Julio Fernandez-Cestau

Raquel J Rama

Luca Rocchigiani

Benoı ̂t Bertrand

Elena Lalinde

Mikko Linnolahti

Manfred Bochmann

Synthesis and Photophysical Properties of Au(III)-Ag(I) Aggregates

Cyclometalated gold(III) complexes of the type (C∧N∧C)AuX [HC∧N∧CH = 2,6-bis(4-Bu t C6H4)pyrazine; 2,6-bis(4-Bu t C6H4)pyridine, or 2,6-bis(4-Bu t C6H4)4-Bu t pyridine; X = CN, CH(COMe)2, or CH(CN)2] have been used as building blocks for the construction of the first family of Au III /Ag I aggregates. The crystal structures of these aggregates reveal the formation of complex architectures in which the Ag + cations are stabilized by the basic centers present on each of the Au precursors. The photophysical properties of these aggregates are reported. Compared to mononuclear pincer complexes, a general red-shift and an increase in the emission intensity are observed. In agreement with DFT calculations, the lowest energy absorption and the emission are assigned to 1 IL(C∧N∧C) and 3 IL(C∧N∧C) transitions dominated by the HOMO and the LUMO orbitals. Scheme 1. Synthesis of Cyano-Bridged Aggregates, Including the Numbering Used for NMR Assignments

Introduction

The use of gold(III) complexes in optical devices such as sensors or organic light-emitting diodes (OLEDs) has been a rising area of research in recent years. (1) In particular, cyclometalated 2arylpyridine (C∧N) and 2,6-diarylpyridine (C∧N∧C) ligands have been found to be a very effective means of stabilizing Au III against reduction (2) and, at the same time, generate emissive compounds. In this context, the most successful strategy revealed to be the introduction of strong C-based σ-donor ligands, such as alkyl, aryl, alkynyl, or N-heterocyclic carbenes, in combination with the cyclometalated ligands. This causes the d-d nonradiative transitions to rise in energy and produces pincer ligand-based emissive transitions with triplet parentage. (3,4) The modulation of the emission wavelengths is usually achieved by modifying either the pincer or the ancillary ligand with substituents of different electronic characteristics, in order to adjust the orbitals responsible for the emission. However, this approach requires a significant synthetic effort. For this reason, having access to less laborious ways of tuning the emission in this type of complexes continues to be a focus of interest. With this in mind, recent studies have been directed toward postsynthetic modulation of photoemissions through the formation of multinuclear architectures and metallogels with supramolecular aggregation, [START_REF] Fu | Supramolecular Metallogels of Platinum(II) and Gold(III) Complexes[END_REF] as well as the exploitation of alternative emissive pathways, such as thermally activated delayed fluorescence (TADF). [START_REF] Fernandez-Cestau | Synthesis and Luminescence Modulation of Pyrazine-Based Gold(III) Pincer Complexes[END_REF][START_REF] To | Highly Luminescent Pincer Gold(III) Aryl Emitters: Thermally Activated Delayed Fluorescence and Solution-Processed OLEDs[END_REF] In 2015, we reported the synthesis of the first family of C∧N∧C pincer complexes featuring pyrazine instead of pyridine as the central ring. [START_REF] Fernandez-Cestau | Synthesis and Luminescence Modulation of Pyrazine-Based Gold(III) Pincer Complexes[END_REF] This simple change has important consequences from a photophysical point of view: First, the pyrazine-based complexes show increased photoluminescence intensities in comparison with the pyridine analogues, and second, the π-π* gap in pyrazine is around 0.95 eV smaller than in pyridine, so that the pyrazine pincer becomes a better electron acceptor and the presence of strong σ-donating ancillary ligands is no longer mandatory to generate luminescent complexes. This family of complexes provided the first examples of gold(III) complexes showing TADF behavior.

A remarkable case for the difference in photoluminescence (PL) of pyridine vs pyrazine (pz) based C∧N∧C gold pincer complexes are the thiolates, (C∧N pz ∧C)AuSR (R = Ph, naphthyl, 1adamantyl), which are strongly photoemissive at room temperature, unlike their pyridine analogues. The photoluminescence of (C∧N pz ∧C)AuSR was due to 3 IL(C∧N pz ∧C) emissions, which, unusually, turned out to be modulated by aggregation through pyrazine-pyrazine interactions, leading to a strong red-shift from a π-stacked bimolecular emissive state. [START_REF] Currie | Luminescent Gold(III) Thiolates: Supramolecular Interactions Trigger and Control Switchable Photoemissions from Bimolecular Excited States[END_REF] The strategy of triggering new emissive states by the formation of homo-and heteropolymetallic architectures held together by metallophilic interactions has been particularly successful in gold chemistry, but only for gold in the oxidation state + I. (9) Supramolecular aggregates have also been described for Pt II , [START_REF] Aliprandi | Recent Advances in Phosphorescent Pt(II) Complexes Featuring Metallophilic Interactions: Properties and Applications[END_REF] which is isoelectronic with Au III . In contrast, there is little evidence for metallophilic interactions in Au III chemistry. (11) Nevertheless, this is no reason to discard Au III complexes as building blocks for the construction of photoemissive supramolecular assemblies, as other basic functionalities of the molecule could act as binding points for other metals. In fact, we observed earlier that the emission of the pyrazine-based alkynyl complex [(C∧N pz ∧C)AuC≡CPh] is red-shifted on addition of Ag + ions. However, despite numerous attempts neither the precise structure of this Ag I /Au III aggregate nor the origin of the shift in emissions could be elucidated. [START_REF] Fernandez-Cestau | Synthesis and Luminescence Modulation of Pyrazine-Based Gold(III) Pincer Complexes[END_REF] Here, we present the first family of structurally characterized luminescent heteropolynuclear systems involving Au III . The use as building blocks of cyclometalated pyrazine Au III systems with secondary basic residues such as cyanide [(C∧N pz ∧C)AuCN], (6) C-bound acetylacetonate [(C∧N pz ∧C)Au(acac)] (acac = CH(C(O)Me)2), or malononitrile [(C∧N pz ∧C)AuCH(CN)2] (12) in reactions with Ag I salts has allowed the isolation of polymetallic aggregates with a wide range of nuclearities and bonding motifs. The photophysical properties of these aggregates are intimately correlated with the nature of the supramolecular assembly, as has been probed by theoretical calculations. Similar Au III -Ag I systems using pyridine-based analogues have also been prepared for comparison and illustrate the implications for the structures and photoluminescence of these assemblies.

Results and Discussion

Synthesis and X-ray Structures

Slow diffusion of THF solutions of AgSbF6 or AgClO4 into light-yellow dichloromethane solutions of (C∧N pz ∧C)AuCN [ pz Au]CN resulted in the precipitation of the 2:1 adducts [{(C∧N pz ∧C)AuCN}2Ag]X (X = SbF6, 1SbF6; ClO4, 1ClO4) as orange solids (Scheme 1). Due to their low solubility in common organic solvents, the compounds were prepared as orange crystals by direct synthesis in H-shaped crystallization tubes (see Figure 1 and SI for experimental details). While the crystal quality of [{(C∧N pz ∧C)AuCN}2Ag](SbF6) (1SbF6) was insufficient for a detailed discussion of the structural parameters, the connectivity could be unequivocally established and confirmed the identity of the complex as a trinuclear species in which two gold fragments are connected by a CN-Ag-NC bridge. The crystal packing shows numerous intermolecular interactions of each trinuclar entity with its neighbors through a combination of Ag•••C6H4 t Bu-4 and π•••π stacking, which may explain the low solubility of these systems. The coordination of the Ag I ions to the cyanide ligands is reflected in the shift of the IR ν(C≡N) stretching band to higher frequencies with respect to the starting material (from 2173 cm -1 in [ pz Au]CN to 2220 cm -1 in 1ClO4 and 2225 in 1SbF6). [START_REF] Kettle | The Vibrational Spectra of the Cyanide Ligand Revisited. Bridging Cyanides[END_REF] The analogous pyridine complexes [{(C∧N tBu ∧C)AuCN}2Ag]X (X = SbF6, 2SbF6; ClO4, 2ClO4) are accessible by treatment of (C∧N tBu ∧C)AuCN ([ tBu-py Au]CN) with the corresponding silver salts in THF. The X-ray structure of 2SbF6 (Figures 2a andS2.1) reveals that the trinuclear cationic units [{(C∧N tBu ∧C)AuCN}2Ag] + dimerize through the formation of unsupported argentophilic interactions, with a silver-silver distance of 3.103(1) Å, much shorter than the sum of the van der Waals radii of two silver atoms (3.44 Å). ( 14) However, it has been recently established that the concept of "unsupported" interactions might underestimate the impact that other aggregation forces, such as hydrogen bonding or π-π stacking, can have on codetermining the Ag-Ag distance, and that the correlation between shorter distance and stronger bond can be misleading given the particular character of argentophilicity. [START_REF] Schmidbaur | Argentophilic Interactions[END_REF] The CN-Ag-NC moieties in [{(C∧N tBu ∧C)AuCN}2Ag]2 2+ deviate from the expected linearity, with N-Ag-N angles of 160.2(3) and 165.7(3)° to accommodate the Ag-Ag interaction. This distortion from linearity is particularly pronounced when compared, for example, with that observed in the argentophilic-based columnar arrangement of [Ag(py)2] + cations (average N-Ag-N angle 175°). ( 16) (b). The structures are shown as a stick based skeleton with only the most relevant atoms represented as ellipsoids with 50% probability level.

Figure 2. Top views of the X-ray structures of [{(C∧N tBu ∧C)AuCN}2Ag]2[SbF6]2•3CH2Cl2, 2SbF6•3CH2Cl2 (a), and [{(C∧N tBu ∧C)AuCN}2Ag]2[ClO4]2•3CH2Cl2, 2ClO4•3CH2Cl2
In the SbF6 -salt, the anions play a spectator role in the stabilization of the structure; one of the anions interacts weakly with one of the Ag centers, while the other silver ion interacts with a CH2Cl2 molecule. By contrast, the anions in [{(C∧N tBu ∧C)AuCN}2Ag(ClO4)]2•3CH2Cl2 (2ClO4•3CH2Cl2) are bound more strongly to the Ag + centers, as indicated by the short Ag-O distance (2.584(4) Å), giving a T-shaped coordination environment for Ag, with additional contacts to dichloromethane molecules. As a consequence of the perchlorate coordination to Ag + , argentophilic interactions are absent, and the Ag-Ag distance is elongated to 3.3881( 5) Å. The top-view of both structures (Figure 2) illustrates the distortion of the trinuclear entities to accommodate the Ag-Ag interaction.

Treatment of CH2Cl2 solutions of (C∧N pz ∧C)Au(acac) ([ pz Au]acac) with an excess of AgX (X = ClO4, SbF6) produced a noticeable change in color from light yellow to deep orange. Orange microcrystalline solids with a Au/Ag ratio of 1:1 were isolated from these solutions (Scheme 2).

Scheme 2. Synthesis of acac Aggregates

Slow diffusion of pentane into CH2Cl2 solutions afforded crystals suitable for X-ray diffraction analysis. As is shown in Figure 3 The Ag1-Au distances (Ag1-Au1 3.004(1) Å and Ag1-Au2 2.993(1) Å for 3SbF6; Ag1-Au1 2.9419( 7) Å, Ag1-Au2 3.0737( 6) Å for 3ClO4) are shorter than the sum of the van der Waals radii of both atoms (r Ag 1.72 + r Au 1.66 = 3.38 Å). The asymmetry of the Ag•••C═C interaction and the close approach of Ag + toward the carbon directly bound to Au indicate that these interactions are predominantly controlled by Coulomb attractions.

The bonding of Ag2 to the two N atoms of the pyrazine rings (Ag2-N2 2.19(1) Å and Ag2-N4′ 2. [START_REF] Chen | Argentophilic Interactions and Anionic Control of Supramolecular Structures in Simple Silver Pyridine Complexes[END_REF](2) Å 3SbF6; Ag2-N2 2.244( 6) Å and Ag2-N4′ 2.241(5) Å 3ClO4) is substantially longer than Ag + bonding to cyanide in 2ClO4 and 2SbF6 (see before Ag-N ∼ 2.10 Å). In the case of 3ClO4, the two silver ions Ag2 and Ag2′ are further held together by two asymmetrically bridging perchlorate ions, with Ag2-O distances of 2.52(1) and 2.657(9). Two further perchlorate ions are κ 1 -bonded (Ag2-O5, 2.584(6) Å).

However, the coordination environment of the Ag2 ions is strongly influenced by the nature of the anion. Thus, for 3SbF6, the lower coordinating character of the SbF6 -drives to shorter Ag-N distances with the pyrazines (Ag2-N2, 2.18(1) Å and Ag2-N4′, 2. [START_REF] Chen | Argentophilic Interactions and Anionic Control of Supramolecular Structures in Simple Silver Pyridine Complexes[END_REF](2) Å). Nevertheless, the general arrangement of the interaction with the anions is maintained through Ag•••F interactions.

The analogous pyridine precursor (C∧N py ∧C)Au(acac) ([ py Au]acac) reacts with an excess of AgSbF6 in CH2Cl2 with a noticeable change of color from light to deep yellow. Slow diffusion of pentane generated crystals suitable for X-ray diffraction analysis. As it is shown in Figure 4, the absence of a basic nitrogen atom in the pincer precludes the formation of Ag-N bonds, and the stoichiometry of the complex is Au/Ag = 2:1, with the silver cation sandwiched between two [Au] fragments, in a manner similar to that of Ag1 in the pyrazine structures. The most noticeable difference is that the Ag bonding to the C═C π-bonds to aryl rings of the cyclometalated ligands is less asymmetric (Ag1-C7 2.453( 8), Ag1-C37 2.432( 8) Å; Ag1-C8 2.558( 8), Ag1-C38 2.591(8) Å). 9), Au1-C7 2.092( 8), Au1-C17 2.078(9), Au1-N1 2.017( 7), Au2-C56 2.071( 8), Au2-C37 2.114( 8), Au2-C47 2.060( 8), Au2-N2 2.024( 6), Ag1-O1 2.430( 7), Ag1-O3 2.409( 6), Ag1-C7 2.453( 8), Ag1-C8 2.558( 8), Ag1-C37 2.432( 8), Ag1-C38 2.591( 8 A CH2Cl2 solution of (C∧N pz ∧C)Au(malononitrile) ([ pz Au]mln) reacted with AgSbF6, generating a light orange solid of composition {[{(C∧N pz ∧C)Au(malononitrile)}2Ag(THF)](SbF6)}n, 5SbF6 (Scheme 3). This compound shows low solubility in CH2Cl2 but can be dissolved in THF. Slow pentane diffusion led to orange crystals suitable for X-ray crystallography.

Scheme 3. Synthesis of Malononitrile Aggregates

The asymmetric unit shows one gold malononitrile fragment (C∧N pz ∧C)Au(malononitrile) and one silver cation with occupancy 1/2 as it lies on a 2-fold rotational axis (Figure 5). Each Ag + ion binds to four different (C∧N pz ∧C)Au(malononitrile) molecules, as well as to one THF ligand. Two of the (C∧N pz ∧C)Au(malononitrile) building blocks are bound by one malononitrile CN unit, with rather short Ag-N bonds (Ag1-N4″, 2.212(5) Å); the other two are bonded via their pyrazine-N atoms, with longer Ag-N interactions (Ag1-N2, 2.476(5) Å). This generates a distorted square-pyramidal AgN4O linking unit, which connects the assembly to give 1D rods in the direction of the crystallographic c axis, with the SbF6 -anions in the interstitial spaces between the rods. 6), Au1-C10 2.087( 6), Au1-C20 2.102( 6), Au1-N1 2.015( 5), Ag2-N2 2.476( 5), Ag1-N4″ 2.212( 5), Ag1-O1 2.644, C10-Au1-N1 80.6(2), C20-Au1-N1 79.6(2), C10-Au1-C25 94.2(2), C20-Au1-C25 105.7(2), N1-Au1-C25 174.4(2), C10-Au1-C20 160.0(2), N2-Ag1-N4″ 92.3, N2-Ag1-O1 84.0, N4″-Ag1-O1 99.6, N2-Ag1-N2′ 167.9, N4″-Ag1-N4‴ 160.7.

NMR Characterization in Solution

In order to understand whether such aggregations persist in solution, we studied the behavior of these complexes by means of NMR spectroscopy. The pyrazine cyanide silver complexes show very low solubility in common organic solvents, so they could not be investigated. In contrast, the analogous complexes with p-tBu pyridine as the central ring of the pincer [{(C∧N tBu ∧C)AuCN}2Ag]X (X = SbF6, 2SbF6; ClO4, 2ClO4) are soluble enough to be fully characterized by NMR spectroscopy. Their 1 H NMR spectra in CD2Cl2 show a shift of the signals with respect to the mononuclear gold precursor. For example, the doublet corresponding to H 8 , which is a convenient reporter signal in this type of complexes, is appreciably lowfrequency shifted when compared with the starting precursor (Δδ 0.09, 2SbF6 and 0.07 ppm, 2ClO4). Quite reasonably, this indicates that the trinuclear fragment persists in solution.

There is not much effect of the anion on the chemical shift, suggesting that even more coordinating anions such as ClO4 -are not capable of dissociating the [Au2Ag] unit. Unfortunately, we were unable to observe a signal for the cyanide moiety in the 13 C{ 1 H} NMR spectra. For this reason, we decided to synthesize the 13 C≡N analogues (see SI), which confirm that the 13 C NMR cyanide signals for both complexes are high-frequency shifted with respect to the mononuclear precursors: (C∧N tBu ∧C)Au 13 CN resonates at δC = 115.9 ppm, while both aggregates [{(C∧N tBu ∧C)AuCN}2Ag]X (X = SbF6, 2SbF6; ClO4, 2ClO4) show signals at δC = 124.3 ppm. ( 18)

The 1 H NMR spectra of the acac derivatives [{{(C∧N pz ∧C)Au(acac)2}2Ag}{Ag2X4}]2 (X= SbF63SbF6, ClO43ClO4) show very broad signals in CD2Cl2 at room temperature, and they are superimposable with each other, with the exception of H 2 . The latter is high-frequency shifted for 3ClO4 (δH = 9.62 ppm) by comparison with 3SbF6 (δH = 9.09 ppm), likely reflecting a different type of interaction between silver, anion, and pyrazine ring, as was also observed at the solid state. Sharp and well resolved spectra are obtained upon cooling the samples at temperatures below -20 °C. The 1 H NMR spectra obtained at low temperature show the presence of two sets of signals for the pincer ligand, together with two different methyl signals for the acac moiety. Interestingly, only one signal for the CH moiety of the acac ligand was observed, excluding the possibility that the dynamic process is related to a multiple species equilibrium. More likely, the temperature dependence seen in the spectra is related to the hindered rotation of the acac fragment about the Au-C bond, which is slowed by the interaction between one carbonyl and a silver cation (see Figure 6). This is further confirmed by the large difference in the 13 C NMR shifts between the two carbonyl groups of the acac fragment (δC = 203.4 and 212.9 ppm). It is reasonable to assume that this interaction induces an oscillating slippage of the pyrazine pincers within the aggregate, which is fast enough to equalize the chemical shift of the complex at room temperature. When the slippage is slowed on cooling, the two sides of the pincer become magnetically inequivalent, and two sets of signals are observed. The degree of association in a solution of 3SbF6 and 3ClO4 was investigated by means of diffusion NMR spectroscopy. [START_REF] Rocchigiani | Disclosing the Multi-Faceted World of Weakly Interacting Inorganic Systems by Means of NMR Spectroscopy[END_REF] In particular, 1 H PGSE NMR experiments on 3SbF6 and 3ClO4 have been performed as a function of the concentration in CD2Cl2, and the data were interpolated by assuming the shape of the complexes as that of a prolate ellipsoid, using crystallographic data as a tool for volume calculations (see Supporting Information for details). We also included the monomeric precursor (C∧N pz ∧C)Au(acac) in order to have a direct comparison.

The monomeric precursor has no self-aggregation tendency over a 1-25 mM concentration range, as the measured P parameter (which is directly proportional to the hydrodynamic radius) does not change with concentration and matches the one calculated for the monomer (Figure 7). This is in contrast with our previous observations on pyrazine-based gold thiolate complexes, where a modest self-aggregation due to π-π stacking interactions was observed at concentrations higher than 10.0 mM. [START_REF] Currie | Luminescent Gold(III) Thiolates: Supramolecular Interactions Trigger and Control Switchable Photoemissions from Bimolecular Excited States[END_REF] In this case, it seems likely that the acetylacetonate moiety disrupts this weak interaction network, making stacking in solution more difficult. On the other hand, P values measured for both 3ClO4 and 3SbF6 are comparably larger. For instance, at c = 6.0 mM the P value for 3SbF6 is twice that of the monomeric (C∧N pz ∧C)Au(acac) complex and matches the one calculated from the crystal structure for the intact tetramer. This indicates that the aggregate structure of [{{(C∧N pz ∧C)Au(acac)}2Ag}{Ag2(SbF6)4}]2 is retained in solution. Interestingly, P values are independent of the concentration, even below 1.0 mM, meaning that the complexes do not dissociate on dilution. The behavior of 3ClO4 matches that of 3SbF6 within the experimental error, suggesting that there is no anion effect on the aggregation tendency of these species. Photophysical Properties Since we discovered that poly(methyl methacrylate) (PMMA) and polyvinylcarbazole (PVK) are capable of breaking some of these aggregates, regenerating the starting materials, the photoluminescence was probed in polystyrene (PS), in which the colors of the aggregates and the emissions are closely similar to the solids but show increased intensities. For comparison, the photophysical properties of the corresponding gold precursor complexes were also measured in polystyrene. A summary of the emissions λem, the lifetimes τ, and photoluminescent quantum yields ϕ is given in Table 1. For the complexes with adequate solubility, the UV-vis absorption and photoluminescence spectra have also been recorded in solution (see SI, Tables S3.1 and S3.2).

a Weak emission.

b One additional component of about 20-60 ns is found but with a very low contribution (∼5%).

As mentioned before, the cyanide pyrazine complexes 1SbF6 and 1ClO4 are poorly soluble in dichloromethane. For this reason, the usual experimental methodology of mixing a CH2Cl2 solution of the complex with a CH2Cl2 solution of the polymer to prepare the doped film was unsuccessful and produced very poor dispersions. We therefore used the alternative strategy of mixing (C∧N pz ∧C)AuCN with the PS in CH2Cl2 and adding the silver salt to this solution while sonicating. This generates clear films suitable for accurate measurements.

As can be seen in Figure 8, there is a red-shift of the emission maxima of the cyanide silver complexes relative to the precursor (601 nm, 1SbF6; 610 nm, 1ClO4, 542 nm, [ pz Au]CN).

Despite the low solubility, the excitation band of the PS films is well resolved. The vibrational progression of the C∧N∧C pincer ligands is retained in both aggregates. This is indicative of the participation of the C∧N∧C in the orbitals that control these transitions, as is also confirmed by theoretical calculations (see below). In contrast to this, the photoluminescence of the p-tBu pyridine cyanide series seems much less sensitive to the formation of the silver aggregates. Thus, as can be seen in Figure S3.1, the complexes [{(C∧N tBu ∧C)AuCN}2Ag]X (478 nm, X = SbF6, 2SbF6; 486 nm, ClO4, 2ClO4) and (C∧N tBu ∧C)AuCN (481 nm) exhibit very similar emission profiles in the blue/green region.

As mentioned before, the reaction with silver in CH2Cl2 solution is accompanied by a color change from the light-yellow of (C∧N pz ∧C)Au(acac) to the deep orange of both aggregates. This is reflected in the red-shifts of the lowest energy absorption bands that, in any case, retain the vibrational spacing indicative of the 1 IL(C∧N pz ∧C) parentage.

Following the same trend, the acac aggregates 3 show intense orange-yellow emissions clearly red-shifted with respect to the precursor in PS (582 nm 3SbF6, 560 nm 3ClO4 vs. 525 nm [ pz Au]acac) and in CH2Cl2 solution at room temperature (569 nm 3SbF6, 559 nm 3ClO4 vs. 522 nm [ pz Au]acac; Figure 9). As for the absorptions, the vibrational spacing of the C∧N∧C ligand indicates the participation of the pincer in the orbitals responsible for the emission. This fact, and the lifetimes in the 1-2 μs range, are indicative of a 3 IL(C∧N pz ∧C) ligand-based triplet origin perturbed by the formation of the polynuclear aggregate for the emissions. In CH2Cl2 at 77 K, the energy sequence of the emission is retained (541 nm [ pz Au]acac > 544 nm 3ClO4 > 558 nm 3SbF6). Interestingly, while the emission of [ pz Au]acac at 77 K is red-shifted with respect to the emission at 298 K, both aggregates show a clear blue-shift of the emission at low temperatures. The rigidochromism found for the aggregates is consistent with the participation of the Ag ions in the frontier orbitals and a mixed 3 CT excited state. ( 20) This is also confirmed by theoretical calculations (see below).

While the pyridine acac precursor (C∧N py ∧C)Au(acac) ([ py Au]acac) shows only weak photoluminescence at 298 K both in CH2Cl2 and PS, complex [{(C∧N py ∧C)Au(acac)2}2Ag}](SbF6) (4SbF6) exhibits intense emissions at room temperature (λmax = 498 nm, ϕ = 2.2% in PS; λmax = 442 nm in CH2Cl2). As can be seen in Figure 10, in CH2Cl2 at 77 K, complex 4SbF6 and its precursor show similar 3 IL(C∧N∧C) structured emission profiles. Both the emission maxima and the low energy absorption bands appear slightly red-shifted in 4SbF6 with respect to [ py Au]acac. SbF6)}n (5SbF6) shows an intense deep-orange emission in PS (566 nm). The red shift with respect to the precursor (C∧N pz ∧C)Au(malononitrile) ([ pz Au]mln; 528 nm; see Figure S3.2) is presumably due to perturbed 3 IL(C∧N pz ∧C) transitions. As can be seen in Figure S3.2, both complexes 5SbF6 and 5ClO4 show similar emission. The lack of influence of the anion in the photophysical properties is in accordance with the structure of 5SbF6 described before.

Theoretical Calculations

To provide a better insight into the nature of the photophysical properties of these aggregates, and in particular to explore the effect that the interaction with the silver centers has on the frontier orbitals of the molecules, we have performed density functional (DFT) and timedependent density functional theory (TD-DFT) calculations. Details of the calculations can be found in the SI. For comparison and consistency, we also carried out calculations on the mononuclear precursors with the same method.

It is well established that both the lowest energy absorptions and the emissions in (C∧N∧C)AuX complexes are dominated by the cyclometalated ligand as the frontier orbitals are located in this chromophore, with little or no contribution from the X ligands. (1,3,6) However, it is also well-known that while the frontier orbitals are located on the C∧N∧C pincer, the energy of the 1 IL(C∧N∧C) and 3 IL(C∧N∧C) transitions are indirectly affected by subtle changes in the electronics of the global system. [START_REF] Fernandez-Cestau | Synthesis and Luminescence Modulation of Pyrazine-Based Gold(III) Pincer Complexes[END_REF][START_REF] Currie | Luminescent Gold(III) Thiolates: Supramolecular Interactions Trigger and Control Switchable Photoemissions from Bimolecular Excited States[END_REF][START_REF] Fernandez-Cestau | Synthesis, Structures, and Properties of Luminescent (C∧N∧C)gold-(III) Alkyl Complexes: Correlation between Photoemission Energies and C-H Acidity[END_REF] As can be seen in Figure 11, for the fragment [{(C∧N pz ∧C)AuCN}2Ag] + (1 + ), both HOMO and LUMO are mainly located on the (C∧N pz ∧C) ligand, with Au participation in the LUMO. These orbitals mimic the frontier orbitals of the precursor [ pz Au]CN. While very similar in shape to [ pz Au]CN, the orbitals of 1 + show a smaller HOMO-LUMO gap and smaller vertical S0 → S1 excitation energy (see SI). This is a general trend for all the aggregates: In all cases, the frontier orbitals are mainly C∧N∧C/Au based orbitals (see SI), and the calculations predict a red shift of the lowest energy absorptions and the emissions. These results are consistent with the assignment of the absorption and the emission, respectively, as 1 IL(C∧N∧C) and 3 IL(C∧N∧C) transitions are perturbed by the formation of the aggregate. The calculations also show an increase of the oscillator strength of the vertical S0 → S1 transition as a consequence of the formation of the aggregate. This is consistent with the rigidity of the aggregates compared with the precursors and explains the increased emission quantum yields of the Au/Ag systems compared with the mononuclear precursors.

In the acac series, the cyclometalated ligand also plays a predominant role in the composition of the frontier orbitals. However, there is a clear influence of the Ag centers in some of the orbitals responsible for the photophysical properties. In Figure 12, we include the frontier orbitals of 3ClO4 as an illustrative example. The HOMO orbital is centered on the {Ag2(ClO4)4} core, while LUMO is centered on the pincer with strong pyrazine character. The predominance of the pincer in the lowest empty orbitals is a general feature of the series. However, in some cases we observe orbitals that are delocalized between two (C∧N pz ∧C)Au moieties through the Ag Td centers. The results are consistent with the photophysical properties discussed before, but the complexity of the systems precludes the determination of the role of the silver ions with more detail.

Conclusions

In summary, we have prepared a series of Au III /Ag I aggregates by employing cyclometalated (C∧N∧C)AuX complexes as building blocks linked by silver ions. The X ligands used (cyanide, acac, malononitrile) act as donors that stabilize the aggregates. In some cases, the free nitrogen of the pyrazine-based Au III precursors induces the formation of high nuclearity structures. Even anions like SbF6 -or ClO4 -, which are typically considered to be weakly coordinating, participate in the stabilization of the multimetallic centers by bridging interactions. The aggregate structures persist in CH2Cl2 solutions. These Au III /Ag clusters show intense photoluminescence in polystyrene and in solution, with emissions dominated by 1 IL(C∧N∧C) and 3 IL(C∧N∧C) transitions perturbed by the aggregation, which show strongly enhanced intensities and are red-shifted with respect to the nonaggregated starting materials. Increased oscillator strength of the vertical S0 → S1 transition and reduced nonradiative processes are traced to the rigidity of these structures. These results demonstrate a synthetically facile strategy for the generation of compounds with enhanced and easily modulated emissions.

Figure 1 .

 1 Figure 1. Crystallization setup for the direct synthesis of 1SbF6 and 1ClO4.

  , both structures show an octanuclear [Au4Ag4] arrangement in which the silver ions adopt two types of coordination environments that are noticeably different from each other: One Ag ion, labeled Ag1, is sandwiched by two[Au] fragments and bound to one acac-O atom of each [Au] fragment. In addition, Ag1 forms a π-bond with one aryl ring of the cyclometalated ligand of each of the [Au] fragments, in a manner similar to that of other Ag-π-arene complexes, (17) which leads to a distorted tetrahedral coordination environment for Ag1. The second silver ion, Ag2, is coordinated to nitrogen atoms of the pyrazine rings of two trinuclear units. Detailed views for both structures can be found in FiguresS2.3 and S2.4.

Figure 3 .

 3 Figure 3. Molecular view of the X-ray structure of (a) 3SbF6•6C7H8 and (b) 3ClO4•1.5CH2Cl2•2C5H12. The solvent molecules and hydrogen atoms are omitted for clarity. The structures are shown as a stick based skeleton with only the most relevant atoms represented as ellipsoids with 50% probability level.

  Figure 4. Molecular view of the complex [{(C∧N py ∧C)Au(acac)}2Ag}](SbF6)•CH2Cl2, 4SbF6•CH2Cl2. The solvent molecule and the hydrogen atoms are omitted for clarity. The structure is shown as a stick based skeleton with only the most relevant atoms represented as ellipsoids with 50% probability level. Selected bond distances (Å) and angles (deg): Au1-C26 2.057(9), Au1-C7 2.092(8), Au1-C17 2.078(9), Au1-N1 2.017(7), Au2-C56 2.071(8), Au2-C37 2.114(8), Au2-C47 2.060(8), Au2-N2 2.024(6), Ag1-O1 2.430(7), Ag1-O3 2.409(6), Ag1-C7 2.453(8), Ag1-C8 2.558(8), Ag1-C37 2.432(8), Ag1-C38 2.591(8), C7-Au1-C26 103.0(3), C17-Au1-C26 95.6(3), C7-Au1-N1 80.8(3), C17-Au1-N1 81.0(3), C26-Au1-N1 172.7(3), C7-Au1-C17 161.2(3), C37-Au2-N2 80.5(3), C47-Au2-N2 81.3(3), C37-Au2-C56 102.7(3), C47-Au2-C56 95.5(3), C37-Au2-C47 161.8(3), C56-Au2-N2 172.1(3), O1-Ag1-O3 75.1(2), O1-Ag1-centroid(C37-C38) 113.50, O3-Ag1-centroid(C7-C8) 120.57, centroid(C7-C8)-Ag1-centroid(C37-C38) 136.80.

  Figure 4. Molecular view of the complex [{(C∧N py ∧C)Au(acac)}2Ag}](SbF6)•CH2Cl2, 4SbF6•CH2Cl2. The solvent molecule and the hydrogen atoms are omitted for clarity. The structure is shown as a stick based skeleton with only the most relevant atoms represented as ellipsoids with 50% probability level. Selected bond distances (Å) and angles (deg): Au1-C26 2.057(9), Au1-C7 2.092(8), Au1-C17 2.078(9), Au1-N1 2.017(7), Au2-C56 2.071(8), Au2-C37 2.114(8), Au2-C47 2.060(8), Au2-N2 2.024(6), Ag1-O1 2.430(7), Ag1-O3 2.409(6), Ag1-C7 2.453(8), Ag1-C8 2.558(8), Ag1-C37 2.432(8), Ag1-C38 2.591(8), C7-Au1-C26 103.0(3), C17-Au1-C26 95.6(3), C7-Au1-N1 80.8(3), C17-Au1-N1 81.0(3), C26-Au1-N1 172.7(3), C7-Au1-C17 161.2(3), C37-Au2-N2 80.5(3), C47-Au2-N2 81.3(3), C37-Au2-C56 102.7(3), C47-Au2-C56 95.5(3), C37-Au2-C47 161.8(3), C56-Au2-N2 172.1(3), O1-Ag1-O3 75.1(2), O1-Ag1-centroid(C37-C38) 113.50, O3-Ag1-centroid(C7-C8) 120.57, centroid(C7-C8)-Ag1-centroid(C37-C38) 136.80.

  Figure 5. Molecular view of the complex {[{(C∧N pz ∧C)Au(malononitrile)}2Ag(THF)](SbF6)}n (5SbF6). Hydrogen atoms are omitted for clarity. The structure is shown as a stick based skeleton with only the most relevant atoms represented as ellipsoids with 50% probability level. Selected bond distances (Å) and angles (deg): Au1-C25 2.088(6), Au1-C10 2.087(6), Au1-C20 2.102(6), Au1-N1 2.015(5), Ag2-N2 2.476(5), Ag1-N4″ 2.212(5), Ag1-O1 2.644, C10-Au1-N1 80.6(2), C20-Au1-N1 79.6(2), C10-

  Figure 6. VT 1 H NMR spectra of 3SbF6 and oscillating slippage in [{{(C∧N pz ∧C)Au(acac)2}2Ag}{Ag2X4}]2 core.

Figure 7 .

 7 Figure 7. 1 H PGSE NMR experiments on 3SbF6, 3ClO4, and [ pz Au]acac.

Figure 8 .

 8 Figure 8. Excitation and emission bands of complexes 1SbF6 (green lines), 1ClO4 (red lines), and (C∧N pz ∧C)AuCN (black lines) in PS (polystyrene) at a loading of 10 wt %. The inset shows pictures of the PS films used for the measurements under UV light (365 nm).

Figure 9 .

 9 Figure 9. (a) Low energy UV-vis absorption spectra and (b) emission spectra in CH2Cl2 (10 -4 M) at 298 K (solid lines) and at 77 K (dotted lines) of complexes [ pz Au]acac (black), 3SbF6 (green), and 3ClO4 (red).

Figure 10 .

 10 Figure 10. Low energy UV-vis absorption spectra (a) and emission spectra in CH2Cl2 (10 -4 M) at 298 K (b, solid lines) and at 77 K (b, dotted lines) of complexes [ py Au]acac (black) and 4SbF6 (blue). The malononitrile coordination polymer {[{(C∧N pz ∧C)Au(malononitrile)2}2Ag(THF)](SbF6)}n (5SbF6) shows an intense deep-orange emission in PS (566 nm). The red shift with respect to the precursor (C∧N pz ∧C)Au(malononitrile) ([ pz Au]mln; 528 nm; see FigureS3.2) is presumably due to perturbed 3 IL(C∧N pz ∧C) transitions. As can be seen in FigureS3.2, both complexes 5SbF6 and 5ClO4 show similar emission. The lack of influence of the anion in the photophysical properties is in accordance with the structure of 5SbF6 described before.

Figure 11 .

 11 Figure 11. HOMO and LUMO frontier orbitals for [ pz Au]CN and 1 + . Isovalue = 0.02 (electrons/bohr 3 ) 1/2 .

Figure 12 .

 12 Figure 12. HOMO and LUMO frontier orbitals for 3ClO4. Isovalue = 0.02 (electrons/bohr 3 ) 1/2 .

Table 1 .

 1 Photoluminescent Properties of the Au-Ag Complexes in PS (10%)

	complex	λem/nm (λex/nm)	τ ± sd/ns (contr./%) [λem/nm]	ϕ/%
				(λex/nm)
	[ pz Au]CN 542max, 570sh (361, 392sh, 430, 457, 484)	1702 ± 38 (75), 350 ± 20	4.6 (420)
			(22)b [542]
	1SbF6	567, 601max, 642sh (366, 429, 453, 488,	1292 ± 20 (70), 216 ± 9	7.2 (480)
		528)	(22)b [601]

Acknowledgments

This work was supported by the European Research Council and by the Ministerio de Economía y Competitividad (MINECO, project CTQ2016-78463-P). M.B. is an ERC Advanced Investigator Award holder (grant no. 338944-GOCAT). R.J.R. acknowledges the VI PPIT-US for a research fellowship. The computations were made possible by use of the Finnish Grid and Cloud Infrastructurea resources (urn:nbn:fi:research-infras-2016072533).

Author Information

Corresponding Authors

Notes

The authors declare no competing financial interest.


M Gaide

D Marcheix

A Arnould

X Skapin

H Belhaouari

S Jean

Model reevaluation based on graph transformation rules

We extend the scope of naming problem studies to encompass rule-based graph transformation modeling systems. We propose a new persistent naming method that capitalizes on the formalized operations of generalized maps and graph transformation rules. It enables a unique and homogeneous characterisation of entities across all dimensions.

Face extrusion rule

<0, 1, 3> n 0 <1, 2, 3> pos n 2 <0, _, 3> n 0 <_, 2, 3> n 1 α1 α0
Face triangulation rule

Persistent naming scheme

Taking advantage of Jerboa graph transformation rules on generalized map's formalism:

• Using darts to represent orbits (cells)

• Persistent name: history of a darts' creation

Persistent name P N 3 = [1 n 3 ; 2 n 4 ; 3 n 0 ]
• Rule 1-create's node n 3 creates dart 3

• Rule 2-extrude matches dart 3 and node n 4 creates its copy: dart 35

•

  (pos); 2-extrude(P N 1 , vec); 3-triangulate(P N 2 ); 4-color(P N 3 ) (pos); ADD-insert(3); 2-extrude(P N 1 , vec); 3-triangulate(P N 2 ); 4-color(P N 3 )

•

  Rule 3-triangulate's node n 0 matches dart 35 Evaluation DAG of PN 3 based persistent naming scheme -Unique identification of topological parameters through their histories • Add, Delete, Move operations to edit a model. • Method: -Record darts histories -Rebuild orbit histories (evaluation DAG) -Build new orbit histories (reevaluation DAG) using strategies Demo


Tristan Allard
email: tristan.allard@irisa.fr

Louis Béziaud
email: louis.beziaud@irisa.fr

Sébastien Gambs
email: gambs.sebastien@uqam.ca

SNAKE challenge: Sanitization Algorithms under Attack

Keywords: Security and privacy → Privacy protections, Data anonymization and sanitization, • Software and its engineering → Software libraries and repositories Challenge, anonymization, sanitization, attack, membership inference attack, synthetic data generation, differential privacy

ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

INTRODUCTION

Competitions and challenges are commonly used both in the machine learning community -for boosting the design and development of practical and efficient solutions to hard or new problems -and in the security community -for training purposes or for the evaluation of existing infrastructures. In contrast, in the privacy community, there is not a long tradition of holding such challenges. However, in recent years several competitions focusing on data sanitization algorithms (also called data anonymization algorithms or privacy-preserving data publishing algorithms) have been launched [START_REF] Boutet | DARC : Data Anonymization and Re-identification Challenge[END_REF][START_REF] Jordon | Hide-and-Seek Privacy Challenge: Synthetic Data Generation vs. Patient Re-identification[END_REF][START_REF]MICO: Membership Inference Competition[END_REF][START_REF] Murakami | Designing a Location Trace Anonymization Contest[END_REF][START_REF] Ridgeway | Challenge design and lessons learned from the 2018 differential privacy challenges[END_REF]. Some of them, like the 2018 Differential Privacy NIST Challenge [START_REF] Ridgeway | Challenge design and lessons learned from the 2018 differential privacy challenges[END_REF], have focused primarily on the defense aspect. Their main requirements were that the proposed algorithms have to meet formal guarantees such as differential privacy [START_REF] Dwork | The Algorithmic Foundations of Differential Privacy[END_REF], achieve high utility levels on real-life cases while being efficient enough to be run on today's off-the-shelf computer systems. Others, like the Hide-and-Seek challenge [START_REF] Jordon | Hide-and-Seek Privacy Challenge: Synthetic Data Generation vs. Patient Re-identification[END_REF], the INSAnonym competition [START_REF] Boutet | DARC : Data Anonymization and Re-identification Challenge[END_REF] or PWSCUP [START_REF] Murakami | Designing a Location Trace Anonymization Contest[END_REF] additionally consider attacks on the sanitized datasets generated by the participants. More precisely, these competitions were generally composed of two phases, in which the first one is dedicated to the design of sanitization algorithms (usually focus on a data type and use case) while the second one usually consists in attacking the data sanitized with the algorithms developed during the first phase.

While the sanitization phases of past challenges have been successful, in the sense that they provided insights on the privacy/utility trade-offs or that it has lead to implementations of state-ofthe-art or novel sanitization algorithms, the outcomes of the attack phases were usually more mitigated. For example, the organizers of the Hide-and-Seek challenge have reported attack results equivalent to random guesses [START_REF] Jordon | Hide-and-Seek Privacy Challenge: Synthetic Data Generation vs. Patient Re-identification[END_REF]. The recent Microsoft Membership Inference Competition (MICO) [START_REF]MICO: Membership Inference Competition[END_REF] consisted only in an attack phase and is therefore an exception to this observation.

We believe that facilitating the organization of attack challenges over sanitization algorithms can greatly benefit the research community -essentially the privacy-preserving database and privacypreserving machine learning fields -by stimulating research, contributing to strengthening the implementation of sanitization algorithms as well as by generating open source implementations of state-of-the-art attacks. This is precisely the overarching goal of the Snake framework. Snake allows managing and easy automation of the redundant tasks that are inherent to any such challenge (e.g., preparing datasets or running the sanitization algorithms).

More precisely, Snake exhibits the following salient features. First, Snake is generic in the sense that it is agnostic with respect to the sanitization mechanisms under attack (e.g., aggregated data, 𝑙-diverse partitioning algorithms or differentially private synthetic data generation), supports the specification of a wide range of parameters (e.g., privacy levels and hyperparameters) and allows participants to compete in various adversarial settings (e.g., background knowledge and success metrics). Second, Snake is easy to use both for participants and for organizers thanks to the Snakemake software [START_REF] Köster | Snakemake -a scalable bioinformatics workflow engine[END_REF]. This facilitates both the organization of challenges (for the organizers) and the creation of tasks for local tests during challenges (for the participants). Third, Snake is extensible as it can support various challenge designs (e.g., tracks, timelines, enabling code submission or not), threat models with respect to participants and the organizers (e.g., colluding participants or not, covert organizers) as well as reproducibility features. As a result, we believe that Snake can help nicely complement the current sanitization competitions that focus on the sanitization part, thus resulting in a complete defense-attack pipeline. To the best of our knowledge, Snake is the first framework of its kind.

We propose to demonstrate the genericity, usability and extensibility properties of the Snake framework through a complete scenario focusing on membership inference attacks [START_REF] Hilprecht | Monte Carlo and Reconstruction Membership Inference Attacks against Generative Models[END_REF][START_REF] Hu | Membership Inference Attacks on Machine Learning: A Survey[END_REF][START_REF] Hyeong | An Empirical Study on the Membership Inference Attack against Tabular Data Synthesis Models[END_REF] over differentially-private synthetic tabular data generation schemes [START_REF] Mckenna | Winning the NIST Contest: A scalable and general approach to differentially private synthetic data[END_REF]. This instantation of the Snake framework is currently being used for supporting a challenge 1 co-located with APVP 2023 (the French workshop on the protection of privacy).

RELATED CHALLENGES

The closest related challenges to ours are the Hide-and-Seek privacy challenge [START_REF] Jordon | Hide-and-Seek Privacy Challenge: Synthetic Data Generation vs. Patient Re-identification[END_REF] from the Van Der Schaar laboratory, the INSAnonym competition [START_REF] Boutet | DARC : Data Anonymization and Re-identification Challenge[END_REF], the PWSCup [START_REF] Murakami | Designing a Location Trace Anonymization Contest[END_REF] series of competitions as well as the Microsoft Membership Inference Competition (MICO) [START_REF]MICO: Membership Inference Competition[END_REF].

The three former challenges differ on the rules, the data and tasks they propose, but they follow the same two-phase structure:

(1) a sanitization phase during which the participants implement a sanitization algorithm and run it on the given dataset and (2) an attack phase during which the sanitization algorithms are attacked. The attack phase of these competitions is often short (either by design or in practice) and the algorithms attacked are chosen by the participants. With the Snake framework, we aim at facilitating and thus strengthening the attack phase. Compared to Hide-and-Seek, INSAnonym or PWSCup, the sanitization algorithms attacked can be chosen from the literature and/or from the latest sanitization challenges (e.g., the NIST differential privacy challenges) and the number of algorithms under attack can remain small. This gives the opportunity to stress-test state-of-the-art sanitization algorithms and helps participants to focus on their attack algorithm. In particular, we believe that the Snake framework complements nicely the other challenges dedicated to designing sanitization algorithms.

Finally, the recent MICO Competition differs from the other three challenges mentioned above in that it consists in a single attack phase. More precisely, it focuses on membership inference attacks, as does the first edition of Snake, but differs from Snake 1 on the algorithms attacked (classifiers rather than synthetic tabular data generators) and on the background knowledge given to participants (disclosure of the learned model rather than disclosure of only its outputs and hyperparameters). In addition, another difference between MICO and Snake 1 is the use of Snake to facilitate the creation and management of Snake 1 . As the objective of Snake is precisely to facilitate challenges such as MICO, instantiating the Snake framework for obtaining a follow-up of MICO would both be easy and provide various benefits (e.g., automation, reproducibility and participant-side tools).

Besides the use in academia, challenges could be also a way forward for companies to validate their approach in a sound manner. Such examples include the 2006 Netflix challenge, in which privacy 1 https://www.codabench.org/competitions/879/ issues were highlighted [START_REF] Narayanan | Robust De-anonymization of Large Sparse Datasets[END_REF], or the 2018 Aircloak bug bounty in which a new class of privacy attacks was proposed [START_REF] Gadotti | When the Signal is in the Noise: Exploiting Diffix's Sticky Noise[END_REF]. Snake can be used to ease the organization of such events, strengthening data sanitization mechanisms and as a first step towards a systematic evaluation of commercial privacy solutions.

SNAKE FRAMEWORK

Snake is not a one-size-fits-all standalone tool that would integrate numerous and heterogeneous sanitization algorithms or scoring measures. This would both be non-exhaustive and lead to a heavy and complex tool. Rather, Snake consists of a set of abstractions and a flexible technical foundation. We describe these two levels below before describing in Section 4 Snake 1 , the first edition of Snake, provided as a reference implementation.

Original data

Prepare Abstractions. The abstractions defined in Snake consist in a workflow and its functional specifications. Figure 1 describes the Snake workflow. The rule Prepare data creates the main dataset of the challenge, called Base data, from some existing source of data, called Original data. Each task of the challenge is created by Create task, as a set of Public and Private files, with the former shared to participants, and the latter used by the organizers for the evaluation of the attacks submitted by participants. The third rule Create bundle packages all the competition files into (1) a bundle that can be uploaded to the CodaBench competition platform [START_REF] Xu | Codabench: Flexible, easy-to-use, and reproducible meta-benchmark platform[END_REF] to instantiate the full competition, (2) a public bundle that contains all the data needed by participants (e.g., available online during the competition) and (3) a private bundle that contains the solutions (e.g., available to participants exclusively after the challenge).

Technical Foundations. Snake leverages (1) the Snakemake workflow management system [START_REF] Köster | Snakemake -a scalable bioinformatics workflow engine[END_REF] for its inner working and (2) the CodaBench competition platform [START_REF] Xu | Codabench: Flexible, easy-to-use, and reproducible meta-benchmark platform[END_REF] for all the features necessary for running a competition in real-life (e.g., user registration, submission management, leaderboard). Snakemake is a bioinformatics workflow engine which provides a domain specific language implemented as an extension to Python to describes pipelines. Workflows are specified as a directed acyclic graph of rules which transform input files into target files, similar to makefile directives. Snake uses Snakemake to prepare all files required to define the challenge and outputs a "bundle" which can be uploaded to CodaBench to build a complete challenge. Thanks to the simple rule-based interface provided by Snakemake, the computational overhead of organizing a challenge using Snake is negligible compared to without it. Key properties. The design of the Snake framework adheres to the following key goals. These minimal set of properties are both necessary to the successful organization of attack challenges targeting sanitization algorithms and general enough to adapt smoothly to the advances of the field.

Genericity. The Snake workflow (see Figure 1) is high-level and generic enough to allow the design of most challenges in which participants attack the privacy properties of a sanitization algorithm. Indeed, any sanitization algorithm inputs prepared data and output sanitized data (e.g., a perturbed model), and any task consists in a challenge available to the participants (public part) and in the answer to the challenge (private part). In particular, the definition of a task as a pair of public and private data allows the framework to support a broad range of attacks scenarios (e.g., varying the background knowledge or sanitization algorithm attacked).

Extensibility. The Snake framework provides the two following levels of extensibility. First, it offers a simplistic challenge overview, which allows for further specification. For example, considering multiple attacks or allowing online attack evaluation is possible without deviating from the framework. Second, steps of the workflow are organized as Snakemake rules that (1) allow for generic input, output, script, execution environment, and parameters and (2) can be broken down into sub-rules if the need arises.

Usability. By leveraging the Snakemake workflow management, the Snake framework does not require strong development skills to be used and can be run on commodity hardware. It can thus be used easily by participants during a competition for building a complete local competition environment allowing local executions of the sanitization algorithms and of the participants' attacks. On the organizer side, existing challenges can easily be framed within Snake. Note that using Snake does not generate any computational overhead compared to preparing a challenge without using Snake. Moreover, the Snake framework outputs a packaged bundle compliant with the CodaBench platform, which allows for user-friendly participation (documentation, live ranking and automated scoring using a Python script).

Reproducibility. Snake allows a challenge to be reproduced in full, thanks to the functionalities offered by Snakemake. For example, inputs, outputs, execution environments, parameters and scripts are tracked through hashing. Random seeds used by Create task are saved in the private part of the related task. They can be kept by the organizers and disclosed to participants after the competition. The genericity and reproducibility properties allow the framework to support different threat models over both participants and organizers. For example, our framework is designed to allow participants to verify locally that their scores, given by the organizer, are indeed correct. This can simply be done by the participants, through local evaluations of the submissions, performed after the distribution of the private part of the tasks. Preventing any tampering of the private part of tasks could be done for instance by storing their hash in the public bundle and by letting participants check that they match with the private parts distributed by the organizers after the competition.

SNAKE 1 : THE FIRST EDITION

Snake 1 is the first challenge based on the Snake framework. It focuses on membership inference attacks [START_REF] Hilprecht | Monte Carlo and Reconstruction Membership Inference Attacks against Generative Models[END_REF][START_REF] Hu | Membership Inference Attacks on Machine Learning: A Survey[END_REF][START_REF] Hyeong | An Empirical Study on the Membership Inference Attack against Tabular Data Synthesis Models[END_REF]) over differentially private synthetic data generation algorithms [START_REF] Mckenna | Winning the NIST Contest: A scalable and general approach to differentially private synthetic data[END_REF]), is co-located with APVP 2023, which is taking part during summer 2023. Figure 2 describes the workflow of the challenge for a single task2 .

Original data

Base data First, the data used by the challenge is prepared as described afterwards. Each execution of a sanitization algorithm takes as input a private dataset consisting of random samples from the base dataset. The attack used as input the synthetic data, a set of targets for which membership is to be guessed, the base data and the parameters of the sanitization algorithm. The participants then perform their attack locally 3 and submit their guesses to the CodaBench space of Snake 1 . The CodaBench platform scores the tasks by comparing the submission with the (private) ground truth.

The following is an excerpt of the task creation rule (with irrelevant parts removed), with task_prep creating most of the public and private files, while synthetic data is generated by a separate rule that uses a specific Conda environment. Attacks algorithm. Each team has to design an attack algorithm as follows.

Input. Attacks algorithms are provided with (1) the synthetic dataset generated by an execution of the targeted sanitization algorithm over a private dataset, (2) the targets to attack, (3) the base dataset from which the private dataset is sampled, and (4) the parameters of the execution of the sanitization algorithm attacked; Output. The output of the attack algorithm is a real number in [0, 1] indicating the predicted probability of each target being within the private dataset or not.

We detail below the computation of the private datasets, the targets, the sanitization algorithms as well as the attack success measure.

Base dataset and private datasets. Snake 1 makes use of the publicly available EPI CPS Basic Monthly data provided by the Economic Policy Institute [START_REF]Current Population Survey Extracts[END_REF]. The CPS dataset is divided in years in which a yearly dataset contains more than 106 records and 125 columns 4 . A record contains information about a single individual in a household. Our base dataset is built by using a pre-processed sample of columns and rows from the original dataset. Full details are available in the competition online documentation. From this base dataset, we generate one private dataset for each parameterized sanitization algorithm attacked.

Targets and background knowledge. In Snake 1 , any household that contains at least 5 individuals might be a target, with the target consisting of the full set of records of the household. Snake 1 considers the following background knowledge about each target. The adversary knows (1) the exact records of the household targeted, and (2) the full base dataset 5 . The adversary is also given the information about the sanitization algorithm targeted as well as the parameters used for the executions and has access to its implementation. However, the randomness generated internally during the execution of the algorithm is unknown to the adversary.

Sanitization algorithms under attacks. The sanitization algorithms under attack during Snake 1 are differentially-private synthetic data generation algorithms. More precisely, we have selected a set of algorithms according to the following two criteria: technical soundness assessed by a rigorous peer-selection process (e.g., published at top-tier conferences or winner of a dedicated competition) and available open-source implementation. In particular, we have used the implementations available in the Reprosyn package [START_REF] Mole | Reprosyn[END_REF]. Except for parameters related to differential privacy, we use the default values set in their implementations. The PrivBayes algorithm [START_REF] Zhang | PrivBayes: Private Data Release via Bayesian Networks[END_REF] generates synthetic data by capturing the underlying distribution of the private data through a specific Bayesian network. The MST algorithm [START_REF] Mckenna | Winning the NIST Contest: A scalable and general approach to differentially private synthetic data[END_REF] is a generalization of the NIST-MST algorithm, which has won the 2018 NIST Differential Privacy Synthetic Data challenge. It generates synthetic data by perturbing the marginals that capture the data distribution through the Gaussian mechanism and by postprocessing them through the Private-PGM algorithm [START_REF] Mckenna | Graphical-model based estimation and inference for differential privacy[END_REF]. The PATE-GAN algorithm [START_REF] Jordon | PATE-GAN: Generating Synthetic Data with Differential Privacy Guarantees[END_REF] is an extension of generative adversarial networks [START_REF] Goodfellow | Generative adversarial networks[END_REF] based on the private aggregation of teacher ensembles framework [START_REF] Papernot | Semi-supervised Knowledge Transfer for Deep Learning from Private Training Data[END_REF].

Success measure. The success of a team is computed by first measuring the successes of its attack on each parameterized algorithm attacked (e.g., MST parameterized by 𝜖 = 1.0 and 𝛿 = 10 -5 ) and second by aggregating the success measures in a single final score. The success of a given attack for a given parameterized algorithm is evaluated based on the well-known membership advantage measure [START_REF] Yeom | Privacy Risk in Machine Learning: Analyzing the Connection to Overfitting[END_REF]. The number of targets must be at the same time large enough for obtaining a sufficiently stable estimation and small enough for being practical (e.g., 𝑟 = 100).

Execution environment. The design, coding, and executions of attacks are performed locally by each team with its own resources. As a result, there is no restriction on the computing environment used to develop the attacks and the choice of the programming language and the available resources are unconstrained. Note however that we provide to participants the Snake 1 Python environment.

DEMONSTRATION

We propose to demonstrate the key features of the Snake framework on several datasets along the following three scenarios.

Organizer side: creating a competition. We demonstrate how one can create a competition with Snake, highlighting the benefits of Snake for automating the creation of tasks and bundles.

Participant side: overview of the first edition. We use the first edition of Snake to give an interactive view of participating in a running competition (e.g., accessing the tasks generated by Snake, running a baseline attack and submitting the results).

Extension: code submission. We demonstrate how the framework can be extended with minimal changes using the example of the ekans toy competition (available on CodaBench 6 ) which is the "reverse" of Snake 1 . The objective of ekans is to propose a way to sample targets that are the easiest to attack. ekans asks participants to submit Python code in charge of sampling "good" targets for membership inference attacks. The CodaBench platform runs the code submitted and performs a basic attack on the sampled targets using the TAPAS package [START_REF] Houssiau | TAPAS: a Toolbox for Adversarial Privacy Auditing of Synthetic Data[END_REF]. The score of the participant is the success score of the attack. We believe that the ekans competition helps illustrate the genericity of the Snake framework.

CONCLUSION

The Snake framework is dedicated to facilitating the organization of challenges stress-testing sanitization algorithms. Snake allows to easily automate the redundant tasks that are inherent to any such challenge and exhibits the following salient features: genericity with respect to attacks, ease of use and extensibility.

We illustrate Snake through Snake 1 , a specific instantiation focusing on membership inference attacks over differentially-private synthetic data generation schemes. We propose in this paper to showcase Snake from the points of view of the organizer and of participants. Overall, we hope that the Snake challenges can help gain understanding of the empirical privacy guarantees of sanitization algorithms and of their parameters and pave the way to a greater democratization of sanitization algorithms providing strong privacy guarantees.

Figure 1 :

 1 Figure 1: High level view of the workflow. Trapezoids represent rules (i.e., programs) and rectangles data (i.e., files).

Figure 2 :

 2 Figure 2: High level view of the workflow implementation for the first edition. Rectangles represent data with rules as edge labels.

  rule task_prep : input : rules . prepare_data . output . data , output : targets =... , train =".../{ gen } _ { eps } _train . feather " , seed =... , # for reproducibility truth =... , # private answers script : " scripts / task_prep . py "

Full implementation available at https://github.com/snake-challenge/snake1.

Participants can use the framework to generate their own versions of the tasks locally and therefore can evaluate their submission on their side before submission.

Full description available at https://microdata.epi.org/variables/.

It provides teams with the knowledge of the population distribution commonly assumed in membership inference attacks.

https://www.codabench.org/competitions/746/

ACKNOWLEDGMENTS

We would like to warmly thank the students, engineers and researchers that have helped us to design the Snake challenge. This work is partially supported by the ANR 22-PECY-0002 IPOP (Interdisciplinary Project on Privacy) project of the Cybersecurity PEPR, the Canada Research Chair program, a Discovery Grant from NSERC as well as CIFAR through a CIFAR-MILA-IVADO-MITACS Catalyst Grant.