Mário S Alvim

Miguel E Andrés

Konstantinos Chatzikokolakis

Catuscia Palamidessi

On the relation between Differential Privacy and Quantitative Information Flow ⋆

Differential privacy is a notion that has emerged in the community of statistical databases, as a response to the problem of protecting the privacy of the database's participants when performing statistical queries. The idea is that a randomized query satisfies differential privacy if the likelihood of obtaining a certain answer for a database x is not too different from the likelihood of obtaining the same answer on adjacent databases, i.e. databases which differ from x for only one individual. Information flow is an area of Security concerned with the problem of controlling the leakage of confidential information in programs and protocols. Nowadays, one of the most established approaches to quantify and to reason about leakage is based on the Rényi min entropy version of information theory.

In this paper, we analyze critically the notion of differential privacy in light of the conceptual framework provided by the Rényi min information theory. We show that there is a close relation between differential privacy and leakage, due to the graph symmetries induced by the adjacency relation. Furthermore, we consider the utility of the randomized answer, which measures its expected degree of accuracy. We focus on certain kinds of utility functions called "binary", which have a close correspondence with the Rényi min mutual information. Again, it turns out that there can be a tight correspondence between differential privacy and utility, depending on the symmetries induced by the adjacency relation and by the query. Depending on these symmetries we can also build an optimal-utility randomization mechanism while preserving the required level of differential privacy. Our main contribution is a study of the kind of structures that can be induced by the adjacency relation and the query, and how to use them to derive bounds on the leakage and achieve the optimal utility.

Introduction

Databases are commonly used for obtaining statistical information about their participants. Simple examples of statistical queries are, for instance, the predominant disease of a certain population, or the average salary. The fact that the answer is publicly available, however, constitutes a threat for the privacy of the individuals.

In order to illustrate the problem, consider a set of individuals Ind whose attribute of interest1 has values in Val . A particular database is formed by a subset of Ind , where a certain value in Val is associated to each participant. A query is a function f : X → Y, where X is the set of all possible databases, and Y is the domain of the answers.

For example, let Val be the set of possible salaries and let f represent the query "what is the average salary of the participants in the database". In principle we would like to consider the global information relative to a database x as public, and the individual information about a participant i as private. Namely, we would like to be able to obtain f (x) without being able to infer the salary of i. However, this is not always possible. In particular, if the number of participants in x is known (say n), then the removal of i from the database would allow to infer i's salary by querying again the new database x ′ , and by applying the formula n f (x) -(n -1) f (x ′ ). Using an analogous reasoning we can argue that not only the removal, but also the addition of an individual is a threat for his privacy.

Another kind of private information we may want to protect is whether an individual i is participating or not in a database. In this case, if we know for instance that i earns, say 5K Euros/month, and all the other individuals in Ind earn less than 4K Euros/month, then knowing that f (x) > 5K Euros/month will reveal immediately that i is in the database x.

A common solution to the above problems is to introduce some output perturbation mechanism based on randomization: instead of the exact answer f (x) we report a "noisy" answer. Namely, we use some randomized function K which produces values in some domain2 Z according to some probability distribution that depends on the input x ∈ X . Of course for certain distributions it may still be possible to guess the value of an individual with a high probability of success. The notion of differential privacy, due to Dwork [START_REF] Dwork | Differential privacy[END_REF][START_REF] Dwork | Differential privacy and robust statistics[END_REF][START_REF] Dwork | Differential privacy in new settings[END_REF][START_REF] Dwork | A firm foundation for private data analysis[END_REF], is a proposal to control the risk of violating privacy for both kinds of threats described above (value and participation). The idea is to say that K satisfies ǫ-differential privacy (for some ǫ > 0) if the ratio between the probabilities that two adjacent databases give the same answer is bound by e ǫ , where by "adjacent" we mean that the databases differ for only one individual (either for the value of an individual or for the presence/absence of an individual). Often we will abbreviate "ǫ-differential privacy" as ǫ-d.p.

Obviously, the smaller is ǫ, the greater is the privacy protection. In particular, when ǫ is close to 0 the output of K is nearly independent from the input (all distributions are almost equal). Unfortunately, such K is practically useless. The utility, i.e. the capability to retrieve accurate answers from the reported ones, is the other important characteristic of K, and it is clear that there is a trade-off between utility and privacy. On the other hand, these two notions are not the complete opposite of each other, because utility concerns the relation between the reported answer and the real answer, while privacy is concerns the relation between the reported answer and the information in the database. This asymmetry makes more interesting the problem of finding a good compromise between the two.

At this point, we would like to remark an intriguing analogy between the area of differential privacy and that of quantitative information flow (QIF), both in the motivations and in the basic conceptual framework. Information flow is concerned with the leakage of secret information through computer systems, and the attribute "quantitative" refers to the fact that we are interested in measuring the amount of leakage, not just its occurrence. One of the most established approaches to QIF is based on information theory: the idea is that a system is seen as a channel in the information-theoretic sense, where the secret is the input and the observables are the output. The entropy of the input represents its vulnerability, i.e. how easy it is for an attacher to guess the secret. We distinguish between the a priori entropy (before the observable) and the a posteriori entropy (given the observable). The difference between the two gives the mutual information and represents, intuitively, the increase in vulnerability due to the observables produced by the system, so it is naturally considered as a measure of the leakage. The notion of entropy is related to the kind of attack we want to model, and in this paper we focus on the Rényi min entropy [START_REF] Rényi | On Measures of Entropy and Information[END_REF], which represents the so-called one-try attacks. In recent years there has been a lot of research aimed at establishing the foundations of this framework [START_REF] Smith | On the foundations of quantitative information flow[END_REF][START_REF] Braun | Quantitative notions of leakage for one-try attacks[END_REF][START_REF] Köpf | Vulnerability bounds and leakage resilience of blinded cryptography under timing attacks[END_REF][START_REF] Andrés | Computing the leakage of information-hiding systems[END_REF][START_REF] Boreale | Asymptotic information leakage under one-try attacks[END_REF]. It is worth pointing out that the a posteriori Rényi min entropy corresponds to the concept of Bayes risk, which has also been proposed as a measure of the effectiveness of attacks [START_REF] Chatzikokolakis | Probability of error in information-hiding protocols[END_REF][START_REF] Braun | Compositional methods for information-hiding[END_REF][START_REF] Mciver | Compositional closure for bayes risk in probabilistic noninterference[END_REF].

The analogy hinted above between differential privacy and QIF is based on the following observations: at the motivational level, the concern about privacy is akin the concern about information leakage. At the conceptual level, the randomized function K can be seen as an information-theoretic channel, and the limit case of ǫ = 0, for which the privacy protection is total, corresponds to a 0-capacity channel3 (the rows of the channel matrix are all identical), which does not allow any leakage. Another promising similarity is that the notion of utility (in the binary case) corresponds closely to the Bayes risk.

In this paper we investigate the notion of differential privacy, and its implications, in light of the min-entropy information theoretic framework developed for QIF. In particular, we wish to explore the following natural questions:

1. Does ǫ-d.p. induce a bound on the information leakage of K? 2. Does ǫ-d.p. induce a bound on the information leakage relative to an individual ? 3. Does ǫ-d.p. induce a bound on the utility? 4. Given f and ǫ, can we construct a K which satisfies ǫ-d.p. and maximum utility?

We will see that the answers to (1) and ( 2) are positive, and we provide bounds that are tight, in the sense that for every ǫ there is a K whose leakage reaches the bound. For (3) we are able to give a tight bound in some cases which depend on the structure of the query, and for the same cases, we are able to construct an oblivious4 K with maximum utility, as requested by [START_REF] Barthe | Information-theoretic bounds for differentially private mechanisms[END_REF]. Part of the above results have already appeared in [START_REF] Mário | Differential privacy: on the trade-off between utility and information leakage[END_REF], and are based on techniques which exploit the graph structure that the adjacency relation induces on the domain of all databases X , and on the domain of the correct answers Y. The main contribution of this paper is an extension of those techniques, and a coherent graph-theoretic framework for reasoning about the symmetries of those domains. More specifically:

-We explore the graph-theoretic foundations of the adjacency relation, and point out various types of symmetries which allow us to establish a strict link between differential privacy and information leakage. -We give a tight bound for the question (2) above, strictly smaller than the one in [START_REF] Mário | Differential privacy: on the trade-off between utility and information leakage[END_REF]. -We extend the structures for which we give a positive answer to the questions (3) and ( 4) above. In [START_REF] Mário | Differential privacy: on the trade-off between utility and information leakage[END_REF] the only case considered was the class of graphs with single-orbit automorphisms. Here we show that the results hold also for regular-distance graphs and a variant of vertex-transtive graphs.

In this paper we focus on the case in which X , Y and Z are finite, leaving the more general case for future work.

Preliminaries

Database domain and Differential privacy

Let Ind be a finite set of individuals that may participate in a database and Val a finite set of possible values for the attribute of interest of these individuals. In order to capture in a uniform way the presence/absence of an individual in the database, as well as its value, we enrich the set of possible values with an element a representing the absence of the individual. Thus the set of all possible databases is the set X = V Ind , where V = Val ∪ {a}. We will use u and v to denote the cardinalities of Ind and V , |Ind | and |V |, respectively. Hence we have that |X | = v u . A database x can be represented as a u-tuple v 0 v 1 . . . v u-1 where each v i ∈ V is the value of the corresponding individual. Two databases x, x ′ are adjacent (or neighbors), written x ∼ x ′ , if they differ for the value of exactly one individual. For instance, for u = 3, v 0 v 1 v 2 and v 0 w 1 v 2 , with w 1 = v 1 , are adjacent. The structure (X , ∼) forms an undirected graph.

Intuitively, differential privacy is based on the idea that a randomized query function provides sufficient protection if the ratio between the probabilities of two adjacent databases to give a certain answer is bound by e ǫ , for some given ǫ > 0. Formally: Definition 1 ( [START_REF] Dwork | A firm foundation for private data analysis[END_REF]). A randomized function K from X to Z satisfies ǫ-differential privacy if for all pairs x, x ′ ∈ X , with x ∼ x ′ , and all S ⊆ Z, we have that:

Pr [K(x) ∈ S] ≤ e ǫ × Pr [K(x ′ ) ∈ S]
The above definition takes into account the possibility that Z is a continuous domain. In our case, since Z is finite, the probability distribution is discrete, and we can rewrite the property of ǫ-d.p. more simply as (using the notation of conditional probabilities, and considering both quotients):

1 e ǫ ≤ Pr [Z = z|X = x] Pr [Z = z|X = x ′ ]
≤ e ǫ for all x, x ′ ∈ X with x ∼ x ′ , and all z ∈ Z where X and Z represent the random variables associated to X and Z, respectively.

Information theory and application to information flow

In the following, X, Y denote two discrete random variables with carriers X = {x 0 , . . . , x n-1 }, Y = {y 0 , . . . , y m-1 }, and probability distributions p X (•), p Y (•), respectively. An information-theoretic channel is constituted by an input X, an output Y , and the matrix of conditional probabilities

p Y |X (• | •), where p Y |X (y | x) represent the probability that Y is y given that X is x.
We shall omit the subscripts on the probabilities when they are clear from the context.

Rényi min-entropy

In [START_REF] Rényi | On Measures of Entropy and Information[END_REF], Rényi introduced an one-parameter family of entropy measures, intended as a generalization of Shannon entropy. The Rényi entropy of order α (α > 0, α = 1) of a random variable X is defined as

H α (X) = 1 1-α log 2 x ∈ X p(x) α .
We are particularly interested in the limit of H α as α approaches ∞. This is called min-entropy. It can be proven that

H ∞ (X) def = lim α→∞ H α (X) = -log 2 max x∈X p(x).
Rényi defined also the α-generalization of other information-theoretic notions, like the Kullback-Leibler divergence. However, he did not define the αgeneralization of the conditional entropy, and there is no general agreement on what it should be. For the case α = ∞, we adopt here the definition of conditional entropy proposed by Smith in [START_REF] Smith | On the foundations of quantitative information flow[END_REF]:

H ∞ (X | Y ) = -log 2 y∈Y p(y) max x∈X p(x | y) (1)
Analogously to the Shannon case, we can define the Rényi-mutual information

I ∞ as H ∞ (X) -H ∞ (X | Y ), and the capacity C ∞ as max pX (•) I ∞ (X; Y ).
It has been proven in [START_REF] Braun | Quantitative notions of leakage for one-try attacks[END_REF] that C ∞ is obtained at the uniform distribution, and that it is equal to the sum of the maxima of each column in the channel matrix, i.e.,

C ∞ = y ∈ Y max x ∈ X p(y | x).
Interpretation in terms of attacks: Rényi min-entropy can be related to a model of adversary who is allowed to ask exactly one question, which must be of the form "is X = x?" (one-try attacks). More precisely, H ∞ (X) represents the (logarithm of the inverse of the) probability of success for this kind of attacks and with the best strategy, which consists, of course, in choosing the x with the maximum probability.

As for H ∞ (X | Y ), it represents the inverse of the (expected value of the) probability that the same kind of adversary succeeds in guessing the value of X a posteriori, i.e. after observing the result of Y . The complement of this probability is also known as Bayes risk. Since in general X and Y are correlated, observing Y increases the probability of success. Indeed we can prove formally that H ∞ (X | Y ) ≤ H ∞ (X), with equality if and only if X and Y are independent. I ∞ (X; Y ) corresponds to the ratio between the probabilities of success a priori and a posteriori, which is a natural notion of leakage. Note that I ∞ (X; Y ) ≥ 0, which seems desirable for a good notion of leakage.

Graph symmetries

In this section we explore some classes of graphs that allow us to derive a strict correspondence between ǫ-d.p. and the a posteriori entropy of the input.

Let us first recall some basic notions. Given a graph G = (V, ∼), the distance d(v, w) between two vertices v, w ∈ V is the number of edges in a shortest path connecting them. The diameter of G is the maximum distance between any two vertices in V. The degree of a vertex is the number of edges incident to it. G is called regular if every vertex has the same degree. A regular graph with vertices of degree k is called a k-regular graph. An automorphism of G is a permutation σ of the vertex set X , such that for any pair of vertices x, x ′ , if x ∼ x ′ , then σ(x) ∼ σ(x ′ ). If σ is an automorphism, and v a vertex, the orbit of v under σ is the set {v, σ(v), . . . , σ k-1 (v)} where k is the smallest positive integer such that σ k (v) = v. Clearly, the orbits of the vertices under σ define a partition of V.

The following two definition introduce the classes of graphs that we are interested in. The first class is well known in literature.

Definition 2. Given a graph G = (V, ∼), we say that G is distance-regular if there exist integers b i , c i , i = 0, ..., d such that for any two vertices v, w in V with distance i = d(v, w), there are exactly

c i neighbors of w in G i-1 (x) and b i neighbors of v in G i+1 (x), where G i (x) is the set of vertices y of G with d(x, y) = i.
Some examples of distance-regular graphs are illustrated in Figure 1. The next class is a variant of the VT (vertex-transitive) class: In particular, the graphs for which there exists an automorphism σ which induces only one orbit are VT + : in fact it is sufficient to define σ i = σ i for all i from 0 to n -1. Figure 2 illustrates some graphs with a single-orbit automorphism. (c) Clique: degree 5.

Definition 3. A graph G = (V, ∼) is VT + (vertex-transitive +) if there are n automorphisms σ 0 , σ 1 , . . . σ n-1 , where n = |V|, such that, for every vertex v ∈ V, we have that {σ i (v) | 0 ≤ i ≤ n -1} = V.

Fig. 2. Some VT + graphs

From graph theory we know that neither of the two classes subsumes the other. They have however a non-empty intersection, which contains in particular all the structures of the form (V Ind , ∼), i.e. the database domains.

Proposition 1. The structure (X , ∼) = (V Ind , ∼) is both a distance-regular graph and a VT + graph. The situation is summarized in Figure 4. We remark that in general the graphs (V Ind , ∼) do not have a single-orbit automorphism. The only exceptions are the two simplest structures

(|V | = 2, |Ind| ≤ 2).
The two symmetry classes defined above, distance-regular and VT + , will be used in the next section to transform a generic channel matrix into a matrix with a symmetric structure, while preserving the a posteriori min entropy and the ǫ-d.p.. This is the core of our technique to establish the relation between differential privacy and quantitive information flow, depending on the structure induced by the database adjacency relation. This section contains the main technical contribution of the paper: a general technique for determining the relation between ǫ-differential privacy and leakage, and between ǫ-differential privacy and utility, depending on the graph structure induced by ∼ and f . The idea is to use the symmetries of the graph structure to transform the channel matrix into an equivalent matrix with certain regularities, which allow to establish the link between ǫ-differential privacy and the a posteriori min entropy.

Let us illustrate briefly this transformation. Consider a channel whose matrix M has at least as many columns as rows. First, we transform M into a matrix M ′ in which each of the first n columns has a maximum in the diagonal, and the remaining columns are all 0's. Second, under the assumption that the input domain is distance-regular or VT + , we transform M ′ into a matrix M ′′ whose diagonal elements are all the same, and coincide with the maximum element of M ′′ , which we denote here by max M ′′ . These steps are illustrated in Figure 5. We are now going to present formally our the technique. Let us first fix some notation: In the rest of this section we consider channels with input A and output B, with carriers A and B respectively, and we assume that the probability distribution of A is uniform. Furthermore, we assume that |A| = n ≤ |B| = m. We also assume an adjacency relation ∼ on A, i.e. that (A, ∼) is an undirected graph structure. With a slight abuse of notation, we will also write i ∼ h when i and h are associated to adjacent elements of A, and we will write d(i, h) to denote the distance between the elements of A associated to i and h.

M      M 0,0 M 0,1 . . . M 0,m-1 M 1,0 M 1,1 . . . M 1,m-1 . . . . . . . . . . . . M n-1,0 M n-1,1 . . . M n-1,m-1      Lemma 1 M ′      max M ′ 0 - . . . - 0 . . . 0 - max M ′ 1 . . . - 0 . . . 0 . . . . . . . . . . . . . . . . . . . . . - - . . . max M ′ n-1 0 . . . 0      Lemma 2 (dist-reg) Lemma 3 (VT++) M ′′      max M ′′ - . . . - 0 . . . 0 - max M ′′ . . . - 0
We note that a channel matrix M satisfies ǫ-d.p. if for each column j and for each pair of rows i and h such that i ∼ h we have that:

1 e ǫ ≤ M i,j M h,j ≤ e ǫ .
The a posteriori entropy of a channel with matrix M will be denoted by H M ∞ (A|B). Next Lemma is relative to the first step of the transformation.

Lemma 1. Consider a channel with matrix M . Assume that M satisfies ǫ-d.p.. Then it is possible to transform M into a matrix M ′ such that:

-Each of the first n columns has a maximum in the diagonal, i.e.

M ′ i,i = max M ′ i = max h M ′ h,i for each i from 0 to n -1.
-The rest of the columns contain only 0's, i.e. M ′ i,j = 0 for each i from 0 to n -1 and each j from n to m -1.

-M ′ satisfies ǫ-d.p. -H M ′ ∞ (A|B) = H M ∞ (A|B).
Next lemma is relative to the second step of the transformation, for the case of distance-regular graphs.

Lemma 2. Consider a channel with matrix M ′ . Assume that M ′ satisfies ǫ-d.p., and the first n columns have maxima in the diagonal, and the rest of the columns contain only 0's. Assume that (A, ∼) is distance-regular. Then it is possible to transform M ′ into a matrix M ′′ such that:

-The elements of the diagonal are all the same, and are equal to the maximum of the matrix, i.e. M ′′ i,i = max M ′′ = max h,i M ′′ h,i for each i from 0 to n -1. -The rest of the columns contain only 0's.

-M ′′ satisfies ǫ-d.p. -H M ′′ ∞ (A|B) = H M ′ ∞ (A|B).
Next lemma is relative to the second step of the transformation, for the case of VT + graphs. Lemma 3. Consider a channel with matrix M ′ satisfying the assumptions of Lemma 2, except for the assumption about distance-regularity, which we replace by the assumption that (A, ∼) is VT + . Then it is possible to transform M ′ into a matrix M ′′ with the same properties as in Lemma 2.

Note that the fact that in M ′′ the diagonal elements are all equal to the maximum max M ′′ implies that H M ′′ ∞ (A|B) = max M ′′ . Once we have a matrix with the properties of M ′′ , we can use again the graph structure of A to determine a bound on H M ′′ ∞ (A|B). First we note that the property of ǫ-d.p. induces a relation between the ratio of elements at any distance: Remark 1. Let M be a matrix satisfying ǫ-d.p.. Then, for any column j, and any pair of rows i and h we have that:

1 e ǫ d(i,h) ≤ M i,j M h,j ≤ e ǫ d(i,h)
In particular, if we know that the diagonal elements of M are equal to the maximum element max M , then for each element M i,j we have that:

M i,j ≥ max M e ǫ d(i,j) (2)
Let us fix a row, say row r. For each distance d from 0 to the diameter of the graph, let n d be the number of elements M r,j that are at distance d from the corresponding diagonal element M j,j , i.e. such that d(r, j) = d. (Clearly, n d depends on the structure of the graph.) Since the elements of the row i represent a probability distribution, we obtain the following dis-equation:

max M d n d e ǫ d ≤ 1
from which we derive immediately a bound on the min a-posteriori entropy.

Putting together all the steps of this section, we obtain our main result.

Theorem 1. Consider a matrix M , and let r be a row of M . Assume that (A, ∼) is either distance-regular or VT + , and that M satisfies ǫ-d.p. For each distance d from 0 to the diameter of (A, ∼), let n d be the number of nodes j at distance d from r. Then we have that:

H M ∞ (A|B) ≥ -log 2 1 d n d e ǫ d (3)
Note that this bound is tight, in the sense that we can build a matrix for which (3) holds with equality. It is sufficient to define each element M i,j according to (2) (with equality instead of dis-equality, of course).

In the next section, we will see how to use this theorem for establishing a bound on the leakage and on the utility.

Application to leakage

As already hinted in the introduction, we can regard K as a channel with input X and output Z. From Proposition 1 we know that (X , ∼) is both distance-regular and VT + , we can therefore apply Theorem 1. Let us fix a particular database x ∈ X . The number of databases at distance d from x is

n d = u d (v -1) d (4)
where u = |Ind| and v = V . In fact, recall that x can be represented as a u-tuple with values in V . We need to select d individuals in the u-tuple and then change their values, and each of them can be changed in v -1 different ways.

Using the n d from (4) in Theorem 1 we obtain a binomial expansion in the denominator, namely:

H M ∞ (X|Z) ≥ -log 2 1 u d=0 u d (v -1) d e ǫ(u-d) e ǫ u = -u log 2 e ǫ v -1 + e ǫ
which gives the following result: Theorem 2. If K satisfies ǫ-d.p., then for the uniform input distribution the information leakage is bound from above as follows: We consider now the leakage for a single individual. Let us fix a database x, and a particular individual i in Ind . The possible ways in which we can change the value of i in x are v -1. All the new databases obtained in this way are adjacent to each other, i.e. the graph structure associated to the input is a clique of v nodes. Therefore we obtain n d = 1 for d = 0, n d = v -1 for d = 1, and n d = 0 otherwise. By substituting this value of n d in Theorem 1, we get

I ∞ (X; Z) ≤ u log 2 v e ǫ v -1 + e ǫ
H ind ∞ (Val|Z) ≥ -log 2 1 1 + v -1 e ǫ = -log 2 e ǫ v -1 + e ǫ
which leads to the following result: Proposition 2. Assume that K satisfies ǫ-d.p.. Then for the uniform distribution on V the information leakage for an individual is bound from above as follows:

I ind ∞ (Val ; B) ≤ log 2 v e ǫ v -1 + e ǫ
Note that the bound on the leakage for an individual does not depend on the size of Ind , nor on the database x that we fix.

Application to utility

We turn now our attention to the issue of utility. We focus on the case in which K is oblivious, which means that it depends only on the (exact) answer to the query, i.e. on the value of f (x), and not on x.

An oblivious function can be decomposed in the concatenation of two channels, one representing the function f , and the other representing the randomization mechanism H added as output perturbation. The situation is illustrated in Figure 6.

The standard way to define utility is by means of guess and gain functions. The functionality of the first is guess : Z → Y, and it represents the user's strategy to retrieve the correct answer form the reported one. The functionality of the latter is gain : Y × Y → R. the value gain(y, y ′ ) represents the reward for guessing the answer y when the correct answer is y ′ . The utility U can then be defined as the expected gain:

U(Y, Z) = y,z p(y, z) gain(guess(z), y)
We focus here on the so-called binary gain function, which is defined as

gain(y, y ′ ) = 1 if y = y ′ 0 otherwise
This kind of function represents the case in which there is no reason to prefer an answer over the other, except if it is the right answer. More precisely, we get a gain if and only if we guess the right answer.

If the gain function is binary, and the guess function represents the user's best strategy, i.e. it is chosen to optimize utility, then there is a well-known correspondence between U and the Bayes risk / the a posteriori min entropy. Such correspondence is expressed by the following proposition: Proposition 3. Assume that gain is binary and guess is optimal. Then:

U(Y, Z) = z max y (p(z|y) p(y)) = 2 -H∞(Y |Z)
In order to analyze the implications of the ǫ-d.p. requirement on the utility, we need to consider the structure that the adjacency relation induces on Y. Let us define ∼ on Y as follows: y ∼ y ′ if there are x, x ′ ∈ X such that y = f (x), y ′ = f (x ′ ), and x ∼ x,. Note that K satisfies ǫ-d.p. if and only if H satisfies ǫ-d.p.

If (Y, ∼) is distance-regular or VT + , then we can apply Theorem 1 to find a bound on the utility. In the following, we assume that the distribution of Y is uniform.

Theorem 3. Consider a randomized mechanism H, and let y be an element of Y. Assume that (Y, ∼) is either distance-regular or VT + and that H satisfies ǫ-d.p. For each distance d from 0 to the diameter of (Y, ∼), let n d be the number of nodes y ′ at distance d from y. Then we have that:

U(Y, Z) ≤ 1 d n d e ǫ d (5)
The above bound is tight, in the sense that (provided (Y, ∼) is distanceregular or VT + ) we can construct a mechanism H which satisfies [START_REF] Boreale | Asymptotic information leakage under one-try attacks[END_REF] with equality. More precisely, define

c = 1 d n d e ǫ d
Then define H (here identified with its channel matrix for simplicity) as follows:

H i,j = c e ǫ d(i,j) (6)
Theorem 4. Assume (Y, ∼) is distance-regular or VT + . Then the matrix H defined in (6) satisfies ǫ-d.p. and has maximal utility:

U(Y, Z) = 1 d n d e ǫ d
Note that we can always define H as in ( 6): the matrix so defined will be a legal channel matrix, and it will satisfy ǫ-d.p.. However, if (Y, ∼) is neither distance-regular nor VT + , then the utility of such H is not necessarily optimal.

We end this section with an example (borrowed from [START_REF] Mário | Differential privacy: on the trade-off between utility and information leakage[END_REF]) to illustrate our technique.

Example 1. Consider a database with electoral information where each row corresponds to a voter and contains the following three fields:

-Id : a unique (anonymized) identifier assigned to each voter; -City: the name of the city where the user voted; -Candidate: the name of the candidate the user voted for.

Consider the query "What is the city with the greatest number of votes for a given candidate cand ?". For such a query the binary utility function is the natural choice: only the right city gives some gain, and all wrong answers are equally bad. It is easy to see that every two answers are neighbors, i.e. the graph structure of the answers is a clique.

Let us consider the scenario where City = {A, B, C, D, E, F } and assume for simplicity that there is a unique answer for the query, i.e., there are no two cities with exactly the same number of individuals voting for candidate cand . Table 1 shows two alternative mechanisms providing ǫ-differential privacy (with ǫ = log 2). The first one, M 1 , is based on the truncated geometric mechanism method used in [START_REF] Ghosh | Universally utilitymaximizing privacy mechanisms[END_REF] for counting queries (here extended to the case where every pair of answers is neighbor). The second mechanism, M 2 , is obtained by applying the definition [START_REF] Braun | Compositional methods for information-hiding[END_REF]. From Theorem 4 we know that for the uniform input distribution M 2 gives optimal utility.

For the uniform input distribution, it is easy to see that U(M 1 ) = 0.2242 < 0.2857 = U(M 2 ). Even for non-uniform distributions, our mechanism still provides better utility. For instance, for p(A) = p(F ) = 1/10 and p(B) = p(C) = p(D) = P (E) = 1/5, we have U(M 1 ) = 0.2412 < 0.2857 = U(M 2 ). This is not too surprising: the geometric mechanism, as well as the Laplacian mechanism proposed by Dwork, perform very well when the domain of answers is provided with a metric and the utility function is not binary5 . It also works well when

Related work

As far as we know, the first work to investigate the relation between differential privacy and information-theoretic leakage for an individual was [START_REF] Mário | Differential privacy versus quantitative information flow[END_REF]. In this work, a channel is relative to a given database x, and the channel inputs are all possible databases adjacent to x. Two bounds on leakage were presented, one for teh Rényi min entropy, and one for Shannon entropy. Our bound in Proposition 2 is an improvement with respect to the (Rényi min entropy) bound in [START_REF] Mário | Differential privacy versus quantitative information flow[END_REF]. Barthe and Köpf [START_REF] Barthe | Information-theoretic bounds for differentially private mechanisms[END_REF] were the first to investigates the (more challenging) connection between differential privacy and the Rényi min-entropy leakage for the entire universe of possible databases. They consider the "end-to-end differentially private mechanisms", which correspond to what we call K in our paper, and propose, like we do, to interpret them as information-theoretic channels. They provide a bound for the leakage, but point out that it is not tight in general, and show that there cannot be a domain-independent bound, by proving that for any number of individual u the optimal bound must be at least a certain expression f (u, ǫ). Finally, they show that the question of providing optimal upper bounds for the leakage of ǫ-differentially private randomized functions in terms of rational functions of ǫ is decidable, and leave the actual function as an open question. In our work we used rather different techniques and found (independently) the same function f (u, ǫ) (the bound in Theorem 1), but we actually proved that f (u, ǫ) is the optimal bound6 . Another difference is that [START_REF] Barthe | Information-theoretic bounds for differentially private mechanisms[END_REF] captures the case in which the focus of differential privacy is on hiding participation of individuals in a database. In our work, we consider both the participation and the values of the participants.

Clarkson and Schneider also considered differential privacy as a case study of their proposal for quantification of integrity [START_REF] Clarkson | Quantification of integrity[END_REF]. There, the authors analyze database privacy conditions from the literature (such as differential privacy, kanonymity, and l-diversity) using their framework for utility quantification. In particular, they study the relationship between differential privacy and a notion of leakage (which is different from ours -in particular their definition is based on Shannon entropy) and they provide a tight bound on leakage.

Heusser and Malacaria [START_REF] Heusser | Applied quantitative information flow and statistical databases[END_REF] were among the first to explore the application of information-theoretic concepts to databases queries. They proposed to model database queries as programs, which allows for statical analysis of the information leaked by the query. However [START_REF] Heusser | Applied quantitative information flow and statistical databases[END_REF] did not attempt to relate information leakage to differential privacy.

In [START_REF] Ghosh | Universally utilitymaximizing privacy mechanisms[END_REF] the authors aim at obtaining optimal-utility randomization mechanisms while preserving differential privacy. The authors propose adding noise to the output of the query according to the geometric mechanism. Their framework is very interesting in the sense it provides a general definition of utility for a mechanism M that captures any possible side information and preference (defined as a loss function) the users of M may have. They prove that the geometric mechanism is optimal in the particular case of counting queries. Our results in Section 6 do not restrict to counting queries, but on the other hand we only consider the case of binary loss function.

Conclusion and future work

In this paper we have investigated the relation between ǫ-differential privacy and leakage, and between ǫ-differential privacy and utility. Our main contribution is the development of a general technique for determining these relations depending on the graph structure induced by the adjacency relation and by the query. We have considered two particular structures, the distance-regular graphs, and the VT + graphs, which allow to obtain tight bounds on the leakage and on the utility, and to construct the optimal randomization mechanism satisfying ǫ-differential privacy.

As future work, we plan to extend our result to other kinds of utility functions. In particular, we are interested in the case in which the the answer domain is provided with a metric, and we are interested in taking into account the degree of accuracy of the inferred answer.

Fig. 1 .

 1 Fig.1. Some distance-regular graphs with degree 3.

  (a) Cycle: degree 2.(b) Degree 4.

Figure 3

 3 Figure 3 illustrates some examples of structures (V Ind , ∼). Note that when |Ind | = n and |V | = 2, (V Ind , ∼) is the n-dimentional hypercube.The situation is summarized in Figure4. We remark that in general the graphs (V Ind , ∼) do not have a single-orbit automorphism. The only exceptions are the two simplest structures(|V | = 2, |Ind| ≤ 2).The two symmetry classes defined above, distance-regular and VT + , will be used in the next section to transform a generic channel matrix into a matrix with a symmetric structure, while preserving the a posteriori min entropy and the ǫ-d.p.. This is the core of our technique to establish the relation between differential privacy and quantitive information flow, depending on the structure induced by the database adjacency relation.

Fig. 3 .Fig. 4 .

 34 abbb abba

KFig. 6 .

 6 Fig. 6. Schema of an oblivious randomized function

Table 1 .

 1 Mechanisms for the city with higher number of votes for candidate cand (Y, ∼) has low connectivity, in particular in the cases of a ring and of a line. But in this example, we are not in these cases, because we are considering binary gain functions and high connectivity.

	(a) M1: truncated geometric mechanism	(b) M2: our mechanism
	In/Out A	B	C	D	E	F	In/Out A B C D E F
	A	0.535 0.060 0.052 0.046 0.040 0.267	A	2/7 1/7 1/7 1/7 1/7 1/7
	B	0.465 0.069 0.060 0.053 0.046 0.307	B	1/7 2/7 1/7 1/7 1/7 1/7
	C	0.405 0.060 0.069 0.060 0.053 0.353	C	1/7 1/7 2/7 1/7 1/7 1/7
	D	0.353 0.053 0.060 0.069 0.060 0.405	D	1/7 1/7 1/7 2/7 1/7 1/7
	E	0.307 0.046 0.053 0.060 0.069 0.465	E	1/7 1/7 1/7 1/7 2/7 1/7
	F	0.267 0.040 0.046 0.052 0.060 0.535	F	1/7 1/7 1/7 1/7 1/7 2/7

In general we could be interested in several attributes simultaneously, and in this case Val would be a set of tuples.

The new domain Z may coincide with Y, but not necessarily. It depends on how the randomization mechanism is defined.

The channel capacity is the maximum mutual information over all possible input distributions.

A randomized function K is oblivious if its probability distribution depends only on the answer to the query, and not on the database.

In the metric case the gain function can take into account the proximity of the reported answer to the real one, the idea being that a close answer, even if wrong, is better than a distant one.

When discussing our result with Barthe and Köpf, they said that they also conjectured that f (u, ǫ) is the optimal bound.

⋆ This work has been partially supported by the project ANR-09-BLAN-0169-01 PANDA and by the INRIA DRI Equipe Associée PRINTEMPS. The work of Miguel E. Andrés has been supported by the LIX-Qualcomm postdoc fellowship 2010.


Joachim Escher

Matthieu Hillairet
email: hillairet@ceremade.dauphine.fr

AND Philippe Laurenc ¸ot

Christoph Walker
email: walker@ifam.uni-hannover.de

WEAK SOLUTIONS TO A THIN FILM MODEL WITH CAPILLARY EFFECTS AND INSOLUBLE SURFACTANT

The paper focuses on a model describing the spreading of an insoluble surfactant on a thin viscous film with capillary effects taken into account. The governing equation for the film height is degenerate parabolic of fourth order and coupled to a second order parabolic equation for the surfactant concentration. It is shown that nonnegative weak solutions exist under natural assumptions on the surface tension coefficient.

Introduction

The modeling of the spreading of an insoluble surfactant on a thin viscous film leads to a coupled system of degenerate parabolic equations describing the space and time evolution of the height h ≥ 0 of the film and the surface concentration Γ ≥ 0 of surfactant. Assuming the film thickness to be small enough so that lubrication theory is applicable, taking into account capillary effects but neglecting gravitational and intermolecular (van der Waals) forces, the following system is obtained [START_REF] De Wit | Nonlinear evolution equations for thin liquid films with insoluble surfactant[END_REF][START_REF] Garcke | Surfactant spreading on thin viscous films: nonnegative solutions of a coupled degenerate system[END_REF][START_REF] Jensen | Insoluble surfactant spreading on a thin viscous film: shock evolution and film rupture[END_REF]]

∂ t h + ∂ x 1 3 h 3 ∂ 3 x h + 1 2 h 2 ∂ x σ(Γ) = 0 , (t, x) ∈ (0, ∞) × (0, 1) , (1)
∂ t Γ + ∂ x 1 2 h 2 Γ ∂ 3 x h + h Γ ∂ x σ(Γ) = D ∂ 2 x Γ , (t, x) ∈ (0, ∞) × (0, 1) , (2)
with homogeneous Neumann boundary conditions

∂ x h(t, x) = ∂ 3 x h(t, x) = ∂ x Γ(t, x) = 0 , (t, x) ∈ (0, ∞) × {0, 1} , (3)
and initial conditions (h, Γ)(0) = (h 0 , Γ 0 ) , x ∈ (0, 1) . (4) Here, σ(Γ) denotes the surface tension which depends on the local concentration of surfactant, and D > 0 stands for the surface diffusivity of the surfactant. Since σ is defined up to a constant, we may assume without loss of generality that σ(1) = 0 as a normalization condition. As the presence of surfactant reduces surface tension, σ is a non-increasing function of Γ; for instance, σ β (s) := (β + 1) 1 -s + β + 1

β 1/3 s -3 -β , s ≥ 0 , (5)
with β ∈ (0, ∞) and its limit as β → ∞ (which is often assumed in applications)

σ ∞ (s) := 1 -s , s ≥ 0 . (6)
The system (1)-( 4) is a fully coupled nonlinear system of parabolic equations featuring a degeneracy where h vanishes, a fact which cannot be excluded a priori. Thus, classical solutions are unlikely to exist for all times in general and only local existence of smooth solutions to (1)-( 2) in the absence of capillarity have been shown in [START_REF] Renardy | On an equation describing the spreading of surfactants on thin films[END_REF][START_REF] Renardy | A degenerate parabolic-hyperbolic system modeling the spreading of surfactants[END_REF]. The alternative is to study the Cauchy problem in a framework of weak solutions (see Section 2 for a precise definition) and this

This work was partially supported by the french-german PROCOPE project 20190SE.

1 approach has been successfully employed to establish the existence of weak solutions to systems similar to (1)-( 2), for instance when the capillarity effect are neglected but the gravitational ones are accounted for [START_REF] Escher | Global weak solutions for a degenerate parabolic system modeling the spreading of insoluble surfactant[END_REF] or when Γ is replaced by λ(Γ) = max {0, 1 -Γ} + 1 in (2) [START_REF] Barrett | Finite element approximation of surfactant spreading on a thin film[END_REF][START_REF] Barrett | Convergence of a finite element approximation of surfactant spreading on a thin film in the presence of van der Waals forces[END_REF], a finite element numerical scheme being also developed in these two papers.

To our knowledge, existence of weak solutions has only been tackled in [START_REF] Garcke | Surfactant spreading on thin viscous films: nonnegative solutions of a coupled degenerate system[END_REF] where this is proved under further technical assumptions on the surface tension σ. Namely, given a surface tension σ ∈ C 2,1 loc (R), defining the free energy g σ by

g σ (1) = g ′ σ (1) = 0, g ′′ σ (s) = - σ ′ (s) s for s ∈ R, (7)
the authors assume the following: (A4) The function g σ lies in C 2,1 loc (R). (A5) There exists c g > 0 such that g ′′ σ (s) ≥ c g for all s ∈ R. (A6) There exist C g and some r ∈ (0, 2) for which g ′′ σ (s) ≤ C g (|s| r + 1) for all s ∈ R. The need in [START_REF] Garcke | Surfactant spreading on thin viscous films: nonnegative solutions of a coupled degenerate system[END_REF] to define σ and g σ in R instead of the physically relevant range [0, ∞) for surfactant concentration stems from the fact that the weak solution (h, Γ) to ( 1)- [START_REF] Barrett | Convergence of a finite element approximation of surfactant spreading on a thin film in the presence of van der Waals forces[END_REF] constructed in [START_REF] Garcke | Surfactant spreading on thin viscous films: nonnegative solutions of a coupled degenerate system[END_REF] might not satisfy Γ ≥ 0. The extension of σ and g σ to negative values then induces several limiting conditions. Namely, the convexity (A5) of g σ in R requires not only that σ ′ (s) < 0 for s > 0 as expected but also σ ′ (s) > 0 for s < 0, which implies σ ′ (0) = 0 and thus excludes surface tensions σ like σ β in (5) and σ ∞ in [START_REF] Escher | Global weak solutions for a degenerate parabolic system modeling the spreading of insoluble surfactant[END_REF]. In addition, assumption (A5) yields σ ′ (s) ≤ -c g s for s ∈ R so that σ necessarily has a quadratic decay at infinity. This again excludes the previous examples σ β in (5) and σ ∞ in [START_REF] Escher | Global weak solutions for a degenerate parabolic system modeling the spreading of insoluble surfactant[END_REF].

The aim of the present paper is to construct a weak solution to (1)-( 2) under weaker assumptions on the surface tension σ (satisfied in particular by σ ∞ ) and such that both h and Γ are nonnegative throughout time evolution. More precisely, we assume that the surface tension σ satisfies:

(H1) σ ∈ C 1 ((0, ∞)) ∩ C([0, ∞)) with σ(1) = 0.
(H2) There exist σ 0 , σ 1 ∈ (0, ∞) and θ ∈ [0, 1) for which:

-σ 0 < σ ′ (s) ≤ - σ 1 1 + s θ for s ≥ 1, -σ 0 < σ ′ (s) < 0 for s ∈ (0, 1). (8)
The assumptions (H1)-(H2) include physically relevant surface tensions σ, which may slowly decrease at infinity. In particular, σ ∞ is included (but not σ β for β ∈ (0, ∞)).

In the next section, we introduce the definition of weak solutions and give precise statements for our existence result. To prove this result, we first construct nonnegative solutions in the framework of [START_REF] Garcke | Surfactant spreading on thin viscous films: nonnegative solutions of a coupled degenerate system[END_REF] under assumptions (A4)-(A6). This improves the results of [START_REF] Garcke | Surfactant spreading on thin viscous films: nonnegative solutions of a coupled degenerate system[END_REF] in that the surfactant concentration Γ stays nonnegative through time evolution. This is the content of Section 3. Then we extend the construction to a surface tension σ merely satisfying (H1)-(H2) by approximating σ with surface tensions σ k satisfying (A4)-(A6) and studying compactness properties of their associated weak solutions. The construction of σ k and the compactness argument are presented in Section 4.

Weak solutions and main results

To introduce the definition of weak solutions, we first derive energy estimates satisfied by smooth nonnegative solutions to (1)- [START_REF] Barrett | Convergence of a finite element approximation of surfactant spreading on a thin film in the presence of van der Waals forces[END_REF]. So, let us consider a non-increasing and smooth surface tension σ and a smooth solution (h, Γ) to (1)-( 3) in (0, T ) × (0, 1) for some T > 0, both functions being uniformly bounded from below by a positive constant. First, we note that by (1)-( 3) there holds d dt

1 0 h dx = 0, d dt 1 0 Γ dx = 0. ( 9
)
Setting

g σ (1) = g ′ σ (1) = 0, g ′′ σ (s) = - σ ′ (s) s for s ∈ (0, ∞), (10)
it follows from (1)-(3) that d dt

1 0 |∂ x h| 2 2 + g σ (Γ) dx = 1 0 ∂ 2 x h ∂ x h 3 3 ∂ 3 x h + h 2 2 ∂ x σ(Γ) dx + 1 0 g ′′ σ (Γ) ∂ x Γ h 2 2 Γ ∂ 3 x h + h Γ ∂ x σ(Γ) -D ∂ x Γ dx = - 1 0 h 3 3 |∂ 3 x h| 2 + h 2 ∂ x σ(Γ) ∂ 3 x h + h|∂ x σ(Γ)| 2 -D σ ′ (Γ) Γ |∂ x Γ| 2 dx.
We abbreviate product terms by introducing J 2 s and J 2 f , where

J f = J f [h, Γ] := h 3/2 3 ∂ 3 x h + h 1/2 2 ∂ x σ(Γ), (11)
J s = J s [h, Γ] := h 3/2 2 ∂ 3 x h + h 1/2 ∂ x σ(Γ). (12)
This yields d dt

1 0 |∂ x h| 2 2 + g σ (Γ) dx = - 1 0 3 2 |J f [h, Γ]| 2 + 1 2 |J s [h, Γ]| 2 + 1 24 h 3 |∂ 3 x h| 2 + 1 8 h|∂ x σ(Γ)| 2 dx + D 1 0 σ ′ (Γ) Γ |∂ x Γ| 2 dx . (13)
Consequently, we infer that, regardless the qualitative properties of σ, (h, Γ) should satisfy

h ∈ L ∞ (0, T ; H 1 (0, 1)), Γ ∈ L ∞ (0, T ; L 1 (0, 1)) (14)
together with

h 3/2 ∂ 3 x h ∈ L 2 ((0, T ) × (0, 1)), h 1/2 ∂ x σ(Γ) ∈ L 2 ((0, T ) × (0, 1)).
(15) Since D > 0, the energy estimate (13) provides an additional estimate which depends strongly on the properties of σ, namely -σ ′ (Γ)/Γ ∂ x Γ ∈ L 2 ((0, T ) × (0, 1)). We will actually prove that, under assumption (8) on σ, this additional estimate guarantees that the solutions we construct satisfy the further regularity Γ ∈ L 2 ((0, T ) × (0, 1)) and σ(Γ) ∈ L 4/3 (0, T ; W 1 4/3 (0, 1)), (16) see Lemma 9. Let us point out here that [START_REF] Jensen | Insoluble surfactant spreading on a thin viscous film: shock evolution and film rupture[END_REF] implies that σ ′ does not decay too fast towards -∞ at infinity. Hence, assuming ( 14) and (15) to hold true, we realize that J f [h, Γ], J s [h, Γ] ∈ L 2 ((0, T ) × (0, 1)). Since an alternative formulation of (1)-(2) reads,

∂ t h + ∂ x h 3/2 J f [h, Γ] = 0 in (0, ∞) × (0, 1) , (17)
∂ t Γ + ∂ x h 1/2 Γ J s [h, Γ] = D ∂ 2 x Γ in (0, ∞) × (0, 1) , (18)
we infer from ( 14)-( 16) and the embedding of

H 1 (0, 1) in L ∞ (0, 1) that h 3/2 J f [h, Γ] and h 1/2 Γ J s [h, Γ] both belong to L 1 ((0, T ) × (0, 1
)) and we can give a meaning to (1)-( 2) at least in the following weak sense: Definition 1. Let T > 0 and σ be a surface tension such that either

• σ ∈ C 1 (0, ∞) ∩ C([0, ∞)), σ (1)
= 0, and (8) holds true, or

• σ ∈ C 1,1 (R) is such that σ(1) = 0 and g σ , defined in [START_REF] Garcke | Surfactant spreading on thin viscous films: nonnegative solutions of a coupled degenerate system[END_REF], satisfies (A4)-(A6).

Then, given an initial condition (h 0 , Γ 0 ) ∈ H 1 (0, 1) × L 2 (0, 1) with h 0 ≥ 0 and Γ 0 ≥ 0 we say that (h, Γ) is a weak solution in (0, T ) to (1)-( 4) with surface tension σ and initial condition (h 0 , Γ 0 ), if

• h ≥ 0 and Γ ≥ 0 satisfy h ∈ L ∞ (0, T ; H 1 (0, 1)) ∩ C([0, T ] × [0, 1]), Γ ∈ L ∞ (0, T ; L 1 (0, 1)) ∩ L 2 ((0, T ) × (0, 1)), ∂ 3 x h ∈ L 2 (P h (δ)) for all δ > 0, σ(Γ) ∈ L 1 (0, T ; W 1 1 (0, 1)), h 3/2 ∂ 3 x h ∈ L 2 (P h ), h 1/2 ∂ x σ(Γ) ∈ L 2 ((0, T ) × (0, 1)), ( 19
)
where P h (δ) := {(t, x) ∈ (0, T )×(0, 1) : h(t, x) > δ} for δ > 0 and P h := {(t, x) ∈ (0, T )×(0, 1) :

h(t, x) > 0}. • for any ζ ∈ C ∞ ([0, T ] × [0, 1]) such that ζ(T, x) = 0 for all x ∈ [0, 1] and ∂ x ζ(t, x) = 0 for all (t, x) ∈ [0, T ] × {0, 1}
, there holds:

T 0 1 0 h ∂ t ζ + 1 3 h 3 1 (0,∞) (h) ∂ 3 x h + 1 2 h 2 ∂ x σ(Γ) ∂ x ζ dxds = - 1 0 h 0 (x)ζ(0, x)dx , (20)
and

T 0 1 0 Γ ∂ t ζ + 1 2 h 2 1 (0,∞) (h) Γ ∂ 3 x h + h Γ ∂ x σ(Γ) ∂ x ζ + DΓ∂ 2 x ζ dxds = - 1 0 Γ 0 (x)ζ(0, x)dx . (21)
With these conventions, our main result reads: [START_REF] Jensen | Insoluble surfactant spreading on a thin viscous film: shock evolution and film rupture[END_REF]. Then, given an initial condition (h 0 , Γ 0 ) ∈ H 1 (0, 1) × L 2 (0, 1) with h 0 ≥ 0, Γ 0 ≥ 0 and any T > 0, there exists at least one weak solution (h, Γ) in (0, T ) to (1)-( 4) with surface tension σ and initial condition (h 0 , Γ 0 ) in the sense of Definition 1.

Theorem 2. Let the surface tension σ ∈ C 1 (0, ∞) ∩ C([0, ∞)) satisfy σ(1) = 0 and
As mentioned in the Introduction, we split the proof of Theorem 2 into two parts. First, we focus on the nonnegativity issue of solutions to (1)- [START_REF] Barrett | Convergence of a finite element approximation of surfactant spreading on a thin film in the presence of van der Waals forces[END_REF]. In this respect, we go back to the framework considered in [START_REF] Garcke | Surfactant spreading on thin viscous films: nonnegative solutions of a coupled degenerate system[END_REF] and we prove: Theorem 3. Let the surface tension σ ∈ C 2 (R) be such that σ(1) = 0 and the free energy g σ defined by [START_REF] Garcke | Surfactant spreading on thin viscous films: nonnegative solutions of a coupled degenerate system[END_REF] satisfies (A4)-(A6). Then, given an initial condition (h 0 , Γ 0 ) ∈ H 1 ((0, 1)) × L 2 ((0, 1)) with h 0 ≥ 0, Γ 0 ≥ 0, and any T > 0, there exists at least one weak solution (h, Γ) in (0, T ) to (1)-( 2) with surface tension σ and initial condition (h 0 , Γ 0 ) in the sense of Definition 1. Moreover, the solution satisfies the further regularity

Γ ∈ L ∞ (0, T ; L 2 (0, 1)) ∩ L 2 (0, T ; H 1 (0, 1)) (22)
and the energy estimate

sup t∈[0,T ] 1 0 |∂ x h(t, x)| 2 2 + g σ (Γ(t, x)) dx + D[h, Γ] ≤ 1 0 |∂ x h 0 (x)| 2 2 + g σ (Γ 0 (x)) dx , (23)
where

D[h, Γ] := T 0 1 0 (h 3 1 (0,∞) (h(τ, x))) 2 1|∂ 3 x h(τ, x)| 2 + h(τ, x) 8 |∂ x σ(Γ(τ, x))| 2 dxdτ -D T 0 1 0 σ ′ (Γ(τ, x)) Γ(τ, x) |∂ x Γ(τ, x)| 2 dxdτ .
With the regularity (22), any weak solution constructed in [START_REF] Garcke | Surfactant spreading on thin viscous films: nonnegative solutions of a coupled degenerate system[END_REF] is a weak solution in our sense (see the proof of Theorem 3 for further details). The major novelty in this result is that we obtain nonnegativity of the surfactant concentration Γ. For the proof of Theorem 2, we consider a surface tension σ ∈ C([0, ∞)) ∩ C 1 (0, ∞) and introduce a family of approximate surface tensions (σ k ) k∈N satisfying the assumptions of Theorem 3. We achieve our result by studying the compactness properties of the family of associated weak solutions. A fundamental argument will be that, owing to assumption [START_REF] Jensen | Insoluble surfactant spreading on a thin viscous film: shock evolution and film rupture[END_REF] and equation ( 13), the dissipation of energy is measured by

T 0 1 0 |∂ x Γ| 2 Γ(1 + Γ) θ dxdτ . ( 24
)
When θ ∈ [0, 1), this quantity enables us to control √ Γ in some Hölder space (see Lemma 9). This, in turn, yields compactness on the concentration for any bounded family of solutions in L 2 ((0, T ) × (0, 1)).

Existence of nonnegative solutions for decaying surface tensions

In this section, we assume σ ∈ C 2 (R) is such that σ(1) = 0 and the free energy g σ , as defined in [START_REF] Garcke | Surfactant spreading on thin viscous films: nonnegative solutions of a coupled degenerate system[END_REF], satisfies (A4)-(A6) and we construct nonnegative weak solutions to (1)-( 2). In [START_REF] Garcke | Surfactant spreading on thin viscous films: nonnegative solutions of a coupled degenerate system[END_REF]Sect.3.4], the authors remark that, for proving nonnegativity of the surfactant concentration of weak solutions to (1)-( 4), a difficulty arises when multiplying equation ( 2) by Γ -= -min {0, Γ}. Indeed, under assumptions (A4)-(A6), the very low regularity of Γ implies only that

∂ t Γ ∈ L 3/2 (0, T ; (W 1 3 (0, 1)) * ) and Γ -∈ L 2 (0, T ; H 1 (0, 1)
). This regularity does not allow to define the duality bracket ∂ t Γ, Γ -. To construct weak solutions with nonnegative surfactant concentrations, we go back to the strategy applied in [START_REF] Garcke | Surfactant spreading on thin viscous films: nonnegative solutions of a coupled degenerate system[END_REF]: construction of solutions to a regularized problem via a Galerkin method, followed by a compactness argument when the regularization parameter goes to 0. We introduce a supplementary truncation operator in the regularized problem in order to guarantee that the solutions to the regularized problems have nonnegative surfactant concentrations.

Throughout this section, we fix a nonnegative initial condition (h 0 , Γ 0 ) ∈ H 1 (0, 1) × L 2 (0, 1). We also introduce a Lipschitz continuous truncation function T such that

T (s) =    s if s ∈ (0, 1), 2 -s if s ∈ [1, 2], 0 if s ≥ 2, T (-s) = -T (s) if s < 0, (25)
and put T k := kT (•/k) for k ≥ 1. Then, we set

σ k (s) := s 1 T k (σ ′ (r))dr for s ∈ R. ( 26
)
We emphasize that this construction ensures that σ k ∈ C 1,1 (R) has bounded first and second derivatives. Associated to this truncation of σ, we introduce a truncation of the identity

τ k (s) := s σ ′ k (s) σ ′ (s) for s ∈ R. (27)
We note that the construction above is well-defined because

0 ≥ σ ′ k (s) ≥ σ ′ (s) for all s ∈ R. ( 28
)
With these conventions, our regularized problem reads

∂ t h + ∂ x [a 3 (h) + 1/k] ∂ 3 x h + a 2 (h) ∂ x σ k (Γ) = 0 , (t, x) ∈ (0, ∞) × (0, 1) , (29)
∂ t Γ + ∂ x a 2 (h) τ k (Γ) ∂ 3 x h + a 1 (h) Γ ∂ x σ k (Γ) = D ∂ 2 x Γ , (t, x) ∈ (0, ∞) × (0, 1) , (30)
subject to (3)-( 4), where k is a positive integer. The notation a i (h) stands for (max {0, h}) i /i for i = 1, 2, 3. This is the same convention as in [START_REF] Garcke | Surfactant spreading on thin viscous films: nonnegative solutions of a coupled degenerate system[END_REF] so that conditions (A1)-(A8) therein are satisfied.

Existence for (29)-(30).

To begin with, we fix k ≥ 1 and prove:

Lemma 4. Consider an initial condition (h 0 , Γ 0 ) ∈ H 1 ((0, 1)) × L 2 ((0, 1)) with h 0 ≥ 0 and Γ 0 ≥ 0. For any k ≥ 1 and T > 0, there exists at least a couple of functions (h, Γ) having the regularity

h ∈ L ∞ (0, T ; H 1 (0, 1)) ∩ L 2 (0, T ; H 3 (0, 1)) , Γ ∈ L ∞ (0, T ; L 2 (0, 1)) ∩ L 2 (0, T ; H 1 (0, 1)), (31)
∂ t h ∈ L 2 (0, T ; (H 1 (0, 1)) * ) , ∂ t Γ ∈ L 3/2 (0, T ; (W 1 3 (0, 1)) * ), ( 32
)
and satisfying,

T 0 ∂ t h, ζ ds - T 0 1 0 a 2 (h)∂ x σ k (Γ) + [a 3 (h) + 1/k] ∂ 3 x h ∂ x ζ dxds = 0, ( 33
)
for all ζ ∈ L 2 (0, T ; H 1 (0, 1)), together with T 0 ∂ t Γ, ζ ds - T 0 1 0 a 1 (h) Γ ∂ x σ k (Γ) + a 2 (h) τ k (Γ) ∂ 3 x h -D ∂ x Γ ∂ x ζ dxds = 0, ( 34
)
for all ζ ∈ L 3 (0, T ; W 1 3 (0, 1)) and (h(0, •), Γ(0, •)) = (h 0 , Γ 0 ) , ( 35
)
the latter being meaningful as h ∈ C([0, T ]; (H 1 (0, 1)) * ) and Γ ∈ C([0, T ]; (W 1 3 (0, 1)) * ) by (31) and (32). Moreover, there holds the energy inequality

sup t∈[0,T ] 1 0 |∂ x h(t, x)| 2 2 + g σ (Γ(t, x)) dx + Dk [h, Γ] ≤ 1 0 |∂ x h 0 (x)| 2 2 + g σ (Γ 0 (x)) dx, ( 36
)
where

Dk [h, Γ] := T 0 1 0 1 k + a 3 (h) 7 |∂ 3 x h| 2 -D σ ′ (Γ) Γ |∂ x Γ| 2 + a 1 (h) 8 |∂ x σ k (Γ)| 2 dxds.
Remark 5. Note that, in (36), σ k only appears in the last term of Dk [h, Γ].

Proof. We follow here the Galerkin method from [7, Section 3]. The system (29)-( 30) is actually almost identical to the regularized system used in [7, Section 3] except that the truncation function τ k is replaced by the identity there. Since τ k is a bounded and Lipschitz continuous function, the analysis performed in [7, Section 3] carries over to (29)-(30) with only slight changes, the main one arising in the derivation of the energy inequality. We will thus only give a sketch of the proof and refer to [7, Section 3] for details. The first step is an alternative formulation of (29)-(30) in therms of h and the new unknown function v := g ′ σ (Γ), the latter being well-defined thanks to the convexity (A5) of g σ . Denoting the inverse function of g ′ σ by W , we have

∂ t h + ∂ x [a 3 (h) + 1/k] ∂ 3 x h -a 2 (h)τ k (W (v))∂ x v = 0 , (37)
∂ t W (v) + ∂ x a 2 (h) τ k (W (v)) ∂ 3 x h -a 1 (h) W (v)τ k (W (v))∂ x v = D ∂ 2 x W (v) , (38)
in (0, ∞) × (0, 1). As already mentioned, (37)-( 38) is the same as the system studied in [7, Section 3]

|∂ x h| 2 2 + g σ (Γ) dx + 1 0 1 k + a 3 (h) |∂ 3 x h| 2 -D σ ′ (Γ) Γ |∂ x Γ| 2 + a 1 (h)(σ ′ (Γ)σ ′ k (Γ))|∂ x Γ| 2 dx = I,
where (see [START_REF] Garcke | Surfactant spreading on thin viscous films: nonnegative solutions of a coupled degenerate system[END_REF] and ( 27))

I := - 1 0 a 2 (h) ∂ x Γ ∂ 3 x h σ ′ k (Γ) + σ ′ (Γ) τ k (Γ) Γ dx = - 1 0 2a 2 (h) ∂ x σ k (Γ) ∂ 3 x h dx. Since σ ′ k ≤ 0, it follows from (28) that (σ ′ k ) 2 ≤ σ ′ σ ′ k while Young's inequality ensures that |2a 2 (h) ∂ x σ k (Γ) ∂ 3 x h| ≤ 7a 1 (h) 8 |∂ x σ k (Γ)| 2 + 6a 3 (h) 7 |∂ 3 x h| 2 ,
so that we finally obtain d dt

1 0 |∂ x h| 2 2 + g σ (Γ) dx + 1 0 1 k + a 3 (h) |∂ 3 x h| 2 -D σ ′ (Γ) Γ |∂ x Γ| 2 + a 1 (h)|∂ x σ k (Γ)| 2 dx ≤ 1 0 7a 1 (h) 8 |∂ x σ k (Γ)| 2 + 6a 3 (h) 7 |∂ 3 x h| 2 dx .
This yields d dt At this point, we show that the idea to introduce truncation functions τ k and σ k yields the nonnegativity of Γ. This relies on a gain of regularity for ∂ t Γ. Lemma 6. Consider an initial condition (h 0 , Γ 0 ) ∈ H 1 ((0, 1)) × L 2 ((0, 1)) with h 0 ≥ 0 and Γ 0 ≥ 0. Given k ≥ 1 and T > 0, any solution (h, Γ) to (31)-( 36) and (3)-( 4) in the sense of Lemma 4 satisfies ∂ t Γ ∈ L 2 (0, T ; (H 1 (0, 1)) * ) and Γ ≥ 0 a.e. in (0, T ) × (0, 1).

1 0 |∂ x h| 2 2 + g σ (Γ) dx + 1 0 1 k + a 3 (h) 7 |∂ 3 x h| 2 -D σ ′ (Γ) Γ |∂ x Γ| 2 + a 1 (h) 8 |∂ x σ k (Γ)| 2 dx ≤ 0 , whence (
Proof. Owing to (31), the embedding of H 1 (0, 1) in L ∞ (0, 1), and the compactness of the supports of σ ′ k and τ k (which follows from (A5) and the properties of T ), there holds

a 1 (h) Γ ∂ x σ k (Γ) + a 2 (h) τ k (Γ) ∂ 3 x h = a 1 (h)Γσ ′ k (Γ)∂ x Γ + a 2 (h) τ k (Γ) ∂ 3 x h ∈ L 2 ((0, T ) × (0, 1
)), and D∂ x Γ ∈ L 2 ((0, T ) × (0, 1)). As a consequence (34) also holds true for all ζ ∈ L 2 (0, T ; H 1 (0, 1)) and

∂ t Γ ∈ L 2 (0, T ; (H 1 (0, 1)) * ). Then, if β ∈ C 2 (R) is such that β ′ is Lipschitz continuous, we have β ′ (Γ) ∈ L 2 (0, T ; H 1 (0, 1)) and d dt 1 0 β(Γ) dx = ∂ t Γ, β ′ (Γ) .
Assuming furthermore that β is convex, i.e. β ′′ ≥ 0, there holds, for any t ∈ (0, T ),

1 0 β(Γ(t)) dx ≤ 1 0 β(Γ 0 ) dx + T 0 1 0 a 1 (h) Γ ∂ x σ k (Γ) + a 2 (h) τ k (Γ) ∂ 3 x h β ′′ (Γ)∂ x Γ dxds.
To finish off the proof, we apply this inequality to a family of functions approximating the negative part of Γ. Namely, we fix a nonnegative χ ∈ C ∞ 0 (R) such that χ ≡ 0 has support in (-1, 0) and define β 1 by

β 1 (0) = 0, β ′ 1 (s) := - ∞ s χ(α)dα ∞ -∞ χ(α)dα for s ∈ R .
We then set β ε (s) := εβ 1 (s/ε) for s ∈ R and ε > 0. Taking β = β ε for ε > 0 in the above inequality, there holds, for each t ∈ (0, T ),

1 0 β ε (Γ(t)) dx ≤ T 0 1 0 a 1 (h) Γ ∂ x σ k (Γ) + a 2 (h) τ k (Γ) ∂ 3 x h β ′′ ε (Γ)∂ x Γ dxds , since β ε (Γ 0 ) = 0 due to Γ 0 ≥ 0. Observing that |τ k (s)β ′′ ε (s)| ≤ |sβ ′′ ε (s)| ≤ C(χ) for s ∈ R, we have T 0 1 0 a 1 (h) Γ ∂ x σ k (Γ) + a 2 (h) τ k (Γ) ∂ 3 x h β ′′ ε (Γ)∂ x Γ dxds ≤ C(χ) {|Γ|<ε} |a 1 (h) ∂ x σ k (Γ)∂ x Γ| + a 2 (h) ∂ 3 x h ∂ x Γ dxds ≤ C(χ) a 1 (h)σ ′ k (Γ) L∞(0,T ;L∞ (0, 1)) + a 2 (h) L∞(0,T ;L∞ (0, 1)) {|Γ|<ε} |∂ x Γ| 2 + ∂ 3 x h ∂ x Γ dxds.
As ∂ x Γ and ∂ 3 x h both belong to L 2 ((0, T ) × (0, 1)) and ∂ x Γ = 0 a.e. in {Γ = 0} by [9, Lemma A.4], we obtain in the limit ε → 0

1 0 max {-Γ(t, x), 0} dx ≤ 0, for t ∈ (0, T ).
This completes the proof.

3.2.

Proof of Theorem 3. Let σ be as in the statement of Theorem 3 and consider an initial condition (h 0 , Γ 0 ) ∈ H 1 ((0, 1)) × L 2 ((0, 1)) with h 0 ≥ 0, Γ 0 ≥ 0 and T > 0. First, applying Lemma 4 and Lemma 6, we obtain a sequence (h k , Γ k ) k≥1 of solutions to (29)-( 30), ( 3)-( 4) for which ∂ t Γ k ∈ L 2 (0, T ; (H 1 (0, 1)) * ) and Γ k ≥ 0 a.e. in (0, T ) × (0, 1). In particular, for each k ≥ 1, the time regularity of h k and Γ k , together with the initial conditions (35) (h k (0, •), Γ k (0, •)) = (h 0 , Γ 0 ), yield the integration by parts formula:

T 0 ∂ t h k , ζ dt = - 1 0 h 0 (x)ζ(0, x)dx - T 0 1 0 h k (s, x)∂ t ζ(s, x)dxdt , T 0 ∂ t Γ k , ζ dt = - 1 0 Γ 0 (x)ζ(0, x)dx - T 0 1 0 Γ k (s, x)∂ t ζ(s, x)dxdt for any test function ζ ∈ C ∞ ([0, T ] × [0, 1]) such that ζ(T, x) = 0 for all x ∈ [0, 1] and ∂ x ζ(t, x) = 0 for all (t, x) ∈ [0, T ] × {0, 1}.
Hence, taking such a test function ζ in (33)-(34) we obtain :

T 0 1 0 h k ∂ t ζ + a 3 (h k ) + 1 k ∂ 3 x h k + a 2 (h k ) ∂ x σ k (Γ k ) ∂ x ζ dxdt = - 1 0 h 0 (x)ζ(0, x)dx , (39)
T 0 1 0 Γ k ∂ t ζ + a 2 (h k ) τ k (Γ k ) ∂ 3 x h k + a 1 (h k ) Γ k ∂ x σ k (Γ k ) ∂ x ζ + DΓ k ∂ 2 x ζ dxdt = - 1 0 Γ 0 (x)ζ(0, x)dx . (40)
So, the proof reduces to find a weak cluster point (h, Γ) of the sequence ((h k , Γ k )) k≥1 that has the regularity ( 19) and for which we can pass to the limit in the two previous equations. First, we note that the conservation laws ( 9) are also satisfied by (h k , Γ k ). Consequently, due to (36) and the Poincaré inequality, we have uniform bounds for

• (h k ) k≥1 in L ∞ (0, T ; H 1 (0, 1)) and (g σ (Γ k )) k≥1 in L ∞ (0, T ; L 1 (0, 1)), • ( a 3 (h k )∂ 3 x h k ) k≥1 , ( a 1 (h k )∂ x σ k (Γ k )) k≥1 , and ( -σ ′ (Γ k )/Γ k ∂ x Γ k ) k≥1 in L 2 ((0, T ) × (0, 1)).
Owing to the bound (A5) from below on σ ′ , this yields a uniform bound on (Γ k ) k≥1 in L ∞ (0, T ; L 2 (0, 1)) and L 2 (0, T ; H 1 (0, 1)), and the sequence of fluxes, given by

J k s := a 2 (h k ) a 1 (h k ) 1/2 τ k (Γ k ) Γ k ∂ 3 x h k + a 1 (h k ) 1/2 ∂ x σ k (Γ k ), J k f := a 3 (h k ) 3 + 1 3k 1/2 ∂ 3 x h k + a 2 (h k ) 3a 3 (h k ) + 3 k -1/2 ∂ x σ k (Γ k ),
are also bounded in L 2 ((0, T ) × (0, 1)) by (36).

Repeating the arguments in [3, Section 2] and [7, Section 3.4], we may extract a subsequence (not relabeled) and find functions h and Γ such that the following convergences hold:

• h k → h in C([0, T ] × [0, 1]) and Γ k → Γ in L 2 (0, T ; L p (0, 1)) for all p ∈ [1, ∞), • 3a 3 (h k ) + 3/k ∂ 3 x h k ⇀ H in L 2 ((0, T ) × (0, 1)) with H = 3a 3 (h) ∂ 3 x h a.e. in {h = 0}, • ∂ x Γ k ⇀ ∂ x Γ in L 2 ((0, T ) × (0, 1)).
Arguing as in the proof of [7, Equation (3.28)], the previous convergences imply that

(3a 3 (h k ) + 3/k) ∂ 3 x h k ⇀ h 3/2 1 (0,∞) (h) ∂ 3 x h in L 2 ((0, T ) × (0, 1)
) . Next, interpolating the bounds on (Γ k ) k≥1 with the help of [5, Proposition I.3.2], we deduce that (Γ k ) k≥1 is bounded in L 6 ((0, T )×(0, 1)) and that the convergence of (Γ k ) k≥1 to Γ takes actually place in L p ((0, T )×(0, 1)) for all p ∈ [2, 6). Now, since

0 ≤ τ k (s) ≤ s for all s ≥ 0 and τ k (s) = s for 0 ≤ s ≤ s k := (k/C g ) r/(r+1) -1 1/r
(see assumption (A6) and ( 27) for the definitions of r and τ k , respectively), we have, for p ≥ 1,

T 0 1 0 τ k (Γ k ) Γ k -1 p dxdt = {Γ k >s k } τ k (Γ k ) Γ k -1 p dxdt ≤ 2 p {Γ k >s k } dxdt ≤ 2 p s 6 k {Γ k >s k } Γ 6 k dxdt ≤ C(p, T ) s 6 k . Since s k → ∞ as k → ∞, we conclude that τ k (Γ k )/Γ k → 1 in L p ((0, T ) × (0, 1
)) for any p ≥ 1. Similarly, since σ ′ k (s) = σ ′ (s) for s ∈ [0, s k ] and σ ′ ∈ C 1 (R), it follows from (A6) and (28) that, given p 0 ∈ [1, 6/(r + 1)), R ≥ 1, and k ≥ 1 such that s k ≥ R, we have

T 0 1 0 |σ ′ k (Γ k ) -σ ′ (Γ)| p0 dxdt ≤ {max {Γ k ,Γ}≤R} |σ ′ (Γ k ) -σ ′ (Γ)| p0 dxdt + {Γ k >R}∪{Γ>R} |σ ′ k (Γ k ) -σ ′ (Γ)| p0 dxdt ≤ σ ′′ L∞(0,R) {max {Γ k ,Γ}≤s k } |Γ k -Γ| p0 dxdt + C(p 0 , C g , r) {Γ k >R}∪{Γ>R} Γ (r+1)p0 k + Γ (r+1)p0 dxdt ≤ σ ′′ L∞(0,R) T 0 1 0 |Γ k -Γ| p0 dxdt + C(p 0 , C g , r) R 6-(r+1)p0 {Γ k >R}∪{Γ>R} Γ 6 k + Γ 6 dxdt ≤ σ ′′ L∞(0,R) T 0 1 0 |Γ k -Γ| p0 dxdt + C(p 0 , C g , r, T ) R 6-(r+1)p0 .
Letting first k → ∞ and then R → ∞ yield that σ ′ k (Γ k ) → σ ′ (Γ) in L p0 ((0, T ) × (0, 1)) for any p 0 ∈ [1, 6/(r + 1)). As r < 2 we note that we may choose p 0 > 2 in the previous convergence which, combined with the weak convergence of (∂

x Γ k ) k≥1 in L 2 ((0, T ) × (0, 1)) implies that ∂ x σ k (Γ k ) ⇀ ∂ x σ(Γ) in L q0 ((0, T ) × (0, 1)) for some q 0 > 1. Consequently, a 1 (h k ) ∂ x σ k (Γ k ) ⇀ a 1 (h)∂ x σ(Γ) and a 2 (h k ) 3a 3 (h k ) + 3 k -1/2 ∂ x σ k (Γ k ) ⇀ a 1 (h) 2 ∂ x σ(Γ) in L 2 ((0, T ) × (0, 1)).
Thus, we conclude that

J k s ⇀ H/2+ a 1 (h)∂ x σ(Γ) and J k f ⇀ H +( a 1 (h)/2)∂ x σ(Γ) in L 2 ((0, T )×(0, 1)
). Combining these convergences with the convergence of (h k ) k≥1 to h in C([0, T ]×[0, 1]) and that of (Γ k ) k≥1 to Γ in L 2 ((0, T )×(0, 1)) allows us to pass to the limit in (39)-( 40).

That h is nonnegative can be obtained as in [START_REF] Garcke | Surfactant spreading on thin viscous films: nonnegative solutions of a coupled degenerate system[END_REF]Section 3.4] while the nonnegativity of Γ is preserved by the weak limit. Concerning the energy estimate (23), we recall (A5) and prove as above that

-σ ′ k (Γ k )/Γ k → -σ ′ (Γ)/Γ in L 2 ((0, T ) × (0, 1)). Consequently, ( -σ ′ k (Γ k )/Γ k ∂ x Γ k ) k≥1 converges weakly in L 1 ((0, T ) × (0, 1)) to -σ ′ (Γ)/Γ∂
x Γ, and we can pass to the weak limit in the energy estimate. This completes the proof of Theorem 3.

Existence of nonnegative solutions for slowly decaying surface tension

From Theorem 3 we obtain existence of weak solutions for a class of surface tension σ decreasing at least quadratically to -∞. We now extend with Theorem 2 the existence result to a class containing surface tensions which decrease slowly to -∞ at infinity (but not too slowly, see (H2)) and are thus closer to applications. To this end, we fix a surface tension σ satisfying (H1)-(H2) and an initial condition (h 0 , Γ 0 ) ∈ H 1 (0, 1) × L 2 (0, 1) satisfying h 0 ≥ 0 and Γ 0 ≥ 0. We split the proof of Theorem 2 into three steps: we first construct a sequence (σ k ) k≥1 of surface tensions approximating σ and enjoying the properties (A4)-(A6) for k ≥ 4 (with constants depending of course on k). Owing to this construction, we may apply Theorem 3 to obtain, for each k ≥ 4, a nonnegative weak solution (h k , Γ k ) to ( 1)-( 4) satisfying (23). We then show that (h k , Γ k ) k≥4 is compact in suitable function spaces. In the last step, we identify the equations satisfied by the cluster points (h, Γ) of (h k , Γ k ) k≥4 .

4.1. Construction of approximate surface tensions. For k ≥ 1, we set σk (1) := 0 and

σ′ k (s) :=              kσ ′ 1 k -k s for s < 1 k , σ ′ (s) for 1 k ≤ s ≤ k, σ ′ (k) - s k 1+θ for s > k. (41)
Recall that θ is defined in [START_REF] Jensen | Insoluble surfactant spreading on a thin viscous film: shock evolution and film rupture[END_REF]. Denoting a family of even mollifiers by (χ ε ) ε>0 , we introduce then the approximate surface tension σ k by

σ ′ k := χ 1/k 2 * σ′ k , σ k (1) = 0. (42)
The following proposition verifies that we can apply Theorem 3 to any approximate surface tension. Proposition 7. Given k ≥ 4, the free energy g k := g σ k associated to σ k via formula [START_REF] Garcke | Surfactant spreading on thin viscous films: nonnegative solutions of a coupled degenerate system[END_REF]

satisfies (A4)-(A6). Proof. By construction, σ ′ k ∈ C ∞ (R)
and, owing to the properties of χ 1/k 2 , straightforward computations yield that

σ ′ k (s) = kσ ′ 1 k -k s for all s ≤ k -1 k 2 , (43)
σ ′ k (s) = σ ′ (k) - s k 1+θ for all s ≥ k + 1 k 2 . (44)
In particular, it follows from (43

) that [s → σ ′ k (s)/s] ∈ C ∞ (R) and g k satisfies (A4). Next, if s ∈ ((k-1)/k 2 , k+(1/k 2 )), we have s -(1/k 2 ) ≥ (k -2)/k 2 ≥ 1/(2k
) and it follows from (41), (H1), and (H2) that

σ ′ k (s) ≤ R kσ ′ 1 k r 1 (0,1/k) (r) + σ ′ (r) 1 (1/k,k) (r) + σ ′ (k) 1 (k,∞) (r) χ 1/k 2 (s -r) dr ≤ R 1 2 σ ′ 1 k 1 (0,1/k) (r) + 1 2 σ ′ (r) 1 (1/k,k) (r) + 1 2 σ ′ (k) 1 (k,∞) (r) χ 1/k 2 (s -r) dr ≤ 1 2 sup [1/k,k] {σ ′ } R χ 1/k 2 (s -r) dr = 1 2 sup [1/k,k] {σ ′ } < 0 . (45)
We then infer from ( 43)-(45) that

g ′′ k (s) = - σ ′ k (s) s ≥              k if s ≤ k -1 k 2 , - 1 4k sup [1/k,k] {σ ′ } if k -1 k 2 ≤ s ≤ k + 1 k 2 , 1 k 1+θ if k + 1 k 2 <
s , and we obtain the existence of a constant c k > 0 for which (A5) holds. Finally, it follows from (8) that, for s ∈

((k -1)/k 2 , k + (1/k 2 )), σ ′ k (s) ≥ - R (1 + σ 0 ) 1 (0,1/k) (r) + σ 0 1 (1/k,k) (r) + σ 0 + r k 1+θ 1 (k,∞) (r) χ 1/k 2 (s -r) dr ≥ -(2 + σ 0 ) R χ 1/k 2 (s -r) dr = -(2 + σ 0 ) .
Noting that ( 8) and ( 43)-(44) guarantee this lower bound also for s ∈ [0, (k -1)/k 2 ) and s

≥ k + (1/k 2 ), we conclude that σ ′ k (s) ≥ -(2 + σ 0 ) for s ≥ 0 . (46)
In addition, it follows from ( 8) and (43

) that σ ′ k (s)/s ≥ -(1 + σ 0 ) k for s ∈ (-∞, (k -1)/k 2 ]
. These two facts give

g ′′ k (s) = - σ ′ k (s) s ≤        k(1 + σ 0 ) for s < k -1 k 2 , k 2 (2 + σ 0 ) k -1 for s ≥ k -1 k 2 , (47)
and we obtain (A6) with r = 0 (so that it also holds true for arbitrary r ∈ (0, 2)).

The previous proposition and Theorem 3 ensure that, for any T > 0 and k ≥ 4, there exists at least a nonnegative weak solution (h k , Γ k ) to ( 1)-( 4) with surface tension σ k and initial condition (h 0 , Γ 0 ). We prepare the study of compactness properties of the sequence (h k , Γ k ) k≥4 by deriving technical properties of the approximate surface tensions (σ k ) k≥4 . Proposition 8. If θ is the exponent given by [START_REF] Jensen | Insoluble surfactant spreading on a thin viscous film: shock evolution and film rupture[END_REF], then there exist constants

C 1 , C 2 ∈ (0, ∞) such that, for k ≥ 4, 0 ≤ g k (s) ≤ C 1 1 + s 2 for all s ≥ 0 , (48)
-(2 + σ 0 ) ≤ σ ′ k (s) ≤ -C 2 ks (1 + s) θ (1 + ks) for all s ≥ 0 . ( 49
)
Moreover, (σ k ) k≥4 converges uniformly to σ on compact subsets of [0, ∞).

Proof. The first inequality in (49) having already been proved in (46), we concentrate on the second inequality and first establish a similar estimate for σ′ k . As the surface tension σ satisfies (8), there holds σ′ k (s) ≤ -

σ 1 (1 + s θ ) ≤ - 2 θ-1 σ 1 (1 + s) θ for s ∈ 1 k , k , σ′ k (s) ≤ - s k 1+θ ≤ - 1 (1 + s) θ for s ≥ k , whence σ′ k (s) ≤ - C ks (1 + ks)(1 + s) θ for s ≥ 1 k since ks/(1 + ks) ≤ 1 for s ≥ 0. Also, σ′ k (s) ≤ -ks ≤ - ks (1 + ks)(1 + s) θ for s ∈ 0, 1 k . Consequently, if s ≥ (k -1)/k 2 , we have s -(1/k 2 ) ≥ (k -2)/k 2 and, as k ≥ 4, 2s ≥ s + 1 k ≥ s + 1 k 2 ≥ s - 1 k 2 ≥ s 2 ,
we have

σ ′ k (s) ≤ - C (k(s -1 k 2 )) (1 + k( 1 k 2 + s))(1 + ( 1 k 2 + s)) θ ≤ - C 2 ks (1 + ks)(1 + s) θ for s ≥ k -1 k 2 .
Since σ ′ k (s) = σ′ k (s) for s ≤ (k -1)/k 2 by (43), we end up with

σ ′ k (s) ≤ - C 2 ks (1 + s) θ (1 + ks)
for s ≥ 0 , and thus obtain (49). We next note that, given R > 0 and s ∈ [0, R], it follows from (8) that, for k ≥ R, we have

|σ k (s) -σ(s)| = 1/k min {s,1/k} kσ ′ 1 k -k r -σ ′ (r) dr ≤ σ ′ 1 k + 1 1 2k + σ 1 k -σ min s, 1 k ≤ 1 + σ 0 2k + σ(0) -σ 1 k and |σ ′ k (s)| ≤ 1 + σ 0 k for s ∈ - 1 k 2 , 0 .
Consequently, owing to the continuity of σ in [0, ∞) and the properties of the convolution, the sequences (σ k ) k and (σ k ) k converge uniformly to σ on compact subsets of [0, ∞).

Finally, integrating the bound (46) gives g k (s) ≤ (2 + σ 0 ) (s ln s -s + 1) ≤ (2 + σ 0 )(1 + s 2 ) for s ≥ 0, whence (48). 4.2. Compactness. Let T > 0. The main difference here with the strategy employed in Section 3.2 is that we no longer have an estimate on (Γ k ) k in L ∞ (0, T ; L 2 (0, 1)) but only in L ∞ (0, T ; L 1 (0, 1)), and this requires a different approach to the compactness issue for (Γ k ) k . Let us collect the estimates available for (h k , Γ k ) k which result from (1)-( 4), (23), and the nonnegativity of g k :

(1) Conservation of matter: for t ∈ [0, T ], there holds

1 0 h k (t, x)dx = 1 0 h 0 (x)dx , 1 0 Γ k (t, x)dx = 1 0 Γ 0 (x)dx . (50)
(2) Energy estimate: for t ∈ [0, T ], there holds 1 2

1 0 |∂ x h k (t, x)| 2 dx + T 0 1 0 h 3 k (s, x) 1 (0,∞) (h k (s, x)) 21 |∂ 3 x h k (s, x)| 2 + h k (s, x) 8 |∂ x σ k (Γ k (s, x))| 2 dxds -D T 0 1 0 σ ′ k (Γ k (s, x)) Γ k (s, x) |∂ x Γ k (s, x)| 2 dxds ≤ 1 0 |∂ x h 0 (x)| 2 2 + g k (Γ 0 (x)) dx. (51)
Moreover, both h k and Γ k are nonnegative a.e. in (0, T )×(0, 1), and

g k (Γ 0 ) 1 ≤ C 1 (1+ Γ 0 2
2 ) by (48). Consequently, (50) and ( 51), together with the lower bound (49) on -σ ′ k and the Poincaré inequality yield:

(B.1) (h k ) k is bounded in L ∞ (0, T ; H 1 (0, 1)) and (Γ k ) k is bounded in L ∞ (0, T ; L 1 (0, 1)). (B.2) (h 3/2 k 1 (0,∞) (h k ) ∂ 3 x h k ) k , (∂ x Γ k /(1 + Γ k ) (1+θ)/2 ) k , and ( √ h k ∂ x σ k (Γ k )) k are bounded in L 2 ((0, T ) × (0, 1)).
We then infer from (20) (with surface tension σ k ), (B.1), and the embedding of

H 1 (0, 1) in L ∞ (0, 1) that (h k ) k is bounded in L ∞ ((0, T ) × (0, 1)) and (∂ t h k ) k is bounded in L 2 (0, T ; (H 1 (0, 1)) * ) . (52)
Next, we prove the following embedding:

Lemma 9. Let Γ be a nonnegative function in L 1 (0, 1) such that (1 + Γ) (1-θ)/2 ∈ H 1 (0, 1). Then there exists C θ < ∞ depending only on θ such that, after possibly redefining Γ on a set of measure zero, Γ ∈ C 0,(1-θ)/2 ([0, 1]) together with

Γ C 0,(1-θ)/2 ([0,1]) ≤ C θ 1 + 1 0 Γ(x)dx 1 + 1 0 |∂ x Γ(x)| 2 (1 + Γ(x)) (1+θ) dx . Proof. Set G := 4 (1 -θ) 2 ∂ x (1 + Γ) (1-θ)/2 2 2 = 1 0 |∂ x Γ(x)| 2 (1 + Γ(x)) 1+θ dx < ∞.
We assume Γ to be smooth for simplicity and focus on the distance 1 + Γ(x) -1 + Γ(y) for 0 ≤ x ≤ y ≤ 1. Then, by Hölder's inequality

1 + Γ(x) - 1 + Γ(y) ≤ y x |∂ x Γ(z)| 1 + Γ(z) dz ≤ y x |∂ x Γ(z)| 2 (1 + Γ(z)) 1+θ dz 1/2 y x (1 + Γ(z)) θ dz 1/2 ≤ √ G y x (1 + Γ(z)) dz θ/2 |y -x| (1-θ)/2 ≤ √ G (1 + Γ 1 ) θ/2 |y -x| (1-θ)/2 . Since 1 0 1 + Γ(z)dz ≤ (1 + Γ 1 ) 1/2 ,
integrating the above inequality with respect to y over (0, 1) ensures that

√ 1 + Γ ∞ ≤ (1 + Γ 1 ) 1/2 + √ G (1 + Γ 1 )
θ/2 , so that there exists C θ depending on θ only such that

√ 1 + Γ C 0,(1-θ)/2 ([0,1]) ≤ C θ 1 + 1 0 Γ(x)dx 1/2 1 + 1 0 |∂ x Γ(x)| 2 (1 + Γ(x)) 1+θ dx 1/2 .
We conclude using the classical trick Γ = ( √ 1 + Γ)

(Γ k ) k is bounded in L ∞ (0, T ; L 1 (0, 1)) ∩ L 1 (0, T ; C 0,(1-θ)/2 ([0, 1])) . (53)
In particular, since Γ k

2 2 ≤ Γ k ∞ Γ k 1 , we have that (Γ k ) k is bounded in L 2 ((0, T ) × (0, 1)) . (54)
Owing to (49), a first consequence of (54) is that (σ k (Γ k )) k is also bounded in L 2 ((0, T ) × (0, 1)). Furthermore, it follows from (51), (49), and (54) that

T 0 1 0 |∂ x σ k (Γ k )| 4/3 dxds = T 0 1 0 -σ ′ k (Γ k ) Γ k 2/3 |∂ x Γ k | 4/3 (Γ k |σ ′ k (Γ k )|) 2/3 dxds ≤ T 0 1 0 -σ ′ k (Γ k ) Γ k |∂ x Γ k | 2 dxds 2/3 T 0 1 0 (Γ k |σ ′ k (Γ k )|) 2 dxds 1/3 ≤ C(T ) (2 + σ 0 ) 2 T 0 1 0 Γ 2 k dxds 1/3 ≤ C(T ) . Consequently, (σ k (Γ k )) k is bounded in L 4/3 (0, T ; W 1 4/3 (0, 1)) . (55)
Finally, (21) (with surface tension σ k ), (B.1), (B.2), (52), and (53) guarantee that

(∂ t Γ k ) k is bounded in L 1 (0, T ; (H 2 N (0, 1)) * ) , (56)
where H 2 N (0, 1) := {w ∈ H 2 (0, 1) : ∂ x w(0) = ∂ x w(1) = 0}. Hence, owing to the compactness of the embeddings of H 1 (0, 1) and C 0,(1-θ)/2 ([0, 1]) in C([0, 1]) and the continuity of the embedding of C([0, 1]) in either (H 1 (0, 1)) * or (H 2 N (0, 1)) * , we infer from (B.1), (52), (53), (56), and [START_REF] Simon | Compact sets in the space L p (0, T ; B)[END_REF]Corollary 4] that there are a subsequence of (h k , Γ k ) k (not relabeled) and functions h and Γ such that

h k → h in C([0, T ] × [0, 1]), Γ k → Γ in L 1 (0, T ; C([0, 1])) . (57)
In addition, (∂ x h k ) k being bounded in L ∞ (0, T ; L 2 (0, 1)) by (B.1) and (∂ x σ k (Γ k )) k being bounded in L 4/3 ((0, T ) × (0, 1)) by (55), we have, up to an extraction of a subsequence and for some function Σ,

∂ x h k ⇀ ∂ x h weakly-⋆ in L ∞ (0, T ; L 2 (0, 1)) and ∂ x σ k (Γ k ) ⇀ Σ in L 4/3 ((0, T ) × (0, 1)) . (58)
As a consequence of (B.1), (54), (57), and (58), we get that the limits satisfy h ∈ L ∞ (0, T ; H 1 (0, 1)), h ≥ 0 , Γ ∈ L ∞ (0, T ; L 1 (0, 1)) ∩ L 2 ((0, T ) × (0, 1)) , Γ ≥ 0 .

Finally, thanks to (B.1), (58), and (59), we have

T 0 1 0 |Γ k (t, x) -Γ(t, x)| 2 dxdt ≤ sup s∈[0,T ] { Γ k (s) 1 + Γ(s) 1 } T 0 Γ k (t) -Γ(t) ∞ dt -→ k→∞ 0 ,
so that we also have Γ k → Γ in L 2 ((0, T ) × (0, 1)) .

(60) 4.3. Identifying the limit system. According to the uniform bounds (B.1), (B.2), and (52), we first obtain that, up to an extraction of a subsequence and for some function  1 and  2 ,

h 3/2 k 1 (0,∞) (h k ) ∂ 3 x h k ⇀  1 , h 1/2 k ∂ x σ k (Γ k ) ⇀  2 ,
in L 2 ((0, T ) × (0, 1)).

(61)

Arguing as in [3, Section 3] and [7, Section 3.4], we first deduce from (B.2) and (57) that ∂ 3 x h belongs to L 2 (P(δ)) for all δ > 0 where P(δ) := {(t, x) ∈ (0, T )×(0, 1) : h(t, x) > δ} and  1 = h 3/2 ∂ 3

x h in {(t, x) ∈ (0, T )×(0, 1) : h(t, x) > 0}. Combining this result with (57) yields Together with (55), the convergence (62) ensures that σ(Γ) ∈ L 4/3 (0, T ; W 1 4/3 (0, 1)) and Σ = ∂ x σ(Γ) in (58). Next, collecting (57), (58), and (62) yields  2 = h 1/2 ∂ x σ(Γ), so that h 1/2 ∂ x σ(Γ) ∈ L 2 ((0, T ) × (0, 1)). It is then straightforward to pass to the limit as k → ∞ in the remaining terms in the weak formulation (20)-( 21) for (h k , Γ k ) and conclude that (h, Γ) is a weak solution to (1)-( 4) with surface tension σ and initial data (h 0 , Γ 0 ). This completes the proof of Theorem 2.

Remark 10. We shall point out that our strategy to prove Theorem 2 by approximating the surface tension σ ∈ C([0, ∞)) ∩ C 1 (0, ∞) by surface tensions (σ k ) k∈N satisfying the assumptions of Theorem 3 does not yield existence of nonnegative weak solutions for the limiting case θ = 1. More precisely, if θ = 1, then the analogue of Lemma 9 for the energy dissipation merely yields a control on √ Γ in the space of continuous functions (instead of a Hölder space as in the case θ ∈ [0, 1)), and we thus lose compactness of the concentration of any bounded family of solutions in L 2 ((0, T ) × (0, 1)). It seems that this threshold is of high importance. Indeed, provided -σ ′ (Γ) is dominated by 1/(1 + Γ) at infinity, a good choice of multiplier for (1)-( 2) yields that the integral (24) (with θ = 1) measures the dissipation of energy for any small solution.

  36) after time integration. The convergence of the Galerkin approximations to a solution to (29)-(30) satisfying the properties listed in Lemma 4 is then carried out as in[START_REF] Garcke | Surfactant spreading on thin viscous films: nonnegative solutions of a coupled degenerate system[END_REF] Section 3.3] to which we refer.

k 1 1 0h 3 1k 1 1 0h 2 1 1 0 2 T 0 1 0.T 0 1 0

 1131121211 (0,∞) (h k ) ∂ 3 x h k ∂ x ζ dxds = T 0 (0,∞) (h) ∂ 3 x h ∂ x ζ dxds , (0,∞) (h k ) Γ k ∂ 3 x h k ∂ x ζ dxds = T 0 (0,∞) (h) Γ ∂ 3 x h ∂ x ζ dxds , for any ζ ∈ C ∞ ([0, T ] × [0, 1]) such that ζ(T, x) = 0 for all x ∈ [0, 1] and ∂ x ζ(t, x) = 0 for all (t, x) ∈ [0, T ] × {0, 1}. We next claim the strong convergence σ k (Γ k ) -→ σ(Γ) in L 2 ((0, T ) × (0, 1)). (62)Indeed, on the one hand, we readily infer from (49) and (60) thatT 0 |σ k (Γ k ) -σ k (Γ)| 2 dxdt ≤ (2 + σ 0 ) |Γ k -Γ| 2 dxdt -→ k→∞ 0On the other hand, it follows from Proposition 8 and (49) that σ k (Γ) → σ(Γ) a.e. in (0, T ) × (0, 1) with |σ k (Γ)| ≤ (2 + σ 0 ) (1 + Γ) ∈ L 2 ((0, T ) × (0, 1)), whence lim k→∞ |σ k (Γ) -σ(Γ)| 2 dxdt = 0by the Lebesgue dominated convergence theorem. Thus, (62) holds true.

  except for the terms involving the bounded and Lipschitz continuous function τ k . Not surprisingly, considering the same Galerkin approximation to (37)-(38) as in [7, Section 3], one can prove the local existence of solutions to the Galerkin approximations exactly in the same way as in [7, Section 3.1]. To obtain the global existence, we argue as in[START_REF] Garcke | Surfactant spreading on thin viscous films: nonnegative solutions of a coupled degenerate system[END_REF] Section 3.2] by deriving an energy estimate for the Galerkin approximations. Since there is a slight modification necessary, let us sketch the proof for (37)-(38), the argument being the same at the level of the Galerkin approximations.

		We multiply
	x h, (38) by v = g ′ σ (Γ), integrate over (0, 1), and add the resulting identities to obtain (37) by -∂ 2 d 1
	dt	0

Acknowledgement

We gratefully acknowledge the hospitality of the Institut für Angewandte Mathematik der Leibniz Universität Hannover and the Institut de Mathématiques de Toulouse, Université Paul Sabatier, where part of this work was done.