Julien Buchoux

Ludovic Bellon
email: ludovic.bellon@ens-lyon.fr

Sophie Marsaudon
email: s.marsaudon@cpmoh.u-bordeaux1.fr

Jean-Pierre Aimé

Carbon nanotubes adhesion and nanomechanical behavior from peeling force spectroscopy

Keywords: Thermal noise, carbon nanotube, adhesion, peeling

come

Introduction

Since their discovery [START_REF] Iijima | Helical microtubules of graphitic carbon[END_REF], Single Walled Carbon Nanotube (SWNT) are at the origin of numerous creative works based on the conjugation of their exceptional electronic and mechanical properties. Their high aspect ratio with diameter in the nm range makes them perfect candidates as nano sensors. Ultimate detection at molecular level are envisioned with nanodevices in which carbon nanotubes (CNTs) are a central part: squid aiming at spin detection at the molecular level [START_REF] Cleuziou | Carbon nanotube superconducting quantum interference device[END_REF], nanoscale resonators where coupling electronic charge transport with high frequencies CNT oscillation leads to highly sensitive mass detection [START_REF] Lassagne | Coupling Mechanics to Charge Transport in Carbon Nanotube Mechanical Resonators[END_REF] or using exciton properties as to detect local variation of pH in biological environment [START_REF] Cognet | Stepwise Quenching of Exciton Fluorescence in Carbon Nanotubes by Single-Molecule Reactions[END_REF]. Near field and nanoelectronic domains have motivated a wealth of attempts based on CNT as a central component [START_REF] Avouris | Carbon Nanotubes[END_REF][START_REF] Anghel | Nanotube transistors as direct probes of the trap dynamics at dielectric-organic interfaces of interest in organic electronics and solar cells[END_REF], while applications as original as fabrication of nanocomposite exhibiting thermal memory effect [START_REF] Miaudet | Shape and Temperature Memory of Nanocomposites with Broadened Glass Transition[END_REF] exploit its low density and high strength. Because the contact between the SWNT and the substrate or the surrounding medium always happens, the interface properties determine most of the nanodevice efficiency. For instance, contact between CNTs and electrodes might exhibit unwanted contact mechanical fluctuation leading to additional energy dissipation, while profile of polymer density surrounding CNT makes the interface properties a key parameter. Therefore, the conception and the fabrication of nanosystems need a companion development of metrology and methodology, a crucial step to develop efficient tools in nanotechnology.

In this work, we present experimental results from an original study of the SWNT mechanical behavior.

Numerous works have been focused on mechanical properties of CNT [START_REF] Kis | Reinforcement of single-walled carbon nanotube bundles by intertube bridging[END_REF][START_REF] Strus | Peeling force spectroscopy: Exposing the adhesive nanomechanics of one-dimensional nanostructures[END_REF][START_REF] Marsaudon | Applied Scanning Probe Methods VIII, chapter Carbon Nanotubes as SPM Tips: Mechanical Properties of Nanotube Tips and Imaging[END_REF][START_REF] Kis | Nanomechanics of carbon nanotubes[END_REF][START_REF] Ishikawa | Visualization of nanoscale peeling of carbon nanotube on graphite[END_REF][START_REF] Ishikawa | Adhesion and peeling forces of carbon nanotubes on a substrate[END_REF][START_REF] Mark | Interfacial energy between carbon nanotubes and polymers measured from nanoscale peel tests in the atomic force microscope[END_REF][START_REF] Ke | Mechanical peeling of free-standing single-walled carbon-nanotube bundles[END_REF]. However, accessing quantitative information such as SWNT adhesion energy and mechanical properties of SWNT when brought in contact with a substrate is still a challenging experiment. In all existing experiments for example, measuring the adhesion energy per unit length of the CNT is either done in a very specific geometry (e.g. nanotube-nanotube interaction) [START_REF] Ke | Mechanical peeling of free-standing single-walled carbon-nanotube bundles[END_REF][START_REF] Lorin | Microscopic determination of the interlayer binding energy in graphite[END_REF][START_REF] Chen | Binding energy of parallel carbon nanotubes[END_REF][START_REF] Hertel | Deformation of carbon nanotubes by surface van der waals forces[END_REF][START_REF] Kis | Interlayer forces and ultralow sliding friction in multiwalled carbon nanotubes[END_REF] or using uncontrolled assumptions (e.g. CNT length in interaction) [START_REF] Strus | Peeling force spectroscopy: Exposing the adhesive nanomechanics of one-dimensional nanostructures[END_REF][START_REF] Ishikawa | Visualization of nanoscale peeling of carbon nanotube on graphite[END_REF][START_REF] Ishikawa | Adhesion and peeling forces of carbon nanotubes on a substrate[END_REF][START_REF] Mark | Interfacial energy between carbon nanotubes and polymers measured from nanoscale peel tests in the atomic force microscope[END_REF], leading to large incertitudes. In the present work, we take advantage of a good control of the SWNT growth processes at an Atomic Force Microscope (AFM) tip apex [START_REF] Marty | Self-assembled single wall carbon nanotube field effect transistors and afm tips prepared by hot filament assisted cvd[END_REF] and the use of a high resolution AFM [START_REF] Paolino | Frequency dependence of viscous and viscoelastic dissipation in coated microcantilevers from noise measurement[END_REF][START_REF] Bellon | Exploring nano-mechanics through thermal fluctuations[END_REF] to extract this information. The low level of noise (10 -13 m/ √ Hz) affords simultaneous recording of static and dynamic measurements, i.e. force curves and thermal noise study, then giving a complete and precise picture of the SWNT mechanical behavior when the CNT partially touches a surface.

Experiments CNT Growth at the tip apex

The growth of CNT at the tip apex uses the Hot Filament assisted Chemical Vapor Deposition (HFCVD) method [START_REF] Marty | Self-assembled single wall carbon nanotube field effect transistors and afm tips prepared by hot filament assisted cvd[END_REF]. Several parameters are of importance to control SWNT growth, in particular it has been shown that cobalt catalyst thickness is a critical parameter. Cobalt layer thickness superior to 9 nm leads to the growth of too many nanotubes at the tip apex, while for too thin one (< 4 nm), the yield of SWNT growth at the apex of the Si tip becomes negligible. With an optimal catalyst thickness of the order of (5 -8) nm, the yield of production of a unique SWNT bundle at the apex of a commercial Si (similar to fig. 1) tip is of about 30 %.

HRTEM observations demonstrate the formation of predominantly SWNT and double walled CNT, with diameters mostly found to be between (1.2 -2.1) nm ± 0.3 nm [START_REF] Faith | Étude par microscopie électronique en transmission de la germination et de la croissance des nanotubes de carbone synthétisés à moyenne température[END_REF]. Raman spectroscopy studies are also strong indications of the excellent crystalline property and purity of the grown CNT [START_REF] Débarre | Electronic and mechanical coupling of carbon nanotubes: A tunable resonant raman study of systems with known structures[END_REF]. Therefore, HFCVD technique appears to be powerful to grow highly crystalline and pure SWNT at the apex on Si tips by taking advantage of the catalytic properties of a thin cobalt layer. A scanning electron micrograph of the nanotube used in the experiment described in this paper is presented in fig. 1. It is about 2 µm long, and well aligned with the tip.

Peeling experiments

In the experiment, we press the CNT against a flat surface of graphite or mica, and record the deflexion d of the AFM cantilever as a function of the sample vertical position Z. The translation of the substrate is performed with a piezo translation platform operated in closed loop (PI P-527.3), featuring an accuracy of 0.3 nm rms. The measurement of the deflexion d is performed with a home made interferometric deflection sensor [START_REF] Paolino | Frequency dependence of viscous and viscoelastic dissipation in coated microcantilevers from noise measurement[END_REF][START_REF] Paolino | Direct measurement of spatial modes of a microcantilever from thermal noise[END_REF][START_REF] Bellon | Exploring nano-mechanics through thermal fluctuations[END_REF],

inspired by the original design of Schonenberger [START_REF] Schonenberger | A differential interferometer for force microscopy[END_REF] with a quadrature phase detection technique [START_REF] Bellon | Differential interferometry with a complex contrast[END_REF]: the interferences between the reference laser beam reflecting on the base of the cantilever and the sensing laser beam on the free end of the cantilever (see figure 1) directly gives a measurement of d, with very high accuracy.

The intrinsic background noise of our detector is only 10 -13 m/ √ Hz for the cantilevers used in this experiment (see inset in figure 2). Beyond this very low noise, one advantage of the technique is that it offers a calibrated measurement of the deflection, without conversion factor from Volt to meter as in the standard optical lever technique common in AFM. Z and d being both calibrated, we can therefore compute at any time the CNT compression z = Zd cos(θ 0 ), and set the origin of z at the last contact between the nanotube and the surface.

In this formula, cos(θ 0 ) accounts for the θ 0 = 15 • inclination of the AFM cantilever with the substrate.

We calibrate the spring constant k of the cantilever with a thermal noise measurement far from the sample [START_REF] Paolino | Direct measurement of spatial modes of a microcantilever from thermal noise[END_REF][START_REF] Butt | Calculation of thermal noise in atomic force microscopy[END_REF]: the thermal excitation operates like a random force (white noise) on the cantilever, and we measure the resulting power spectrum density (PSD) of deflexion fluctuation. As illustrated by the inset of figure 2, the PSD of the first resonance of the cantilever is well described by a simple harmonic oscillator model. From this fit, we determine the dynamic spring constant k 1 of the first mode of the cantilever: k 1 = (84 ± 5).10 -3 N/m.

The static stiffness k is deduced from the dynamic one k 1 with a small correction coefficient computed for an Euler Bernoulli description of the cantilever [START_REF] Butt | Calculation of thermal noise in atomic force microscopy[END_REF]: k = 0.97k 1 = (81 ± 5).10 -3 N/m. In quasi-static operation, the vertical force acting on the nanotube is computed by F = kd/ cos(θ 0 ).

All signal are acquired at 200 kHz with high resolution acquisition cards (NI-4462) to determine the force compression curves F vs z when cycling the CNT against the substrate at low ramping speed (typically 500 nm/s).

Due to the finite stiffness of the cantilever, a mechanical instability occurring with attractive forces prevents continuous operation in equilibrium, and part of the force compression curves F (z) cannot be accessed during the approach-retraction cycle. To exclude data that do not correspond to quasi-static operation of the cantilever, we discard any point presenting a deflexion speed dd/dt greater than 4 standard deviations of its equilibrium fluctuations.

If the ramp is sufficiently slow, we stay long enough around any compression z to measure a spectrum of thermal noise driven fluctuations of deflexion. The force acting on the AFM tip is no longer due to the deflected cantilever alone, since the nanotube touching the surface has to be considered as well. The mechanical oscillator (cantilever first mode) experience an effective stiffness k 1 + k CNT , shifting its resonance frequency from f 0 to f 0 + ∆f , as illustrated in the inset of figure 2. In first approximation, the dynamic stiffness of the cantilever (around the resonance frequency of the oscillator) can be computed by [START_REF] Buchoux | Investigation of the carbon nanotube afm tip contacts: free sliding versus pinned contact[END_REF]:

k CNT = k 1 1 + ∆f f 0 2 -1 (1)
We perform a time-frequency analysis of the deflexion signal, to access at each time to the PSD of the thermal noise driven deflexion. As long as the quasi-static approximation is valid and the resonance has a high enough quality factor, the maximum of the spectrum directly gives ∆f , so we can use equation 1 to estimate k CNT .

Figure 2 present a spectrogram of the deflexion signal during an approach-retract cycle. Each spectrum has been computed in a 5 ms time window, corresponding to a 2.5 nm translation of the sample. The thermal noise excitation is clearly strong enough to determine the resonance frequency shift, and thus k CNT . As k CNT is inferred in the 10 kHz frequency range, it measures the dynamic stiffness of the nanotube/substrate system.

Force-compression curves F (z) and dynamic stiffness k CNT (z) measured on graphite and mica surfaces are reported in figure 3 and 4 respectively. Our measurement device is fully calibrated for all observables, these are therefore quantitative measurements. An hysteresis between approach and retraction can be noticed, with anyway a perfect overlap of both force-compression profiles in some part of the curves. The interaction is everywhere attractive (F < 0) or marginally repulsive, hinting at adhesion to be the most pertinent process to consider. Except for the two pronounced negative peaks during retraction, the force mainly presents two plateaux, one close to zero (principally during approach), the other around -1 nN for graphite and -0.4 nN for mica (principally during retraction). The very same characteristics can be noted on the stiffness curves, with diverging values of k CNT connected to force accidents, and plateaux around zero and 0.4 N/m for graphite, 0.1 N/m for mica. As illustrated in figure 5, this behavior is very robust and the measurement is reproducible for different landing position of the substrate, ramping speeds (from 500 nm/s to 5 µm/s), surrounding atmosphere (air or dry nitrogen) and for the two surfaces of graphite and mica. Values of the force and stiffness plateau are about half and one third on mica compare to that on graphite.

Discussion

To interpret those observations, let us model the nanotube by an elastic line, incompressible along its axis [START_REF] Strus | Peeling force spectroscopy: Exposing the adhesive nanomechanics of one-dimensional nanostructures[END_REF][START_REF] Oyharcabal | Peeling off an elastica from a smooth attractive substrate[END_REF].

The shape of the force-compression curves, with two similar patterns (force plateaux, jumps and divergences)

occurring reproducibly at about 300 nm distance for that specific nanotube, suggests that it is not mechanically integer on its whole 2 µm length. On other nanotubes (data not presented), similar reproducible patterns can be observed, with distances from few tens of nanometers up to 400 nm. Stick-slip phenomenon can be discarded as the observed behavior is independent on ramping speed. A sound hypothesis is that the nanotube is composed of several ideal segments linked by defects presenting higher flexibility (kink like defects for example). The equilibrium shape of each segment can thus be described by the Elastica [START_REF] Oyharcabal | Peeling off an elastica from a smooth attractive substrate[END_REF]:

EI d 2 θ ds 2 = EIθ ′′ = F sin θ ( 2
)
where s is the arc length along the line, θ(s) the angle between the local slope and the vertical direction (normal to the sample), E and I are the Young's modulus and quadratic moment of the CNT, and F the vertical force. We suppose that the nanotube segments can freely slide horizontally (either on the substrate or at their suspension point), so that we will not consider any horizontal forces.

The interaction between the SWNT and the substrate is due to short range Van der Waals potential, it thus rapidly vanishes when the nanotube is not in immediate proximity (a few nanotube diameter at most) with the surface [START_REF] Oyharcabal | Peeling off an elastica from a smooth attractive substrate[END_REF]. We will therefore model this attractive interaction by a simple energy of adhesion per unit length E a . The boundary condition on the substrate can be either a torque free condition (θ ′ = 0), corresponding to only the very end of the segment being in contact with the surface (point contact state), or an adsorption condition, when a non zero length of the nanotube is in contact with the substrate (adsorbed state). In this case, the continuity of the slope of the elastic line thus implies θ = π/2 for the last point of the free standing part of the nanotube. As soon as part of the nanotube is adsorbed, minimizing the energy of the system will tend to maximize the absorbed length. However, this process increases the bending of the free standing part of the nanotube and its the associated curvature energy. The local shape of the CNT is the result of the balance between adhesion and bending, leading the radius of curvature at the contact point to be [START_REF] Obreimoff | The Splitting Strength of Mica[END_REF][START_REF] Seifert | Adhesion of vesicles in two dimensions[END_REF] 1

θ ′ = R a = EI 2E a (3)
If the free standing part of the nanotube has a length large compared to R a , the local shape of the SWNT does not change much when it is being peeled from the substrate. The vertical displacement δz needed to peel a small length δl is in first approximation δz ≃ δl. As we are pulling with a force F , the work produced is F δz while the energy released is E a δl, leading to F ≃ E a : peeling the nanotube results in a flat force-compression curve. In order to close the description of the nanotube as an elastic line, let us briefly discuss the boundary condition at the suspension point. When the nanotube is adsorbed, the torque applied at this point is small in the hypothesis of a high flexibility of this defect linking the segment under consideration to the upper part of the nanotube. We can thus use a torque free condition (θ ′ = 0) in this case. However, when the nanotube is not adsorbed, this boundary condition is not reasonable any more, since it would lead to a unrealistic straight shape for the considered segment. In this case, we will simply use a clamped hypothesis, with θ ∼ θ 0 (where θ 0 = 15 • is the common inclination of the AFM cantilever with the substrate).

We present in figure 6 the force-compression curves numerically simulated for the model of an elastic line with a ratio R a /L = 0.2 where L is the nanotube length (see Appendix for details). During approach, the nanotube will first adopt a weakly bended shape, resulting in a small repulsive force. As the compression is increased, this state turns metastable, but may remain till the end of the nanotube gets tangent to the substrate.

At this point, this branch of solution stops existing and part of the nanotube will be absorbed on the surface, on a force plateau close to the value of E a . As the suspension point is brought closer to the surface, the force exhibit a divergence towards -∞: let L f be the length of the free standing part of the nanotube, the distance between the surface and suspension point is of order L 2 f /2Ra, so equalizing the work done by the force F and the variation in adsorption energy leads to F ∼ -2E a R a /L f , diverging when L f tends to 0.

During retraction, the adsorbed shape will remains stable or metastable as long as the absorbed length is non-zero, the force presenting the peeling plateau expected when the free standing length is larger than R a .

When the absorbed state disappear, the force will jump close to 0 as the nanotube recover a weakly bended shape. The adhesion of the end point or next segment creates however a strong coupling to the surface. Further retraction will eventually lead to a fully extended nanotube (almost perpendicular to the surface), corresponding to very high negative forces. The connection with the substrate will finally break. The phenomenology expected from this model is very close to the experimental observations, as shown by the similarity between figures 6 and 3 or 4.

Flat force-compression curves should lead to zero stiffness, since dF/dz = 0. However, it is clear on figures 3 and 4 that k CNT does not vanish when the force presents a plateau. This dynamic stiffness is measured in the ( 10 -50) kHz range through thermal noise fluctuations. The discrepancy between k CNT and dF/dz can be explained by the simple assumption that adhesion is a slow process: in such a case, high frequency thermal fluctuations will only probe the response of the free standing part of the nanotube, the adsorbed length acting like a rigid clamping condition at fast time scales. The SWNT behaves as a nanomachine of finite stiffness linked to its local shape and its characteristic length R a . In figure 6, we plot the dynamic stiffness computed under this hypothesis for the adsorbed elastic line. Just as for experimental data, it present a flat profile in correspondence to the static peeling force plateau. The value of this stiffness k peeling CNT can be compared to E a /R a , the natural scale of the problem for the spring constant: we get from our model

k peeling CNT ≃ 2 E a R a = EI R 3 a (4)
Using mean value of the force and stiffness plateaux of figures 3 and 4, and equation 4, we estimate the radius of curvature at the adhesion point for both substrates: R HOPG a = 59 nm and R mica a = 72 nm (see table 1 for details).

The distance L a between the last adhesion point and the fully extended nanotube can also be used to estimate R a : we read on figure 6 L a = 0.85R a for a ratio R a /L = 0.2. L a corresponds to the length stored in the curved shape and involved in the peeling process, that is restored as the peeling end up. In fact, as the last adhesion point is a metastable state (corresponding to a vanishing adsorbed length), the estimation we get through this observation gives an upper bound to R a . This leads to R HOPG a 90 nm and R mica a 115 nm, values that are coherent with the estimation through the dynamic stiffness.

From the definition of R a (equation 3), its estimation together with the value of E a can be used to characterize the mechanical properties of the nanotube as we can compute the bending rigidity EI. This quantity should be independent of the substrate, and we find indeed a reasonable agreement (within 40%, see table 1) between the two measurements, with EI ∼ 6 × 10 -24 Jm. The bending rigidity is a characteristic mechanical property of the nanotube, linking its diameter D CNT to its Young's modulus [START_REF] Landau | Theory of elasticity[END_REF]: EI = πED 3 CNT t CNT /8, with t CNT the thickness of the SWNT wall. Assuming E = 10 12 Pa and t CNT = 0.34 nm [START_REF] Kis | Nanomechanics of carbon nanotubes[END_REF], we can compute a diameter D CNT ∼ 3.5 nm for the nanotube segment probed in this experiment. This size is close to the expected diameter for our nanotubes.

Conclusion

As a conclusion let us first summarize the main points we have developed in this article: we perform a series of experiments where a SWNT is pushed almost perpendicularly against a substrate of graphite or mica. We measure the quasi-static force as a function of the compression, but we can also access the dynamic stiffness using a analysis of thermal noise during this process. The most striking feature of these two observables is a plateau curve for a large range of compression, the values of which are substrate dependent. We use the Elastica to describe the shape of the nanotube, and a simple energy of adhesion per unit length E a to describe the interaction with the substrate. A natural length R a is defined, corresponding to the radius of curvature at the adsorption point when a non zero length of the nanotube is adsorbed on the substrate. R a results from an local equilibrium between curvature and adsorption. Comparison of experiment to a numerical integration of the problem demonstrate that the behavior to the nanotube is well described with these simple ingredients.

The analysis of the experimental data naturally leads to the every quantity of interest in the problem (see table 1): the force plateau is a direct measurement of the energy of adhesion per unit length E a for each substrate, and we easily determine R a from the dynamic stiffness plateau. Mechanical properties of the nanotube itself (its bending rigidity EI) can be extracted from those values, and prove to be independent of the substrate.

This work provides quantitative values on the adhesion energy between a SWNT and a substrate. The key point for the method to work is a weak rigidity with respect to adsorption: the radius of curvature at the adsorption point should be small compared to the length of the nanotube. Further investigation should as well give numbers on gold or platinum substrate or any metallic surfaces. Therefore, the present experimental setup should help to design the most appropriate contact electrode for SWNT based nanodevices. Another issue we can address is the access to quantitative information on interface properties between polymer materials and carbon nanotubes. This application deals with the important field of designing composite polymer materials reinforced with CNT [START_REF] Breuer | Big returns from small fibers: A review of polymer/carbon nanotube composites[END_REF][START_REF] Hussain | Review article: Polymermatrix Nanocomposites, Processing, Manufacturing, and Application: An Overview[END_REF][START_REF] Bal | Carbon nanotube reinforced polymer composites -a state of the art[END_REF].

In adsorbed configuration, the SWNT acquires an equilibrium curvature shape with a bending elastic energy balancing the adhesion energy. A promising development is to further exploit this configuration as a highly sensitive mechanical nanomachine. Both the flat pulling force (in the nN range) and the spring constant (in the 10 -2 N/m range) of this nanomachine are directly related to the energy of adhesion. Therefore, any change of the adhesion due to molecule surfactant or other perturbation, for instance local variation of pH in liquid environment, can be monitored with a great precision of 2 independent variables. Periodic perturbations can as well be detected. In particular if there are any characteristic frequencies governing the contact length fluctuation, for the frequencies of the perturbation that fall in that range a stochastic resonant process [START_REF] Gammaitoni | Stochastic resonance[END_REF] We generalize this technique with a time frequency analysis: every 5 ms, we compute a PSD of the deflexion and plot the result in the color coded spectrogram of the bottom graphic. We extract from this plot the time evolution of the resonance frequency, and thus of the dynamic stiffness. ible along its axis, and different boundary conditions are considered whether it is adsorbed (green curves) or not (purple curves). Fundamental and metastable states are respectively drawn as thick and thin lines. The shape of the nanotube for various compression is plotted in the top graphic, while two bottom graphics present the vertical force F and dynamic stiffness k CNT as a function of compression z. During an approach-retraction cycle, the nanotube will first switch from its straight shape (black) to a weakly bended state (purple), which is (meta)stable till the CNT is tangent to the substrate. The nanotube will then adopt an adsorbed state (green), presenting force and dynamic stiffness plateau except for the highest compressions. Upon retraction, the nanotube can remain in this state as long as the adsorbed length (horizontal segment between ticks on top graphic) is not zero. It will then jump back to the weakly bended state, which will eventually correspond to a fully extended nanotube, presenting a diverging force before overcoming the adhesion energy of the CNT free end with the substrate. The arc length L a stored in the curved shape of the adsorbed nanotube and released when this state disappear can directly be read on the force-compression curve, and provides an estimation for R a : L a = 0.85R a .

EI

  and estimated nanotube diameter D CNT for two different substrates. Data correspond to mean values and standard deviations on the plateau of force and stiffness for compression z in the (80 -220) nm range for graphite, and (120 -280) nm range for mica, except L a which is determined as indicated in figure6using the 80 experiments displayed in figure5.

Figure 1 :Figure 2 :

 12 Figure 1: Carbon nanotube tip. The SWNT is grown directly on the tip of an AFM cantilever, as shown on scanning electron micrograph. The length of the nanotube under study is L ∼ 2 µm. In the experiment, itis pressed against a substrate of graphite or mica, and the deflexion d of the cantilever is measured with a differential interferometer. The optical path difference between the sensing beam, reflecting on the cantilever above the tip, and the reference beam on its base, is twice the deflexion d. The nanotube compression z is inferred from the calibrated measurements of d and Z (sample vertical position), taking into account the common θ 0 = 15 • angle between the force sensor and the sample. In the adsorbed state, balance between curvature and adsorption sets the radius of curvature R a at the last point of the free standing part of the nanotube.

Figure 3 :Figure 4 :Figure 5 :Figure 6 :

 3456 Figure3: Force F and dynamic stiffness k CNT of a nanotube as a function of its compression on a graphite substrate. A strong hysteresis, due to adhesion, can be noted between approach (blue) and retraction (red). Well defined plateaux of force (around 0.98 nN) and stiffness (around 0.036 N/m) allow one to estimate the energy of adhesion of the CNT on graphite (E HOPG a

  This is indeed what is observed in our experiments, the value of the plateaux giving direct access to the value of the energy of adhesion per unit length: E HOPG see table 1 for details). These values are in good agreement with the few results available in the literature[START_REF] Strus | Peeling force spectroscopy: Exposing the adhesive nanomechanics of one-dimensional nanostructures[END_REF][START_REF] Ke | Mechanical peeling of free-standing single-walled carbon-nanotube bundles[END_REF][START_REF] Lorin | Microscopic determination of the interlayer binding energy in graphite[END_REF][START_REF] Chen | Binding energy of parallel carbon nanotubes[END_REF][START_REF] Hertel | Deformation of carbon nanotubes by surface van der waals forces[END_REF][START_REF] Kis | Interlayer forces and ultralow sliding friction in multiwalled carbon nanotubes[END_REF][START_REF] Girifalco | Carbon nanotubes, buckyballs, ropes, and a universal graphitic potential[END_REF]34], though our error bars are much smaller.

	a	≃ 0.98 nJ/m for graphite substrate, and E mica a	≃ 0.42 nJ/m
	for mica (

Table 1 :

 1 can be called to amplify the detection sensitivity. Substrate E a /(nJ/m) k peeling CNT /(N/m) R a /(nm) L a /(nm) EI/(10 -24 Jm) D CNT /(nm) Measured values for the adhesion energy per unit length E a , dynamic spring constant plateau k peeling CNT , radius of curvature at adhesion point R a , stored length in absorbed shape L a , bending modulus of the nanotube

	HOPG mica	0.98 ± 0.07 0.42 ± 0.04	0.036 ± 0.007 0.013 ± 0.003	59 ± 10 72 ± 15	85 ± 15 115 ± 15	7.1 ± 2.5 4.5 ± 2.0	3.7 ± 0.4 3.2 ± 0.5

Appendix : numerical simulation

The equilibrium shape of the elastic line used to describe the nanotube is a solution of the Elastica (equation 2), which usually doesn't have simple analytic solutions. We use Matlab to solve this ordinary differential equation using boundary conditions previously described:

• unabsorbed state: clamped extremity at the suspension point (θ(s = 0) = θ 0 = 15 • ) and torque free condition at nanotube end (θ ′ (s = L) = 0).

• absorbed state: torque free condition at the origin (θ ′ (s = 0) = 0) and clamped extremity at the contact point with the substrate (θ(s = L f ) = π/2, where L f is the length of the free standing part of the nanotube above the surface).

The natural control parameter when solving the Elastica is the external force F , whereas the experimental control parameter is the nanotube compression z = L -L f 0 cos(θ)ds. This integral condition is not easy to handle directly, so we perform a shoot and adjust strategy to find for any z the corresponding force F . An additional step is required in the adsorbed state as the length of nanotube in contact is also a free parameter. We adjust this variable by a minimization of the total energy of the system

is the curvature energy of the free standing part, and (L -L f )E a the energy of the adsorbed part of the CNT.

When both states can exist for a given z, we compare their total energies to know which of the two is metastable.


Geoffroy Guéna

Ji Wang

Jean -Baptiste D'espinose

François Lequeux

Boiling of an Emulsion in a Yield Stress Fluid

de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.


Sardaouna Hamadou

Vladimiro Sassone

Catuscia Palamidessi
email: catuscia@lix.polytechnique.fr

Reconciling Belief and Vulnerability in Information Flow

Keywords: Security, information hiding, information flow, quantitative and probabilistic models, uncertainty, accuracy

Belief and vulnerability have been proposed recently to quantify information flow in security systems. Both concepts stand as alternatives to the traditional approaches founded on Shannon entropy and mutual information, which were shown to provide inadequate security guarantees. In this paper we unify the two concepts in one model so as to cope with (potentially inaccurate) attackers' extra knowledge. To this end we propose a new metric based on vulnerability that takes into account the adversary's beliefs.

I. I

Protecting sensitive and confidential data is becoming increasingly important in many fields of human activities, such as electronic communication, auction, payment and voting. Many protocols for protecting confidential information have been proposed in the literature. In recent years the frameworks for reasoning, designing, and verifying these protocols have considered probabilistic aspects and techniques for two reasons. First, the data to be protected often range in domains naturally subject to statistical considerations. Second and more important, the protocols often use randomised primitives to obfuscate the link between the information to be protected and the observable outcomes. This is the case, e.g., of the DCNets [START_REF] Chaum | The dining cryptographers problem: Unconditional sender and recipient untraceability[END_REF], Crowds [START_REF] Michael | Crowds: anonymity for Web transactions[END_REF], Onion Routing [START_REF] Syverson | Anonymous connections and onion routing[END_REF], and Freenet [START_REF] Clarke | Freenet: A distributed anonymous information storage and retrieval system[END_REF].

From the formal point of view, the degree of protection is the converse of the leakage, i.e. the amount of information about the secrets that can be deduced from the observables. Early approaches to information hiding in literature were the so-called possibilistic approaches, in which the probabilistic aspects were abstracted away and replaced by non-determinism. Some examples of these approaches are those based on epistemic logic [START_REF] Halpern | Anonymity and information hiding in multiagent systems[END_REF], [START_REF] Syverson | Group principals and the formalization of anonymity[END_REF], on function views [START_REF] Hughes | Information hiding, anonymity and privacy: a modular approach[END_REF], and on process calculi [START_REF] Ryan | Modelling and Analysis of Security Protocols[END_REF], [START_REF] Schneider | CSP and anonymity[END_REF]. Recently, however, it has been recognised that the possibilistic view is too coarse, in that it tends to consider as equivalent systems which have very different degrees of protection.

The probabilistic approaches are therefore becoming increasingly more popular. At the beginning they were investigated mainly at their strongest form of protection, namely to express the property that the observables reveal no (quantitative) information about the secrets (strong anonymity, no interference) [START_REF] Bhargava | Probabilistic anonymity[END_REF], [START_REF] Chaum | The dining cryptographers problem: Unconditional sender and recipient untraceability[END_REF], [START_REF] Halpern | Anonymity and information hiding in multiagent systems[END_REF]. More recently, weaker notions of protection have been considered, due to the fact that such strong properties are almost never achievable in practice. Still in the probabilistic framework, Rubin and Reiter have proposed the concepts of possible innocence and of probable innocence [START_REF] Michael | Crowds: anonymity for Web transactions[END_REF] as weak notions of anonymity protection (see also [START_REF] Chatzikokolakis | Probable innocence revisited[END_REF] for a generalisation of the latter). These are, however, still true-or-false properties. The need to express in a quantitative way the degree of protection has then lead naturally to explore suitable notions within the well-established fields of Information Theory and of Statistics.

Concepts from Information Theory [START_REF] Cover | Elements of Information Theory[END_REF] have indeed revealed quite useful in this domain. In particular, the notion of noisy channel has been used to model protocols for information-hiding, and the flow of information in programs. The idea is that the input s ∈ S of the channel represents the information to be kept secret, and the output o ∈ O represents the observable. The noise of the channel is generated by the efforts of the protocol to hide the link between the secrets and the observable, usually by means of randomised mechanisms. Consequently, an input s may generate several different outputs o, according to a conditional probability distribution p(o | s). These probabilities constitute the channel matrix C. Similarly, for each output there may be several different corresponding inputs, according to the converse conditional probability p(s | o) which is linked to the above by the Bayes law: p(s | o) = p(o | s) p(s)/p(o). The probability p(s) is the a priori probability of s, while p(s | o) is the a posteriori probability of s, after we know that the output is o. These probability distributions determine the entropy and the conditional entropy of the input, respectively. They represent the uncertainty about the input, before and after observing the output. The difference between entropy and conditional entropy is called the mutual information and expresses how much information is carried by the channel, i.e. how much uncertainty about the input we lose by observing the output (i.e., equivalently, how much information about the input we gain by observing the output).

Even though several notions of entropy have been proposed in Information Theory, Shannon's is by far the most famous of them, due to its relation with the channel's rate, i.e., the speed by which information can be transmitted accurately on a channel. Consequently, there have been various attempts to define the degree of protection by using concepts based on Shannon entropy, notably mutual information [START_REF] Clark | Quantitative information flow, relations and polymorphic types[END_REF], [START_REF] Malacaria | Assessing security threats of looping constructs[END_REF], [START_REF] Malacaria | Lagrange multipliers and maximum information leakage in different observational models[END_REF], [START_REF] Zhu | Anonymity vs. information leakage in anonymity systems[END_REF] and the related notion of capacity, which is the supremum of the mutual information over all possible input distributions, and which therefore represents the worst case from the point of view of security [START_REF] Chatzikokolakis | Anonymity protocols as noisy channels[END_REF], [START_REF] Moskowitz | Covert channels and anonymizing networks[END_REF], [START_REF] Moskowitz | Quasianonymous channels[END_REF].

A refinement of the above approaches came from the ideas of integrating the notions of extra knowledge and belief [START_REF] Michael | Belief in information flow[END_REF], [START_REF] Franz | Attacking unlinkability: The importance of context[END_REF]. The idea is that the gain obtained by looking at the output should be relative to the possible initial knowledge or belief that an attacker may have about the secret. For instance, assume that in a parliament composed by m Labourists and n Conservatives, m members voted against a proposal to remove minimum wages. Without any additional knowledge it is reasonable to believe that all Labourists voted against. If however we came to know that exactly one Conservative voted against, then it is more reasonable to believe that the most liberally-inclined Conservative voted against, and the least liberally-inclined Labourist voted in favour. In this case, the a posteriori belief is likely to be much more accurate than the a priori one, and the gain obtained using the knowledge about MPs' relative positioning on the left-to-right scale is much larger than the one computed as difference of entropies. Consequently, [START_REF] Michael | Belief in information flow[END_REF] proposes to define the protection of a system in terms of the difference (expressed in terms of Kullback-Leibler divergence) between the accuracy of the a posteriori belief and the accuracy of the a priori one.

In recent work, however, Smith has shown that the concepts based on Shannon entropy are not very suitable for modelling the information leakage in the typical scenario of protocol attacks, where the adversary attempts to guess the value of the secret in one single try [START_REF] Smith | Adversaries and information leaks (tutorial)[END_REF]. He gave an example of two programs whose Shannon's mutual information is about the same, yet the probability of making the right guess after having observed the output is much higher in one program than in the other. In a subsequent paper [START_REF] Smith | On the foundations of quantitative information flow[END_REF], Smith has proposed to define the leakage in terms of a notion of mutual information based on Rényi min-entropy.

Recently in [START_REF] Hamadou | Probable Innocence in the presence of independent knowledge[END_REF] the authors extended the vulnerability model of [START_REF] Smith | On the foundations of quantitative information flow[END_REF] in the context of the Crowds protocol for anonymous message posting to encompass the frequent situation where attackers have extra knowledge. They pointed out that in Crowds the adversary indeed has extra information (viz., the target servers) and assumed that she knows the correlation between that and the secret (viz., the users' preferences for servers). They proved that in such scenarios anonymity is more difficult to achieve.

In our opinion, a fundamental issue remains wide open: the need to measure and account for the accuracy of the adversary extra knowledge. Indeed, [START_REF] Hamadou | Probable Innocence in the presence of independent knowledge[END_REF] assumes that the adversary's extra information is accurate, and this assumption is generally not warranted. Inaccuracy can indeed arise, e.g. from people giving deliberately wrong information, or simply from outdated data. As already noticed in [START_REF] Michael | Belief in information flow[END_REF] there is no reason in general to assume that the probability distributions the attacker uses are correct, and therefore they must be treated as beliefs.

This paper tries to fill this gap by generalising the model on Rényi min-entropy to cope with the presence of the attacker's beliefs. To this end we propose a new metric based on the concept of vulnerability that takes into account the adversary's beliefs. The idea is that the attacker does not know the actual probability distributions (i.e., the a priori distribution of the protocol's hidden input and its correlation with the extra information), and is assuming them. The belief-vulnerability is then the expected probability of guessing the value of the hidden input in one try given the adversary's belief. Informally, the adversary chooses the value of the secret input which has the maximum a posteriori probability according to her belief. Then the vulnerability of the secret input is expressed in terms of the actual a posteriori probabilities of the adversary's possible choices. We show the strength of our definitions both in terms of their theoretical properties and their utility by applying them to various threat scenarios and comparing the results to the previous approaches. Among its several advantages, our model allows to identify the levels of accuracy for the adversary's beliefs which are compatible with the security of a given program or protocol.

The rest of the paper is organised as follows: in §II we fix some basic notations and recall some fundamental notions of Information Theory; in §III we briefly revise previous approaches to quantitative information follow; §IV delivers our core technical contribution by extending the model on Rényi min entropy to the case of attacker's beliefs and investigating its theoretical properties; in §V we apply our approach to various threat scenarios and compare it to the previous approaches whilst §VI contains our concluding remarks.

II. P

In this section we briefly revise the elements of Information Theory which underpin the work in this paper, and illustrate our conceptual framework.

A. Some notions of information theory

Being in a purely probabilistic setting gives us the ability to use tools from information theory to reason about the uncertainty of a random variable and the inaccuracy of assuming a distribution for a random variable. In particular we are interested to the following notions: entropy, mutual information, relative entropy and min-entropy. We refer the reader to [START_REF] Cover | Elements of Information Theory[END_REF], [START_REF] James | Guessing and entropy[END_REF] for more details.

We use capital letters X, Y to denote discrete random variables and the corresponding small letters x, y and calligraphic letters X, Y for their values and set of values respectively. We denote by p(x), p(y) the probability of x and y respectively and by p(x, y) their joint probability.

Let X, Y be random variables. The (Shannon) entropy H(X) of X is defined as

H(X) = - x∈X p(x) log p(x).
(

) 1
The entropy measures the uncertainty of a random variable. It takes its maximum value log |X| when X is uniformally distributed and its minimum value 0 when X is a constant. We take the logarithm with a base 2 and thus measure entropy in bits.

I(X; Y) = H(X) -H(X|Y).
(

) 3
It is non-negative, symmetric and bounded by H(X). In other words 0 ≤ I(X; Y) = I(Y; X) ≤ H(X).

The relative entropy or Kullback-Leibler distance between two probability distribution p and q on the same set X, denoted D(p q), is defined as

D(p q) = x∈X p(x) log p(x) q(x) . (4)
It is non-negative (but not symmetric) and it is 0 if and only if p = q. The relative entropy measures the inaccuracy or information divergence of assuming that the distribution is q when the true distribution is p.

The guessing entropy G(X) is the expected number of tries required to guess the value of X optimally. The optimal strategy is to guess the values of X in decreasing order of probability. Thus if we assume that X = {x 1 , x 2 , . . . , x n } and x i 's are arranged in decreasing order of probabilities, i.e., p(x 1 )

≥ p(x 2 ) ≥ • • • ≥ q(x n ), then G(X) = 1≤i≤n ip(x i ). (5)
The min-entropy H ∞ (X) of a random variable is given by

H ∞ (X) = -log max x∈X p(x) (6)
and measures the difficulty for an attacker to correctly guess the value of X in one try (obviously using the optimal strategy above). It can be shown that H ∞ (X) ≤ H(X) with equality when X is uniformly distributed. In general, H(X) can be arbitrary higher than H ∞ (X), since it can be arbitrary high even if X assumes a given value with probability close to 1.

B. Framework

In this paper we consider a framework similar to the probabilistic approaches to anonymity and information flow used e.g. in [START_REF] Chatzikokolakis | Anonymity protocols as noisy channels[END_REF], [START_REF] Halpern | Anonymity and information hiding in multiagent systems[END_REF], [START_REF] Malacaria | Lagrange multipliers and maximum information leakage in different observational models[END_REF], and [START_REF] Smith | On the foundations of quantitative information flow[END_REF]. We restrict ourselves to total protocols and programs with one high level input A, a random variable over a finite set A, and one low level output (observable) O, a random variable over a finite set O. We represent a protocol/program by the matrix of the conditional probabilities p(o j | a i ), where p(o j | a i ) is the probability that the low output is o j given that the high input is a i . An adversary or eavesdropper can see the output of a protocol, but not its input, and she is interested in deriving the value of the input from the observed output in one single try.

In this paper we shall assume that the high input is generated according to an a priori probabilistic distribution p ρ (a i ) unknown to the adversary, as explained in the introduction. We also denote by p β (a i ) the adversary's assumed a priori distribution of A. Furthermore, we assume that the attacker has access to the value of a random variable B distributed over B which summarises the additional knowledge (information) about A she has independently of the behaviour of the protocol. The matrix of the conditional probabilities

p ρ (b k | a i ) (resp. p β (b k | a i ))
expresses the real (resp. the adversary's assumed) correlation between the hidden input and the additional observables B. An adversary's belief then consists of the pair

p β (a i ), p β (b k | a i ) of her assumed probabilities.
When | B | = 1 and the a priori distribution is publiclyknown, i.e., p ρ (a i ) = p β (a i ), the adversary's additional information about A is trivial and cannot help to determine the value of A. For example, knowing the length of a password in a fixed-length password system gives no advantage, as all passwords have the same length. Trivial information allow us to model the absence of additional information, and to see the standard framework in the literature as an instance of ours.

Example 1: Let A be a random variable with a publiclyknown uniform a priori distribution over A = {0, 1, 2, 3}. Assume that the adversary's additional observable is the parity of A, i.e. B = {0, 1}, with the following deterministic belief's correlation p β (b k | a i ) = p(a i mod 2 = b k ). In other words, the adversary believes that her additional information accurately reflects that the value of A is an even number if B = 0 and odd otherwise. Now suppose that A is the high input of the deterministic program C1 below, whose low output is

O = 1 if a ∈ {0, 1} 2 otherwise. PROG C1: BEGIN O := ⌊ log(A + 2) ⌋ END
In the case of wrong belief, i.e., when the attacker believes that the value of A is even (resp. odd) when it actually is odd (resp. even), her low observation of PROG C1 does not allow her to correct her belief. Indeed, both observations can be induced by any number. Now suppose that A is the high input of the probabilistic program C2 below, with low output O ∈ {-1, 0, 2} and conditional probabilistic matrix as in Table I.

PROG C2: BEGIN R 'sampled from {0, 2} with p(0) = λ and p(2) = 1 -λ'; If A = R Then O := A p(o | a) o 0 o 1 o 2 a 0 1 -λ λ 0 a 1 1 0 0 a 2 λ 0 1 -λ a 3 1 0 0 TABLE I C    PROG C2 Else O := -1 END
Contrary to the PROG C1, the low output of PROG C2 may allow the adversary to correct her wrong belief. In particular if B = 1 and O is either 0 or 2 then the adversary knows that her belief is wrong. But the observation O = -1 cannot help her correct her wrong belief, as it is compatible with both beliefs.

III. U  

This section reviews the existing definitions for quantifying information leakage. We begin by quantitative approaches to information flow based on Shannon entropy and mutual information, and recall why they fail to give good security guarantees. We then present an alternative approach based on the adversary's beliefs proposed by Clarkson, Myers and Schneider [START_REF] Michael | Belief in information flow[END_REF]. We conclude the section by presenting a more recent alternative approach based on the concept of vulnerability introduced by Smith [START_REF] Smith | On the foundations of quantitative information flow[END_REF].

A. Shannon entropy approach

There seems to be a general consensus in the literature for using Shannon entropy to measure uncertainty and mutual information to quantify information leakage [START_REF] Chatzikokolakis | Anonymity protocols as noisy channels[END_REF], [START_REF] Clark | Quantitative analysis of the leakage of confidential data[END_REF], [START_REF] Clark | Quantitative information flow, relations and polymorphic types[END_REF], [START_REF] Clark | A static analysis for quantifying information flow in a simple imperative language[END_REF], [START_REF] Köpf | An information-theoretic model for adaptive side-channel attacks[END_REF]. We remind the reader that these approaches aim at quantifying information flow as a reduction of the adversary uncertainty about the high input and take no account of the adversary's initial knowledge. Shannon entropy H(A) as a measure of the uncertainty of A seems adequate to express the adversary's initial uncertainty about A. Similarly, as the conditional entropy H(A | O) measures the amount of uncertainty of A when O is known, it seems appropriate to express the adversary's remaining uncertainty. We thus have the following definitions.

• initial uncertainty (IU): H(A)

• remaining uncertainty (RU): Smith [34] suggests that these notions do not support security guarantees satisfactorily. In particular the remaining uncertainty is generally of little value in characterising the real threat that the adversary could guess the value of A given her low observations. Smith uses the following example to prove that.

H(A | O) • information leakage (IL): IU -RU = H(A) -H(A | O) = I(A; O) Nevertheless, recent work by
Example 2: Consider the following programs C3 and C4, where A is a uniformly distributed 8k-bit integer, k ≥ 2, & denotes bitwise 'AND', and 0 7k-1 1 k+1 a binary constant.

PROG C3: BEGIN If A mod 8 = 0 Then O := A Else O := 1 END PROG C4: BEGIN O := A & 0 7k-1 1 k+1 END
PROG C3 reveals completely the high input when A is a multiple of 8 while it reveals nothing about A otherwise (except of course the very fact that it is not a multiple of 8). On the contrary, PROG C4 reveals always and only the last k + 1 bits of A.

According to the consensus definitions, we have IU = 8k, RU = 7k-0.169 and IL = k+0.169 for PROG C3, and IU = 8k, RU = 7k -1 and IL = k + 1 for PROG C4 (the reader is referred to [START_REF] Smith | On the foundations of quantitative information flow[END_REF] for the detailed calculations). So, under such definitions, PROG C4 appears actually worse than PROG C3, as 7k -1 < 7k -0.169, even though intuitively C3 leaves A highly vulnerable to being guessed (e.g., when it is a multiple of 8) while C4 does not, at least for large k.

B. Belief approach

Recently Clarkson et al. [START_REF] Michael | Belief in information flow[END_REF] showed that the Shannon entropy approach is inadequate for measuring information flow when the adversary makes assumptions about the high-level secret and such assumptions might be incorrect. Based on the conviction that it is unavoidable that the attacker makes such (potentially inaccurate) assumptions, they proposed a new metric. They formalised the idea of an adversary's belief simply as a distribution of A assumed by the adversary: information flow is then expressed as an increase of the accuracy of such belief. The initial accuracy is the Kullback-Leibler distance between the adversary's initial belief and the actual distribution of A; similarly the remaining accuracy is the Kullback-Leibler distance between the Bayesian-updated belief of the adversary after her low observation, and the actual distribution of A.

However, as noticed by Smith [START_REF] Smith | On the foundations of quantitative information flow[END_REF], when the adversary's belief coincides with the a priori distribution of A, then the belief approach reduces again to the inadequate standard approach illustrated above.

C. Vulnerability approach

Having observed that both the consensus and the belief approaches fail in general to give good security guarantees, Smith [START_REF] Smith | On the foundations of quantitative information flow[END_REF] proposes a new metric for quantitative information flow based on the notions of vulnerability and min-entropy. We briefly revise these concepts here.

The vulnerability of a random variable A is the worsecase probability that an adversary could guess the value of A correctly in one try. The vulnerability of A, denoted V(A), is thus formally defined as follows. Definition

2: V(A | O) = o∈O p(o)V(A | o), where V(A | o) is max a∈A p(a | o).
The initial uncertainty about A is then defined as the negative logarithm of V(A), which turnouts to be the minentropy of the random variable A -cf. ( 6) above. And the remaining uncertainty about A after observing O is defined as the min-entropy of A given O. Thus we have the following vulnerability-based definitions:

• IU : H ∞ (A) = -log V(A) • RU : H ∞ (A | O) = -log V(A | O) • IL : IU -RU = H ∞ (A) -H ∞ (A | O)
Now on the security guarantees of the vulnerability-based approach. By applying these definitions to the programs of Example 2, we have IU = 8k, RU = 8k -3 and IL = 3 for PROG C3, and IU = 8k, RU = 7k -1 and IL = k + 1 for PROG C4. While these quantities remain the same as in the consensus approach for PROG C4, the new metric hugely increases the leakage ascribed to PROG C3 reflecting the fact that the low observations of PROG C3 leave the high input very vulnerable to being guessed.

A related line of research has explored methods of statistical inference, in particular those from the hypothesis testing framework. The idea is that the adversary's best guess is that the true input is the one which has the maximum a posteriori probability (MAP rule) and that, therefore, the a posteriori vulnerability of the system is the complement of the Bayes Risk, which is the average probability of making the wrong guess when using the MAP rule [START_REF] Chatzikokolakis | On the bayes risk in information-hiding protocols[END_REF]. This is always at least as high as the a priori vulnerability, which is the probability of making the right guess just based on the knowledge of the input distribution. It turns out that Smith's notion of leakage actually corresponds to the ratio between the a posteriori and the a priori vulnerabilities [START_REF] Braun | Quantitative notions of leakage for one-try attacks[END_REF], [START_REF] Smith | On the foundations of quantitative information flow[END_REF].

Concerning the efficient computation of the channel matrix and the leakage, the only work we are aware of is [START_REF] Andrés | Computing the amount of leakage in information-hiding systems[END_REF], in which the authors propose various automatic techniques. One of these is able to generate counterexamples, namely points on the execution where the channel exhibits an excessive amount of leakage. This method is therefore also useful to fix unsound protocols.

IV. U B  V

We now propose an alternative approach based on the vulnerability concept that takes into account the adversary's belief.

A. Belief-vulnerability

Let B be the adversary's additional information about a random high level variable A. Then the belief-vulnerability of A is the expected probability of guessing A in one try given the adversary's belief. Given an additional information B = b, the adversary will choose a value having the maximal a posteriori probability according to her belief, that is a value a ′ ∈ Γ b , where Γ b = argmax a∈A p β (a | b). The vulnerability of A given b is then the real probability that the adversary's choice is correct given b, that is the a posteriori probability p ρ (a ′ | b). As there might be many values of A with the maximal belief a posteriori probability, the attacker will pick uniformly at random one element in Γ b . Hence we have the following definition.

Definition 3: Let A be a random variable and B the adversary's extra knowledge about A. Then the belief-vulnerability of A, denoted V(A : B), is defined as

V(A : B) = b∈B p ρ (b)V(A : b) ( 7
)
where

V(A : b) = 1 |Γ b | a ′ ∈Γ b p ρ (a ′ | b).
Next, we show how to compute V(A : B) from the given probabilities.

V(A : B) = b∈B p ρ (b)V(A : b) = b∈B p ρ (b) 1 |Γ b | a∈Γ b p ρ (a | b) = b∈B 1 |Γ b | a∈Γ b p ρ (a | b)p ρ (b) (by Bayes theorem) = b∈B 1 |Γ b | a∈Γ b p ρ (b | a)p ρ (a).
Thus the belief-vulnerability can be easily computed as follows.

Proposition 1: Let A be a random variable and B the adversary's extra knowledge about A. Then

V(A : B) = b∈B 1 |Γ b | a∈Γ b p ρ (b | a)p ρ (a). (8)
We then define the initial uncertainty as the min-entropy of A : B. Thus we have the following definition.

Definition 4: Let A be a random variable and B the adversary's additional information about A. Then the initial threat to A given B, denoted H ∞ (A : B), is defined as

H ∞ (A : B) = log 1 V(A : B) . ( 9
)
Example 3: Suppose that A is uniformly distributed over {0, 1, 2, 3} and the adversary's extra information is about the parity of A. Assume that the a priori distribution of A is publicly-known, i.e. ∀a ∈ A, p β (a) = p ρ (a). Assume also that the adversary believes that her extra info is accurate, that is she assumes the following correlation: the adversary's extra information is slightly noisy: when the high input is an even (resp. odd) number, the extra observable is usually (with probability 0.98) even (resp. odd). But with a small probability the adversary is wrong as the parity is reversed. The contrary holds for the second correlation p ρ2 (b | a), that is the correlation is highly noisy. The third correlation is not a noisy one and coincide with the adversary's assumed one: the adversary's belief is therefore 100% accurate since we assumed that the actual a priori distribution of A is publicly-known. Finally, the last correlation p ρ4 (b | a) always fools the attacker by reverting the parity. Note that in this last case the adversary's initial uncertainty is infinite. This means that it is impossible for her to guess the value of the secret in one try when her initial belief is 100% inaccurate. In order to avoid such infinite values when computing the reduction of uncertainty, we shall exclude 100% always inaccurate beliefs. Thus we define admissible beliefs up to a positive number ǫ so that we can approximate 100% always inaccurate beliefs by making ǫ as close to zero as possible.

p β (b | a) b 0 b 1 a 0 1 0 a 1 0 1 a 2 1 0 a 3 0 1 p ρ (b | a) p ρ1 p ρ2 p ρ3 p ρ4 V(A : B) 0.
p ρ3 (b | a) b 0 b 1 a 0 1 0 a 1 0 1 a 2 1 0 a 3 0 1 p ρ4 (b | a) b 0 b 1 a 0 0 1 a 1 1 0 a 2 0 1 a 3 1 0 TABLE II I      Then Γ 0 = {0, 2} and Γ 1 = {1, 3}. Thus V(A : B) = b∈B 1 |Γ b | a∈Γ b p ρ (b | a)p ρ (a) = b∈{0,1} 1 |Γ b | a∈Γ b 1 4 p ρ (b | a) = 1 4 1 2 a∈Γ 0 p ρ (b 0 | a) + 1 2 a∈Γ 1 p ρ (b 1 | a) = 1 8 p ρ (b 0 | a 0 ) + p ρ (b 0 | a 2 ) + p ρ (b 1 | a 1 ) + p ρ (b 1 | a 3 ) .

Table II summarizes the initial uncertainty about

Definition 5: An adversary's initial belief is ǫ-admissible (0 < ǫ ≤ 1) if the following holds.

∀b ∈ B, a ∈ Γ b implies p ρ (a | b) ≥ ǫ.
Beliefs ǫ (A, B) denotes the set of ǫ-admissible beliefs.

Note that in the above definition, ǫ is a lower bound on the probability that the adversary's guess is correct. Note also that if a belief is ǫ-admissible then it is also ǫ ′ -admissible for all ǫ ′ ≤ ǫ. Thus Beliefs ǫ (A, B) ⊆ Beliefs ǫ ′ (A, B).

Next we show that, contrary to information, belief may actually hurt. Indeed, in the above example since A is uniformly (and publicly) distributed over {0, 1, 2, 3} then

H ∞ (A) = 2. Hence H ∞ (A) > H ∞ (A : B) when ρ ∈ {ρ 1 , ρ 3 } and H ∞ (A) < H ∞ (A : B) when ρ ∈ {ρ 2 , ρ 4 }.
In particular, the following two results hold.

Lemma 1:

If ∀b ∈ B, a ∈ Γ b implies p ρ (b | a) ≤ 1 |B| then H ∞ (A) ≤ H ∞ (A : B) Proof: V(A : B) = b∈B 1 |Γ b | a∈Γ b p ρ (b | a)p ρ (a) ≤ b∈B 1 |Γ b | a∈Γ b 1 |B| p ρ (a) ≤ b∈B 1 |Γ b | a∈Γ b 1 |B| max a∈A p ρ (a) ≤ b∈B 1 |Γ b | |Γ b | |B| max a∈A p ρ (a) ≤ 1 |B| b∈B V(A) ≤ |B| V(A) |B| = V(A). Hence H ∞ (A) ≤ H ∞ (A : B).
The next result states that a 100% accurate belief is information and hence may only reduce the uncertainty about A.

Lemma 2:

If ∀b ∈ B, a ∈ Γ b implies that p ρ (b | a) = max a ′ ∈A p ρ (a ′ | b), then H ∞ (A : B) = H ∞ (A|B) ≤ H ∞ (A). Proof: V(A : B) = b∈B p ρ (b)V(A : b) = b∈B p ρ (b) 1 |Γ b | a∈Γ b p ρ (a | b) = b∈B p ρ (b) 1 |Γ b | a∈Γ b max a ′ ∈A p ρ (a ′ | b) = b∈B p ρ (b) 1 |Γ b | a∈Γ b V(A | b) = b∈B p ρ (b) 1 |Γ b | |Γ b | V(A | b) = b∈B p ρ (b)V(A | b) = V(A | B) Hence H ∞ (A : B) = H ∞ (A|B) ≤ H ∞ (A).
We conclude this subsection by establishing both a lower and an upper bounds of our initial uncertainty in term of minentropy. The following auxiliary definitions and results serve this purpose.

Definition 6: An adversary's initial belief is (at least) ωaccurate (0

< ω ≤ 1), denoted p β ω (a), p β ω (b | a) if the following holds. ∀b ∈ B, 1 |Γ b | a∈Γ b p ρ (a | b) ≥ ω • V(A | b).
In other words, an adversary's belief is ω-accurate if the belief-vulnerability of A is never off by more than a factor ω from the real vulnerability of A given the additional information. Similarly, we say that an adversary's belief is (ω)accurate if it is exactly ω-accurate, i.e.,

∀b ∈ B, 1 |Γ b | a∈Γ b p ρ (a | b) = ω • V(A | b).
Fixed the actual probabilities p ρ (a) and p ρ (b | a), let us consider the partial order ≪ on Beliefs(A, B), such that

p β (a), p β (b | a) ≪ p ′ β (a), p ′ β (b | a) if and only if ∀b ∈ B, 1 |Γ b | a∈Γ b p ρ (a | b) ≤ 1 |Γ ′ b | a∈Γ ′ b p ρ (a | b).
Then the following lemma states that (p β 1 (a), p Proof: Follows easily from the definitions of ≪ and p β 1 (a), p β 1 (b | a) . We now show that the uncertainty based on beliefvulnerability decreases when the accuracy of the adversary's belief increase.

Lemma

4: p β (a), p β (b | a) ≪ p ′ β (a), p ′ β (b | a) implies H ∞ (A : B) ≥ H ∞ (A : B ′ ). Proof: p β (a), p β (b | a) ≪ p ′ β (a), p ′ β (b | a) ∀b ∈ B, 1 |Γ b | a∈Γ b p ρ (a | b) ≤ 1 |Γ ′ b | a∈Γ ′ b p ρ (a | b) ∀b ∈ B, p ρ (b) 1 |Γ b | a∈Γ b p ρ (a | b) ≤ p ρ (b) 1 |Γ ′ b | a∈Γ ′ b p ρ (a | b) b∈B p ρ (b) 1 |Γ b | a∈Γ b p ρ (a | b) ≤ b∈B p ρ (b) 1 |Γ ′ b | a∈Γ ′ b p ρ (a | b) V(A : B) ≤ V(A : B ′ ).
Hence H ∞ (A : B) ≥ H ∞ (A : B ′ ). Now we show that a 1-accurate belief is also 100% accurate. Lemma 5: An adversary's belief is 1-accurate if and only if

∀b ∈ B, ∀a ∈ Γ b , p ρ (a | b) = max a ′ ∈A p ρ (a ′ | b).
Proof: An adversary's belief is 1-accurate if and only if

∀b ∈ B, 1 |Γ b | a∈Γ b p ρ (a | b) ≥ 1 • max a ′ ∈A p ρ (a ′ | b). ( 10
) But 1 |Γ b | a∈Γ b p ρ (a | b) ≤ 1 • max a ′ ∈A p ρ (a ′ | b) since ∀b ∈ B, ∀a ∈ Γ b , p ρ (a | b) ≤ max a ′ ∈A p ρ (a ′ | b).
Therefore ( 10) is equivalent to

∀b ∈ B, 1 |Γ b | a∈Γ b p ρ (a | b) = 1 • max a ′ ∈A p ρ (a ′ | b) ( 11
)
which itself is equivalent to [START_REF] Clark | Quantitative information flow, relations and polymorphic types[END_REF] to holds; but this is impossible.

∀b ∈ B, ∀a ∈ Γ b , p ρ (a | b) = max a ′ ∈A p ρ (a ′ | b). Indeed, if there exists a i in Γ b such that p ρ (a i | b) < max a ′ ∈A p ρ (a ′ | b) there is a j in Γ b such that p ρ (a j | b) > max a ′ ∈A p ρ (a ′ | b) in order for
The next result shows that an ω-accurate belief impacts the vulnerability of A in presence of extra information by a factor at least ω.

Lemma 6: If the adversary's initial belief is ω-accurate then

H ∞ (A : B) ≤ ω • H ∞ (A | B)
Proof: By definition we have:

V(A : B) = b∈B p ρ (b)V(A : b) = b∈B p ρ (b) 1 |Γ b | a∈Γ b p ρ (a | b) (by hypotheses) ≥ b∈B p ρ (b) ω • V(A | b) ≥ ω • b∈B p ρ (b)V(A | b) ≥ ω • V(A | b).
We can then establish our bounds on the initial uncertainty as follows.

Theorem 1: Let A be a random variable and B be the additional information about A. Then

H ∞ (A | B) ≤ H ∞ (A : B) ≤ H ∞ (A | B) + log 1 ζ , where ζ = min b∈B 1 |Γ b | a∈Γ b p ρ (a | b) /V(A | b).
Note that ζ in the above theorem is strictly greater than zero since we consider admissible beliefs for some positive ǫ. Hence the upper bound is well defined.

Proof: From Lemma 10, Lemma 2, Lemma 3 and Lemma 4 we have

H ∞ (A | B) ≤ H ∞ (A : B).
The second part of the inequality follows from Lemma 6 and from the fact that the adversary's belief is ζ-accurate.

Finally, we show that when A is uniformly distributed, we can obtain a better upper bound. We begin by recalling a result proven in [START_REF] Smith | On the foundations of quantitative information flow[END_REF].

Lemma 7: If A is uniformly distributed and the program is deterministic then

H ∞ (A | O) = log |A| / |O| .
Thus we have the following corollary of Theorem 1.

Corollary 1: If A is uniformly distributed and the actual correlation p ρ (b | a) is deterministic then log |A| |B| ≤ H ∞ (A : B) ≤ log |A| |B| + log 1 ζ ,
where ζ is defined as in the above theorem.

B. A posteriori belief-vulnerability

We now define our belief-vulnerability conditioned to the low observations of the adversary. Note that in this case, the adversary's low observations could help her sort out inaccurate beliefs. Indeed, if an observation o contradicts her initial belief about extra information b, that is there is no high input a in Γ b such that p ρ (o | a) > 0, then to try values in Γ b is pointless. A belief b is compatible (from the adversary's point of view) to an observation o, denoted b⋄o, if there exists a in Γ b such that p ρ (o | a) > 0. For instance, if the adversary initially believes that A is an odd number while observing a low output o of the program which is only possible for even numbers high inputs, then her belief and her observation are incompatible. Let o and b be the adversary's observation and initial belief respectively. She will then only try values a in Γ b for which p ρ (o | a) > 0 if her belief and observation are compatible. Otherwise, as the evidence contradicts her belief, she will throw it away and only use the observation. Now let Γ b,o denote the set possible adversary's choices according to both her belief and her low observation. Then

Γ b,o = argmax a∈A p β (a | b, o) if b ⋄ o, argmax a∈A p ρ (a | o) otherwise.
Then we define the a posteriori belief-vulnerability as follows.

Definition 7: Let A be the high input of a program, O its low output and B the adversary's initial belief about A. Then the belief-vulnerability of A given O, denoted V(A | O : B), is defined as

V(A | O : B) = o∈O b∈B p ρ (b, o)V(A | o : b), ( 12
)
where

V(A | o : b) = 1 |Γ b,o | a∈Γ b,o p ρ (a | o, b
). We now show how to compute V(A | O : B) under the assumption that the extra information B and the low observable O are actually independent.

V(A | O : B) = o∈O p ρ (b, o)V(A | o : b) = o∈O b∈B p ρ (b, o) 1 |Γ b,o | a∈Γ b,o p ρ (a | o, b) = o∈O b∈B 1 |Γ b,o | a∈Γ b,o p ρ (a | o, b)p ρ (b, o) = o∈O b∈B 1 |Γ b,o | a∈Γ b,o p ρ (o, b | a)p ρ (a) = o∈O b∈B 1 |Γ b,o | a∈Γ b,o p ρ (b | a)p ρ (o | a)p ρ (a)
Thus we have the following proposition. Proposition 3: Let A be the high input of a program, O its low output and B the adversary's extra information about A.

If O and B are independent, then

V(A | O : B) = o∈O b∈B 1 |Γ b,o | a∈Γ b,o p ρ (b | a)p ρ (o | a)p ρ (a).
We then define our remaining uncertainty as follows. Definition 8: Let A be the high input of a program, O its low output and B the adversary's initial belief about A. III. Thus under the assumption that B and O are actually independent we have

The remaining uncertainty about

A after observing O, denoted H ∞ (A | O : B), is defined as H ∞ (A | O : B) = log 1 V(A | O : B)
V(A | O : B) = b,o 1 |Γ b,o | a∈Γ b,o p ρ (b | a)p ρ (o | a)p ρ (a) = 1 4 b,o 1 |Γ b,o | a∈Γ b,o p ρ (b | a)p ρ (o | a) = 1 4 p ρ (b 0 | a 0 )p ρ (o 0 | a 0 ) + p ρ (b 0 | a 2 )p ρ (o 1 | a 2 ) + p ρ (b 0 | a 3 )p ρ (o 2 | a 3 ) + p ρ (b 1 | a 0 )p ρ (o 0 | a 0 ) + p ρ (b 1 | a 1 )p ρ (o 1 | a 1 ) + p ρ (b 1 | a 3 )p ρ (o 2 | a 3 ) = 1 4 p ρ (b 0 | a 0 ) + p ρ (b 0 | a 2 ) + p ρ (b 0 | a 3 ) + p ρ (b 1 | a 0 ) + p ρ (b 1 | a 1 ) + p ρ (b 1 | a 3 ) = 1 4 (p ρ (b 0 | a 0 ) + p ρ (b 1 | a 0 )) + (p ρ (b 0 | a 3 ) + p ρ (b 1 | a 3 )) + p ρ (b 0 | a 2 ) + p ρ (b 1 | a 1 ) = 1 4 2 + p ρ (b 0 | a 2 ) + p ρ (b 1 | a 1 ) . Hence V(A | O : B) ≥ 1 2
, meaning that the remaining uncertainty H ∞ (A | O : B) is always less than or equal to 1 regardless the actual correlation between A and B. Thus PROG C5 leaves the high value very vulnerable to be guessed. Recall that the initial uncertainty H ∞ (A : B) (see Example 3) can be arbitrary high when the accuracy of the adversary's belief is very low. This implies that a deliberate reverting of the parity of the high value in order to confuse the adversary is of very little use when the adversary can see the output of PROG C5. Indeed, even if her initial belief is wrong, the observation allows her to correct it. Table IV summarises the remaining uncertainty for PROG C5 when the actual correlation is ρ 1 , ρ 2 and ρ 3 .

We now establish both a lower bound and upper bound to our remaining uncertainty. To this end, we establish some auxiliary results.

We first extend the notion of initial belief's accuracy and the partial order ≪ to the adversary's post-beliefs as follows. An adversary's post-belief is (at least) ω-accurate if

∀o ∈ O, ∀b ∈ B, 1 |Γ b,o | a∈Γ b,o p ρ (a | o, b) ≥ ω • V(A | o, b).
Let ≪ O denote the partial order on Beliefs induced by the observations O such that p β (a),

p β (b | a) ≪ O p ′ β (a), p ′ β (b | a) p β (a | o, b) a 0 a 1 a 2 a a Γ b k ,o j b 0 , o 0 1 0 0 0 {a 0 } b 0 , o 1 0 0 1 0 {a 2 } b 0 , o 2 0 0 0 1 {a 3 } b 1 , o 0 1 0 0 0 {a 0 } b 1 , o 1 0 1 0 0 {a 1 } b 1 , o 2 0 0 0 1 {a 3 }
1 |Γ b,o | a∈Γ b,o p ρ (a | o, b) ≤ 1 |Γ ′ b,o | a∈Γ ′ b,o p ρ (a | o, b).
As in the previous subsection, we can show that a 1-accurate post-belief is an information and that the remaining uncertainty is a decreasing function of the accuracy of the adversary postbelief.

Lemma 8: Let A be the high input of a program, O its low output and B be an additional information about A. If the adversary's post-belief is 1-accurate then

H ∞ (A | O : B) = H ∞ (A | B, O). Lemma 9: p β (a), p β (b | a) ≪ O p ′ β (a), p ′ β (b | a) implies H ∞ (A | O : B) ≥ H ∞ (A | O : B ′ ).
We then establish the following bounds for the beliefvulnerability based remaining uncertainty.

Theorem 2: Let A be a random variable, B be the additional information about A and O be the low output of the program. Then

H ∞ (A | O, B) ≤ H ∞ (A|O : B) ≤ H ∞ (A | O, B) + log 1 η ,
where η = min o∈O, b∈B

1 |Γ o,b | a∈Γ o,b p ρ (a | o, ) / V(A | o, b).
Finally we have the following corollary of Theorem 2. Corollary 2: If A is uniformly distributed and both the protocol and the actual correlation between A and B are deterministic then

log |A| |O| • |B| ≤ H ∞ (A | O : B) ≤ log |A| |O| • |B| + log 1 η .
We conclude this section by showing that in case of belief's absence (i.e., the initial knowledge of the adversary is reduce to trivial information) then our definitions are equivalent to the vulnerability-based definitions of Smith.

Theorem 3: The following statements are equivalent.

H ∞ (A | B) = H ∞ (A) and H ∞ (A | O : B) = H ∞ (A | O). Proof: (1) ⇒ (2): |B| = 1 implies that B is a constant.
Hence B is independent of both A and O. Furthermore, the only possible adversary's belief, which is the publicly-known a priori distribution of A, is 1-accurate. Thus V(A :

B) = V(A | B). But V(A | B) = V(A) since A and B are independent. Similarly, V(A | O : B) = V(A | O).
(2) ⇒ (1): (By contradiction). Assume that (2) holds and |B| > 1 or the adversary does not know the a priori distribution of A. Let first consider the case |B| > 1. Then we can create an adversary's belief which is exactly ω-accurate for any 0 < ω < 1. Thus for such belief we have

V(A : B) = ω • V(A | B). Therefore if we choose ω V(A)/V(A | B), then V(A : B) V(A).
Hence, it contradicts our initial hypotheses that (2) holds. Now assume that |B| = 1 but the adversary does not know the a priori distribution of A. Again B is a constant and thus irrelevant. If A is not uniformly distributed then it is easy to construct an adversary's assumed a priori distribution of

A such that V(A : B) V(A | B) = V(A). If however A is uniformly distributed then we can still create a program such that V(A | O : B) V(A | O, B) = V(A | O).
Again, this contradicts our initial hypotheses that (2) holds.

Finally, the equivalence (2) ⇔ (3) follows because functions g(x) =log(x) and g ′ (x) = 2 -x are strictly monotone.

V. O  A   B- A

The previous section establishes the reasonableness of our definitions in terms of their theoretical properties. Now we show the utility of our approach by applying it to various threat scenarios and comparing the results to the previous approaches.

We proceed now to the analysis of the programs presented in this paper, and compare the results with previous approaches. Each of the programs is analysed under the following hypothesis.

• The high input A is uniform and publicly-known. Thus

∀a ∈ A p ρ (a) = p β (a) = 1
|A| .

• The adversary believes that her extra info is accurate, that is she assumes the correlation shown in Table V. Thus Γ 0 = {0, 2} and Γ 1 = {1, 3}.

β (b | a) b 0 b 1 a 0 1 0 a 1 0 1 a 2 1 0 a 3 0 1 p ρ (b | a) b 0 b 1 a 0 ω 1+ω 1 1+ω a 1 1 1+ω ω 1+ω a 2 ω 1+ω 1 1+ω a 3 1 1+ω ω 1+ω TABLE V C 
We denote by IU x the initial uncertainty computed using approach x ∈ {c, v, bv} where c, v and bv denote the consensus, vulnerability and belief-vulnerability approaches respectively. Ditto for RU x and IL x .

We begin by PROG C1 of Example 1. Since A is uniformly distributed then 4 2 = 1 = RU c since PROG C1 is deterministic. Thus, when we do not take into account the attacker's belief, then IL c = IL v = 1. Now let consider the uniformly ω-accurate attacker's belief. Then from the calculation in Example 3 we have IU bv =log ω 2(1+ω) . And from Proposition 3, we get RU bv =log ω 1+ω . Therefore for all ω, IL bv = 1. Thus, the adversary's initial knowledge about the parity of A does not affect the quantity of information leaked by PROG C1. However, the real question is not how much information is leaked by this program, but what the remaining uncertainty represents in term of security threat to the high input. Even though the adversary's belief does not affect the quantity of information leaked, it dramatically affects both the initial and remaining uncertainty. Indeed, as illustrated by Figure 1, both IU bv and RU bv tend toward infinity as ω tends toward zero. On the other hand, IU bv and RU bv tend toward two and one, respectively, as ω tends toward one. In other words inaccurate beliefs strengthen the security of the program (by confusing the adversary), whilst accurate beliefs may weaken it. Thus, a deliberate randomization of the parity of the high input in order to confuse the adversary is a good strategy to strengthen the security of this program.

IU c = IU v = log |A| = 2. Furthermore, RU v = log |A| / |O| = log
We continue our analysis with PROG C5 of Example 4 which is a slight modification of PROG C1. Again IU c = IU v = log |A| = 2 and IU bv =log ω 2(1+ω) . For the remaining uncertainty we have RU c = 0.585, RU v = 0.415 and RU bv =log 2ω+1 2(1+ω) . Therefore, IL c = 1.415, IL v = 1.585 and IL bv = log 2ω+1 ω . The information flow ascribed by our approach to this program is illustrated by Figure 2. Unlike PROG C1, the information leakage of this program can be arbitrary high when the inaccuracy of the adversary's belief is high whilst its remaining uncertainty RU bv remains very low even for inaccurate beliefs. As already noticed in Example 4, this program leaves A highly vulnerable of being guessed and a deliberate padding of A in order to confuse the adversary is of little help. Note however that RU bv tends toward one, which is higher than both RU c and RU v , as ω tends toward zero. It means that highly inaccurate beliefs slightly strengthen the security of PROG C5.

We proceed with the probabilistic program PROG C2 (see Example 1). Again IU c = IU v = log |A| = 2 and IU bv = log ω 2(1+ω) . For the remaining uncertainty, we have RU v = 1, RU c = 1 4 3 log 3log (1λ) (1-λ) λ λ and RU bv =log 1 4 + ω ω+1 1 4 + 1 4 max(λ, 1λ) . The information flow ascribed by the consensus definitions is illustrated in Figure 3 and those of the belief-vulnerability approach in Figures 4 and5. We first note that in the case of belief's absence, our approachwhich coincides with the vulnerability one-ascribes the same information flow quantities to both PROG C2 and PROG C1, even though they seem to present rather different threats. 1 The reason is simply that after her low observation, the adversary needs on average 2 1 tries to guess the value of A for both programs. We also note that the randomisation parameter λ of PROG C2 has no effect on the vulnerability approach, and has only a little one on ours when the accuracy of the adversary's beliefs tends to 1 and λ to 1 2 . This is due to the fact that these metrics focus on the single probability that brings greatest risk and values 0 and 2 of A play symmetric roles with respect to λ. Finally, comparing Figures 4 and5 to Figure 1, our approach allows us to assert that the security performance of PROG C1 is better than those of PROG C2, except for highly accurate beliefs. Indeed, the remaining uncertainty of PROG C2 is always less than or equal to 2 whilst those of PROG C1 can be arbitrary high for highly inaccurate beliefs. In fact, we have the following result relating the security performance of these 1 See the discussion on the last paragraph of page 298 of [START_REF] Smith | On the foundations of quantitative information flow[END_REF]. The few elementary examples above illustrate the applicability of our metric to various threats scenarios. In particular, when it is unavoidable for the attacker to initially have access to some (potentially inaccurate) information about the high input, our approach allows to establish the adversary's beliefs accuracy limit that is tolerable given a specific program. For instance, adversary's beliefs which are less than or equal to 50% accurate are tolerable for PROG C1, since they happen to confuse the adversary instead of helping her. Furthermore, given a collection of programs with the same security objective, we can design a more complex program that adapts dynamically to the context of the adversary, when the accuracy of her beliefs changes. For example, proposition 4 tells us that it is more secure to use PROG C1 that PROG C2 in a context where one can assume that the accuracy of the initial information of the adversary is less than two-fifth; on the other hand, the contrary holds for higher accurate beliefs.

VI. C

This paper presents a new approach to quantitative information flow that incorporates the attacker's beliefs in the model on Réneyi min entropy. We investigate the impact of such adversary's extra knowledge on the security of the secret information. Our analyses reveals that inaccurate extra information tend to confuse the adversary by increasing her uncertainty about the hidden secret while accurate information may increase dramatically its vulnerability. We showed the strength of our definitions both in terms of their theoretical properties and their utility by applying them to various threat scenarios and comparing the results to the previous approaches. Our model allows to identify the levels of accuracy for the adversary's

Definition 1 :

 1 V(A) = max a∈A p(a). The conditional vulnerability of a A given O measures the expected probability of guessing A in one try given O. It is denoted V(A | O) and defined as follows.

  A when the real correlation between the high level input and the extra observables is p ρ1 (b | a), p ρ2 (b | a), p ρ3 (b | a), and p ρ4 (b | a) respectively. The correlation p ρ1 (b | a) means that

  More generally, let Beliefs(A, B) denote the set of adversary's beliefs about A according to the extra information B, and let Beliefs ⊥ (A, B) be the set of totally inaccurate beliefs, Beliefs ⊥ (A, B) = p β (a), p β (b | a) ∈ Beliefs(A, B) | ∀b ∈ B, a ∈ Γ b implies p ρ (a | b) = 0 Then the following result holds. Proposition 2: Let A be a random variable and B the adversary's extra information about A. Let (p β (a), p β (b | a)) be the adversary's belief, then p β (a), p β (b | a) ∈ Beliefs ⊥ (A, B) implies H ∞ (A : B) = +∞. Proof: Direct consequence of Proposition 1 and Definition 4.

3 :

 3 β 1 (b | a)) is an upper bound on Beliefs(A, B). Lemma For all p β (a), p β (b | a) in Beliefs(A, B) we have p β (a), p β (b | a) ≪ p β 1 (a), p β 1 (b | a) .

Example 4 :

 4 Consider the following program, with A and B as in Example 3, then O = {0, 1, 2}.

  ⌊ log(A + 1) ⌋; END Both the program and the adversary's assumed correlation are deterministic, it is therefore easy to compute the adversary's belief conditional matrix p β (a | o, b) and the associated possible choices Γ o,b . The result is shown in Table

1 ) 2 ) 3 )

 123 |B| = 1 and the a priori probability of A is publiclyknown. For each adversary's initial belief p ρ (a), p ρ (b | a) in Beliefs(A, B) and for each program p ρ (o | a) we have V(A : B) = V(A) and V(A | O : B) = V(A | O). For each adversary's initial belief p ρ (a), p ρ (b | a) in Beliefs(A, B) and for each program p ρ (o | a) we have

  p

Fig. 1 .Fig. 2 .

 12 Fig. 1. Information flow of PROG C1

Fig. 3 .

 3 Fig. 3. Shannon entropy-based information flow of PROG C2

Fig. 4 .Fig. 5 .

 45 Fig. 4. RU bv of PROG C2