in the street all alone, he is nothing. Alone, he no longer has any power. His power comes from the neighbourhood.' (A young boy from the neighbourhood) This chapter investigates the gap between this young man's sense of how his power derives from the neighbourhood of Sanitas and the practices of 'empowerment' associated with established community development projects in that same neighbourhood. In France, the language of empowerment, associated elsewhere with community development, is more usually associated with 'animation' and 'popular education'. As for community development workers elsewhere, the theoretical foundations laid in the work of Paulo Freire are evident in the histories of Community Associations in the neighbourhood of Sanitas, but this does not appear to create an openness to the young people of the district: a long-standing issue for community development practice in both France and elsewhere. Laclau and Mouffe in Hegemony and Socialist Strategy: Towards a Radical Democratic Politics (2009) claim that deliberative democracy with the will to build consensus oppresses different viewpoints especially with regard to race, class, gender and, we can add, generational perspectives. According to Laclau and Mouffe, it is only with radical democratic methods that oppressive power relations can be made visible, renegotiated and altered.

Starting from this idea, when we talk about radical democracy, we are talking about a praxis coming from the roots of democracy itself; in other words, a praxis far from a set of procedures but rather an infinite process of deconstruction/reconstruction of the substance, forms and limits of collective existence: a dynamic irreducible to any institutional state and coming clearly from grassroots initiatives. Laclau and Mouffe (2009: 269) suggest that if we want to return the original signification to the term 'democracy' in the current neoliberal age, we should accept it 'as a new matrix of the social imagination and as a fundamental nodal point in the construction of politics'. In addition, this should be done in plural ways including all individuals with all their rights as well as all struggles with their claims. This plurality is particularly important: with its democratic logic of the generalisation of equivalence it includes all social and cultural categories in the realisation of a collective participation including youth and children. It is therefore interesting to observe existing practices of democracy from the perspective of youth.

This enables the analysis of how their place is conceivedif it is conceivedin existing democratic practices.

Community development offers a perspective towards social equality in participatory processes. Practising radical democracy in urban space also requires thought about how and with which tools and methods such radical democracy becomes possible. The claim to 'space' is the main base of expression for all these practices. Henri [START_REF] Lefebvre | La Production de l'Espace[END_REF] argued that the production of space not only manifests various forms of injustice but also produces and reproduces them, thereby maintaining established relations of domination and oppression. Therefore, governmental practices in urban policy are not exempt. To resolve and mitigate the effects of this process is to realise the right to the city for everyone according to Lefebvre and this is also a radical approach of democracy in the city, going beyond the classical understanding of participatory democracy. Lefebvre proposes the right to the city as a right of all people living in the city to participate in decisions concerning their everyday life and to exist, with their own lifestyles, identity and cultural habits, in the city. The right to the city is then considered as a resistance to the standardisation of city life, including resistance to standard forms of participation. This necessarily goes beyond the institutions and become a perpetual invention of different forms of democratic participation and expression. In other words, I argue that space and its political construction matters for the realisation of a radical democracy.

This chapter sets out to enquire whether, in a marginalised, low-income neighbourhood with a significant young population, it is possible to see radical democratic practices from the perspective of democratic right to the city despite the weak social capital of residents. Are existing democratic tools, structures and participatory devices efficient and inclusive? Are there spaces, possibilities and a will for including youth in processes of community development? The question here is whether and how different participatory processes, including those conceived by governments in France, are able to build a democratic capacity for citizens or whether [START_REF] Dikeç | Space, governmentality, and the geographies of French urban policy[END_REF].

In 2015, Sanitas had 8,227 residents with a median income of 7,500 euros per year. It is a 93 per cent social-housing district. The population is quite young (48 per cent are under 30 years old) and the working class is overrepresented, as are residents of immigrant origin (27 per cent). Single-parent families are also significant. Among 2,200 families, there are 700 single-mother families. The unemployment rate (22 per cent) is more than twice that of the region (9 per cent). 1 More than half of households live below the poverty line. 2 As such, it is a neighbourhood which might classically be the focus of a community development approach. However, a closer observation of the neighbourhood shows clearly that there are numerous social and cultural initiatives and associations for families, children, cultural and sports activities. As one of the members of an association, ATD Quart Monde, told me, "even if the neighbourhood seems globally poor, it is very rich in terms of cultural and ethnic diversity and this is the treasure of Sanitas" (Beatrice, interview).

The district is located in the city centre of Tours, behind the train station. It has already benefited from regeneration actions in the 1990s and then between 2001 and 2014. Today, it is one of the 200 districts of 'national interest' listed by the state as part of the New National Renewal Program (NPNRU), when a new phase of urban renewal was launched in 2017.

According to this programme, the demolition of 430 social-housing units is planned by 2024, corresponding to 10 per cent of the entire social-housing stock with the objective of introducing further social diversity in the district. The main associations in the neighbourhood struggling for tenant rights, such as the National Confederation for Housing (CNL) and the Association for the Defence of Worker Consumers, are opposed to the demolitions. The representatives of these associations came together in order to create a collective of activists and to organise a mobilisation in the neighbourhood. In 2017, they founded Sanitas Collective in order to stand up for the existing social character of the neighbourhood and against the potential gentrification at the hands of local administration itself.

In Sanitas, besides multiple associations working on concrete themes (help for schoolwork, support for families in poverty and for refugees, food and meal distribution, leisure and sport activities), there are three places of participation where social, cultural and political issues related to the neighbourhood's life are debated and discussed: Sanitas Collective, the Community Centre called Pluriel(le)s and the Citizen Council.

The Collective has about ten permanent members with some other people participating sporadically in meetings and activities. Of the permanent members, half are women and apart from two people, all are over 55 years old. All the permanent members are of French origin and only one occasional participant is of immigrant origin. There are no young people in the collective.

The Pluriel(le)s was created in July 2013 with three main objectives: creating social cohesion, supporting youth and promoting multiculturalism. Supported by the National Family Allowance Fund (CAF) and the City of Tours, it hosts more than 64 associations offering diverse activities. There are 18 people on the Board of Administration, around ten permanent volunteers throughout the year (with a significant turnover) and 13 employees, as well as around 350 members and 2,000 users. While the most of the employees of the centre are relatively young (age 22-40), the majority of its users regularly frequenting the premises are, in the main, either people aged over 40 or children doing schoolwork. The members of the Collective were aware of the fact that the mobilisation was not strong enough, but they believed that this was for structural reasons in the neighbourhood. One member argued that "people are mostly of immigrant origin [and live] in a country [which is] strange to them, they stay silent as they want to stay here permanently, and therefore don't challenge the French authorities" (Jean, interview).

What is interesting in the discourse of the activists of the Collective is the focus on ethnic origin as a barrier to engagement and mobilisation. Despite the presence of a significant young population, whenever someone from the existing community associations wonders why young adults are not engaged in different campaigns and mobilisations in the neighbourhood, the response is limited to an observation of ethnic and racialised barriers. Furthermore, 'youth' is often seen as a separate category of population and not considered as a potential support for engagement and participation but rather as a potential problem: they are seen as the people mostly responsible for the stigmatisation and the marginalisation of the neighbourhood. In this context, elderly residents feel intimidated when they meet young adults in the street: 'I am fed up with the noise in the neighbourhood. The police should install speed bumps in our street because every weekend there are young people coming with their motorcycle and they make urban rodeos. It is unbearable and you cannot tell them to stop unless you want to be targeted and they will be hostile with you.' (Elderly Resident 1, interview) 'There are always young people with their motorcycles and I'm always scared that one day they will accidentally kill a kid.' (Elderly Resident 2, interview)

Another problem related to the young people and mentioned by all people I met in the neighbourhood is drug dealing. One of the activists of the Housing Association, CNL, says:

'Before the urban renewal, there were well-defined corners in the neighbourhood for the drug traffic. Everybody knew that. It was especially around the petrol station and behind the church. Now the petrol station and building near it are demolished and dealers don't know where to go. There are regular police patrols and therefore they are now hiding their dealing inside the buildings and intimidating the residents if they protest against that.' (Pierre, interview)

In fact, among the structures of citizen participation in the neighbourhood, the Community Centre is the only place where young adults can organise and participate in a range of different activities. It is also the sole place where different forms of engagement and participation for youth are encouraged. However, it is also the case that in the Community Centre, their participation is considered separately with an objective of social empowerment in order to turn them away from delinquency or religious radicalism. The director of the Pluriel(le)s explains:

'We must first encourage young people to take initiatives, to set up a project on something they like. They must already be motivated to push open the doors of the Community Centre and to know and participate in the activities offered to them.

Most of them don't even know that we have a specific youth programme, that we have a music and recording studio. Since we widely publicised about Ti'Studio, some young teenagers and adults come to make hip-hop and rap and it allows them to focus on something. Participation in city affairs and democratic bodies is a second step. The latter can't come if they don't first learn to take collective initiatives around small projects.' (Interview, Community Centre director)

There is a tendency to see youth as a monolithic group having the same objectives and characteristics. It is true that in Sanitas, the young population have some similar characteristics including a low level of education (71 per cent of the population has no high school diploma according to the French National Institute of Statistics [INSEE]) and a high level of unemployment. It is nonetheless true that not all the young people of this district can be contained and confined in a single category with the same kind of professional and life objectives. On the whole, the reason for not seeing them in participatory processes and in mobilisations as citizens can be explained by different reasons, which are neither their lack of interest in democratic participation nor their delinquency or segregation within specific 'ethnic' communities. In Sanitas, around 18 per cent of youth between 15 and 24 years are unemployed (INSEE, Main census, 2013). Globally, the unemployment rate among youth in priority neighbourhoods of the Policy for the City scheme in 2013 was 24.6 per cent while the national average rate was around 13 per cent [START_REF] Hbila | La participation des jeunes des quartiers populaires: un engagement autre malgré des freins[END_REF]. It means that, as in other priority neighbourhoods, in Sanitas, young adults have difficulties in managing everyday life and social and professional stability and combining that with having a perspective on the future. Their demands and needs are relatively immediate, like finding a job and an income.

In addition, there is also the fact that talking about youth in French priority 3 neighbourhoods, as elsewhere, has a gendered dimension. We should remember that before the law of Politique de la Ville (2014), these neighbourhoods requalified as 'priority' were called Zones Urbaines Sensibles (Sensitive Urban Areas). In other words, the category of 'youth' in these areas is actually synonym for young men who are seen as trouble. Whether for institutional representatives or members of associations, youth (jeunes du quartier) has exclusively a masculine character.

Whenever community association members spoke about problems in the neighbourhood and the people they tried to encourage to come to the Community Centre, they presumed that it would be young men and not young women. Young women are often placed in the category of 'women' and 'women's activities' as in 'Atelier des Femmes Plurielles': cooking, doing yoga or stretching, learning French or sewing. More could be done to encourage more social initiatives coming especially from young women. Public institutions and their inclusivity programmes have a tendency to characterise young women in neighbourhoods such as Sanitas as submissive and dominated by their father, brother or husband [START_REF] Arouche | L'engagement dans les quartiers populaires. Formes et modalités des initiatives des jeunes[END_REF] and therefore propose very few programmes of real empowerment, more often staying with clichés, especially in relation to Islamic headscarfed young women.

Therefore, in addition to the collective problems with youth in general, as discussed, young women also live with the problems of invisibility, with little voice and limited presence in public space. Their presence in public space depends on their status. If they are a student or find a job or traineeship, they have relative liberty, but this liberty may still be controlled either by members of their family or by the norms of neighbourhood life. It seems hard, however, for the older generation to recognise how they exercise agency. For example, Inaya, a young woman of 21 years old, working for an association in the neighbourhood, explained that, although her family allowed her to work, her movements and hours were controlled; she could not wear the clothes she wished and she could not have a boyfriend. However, she had found different ways and means in order to enlarge the borders of her liberty by organising valuable activities for her Senegalese community in order to gain respect (Inaya, interview). Nevertheless, the complexity of negotiations such as Inaya's are not neglected and often supported in community development programmes as distinct from the neglect by public institutions. For example, after she organised activities to promote the cultural heritage of the African community, an association working in the neighbourhood hired her to develop work with the Senegalese community.

The time of community development through the lens of young people's engagement

All young individuals regardless of their gender share the immediacy of job problems and the need for better conditions of life. This has effects concerning their participation and interpretation of democratic participation tools offered by institutions. According to an employee of the Community Centre, it is only possible to pay attention and to be interested in developing community and helping others in the everyday life of one's neighbourhood, and therefore to contribute to the construction of a real citizen participation and a radical democracy, if you are comfortable and supported in your own life: "You can't expect people to be interested in Citizen Council, participation or other things which demand time and energy when their stomach is empty, when they are expected to live on the minimum social wage" (Abdou, interview). Another employee drew attention to another aspect of living with urgent and immediate pressure: 'In fact, young people, they have just one problem … they find it difficult to imagine future plans. They want to bring the neighbourhood to life. There are many things they want to create … but, now planning projects, that seems complicated to them.

What they lack is above all organisation. It is basically methodology. For them, it's "right now", that's all … if it is not, they will not be interested'. (Observation notes of Citizen Council meeting)

This clearly raises the question of the articulation of institutional and political time and that of time in the lifeworld of young people, which follow distinct logics. For example, when young people formulate familiar requests for places of sociability like a self-managed meeting room or premises for their leisure; by the time these demands have been managed politically and found an institutional outcome, the young people have already left the field of negotiations because it is too slow for them [START_REF] Hbila | La participation des jeunes des quartiers populaires: un engagement autre malgré des freins[END_REF]. Thus, when young people's involvement in a participatory scene brings them little or no benefit in return, they are disappointed and transmit their disillusion to their juniors. A young man encountered in the street says the following:

'What is the point of participation? We have participated a thousand times in their meetings, and, in their day, our grown-up brothers already participated a thousand times in their meetings, what was the point? We have met this professional or that elected representative several times. They know our problems. So what? It's no use.' (Abbas, interview) This statement shows clearly the spatio-temporal gap between young people and institutions. The former live in the moment and have difficulty in adapting to the longer temporalities, especially those of institutional arrangements. This gap sometimes creates conflict between the expectations of young people and the response of existing structures in the neighbourhood. As for the Community Centre, it is not always easy to act directly since the public institutions do not always allow it to take initiatives even though it knows the neighbourhood better. The institutions are motivated above all by respect for the republican and secular principles of France. As a result, therefore, social and political participation schemes stay at a distance from the grassroots and do not leave very much liberty to employees as the budget of community centres come directly from national and local government in France.

Institutions-youth nexus through participation and empowerment

In France, since the 1990s, different programmes aiming to reintegrate young people into the public sphere have multiplied. From Youth Councils to Parliaments and Citizen Forums, a whole set of tools have the aim of encouraging their participation but find relatively little interest among those first concerned [START_REF] Arouche | L'engagement dans les quartiers populaires. Formes et modalités des initiatives des jeunes[END_REF].

Several people interviewed in the district indeed perceive these devices as tools aimed at favouring a certain type of commitment. Through unequally accessible modes of participation, there is a perception of carrying out a 'selection process' in order to promote a style of commitment responding to local political issues, at the expense of others that do not fit into traditional channels of participation. Generally, there are two major problems for ensuring the participation of young people in the existing institutions and structures. The first problem is the nature and the way of functioning of these places of participation that have in the main a top-down and paternalist character. The second problem is the educative posture of agents/representatives of local structureseven when the latter are grassroots organisations vis-à-vis young people.

If we start with the first problem, it is partly due to the forms and tools of democratic participation in France and to the Jacobin character of French state institutions consisting in the support of a centralised republican state and strong central government powers seen as the sole legitimate actor to transform society (Fassin and Fassin, 2009). 4 This perception means that even in introducing citizen participation, it is left to the state bodies to manage the issue and to provide places for it [START_REF] Bertho | Malaise dans la République[END_REF]. This functioning has three perverse effects. First, it prevents citizens from easily appropriating the places of participation as they were not involved in their creation and therefore do not even sometimes know they exist. For example, the Citizen Councils have been created by a law and only in certain neighbourhoods qualified by their social and economic problems. This gives the impression that the state conceived these councils in order to prevent potential conflicts but not to drive a real participative initiative from citizens. Second, they are bureaucratic and complex structures requiring time and practical competence to understand their rules, duties and competences vis-à-vis public administration as well as their usefulness. This means that the access to these structures stays limited for the part of the population with a weak social capital and disadvantaged ethnic belonging, that is especially those of Arab or Muslim origin including young people [START_REF] Slaouti | Racismes de France[END_REF].

Finally, these devices paradoxically reinforce inequalities in participation.

There is clearly an 'under-representation of people belonging to dominated groups (precarious youth, especially young, population of immigrant origin) in participatory experiences in France' (Bacqué and Sintomer, 2011: 15-16) as it takes time and knowledge to achieve the necessary skills (correct language use, ability to manage a meeting, to talk in public, to prepare official documents) in order to become part of these processes. In other words, instead of creating an empowerment for the excluded, they become the places where the self-esteem of long-lasting activists is enhanced. A member of the Sanitas Citizen Council explains his commitment: 'because this district needs recognition, because I am linked to this district, I am part of it. I can bring my skills and contribute, through citizen action, to move the population towards more dignity, solidarity, consciousness' (Sebastien, interview). French Policy for the City has therefore lost its initial affirmative character underlined in 1983's Together Remaking the City, which insisted that it is necessary 'to take into consideration diverse forms of participation, and not merely formal associational forms. There is not only one but several levels of intervention by residents in democracy at the level of the neighbourhood […]. The quest was for the 'democratization of the management of the city' (Dikeç, 2006: 29). Participatory structures are thus under the constant supervision of public institutions, ensuring that their members cannot emancipate themselves from the competences and borders defined by those institutions. This constitutes a real obstacle to imagination and initiative-taking and is highly frustrating for young people who want to bring different projects to being and make them real in a relatively short time. Thus, during a meeting of the Citizen Council where the representatives of the municipality were present, I observed clearly that public decision-makers do not consider the council as a real tool for citizen participation and empowerment. The local social development officer in charge of Sanitas underlined that: "the Citizen Council is not intended to provide institutional formulas. It is not your role, you have to leave that to the institutions. However, we can provide you with information. Be careful not to be the messenger of any demand." The urban renewal manager at Tours Métropole continues in this direction: "We must not be fooled about participation, because there are subjects which we can discuss, but, for example the demolitions that have been decided in the neighbourhood are nonnegotiable. It is not for the residents to decide." Members of the Citizen Council often feel this top-down gaze. The Sanitas Collective had, for example, carried out a door-to-door survey among residents in the Marie-Curie sector of the district. This initiative was very badly received by the Municipality. A member of the Housing Association, CNL, and the director of the Community Centre were called upon by a councillor who asked them: "What does this survey mean? We have done the official consultation in the neighbourhood. They are trying to do their own!" These words validate the observation that local elected officials and state representatives do not seem ready to recognise the value of proposals produced outside of their initiative and control [START_REF] Bachir | Et si les habitants participaient? Entre participation institutionnelle et initiatives citoyennes dans les quartiers populaires[END_REF]. One of the members of the Citizen Council wondered if:

'The Citizen Council wasn't it created in order to give the illusion of establishing more democracy? For the authorities, isn't it created for clearing their conscience? Is there a real desire for constructive discussion and consultation with citizens? The council must be a real place of exchange, reciprocity, consultation for the good of the residents of the district. As for the neighbourhood renewal proposed to us, the Council has no say, is not consulted, cannot make proposals.' (Interview, a member of the council) This paternalist approach is not compatible with what young people perceive as democratic participation either.

A young volunteer at the Community Centre explains:

'It is clear that in appearance we have some places to talk, a fake democracy that we put in place to say: "hey, have a look, there is a chance to discuss", but what do we do with the discussion afterwards? That's the problem. Listening is good, but are we taking the discussion into account? For example, a protest that comes from some young people, such as: "Yeah, that's not normal, we want that", well … they are heard. They are going to be listened during a meeting but after that, what happens? Over time, when this kind of meetings happens once, twice, three times, four times, nothing moves or the result is not what is expected, then young people may not believe in the system, no longer trust and say: well we are going to do otherwise, we will not ask for anything, it is useless. They express their anger by burning cars or by organizing in groups in order to have some power in the neighbourhood but don't work with us or no longer come to events organised for them.' (Interview)

In short, the whole question that arises for a community and its traditional partners is to know to what extent they are ready to hear the youth. Do a city and those involved with 'youth policy' actors value the voice of young people only when it meets their expectations? Are they ready to accept that young people 'move the lines', question the rules in force and, ultimately, produce new social standards? (Hbila, 2014: 13). This is one of the main issues for the promotion of young people's participation in local democratic structures and returns us to the meeting of radical democracy and the right to the city, meaning the real transformation everyday practices of participation for all. Drawing on Lefebvre, the right to the city signifies in the most positive of terms the right of citizens and city dwellers, and of groups they (on the basis of social relations) constitute, to appear on all networks and circuits of communication, information and exchange [START_REF] Lefebvre | Writing on cities.Translated and introduced[END_REF]. In other words, the core elements of the right to the city are defined as the promotion of equal access for all to the potential benefits of the city, the democratic participation of all residents in decision-making processes, and the realisation of residents' fundamental rights and liberties, including those of the youth. The French urban policy, which seemed to promote this approach in the 1980s, has abandoned progressively this inclusive way of bringing solutions to priority neighbourhoods' various problems. Rather, as Dikeç argues, 'these neighbourhoods were conceptualised as self-contained and dangerous areas with rigid boundaries for which the answer became often repressive and punitive state interventions addressed in spatial terms' (Dikeç, 2006: 287).

Another problem is the normative and pedagogic orientation of agents/representative of local structures. In France, Community Centres are created with the principle of 'education populaire', which means to create collective dynamics that allow the dominated people to jointly develop a critical understanding of society and the origins of social inequalities. It is about giving yourself the means to understand the world in order to be able to transform it. This orientation is, in reality, not so far from what a radical democracy should be. Moreover, the director of Pluriel(le)s underlines it clearly. Defining himself as an activist of 'education populaire', he says that he wants to "use the skills acquired over the years to enable people to take charge of their lives and to act together". In his mind, the relationship between the community development worker and the local resident is evolving towards an 'alliance' in which the latter is a committed actor developing their own resources. As for the community development worker, s/he becomes a 'resource mobiliser' and a 'partner' who facilitates the empowerment process [START_REF] Deverchère | Innovations et engagement des travailleurs sociaux en faveur du développement du pouvoir d'agir[END_REF]. As the director underlined during a meeting, "they are not there to take the place or to speak in place of local residents" but to listen and support. Everyone must speak up and have the necessary time for this. It is therefore necessary to know how to be patient and to live at the pace of the other person and not at his own personal pace [START_REF] Deverchère | Innovations et engagement des travailleurs sociaux en faveur du développement du pouvoir d'agir[END_REF]. However, in practice, these principles are not entirely followed and are sometimes transformed first in the style of assistance and teaching by the workers towards the residents and especially towards young people. Concerning the latter, according to [START_REF] Cortéséro | Empowerment, travail de jeunesse et quartiers populaires: vers un nouveau paradigme?[END_REF], what is observed in public structures like Community Centres is that work for youth aims to help young people achieve a social figure of the accomplished adult, defined by a set of psychosocial development standards. In France, policies for young people from low-income, social-housing neighbourhoods follow largely a logic of containment of 'dangerous classes' aimed at ensuring social peace through educational actions intended to make young people 'reasonable' [START_REF] Dikeç | Badlands of the Republic: Space, Politics and Urban Policy[END_REF][START_REF] Cortéséro | Entre l'émeute et le ghetto. Quels cadres de socialisation politique pour les jeunes des banlieues populaires?[END_REF]. Animation, the professionalisation of which, in France, is largely linked to policies for the infrastructure and management of social housing banlieues (Bataille, 2004) is part of a larger plan to 'civilize the banlieue' (Cortéséro, 2014: 53). Young people who depart from these standards then embody a deficit figure, and the work in their direction must be corrective and compensatory: they must be helped to reach the 'dominant standard' [START_REF] Cortéséro | Empowerment, travail de jeunesse et quartiers populaires: vers un nouveau paradigme?[END_REF]. This kind of education whose objective is actually to teach the formal exercise of citizenship to the youth is often experienced as an institutional violence and a denial of recognition.

For example, in 2018, the French government set up the programme of 'Quartiers de Reconquête Républicain' (Neighbourhoods of Republican Re-conquest) in order to ensure the public security by increasing the number of police officers in some 'sensitive' neighbourhoods. Sanitas has been included in this programme that was harshly criticised by civil society organisations who accused the government of not being interested in long-term social solutions but of instead privileging physical repression. For the director of Pluriel(le)s, this programme makes no sense because the police will never be able to eradicate drug dealing. Instead, it increases social tensions in the neighbourhood and young people are very hostile to the police officers.

According to him: "dealers are smart guys, they know their interest very well. In general, they don't use drugs but only sell them. Some of them study and you can really discuss with them. When you want to discuss with an equal base, they listen" (interview). In any case, it is rare to simply ask young people what they want and how they would like to do it.

Conclusion

The study of actors in local democracy such as the Community Centre and the Citizen Council at Sanitas shows that ensuring a broad participation of residents within working-class districts is always a difficult task. Observation of the people involved in various initiatives within the neighbourhood indicates that they are very unrepresentative of the entire population of the neighbourhood. We see very few young people or people of migrant origin in the activities of participation and design of the Community Centre's project and activities. They are very often the same people involved in different associations and projects, wearing several militant hats.

Observation of the participation and advocacy initiatives of residents of

Sanitas also shows the importance of the role of the Community Centre, which can be both initiator and unifier, as well as passive and demobilising. Its position seems to be largely dependent on the employees of the Centre and their involvement in structures and spaces of participation as community development practitioners. Some programmes and participatory studios initiated by the director of Pluriel(le)s seem to attract young people to attend the Community Centre and this could have the effect of giving back some confidence, to participate in the collective events and meetings, to respect others' opinions and therefore to tolerate the contradictions. In that case, it would be more valuable to integrate youth into existing participation platforms and spaces rather than creating separate 'youth' platforms through which institutions expect their engagement in policy. For that, instead of a paternal approach, some researchers propose the term 'user expertise' as young people could be experts of their own territory and neighbourhood [START_REF] Talpin | Ces moments qui façonnent les hommes. Eléments pour une approche pragmatiste de la compétence civique[END_REF][START_REF] Cortéséro | Empowerment, travail de jeunesse et quartiers populaires: vers un nouveau paradigme?[END_REF]. According to Coussé et al, the education-centred approach is actively refused by young people, as it tends to erase class conflict and relations of domination [START_REF] Cano-Hila | Youth and neighbourhood effect in Southern European cities: Some pending issues to analyse[END_REF]. In sum, the lack of participation of youth seems highly correlated to social exclusion and precariousness, especially in disadvantaged neighbourhoods. All public and community-based programmes targeting their inclusion in various platforms of democratic expression should be imagined in the big picture that includes solutions to enhance their social conditions. In addition, they should abandon the perception of these neighbourhoods as problematic areas and consider them as resourceful areas by focusing on how they can value the neighbourhood, both the young men and young women within it, and what can they do together with young people and not for them.

Notes <<TS: take in notes here>>

  chapter is based on empirical research conducted during 2017-19 in a socialhousing and multiethnic neighbourhood, Sanitas, located in Tours, France. It focuses on a mobilisation against a renewal project in the neighbourhood and the relationships between different local structures including the Social Centre, Citizen Council and Sanitas Collective. The chapter argues that the top-down creation of participatory tools does not enable real empowerment of inhabitants leading to a local radical democracy but rather reflects the nature of neoliberal urban governance based on the efficiency of urban policies and the deconflictualisation of urban projects. It also discusses the tensions between different groups like young and 'racialised' people and activists in associations and the role the Social Centre plays in managing these tensions. Finally, the author highlights the importance of involving youth in the everyday life of the neighbourhood within the context of urban renewal. man from the neighbourhood, no matter how he is a leader, if you put him

  in reality they neutralise different forms of resistance, mobilisation and/or protest built by those same citizens. Do implicit spatial assumptions of governments concerning so-called 'sensitive neighbourhoods' not inflect the politics of participation and community development in those neighbourhoods? Methods of qualitative sociology were used for this empirical research undertaken between 2017 and 2019 for a locally funded research project entitled L'engagement et la participation au prisme du pouvoir d'agir. Enquête dans des centres sociaux et conseils citoyens en Région Centre-Val de Loire (ENGAGIR) in a social-housing and multiethnic neighbourhood, Sanitas, located in Tours, France. The objective of this project was to study the role of Community Centres (Centres Sociaux) in the empowerment of people living in the neighbourhood. The research focuses on a mobilisation against a regeneration project and on the relationship between different local groups like the Community Centre, the Citizen Council and the Sanitas Collective. I argue that the top-down creation of participatory tools does not facilitate a real empowerment of residents in order to lead to a local radical democracy; in particular, it especially excludes the young. The main focus of the chapter is to analyse the tensions between different groups, especially between young and 'racialised' peoples and activists in associations, and between those young people and the Community Centre's employees. It will also analyse the involvement of a young population in the everyday life of the neighbourhood in the context of urban regeneration. Attempts at mobilisation against urban regeneration in Sanitas and the difficult participation of young people Sanitas is the poorest district of Tours Metropolitan Area, classified as a priority neighbourhood by the framework of Policy for the City designed in 2014. Policy for the City (Politique de la Ville) is a set of policies for urban cohesion and solidarity within the most disadvantaged districts. It aims 'to restore republican equality and to improve the living conditions of residents by mobilizing all public policies' (French Ministry of Territorial Cohesion and Relations with Local Authorities, 2014). The origins of this policy scheme was in a specific context marked by the arrival of the left to power in 1981. After several incidents of unrest took place in the social housing neighbourhoods of the French banlieues during 1981, a National Commission for the Social Development of Neighbourhoods (Commission Nationale pour le Développement Social des Quartiers, CNDSQ) was created and attached directly to the office of the Prime Minister. Hubert Dubedout, the mayor of Grenoble, was appointed as the president of the Commission who finally prepared the report Ensemble, refaire la ville (Together, Remaking the City)

Finally

  , the Citizen Council is composed of eight residents and eight people from associations active in the neighbourhood. It is hosted by Pluriel(le)s and meetings are facilitated by its director. The Citizen Councils were created in France in 2014 by a governmental decree. The initiative comes therefore from the top rather than grassroots movements. The composition of the council has stayed the same since its creation. For the most part, individuals who are already activists in different associations and Sanitas Collective are also members of the Citizen Council. Most of the individuals involved in these three structures are long-standing activists; some of them do not live in Sanitas and all of them are White without migrant origin. They invested in Sanitas "because there was poverty and migrants who arrived and who needed help" (Nathalie, interview). However, they are not well known by the local residents who do not really recognise themselves in these militants from the middle classes and who are perceived as 'White French'. The members are aware of this: "Young Africans at the corner who make barbecues have said of the Collective: 'they are White bourgeois who deal with the urban renewal'. That's why we must go and discuss with them, otherwise it constitutes a brake on mobilisation and for the Collective" (Martine, interview). This difficulty in creating links between the Collective and the residents of the area clearly represents an obstacle to mobilisation. It prevents the constitution of an 'us' which could make it possible to channel the feeling of injustice, by explicitly designating the Municipality of Tours as an adversary and to take action around the common objective of preventing demolitions and ensuring that the renewal project is carried out for the benefit of the residents. During a meeting of the Collective on 4 December 2017, one of its members said: "We should try to think of ways [by which] people can do things together. The question of trust is important."

3 We should remember that before the law of Politique de la Ville (2014), these neighbourhoods requalified as 'priority' were called Zones Urbaines Sensibles (Sensitive Urban Areas).

4 'French republican' tradition considers each person as a member of the national community; consequently, integration means assimilation into the national culture. In the 1990s, this tradition took the form of a 'republican nationalism'; immigrants became the scapegoats for socioeconomic difficulties and the banlieues were perceived as a 'threat' to national unity. Despite the ethnic diversity of these neighbourhoods, they have commonly been described as 'ghettos'. See [START_REF] Dikeç | Badlands of the Republic: Space, Politics and Urban Policy[END_REF] and the review of his book [START_REF] Gilbert | Badlands of the republic: Space, politics, and urban policy by Mustafa Dikeç[END_REF] where the quotation has been taken from.


L'apprentissage automatique gagne de plus en plus de terrains d'applications. Différentes méthodes existent et qui permettent la construction de modèles à des fins d'aide à la décision. Néanmoins, les modèles d'apprentissage automatique sont vulnérables et exposés à différents types d'attaques de sécurité durant le processus d'apprentissage des modèles et après leur déploiement. Par conséquent, ces menaces doivent être, dans un premier temps, identifiées, définies et classées afin que, dans un deuxième temps, proposer des mesures de défense pour faire face à ces menaces. Dans cet article, Nous nous sommes intéressés à l'étude des menaces pouvant toucher un processus d'apprentissage automatique. Nous présentons une classification des menaces autour de l'objectif, la connaissance et la capacité de l'attaquant. Ensuite, nous montrons quelques exemples d'attaques sur des applications utilisant l'apprentissage automatique.

Taxonomie des attaques sur les méthodes d'apprentissage automatique

Tom Djaaleb * , Mohamed-Lamine Messai * 1 Introduction L'apprentissage automatique ou machine (Machine Learning (ML)) est un sous-domaine de l'intelligence artificielle. Le ML inclut un ensemble d'algorithmes permettant de créer automatiquement des modèles à partir de données exemples. Ces données, utilisées dans la phase d'entraînement sont appelées les jeux de données d'apprentissage. Traditionnellement, un programme informatique effectue une tâche en suivant des instructions précises, et donc systématiquement de la même façon. Par contre, un système d'apprentissage automatique ne suit pas d'instruction, mais apprend à partir de l'expérience. Par conséquent, ses performances s'améliorent au fil de son entraînement sur le jeu de données. La finalité du modèle de ML est d'imiter un comportement semblable au cerveau humain en termes de prise de décision afin d'automatiser des tâches. Ces dernières années, grâce à des capacités de calcul beaucoup plus puissantes et des ensembles de données beaucoup plus importants pour l'entraînement des modèles, les technologies d'apprentissage automatique, en particulier les réseaux neuronaux artificiels et les architectures d'apprentissage profond, ont fait des progrès considérables. L'apprentissage automatique a de nombreux domaines d'application comme la détection des spams et des logiciels malveillants en cybersécurité, la classification d'images et la reconnaissance d'objets pour le contrôle des véhicules autonomes, le diagnostic médical, la reconnaissance vocale, ... etc.

Avec le succès impressionnant de l'application du ML dans des domaines de plus en plus nombreux, des faiblesses de sécurité sont présentes dans les étapes des algorithmes d'appren-tissage ce qui peut rendre les modèles générés inutilisables. En raison de ces faiblesses, un système d'apprentissage automatique est vulnérable à divers types d'exploitations adverses qui peuvent compromettre l'ensemble du système. En fait, un processus d'apprentissage automatique typique, qui consiste en la collecte de données, l'extraction de caractéristiques, l'entraînement du modèle, la prédiction et le réentraînement du modèle, est vulnérable aux attaques malveillantes à chaque étape. Nous nous intéressons dans ce travail à l'étude des menaces et à l'identification et la classification des différents types d'attaques sur l'apprentissage automatique.

Le reste de l'article est organisé comme suit : la Section 2 explique brièvement le processus d'apprentissage automatique en donnant les sources de vulnérabilités et présente les travaux antérieurs sur la sécurité de l'apprentissage automatique. Ensuite, la Section 3 présente une taxonomie des menaces en présentant notre classification axée sur les dépendances entre les objectifs de l'attaquant, sa connaissance sur le système ML et les attaques qu'il peut exécuter. Dans la Section 4, nous présentons quelques attaques sur des exemples d'applications. La section 5 conclut l'article en donnant quelques perspectives.

Apprentissage automatique

La Figure 1, schéma utilisé par [START_REF] Mcgraw | The top 10 risks of machine learning security[END_REF] en amont de leur travaux sur la sécurité du ML, représente toutes les étapes du processus d'apprentisage automatique. Les cellules rectangulaires bleues 2, 4, 5, 8 sont des processus ("des actions") alors que les cellules ovales jaunes 1, 3, 6, 7 et 9 représentent des objets ou des ensembles d'objets. Pour comprendre d'où proviennent les vulnérabilités de l'apprentissage automatique, il est nécessaire de définir formellement son fonctionnement. Le livre "An Introduction to Statistical Learning" de James et al. (2021) propose une définition claire et précise du problème. Soit X = (X 1 , ..., X p ) un ensemble de variables prédictives et Y l'ensemble des réponses associées. Il existe une fonction f qui établit la relation entre X et Y :

Y = f (X) + (1)
Le terme représente l'erreur irréductible et est indépendant de X. Cette relation n'est pas toujours connue, l'apprentissage automatique cherche donc à l'estimer pour plusieurs raisons :

-La prédiction : généralement, X est connu et accessible mais la réponse Y ne l'est pas. On peut donc utiliser l'estimation f pour prédire Y , l'estimation de la réponse. -L'inférence : l'estimation de f permet parfois de mieux comprendre la relation entre Y et les variables explicatives. L'estimation de f se fait en appliquant des méthodes d'apprentissage statistique sur les données déjà à notre disposition. Lorsque l'apprentissage est supervisé, chaque observation i est constituée de j prédicteurs x ij et de la réponse associée y i . Si l'apprentissage est non supervisé, seul l'ensemble des X est disponible, les réponses associées aux observations sont inconnues.

Les deux principales raisons de la vulnérabilité des systèmes d'apprentissage automatique, outre les problèmes de sécurité classique, sont les suivantes :

f est dépendante de X train l'ensemble des données d'entrainement : une modification de l'ensemble modifie également la fonction.

FIG. 1 -Framework de l'apprentissage automatique.

f est une estimation de la relation réelle entre le variables et la réponse : il existe des paires

(X i , y i ) telles que f (X i ) = y i (2)
Plusieurs travaux antérieurs présentent les menaces et les attaques sur l'apprentissage automatique. [START_REF] Barreno | Can machine learning be secure ?[END_REF] étaient les premiers à s'intérésser aux vulnérabilités des méthodes d'apprentissage automatique. Ils ont proposé une première classification des attaques sur le ML en 2006. Leur classification a été reprise et étendue par [START_REF] Huang | Adversarial machine learning[END_REF] et par [START_REF] Biggio | Is data clustering in adversarial settings secure[END_REF]. Plus récemment, le travail [START_REF] Biggio | Is data clustering in adversarial settings secure[END_REF] est repris et complété par [START_REF] Xiao | Is feature selection secure against training data poisoning[END_REF] et [START_REF] Muñoz-González | The security of machine learning systems[END_REF]. La Table 1 présente un résumé de chaque travail antérieur ainsi que l'année de publication.

Dans ce travail, nous enrichissons la classification de Biggio et al. (2013b) en ajoutant la notion de dépendance entre les caractéristiques d'une attaque. Cela permet de mieux comprendre les possibilités de l'attaquant dans la construction de son attaque et ainsi déterminer la faisabilité de celle-ci.

Publication

Résumé [START_REF] Barreno | Can machine learning be secure ?[END_REF] Les auteurs proposent un premier modèle des attaques et discutent ensuite des défenses possibles à explorer. Ils présentent une attaque par empoisonnement simple. [START_REF] Huang | Adversarial machine learning[END_REF] Le modèle de [START_REF] Barreno | Can machine learning be secure ?[END_REF] Extension du modèle de Biggio et al. (2013b). Optimisation des attaques par empoisonnement. Présentation de propriétés sur les attaques par empoisonnement et par évasion. Proposition de pistes de défenses. [START_REF] Tabassi | A taxonomy and terminology of adversarial machine learning[END_REF] Proposition d'un nouveau modèle. Inclusion des défenses et des conséquences.

TAB. 1 -Publications antérieures.

Taxonomie des menaces

Dans cette section, nous présentons le modèle de l'attaquant sur les systèmes d'apprentissage automatique. La stratégie de l'attaquant est représentée autour des trois points clés : son Objectif, ses Connaissances et ses Capacités.

La Figure 2 représente le modèle de l'attaquant. La capacité de l'attaquant représente la phase attaquée (Phase d'entrainement ou lorsque le modèle est actif), ses connaissances sont modélisées en cinq points qui sont précisés dans la section 3.2 et son objectif est défini par la règle de sécurité enfreinte ainsi que si l'attaque est ciblée ou non.

Bien que ces trois pilliers définissent une attaque sur un modèle d'apprentissage automatique, ils ne sont pas indépendants. En effet, les connaissances que l'attaquant possède sur le modèle sont essentielles pour que celui-ci puisse déterminer l'objectif de son attaque, ainsi que son champ d'action. La capacité influe également sur l'objectif de l'attaquant, notamment sur le type de sécurité enfreint, celui-ci pourra être limité s'il n'a pas accès à la phase d'entraînement. Nous détaillons par la suite chaque point. Confidentialité On parle de "Privacy Attack" ou "Confidentiality Attack" lorsque l'attaquant a pour objectif d'obtenir des informations confidentielles sur le modèle ou bien sur les données d'entraînement (qui peuvent être des données personnelles d'utilisateurs réels).

Objectif de l'attaquant

Disponibilité Les attaques visant à compromettre la disponibilité du modèle cherchent à le rendre inutilisable. Cela se produit généralement en modifiant le modèle pour que celui-ci prédise un trop grand nombre de "faux positifs".

Intégrité Les "Integrity Attack" n'ont pas pour objectif de rendre inutilisable le modèle mais que celui-ci produise des erreurs pour fausser les utilisateurs dans leurs prises de décisions. type d'infraction comme un objectif de l'attaquant plutôt que comme une conséquence de ses actions. Muñoz-González et Lupu (2019) proposent également une troisième catégorie pour définir l'objectif de l'attaquant, la spécificité de l'erreur. Cette caractéristique n'étant propre qu'à un nombre restreint de modèles, nous ne la prendrons pas en considération.

Connaissances de l'attaquant

Les informations détenues par l'attaquant sur le modèle jouent un rôle essentiel dans l'élaboration de sa stratégie. Muñoz-González et Lupu (2019) définissent ces connaissances en cinq composantes :

-Le jeu de données d'entraînement D tr -L'ensemble des variables explicatives X -L'algorithme d'apprentissage M -La fonction objective de l'algorithme L -Les paramètres de l'algorithme w L'attaquant peut connaître tout ou une partie de ces cinq paramètres, cependant, [START_REF] Barreno | Can machine learning be secure ?[END_REF] détient les cinq informations. La deuxième vision est une extension de la première dans laquelle on accepte d'étudier le cas où l'adversaire n'a aucune information sur le modèle (Black Box), ce qui est rarement le cas dans une situation réelle, c'est pourquoi dans notre taxonomie, nous décidons de classer les connaissances en deux catégories seulement (Figure 4). Dans cette deuxième vision, Grey Box signifie que l'attaquant a des connaissances limitées, et White Box, celui-ci a des connaissances parfaites. Les attaques avec connaissances limitées sont les plus fréquentes, la confidentialité des données étant aujourd'hui un enjeu majeur, D tr est très souvent inconnu. Les informations possédées par l'attaquant sont généralement les paramètres M, X et L. Dans cette configuration, l'attaquant peut chercher un échantillon Dtr statistiquement proche de D tr pour obtenir une estimation ŵ des paramètres du modèle. [START_REF] Tabassi | A taxonomy and terminology of adversarial machine learning[END_REF] expliquent que si ce modèle de substitution est suffisament ressemblant au modèle original, les connaissances de l'attaquant deviennent "parfaites". Il est rare que l'attaquant ait une parfaite connaissance du modèle, mais ce type d'attaque est étudié dans la littérature car dans cette configuration, l'attaquant peut attaquer le modèle de façon très performante (celui-ci peut tester son attaque en amont avant de la déployer). Implémenter une défense contre les attaques White Box renforce considérablement la résistance du modèle puisque celles-ci sont d'ordinaire, optimisées. Cependant, il existe de rare cas où trouver une attaque optimale est difficile dû à la complexité de certains algorithmes de décision, même avec une connaissance parfaite du modèle.

Capacité de l'attaquant

La capacité de l'adversaire définit comment et dans quelle mesure l'attaquant peut contrôler le processus d'apprentissage [START_REF] Biggio | Is data clustering in adversarial settings secure[END_REF]). On retrouve également le terme d'"influence" pour définir la capacité de l'attaquant [START_REF] Barreno | Can machine learning be secure ?[END_REF] [START_REF] Huang | Adversarial machine learning[END_REF]). Lors de la mise en place d'un modèle d'apprentissage automatique, deux phases sont vulnérables aux attaques malveillantes : la phase d'entraînement et la phase d'inférence (Figure 5). Une attaque pendant la phase d'apprentissage est dite "causale" (Causative Attack), la caractéristique principale de ce type d'attaque est qu'elles modifient la structure même de l'algorithme pour que celui-ci produise des erreurs de classifications lors de la mise en production. Les attaques "exploratoires" (Exploratory Attack) surviennent lors de la phase d'inférence, lorsque le modèle est mis en production. Ce type d'attaque ne modifie pas le modèle mais cherche plutôt à le leurrer ou à le rendre inutilisable.

Attaque Causale

Les attaques causales interviennent pendant la phase d'entraînement du modèle, on appelle aussi ce type d'attaque "empoisonnement". Les attaques par empoisonnement sont découpées en trois catégories selon [START_REF] Tabassi | A taxonomy and terminology of adversarial machine learning[END_REF] :

-Injection de données -Manipulation des données -Corruption du modèle L'injection de données revient à ajouter des échantillons malveillants dans l'ensemble des données d'entraînement pour dégrader les performances de l'algorithme [START_REF] Saadi | Détection d'anomalies dans les flux de graphes et attaques d'empoisonnement[END_REF]). Dans le cadre d'une attaque ciblée, l'injection permet à l'attaquant d'introduire des backdoor pour pouvoir les utiliser lors de la mise en production et d'éviter la détection. La manipulation des données est une extension de l'injection puisqu'elle permet également à l'attaquant de pouvoir modifier/supprimer les échantillons d'entraînement. Cela peut être une modification des données en entrée (X i ) ou bien des labels (y i ). La corruption du modèle (Logic Corruption) est l'attaque la plus difficile à mettre en place mais la plus "puissante". L'attaquant cible le modèle d'apprentissage lui-même, il modifie ainsi le processus d'apprentissage. Ce type d'attaque peut survenir à l'entraînement initial ou alors pendant les phases de réentrainement si le système le permet. Il arrive que dans certains cas, les données d'entraînements soient volées avec des attaques informatiques plus classiques. Cela ne modifie pas le modèle mais viole la confidentialité des données, l'attaquant pourra utiliser les informations récoltées pour créer un modèle de substitution et réaliser une attaque exploratoire.

Attaque Exploratoire

Lors d'une attaque exploratoire, l'attaquant n'a pas accès au modèle (il peut tout de même connaître des informations sur ce dernier). Plusieurs possibilités s'offrent à l'adversaire, celuici peut dans un premier temps déstabiliser le modèle en envoyant des données en entrée qui produiront des prédictions "faussement positives" [START_REF] Shi | Generative adversarial networks for blackbox api attacks with limited training data[END_REF]). Dans le cadre d'un IDS (Intrusion Detection System) par exemple, le système alertera sans cesse d'une attaque alors que la situation est normale, ce qui rendra la modèle inutilisable. L'attaquant peut également essayer de traverser le système en trouvant une configuration de variables en entrée qui renvoient une prédiction "faussement négative". Lorsque le modèle est connu, cela peut se faire en analysant le modèle et donc en une seule étape, mais dans le cas où l'adversaire a des connaissances limitées sur le système, il peut trouver cette configuration de manière itérative en ajustant les paramètres à chaque étape. Pour ces types d'attaques, on parle généralement d'attaque par "évasion". Les attaques exploratoires posent également des problèmes de confidentialité. L'attaquant peut, avec un jeu de données en entrées et les prédictions du modèle associées, déduire des informations sur le modèle comme sa nature (paramétrique ou non) ou bien les paramètres choisis par le constructeur (par exemple la fonction objective associée). Ces informations peuvent être utilisées pour créer un modèle de substitution et donc avoir une meilleure connaissance du modèle original. Ce nouveau modèle sera utilisé pour trouver les entrées optimales qui permettent de créer des erreurs de classifications. Le modèle peut également détenir des informations sur le jeu de données d'apprentissage et des attaques peuvent être construites pour récupérer le jeu de données d'entrainement [START_REF] Shokri | Membership inference attacks against machine learning models[END_REF]).

Les trois caractéristiques présentées précédemment sont dépendantes. Plus particulièrement, les connaissances influent sur l'objectif et la capacité de l'attaquant, de même que la capacité de l'attaquant influe sur son objectif.

Dans le cas où D tr est connu, l'attaquant n'aura pas besoin de réaliser une attaque exploratoire pour retrouver le jeu de données d'entraînement (Inférence), on peut donc considérer que ce type d'attaque n'est pas une menace pour notre modèle. En revanche, si l'attaquant connaît D tr , deux possibilités sont retenues : les données sont publiques, il n'y a pas de problème de confidentialité ; les données sont privées, il y a une violation de la confidentialité des données. Dans le deuxième cas, en plus de la sécurité enfreinte par l'attaque en question, il faudra aussi considérer qu'il y a eu des failles dans la sécurité des données. Comment l'attaquant a-t-il pu avoir accès aux données ? Méthode classique ou inférence par attaque exploratoire ? Lorsque l'attaquant ne connais ni D tr ni X , cela devient très compliqué pour lui de tissage automatique. Il existe bien d'autres attaques appliquées à différentes applications ou différents modèles.

4.1 Attaque par empoisonnement [START_REF] Goodfellow | Explaining and harnessing adversarial examples[END_REF] proposent une méthode rapide pour générer des exemples contradictoires : Fast Gradient Sign Method (FGSM). Leurs travaux traitent de la classification d'images. Cette méthode consiste a ajouter une quantité linéaire de bruit inperceptible à l'image et à faire en sorte que le modèle la classe de manière incorrecte. L'exemple contradictoire est généré à partir d'une image des données d'entraînement, à laquelle on ajoute une constante multipliée par le signe du gradient. Plus est grand, plus le modèle sera perturbée, mais la perturbation sera également plus visible. La formule pour générer les exemples contradictoires est la suivante :

η = × sign(∇ x J(θ, x, y)) (3)
Avec η la perturbation finale ajoutée à l'image de départ, le montant de la perturbation, J la fonction de coût, θ les paramètres du modèles, x les données en entrées et y la réponse associée. Une fois les exemples générés, ils sont introduits dans l'ensemble des données d'entraînement et vont perturbés la construction du modèle. Le modèle sera biaisé et ses performances seront dégradées.

Bien que cette méthode ne soit pas la plus efficace, c'est l'une des plus rapide, elle est donc toujours très utilisée pour tester la robustesse des modèles face aux exemples contradictoires. Des méthodes plus efficaces ont été proposées par la suite comme l'attaque C & W du nom de ses auteurs par [START_REF] Carlini | Adversarial examples are not easily detected : Bypassing ten detection methods[END_REF].

4.2 Attaque exploratoire : Erreur de classification Biggio et al. (2013a), en plus de proposer un modèle de l'attaquant, publie également un article qui traite des attaques exploratoires visant à produire des erreurs de classifications. Les auteurs construisent une attaque basée sur la descente de gradient pour déterminer x * , l'echantillon optimal qui "échappe" au modèle (mauvaise classification). Leurs tests sont effectués sur deux systèmes, le premier est un algorithme de reconnaissance d'image et le deuxième, un algorithme ayant pour but de détecter les malwares dans les documents PDF. Leurs expérimentations montrent que les méthodes d'apprentissage populaires comme les SVM ou les réseaux de neurones sont sensibles à ce genre d'attaque, même lorsque les connaissances de l'attaquant sont limitées. classes de sortie en fonction de la classe réelle de l'entrée. k modèles "fantômes" f i shadow (un pour chaque classe) sont construits et destinés à se comporter de manière similaire au modèle cible. Chaque modèle fantôme i est entraîné sur un jeu de données D train shadow i de distribution similaire aux données d'entraînement du modèle ciblé. Les sorties de ses modèles sont "in" si l'observation fait partie du jeu de données d'entrainement et "out" si ce n'est pas le cas. Plus il y a de modèles fantômes, plus l'attaque sera performante. Pour finaliser l'attaque, les sorties de chaque modèle fantôme sont associées à leurs données en entrée pour créer le jeu de données d'entrainement du modèle final. C'est ce modèle qui sera utilisé pour attaquer le modèle ciblé et déterminer les observations utilisées pour son entraînement. La construction de cette attaque est schématisée dans la Figure 6.

Attaque exploratoire : Inférence

Conclusion

L'intelligence artificielle occupe de plus en plus de place dans nos applications de tous les jours. Les modèles d'apprentissage automatique, utilisés dans ces applications, sont vulnérables et sont exposés à différents types d'attaques. Avant d'utiliser massivement l'apprentissage automatique dans les différents domaines notamment le domaine de la cyber-sécurité, il est très important d'étudier la sécurité du processus d'apprentissage automatique. Dans cet article, nous avons présenté les vulnérabilités et une taxonomie des attaques qui peuvent affecter le fonctionnement d'un système ML. Comme perspectives de ce travail, nous envisageons d'étudier l'ensemble de mesures proposées pour faire face aux différents types d'attaques présentés. Les techniques de défense ont pour objectif d'éliminer ou de diminuer l'impact des attaques sur les modèles tout en assurant une précision acceptable.

N. B. : Ce travail a été effectué dans le cadre d'un stage de recherche financé par l'équipe SID du laboratoire ERIC.

  FIG. 2 -Modèle de l'attaquant.

  FIG.3-Objectif de l'attaquant.

  FIG.4-Connaissances de l'attaquant.

  FIG. 5 -Capacité de l'attaquant.

  FIG. 6 -Création du modèle d'attaque par inférence.

  est repris. Étude de cas sur deux systèmes : SpamBayes et Anomalous Traffic Detection. Introduction de la confidentialité des données dans le ML. Biggio et al. (2013b) Généralisation du modèle de Huang et al. (2011). Introduction des connaissances de l'attaquant. Étude de cas sur un modèle de clustering.

	Xiao et al. (2015)	Reprise du modèle de Biggio et al. (2013b). Application à
		la sélection de variables et expérimentation d'une attaque
		par empoisonnement.
	Muñoz-González et
	Lupu (2019)

générer des exemples contradictoires : premièrement si le format des données empoisonnées n'est pas le bon, celles-ci pourront tout simplement être rejetées par l'algorithme ; deuxièmement, comment déterminer la pertinence des exemples ? seront-ils assez biaisés pour baisser les performances du modèle. On peut donc se demander si une attaque par empoisonnement est vraiment à craindre lorsque ces informations manquent pour l'attaquant.

La Figure 5 illustre la classification des différentes attaques et la

Quelques exemples d'attaques

Dans cette section, nous présentons trois exemples d'attaques bien connues dans la littérature. Ces exemples permettent d'illustrer la diversité des menaces qui plannent sur l'appren-

Summary

Machine learning is gaining more and more application fields. Different methods exist that allow model constructions for decision support purposes. Nevertheless, machine learning models are vulnerable and exposed to different types of security attacks during the model learning process and after their deployment. Therefore, these threats must be first identified, defined and classified in order to propose defensive measures in the aim to have robust models. In this paper, we study various threats that can affect a machine learning process. We present a classification of threats divided into three parts, the objective, the knowledge and the capability of the attacker. Then, we show some examples of attacks on applications using machine learning.


T Bapaume
email: thomas.bapaume@univ-eiffel.fr

E Côme

J Roos

M Ameli

L Oukhellou
email: latifa.oukhellou@univ-eiffel.fr

Passenger flow forecasting framework based on vision transformer and inpainting: Application to a public transport system

Keywords: Short-term Forecating, Passenger Load, Deep Learning, Transformer, Inpainting

INTRODUCTION

Short-term forecasting is one of the most important challenges in intelligent transport systems (ITS). The demand information is crucial for transport operators in order to anticipate and optimize their service level and for travelers to have robust information. In addition, a good predictor can contribute to system resilience by predicting disrupted situations. In most forecasting models, the data collectors are based on regular time series and single stations of the urban area. This study considers trains as data collectors, i.e., sensors. Thus, we are not limited to single location sensors. Moreover, we have to deal with irregular time series. In the literature, there are few studies that take this point into account [START_REF] Pasini | LSTM Encoder-Predictor for Short-Term Train Load Forecasting[END_REF]. [START_REF] Bapaume | Image Inpainting and Deep Learning to Forecast Short-Term Train Loads[END_REF] proposed a U-net framework to take into account the specificity of real train data and perform forecasting over images through an inpainting task. This present study aims to extend the architecture of the deep learning process with self-attention mechanisms. These mechanisms outperform other solutions (on two popular data sets:CIFAR-100 and Imagenet) when they are used by the Transformer [START_REF] Vaswani | Attention Is All You Need[END_REF] and Vision Transformer models [START_REF] Dosovitskiy | An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale[END_REF] in Natural Language Processing (NLP) and image processing. Self-attention mechanisms show a high potential to be deployed for short-term prediction through solving image processing problems. In this study, two attention-based architectures were used: the U-transformer and Channel Vision Transformer. Then, we performed a benchmark on real load data (collected during 3 years of the Paris metro line 9) in order to compare the ability of these two architectures to forecast the loads of all the next 4 train departures of a metro line.

METHODOLOGY

2.1 Short-term train load prediction with metro traffic images A train load image can be decomposed of multiple channels representing respectively data of the train network. For this study, 4 variables were defined: train load, remote ticket validation at the station, travel time, and waiting time as shown in Figure 1(b). Based on this image definition, we can present the methodology to forecast a certain number of unknown (future) train loads at a time t in grey in Figure 1(a).

Proposed image processing model with Transformer encoders

The forecasting task consists of two main steps: (i) the reconstruction of a missing part of an image I(t) and (ii) the extraction of the forecasted loads from Î(t) illustrated in Figure 1. In the first step, we applied the inpainting function f as the deep learning model to an input image. Then, to extract future train loads denoted by Îpred (t), we used a mask m y in the second step to select the corresponding pixels from Î(t). The following equation summarizes the forecasting task:

Îpred (t) = Î(t) ⊙ m y , where Î(t) = f (I(t)) and ⊙ is the product of Hadamard (1)
The proposed architectures are built using the positional patch encoding introduced by the Vision Transformer [START_REF] Dosovitskiy | An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale[END_REF] in order to deploy self-attention models to the image processing task. First, the goal is to apply this emerging framework, i.e., Transformer, to our image forecasting problem. Second, we use this methodology to directly predict all the next departures while we skip the inpainting task thanks to the Transformer's ability to enhance the relation between patches (set of pixels) inside an image. The two proposed models are detailed as follows:

U-Transformer: The idea is to replace the convolution and pooling layers with transformer encoders and decoders. The architecture is based by the Swin-Transformer proposed by [START_REF] Cao | Swin-Unet: Unet-like Pure Transformer for Medical Image Segmentation[END_REF]. Besides, the pooling task is achieved by concatenating patches together. The skip connections used by the conventional U-net are replaced by the sum of the deconvolution and convolution steps in order to preserve the spatial information during image reconstruction.

Channel Vision Transformer: This new architecture applies transformer encoders for each channel composing I(t) (Figure 1(b)). The goal is to extract features independently from each variable. These features are concatenated and passed to a decoder to reconstruct the image and forecast loads.

RESULTS

Model configuration and numerical experiments

In order to validate our methodology, we evaluated its performance on real data collected from the Paris metro line 9, including train loads, ticket validations, and train waiting and travel times (input image presented in Figure 1(b)). The generated images have a size of 36 stations, 40 train sequences, and 4 channels (i.e., input variables). These images were generated based on the data collected every minute for the daily working hours of the line. In this study, 6 solution methods are considered as the reference methods: neural network (NN), fully convolutional network (CNN), convolutional network combined with NN (CNN+NN), U-net model, Transformer, and Vision Transformer (VIT). Furthermore, the two proposed models, U-Transformer and Channel Vision Transformer, were implemented in order to compared them with the reference solutions.

The Softplus function was used as the output function of all models because the load is defined positively between 0 and the maximum passenger load (800) per train. For the learning step, all models were trained with the Adam optimizer and a learning rate of 0.0001. Transformer models consisted of three encoder layers, a dimension of 64 by 128 heads, and used a patch size of 3. Finally, the learning for all models was done on 4 epochs. This number is small enough due to the high degree of similarity between the images.

For the learning and test datasets, images were generated from January 2019 to April 2021 with 1200 images per day, making a total of 900, 000 images. The test set includes 25% of the dataset and was selected so that we have at least the data of one month per year in order to illustrate different train contexts.

Forecasting results

Table 1 presents the results of the forecasting algorithms for the next four train departures from each station (i.e., grey pixels in Figure 1(a)). We measured the weighted mean absolute percentage error (WMAPE) for each scenario. The first column denotes the forecasting result for the whole Testset. The best result was obtained with U-Transformer (11.4%). Only two Transformer architectures (U-transformer and Channel Vision Transformer) outperform the Unet model. The other columns present the results for Atypical situations.

Atypical situations

In practice, it is crucial to evaluate the forecast model not only at the normal service level (as the results can be trivial), but in disrupted transport contexts which represent the uncertainty of the short-term forecasting in a real test case. Thus, we selected several real atypical scenarios based on two criteria extracted by (i) metric calculations and (ii) posterior knowledge of the metro traffic. The first criterion is easily computed over all metro line stations thanks to the image-oriented approach. For example, the range of total travel time of a single train allows us to identify disrupted events (e.g., longer parking times, traffic incidents). In addition, by computing the mean travel time of all trains at time t (i.e., for a single image), we can extract a Delay set if the difference between mean travel time and free-flow travel time is more than a given threshold (15 minutes in this test case

DISCUSSION

The proposed framework forecasts all the targeted future train loads simultaneously (i.e., not recursively). The new architectures based on self-attention reformulate and solve the forecasting task as an inpainting problem. The benchmark showed the efficiency of the proposed methods over multiple test sets. Besides, we plan to include other methodologies reported in the literature, such as ensemble learning methods. We are currently extending the test case to other atypical situations (e.g., peak hours) based on posterior knowledge or metrics from the picture. The goal is to include other types of atypical situations in order to evaluate the robustness of the forecasting methods. Moreover, the explainability of the methods needs to be evaluated through attention scores.

Figure 1

 1 Figure1(a) depicts an image that represents the train loads of all trains over the Paris metro line 9 in real time. Each pixel encodes the train load corresponding to the train identified by the column number at the station denoted by the row number. Therefore, each column represents

Figure 1 -

 1 Figure 1 -(a) Image of metro line 9 train loads (including past load channel) generated at time t. Colored pixels are past train loads, grey pixels are the future loads to be predicted for a short-term horizon (i.e., the pixels targeted by this study), and uncolored pixels are long-term horizon train loads. (b) Schema of the methodology with the multi-channel image as input and two-step output (inpainting and extraction of next four pixels).

Table 1 -

 1 Forecasting results, expressed with weighted mean absolute percentage error (WMAPE), on the test set and on the atypical situations.

	Models (reference) / WMAPE [%] for	Testset Nominal Delay	High load Strike Lockdown
	NN	18.9	16.1	25.7	20.1	40.2	19.4
	CNN	13.3	11.2	17.6	13.0	29.8	15.7
	CNN + NN (Ma et al., 2017)	14.8	12.2	20.1	14.3	32.4	20.5
		12.2	10.6	16.0	11.6	28.1 14.6
	Transformer (Vaswani et al., 2017)	12.7	10.1	18.4	13.1	34.8	15.6
	VIT (Dosovitskiy et al., 2021)	12.3	10.0	17.3	12.1	29.7	16.1
	U-Transformer (This study)	11.4	9.5	16.0	11.2	28.7	14.1
	Channel Vision Transformer (This study)	12.1	10.1	19.9	12.0	29.7	14.7

U-net

[START_REF] Bapaume | Image Inpainting and Deep Learning to Forecast Short-Term Train Loads[END_REF]

  ). The results show that approximately 30% of images in the test set are identified as delayed situation. The remaining images are grouped in a Nominal set. In a similar way, the data set high load fluctuation can be extracted by recording high train load variations between two sequential stations for a single train. The second criterion can be used to identify images of a unique context or an external event. In this study, Strike and Lockdown are the two external events identified in the test case. Regarding forecasting results, U-Transformer outperforms all other models in all test cases, except for Strike. The U-net architecture outperforms U-Transformer for Strike images with a 0.06 lower WMAPE. Note that for the Delay set, U-net is the best model with 16.0% of error, the same as that of U-Transformer. In all image sets, Channel Vision Transformer is dominated by the best methods. However, it is among the top three methods in most of the test cases. Consequently, the results numerically prove that the proposed architecture, U-Transformer, can provide more accurate predictions for future train loads in particular for atypical situations.