Olivier Duplâtre

Pierre-Yves Modicom

Adverbs and adverbials: categorial issues

The theory of parts-of-speech is both one of the most fundamental issues of any syntactic description or any syntactic theory, and one of the trickiest for anyone defending a cross-linguistic, comparative approach (Haspelmath 2001: 16538). A first major question, common to languagespecific and cross-linguistic research, is whether parts-of-speech are essentially word-classes or functional classes. Directly pertaining to this matter is the question of the polycategoriality and/or polyfunctionality of items that seem to belong to several classes. Depending on the positions adopted in this debate, the respective relevance of semantic, syntactic and morphological criteria needs to be considered differently. From a cross-linguistic perspective, syntactic and above all morphological tests are put into jeopardy even more directly. As a result the degree of languagespecific variation, the extent of flexibility required in classifications and the respective role of functional and formal criteria are still major issues for any theory of parts-of-speech.

Among the word-classes of traditional grammar, there is one which appears to be even less satisfactory than the other ones: the adverb. The concept of "adverb" (Lat. adverbium) has been coined as a loan translation from Greek épirrhêma (ἐπίῤῥημ πί ημα). ).

ἐπίῤῥημα ῤῥημα). This concept goes back to Dionysius Thrax (2 nd century BCE), who defined it as "something that applies to a verb" in the penultimate chapter of his Τέχνη Γρα). μμα). τική (chapter 24 following Davidson's 1874 rendition, chapter 19 in Uhlig's 1883 version). The definition of adverbs has been shaky and ambiguous from the beginning. For instance, there are two interpretations for the origin and the name of the Greek concept of épirrhêma. The first one is positional (De Benedetto 1959: 111): "adverbs" either immediately follow or precede the verb. The other one is semantic: based on the meaning of preposition kata (kata rhematos legomenon), Lallot (1998: 221-222) claims that the épirrhêma is said (legomenon) of (kata) the rheme (rhematos). In other words: the épirrhêma is a predication on the rheme. While he also defended the view that Greek adverbs had a special slot immediately before the verb; Apollonius Dyscolus (2 nd century CE) claims that the épirrhêma is predicated on the verb, or rather on the some or all the finite marks on the verb (katêgorousa toñ ẻn toĩs rhếmasin ẻnklíseôn kathólou è̉ merisôs, Apollonius Dyscolus 2021:76). But the most blatant issue with adverbs is the extreme heterogenity of the class, of which Dionysius Thrax was already well aware: An Adverb is an indeclinable part of speech, said of a verb or added to a verb. Of the Adverbs, some are Simple, and others Compound; simple, as πάλαι; compound, as πρόπαλαι. Some are indicative of time, as ν ν, τότε, α θις: to these we must subordinate as species those that ὖθις: to connote particular times or seasons, as σήμερον, α ριον, τόφρα, τέως, πηνίκα. Some indicate ὔριον, τ manner, as καλ ς, σοφ ς, δυνατ ς; some, quality, as πύξ, λάξ, βοτρυδόν, γεληδόν; some, ἀγεληδόν quantity, as πολλάκις, λιγάκις, μυριάκις; some, number, as δίς, τρίς, τετράκις; some, place, as νω, κάτω-of thesof these there are three kinds, those signifying ἄνω, κάτ in a place, those signifying to a place, and those signifying from a place, as ο κοι, ο καδε, ο κοθεν. Some Adverbs signify a ἴκοι, οἴ ἴκοι, οἴ ἴκοι, οἴ wish, as ε θε, α θε, βαλε; some express horror, as παπαί, ού, φε ; some, denial or negation, ἴκοι, οἴ ἴκοι, οἴ ἄνω, κάτ ἰού, φεῦ as ο , ο χί, ο δ τα, ο δαμ ς; some, agreement, as ναί, ναίχι; some, prohibition, as μή, μη ὔριον, τ δ τα, μηδαμ ς; some, comparison or similarity, as ς, σπερ, ΰτε, καθά, ὥς, ὥσπε ὥς, ὥσπε ἠΰτε, κα καθάτερ; some, surprise, as βαβαί; some, probability, as σως, τάχα, τυχόν; some, order, as ξ ς, φεξ ς, ἴκοι, οἴ ἑξῆς, ἐφ ἐφεξῆς, χωρίς; some, congregation, as ρδην, μα, λιθα; some, command, as ε α, γε, φέρε; some, ἄνω, κάτ ἅμα, ἤλι ἤλιθα; s ἶα, ἄγε, ἄνω, κάτ comparison, as μ λλον, ᾶλλον, ττον ἦττον ; some, interrogation, as πόθεν, πο , πηνίκα, π ς; some, vehemence, as σφόδρα, γαν, πάνυ, μάλιστα; some, coincidence, as μα, μο , μυδις; some ἄνω, κάτ ἅμα, ἤλι ὁμοῦ, ἄμ ἄνω, κάτ are deprecative, as μά; some are asseverative, as νή; some are positive, as γνωστέον, ἀγεληδόν γραπτέον, πλευστέον; some express ratification, as δηλαδή; and some enthusiasm, as ε ο , ῖ, ε άν. (Thrax & Davidson 1874: 337-338) 1 The starting point of Dionysus Thrax is a morphosyntactic definition of the adverb. In his work, semantics is essentially reduced to the question of incidence. In a nutshell, Dionysus's theory of adverbial incidence is that adverbs predicate a property onto the verb. Other semantic features (circumstantiality, manner etc.) do not belong to the definition and are considered as secondary accidents to the épirrhêma: after the primary accident, the so-called figura in Latin grammars (some épirrhêma are simple, others are compound), there follows a long enumeration of the various semantic fields in which the épirrhêma occurs. In the mainstream reception of Dionyisus Thrax, however the adverb is not defined functionally as a predication on the verb, but morphosyntactically, as a part of speech that may be pre-or postponed to the verb. The cause for this evolution may be found in the Latin interpretation and translation of épirrhêma: "adverbium praeponitur et postponitur verbo" (Macrobius 1848: 263).

Latin grammar has also endowed the épirrhêma with a semantic dimension. Among the grammarians who played a major role in this Latin reception, one should name Remmius Palaemon (in his reconstructed Ars grammatica) and his successors, like Charisius, but also Donatus (Ars Minor, Ars Maior) and Diomedes (Swiggers & Wouters 2002: 295). All of them indicate that the adverb explains and completes the verb (adverbium est pars orationis quae adiecta verbo significationem eius explanat atque implet). Such a definition 2 was contradicted by the fact that an adverb or a so called one could occur alone (Pinkster 1972: 136-141). This issue is also addressed by Apollonius Dyscolus (2021: 78-79) in his major treaty on Greek adverbs. Apollonius makes a distinction between adverbs which are directly associated to a verb and adverbs for which grammarians had to postulate an underlying verbal assertion which the adverb modifies in a further step. Apollonius's hypothesis was mostly motivated by his wish to maintain the parallelism adjective/noun, adverb/verb (Brocquet 2005: 128). Priscian also draw a parallel with adjectives and claimed that the meaning of the adverb is added to that of the verb (Adverbium est pars orationis indeclinabilis, cujus significatio verbis adicitur). As Pinkster points out, the ancient grammarians were used to "describ[ing] parts of speech in terms of relationship between categories and not in terms of their function in a sentence." (Pinkster 2005: 180). Still, Priscian's definition paves the way for functional conceptions. The adverb does not complete or explain the verb any more, its signification is only added, which means that the adverb is ready to become a modifier. The notion of verbal incidence plays a cardinal role alongside the criterion of invariability. However, the limits of the verbal incidence thesis quickly become apparent. First, it is well-known that adverbs can be incident to adjectives (example 1) or to other adverbs (example 2).

(1) Since Sylvia Plath died in 1963, she's been turned into a crudely tragic symbol.

(bbc.com, July 21 st , 2021)

(2) Rawls never wrote about himself, and virtually never gave interviews. (The Guardian, Nov. 17th, 2002) 1 We quote from the 1874 English translation by Thomas Davidson for the Journal of Speculative Philosophy. 2Note that it bears some similarity with modern definitions of manner adverbials which are claimed to expand Aktionsart features of the verb (Dik 1997: 228).

This fact led some scholars to enlarge the etymological definition of the adverb inasmuch as verbum may not only signifies verb, but word. This was done for instance by 18 th century Cartesian grammarian Beauzée, who held that "adverbs complete the meaning of adjectives or even of other adverbs as often as the meaning of verbs" (Beauzée 1767: 548-549).

On the other hand, even an adverb that seems to be incident to a verb may actually be incident to a higher node in the syntactic structure of the verbal clause, such as a complex made up of the verb and one its arguments, or the VP as a whole, or even higher functional levels, as is most notably the case for "sentence adverbs" or "high adverbs". This high degree of variation regarding the real level of incidence of adverbs is a major issue for any syntactic theory and has enjoyed renewed interest over the last 25 years. Most significantly, it has played a prominent role in the constitution of the "cartographic approach" in the field of Generative Grammar [START_REF] Cinque | Adverbs and functional heads[END_REF]. As early as 1990, [START_REF] Dik | The hierarchical structure of the clause and the typology of adverbial satellites[END_REF] developed a functional view drawing on a similar intuition: the clause is structured as a cascade of successive predicative operations, for which the verbal categories are grammatical operators, whereas adverbs and adverbials are lexical satellites, located at different representational levels and thus incident to different syntactic units within the verbal clause.

The question of syntactic incidence within the shell structure of the VP goes along with considerations on the relationship between adverbs and the hierarchy of "functional heads" or grammatical categories such as aspect, tense or mood. This way of thinking bears striking similarities with insights from Apollonius (2021: 80-81), who developed a fine-grained account of how adverbs may be incident either to the verbal root or to verbal flections, with some adverbs being associated to tense, while others apply to mood or even to personal agreement morphemes. According to Apollonius, selectional restrictions imposed on adverbs by inflectional categories show that temporal adverbs were predicated on tense markers and that adverbs which would now be called illocutionary were predicated on mood (see Dumarty 2021: 202-204 for a general discussion and 222-233 for a case-by-case analysis of Apollonius's claims). Apollonius thus paved the way for further accounts distinguishing between different levels of adverbial scope within the VP itself.

Adverbs: a superfluous class? Issues in contemporary theories

Indeed, if we look at contemporary research on adverbs, it seems that, far from advancing towards a more precise, consensual definition of the adverb, we are faced with an even greater level of heterogeneity. The formal and functional heterogeneity of this class makes it "the least satisfactory of all" according to Quirk et al. (1972: 267). A similar view is expressed by Gleason (1965: 129):

The traditional "adverbs" are a miscellaneous lot, having very little if anything in common. Some fit part of the definition, but not other parts. Some fit the whole definition but far exceed its limits. The linguist almost invariably divides this assemblage into several groups which are not related to one another. (Gleason 1965: 129) Some scholars are even tempted to define adverbs negatively, i.e. to drop the idea of finding a unitary, consistent definition for the class: Indeed, it is tempting to say simply that the adverb is an item that does not fit the definitions for other parts of speech/word classes. (Quirk et al. 1972: 267) Thus, resorting to the notion of adverb as a distinct word-class may be a matter of mere expedience, aimed at maintaining a relatively stable number of parts of speech in the face of the multiplicity of non-flectional morpheme and lexeme classes in Standard Average European languages (Rauh 2015: 38). Finding a universally valid definition of adverbs seems to be an almost impossible task. This can lead to the conclusion that "adverb" are not a typologically relevant category. In this respect, "adverbs" illustrate how a eurocentric conception of parts of speech is a cross-linguistically inadequate descriptive tool. This was already suggested by Hopper & Thompson (1984: 747):

To the extent that forms can be said to have an a-priori existence outside of discourse, they are characterizable as acategorial; i.e., their categorical classification is irrelevant. Categoriality -of thes the realization of a form as either a N or a V -of thes is imposed on the form by discourse. Yet we have also seen that the noun/verb distinction is apparently universal: there seem to be no languages in which all stems are indifferently capable of receiving all morphology appropriate for both N's and V's. This suggests that the continua which in principle begin with acategoriality, and which end with fully implemented nounhood or fully implemented verbhood, are already partly traversed for most forms. (Hopper & Thompson 1984: 747) Given the problems raised above, it appears that the prominence of adverbs in Standard Average European should not lead us into abusive generalizations: a cross-linguistic survey suggests that the class of "adverbs", however fuzzy and all-encompassing, is superfluous for the description of certain (types of) languages. For instance, Hengeveld & Valstar (2010: 6), drawing on a system of four basic, functionally defined parts of speech (heads vs modifiers; within referential vs predicative phrases), show that the Krongo language does not show any specialized part of speech for modifiers, thus eliminating the adverb (as a part of speech for modifiers within a predicative phrase). Krongo uses only subordinate verbal phrases as modifiers. In this language, there might be something like an adverbial function ("modifier of a predicate phrase"), but no corresponding word-class. Hengeveld (1992a, b and2004) defends the view that there is crosslinguistic hierarchy of parts of speech, meaning that not all "big four" classes are equally likely to be found across languages:

Head of predicate phrase > head of referential phrase > modifier of referential phrase > modifier of predicate phrase.

In this hierarchy, adverbs occupy the lowest position (i.e. if there is a class of adverbs in a given language, that language must also display the other three classes, while the opposite is not true). On the other hand, this hierarchical approach is not necessary if we enlarge Croft's conception of modification and couple it with a radical view on word-classes. For instance, we may consider that subordinate clauses in Krongo correspond to a morphologically marked adverb, the unmarked item being absent in that language.

In his radical attempt at deconstructing presupposed categories, Croft (1991) sketches a threefold distinction for parts of speech which leaves aside the adverb. He distinguishes between three discourse functions: reference, predication and modification. These functions are prototypically filled by "nouns", "verbs" and "adjectives". More precisely, nouns, verbs and adjectives are unmarked items, resulting from the combination of reference, predication and modification with objects, actions and properties, respectively. Marked items (for instance deadjectival nouns, predicate adjectives) proceed form one of the other combinations between form and function. But what about adverbs? Croft does not treat them explicitly, but admits that modification of a predicate would also have to be represented in a theory devoted to parts of speech (Croft 2001: 94). This enlargement of the discourse function of modification is taken up by Haser & Kortmann (2006: 68), who claim that prototypical adverbs, much like prototypical adjectives, can be defined as items that provide modification by a property, the difference being that prototypical adjectives modify referents and prototypical adverbs modify predicates. This could mean that the adverbial class is reduced to manner adverbs, at the expense of, say, adverbs of space and time. Manner adverbs would be then the unmarked items, whereas prepositional phrases (see for example mit schnellem Schritt/with quick steps in German), nominal phrases (see for example schnellen Schrittes/with quick steps in German) or even converbs would be marked items (see Hallonsten Halling 2018: 38). In this framework, adverbs are essentially conceived of on the basis of adjectives, raising the question whether adverbs are really a primary word-class. However, one may want to maintain the idea that the modifiers of predicates are not secondary to the modifiers of referential phrases, i.e. that "adverbs" are not secondary to "adjectives". According to Hallonsten Halling (2018: 96), "the languages that have adverbs but lack adjectives are genealogically unrelated and geographically distant. This shows that it is not necessary for a language to have adjectives in order for it to have adverbs, as earlier argued by Hengeveld (1992b[START_REF] Hengeveld | Parts-of-speech systems as a basic typological determinant[END_REF]."

Another proposal for a revision of "word-classes" on a non-eurocentric base has been made by [START_REF] Haspelmath | How to compare major word-classes across the world's languages[END_REF], drawing on insights from [START_REF] Croft | Radical Construction Grammar[END_REF]. It is striking to see that here also, the proposed model leaves adverbs aside. Haspelmath argues that questions such as "Is there a noun/adjective distinction in language X or Y?" are wrongly formulated since they presuppose clear-cut cross-linguistic definitions of word-classes, which are ultimately language-specific. Instead, he proposes to go back to the mostly implicit view behind traditional definitions of wordclasses and to examine roots, not words, on a semantic (ontological) basis, looking for "rootgroupings" such as "thing-roots", "action-roots" and "property-roots". The second set of comparative concepts advocated for in his paper are defined on a functional basis. Haspelmath calls them "referential roots", "predicate roots" and "attribute roots", i.e. roots that are specialized for one of those three functions and usually need further material (e.g. additional affixes) to be used in the other two functions. Both sets of comparative concepts intend to rescue the concepts of nouns, verbs and adjectives, based on the premise that "things-roots" tend to be "referential roots" as well, while "action-roots" are often "predicative roots" and "property-roots" are "attribute roots". But what about adverbs? What would be the ontological base for a comparative concept replacing this category, alongside with "things", "actions" and "properties"? Could it be "circumstance"? Or perhaps "manner"? And what about the functional concept corresponding to the class? Should we look for "adjunct roots"?

Considering this extreme fuzziness, some grammarians have looked for a renewed definition of adverbs based on prototypical features [START_REF] Ramat | Prototypical adverbs: On the scalarity/radiality of the notion Adverb[END_REF]. A possible outcome of this strain of thought is to sketch a hierarchy of adverbial classes, distinguishing central subclasses (e.g. manner adverbs) and peripheral subclasses, which would be "less adverbial" than others (e.g. sentence adverbials). But which criteria should be chosen to define the prototype of the adverb? Should frequency data play a role in this definition? Should one take some semantic features as more prototypical than others? Can the manner adverb constitute the prototype? Should we follow Hengeveld's position (1992a andb, 2004) that the only way to come up with typological generalizations is to focus on manner adverbs?

Looking for a functional alternative: Adverbials

Hengeveld (1992 and subsequent) and [START_REF] Hengeveld | Parts-of-speech systems and subclasses[END_REF] use the definition of "modifier of a predicate phrase" as a functional cue leading to the identification of "adverbs" in given languages (provided that there exists a corresponding word-class in this language). This actually means that we first define a function (which shall henceforth be called "adverbial") and that "adverbs", if there are any, are those lexemes which are specialized for this function. Other scholars have chosen to do away with the category of adverb and to concentrate (almost) exclusively on the functional category of adverbial [START_REF] Nølke | Les adverbiaux contextuels: problèmes de classification[END_REF][START_REF] Pittner | Adverbiale im Deutschen: Untersuchungen zu ihrer Stellung und Interpretation[END_REF], with the latter being defined in a purely syntactic way if necessary [START_REF] Chomsky | Aspects of the theory of syntax[END_REF], Steinitz 1969). Similarly, some linguists take the adverbial as the more basic notion and derive the notion of adverb from it [START_REF] Maienborn | Adverbs and adverbials[END_REF]).

However the notion of "adverbial" is not very clear either (Eisenberg 2013: 212). Its boundaries are probably just as fuzzy as those of the word-class "adverb". If the concept of "adverbial" encompasses all phrases that are not positively defined as belonging to another specific type of sentential component (Nølke 1990: 17), this means that any type of circumstantial, be it an adjective, a prepositional phrase, a subordinated clause etc., falls into this category. Further, the question of the syntactic domain of adverbials and of their semantic scope is as difficult as it ever was for adverbs: should we really lump together in one category manner adverbials, speakeroriented modal adverbials, evaluative adverbials, circumstantials, or even discourse markers?

Due to the syntactic tests used to isolate them (e.g. commutation, coordination, ellipsis) the definition of adverbials can be a test case for both constituency grammars, dependency grammars and valency theory. For instance, should we draw a line between adjuncts and adverbials? Dionysius Thrax makes a difference between "adverbs" and "conjunctions", i.e. particles and discourse connectives. The last chapter of the Τέχνη Γρα). μμα). τική is devoted to these "conjunctions". Dionysius Thrax shows that semantically, particles and discourse connectives do not predicate "properties". From a syntactic point of view, they are not constituents, either. Yet, Dionysus regards negations as "adverbs", and also counts affirmative νή as an adverb, while today's dictionaries treat it as a particle. Are all adverbials and/or "adverbs" full constituents, or should we acknowledge the existence of cliticized or particulized "deficient adverbs" (Cardinaletti & Starke 1999: 97-102)? If so, should we still count them as adverbials?

Another major issue undermining the categorial homogeneity of adverbials is the distinction between bound and unbound adverbials or, to use a generative terminology, between central and peripheral adverbials. This distinction has been popularized for adverbial clauses, by [START_REF] Haegeman | Adverbial clauses, main clause phenomena and the composition of the left periphery[END_REF], among others. Central adverbial clauses are modifiers within the VP. Among other properties, they can be negated, receive contrastive focus, and can be the answers to whquestions. Peripheral adverbial clauses, on the other hand, are located within the illocutionary layer of the clause: they cannot be focused upon, nor can they be negated, and there is no corresponding wh-word.

(3) a. We went to England for the first time as our children were still small. b. We went to England for the first not as our children were still small, but only later.

Note that (3a) can also be an answer to the question "When did you go to England for the first time?". By contrast, (4a) is neither an answer to "When didn't you want to make the journey to England?", nor to "Why didn't you want to make the journey to England?":

(4) a. As our children were still small, we didn't want to make the journey to England. b. *Not as our children were still small, we didn't want to make the journey to England.

Further properties such as the possibility of using discourse particles in peripheral, but not in central clause suggest that peripheral clauses are indeed illocutionarily autonomous. If we consider the fact that speaker-oriented adverbs tend to exhibit similar properties (see for instance Ernst 2009 on their behaviour with respect to negation, or Pérennec 2002 for questions), an important issue is whether this functional dichotomy between two sorts of adverbials is relevant only for adverbial clauses. Shouldn't we also look for a similar division between two groups of lexical adverbs?

Adverbs as lexical class: Delimitational and classificational issues

Delimitational approaches, either from a formal or from a functional point of view, often point out that it is sometimes hard to distinguish between adverbs and particles, adverbs and interjections, adverbs and discourse markers, even in languages where the tradition of "parts of speech" is supposed to guarantee strict borders between well-established categories. But the most salient issue in delimitational research is probably the relationship between adverbs and adverbial adjectives. If we assume that adverbials in sentences such as ( 5) and ( 6) are adjectives fulfilling an adverbial function, the class of adverbs has to undergo a strong reduction.

(5) Lo saben seguro.

'They certainly know it.' (6) Er singt gut.

'He sings well.' But the fuzziness of the adjective-adverb boundary also involves morphological issues: is it enough to have an "adverbial morpheme" distinguishing "adverbs" from corresponding adjectives? Or should we refrain from immediately reading these morphemes as derivational affixes yielding lexical adverbs? Two striking examples are the derivative adverbial suffixes of Latin -e, -o and Greek -ôs, which are broadly similar to inflectional endings, which raises the question as to whether adverbial derivation can always be separated from adjective flection [START_REF] Haspelmath | Word-class-changing inflection and morphological theory[END_REF]. This question was already raised by Greek grammarians. For instance, a large part of Apollonius's treaty is devoted to the analysis of adverbial morphology, trying to determine which suffixes have to be traced back to marks of declension, and which adverbial forms are actually verbs or nouns (see especially Apollonius 2021: 84-107).

This issue becomes even more striking if we follow a radical diachronic view underlining the adjectival component of Romance lexemes ending in -ment(ἐπίῤῥημ e) or English so-called adverbs in -ly. Haspelmath claims:

For example, if the English adverb-forming suffix -ly is regarded as an inflectional suffix, then quickly is an inflected adverb form of the (adjectival) lexeme quick, hence it is an adjective. But if the suffix -ly is regarded as a derivational form, then quickly is a derived adverb lexeme. It turns out that there is no good general way of distinguishing between the two kinds of processes [...], so we cannot make this distinction the basis of our definition. Another serious problem is that there is no good general way of distinguishing inflectional affixes from separate clitic words. (Haspelmath 2012: 123).

Following this strain of thought, most "manner adverbs" would be discarded from the lexical class, and the notion of "adverbs" would be almost reserved to deictic adverbs of time and space and, depending on the author, to some grammatical forms used as a basis for (more or less lexicalized) adverbial constructions. Among these "adverbial" grammatical(ized) items, we could count the English suffix -ly (originally a noun, today a derivational suffix for both adjectives and adverbs, see [START_REF] Pittner | Between inflection and derivation: Adverbial suffixes in English and German[END_REF] or Romance -ment, -mente (also a former noun, see Lehmann 2015: 93 among many other). The same questions can be raised for gerunds and especially converbs in languages where converb derivation is highly productive (Haspelmath & König 1995): should they be regarded as deverbal adverbs? How do we distinguish between inflection, subordination and derivation in the case of gerunds and converbs? It is unclear whether the notions of "adverb" or "adverbial" really help to capture what is going on at all, since some differences at play within the derivational or inflectional procedures described above seem to permeate these classical categories.

For instance, in German, most adjectives can play the role of manner adverbials [START_REF] Schäfer | Deutsche adverbiale Adjektive oder was es heißt, ein Adverbial der Art und Weise zu sein[END_REF]. But in some cases, modal adverbials turn out to be originally epistemic modal adjectives having undergone functional specialisation. Today, a form like vermutlich, "plausible, plausibly" is no longer in use as an adjective. Adjectival uses of offenbar "manifest, manifestly" as NP-modifier are still marginally attested in the German Reference Corpus (DeReKo), but adverbial and predicative uses make up the vast majority of tokens. It appears that an adjective can turn into an adverb and all but lose its NP-modifying usage without any morphological altering. Yet, High German has also developed a derivation path resorting to a grammaticalized noun (-weise) meaning 'manner' and giving rise to a morphologically distinct class of "adverbs". This morphological opposition, which is strongly reminiscent of the Romance data observed by [START_REF] Schneider | Adjective-Adverb Interfaces in Romance. Open-Access Database (=AAIF-Database)[END_REF], also has a functional correlate: many weise-adverbials are not licit as proper manner adverbials (see overview in Elsner 2015), whereas most adjective-adverbs are ruled out from higher adverbial functions, with functionally specialized epistemic modals like offenbar and vermutlich being the main exceptions (which means that forms used as sentence adverbials still tend to be disprefered for NP-modifying functions).

At this stage, the morphological examination of adverbs raises several major issues pertaining to the consistency of the class: the different morphological classes of adverbs do not correspond to the different adverbial functions. At the same time, many forms appear to be morphologically ambiguous between adverbs and adjectives or adverbs and prepositions.

The first two chapters of this volume explore these mismatches between morphology and functions from a corpus-based perspective, taking Present-Day English as target of their study. With the help of a statistical study carried out with the software R, Romain Delhem ("The incoherence of the English adverb class") redefines on the morphosyntactic level the class of English adverbs. Two series of adverbs are eliminated: place adverbs, such as here, there, abroad, ahead, home, downstairs or forward move to the class of prepositions, which confirms the analysis of Huddleston & Pullum (2002). Flat adverbs, i.e. adverbs with a form identical to that of an adjective, join the class of adjectives. Finally, the third class includes adverbs expressing manner, frequency, time, modality, degree, etc. Romain Delhem assumes that the coherence of this class could be ensured by derived adjectives in -ly and units having the same function. Whereas Romain Delhem relies on morpho-syntactic criteria to carry out his statistical analysis of English adverbs, Christina Sanchez-Stockhammer and Antony Unwin ("The subcategorization of English adverbs: A feature-based clustering approach") use new morpho-semantic criteria such as the formation of the adverb, its capacity to give rise to other terms, its origin and its age. Their innovative clustering approach makes it possible to isolate three adverbial classes: adverbs in -ly, adverbs without suffixation that can be decomposed, such as away, forward, anywhere, etc., adverbs that cannot be decomposed, such as out, next, so, then, etc.

The adjective/adverb interface is an issue per se. Special attention has to be paid to the competition between "adverbial adjectives" (seguro, gut, see ex. 5 and 6), adjectives that have relexicalized as adverbs (offenbar, vermutlich) and adverbs derived from adjectives (using -ly, -mente, -erweise), which seem to compete for adverbial functions. This field has been extensively studied in Romance in the last years from a diachronic perspective (see especially the studies in Hummel & Valera 2017 as well as contributions by [START_REF] Hummel | La structure 'verbe + adjectif'. Parler vrai, dire juste, faire simple et compagnie[END_REF][START_REF] Gerhalter | Paradigmas y polifuncionalidad. La diacronía de preciso / precisamente, justo / justamente, exacto / exactamente y cabal / cabalmente[END_REF][START_REF] Schneider | Adjective-Adverb Interfaces in Romance. Open-Access Database (=AAIF-Database)[END_REF]. [START_REF] Hummel | The Third Way: Prepositional Adverbials in the Diachrony of Romance[END_REF] distinguishes between three competing ways of forming adverbs in the history of Romance: the use of adverbial adjectives (seguro, "surely, for sure"); suffix derivation (seguramente, "surely, for sure"); prepositional constructions (de seguro, "surely, for sure"). What are the parameters of variation at stake in the choice of one strategy or another? Are these determined by usage conditions, possibly linked to larger language change phenomena? Are there language-internal, synchronic biases? Are they linked to the level of incidence of the adverbial? What can morphology (e.g. agreement) teach us here? These issues are addressed by the contribution of Ignazio Mirto ("Proteus: Adverbial multi-word expressions in Italian and their cognate counterparts in -mente"), who is concerned with Italian -mente adverbials and their multiword counterparts (e.g. lussuosamente vs. di lusso, both meaning "lavishly"). Mirto shows both the truth-conditional interchangeability of both morphological types and their distributional differences as well as their semantic idiosyncrasies (under special consideration of subject-orientation). Inflection plays a major role in his reflection, which leads to a reassessment of morphosyntactic procedures in the functional examination of modifiers, at reasonable distance from traditional parts-of-speech classifications.

The very notion of "modification" needs to be re-examined in the light of such fuzziness. Should modification be conceived of as a (secondary) predication or as a phenomenon of attribution? Here also, adjectives offer an interesting parallel, and the comparison between both can be insightful, especially when adjectives compete with adverbs… or where morphological adverbs (or limit cases between adverbs and prepositions such as German auf) appear to gain access to adjectival functions. For instance, in (7), auf would most classically be analysed as a directional particle meaning "above". In (8), auf is a particle meaning "open" in a resultative construction.

(7) Er packte den Schläfer unter der Achsel und riss ihn auf.

'He seized the sleeper under the armpits and drew him up.' (Digitales Wörterbuch der Deutschen Gegenwartssprache, August 13 th , 2021). ( 8 These phenomena are at the heart of the chapter written by Marius Albers ("Prenominal adverbs in German? The cases of auf 'open' and zu 'closed'"): according to Marius Albers, the inflection of the verbal particles auf and zu is made possible by the fact that they can be used predicatively, the predicative use paving then the way to an attributive one. These particles are thus much more akin to adjectives than adverbs and represent, according to the author, a particular use of a polyfunctional adjective. The evolution of adverbs into adjectives in German raises major questions as to the respective status of both classes, since it suggests that the border between adjectives and adverbs is open in both directions, against the common assumption that there is a hierarchy in the class of German modifiers and that adverbs are a secondary group. Further, it appears that adjectival uses of adverbs have developed from resultative constructions where the adverbial constituent fulfilled a predicative function that is typical for satellite-framed languages [START_REF] Talmy | Path to realization: A typology of event conflation[END_REF]. This opens the way to new research about the link between the great typological divide first observed by Talmy in the expression of movement and issues of part-of-speech flexibility, where the syntactic type of motion expression determines which kinds of conversion are possible.

Semantics and syntax: beyond manner and circumstances

Splitting "manner adverbs"

3 Example ( 9) is taken from an internet forum. Participants are discussing about the most convenient ways to smoke in closed spaces.

The result of inquiries looking for a consistent definition of adverbs as word-class is that items classified as adverbs actually have to be separated into several homogeneous groups. As a consequence, the delimitational enterprise leads to renewed interest in functional classifications. Within the set of adverbial functions, the notion of "manner adverb(ial)" plays a central, if not prototypical role in research on adverbs and adverbials, both from a formal point of view (-ly,erweise or -mente are all semantically related to the marking of "manner") and from a semantic perspective. In a discussion on the different meanings encoded by converbs (i.e. adverbial constructions of verbal lexemes), König (1995) posits a general domain of circumstantial relations as semantically central for their interpretation. Within this domain, König (1995: 66) argues for a sharp distinction between "manner" and "attendant circumstance". Manner describes "two aspects of or dimensions of only one event", whereas "two independent events or actions are involved" in the case of "attendant circumstance" (König 1995: 65-66). The articulation of manner and circumstances appears to be a central issue for any semantic view on the cohesion of "adverbs" as a class.

So-called "manner adverbs" in -ly (English), -ment (French) or -mente (other Romance languages) can often be used as "sentence adverbs" or as assertive adverbs. In other words: classificational research must address the question of the relationship between the semantic domain of adverbials and their level of incidence. "Manner" is normally a determination of the process, and thus "adverbials of manner" should be modifiers of the VP. "High adverbials" on the other hand are modifiers of a higher layer. For instance, French diplomatiquement, 'diplomatically', can be used as a VP-internal modifier of manner:

(10) Elle a oublié de répondre diplomatiquement.

'She forgot to answer diplomatically, she forgot to make a diplomatic answer.' But it can also be used as domain adverbial, with a partly circumstantial reading:

(11) Diplomatiquement, ne pas répondre était une bonne solution.

'From a diplomatic point of view, not to answer was a good idea.' Finally, given that diplomatiquement can bear a latent evaluative value paraphrasable as "skilfully, though not necessarily honestly", it is possible to force a speaker-oriented reading of the adverb when it is detached to the left. This interpretation is easily accessible if the adverb is intensified, which would be clumsy with a domain adverbial, since they are supposed to be ungradable:

(12) Très diplomatiquement, elle a oublié de répondre.

'She forgot to answer, which I think was a very skilful decision.' Incidence and scope variations are not compatible with the claim that -ly or -mente adverbials form a homogeneous group. Which are the levels that should be taken into consideration for a more finegrained taxonomy? For instance, can syntax help differentiate between low and high adverbs? Or between low and high adverbial positions that can be occupied by the same lexical items? Or is the interpretation of adverbs forced by other factors such as the lexical meaning of the derivation root, or maybe the meaning of the verbal predicate?

"High adverbs"

Positional criteria can help distinguish subclasses of adverb(ial)s. Just as for peripheral adverbial clauses, these apparent "manner adverbs" can actually modify the illocutionary layer of the clause rather than the predication.

(13) Bêtement, il a répondu au juge.

'Stupidly, he gave an answer to the judge.' (evaluative, wide scope: he gave an answer to the judge, and that was stupid of him). ( 14) Il a répondu bêtement au juge.

'He gave a stupid answer to the judge.' (manner adverbial, narrow scope).

In this case, they are to be considered as illocutionary modifiers, raising a new series of questions about incidence, scope and semantic orientation. Adverbs taking wide scope are traditionally called "sentence adverbs": an adverb, according to the traditional definition, is due to modify not only a verb, an adjective, another adverb, but also a larger unit, including the propositional content of the whole clause. Sentence adverbs are said to scope over the propositional content and to express the speaker's position relative this content. Since they do not participate in the propositional content itself, they cannot be clefted and are not licit under the scope of the propositional negation. But this adverbial class leaves aside Greenbaum's style disjuncts (1969: 81-93) as well as the so-called domain adverbs, since both do not express any commitment of the speaker to the content. Besides, as Aquiles Tescari Neto points out ("Sentence adverbs don't exist!"), the propositional content is not necessarily the only relevant level of incidence for these adverbs. For instance, in example ( 15), depending on the prosody of the clause, provavelmente can take scope directly and solely over the propositional content (paraphrase 15a) or be associated with a specific constituent under contrastive stress ( 15b This leads to the conclusion that the syntactic status of an adverb is independent from its domain of modification: sentence adverbs do not correspond to a category per se, but to a constructional phenomenon or a function. In languages such as English and French, this function is mainly assumed by an homogeneous morphological class. But, as shown by Fryni Kakoyianni-Doa ("Formal and functional features of modal adverbs in French and Modern Greek"), a comparative study of modal adverbs reveals that the suffixation of this adverbial subgroup is more diverse in Modern Greek. On the contrary, French and Modern Greek share much more similarities on the syntactic level. This finding tends to confirm the hypothesis according to which modal adverbs, and more generally sentence adverbs, are in fact functions. Adverbial orientation is a very important criterion: it makes it possible to draw a border between adverbs expressing circumstances of time, place, cause, purpose, etc., which have no orientation, and subject-oriented adverbs and speaker-oriented adverbs. It also makes it possible to differentiate speaker-oriented adverbs, i.e. adverbs expressing the position of the speaker towards the propositional content, from subject-oriented adverbs. According to [START_REF] Jackendoff | Semantic interpretation in generative grammar[END_REF], speakeroriented adverbs are distinguished from manner adverbs by the fact that S' contains the surface subject and is embedded in an attributive structure containing the adjective and a reference, which may be implicit, to the speaker: (16) Evidently, Frank is avoiding us. 'It is evident (to me) that Frank is avoiding us.' (17) Happily, Frank is avoiding us. 'I am happy that Frank is avoiding us.' (Jackendoff 1972: 69) Subject-oriented adverbs are distinguished from manner adverbs by the fact that S' is embedded in an attributive structure containing the corresponding adjective and a nominal phrase representing the surface subject (18b to 18d, compared to the investigated adverbial construction, represented in 18a):

(18) a. Carefully, clumsily(,) John spilled the beans.

b. John was careful to spill the beans. c. It was clumsy of John to spill the beans. d. John was clumsy in spilling the beans. (Jackendoff 1972: 70) The notion of orientation however raises a syntactic problem : a subject-oriented adverb, whether it is an agent-oriented adverb or a mental attitude adverb [START_REF] Ernst | The syntax of adjuncts[END_REF], says something about the subject. Speaker-oriented adverbs, on the other hand, do not necessarily say much about the "speaker", i.e. the bearer of the illocutionary act: the status of the speaker variable in ( 16) and ( 17) is not the same. Unlike ( 17), example ( 16) cannot be paraphrased as "I am evident that Frank is avoiding us". Similarly, (19) cannot be paraphrased as "I am unfortunate that Frank is avoiding us", but only as "It is unfortunate that Frank is avoiding us":

(19) Unfortunately, Frank is avoiding us.

Is it the speaker who uses the adverb to say something about the propositional content -or rather the epistemic judge? Or another bearer of propositional attitudes [START_REF] Gévaudan | Sprachliche Modalität zwischen Illokution und Polyphonie[END_REF])? The answer is certainly not the same for all "speaker-oriented" adverbs, which probably have to be split into a series or even a cascade of functional subcategories, as proposed by Greenbaum for more than half a century [START_REF] Greenbaum | Studies in English adverbial usage[END_REF], under special consideration of fronted and detached adverbs in English). This enterprise has been pursued independently by many scholars. The study of [START_REF] Cinque | Adverbs and functional heads[END_REF] on the functional hierarchy of adverbial heads played a major role in the renewed interest in adverbial syntax in the last twenty years. Functional semantics have also delivered valuable criticisms of speaker-orientation, e.g. [START_REF] Franckel | Mots du discours, adéquation et point de vue: l'exemple de réellement, en réalité, en effet, effectivement[END_REF] and [START_REF] Paillard | Scène énonciative et types de discursifs[END_REF], on French.

Agent-and subject-orientation: From semantic orientation to syntactic hierarchy

"Subject-orientation" is an even trickier category than speaker orientation. [START_REF] Ernst | The syntax of adjuncts[END_REF] distinguishes agent-oriented adverbs from mental attitude adverbs: (Ernst 2002: 63) In the first case, the agent is the entity controlling the process, i.e. the entity that can "choose not to do some action, enter into a state, etc." (Ernst 2002: 55). In the second case, the subject is not the agent, but the experiencer, i.e. the entity having during the process the state of mind expressed by the adverb.

The first type of adverb differs from the manner adverb (She left rudely) in that the latter describes a way of doing the action denoted by the verb (leave, get out) or of being in the space (lay), but not a property of the agent during the action or the position. The second type differs from the manner adverb (she had left the room calmly) in that the subject does have the state of mind expressed by the adverb during the process, whereas this is not the case for the manner adverb (Ernst 2002: 66). In other words, one can leave a room calmly, without being calm during the process of leaving. This description, however, raises two problems. First of all, it is not clear whether the controller is both responsible for the process (action or position) and its continuation. Ernst uses the example of position (John wisely lay on the bed) to enlarge the notion of agent, but he indicates at the same time that the agent is not responsible for this position. In the former cases (rudely, she left; John wisely got out of bed), on the other hand, the agent is at the origin of the process and is responsible for its continuation too. Moreover, how can we distinguish the agent from the experiencer in She had calmly left the room, knowing that the subject is also the controller of the process? In addition to the notion of orientation, we face a second problem: How can the notion of control be defined in such a way as to distinguish the agent from the experiencer?

However limited and insufficient, the notion of "orientation" should not be rejected altogether, since it is very useful to distinguish manner adverbs. As Guimier (1991: 33) pointed out, in (24), inutilement 'in vain' is "attracted to the verb":

(24) Pierre travaille inutilement. 'Peter works in vain.' But in (25), joyeusement 'happily' is "attracted to the subject":

(25) Pierre travaille joyeusement. 'Peter works with glee.' Finally, in (26), méticuleusement 'carefully' is "attracted to the verb and the subject":

(26) Pierre travaille méticuleusement. 'Peter works carefully.' Unlike the subject-oriented adverb as defined by Ernst, the manner adverb does not relate exclusively to the subject, it also has a relationship with the predicate. It would therefore be tempting to establish a functional classification of manner adverbs: a. The adverb is attracted to the subject, as in (25); b. It is attracted to the verb, as in (24); c. These forces of attraction balance each other, as in (26). This double attraction, the fact that the manner adverb oriented towards the subject does not relate exclusively to the subject and the fact, by symmetry, that the manner adverb oriented towards the verb does not relate exclusively to the verb, make it possible to assume that the manner adverb is defined by a double relation: a relation of determination allowing one to subcategorize the action performed by the subject (relation to the verb), a relation of predication allowing one to attribute a property to the subject within the framework set by the predicate (relation to the subject). These fine-grained distinctions are at the heart of Jian Courteaud Zhang's contribution on subjectoriented adverbials in Chinese, which is elaborated from a contrastive perspective ("Different types of subject-oriented adverbials in French and in Mandarin Chinese: a contrastive study"). Zhang also addresses important methodological issues for the cross-linguistic comparison of manner adverbials, sentence adverbials and semantic phenomena of subject-orientation, such as the value of classical syntactic tests used in several Standard Average European languages but cannot be applied to Chinese. However, drawing on semantic and information-structural tests, Zhang manages to isolate three cross-linguistic classes of subject-oriented adverbials with different incidence properties (subject-predicate manner adverbials, subject-oriented sentence adverbials and subjectdescribing adverbials).

Such fine-grained descriptions make it possible to classify adverbs according to their distance from the lowest hierarchy node of the VP, and to account for functional changes due to their syntactic position in the hierarchical structure of the clause, very much in the spirit of both [START_REF] Dik | The hierarchical structure of the clause and the typology of adverbial satellites[END_REF] and [START_REF] Cinque | Adverbs and functional heads[END_REF] and exemplified in this volume by the contribution of Aquiles Tescari-Neto (see above). Indeed, the elements found on the different layers are not fixed. The adverbials of instrument for example [START_REF] Duplâtre | Un constituant invisible obligatoire[END_REF], are very close to manner, in that they presuppose a controller. They can even create the illusion of manner when manner is not made explicit. This phenomenon is due to the fact that manner is presupposed by action verbs (cf. Dik 1997: 228). Thus, when the slot reserved for manner is empty, i.e when manner is not realized on the surface, heterogeneous elements such as instrumental indications, but also indications of place (27), time ( 28 Unlike English nightly, French nuitamment does not only mean "during the night", but also "in secret" (Nilsson-Ehle 1941: 206-207). Thus, this adverb, which a priori expresses time, can, given that the controller chooses precisely to carry out the action at night, be transformed into a manner adverb and provide indications about the subject and the action carried out. This semantic shift can also be observed with French adverbs such as brusquement 'abruptly', which are transformed into aspectual complements [START_REF] Duplâtre | Un constituant invisible obligatoire[END_REF]):

(30) a. Il me parla brusquement. 'He spoke to me abruptly.' b.

Il partit brusquement. 'He left abruptly.'

Finally, brusquement can be used to mark discourse-relative temporality ('then, all of a sudden'), which corresponds to an even higher position in the functional hierarchy: c. Le ciel était serein; brusquement, l'orage éclata. 'The sky was serene; suddenly, the storm broke out.'

Domain adverbs and adverbials

Domain adverbials are free from any selectional restriction between them and the rest of the verb phrase. In Germanic and Romance, they are usually placed at the beginning of the utterance and are often detached from the rest of the clause. From a semantic point of view, they are used to restrict the content of the clause only to the frame of validity which they denote. As [START_REF] Maienborn | Adverbs and adverbials[END_REF] point out, the content of the clause with the adverb/adverbial does not entail the content of the clause without the adverbial. Thus, it would probably be more accurate to call these adverbials "adverbials of relative validation". For instance, in the Spanish example below (ex. 31), the speaker states that selling football player Lionel Messi in the Summer of 2020 would have been the right thing to do from an economic (here: financial) point of view for his employer. However, this does not mean that it was the right thing to do in general:

(31) Económicamente hubiera sido deseable vender a Messi en verano. 'Economically, it would have been preferable to sell Messi this Summer.' (El Periódico, Dec. 3 rd , 2020) By contrast, in example (32), económicamente is constructed as a VP-internal manner adverbial depending from the verb apoyar, "to support":

(32) La 'caja de solidaridad', creada por las entidades soberanistas en el 2017 y reconvertida en una fundación dedicada a recoger fondos para apoyar económicamente a investigados judicialmente por el 'procés', ya se está movilizando. 'The 'solidarity office', which was created by sovereignist entities in 2017 and reconverted into a foundation that raises funds aimed at supporting economically those who have been charged by the judiciary power in the circumstances of the independence process, has already begun to mobilize.' (El Periódico, July 6 th , 2021) Domain adverb(ial)s and framesetting adverb(ial)s raise challenging questions as to the scope of adverbials and the relevance of the distinction between sentence adverbials or wide-scope adverbials and circumstantial adjuncts. As was already pointed out by [START_REF] Charolles | L'encadrement du discours: Univers, champs, domaines et espaces[END_REF], many framesetters tend to be recruited from domains like space, time or conditions, which are also among the classical domains denoted by circumstantial adjuncts. But according to him, framesetting adverbials take scope over the whole utterance, not only the predicate, and they sometimes introduce text sequences that can encompass several utterances. In English an in Romance languages, many domain adverbials are formally akin to "manner adverbials", since they are formed with suffixes such as -ly or -mente. Once again, syntactic position helps discriminate between various interpretations, e.g. between the two readings of económicamente (Spanish, "economically") in the example above. [START_REF] Rizzi | Locality and left periphery[END_REF] claims that the hierarchical position of preposed adverbs is in the functional "left periphery", i.e. above the representational layer, within the cascade of illocutionary and information-structural heads postulated in the cartographic programme. For Rizzi, these adverbials are neither topics, nor foci. He claims that their position lies between Force and Fin, and characterizes it Mod(ifier). This is in line with the semantic and pragmatic view defended by [START_REF] Maienborn | On the position and interpretation of locative modifiers[END_REF], among many others: domain adverbials are restrictive devices that set the scene for the rest of the sentence.

The contribution by Martina Werner and Nina C. Rastinger takes a morphological stance on this issue and investigates two derivation patterns that seem to be specialized for domain adverbials ("Domain adverbials and morphology: the rivalry between -mäßig and -technisch in German"). Superficially, -mäßig and -technisch form denominal adjectives, but the authors show that they have developed an adverbial usage that is restricted to domain adverbials in the case oftechnisch, whereas -mäßig-formations displays uses as domain adverbials and as qualitative adverbials. Their corpus study also reveals that -technisch is the more productive suffixoid, so that German seems to be developing a conventionalized formation pattern that is reserved for domain adverbials designating a notional domain to which the validity of the predicate is restricted.

The syntax of domain adverbials and the absence of selectional restrictions between them and the content of the clause, point to an "outsider status" for adverbials, which are not integrated into the core structure of the verbal phrase. This is in line with the terminological choices made by scholars for whom adverbials express a point of view [START_REF] Mørdrup | Une analyse non-transformationnelle des adverbes en -ment[END_REF][START_REF] Molinier | Grammaire des adverbes[END_REF] or designate a limit (Nilsson-Ehle 1941, [START_REF] Bartsch | Adverbialsemantik[END_REF], Nøjgaard 1993), a frame [START_REF] Schlyter | La place des adverbes en -ment en français[END_REF] or a domain [START_REF] Bellert | On semantic and distributional properties of sentential adverbs[END_REF], Nolke 1990[START_REF] Guimier | Les adverbes du français[END_REF][START_REF] Ernst | Domain adverbs and the syntax of adjuncts[END_REF][START_REF] Maienborn | Adverbs and adverbials[END_REF][START_REF] Grübl | What are 'domain adverbs' and what functions do they have? Paper presented in the online Conference Adverbs and Adverbials: Categorial Issues[END_REF][START_REF] De Cesare | Domain adverbials in the news. A corpus-based contrastive study of English, German, French, Italian and Spanish[END_REF]: the meaning of the domain adverbial is not part of the state of affairs denoted by the clause. It helps characterise the mental space against the background of which that very state of affairs is set [START_REF] Fauconnier | Espaces mentaux[END_REF]. In Cognitive Grammar terms (Langacker 1987), domain adverbials are used to ground a propositional unit made up of the predicate, its arguments, circumstantial adjuncts, and possibly even (some) epistemic modals. According to [START_REF] Duplâtre | Incidence de second degré et adverbe. Utilité de cette notion dans la redéfinition syntaxique de l'adverbe[END_REF], domain adverbials are secondary predicates mapped onto the clausal unit as a whole. In turn, this operation yields a new, complex discourse unit, of which the domain adverbial is a part.

A major question to solve here is the definition of what is to be called a "domain of validity". Some scholars lump together all adverbs/adverbials expressing not only a notional domain, but also a point of view, a frame or a limit [START_REF] Charolles | L'encadrement du discours: Univers, champs, domaines et espaces[END_REF][START_REF] Franckel | Mots du discours, adéquation et point de vue: l'exemple de réellement, en réalité, en effet, effectivement[END_REF]. Thus, the proposed adverbial class would include English items like politically, botanically, linguistically, but also personally, in my opinion, essentially, in practice, in a sense, etc. At least at first glance, the result is a rather heterogeneous class, and further internal distinctions are needed, as demonstrated by [START_REF] Grübl | What are 'domain adverbs' and what functions do they have? Paper presented in the online Conference Adverbs and Adverbials: Categorial Issues[END_REF]. The contribution by Anna-Maria De Cesare ("Framing, segmenting, indexing: Towards a functional account of Romance domain adverbs in written texts") addresses a broad range of phenomena and extensively discusses previous accounts in the literature. This chapter offers a comprehensive synthesis, according to which it is possible to distinguish three main classes within this broad set:

 domain adverbs expressing a notional domain;  viewpoint adverbs or adverbials, which in addition to domain adverbs/adverbials, include adverbs such as personally and adverbial expressions such as in my opinion;  limitative adverbs, which, besides domain adverbs, encompass terms such as essentially, globally, strictly and adverbial expressions such as in theory, in a sense, etc.

Concluding remarks

The studies presented in this volume present converging cross-linguistic data to suggest that traditional definitions insisting on morphological invariability and dependency from the verb or the verbal phrase should be taken with much caution. The same holds for binary distinctions such as predicate adverb vs. sentence adverb or for labels that may be erroneously taken as homogeneous categories, such as "subject-oriented adverbs" or "domain adverbs". However, there are also converging signals that adverbial morphology is not a jungle void of any regularity: there are indeed language-specific morphological types of adverbs corresponding to homogenous functional sets, as shown by Delhem and Sanchez-Stockhammer & Unwin on English, but also to some extent by Courteaud Zhang, who shows that in Chinese, morphosyntactic procedures at the interface of syntax and derivation are used to distinguish thoroughly between subject-oriented sentence adverbials and all kinds of predicate-internal subject-oriented adverbials. At the micro-functional level, Werner & Rastinger demonstrate the rise of a specialized formation pattern for adverbials of notional domain in German. In all three languages, morphological regularities can be studied while keeping some distance towards traditional parts-of-speech models. This emancipation of adverbial morphology from parts-of-speech distinctions is also highlighted in the contribution by Ignazio Mirto, who lays the foundation of paradigms of competing morphosyntactic procedures corresponding to neighbouring functional properties. The determination of a specific word-class of "adverbs" should not be the starting point of the study; it is much rather a possible result of the analysis of set of morphosyntactic properties associated with semantic regularities. For this reason, it is highly important to establish a set of cross-linguistically valid syntactic tests. The contrastive contributions by Kakoyanni-Doa and Courteaud Zhang, addressing Greek and Chinese respectively, both discard several usual tests of Romance and Germanic adverbial research, but they also confirm that the various functional types of adverbials can be distinguished alongside properties located at the interface of syntax and information-structure (most prominently negation, focalization, interrogation). All these data suggest that functional semantics are the starting point. In other words: adverbials should be used as the more basic concept, before determining whether a functional (sub-)class has partly conventionalized into a lexical class. Adverbs form an unstable, secondary part-of-speech even in languages that supposedly display a morphological class of adverbials, as shown by Albers's study of how stable German adverbs can be re-adjectivized under the pressure of ambiguous constructions: it is not only adverbs that arise from the specialization of adjectival forms; morphologically simple adverbs can fall into the adjectival category where they had never belonged. Thus, there is no unidirectional movement towards the establishing of a barrier between adjectives and adverbs.

Among the semantic regularities that can be observed, a common denominator is the notion of attribution onto the predication. This attribution may take the form of proper determination, but also of secondary predication, either onto a constituent of the proposition or onto the predication as a whole, operating from different levels. The contributions by Tescari-Neto and Kakoyanni-Doa highlight the fact that notions such as "sentence adverbials" or "modal adverbials" should be taken cum grano salis, yet they also isolate stable semantic properties as well as a shared position in the functional hierarchy of the clause. Chinese may be radically different in its morphosyntactic characteristics, yet here, too, a thin line of semantic properties linked to incidence but not reducible to it can be distinguished along lines that are similar to those of Romance, for instance. The same is true for "domain adverbials", as was shown by Werner & Rastinger, who were able to isolate a formally consistent set of adverbials of notional domain, and by De Cesare, whose syntactic and semantic study paves the way to a clear-cut, three-way functional typology of domain adverbials. As a result, it appears that adverbs become a problem only if their categorial definition and their classification is taken for granted from the beginning. Starting from a comparative concept of adverbial modification, more fine-grained functional and formal sets of properties emerge, which do not define one "part-of-speech", but several functional classes that bear a family resemblance and display noticeable similarities throughout language families. It is hard to claim that any other "word-class" is significantly more consistent than that from a cross-linguistic point of view. In this respect, adverbs do not make up a "dustbin category": they only invite us to more humility in the definition of categories in general.

List of abbreviations

F: feminine gender; N: neutral gender

( 20 )

 20 Rudely, she left. (Ernst 2002: 57) (21) John wisely got out of bed. (Ernst 2002: 55) (22) John wisely lay on the bed. (Ernst 2002: 55) (23) She calmly had left the room.

  ), or frequency (29), etc., can occupy the slot left vacant.

	(27) a.	Il dort à même le sol.
		'He sleeps directly on the floor.'
	b.	Il dort à la dure.
		'He sleeps in the tough way.' (i.e. without a bed)
	(28) a.	Ils ont agi de nuit.
		'They acted nightly / by night.'
	b.	Ils ont agi nuitamment.
		'They acted nightly / by night.'
	(29) a.	Il boit tous les jours.
		'He drinks every day.'
	b.	Il boit quotidiennement.
		'He drinks everyday.'


Charbel Saliba
email: charbel.saliba@ensea.fr

Laura Luzzi
email: laura.luzzi@ensea.fr

Cong Ling
email: cling@ieee.org

Error Correction for FrodoKEM Using the Gosset Lattice

We consider FrodoKEM, a lattice-based cryptosystem based on LWE, and propose a new error correction mechanism to improve its performance. Our encoder maps the secret key block-wise into the Gosset lattice E8. We propose three sets of parameters for our modified implementation. Thanks to the improved error correction, the first implementation allows to reduce the bandwidth by 7% by halving the modulus q; the second outperforms FrodoKEM in terms of plausible security by 10 to 13 bits by increasing the error variance; and the third one allows to increase the key size. In all cases, the decryption failure probability is improved compared to the original FrodoKEM. Unlike some previous works on error correction for lattice-based protocols, we provide a rigorous error probability bound by decomposing the error matrix into blocks with independent error coefficients.

I. INTRODUCTION

Quantum computers pose a threat since they are capable of breaking most of the cryptographic systems currently in use. Post-quantum cryptography refers to cryptographic algorithms believed to be secure against a cryptanalytic attack by a quantum computer. Lattice-based cryptographic constructions are particularly promising candidates for post-quantum cryptography because they offer strong theoretical security guarantees and can be implemented efficiently. Therefore, lattice-based cryptosystems are considered a safe avenue for replacing the currently used schemes based on RSA and the discrete logarithm. As of now, NIST is assessing and standardizing PQC algorithms. In the third round submissions, three of the four finalists in the public-key encryption and key-establishment algorithms are lattice-based schemes, along with the majority of the alternate candidates.

One of the most widely used cryptographic primitives based on lattices is the Learning With Errors problem (LWE), introduced by Regev [START_REF] Regev | On lattices, learning with errors, random linear codes, and cryptography[END_REF], who proved a worst-case to average-case reduction from the shortest independent vector problem (SIVP) to LWE. It can be used to build a variety of cryptographic algorithms and provides guarantees in terms of IND-CPA and IND-CCA security. Later works introduced structured variants of LWE such as Ring-LWE [START_REF] Lyubashevsky | On ideal lattices and learning with errors over rings[END_REF] and Module-LWE [START_REF] Langlois | Worst-case to average-case reductions for module lattices[END_REF] which involve ideal lattices and module lattices respectively. Their cryptographic applications are generally more efficient compared to LWE. However, in principle the additional algebraic structure might make these variants more vulnerable to attacks. Although currently there are no specific known attacks targeting Ring-LWE or Module-LWE, much progress has been made in recent works to exploit the structure of ideal lattices and module lattices to solve lattice problems [START_REF] Cramer | Recovering short generators of principal ideals in cyclotomic rings[END_REF]- [START_REF] Bernard | Twisted-PHS: Using the Product Formula to Solve Approx-SVP in Ideal Lattices[END_REF]. Thus, although the Module-LWE based scheme Kyber [START_REF] Avanzi | Crystals-Kyber algorithm specifications and supporting documentation[END_REF] was selected as a finalist for the NIST PQC standardization Round 3, the plain-LWE scheme FrodoKEM [START_REF] Naehrig | FrodoKEM. tech. rep[END_REF] was selected as an alternate candidate which may provide longer-term security guarantees since it is less susceptible to algebraic attacks. From the NIST's perspective, although FrodoKEM can be used in the event that new cryptanalytic results targeting structured lattices emerge, the first priority for standardization is a KEM that would have acceptable performance across widely used applications.

In this paper, we aim at improving the bandwidth efficiency and/or security of FrodoKEM, or at increasing the key size, through an enhanced error correction mechanism. We note that although the current security estimate for FrodoKEM against known attacks is greater than the brute-force security (except for Frodo-1344), the plausible security [8, Section 5.2], which takes into account possible improvements in sieving algorithms, is not. Improving the plausible security would give FrodoKEM better guarantees for long-term security.

A modification of FrodoKEM has been proposed in [START_REF] Lee | Modification of FrodoKEM using Gray and errorcorrecting codes[END_REF] using Gray labeling and error correcting codes in order to improve the performance. However, the decryption failure analysis in [START_REF] Lee | Modification of FrodoKEM using Gray and errorcorrecting codes[END_REF] assumes that the coefficients of the error are independent. Unfortunately this assumption does not hold for FrodoKEM, and as shown in [START_REF] D'anvers | The impact of error dependencies on Ring/Mod-LWE/LWR based schemes[END_REF], it can lead to underestimating the decryption failure by a large exponential factor.

In this work, we propose a different approach where enhanced error correction is obtained through lattice encoding and decoding rather than using error-correcting codes. More precisely, our encoder maps the secret key block-wise into the Gosset lattice E 8 . Lattice codes were used in previous works for Ring-LWE based cryptosystems, such as the reconciliation mechanism based on the D4 lattice for NewHope [START_REF] Alkim | Post-quantum key exchange-a new hope[END_REF]. Due to its optimal density and low-complexity quantization, the E 8 lattice was already used in KCL [START_REF] Zhao | A modular and systematic approach to key establishment and public-key encryption based on LWE and its variants[END_REF], a first round NIST candidate. In our previous work [START_REF] Saliba | A reconciliation approach to key generation based on Module-LWE[END_REF], the E 8 lattice was employed to improve the security of the Module-LWE based candidate KyberKEM.

The choice of an 8-dimensional lattice encoder is well-suited to the parameters of FrodoKEM. In fact, due to its particular structure, the error matrix can be decomposed into 8 blocks of 8 independent components, which makes a rigorous decryption error analysis possible. The encryption function used by the original FrodoKEM implicitly uses the cubic lattice Z 64 ∼ = Z 8 8 . Accordingly, switching from Z 8 to E 8 allows us to improve the security or bandwidth. We propose three sets of parameters for our modified implementation. Thanks to the improved error correction, the first implementation allows to reduce the bandwidth by 7% by halving the modulus q, the second improves the security level by 10-13 bits by increasing the error variance, and the third allows to generate 192 bits from Frodo-640 instead of 128 bits, as well as 256-bit key instead of 192 bits in Frodo-976, with comparable security and error probability.

Organization: This paper is organized as follows. In section II, we provide essential mathematical and cryptographic background for our work, then we develop the proposed modification for FrodoKEM in section III. Section IV gives an upper bound for the decryption error probability for our algorithm, while section V derives its security analysis. In the last section, we show the improvements made with regard to security, bandwidth and key size.

II. NOTATION AND PRELIMINARIES

a) Notation: Given a set A ⊆ R n , |A| stands for its cardinality. All vectors and matrices are denoted in bold. The function sign(•) outputs 1 for positive real input (including zero) and -1 for strictly negative one. For x ∈ R n we denote x to be the rounding function of each component of x, where ±1/2 is rounded to 0. We also denote x to be the same as x except that the worst component of x -that furthest from an integer -is rounded the wrong way. More formally, if i 0 = argmax

i |x i -x i |, then x i = x i + sign (x i ) • sign (|x i | -|x i | ) if i = i 0 and x i = x i if not. A constant vector (α, . . . , α) ∈ R n is denoted by α.
For a, b ∈ Z, the operation (a+b) mod 2 is simplified to a⊕b.

b) Lattice definitions and properties: An n-dimensional lattice Λ is a discrete subgroup of R n that can be defined as the set of integer linear combinations of n linearly independent vectors, called basis vectors. The closest lattice point to x ∈ R n is denoted by CVP Λ (x), and the Voronoi region V (Λ) is the set of all points x ∈ R n for which CVP Λ (x) = 0. The volume of a lattice, which is a lattice constant, is defined to be the volume of its Voronoi region. The Voronoi relevant vectors of Λ are the vectors λ ∈ Λ such that x, λ < x 2 for all x ∈ Λ \ {0, λ}. The minimal distance of the lattice is defined as

λ 1 (Λ) := min v ∈ Λ \ {0}
||v||.

c) The Gosset lattice: We introduce the 8-dimensional lattice E 8 [14, p.121] which will be used throughout this paper. This lattice has a unit volume, and is generated by the rows of the matrix

G E8 =         2 0 0 0 0 0 0 0 -1 1 0 0 0 0 0 0 0 -1 1 0 0 0 0 0 0 0 -1 1 0 0 0 0 0 0 0 -1 1 0 0 0 0 0 0 0 -1 1 0 0 0 0 0 0 0 -1 1 0 1/2 1/2 1/2 1/2 1/2 1/2 1/2 1/2        
The Voronoi relevant vectors of E 8 form two sets: VR 1 which contains the first type of the form (±1 2 , 0 6 ), and VR 2 which contains (±0.5 8 ) as the second type. Note that |VR 1 | = 112 and |VR 2 | = 128, so that the total number of Voronoi relevant vectors is 240.

d) Error distribution: The error distribution required for the LWE problem defined in the next section is ideally a Gaussian-like distribution. Let D σ (x) = 1 √ 2πσ exp -x 2 /2σ 2 denotes the probability density function of a zero-mean continuous Gaussian distribution with variance σ. A rounded Gaussian distribution Ψ σ is obtained by rounding a sample from D σ to the nearest integer.

As in the FrodoKEM specifications [START_REF] Naehrig | FrodoKEM. tech. rep[END_REF], we use a discrete and symmetric distribution χ on Z, centered at zero and with finite support {-s, . . . , s}, which approximates a rounded Gaussian distribution. In our case, χ is generated for different values of σ and the support {-s, . . . , s} depends on the chosen σ value. In a more detailed manner, given the target standard deviation σ, we first construct a function χ on {-s, . . . , s} ⊆ Z as follows:

∀i ∈ {-s, . . . , s}, χ(i) = 1 2 16 2 16 • [i-1 2 ,i+ 1 2 ] D σ (x)dx .
The distribution χ is obtained from χ by making small changes in the numerator values of χ(i) in order to obtain a probability distribution (the whole sum ends up to be 1) The sampling algorithm for such a distribution is given in [8, Algorithm 5], and it is resistant to cache and timing side-channels. The distance between Ψ σ and χ is measured according to the Rényi divergence, which indicates how far a discrete distribution P is from another distribution Q. More formally, for a given positive order α = 1, the Rényi divergence between P and Q is defined as

D α (P ||Q) = 1 α -1 ln   x∈suppP P (x) P (x) Q(x) α-1   .
The Rényi divergence can be used to relate the probabilities of an event according to P or Q [8, Lemma 5.5]. This justifies why replacing the rounded Gaussian with a distribution which is close in Rényi divergence will preserve the security reductions [START_REF] Naehrig | FrodoKEM. tech. rep[END_REF]Corollary 5.6]. We use the script scripts/Renyi.py in [START_REF] Alkim | Post-quantum key exchange-a new hope[END_REF] to compute the Rényi divergence between our chosen distribution χ and the rounded Gaussian.

e) LWE problem: The security of FrodoKEM and our modified version is based on the hardness of the LWE problem [START_REF] Regev | On lattices, learning with errors, random linear codes, and cryptography[END_REF]. Let n and q be positive integers, and χ an error distribution over Z. Take s to be a uniform vector in Z n q . The problem consists in distinguishing uniform samples (a, b) ← Z n q × Z q from (a, a, s + e), where a $ ← -Z n q is uniform and e χ ← -Z q . We use a variant of the original LWE problem, for which the secret s is sampled from χ rather than U. A polynomial reduction to the original decision LWE is given in [START_REF] Applebaum | Fast cryptographic primitives and circular-secure encryption based on hard learning problems[END_REF]. f) FrodoPKE: This section presents the basic algorithm of FrodoPKE [START_REF] Naehrig | FrodoKEM. tech. rep[END_REF], which can be transformed into an IND-CCA secure KEM called FrodoKEM [START_REF] Naehrig | FrodoKEM. tech. rep[END_REF] using the Fujisaki-Okamoto (FO) transform [START_REF] Hofheinz | A modular analysis of the Fujisaki-Okamoto transformation[END_REF], keeping the error probability unchanged. FrodoPKE is designed to guarantee IND-CPA security at three levels: Frodo-640, Frodo-976 and Frodo-1344. The security of these levels matches the brute-force security of AES-128, AES-192 and AES-256 respectively. Each level is parameterized by an integer dimension n such that n ≡ 0 mod 8, a variance σ and a discrete error distribution χ Frodo which is close to the rounded Gaussian Ψ σ in Rényi divergence. The LWE modulus q in FrodoPKE is either 2 14 or 2 15 depending on what level is adopted. A sketch of the algorithm is given in Table I

A $ ← -Z n×n q S, E ← -χ n×n Frodo S , E ← -χ n×n Frodo , B := AS + E ∈ Z n×n q (A,B) ----→ E ← -χ n×n Frodo U := S A + E ∈ Z n×n q V := S B + E ∈ Z n×n q m $ ← -{0, 1} V := C -US ∈ Z n×n q (U,C) ← ----C = V+FRODO.ENCODE(m) m = FRODO.DECODE(V )

TABLE I SIMPLIFIED DESCRIPTION OF THE ORIGINAL FRODOPKE

III. PROPOSED MODIFICATION OF FRODOPKE

With the choice of parameter n = 8 in FrodoKEM [START_REF] Naehrig | FrodoKEM. tech. rep[END_REF], the message m ∈ {0, 1} is encoded into a point of Z 64 q . In this section, we propose a modified version of FrodoPKE where the encoder maps the key into a suitably scaled version of the 64-dimensional lattice E 8 8 , i.e. the product of 8 copies of the Gosset lattice. Since E 8 is the densest 8-dimensional packing, this results in a more efficient encoding. Since all integer operations in FrodoPKE are performed modulo q, we identify the lattice points that are equivalent modulo qZ 64 .

Referring to Table I, the main adjustments are made for the encryption and decryption algorithms FRODO.ENCODE(•) and FRODO.DECODE(•) respectively. Following the approach in [START_REF] Van Poppelen | Cryptographic decoding of the Leech lattice[END_REF], we search for a suitable scaling parameter β such that qZ 64 ⊆ (βE 8 )

8 ⊆ Z 64 , knowing that 2Z , is greater than or equal to 2 . This condition is verified by setting β = q/2 /64 ∈ {q/4, q/8, q/16} for ∈ {128, 192, 256}.

The construction of the encoder is as follows. First, m ∈ {0, 1} is partitioned into 8 substrings m i ∈ {0, 1} /8 , i = 0, .., 7. Each substring is mapped into βE 8 /qZ 8 ⊆ Z 8 . For simplification, each element in βE 8 /qZ 8 is identified with the corresponding coset leader in E 8 /2 /64 Z 8 . As an example, for = 128, the value of β is q/4. Hence mapping 8 bits of information into E 8 /2Z 8 allows to map 16 bits into

E 8 /4Z 8 . Let f : {0, 1} 8 -→ E 8 /2Z 8 that maps b = [b 1 , b 2 , . . . , b 8 ] ∈ {0, 1} 8 as follows:          f (b) = [b 1 , . . . , b 7 , -1] • G E8 mod 2 if b 1 = 0 && b 8 = 0 f (b) = [b 1 , . . . , b 7 , 0] • G E8 mod 2 if b 1 = 0 && b 8 = 1 f (b) = [b 1 , . . . , b 7 , 1] • G E8 mod 2 if b 1 = 1 && b 8 = 0 f (b) = [b 1 , . . . , b 7 , 2] • G E8 mod 2 if b 1 = 1 && b 8 = 1
One can verify that f is a bijective function. We can map 16 bits into the quotient E 8 /4Z m i : i=0,...,7 = (m i( /8) , . . . , m i( /8)+ /8-1 ) ∈ {0, 1} 8 3:

X i : i=0,...,7 = f (m i,0 , . . . , m i,7 ) ∈ E 8 /2Z 8 4:
X i : i=0,...,7 = g(m i,8 , . . . , m i, /8-1 ) ∈ 2Z 8 /2 /64 Z 8 5:

R i : i=0,...,7 = X i + X i ∈ E 8 /2 /64 Z 8 ∼ = βE 8 /qZ 8 6: return O i,j = R (8-i+j) mod 8,j 0≤i≤7 0≤j≤7 Note that each substring m i is mapped into a vector in Z 8 , which is encoded in a block BLOCK i (O) = (O i mod 8,0 , . . . , O i+7 mod 8,7 ) (1)
of 8 components of the output matrix O. Finally, E8.ENCODE is a bijection from {0, 1} to (βE 8 ) 8 /qZ 64 .

The decoding algorithm E8.DECODE uses the CVP E8 algorithm [START_REF] Conway | Fast quantizing and decoding algorithms for lattice quantizers[END_REF] presented in Algorithm 2 below.

Algorithm 2 Closest Vector Point in E 8 1: function CVP E8 (x ∈ R 8 ) 2: f = x ; g = x 3: y = (1 ⊕ f i ) f + (1 ⊕ g i ) g 4: f = x -1 2 ; g = x -1 2 5: y = (1 ⊕ f i ) f + (1 ⊕ g i ) g + 1 2 6:
return argmin y ∈{y,y }

xy

We describe the decoding protocol in Algorithm 3. It concatenates the outputs of CVP E8 to form an element of (βE 8 )

8 /qZ 64 . Since our lattice E 8 is scaled by β, we use the

fact that CVP βE8 (x) = β • CVP E8 1 β x . Algorithm 3 Gosset Lattice Decoding 1: function E8.DECODE(N ∈ R 8×8 q ) 2: Y i : 1≤i≤8 = β • CVP E8 1 β BLOCK i (N) mod q 3: Y = [Y 1 , . . . , Y 8 ] ∈ (βE 8 ) 8 /qZ 64 4: return m = E8.ENCODE -1 (Y) ∈ {0, 1}
IV. RELIABILITY

In this section we aim to provide an upper bound for the decryption error probability for our algorithm. Clearly, an error occurs whenever the received message m differs from the original one m, i.e., P e = P {m = m }. Following Table I, the expression of V can be simplified as follows:

V = C -US = V + E8.ENCODE(m) -(S A + E ) S = S (AS + E) + E + E8.ENCODE(m) -S AS -E S = E8.ENCODE(m) + S E + E -E S E .
From this we can express the decoded message m as

m = E8.DECODE(V ) = E8.DECODE (E8.ENCODE(m) + E ) = m + E8.DECODE (E ) .
Each entry E i,j in the matrix E is the sum of 2n products of two independent samples from χ, adding to it another independent sample also from χ:

∀ 0 ≤ i, j ≤ 7, E i,j = n-1 k=0 S i,k E k,j -E i,k S k,j + E i,j (2)
The distribution of E i,j , denoted by χ , can be efficiently computed using the product of probability generating functions. Due to equation [START_REF] Lyubashevsky | On ideal lattices and learning with errors over rings[END_REF], two entries of the matrix E which are not on the same row or column are independent, and hence we can extract 8 identically distributed blocks of 8 independent coordinates from this error matrix, just as indicated in equation [START_REF] Regev | On lattices, learning with errors, random linear codes, and cryptography[END_REF]. Decoding is correct whenever E8.DECODE (E ) = 0. For this it is sufficient to have BLOCK k (E ) ∈ V (βE 8 ) for all k = 0, .., 7, i.e.,

BLOCK k (E ) , v < v 2 2 2 , ∀v ∈ β (VR 1 ∪ VR 2 ) .
The error probability can thus be bounded by

Pe ≤ 7 i=0 P ∃ v1 ∈ VR1 : BLOCK k E , v1 ≥ β v1 2 2 /2 + 7 i=0 P ∃ v2 ∈ VR2 : BLOCK k E , v2 ≥ β v2 2 2 /2 (3)
Since the error probability is independent of the choice of Voronoi relevant vector for vectors of the same type (because the distribution of each entry of E is symmetric, centered at 0), without loss of generality we can choose v 1 = (1, 1, 0, 0, 0, 0, 0, 0) and

v 2 = ( 1 2 , 1 2 , 1 2 , 1 2 , 1 2 , 1 2 , 1 2 , 1 2
). This reduces the computations to just two cases. Choosing the value of n and the modulus q, we can compute an upper bound for the above expression for different values of σ. The R.H.S. of equation ( 3) becomes:

8 • 112 • P E 0,0 + E 1,1 ≥ β + 8 • 128 • P E 0,0 + • • • + E 7,7 ≥ 2β .
In order to upper bound P e , we use the following.

Remark 1: A discrete distribution p taking values in Z is unimodal with mode 0 if p(n + 1) ≤ p(n -1) ∀n ≥ 0, and p(n + 1) ≥ p(n) ∀n < 0. The convolution of two symmetric discrete unimodal distributions is symmetric unimodal [START_REF] Dharmadhikari | Unimodality, convexity and applications[END_REF]Theorem 4.7].

Since the distribution χ is symmetric unimodal, so are the distributions χ 2 , χ 4 , χ 8 of the sum of two, four and eight independent copies of E i,j respectively. While χ 2 and χ 4 can be calculated efficiently, the computation of χ 8 is slow. Thanks to unimodality, we can estimate the term P E 0,0 + • • • + E 7,7 ≥ 2β by upper bounding χ 8 by a piecewise constant function.

V. SECURITY a) IND-CPA security: Our scheme only modifies the encoding and decoding functions, the choice of parameters q and σ, and the error distribution. As shown in [START_REF] Naehrig | FrodoKEM. tech. rep[END_REF], the IND-CPA security of FrodoPKE is upper bounded by the advantage of the decision-LWE problem for the same parameters and error distribution [Theorem 5.9, Theorem 5.10]. We note that the security proof relies on the pseudorandomness of the adversary's observation (similarly to [START_REF] Lindner | Better key sizes (and attacks) for LWE-based encryption[END_REF]Theorem 3.2]) and thus the choice of encoding function has no effect on the security level, which is only affected by the parameters and error distribution. In terms of security against known attacks, the best known bound is given by the BKZ attacks, which involve both primal and dual attacks [START_REF] Chen | BKZ 2.0: Better lattice security estimates[END_REF].

b) IND-CCA security: It was shown in [START_REF] Naehrig | FrodoKEM. tech. rep[END_REF] that applying the Fujisaki-Okamoto transformation to the IND-CPA secure protocol FrodoPKE yields an IND-CCA secure key encapsulation mechanism FrodoKEM, even if they use different error distributions, provided that the Rényi divergence between these error distributions is small. In particular, FrodoKEM using the finite support distribution χ Frodo is IND-CCA secure provided that the FrodoPKE protocol using a rounded Gaussian distribution Ψ σ is IND-CPA secure, and the classical IND-CCA advantage Adv ind-cca can be upper bounded by [START_REF] Naehrig | FrodoKEM. tech. rep[END_REF]Equation (3)] ∀α > 1:

qRO |M| + 2•qRO+1
|M| + q RO • P e + 3 • Adv ind-cpa • e t•Dα(P ||Q) 1-1 α where q RO is the maximum number of oracle queries, |M| = 2 is the cardinality of the set of keys, and t = 2n(8+8)+64 is the total number of samples (drawn from the error distribution χ) used to generate E, S, E , S and E in Table I. In our case, P = χ and Q is the rounded Gaussian Ψ σ . The security loss will be minimized by optimizing over the order α.

  . Alice generates A AS + E and outputs a public key (A, B). Bob chooses S , E , E ← χ n×n Frodo , then computes the LWE samples U = S A + E and V = S B + E . A message m in {0, 1} is generated unilaterally on Bob's side and encoded into Z n×n q using the function FRODO.ENCODE(•) [8, Algorithm 1]. Alice recovers m using the decoding mechanism [8, Algorithm 2]. The two messages are the same except with probability P e = P{m = m}. The number of message bits ∈ {128, 192, 256} depends on the assigned security level.

	$ ← -Z n×n q	, then samples S, E ← χ n×n Frodo , computes the LWE
	samples B =

Parameters: q; n ∈ {640, 976, 1344}; n = 8

FrodoKEM's distribution χ Frodo Alice (server) Bob (Client)

  1} to (βE 8 ) 8 /qZ 64 ⊆ Z 8×8 . This function is oneto-one if the number of points in (βE 8 ) 8 /qZ 64 , which is Vol qZ 64 /Vol (βE 8 ) 8

8

⊆ E 8 ⊆ 1 2 Z 8 . Our aim is to define an encoding function from {0,

  8 as follows: map the first 8 bits into E 8 /2Z 8 , and the remaining ones into 2Z 8 /4Z 8 . This last mapping is obtained by simply multiplying the input string by 2. This example can be extended to the cases = 192 and = 256 by considering the chain E 8 ⊇ 2Z 8 ⊇ 4Z 8 ⊇ 8Z 8 ⊇ 16Z 8 . We denote the function that maps the remaining /8 -8 bits by g. The encoding function FRODO.ENCODE(•) can now be changed to E8.ENCODE(•) as shown in Algorithm 1.

	Algorithm 1 Gosset Lattice Encoding
	1: function E8.ENCODE(m ∈ {0, 1} )

2:

TABLE II MODIFIED

 II PARAMETERS FOR IMPROVING THE BANDWIDTH, THE SECURITY LEVEL AND/OR INCREASING THE KEY SIZE FOR FRODOKEM.

The condition σ ≥

2.12 is imposed in[START_REF] Naehrig | FrodoKEM. tech. rep[END_REF] to allow the reduction from the bounded distance decoding with discrete Gaussian sampling (BDDwDGS) to the decision LWE problem. Note that for efficiency reasons, σ is equal to 1.4 in Frodo-1344, while still guaranteeing a large number N of discrete Gaussian samples, namely N ≈ 2 111 . For Frodo-1344 we take σ = 1.15, which still leads to a large number of discrete Gaussian samples, namely N ≈ 2 75 .[START_REF] Lyubashevsky | On ideal lattices and learning with errors over rings[END_REF] The communication requirements of the protocol are computed using the functions Frodo.Pack and Frodo.Unpack presented in[START_REF] Naehrig | FrodoKEM. tech. rep[END_REF]. In our case we pack both U ∈ Z n×n and C ∈ Z n×n . Those two vectors, concatenated together, carry (log 2 (q) × n + log 2 (q) × 8) bytes.[START_REF] Langlois | Worst-case to average-case reductions for module lattices[END_REF] The security level of FrodoKEM with respect to primal/dual attacks is already higher than the brute force security level, but this might change due to improvements in the best known attacks. So this choice of parameters represents an even more conservative option for long-term security.

ACKNOWLEDGMENT

The work of C. Saliba and L. Luzzi is supported by the CY Cergy Paris Université INEX Project AAP 2017.

VI. PERFORMANCE COMPARISON

In this section we show the performance of the proposed modification of FrodoKEM. We propose three sets of parameters: the first aims at improving the security level, the second at reducing the bandwidth and the third at increasing the key size. Note that for all sets of parameters, n and n will remain unchanged. The performance comparison is shown in Table II. The security level refers to the primal and dual attack via the FrodoKEM script pqsec.py with parameters n, σ, q.

a) Parameter set 1 -Reducing the bandwidth: For the first set of parameters, we aim at reducing the bandwidth while keeping the same security level. This is achieved by reducing the modulus q by half, which in turn requires a reduction in standard deviation σ in order to preserve a low error probability 1 . Overall, the modulus to noise ratio of the protocol is increased. Compared to the original FrodoKEM, this allows to reduce the bandwidth by approximately 7% 2 .

b) Parameter set 2 -Improving the security level: For the second parameter set, we aim at increasing the plausible security level 3 while keeping the same bandwidth and a similar error probability level as in the original FrodoKEM protocol. To do so, we increase the variance σ while keeping q unchanged. Note that we can increase σ because of the higher error correction capability provided by our modified encoder. c) Parameter set 3 -Increasing the key size: For the last set of parameters, we aim to increase the key size for Frodo-640 and Frodo-976 with comparable security and error probability. We generate 192 bits from Frodo-640 instead of 128 bits, as well as 256-bit key instead of 192 bits in Frodo-976. The modulus q remains unchanged.