an adversary A. In this section, our concern will be in a sense 'orthogonal': the issue will be that of quantifying how different the probabilistic mechanism's answers can be, at different moments of A's querying sequence. Remember that the knowledge of A, at any node on the DLTTS of the run corresponding to the query sequence, is represented as a set of tuples; and also that the data forming any tuple are assumed implicitly typed, 'labeled with' (i.e., under) the headers of the database D. To be able to compare two tuples of the same length, we shall assume that there is a natural, injective, type-preserving map from one of them onto the other; this map will remain implicit in general; two such tuples will be said to be type-compatible. If the two tuples are not of the same length, one of them will be projected onto (or restricted to) a suitable subtuple, so as to be type-compatible and comparable with the other; if this turns out to be impossible, the two tuples will be said to be uncomparable.

The quantification looked for will be based on a suitable notion of 'distance' between two sets of type-compatible tuples. For that, we shall first define 'distance' between any two type-compatible tuples; more precisely, define such a notion of distance between any two data values under every given header of D. As a first step, we shall therefore begin by defining, for every given header of D, a binary 'distance' function on the set of all values that get assigned to the attributes under that header, along the sequence of A's queries. This distance function to be defined will be a metric: non-negative, symmetric, and satisfying the so-called Triangle Inequality (cf. below). The 'direct-sum' of these metrics, taken over all the headers of D, will then define a metric d on the set of all type-compatible tuples of data assigned to the various attributes, under all the headers of D, along the sequence of A's queries. The 'distance' d(t, t ), from any given tuple t in this set to another type-compatible tuple t , will be defined as the value of this direct-sum metric on the pair of tuples (t, t ); it will, by definition, be calculated 'column-wise' on the base D, and also on the intermediary databases along A's query sequence; note that it will give us a priori an m-tuple of numbers, where m is the number of headers (or columns) in the database D.

A single number can then be derived as the sum of the entries in the m-tuple d(t, t ). This sum will be denoted as d(t, t ), and defined as the distance from the tuple t to the tuple t in the database D. Finally, if S, S are any two given finite sets of type-compatible tuples, of data that get assigned to the various attributes (along the queries), we shall define the distance from the set S to the set S as the number ρ(S, S ) = min{ d(t, t ) | t ∈ S, t ∈ S } Some preliminaries are needed before we can define the 'distance' function between the data values under every given header of D. We begin by dividing the headers of the base D into four classes classes, for clarity of presentation:

. 'Nominal': identities, names, attributes receiving literal data not in any taxonomy (e.g., gender, city, . . . ), finite sets of such data;

. 'Numerval' : attributes receiving numerical values, or bounded intervals of (finitely many) numerical values;

. 'Numerical': attributes receiving single numerical values (numbers).

. 'Taxoral': attributes receiving literal data in a taxonomy relation.

For defining the 'distance' between any two values v, v assigned to an attribute under a given 'Nominal' header of D, for the sake of uniformity we agree to consider every value as a finite set of singleton values. (In particular, a singleton value 'x' will be seen as the set {x}.) Given two such values v, v , note first that the so-called Jaccard Index between them is the number

jacc(v, v ) = |(v ∩ v )/(v ∪ v )|,
which is a 'measure of their similarity'; but this index is not a metric: the triangle inequality is not satisfied; however, the Jaccard metric

d N om (v, v ) = 1 -jacc(v, v ) = |(v∆v )/(v ∪ v )|
does satisfy that property, and will suit our purposes. Thus defined, d N om (v, v ) is a 'measure of the dissimilarity' between the sets v and v .

Let τ N om be the set of all data assigned to the attributes under the 'Nominal' headers of D, along the sequence of A's queries. Then the above defined binary function d N om extends to a metric on the set of all type-compatible data-tuples from τ N om , defined as the 'direct-sum' taken over the 'Nominal' headers of D.

If τ N um is the set of all data assigned to the attributes under the 'Numerval' headers along the sequence of queries by A, we also define a 'distance' metric d N um on the set of all type-compatible data-tuples from τ N um , in a similar manner. We first define d N um on any couple of values u, v assigned to the attributes under a given 'Numerval' header of D, then extend it to the set of all type-compatible data-tuples from τ N um (as the direct-sum taken over the 'Numerval' headers of D). This will be done exactly as under the 'Nominal' headers: suffices to visualize any finite interval value as a particular way of presenting a set of numerical values (integers, usually). (In particular, a single value 'a' under a 'Numerval' header will be seen as the interval value [a].) Thus defined the (Jaccard) metric distance

d N om ([a, b], [c, d]) is a measure of 'dissimilarity' between [a, b] and [c, d]. .
Between numerical data x, x under the 'Numerical' headers, the distance we shall work with is the euclidean metric |x -x |, normalized as:

d eucl (x, x ) = |x -x |/D,
where D > 0 is a fixed finite number, bigger than the maximal euclidean distance between the numerical data on the databases and on the answers to A's queries.

On the data under the 'Taxoral' headers, we choose as distance function the metric d wp , defined in Lemma 1 (cf. Appendix) between the nodes of any Taxonomy tree.

Note that the 'datawise distance functions' defined above are all with values in the real interval [0, 1]. (This is also one reason for our choice of the distance metric on Taxonomy trees.) This fact is of importance, for comparing the metric ρ we defined above with the Hamming metric, cf. Section 6.

An additonal role for Oracle O: In Section 5.1 below, we present a procedure for comparing the knowledge of an adversary A at different nodes of the DLTTS that models the 'distributed sequence' of A's queries on a given database D. The comparison can be with respect to any given 'target' dataset T (e.g., a privacy policy P on D). In operational terms, so to say, the oracle mechanism O of the DLTTS keeps the target dataset 'in store'; and as said earlier, a first role for the oracle O of the DLTTS is to keep a watch on the deduction of the target dataset by the adversary A at some node. The additional second role that we assign now to the oracle O, is to publish information on the distance of A's saturated knowledge τ (s), at any given node s, to the target dataset T . This distance is calculated wrt the distance ρ, defined above as the minimal distance d(t, t ) between the tuples t ∈ τ (s), t ∈ T , where d is the direct sum of the 'column-wise distances' between the data on the tuples.

Before presenting the comparison schema, here is an example to illustrate -conf ig 2 : successor states s 1 , . . . , s m for a transition t from s , with probability distribution p 1 , . . . , p m ; and respective tags l 1 , . . . , l m , with the contribution from t (cf. Remark 2(a)).

• Objective: Choose states to compare under s, s (with probability measures not lower than p, p ) in conf ig 1 , or in conf ig 2 , or from either.

(i) Compute d i = ρ(l i , T ), i ∈ 1 • • • n, and d j = ρ(l j , T ), j ∈ 1 • • • m. d min (t, T ) = min{d i | i ∈ 1 • • • n}, d min (t , T ) = min{d j | j ∈ 1 • • • m} (ii)
Check IF the following conditions are satified by conf ig 1 :

d min (t, T ) ≤ d min (t , T ) ∃ an i, 1 ≤ i ≤ n, such that d i = d min (t, T ), p i ≤ p,
and p i ≥ p j for any j, 1 ≤ j ≤ m, where d j = d min (t , T ) (iii) IF YES, continue under s with conf ig 1 , else RETURN.

New Metric for Indistinguishability and DP

Given a randomized/probabilistic mechanism M answering the queries on databases, and an ≥ 0, recall that the -indistinguishability of any two given databases under M, and the notion of -DP for M, were both defined in Definition 4 (Section 4), based first on a hypothetical map f from the set of all the databases concerned, into some given metric space (X, d X ), and an 'adjacency relation' on databases defined as f adj (D, D ) = d X (f D, f D ), which was subsequently instantiated to f adj = d h , where d h is the Hamming metric between databases. It must be observed here, that the Hamming metric is defined only between databases with the same number of columns, and usually only with all data of the same type.

In this subsection, our objective is to propose a more general notion of adjacency, based on the distance metric ρ defined above, between type-compatible tuples on databases with data of multiple types. In other words, our D here will be the set of all databases, not necessarily all with the same number of columns, and with data of several possible types as mentioned in the Introduction. We define then a binary relation f Given , we can then define the notion of ρ -indistinguishabilty of two databases D, D under a (probabilistic) answering mechanism M, as well as the notion of ρ -DP for M, exactly as in Definition 4, by replacing f adj first with the relation f ρ adj , and subsequently with ρ. The notions thus defined are more general than those presented earlier in Section 4 with the choice f adj = d h . An example will illustrate this point.

Example 4. We go back to the 'Hospital's public record' of our previous example, with the same notation. For this example, we shall assume that the mechanism M answering a query for 'ailment information involving men' on that record, returns the tuples l 2 , l 4 , l 5 with the probability distribution 0, 2/5, 3/5, respectively. Let us look for the minimum value of ≥ 0, for which these three tuples will be ρ -indistinguishable under the mechanism M.

The output l 2 , with probability 0, will be ρ -distinguishable for any ≥ 0. Only the two other outputs l 4 , l 5 need to be considered. We first compute the ρ-distances between these two tuples: d(l 4 , l 5 ) = (1 -1 20 ) + 0 + 1 + 0 = 39/20. The condition for l 4 and l 5 to be ρ -indistinguishable under M is thus:

(2/5) ≤ e (39/20) * (3/5) and (3/5) ≤ e (39/20) * (2/5),

i.e., ≥ (20/39) * ln(3/2). In other words, for any ≥ (20/39) * ln(3/2), the two tuples l 4 and l 5 will be ρ -indistinguishable; and for values of with 0 ≤ < (20/39) * ln(3/2), these tuples will be ρ -distinguishable.

For the -indistinguishabilty of these tuples wrt the Hamming metric d h , we proceed similarly: the distance d h (l 4 , l 5 ) is by definition the number of 'records' where these tuples differ, so d h (l 4 , l 5 ) = 2. So the condition on ≥ 0 for their -indistinguishabilty wrt d h is: (3/5) ≤ e 2 * (2/5), i.e., ≥ (1/2) * ln(3/2) .

In other words, if these two tuples are ρ -indistinguishables wrt ρ under M for some , then they will be -indistinguishable wrt d h for the same . But the converse is not true, since (1/2) * ln(3/2) < (20/39) * ln(3/2). Said otherwise: M -distinguishes more finely with ρ, than with d h .

Remark 4: The statement¡'M -distinguishes more finely with ρ, than with d h ", is always true (not just in Example 4). For the following reasons: The records that differ 'at some given position' on two bases D, D are always at distance 1 for the Hamming metric d h , by definition, whatever be the type of data stored at that position. Now, if the data stored at that position 'happened to be' numerical, the usual euclidean distance between the two data could have been (much) bigger than their Hamming distance 1; precisely to avoid such a situation, our definition of the metric d eucl on numerical data 'normalized' the euclidean distance, to ensure that their d eucl -distance will not exceed their Hamming distance. Thus, all the 'record-wise' metrics we have defined above have their values in [0, 1], as we mentioned earlier; so, whatever the type of data at corresponding positions on any two bases D, D , the ρ-distance between the records will never exceed their Hamming distance. That suffices to prove our statement above. The Proposition below formulates all this, more precisely: Proposition 2 Let D m be the set of all databases with the same number m of columns, over a finite set of given data, and M a probabilistic mechanism answering queries on the bases in D. Let ρ be the metric (defined above) and d h the Hamming metric, between the databases in D, and suppose given an ≥ 0.

-If two databases D, D ∈ D m are ρ -indistinguishable under M wrt ρ, then they are also -indistinguishable under M wrt d h .

-If the mechanism M is ρ -DP on the bases in D m (wrt ρ), then it is also -DP (wrt d h ) on these bases.

The idea of 'normalizing' the Hamming metric between numerical databases (with the same number of columns) was already suggested in [START_REF] Chatzikokolakis | Broadening the Scope of Differential Privacy Using Metrics[END_REF] for the same reasons. When only numerical databases are considered, the metric ρ that we have defined above is the same as the 'normalized Hamming metric' of [START_REF] Chatzikokolakis | Broadening the Scope of Differential Privacy Using Metrics[END_REF]. Our metric ρ must actually be seen as a generalization of that notion, to directly handle bases with more general types of data: anonymized, taxonomies, . . .

Related Work and Conclusion

A starting point for the work presented is the observation that databases could be distributed over several 'worlds' in general, so querying such bases leads to answers which would also be distributed; to such distributed answers one could conceivably assign probability distributions of relevance to the query. The probabilistic automata of Segala ([12, 13]) are among the first logical structures proposed to model such a vision, in particular with outputs. Distributed Transition Systems (DTS) appeared a little later, with as objective the behavioral analysis of the distributed transitions, based on traces or on simulation/bisimulation, using quasi-or pseudo-or hemi-metrics as in [START_REF] Castiglioni | A Logical Characterization of Differential Privacy via Behavioral Metrics[END_REF][START_REF] Castiglioni | The metric linear-time branching-time spectrum on nondeterministic probabilistic processes[END_REF][START_REF] De Alfaro | Linear and Branching System Metrics[END_REF]. Our lookout in this work was for a syntax-based metric in the mathematical sense, that can directly handle data of 'mixed' types -which can be numbers or literals, but can also be 'anonymized' as intervals or sets; they can also be taxonomically related to each other in a tree structure. (The metric d wp we have defined in the Appendix on the nodes of a taxonomy tree is novel.) Data-wise metrics as defined in our work can express more precisely, in a mathematical sense, the 'estimation errors' of an adversary wrt the given privacy policies on the database, at any point of his/her querying process. (In [START_REF] Rebollo-Monedero | On the measurement of privacy as an attacker's estimation error[END_REF], such estimations are expressed in terms of suitably defined 'probability measures'.) Implementation and experimentation are part of our future work, where we also hope to define a 'divergence measure' between two given nodes on a DLTTS modeling a querying process, in terms of the knowledge distributions at the two nodes -independently of any notion of a given target data set. nodes from the root to x (both included), along the path from the root to x. For any pair x, y of nodes on T , let c xy be the depth of the common ancestor of x, y that is farthest from the root. The Wu-Palmer symmetry measure between the nodes x, y on T is then defined as WP(x, y) = 2 cxy cx+cy . This measure, although considered satisfactory for many purposes, is known to have some disadvantages such as not being conform to semantics in several situations.

What we are interested in, for the purposes of our current paper, is a metric between the nodes of a taxonomy tree, which in addition will suit our semantic considerations. This is the objective of our Lemma below. (A result that seems to be unknown, to our knowledge.) Lemma 1 On any taxonomy tree T , the binary function between its nodes defined by d wp (x, y) = 1 -2 cxy cx+cy (notation as above) is a metric.

Proof: We drop the suffix wp for this proof, and just write d. Clearly d(x, y) = d(y, x); and d(x, y) = 0 if and only if x = y. We only have to prove the Triangle Inequality; i.e. show that d(x, z) ≤ d(x, y) + d(y, z) holds for any three nodes x, y, z on T . A 'configuration' can be typically represented in its 'most general form' by the diagram below. The boldface characters X, Y, Z, a, h in the diagram stand for the number of arcs on the corresponding paths. Thus, for the depths of the nodes x, y, z, and of their farthest common ancestors on T , we get:

c x = X + h + 1, c y = Y + h + a + 1, c z = Z + h + a + 1, c xy = h + 1, c yz = h + a + 1, c xz = h + 1
The '+1' in these equalities is because the X, Y, Z, a, h stand for the number of arcs on the paths, whereas the depths are defined as the number of nodes. Also note that the X, Y, Z, a, h must all be integers ≥ 0.

For the Triangle Inequality on the three nodes x, y, z on T , it suffices to prove the following two relations: Inequality (1): We eliminate the denominators (all strictly positive), and write it out as an inequality between two polynomials eq1, eq2 on X, Y, Z, h, a, which must be satisfied for all their non-negative integer values: The equation eq once expanded (e.g., under Maxima) appears as: eq : Y Z 2 + XZ 2 + aZ 2 + Y 2 Z + 2XY Z + 4hY Z + 2aY Z + 4Y Z + X 2 Z + 4hXZ + 2aXZ + 4XZ + a 2 Z + XY 2 + 4hY 2 + aY 2 + 4Y 2 + X 2 Y + 4hXY + 2aXY + 4XY + 8h 2 Y + 8ahY + 16hY + a 2 Y + 8aY + 8Y

The coefficients are all positive, and inequality (1) is proved.

Inequality (2): We again proceed as above: we first define the following polynomial expressions: To prove inequality (2), we need to show that eqn remains non-negative for all non-negative values of X, Y, Z, h, a. Expanding eqn (with Maxima), we get:

eqn: Y Z 2 + XZ 2 + aZ 2 + Y 2 Z + 2XY Z + 4hY Z + 6aY Z + 4Y Z + X 2 Z + 4hXZ + 6aXZ + 4XZ + 8ahZ + 5a 2 Z + 8aZ + XY 2 + aY 2 + X 2 Y + 4hXY + 6aXY + 4XY + 8ahY + 5a 2 Y + 8aY + 4hX 2 + 4aX 2 + 4X 2 + 8h 2 X + 16ahX + 16hX + 8a 2 X + 16aX + 8X + 8ah 2 + 12a 2 h + 16ah + 4a 3 + 12a 2 + 8a

The coefficients are all positive, so we are done. .

Definition 4

 4 Let f adj be a given adjacency relation on a set D of databases, and M a probabilistic mechanism answering queries on the databases in D. -Two databases D, D ∈ D are said to be f adj -indistinguishable under M, if and only if, for any possible output S ⊂ Range(M), we have P rob[M(D) ∈ S] ≤ e f adj (D,D ) P rob[M(D ) ∈ S].

(

  iv) The mechanism RR described above is actually log(3)-DP, not only log(3)-LDP. To check DP , we have to check all possible pairs of numbers of the form(P rob[M(x) = y], P rob[M(x ) = y]), (P rob[M(x) = y ], P rob[M(x ) = y]), (P rob[M(x) = y], P rob[M(x ) = y ]), etc., where the x, x .... are the input instances for RR, and y, y , ... the outputs. The mechanism RR has 2 3 possible input instances for (X, F 1 , F 2 ) and two outputs (True, False); thus 16 pairs of numbers, the distinct ones being (1/4, 1/4), (1/4, 3/4), (3/4, 1/4), (3/4, 3/4); if (a, b) is any such pair, obviously a ≤ e log(3) b. Thus RR is indeed log(3)-DP.

  ρ adj (D, D ) between D, D in the set D by setting f ρ adj (D, D ) = ρ(D, D ), visualizing D, D as sets of type-compatible data tuples.

  d(x, z) ≤ d(x, y) + d(y, z) and d(y, z) ≤ d(y, x) + d(x, z). by showing that the following two algebraic inequalities hold: h+2 * a+2) ≥ 1 -2 * (h+a+1) (Y +Z+2 * h+2 * a+2) The third relation d(x, y) ≤ d(x, z) + d(z, y) is proved by just exchanging the roles of Y and Z in the proof of inequality (1).

  eq1 : (X + Y + 2 * h + a + 2) * (Y + Z + 2 * h + 2 * a + 2) * (X + Z + 2 * h + a + 2) eq2 : (h + 1) * (Y + Z + 2 * h + 2 * a + 2) * (X + Z + 2 * h + a + 2) +(h + a + 1) * (X + Y + 2 * h + a + 2) * (X + Z + 2 * h + a + 2) -(h + 1) * (X + Y + 2 * h + a + 2) * (Y + Z + 2 * h + 2 * a + 2) eq : eq1 -2 * eq2. We need to check: eq ≥ 0 ?

  eq3 : (X + Y + 2 * h + a + 2) * (X + Z + 2 * h + a + 2) * (Y + Z + 2 * h + 2 * a + 2); eq4 : (h + 1) * (Y + Z + 2 * h + 2 * a + 2) * (2 * X + Y + Z + 4 * h + 2 * a + 4); eq5 : (h + a + 1) * (X + Y + 2 * h + a + 2) * (X + Z + 2 * h + a + 2); If we set eqn : eq3 + 2 * eq5 -2 * eq4, we get eqn : -2(h + 1) * (Z + Y + 2h + 2a + 2) * (Z + Y + 2X + 4h + 2a + 4) + (Y + X + 2h + a + 2) * (Z + X + 2h + a + 2)(Z + Y + 2h + 2a + 2) + 2(h + a + 1) * (Y + X + 2h + a + 2) * (Z + X + 2h + a + 2)

Table 1 :

 1 Example 1. Table1below is the record kept by the central Hospital of a Faculty, with three Departments, in a University, on recent consultations by the faculty staff. In this record, 'Name' is an identifier attribute, 'Ailment' is sensitive, the others are QI; 'Ailment' is categorical with 3 branches: Heart-Disease, Cancer, and Viral-Infection; this latter in turn is categorical too, with Hospital's 'secret' record 2 branches: Flu and CoVid. By convention., such taxonomical relations are assumed known to public, (For simplicity of the example, we assume that all Faculty staff are on the consultation list of the Hospital.)The Hospital intends to keep 'secret' information concerning CoVid infected faculty members; the tuple ¬(John, 46, M, #, CoV id) therefore constitutes its privacy policy. The following Table2is then published for the public, where the 'Age' attributes have been anonymized as (integer) intervals, the 'Ailment' attribute is anonymized by an upward push in the taxonomy.A certain person A, who met John at a faculty banquet, suspected John to have been infected with CoVid; (s)he thus decides to consult the published record of the hospital for information. Knowing that the 'John' (s)he met is a

	Name Age Gender	Dept.	Ailment
	Joan		24	F	Chemistry Heart-Disease
	Michel	46	M	Chemistry	Cancer
	Aline		23	F	Physics	Flu
	Harry	53	M	Maths	Flu
	John		46	M	Physics	CoVid
	Age		Gender	Dept.	Ailment
	1	[20 -30[	F	Chemistry Heart-Disease
	2	[40 -50[	M	Chemistry	Cancer
	3	[20 -30[	F	Physics	Viral-Infection
	4	[50 -60[	M	Maths	Viral-Infection
	5	[40 -50[	M	Physics	Viral-Infection

Table 2 :

 2

	a priori

Hospital's published record 'man' and that the table 2 must contain John's health bulletin), A has as choice lines 2, 4 and 5 ( 2 , 4 , 5 ) of Table

2

. A being in the lookout for a 'CoVidinfected' man, this choice is reduced to the last two tuples of the table -

Table 5 :

 5 . DBMS's Answer to A's query

	Client id	Name	Monthly-balance
	1	Claude	320
	2	Paul	270
	3	Jean	420
	4	Martin	150
	5	Michel	420
	Table 3: L's (secret) client record
	Number of Clients Minimum Total Monthly-balance
	5		≥ 1580
	Table 4: Bank L's Monthly public statement
	An adversary A wants to know if Jean is a client of the bank, and if so, with

A formal definition of quasi-identifier attributes does not seem to be known. For our purposes, it suffices to see them as those that are not identifiers nor sensitive.

how the notions developed above operate in practice.

Example 1 bis. We go back to the Hospital-CoVid example seen earlier, more particularly its Table 2 We are interested in the second, fourth and fifth tuples on the record, respectively referred to as l 2 , l 4 , l 5 . The 'target set' of (type-compatible) tuple in this example is taken as the (negation of the) privacy policy specified, namely the tuple T = (John, 46, M, #, CoV id).

We compute now the distance d between the target T , and the three tuples l 2 , l 4 , l 5 . This involves only the subtuple L = (46, M, #, CoV id) of T : The tuple l 2 is the farthest from the target, while l 5 is the closest. This 'explains' that the adversary can choose the branch on the transition that leads to a state where l 5 is added to his/her knowledge. This is more formally detailed in the procedure presented below.

A (Non-Deterministic) Comparison Procedure

• Given: DLTTS associated with a querying sequence, by adversary A on given database D; and a Target set of tuples T .

• Given: Two states s, s on the DLTTS, with respective saturated tags l, l , and probabilties p, p . Target T assumed not in l or l : neither ρ(l, T ) nor ρ(l , T ) is 0. Also given:

-conf ig 1 : successor states s 1 , . . . , s n for a transition t from s, with probability distribution p 1 , . . . , p n ; and respective tags l 1 , . . . , l n , with the contribution from t (cf. Remark 2(a)).

Appendix

Taxonomies are frequent in machine learning. Data mining and clustering techniques employ reasonings based on measures of symmetry, or on metrics, depending on the objective. The Wu-Palmer symmetry measure on tree-structured taxonomies is one among those in use; it is defined as follows ( [START_REF] Wu | Verb Semantics and Lexical selection[END_REF]): Let T be a given taxonomy tree. For any node x on T , define its depth c x as the number of


Benedikt Barthelmess

Jean Langlois

Bi-and Multilateral Lenders' Support to SMEs through Private Sector Financial Intermediaries in the MENA Region: A Critical Analysis

Keywords: F35, O19, O31 Development Bank, Job Creation, Innovation

This paper documents for the first time the considerable increase of bi-and multilateral financial institutions' support to small and medium-sized enterprises (SMEs) in the Middle East and North Africa, following the political unrest and civil strife across the region since 2011. Focusing upon intermediated lending, the main financing channel, it assesses the underlying economic logic and implementation of this kind of SME financing. It is found that SMEs' contribution to economic development is insufficiently well understood and, to some extent, has been misinterpreted, which implies that the development banks' lending operations lack appropriate targeting to achieve economic and social lending objectives. A review of the academic literature on financial exclusion and development finance, moreover, concludes that the lenders' reliance upon large, often foreign-owned, commercial banks is not likely to achieve the desired developmental impact.

Introduction

There has been a widespread perception for a number of years that a central obstacle to economic development in the Middle East and North Africa (MENA) is the lack of access to finance for small-and medium-sized enterprises 1 (SMEs). There has also been a growing consensus that the political unrest and civil strife across the region since 2011 has been fuelled by economic discontent, including high unemployment rates. [START_REF] Amsden | Asia's Next Giant: South Korea and Late Industrialization[END_REF] Unsurprisingly, with SMEs contributing up to 40 per cent of formal private sector employment in the region (Nasr and Pearce 2012, 5), the argument that SME sector development could serve as a particularly effective means of tackling the region's political and socio-economic crises has thus gained significant traction.

As a consequence, the development community has been dedicating growing amounts of resources to the provision of SME financing. Notably, the "Deauville Partnership with Arab Countries in Transition", launched in 2011 at the G8 Summit in Deauville, made significant commitments towards SMEs, turning the region into a major beneficiary of development assistance directed toward SMEs (EBRD 2016a). In 2015, financial support for SMEs was further reinforced by the European Commission, the driving force behind the "EU Initiative for Financial Inclusion", a collective effort involving several European bilateral and multilateral development banks (EC 2016a).

Data on bi-and multilateral lenders' loan portfolios in the region gathered by the author shows that the largest part of SME financing has been provided through a mechanism where local intermediaries are given credit lines to lend funds on to SMEs. Since 2012, the European Investment Bank (EIB), the European Bank for Reconstruction and Development (EBRD) and the International Finance Corporation (IFC) alone have allocated between 8 and 31 per cent of their entire MENA loan portfolios, or about USD 6.2 billion, to SME lending via commercial banks.

The heavy reliance upon this particular financing mechanism is puzzling, [START_REF] Alario | EIB financing with own resources through global loans under Mediterranean mandates[END_REF] The definition of SMEs has been subject to controversy, which goes beyond the scope of this work. A common definition recommended by the European Commission (EC 2016) uses the staff headcount (>10 and ≤ 250) and annual turnover (>EUR 2mn and ≤ EUR 50mn) to identify SMEs.

2 e.g. Nasr and Pearce (2012) given that there is relatively little direct evidence that it is suited to achieve stated development objectives, such as job creation. Indeed, several major independent evaluations of past intermediated lending projects published over the last few years mostly fail to identify development-related impacts. [START_REF] Arestis | Financial Liberalisation and the Relationship Between Finance and Growth[END_REF] This mechanism has instead mainly been justified using a two-tier deductive logic: first, SMEs' special economic contributions and, second, their financial exclusion. However, both topics have been subject to on-going controversy often due to very ambiguous empirical findings, thus lending rather weak support to the mechanism and its implementation.

Despite the prevalence of this financing model, neither its shaky logical foundations nor its modus operandi have been given much academic attention to date and even less so with respect to the MENA region. Criticisms have mostly been restricted to the operations' lack of transparency, [START_REF] Armendáriz | The Economics of Microfinance[END_REF] but there has been no comprehensive economic critique to date. Building upon this observation, this paper has two main objectives. First, it, for the first time, documents the recent developments in International Financial Institutions' (IFIs) [START_REF]Financial Institutions Search[END_REF] SME financing activities in MENA countries (Section 2). In order to provide a comprehensive picture, lending information from IFIs' project databases is examined. Second, it offers an analysis of intermediated financing in the MENA region focusing upon the case of Egypt, the largest beneficiary of the SME support initiatives (Sections 3-4).

This analysis draws upon existing academic research as well as findings from a large body of IFI-commissioned independent evaluations. which have received little attention to date. It is subdivided into two parts: Section 3 reviews the role of SMEs in economic development, shedding light upon their much discussed "special contribution". Moreover, the implications for SME lending are reviewed and it is found that IFIs likely fail to sufficiently target lending in order to generate any of the potential benefits of SME development. Section 4 considers the nature of the financing constraint in Egypt. This part has three main objectives. First, it offers a brief overview of how SMEs' financial exclusion can be quantified. Second, it outlines the major theories conceptualising financial exclusion and argues that IFI lending strategies are centred upon the asymmetric information paradigm, lending cyclicality and notions of financial sector competition, thus eclipsing an extensive body of relevant research. Third, it offers a discussion of the potential effectiveness of intermediated SME lending in light of these theories.

For this purpose, it reviews the implications for a developmentally efficient financial system, arguing that IFIs preference for large, often foreign-owned commercial banks is unlikely to achieve the development objectives.

Section 5 concludes with the principal observation that the paradigmatic shift in IFI lending towards SME lending via commercial banks has been poorly justified on economic grounds. On top of this, the implementation of the lending activities suffered from an insufficient understanding of financial exclusion, instilling little confidence that development objectives can be achieved. These conclusions are complemented by some policy consideration. reasons including lending to connected parties and political interference.

Key Players, Policy Initiatives and Business Volumes

There is no official aggregated data available on the loan volumes earmarked for SME lending that have been channelled into the region by development financiers. This is mainly due to the high degree of fragmentation of the donor community, which means that bilateral initiatives in particular often go unrecorded ( (Fig. 1). The EIB's lending was notably complemented by smaller volumes from the KfW and the IFC.

The political unrest in several MENA countries resulting in the toppling of In 2015, the "EU Initiative for Financial Inclusion" was created as a part- The relationship between financial and economic development has been a subject of debate throughout the modern history of economics (Arestis 2005, 2). The argument that specifically SMEs' disconnect from the financial sector represents a major obstacle to development has emerged more recently from this broader debate (Berger and Udell 1998, 1). This argument has also been adopted by IFIs and is tightly linked to their strategy to support SMEs.

Much emphasis has been placed on SMEs' contribution to job creation, economic growth and innovation. This section reviews the substance of these claims and analyses their implications for intermediated SME lending. However, looking beyond the headline figures, empirical findings in the existing academic literature reveal a much more ambiguous relationship between SMEs and job creation, thus calling into question the repeated claim that SMEs constitute a "major job creation engine" (ILO 2015, v). First, a number of studies have highlighted the methodological issues that arise when analysing SME data with respect of their impact on employment. Page and Söderbom (2012, 10) highlight that especially the difficulties in distinguishing between gross and net job creation have been subject to much debate. [START_REF] Beck | Foreigners vs. Natives: Bank Lending Technologies and Loan Pricing[END_REF] Small firms may create many jobs, but, given their low survival rates, they destruct most of them soon after. This problem could be addressed by using panel data, but most studies have to rely upon cross-sectional datasets.

SMEs as Job Creation Engines

Second, more recent research found that firms' ability to create jobs also

depends

SMEs as Drivers of Industrial Growth and Innovation

Albeit to a lesser extent, IFIs have also justified their interventions using the argument that SMEs play a particularly important role in driving growth and innovation in MENA countries. [START_REF] Benhassine | From Privilege to Competition: Unlocking Private-Led Growth in the Middle East and North Africa[END_REF] The argument that SMEs' contributions depend on their activity also seems to hold true when it comes to innovation. Biggs (2002, 7) writes that, based upon empirical evidence from the US, SMEs' innovation rates are greater in high technology, skill intensive industries, whilst larger firms tend to achieve higher rates in capital-intensive industries. This seems to be confirmed by Brunnhuber et al. (2013, 19) who find that the economic impact of EIB lending in terms of growth, job creation and competitiveness was greatest when loans went to SMEs who had introduced innovations.

In developing countries, determining SMEs' role in innovation has been met

with additional data challenges. There is evidence that the composition of the SME sector in developed and developing countries is not identical, as in developing countries the sector mainly consists of small or micro enterprises with low-productivity and little growth and job creation potential (ILO 2015, v). This means that the impact of SMEs on innovation in devel-oping countries is likely overstated since most studies rely upon data from developed countries.

Implications for Intermediated SME Lending

The review of academic literature and suggests that there is insufficient evidence to support the broad economic development-related claims used by IFIs to justify their SME lending activities. This means that much more rigorous monitoring of lending portfolios would be necessary to ascertain their impact. This, however, appears to be a major shortcoming of the lending programmes. IFIs have gathered so little information on intermediaries portfolios that, in the case of the EIB, not even the exact number of Although evaluations for lending programmes of other development banks are less frank with respect to this matter, they do not give rise to the impression that targeting would be any more rigorous. 4 SMEs' Access to Finance: Theories, Evidence and Remedies

There have been extensive debates about SMEs' restrictions on accessing financing over the last few decades. This issue has also received significant scrutiny with respect to MENA countries, culminating in several detailed reports, notably the above-mentioned WB flagship report on financial access and stability (Rocha, Arvai and Farazi 2011), the OECD's "Access to

Finance" report (2010) and the EIB's "Neighbourhood SME Financing" report (2016c). These reports consistently identify access to finance as a main obstacle facing SMEs in the region. On this basis, enhancing SMEs' access to finance has become a principal justification of lending programmes along with claims relating to their special economic contributions. [START_REF] Birch | Job Creation in America: How Our Smallest Companies Put the Most People to Work[END_REF] This section provides a brief exposition of the existing literature on SMEs' financial exclusion and possible remedies, which is then contrasted with the IFIs' intermediated SME financing strategy drawing upon loan portfolio data and evaluations of past lending projects.

Quantifying Financial Exclusion

The

Causes of SME's Restricted Access to Finance

Information Asymmetries and Institutional Weaknesses

To the extent that enterprises are finance-constrained, this constraint has primarily been attributed to banks' rationing of credit and high borrowing costs. [START_REF] Cbe | Al bank al markazi almasri yedtlaq shamel litahfeez al bonook litamweel al mashru'at al sagheera wa al metwasdtah liziadah alnateg almahly wa tawfeer fars 'aml lilshabab wa khafadt nisbah al batalah[END_REF] For several decades, the mainstream economic theory as promoted by IFI publications [START_REF] Ceb | Small and Medium Enterprise Programme in South-Eastern Europe supporting a EU programme[END_REF] restricted to a narrow range of assets, which is mostly limited to land and real estate, as shown in Figure 5. Such stringent collateral requirements are considered a highly deficient screening device for three main reasons. [START_REF] Cbe | Al bank al markazi almasri yedtlaq shamel litahfeez al bonook litamweel al mashru'at al sagheera wa al metwasdtah liziadah alnateg almahly wa tawfeer fars 'aml lilshabab wa khafadt nisbah al batalah[END_REF] An indication of credit rationing is the extremely low loan-to-deposit ratio (LTD) in MENA (de Lima, et al. 2016, 37). [START_REF] Ceb | Small and Medium Enterprise Programme in South-Eastern Europe supporting a EU programme[END_REF] See, for instance, Creane et al. (2004, 9) or EBRD (2010, iii) [START_REF] Creane | Financial Sector Development in the Middle East and North Africa[END_REF] Average ratio for the value of the collateral to the value of the loan Enforcement problems relate to the potential difficulties in ensuring repayment following the completion of an investment project, as the project's returns may be dissimulated by the debtor. The dissimulation problem is exacerbated if debt contracts are difficult to enforce due to a weak legal system (Armendáriz and Morduch 2005, 46). Deficient collateral and insol-vency regimes have been identified as a major hindrance to credit expansion (Betz and Ravasan 2016). Benhassine et al. (2009, 153), furthermore, find a causal link between higher collateral ratios and costly, time-intensive processes to foreclose collateral and a general lack of confidence in institutions.

Apart from causing credit rationing, information asymmetries in weak institutional environments are believed to increase transaction costs due to higher screening and monitoring costs. Such costs are relatively invariable with respect to the size of a loan and raise the break-even point of investments. Nasr (2006, 41) notes that, in addition to interest rates for Egyptian SMEs ranging between 22 and 28 per cent, "private commercial banks and foreign branches charge between 1 and 5 per cent for fees on loans, plus 0.3 to 1 percent on collateral value for evaluation".

Credit Rationing Beyond Information Asymmetries

Despite the extensive focus on information asymmetries in academic literature, it has been argued that this paradigm cannot fully explain low lending volumes. Criticisms and alternative suggestions have been forthcoming from a number of angles. Some of these views also figure in IFI publications, but their implications have been given little attention or were subject to questionable interpretations.

The EBRD (2015, 33) and the EIB (2014a, 3) have highlighted strong evidence for the existence of a cyclical component in the availability of credit, which disproportionately affects SMEs. Notably following the 2007/08 financial crisis, large numbers of SMEs found themselves unable to obtain sufficient working capital, not to mention capital for investment expenditure, threatening their survival. However, in Egypt and other MENA economies, where large numbers of SMEs are disconnected from the financial sector and hence do not rely upon credit, lending cyclicality has a limited explanatory power.

There is a large body of Post-Keynesian literature, which has focused upon uncertainty and power relations. Wolfson (1996, 450) highlights the relevance of fundamental uncertainty, arguing that both the borrower and the lender are subject to fundamental uncertainty about the future. Mazzucato (2013, 851) further argues that, due to their uncertain nature, some investments are naturally unattractive to commercial banks ('Knightian uncertainty'). This characteristic applies in particular to investments in innovation, which suggests that small innovative companies with large growth and employment creation potential, as discussed in Section 3.1-3.2, have little or no appeal to conventional commercial banks. Ramskogler (2007, 31) adds the element of power to the concept of uncertainty, arguing that SMEs' restricted access to finance may result from their position in oligopolistic markets. Given larger firms' market power, uncertainty is structurally concentrated among the less powerful SMEs, which makes them less attractive especially to large banks whose balance sheets allow them to meet the demands of the large corporate players.

From this, it follows that lenders might not only be hesitant to lend to smaller companies due to information asymmetries, but also allocate credit based on their conventional knowledge of a company's type of activity, its position in the market and the overall economic and political environment.

These factors likely play an important role in Egypt, where many sectors are dominated by the state and the military. Given the tremendous power of the military not only in specific markets, but also in security and political matters, there is widespread acceptance among investors that projects involving the military are less risky and more likely to succeed (Marshal 2015, 4). This implies that in Egypt's concentrated banking sector credit allocation is skewed toward larger companies with close ties to the military.

Although high concentration levels in the Egyptian banking sector are also considered a problem by IFIs, its impact on lending in relation to the structure of individual industries has been insufficiently explored to date. Instead, the dominance of large banks has been primarily interpreted from a competition and ownership point of view. Nasr (2006, 33), for example, attributes poor lending outcomes to the inefficiency, undercapitalisation, poor asset quality, weak incentive structure and inadequate risk management of monopolistic state-owned banks. Along with Mian's findings, contrary evidence on foreign banks' role vis-àvis SMEs in developing countries has been significantly more multifarious, drawing upon a wealth of different datasets, including loan-, bank-and firmlevel data. A number of works reveal that large and foreign banks are less likely to lend to small and opaque firms. [START_REF] Haas | Foreign Banks in Transition Countries: To Whom do They Lend and How Are They Financed[END_REF] This has been complemented by studies incorporating time series data, which observe a decline in outreach and SME lending following foreign bank entry in several countries. [START_REF] Haas | What determines banks' customer choice? Evidence from transition countries[END_REF] There is also evidence for 'cream-skimming', where foreign banks mainly lend to the most profitable firms with negative effects for domestic banks and their (SME) customers. [START_REF] Haas | What determines the composition of banks' loan portfolios? Evidence from transition countries[END_REF] From a competition point of view, Peterson and Rajan (1995) find that young firms are more likely to obtain credit in concentrated loan markets, which contradicts IFIs' push for competition.

Market Access and the Implications for SME Lending

Bank Type and Size

Similar to the issue of bank ownership, the question of which type of banks are best positioned to support SME development has neither been settled on an empirical nor theoretical level. IFIs preference for large, often publiclylisted commercial banks again appears to be based upon a deductive logic, which primarily uses the experience of the Anglo-Saxon economies. Such an approach is fallacious, as it neither accurately reflects the historical devel- There is a widespread consensus that smaller, locally embedded banks tend to lend larger shares of their loan books go to SMEs. [START_REF] De Kok | Is Small Still Beautiful? Literature Review of Recent Empirical Evidence on the Contribution of SMEs to Employment Creation[END_REF] The conventional view is that smaller banks engage in relationship lending, which allows them to deal with the opaqueness arising from asymmetric information structures There is a rich body of literature on the role of financial co-operatives in various countries. Bülbül et al. (2013) note that, until the recent wave of financial liberalisation, almost all European countries had a three-pillar banking system in which co-operative banks represented a major pillar alongside private and (public) savings banks. There is broad agreement that co-operative banks have been highly successful at promoting small innovative enterprises in Western Europe. [START_REF] De La Torre | Bank involvement with SMEs: Beyond relationship lending[END_REF] Similarly, research on Central and Eastern European countries shows that co-operative banks dedicate the largest shares of their portfolio to SMEs and that there is a strong positive correlation between their presence and SME performance (Hasan, et al. 2014). In the Middle East, co-operative banks have little or no presence with the exception of Mo-

Figure 1 :

 1 Figure 1: Annual Volume of IFI-sponsored credit lines for on-lending to SMEs signed with MENA-based intermediaries

Figure 2 :Figure 3 :

 23 Figure 2: Annual Volume of IFI-sponsored credit lines for on-lending to SMEs signed with MENA-based intermediaries excluding Lebanon

Figure 4 :

 4 Figure 4: Total volume of IFI-sponsored credit lines for on-lending to SMEs by country since 2011

  figures, several influential studies have argued that SMEs create an overproportionate number of jobs.[START_REF] Beck | SMEs, Growth, and Poverty: Cross-Country Evidence[END_REF] A review of IFI strategy documents and other reports suggests that these institutions collectively subscribe to this argument and that the employment effects of lending programmes are considered a key outcome.[START_REF] Beck | When arm's length is too far: relationship banking over the busi-ness cycle[END_REF] Across the MENA region, job creation is frequently prioritised, given the high rates of youth and female unemployment. An IFC report, for instance, points out that "youth unemployment of 25.1 percent for the Middle East and 23.7 percent for North Africa [. . . ] and female-entrepreneurship levels of 12 to 15 percent [...] severely affect economic growth"(Saleem 2013, 2). In this context, coupled with the recent popular uprisings, Page and Söderbom (2012, 4) observe that "supporting micro and small enterprises has increasingly come to be viewed by the donor community as a 'quick fix' to boost job creation for the young and growing populations". 10 e.g.Birch (1979 and 1987) and Beck and Demirguc-Kunt (2005)[START_REF] Beck | When arm's length is too far: relationship banking over the busi-ness cycle[END_REF] See Nasr and Pearce (2012),EBRD (2006, 2012 and 2016b) andEIB (2014b, 7)

Figure 5 :

 5 Figure 5: Types of Collateral Required in Egypt (Percentage of Total Loans)

4. 3 . 1 IFIFigure 6 :

 316 Figure 6: IFI partner banks in Egypt for SME lending, incl. ownership and ranking by total assets

29

  Berger, Klapper and Udell (2001),Mian (2006),de Haas et al. (2010), Hasan et al. (2014) 30 Beck and Martínez Pería (2010) and Gormley (2010) 31 Detragiache et al. (2008) and Gormley (2010) opment experiences of these nor of other economies, which benefited from different types of financial systems. Taking a broader and more historyminded approach, Bateman (2014, 111-116) develops a useful typology of banks that are believed to have played important roles "developmentally efficient financial systems": (1) locally-embedded private banks, (2) financial co-operatives and co-operative banks, and (3) local state-owned and directed FIs and development banks.

(

  de la Torre, Martínez-Pería and Schmukler 2010, 2281).Bateman (2014, 115) notes that small private banks are usually family-owned, use longstanding trust-based connections with local businesses and respect community obligations. Given their embeddedness in the local community, they can also rely upon social rather than physical collateral, thus lowering the requirements for the latter.Ramskogler's (2007) Post-Keynesian theory supports the view that smaller banks are more incentivised to lend to smaller companies, arguing that small banks have to avoid the monopsonistic power or relatively large debtors, which would weaken their bargaining position.

4. 3 . 4 5 Conclusion

 345 Large (Foreign) Commercial Banks as Promoters of Financial Inclusion: An Unlikely ScenarioThere are some immediate conclusions to be drawn from the literature on bank ownership, size and type as well as practical lending experience. First, increasing SME lending is neither just a matter of improving large 'bankable' FIs' governance, lending techniques and loan tenors nor of alleviating their liquidity shortages during economic downturns. Second, supporting large shareholder value maximising banks encourages a banking monoculture, including a regulatory environment that is hostile to alternative banking models and, potentially, more inclusive lending.Third, along the lines ofMazzucato and Penna (2014, 21), largely indiscriminate wholesale lending favours quantity over quality of lending. The experience of most developed countries suggests that successful SME lending needs to be strategic and tends to be linked to some form of country-level industrial policy. Intermediated lending as practised thus lacks the potential of sustaining or driving employment and growth, since financing is unlikely to reach those enterprises, which generate most jobs, innovation and growth.Fourth, the quality and availability of appropriate financial intermediaries in developing countries poses major obstacles to IFIs. Nevertheless, the belief that targeting relatively easily bankable FIs can serve as a short-cut to achieve SME development objectives is unrealistic. Instead, a profound shift in the lending strategy is necessary, focusing on promoting a broader range of FI types with more 'SME-friendly' characteristics.[START_REF] Detragiache | Foreign Banks in Poor Countries: Theory and Evidence[END_REF] See WB (2006 and 2016d) andKfW (2005 and 2009) This work demonstrated that there has been an important recent shift in IFIled lending in MENA countries toward intermediated lending to SMEs. An analysis of the underlying premises of this lending practice showed that they lacks empirical and theoretical support. An excessive focus upon headline indicators of SMEs' role within the economy has impaired a clear understanding of the links between SMEs and economic development and employment.Empirical evidence using more granular data suggests that a large share of SMEs are subsistence enterprises and of little relevance for job creation and economic growth. The SME sector is also in other respects very heterogeneous, making the targeting of very specific kinds of enterprises necessary.Similarly, a review of the possible determinants of financial exclusion underscored how this phenomenon cannot be reduced to information asymmetries and related issues. Even though other determinants, notably lending cyclicality, have been given greater attention by IFIs in recent years, determinants, such as fundamental uncertainty and power relations, have been ignored. Considering this broader set of theories of financial exclusion, as well as empirical evidence on lending activities of different types of banks, it is thus unclear how loans extended through a relatively homogenous category of large transactional lenders could possibly reach pro-growth and pro-employment companies.A radical overhaul of IFIs' flagship SME lending programmes hence appears unavoidable, if the stated economic and social targets are to be achieved.Admittedly, the alternative lending routes are not obvious, as section 4 suggests. Considering, for instance, the relatively homogenous and centralised nature of the Egyptian banking sector, the existing alternatives are mostly state-owned development banks. Cooperation with such banks has proven difficult in the past, but should be reconsidered, considering their crucial importance in other countries. For reasons similar to commercial banks, including the ability to deal with uncertainty and long amortisation schedules, venture capital financing activities, as they have been promoted by the EIB, are unlikely to successfully serve as alternative channels. This, however, needs to be further researched. To some extent, IFIs should also stop relying on the existing FIs and reappraise their role as market shapers, in which they actively support the development of different types of locally embedded banks with stronger developmental track records.

  Egyptian policymakers, for instance, have embraced schemes to support SMEs with the aim to improve the lending climate for SMEs. In January 2016, Egypt's president El-Sissi announced the launch of an EGP 200 billion 9 loan programme to support SMEs (Reuters 2016). In the same month, the Central Bank of Egypt (CBE 2016) announced that it would introduce measures requiring commercial banks to dedicate 20 per cent of their loan portfolio to SME credits.

	tion across the region.
	late 2016 onwards (EC 2016a, 5). Its aim is to mobilise more than EUR 1.5
	billion and reach more than 200,000 MSMEs. Out of the total EUR 1.5 bil-
	lion, about EUR 572.5 million are to be used to support MSMEs via partner
	financial intermediaries. Not all of the funding is new; at least some of it
	represents a mere incorporation of existing projects, such as the SANAD
	microfinance fund.
	On-lending to SMEs through local financial intermediaries constitutes the
	largest share of funds committed by the lenders. The available loan data
	suggest that since 2011 about 31 per cent of the EIB's MENA loan port-
	folio was used this way. For the EBRD and IFC the percentage is lower,
	but nonetheless seizable, at 17 and 8 per cent respectively (Figure 3). The
	main beneficiaries of this wave of loans have been banks in Egypt, Morocco
	and Tunisia, which sign loan agreements totalling USD 7 billion since 2011
	(Figure 4).
	International efforts to boost SME lending have been paralleled by local ac-

[START_REF] Beck | Foreign bank participation and outreach: Evidence from Mexico[END_REF]

, to expand financing to MSMEs from

[START_REF] Beck | SME Finance in Africa[END_REF]

Equivalent of USD 25 billion at this time 3 IFIs' Love for SMEs: Understanding SMEs' Role in the Economy

  The findings, moreover, suggest that SME lending is only likely to have the desired employment and economic growth effects if very specific groups or types of SMEs are targeted. Otherwise, interventions risk having no effect, creating low-quality unsustainable jobs or causing productivity declines. The idea that only a certain set of enterprises should receive particular attention is by no means new and, for example, figures prominently in the work of the developmental state school of thought.[START_REF] Besedová | Missing in action: The winners, the losers and the unknowns of the European Investment Bank's anti-crisis SME offensive in central and eastern Euro[END_REF]

	Targeting SMEs using criteria such as age or activity hence appears to be
	paramount. Yet, an analysis of IFIs' MENA loan portfolios provides no
	evidence that IFIs apply any serious form of discrimination in their inter-
	mediated SME lending operations. Only the EIB's portfolio information
	mentions some broad targeting of, for example, the industrial or tourism
	sector. Additionally, an IEG report from 2014 (WB 2014, 39-40) finds that
	IFC lending agreements generally fail to define the private sector beneficia-
	ries that are to be targeted:

borrowers were known for an EU-wide lending programme from 2005-2011

(Brunnhuber, et al. 2013, 6

). An Independent Evaluations Group (IEG) report

(WB 2013, 39)

found similar deficiencies in WB group members' data collection: "[...] measuring the development results of financial sector projects, in particular those involving wholesaling of IFC funding via a financial intermediary, is inherently difficult. This is because IFC and MIGA have no relationship with, access to, or often even knowledge of the companies or microenterprises that are borrowing or leasing from the financial intermediary [...]. Moreover, the level of funding provided by IFC [...] relative to total assets of the intermediary, and the fungibility of funds, means that the intermediary's sub-portfolio can, at best, be only notionally attributed to IFC or MIGA interventions." [Italics added] 15 15 See also EBRD (2010, 18) and EIB (2005, 6) "A review of 166 legal agreements for IFC TSME [Targeted SME] investment projects in the financial markets line shows that only 38 percent contain a definition of SME in their legal agreement [...]. Furthermore, 60 percent of projects that say they are targeting SMEs have no provisions mentioning SMEs as beneficiaries. Overall, only 20 percent of the targeted SME Financial Markets portfolio both define SMEs and have provisions mentioning them." [Italics added] 17

  or most SMEs do not have access to credit. This is confirmed by a survey of FIs in the region, which found that only 8 per cent of the total lending

	volume went to SMEs, which translates into only 20 per cent of SMEs having
	a loan or credit line (Rocha, Farazi, et al. 2011, 1-2).
	Investigating the borrower side, the MENA enterprise survey conducted by
	the WB, EBRD and EIB in 2012 and 2013 adds further nuances to this
	picture of SMEs' financing deprivation. In their evaluation of the survey
	responses, de Lima et al. (2016, 39-40) find that 77 per cent of working
	capital and investment is internally sourced, which is above the average in
	lower-and upper-middle-income economies. The external sources of finance
	primarily consist of supplier and bank credit, with bank credit exhibiting a
	positive correlation with the extent of financial deepening. In Egypt, bank
	credit is found to be an almost insignificant financing source.
	20 This small, but important distinction, has caused confusion and misrepresentation by
	some in the development community. For example, the EBRD Transition Report 2015-16
	(EBRD 2015, 31), using the same survey data, claims that the above-mentioned 85 per
	cent of the Egyptian respondents are credit-constrained.
	stands in stark contrast to high concentration levels of private credit, which 21 e.g. Rocha, Arvai and Farazi (2011, 98), WB (2016b) or Dalberg (2011, 4)
	has been particularly pronounced in Egypt, where, according to central bank 22 The WB (2016b) estimates that around 2.1 million Egyptian micro and small enter-
	data from 2009, over half of all credit went to 1 per cent of their clients (WB prises have no access to finance.
	2016a, 1). The fact that loans are highly concentrated suggests that many

above-mentioned reports reflect a broad consensus that most SMEs are excluded from the financial sector in MENA countries, yet measuring the extent to which SMEs lack access to finance is notoriously difficult. The available evidence relies upon survey data from the financial sector (supply side) and enterprises (demand side). On the supply side, the financial sector is dominated by banks. De Lima et al.

(2016, 5)

highlight that levels of private sector credit to GDP are relatively high in upper-middle-income economies, such as Tunisia and Jordan, and in line with most peer economies in other regions in lower-middle-income economies, such as Egypt. This 19 e.g. WB (2014, xii), EIB (2005, 12) De Lima et al. (2016, 40), moreover, observe that 73 per cent (Egypt: 85

per cent) of the surveyed firms cannot be classified as credit-constrained, but are, in fact, completely disconnected from the financial sector and do not seek any financing.

[START_REF] Birch | The Job Generation Process[END_REF]

This finding is significant because it contradicts the popular narrative 21 of millions

[START_REF] Bülbül | Savings Banks and Cooperative Banks in Europe[END_REF]

of SMEs seeking bank loans to finance their activities, but are unable to. It, furthermore, suggests that most SMEs are not temporarily excluded from external financing, but never actually had any, and, therefore, generally do not rely on the financial sector, as they pursue financially self-sufficient business models. De Lima et al.

(2016, 40)

also find that these firms tend to have a low propensity to invest and are less likely to plan for expansion. This, in turn, lends support to the observation made in Section 3.2 that most SMEs are subsistence entrepreneurs.

See, for instance, WB (2014) and[START_REF] Brunnhuber | Ex post evaluation of EIB Intermediated lending to SMEs in the EU[END_REF]

See Tricarico (2010) and[START_REF] Besedová | Missing in action: The winners, the losers and the unknowns of the European Investment Bank's anti-crisis SME offensive in central and eastern Euro[END_REF]

Note that the terms "International Financial Institutions" and "bi-and multilateral development bank" are used interchangeably in this paper for the sake of simplicity.

EIB, EBRD, KfW and AFD(EC 2016a, 5)

See, for example,[START_REF] Biggs | Is Small Beautiful and Worthy of Subsidy?[END_REF],[START_REF] Page | Is Small Beautiful? Small Enterprise, Aid and Employment in Africa[END_REF]

See EBRD (2012, 1), IFC (2016a),Nasr and Pearce (2012, 7)

See, for example,[START_REF] Hsieh | Misallocation and Manufacturing TFP in China and India[END_REF] and[START_REF] Restuccia | Misallocation and Productivity[END_REF]

See alsoDalberg (2011, 26) andIFC (2010, 53)

De Haas and Naaborg (2006), de la Torre et al. (2010), and Beck et al. (2014)

e.g.de Haas (2014, 14),Beck and Cull (2014, 16)