Mériem Ben Abdallah

Marie Blonski

Sophie Mézières

Yann Gaudeau

Luc Taillandier

Jean-Marie Moureaux

Predictive models for diffuse low-grade glioma patients under chemotherapy

Diffuse low-grade gliomas are rare primitive cerebral tumours of adults. These tumors progress continuously over time and then turn to a higher grade of malignancy associated with neurological disability, leading ultimately to death. Tumour size is one of the most important prognostic factors. Thus, it is of great importance to be able to assess the volume of the tumor during the patients' monitoring. MRI is nowadays the recommended modality to achieve this. Furthermore, if surgery remains the first option for diffuse low-grade gliomas, chemotherapy is increasingly used (before or after a possible surgery). However, crucial and difficult questions remain to be answered: identifying subgroups of patients who could benefit from chemotherapy, determining the best time to initiate chemotherapy, defining the duration of chemotherapy and evaluating the optimal time to perform surgery, or otherwise radiotherapy. In this study, we propose to help clinicians in decision-making, by designing new predictive models dedicated to the evolution of the diameter of the tumor. Two proposed statistical models (linear and exponential) have been tested on a database of 16 patients whose temozolomidebased chemotherapy lasted between 14 and 32 months, with an average duration of 22.8125 months. The selection of the most appropriate model has been achieved with the corrected Akaike's Information Criterion. The results are very promising, with coefficients of determination varying from 0.79 to 0.97 with an average value of 0.90 for the linear model. This shows it is possible to alert the clinician to a change in the tumor diameter's dynamics.

I. INTRODUCTION

Diffuse low-grade gliomas (DLGG) are rare and infiltrative brain tumors. Three phases characterize their evolution:

-The first phase is asymptomatic with a linear and constant tumor growth rate (about 3.5mm per year) [START_REF] Pallud | Natural history of incidental world health organization grade II gliomas[END_REF]. -The second phase is associated with few neurological symptoms (seizure most frequently) allied with a linear and constant tumor growth rate of about 4 mm per year [START_REF] Mandonnet | Continuous growth of mean tumor diameter in a subset of grade II gliomas[END_REF]. -The third phase corresponds to the anaplastic transformation (high-grade glioma) with an increased tumor growth rate. The aim of treatments is to delay as much as possible the anaplastic transformation while preserving the quality of life [START_REF] Duffau | Preserving quality of life is not incompatible with increasing overall survival in diffuse low-grade glioma patients[END_REF]. Functional surgery is the first therapeutic option because of its clear impact on survival while maintaining or improving the quality of life [START_REF] Jakola | Comparison of a strategy favoring early surgical resection vs a strategy favoring watchful waiting in low-grade gliomas[END_REF]. Radiotherapy, which was the first complementary treatment proposed, has the same impact, regardless of its realization's moment (earlier at diagnosis or later at progression) [START_REF] Van Den Bent | Long-term efficacy of early versus delayed radiotherapy for low-grade astrocytoma and oligodendroglioma in adults: the eortc 22845 randomised trial[END_REF]. Furthermore, in an increasing manner, chemotherapy takes place earlier in the management of these patients, either in a neoadjuvant position (as a possible first treatment before surgery) or in case of progression after surgery for non re-operable patients [START_REF] Soffietti | Guidelines on management of low-grade gliomas: report of an efns-eano task force[END_REF] [START_REF] Blonski | Neoadjuvant chemotherapy may optimize the extent of resection of world health organization grade II gliomas: a case series of 17 patients[END_REF]. It is now admitted that MRI is recommended in the monitoring of the DLGG patients [START_REF] Soffietti | Guidelines on management of low-grade gliomas: report of an efns-eano task force[END_REF] and allows the assessment of the tumor volume. Indeed, volume monitoring is essential in therapeutic decision. In this context, two techniques have been proposed in the literature to estimate the tumor volume : three diameters technique [START_REF] Mandonnet | Continuous growth of mean tumor diameter in a subset of grade II gliomas[END_REF] and segmentation [START_REF] Pallud | Natural history of incidental world health organization grade II gliomas[END_REF] which is considered a gold standard. Regardless of the adopted technique, one crucial issue is that the treatment strategy should be strictly tailored to each patient [START_REF] Duffau | New concepts in the management of diffuse low-grade glioma: Proposal of a multistage and individualized therapeutic approach[END_REF]. In the framework of chemotherapy, it is of high importance to be able to assess the impact and the expected benefit of the treatment in order to control it. Thus, modelling the response to chemotherapy would help clinicians in decision-making by identifying subgroups of patients who could benefit from chemotherapy, determining the best time to initiate chemotherapy, fixing the duration of chemotherapy and evaluating the optimal time to perform surgery. In other words, clinicians could more easily propose a tailored solution to each patient. To our knowledge, two recent studies have been conducted to address this issue and have offered interesting results [START_REF] Ribba | A tumor growth inhibition model for low-grade glioma treated with chemotherapy or radiotherapy[END_REF] [START_REF] Mazzocco | Prediction of response to temozolomide in low-grade glioma patients based on tumor size dynamics and genetic characteristics[END_REF]. The proposed solutions in these studies are based on a microscopic approach, at the cellular scale. Furthermore, the volume measurement is obtained by the three diameters method. Here, we propose a different approach at a macroscopic scale which is based on the design of two predictive models for DLGG patients under Temolozomide chemotherapy. Another key point lies in the tumor volume assessment which is based here on MRI scans' segmentation. Our models are data-driven and adapt in real-time to each new MRI. This makes our approach a practical tool in a clinical routine to assist, simply and quickly, doctors in the establishment of their treatment strategy. The two proposed models allow us to predict the tumor diameter as a variable evolving according to time and are based on a training set of 5 MRI acquisitions from the begining of chemotherapy. We show that if a new observed diameter (corresponding to the current MRI examination) is inside the prediction interval given by the model, a normal evolution can be considered. On the contrary, if the new observation leaves the prediction interval, a change in the tumor diameter's dynamics of evolution is foreseen and an alert can be given to the clinician to help him in decisionmaking. The rest of the paper is organized as follows. In section 2, the material and method are presented. Models are detailed in section 3. Results are given in section 4. Finally, section 5 provides a discussion and a conclusion.

II. MATERIALS AND METHODS

Some DLGG patients have to undergo one or more chemotherapy sessions. After being confronted with the question of optimal timing of treatment initiation, physicians are then faced with the crucial choice of when to stop the treatment (if, of course, there is no tolerance problem). There is currently no consensus among the neuro-oncology community on how to determine that moment. In order to address this problem, we propose statistical predictive models which are based on the tumor diameter's evolution over time. This diameter is obtained from the tumor volume, that is numerically reconstructed from manual segmentations using the Delaunay-triangulation-based reconstruction algorithm of the OsiriX software. In this study, we will only consider patients in first-line chemotherapy, who didn't undergo any prior treatment, except surgery. We will also only investigate one type of chemotherapy, the temozolomide (TMZ), which is the most widely used molecule for DLGG due to its good tolerance by most patients and its practical use (oral treatment). For this work, we tested multiple regression models to predict the moment to end chemotherapy. Spontaneously, without any treatment, DLGG tumor diameter evolves linearly over time [START_REF] Mandonnet | Continuous growth of mean tumor diameter in a subset of grade II gliomas[END_REF]. We noticed that under chemotherapy, for some patients, the diameter evolves linearly, whereas, for other patients, the evolution is exponential. But for a small minority of cases, the evolution is neither monotonously decreasing nor even increasing and the curve does not fit any known or specific function. Our initial database included 21 patients who underwent TMZ chemotherapy. Five patients were excluded because they fitted neither the exponential nor the linear model. For these patients, and for other similar cases, we will adopt the classical approach of following up the dynamics of tumor growth. In the present article, we will only discuss the cases of patients following a linear or an exponential model, which represent the majority of our database (16/21 patients), and we will leave the discussion of other cases for later work. Our predictive models were thus applied on 16 patients whose duration of treatment lasted between 14 and 32 months, with an average duration of 22.8125 months. In this first study, we have included tumors regardless of their pathological (astrocytomas versus oligodendrogliomas versus mixed tumors) or molecular (including IDH 1/2 or 1p19q) status.

III. STATISTICAL ANALYSIS

Let D be the random variable representing the tumor diameter, following a simple linear regression model: Let D be the random variable representing the tumor diameter, following an asymptotic exponential model: D = a 0a 1 e -a 2 T + ε where a 0 : the asymptotic term which ensures the data's adequacy with reality where the tumor diameter never equals zero, regardless of the chemotherapy's efficiency. a 1 : the difference between the asymptotic term and the initial value of the tumor diameter. a 2 : the decay rate constant.

D = b 0 + b 1 T + ε
Our prediction models resort to a training dataset of an iid sample (D i , T i , ε i ) for the linear model and (D i , T i , ε i ) for the exponential model, where i is the observation number. Tumor diameters in the chemotherapy period, (D i ) i=0...n and (D i ) i=0...n , are obtained from MRI scans' manual segmentation by a clinician expert using the OsiriX software. The number of available training dataset n is low, often around 6. In any case, to comply with our statistical analysis, n must be at least equal to 5. The first step is to estimate the parameters, b 0 and b 1 for the linear model, a 0 , a 1 and a 2 for the exponential model, from the training data set.This estimation is based on the least squares method for the linear model and on the Gauss-Newton algorithm for the exponential model. In both models, the statistical error terms ε i are assumed to be independent, normally distributed N (0, σ ) and to fulfill the homoscedasticity condition. After estimating the parameters, we verify that these hypotheses are fullfilled. The statistical error terms ε i 's normality is verified using a Shapiro-Wilk test. The homoscedasticity condition is checked with a White test for the linear model and with the plot of the residuals vs. the fitted values for the exponential model. As for the independence hypothesis, a Durbin Watson test is used for the linear model and the plot of each residual vs. the previous residual is employed for the exponential model. Once these conditions are established, a Student test is applied on b 1 for the linear model, on a 1 and a 2 for the exponential model, in order to evaluate the significance of the regression. Moreover, the linear model's prediction quality is analysed with the coefficient of determination R 2 . If, for a given patient, all previous conditions are met for both models, we resort to the corrected Akaike's Information Criterion (AIC c ) [START_REF] Motulsky | Fitting Models to Biological Data using Linear and Nonlinear Regression : A practical guide to curve fitting[END_REF] to choose the model that best describes the dataset. AIC c is defined as follows:

AIC c = n ln SS n + 2K + 2K(K+1) n-K-1
where SS : the sum of the square of the vertical distances of the points from the curve . K : the number of parameters fit by the regression plus one. It equals 3 for the linear model and 4 for the exponential model. The best model is the one with the minimum value of AIC c . Once the model is validated, we agree the evolution of the tumor is either linear with estimated parameters b0 , b1 or exponential with estimated parameters â0 , â1 , â2 . Then a new observation is predicted at time T n+1 as follows:

Dn+1 = b0 + b1 T n+1 Linear model D n+1 = â0 -â1 e -â2 T n+1 Exponential model
A prediction interval is also defined for a certain type I error α, providing the range of values in which Dn+1 or D n+1 is likely to fall given T n+1 . If the new observation is inside the prediction interval, a normal evolution of the tumor diameter is announced. If it leaves the prediction interval, a change in the tumor diameter's dynamics of evolution is observed. This can be medically interpreted either positively (in case the diameter decreases below the lower endpoint of the prediction interval, heralding a likely good response to the treatment) or negatively (tumor growth under chemotherapy above the higher endpoint of prediction interval, patient not responding positively to the treatment).

IV. RESULTS

The results of this study have been implemented with the R software. Among the 16 patients of our dataset, 13 are classified as linear and 3 are classified as exponential. We selected a type I error α equal to 0.1. The coefficients of determination R 2 for the 13 linear patients vary from 0.77 to 0.97 with an average value of 0.90. In this paper, we will present one example of our linear predictive model and another one for the exponential predictive model for a representative purpose.

A. Example for the linear model

Patient 1 underwent chemotherapy for 27 months. For the learning phase, we had 6 points and we predicted one point preceding the end of the chemotherapy. The estimation of the linear parameters b 0 and b 1 gave the values 5.268757 and -0.025601 respectively. We then tested the normality hypothesis with the Shapiro-Willk test: W = 0.9888 > W crit = 0.713 for type I error equal to 0.01. We validated the homoscedasticity condition with the White test: f (2, 3) = 30.82 > W hite = 3.7468 for type I error equal to 0.01. We also confirmed the non correlation hypothesis with the Durbin Watson test: DW = 1.9082 which is between 1.5 and 2.5 as it should be to pass the test. We also verified the significance of the regression with a Student test on b 1 . We then computed the coefficient of variation R 2 which is equal to 0.87.

We also tested the exponential model. The exponential model coefficients a 0 , a 1 and a 2 were estimated at 4.71256, 0.61778 and 0.08615304 respectively. We checked the normality hypothesis with the Shapiro-Wilk test: W = 0.9021 > W crit = 0.713 for type I error equal to 0.01. The homoscedasticity and the correlation conditions were verified with the corresponding plots. As for the significance of the regression, we confirmed it with a Student test on a 1 and a 2 .

To choose the best model, we computed AIC c for both models. AIC c Linear = -6.495425 < AIC c Exponential = -1.268149. We thus chose the linear model to predict the last value of the diameter before the completion of chemotherapy as well as the prediction interval for type I error α equal to 0.1. The visualization of the curve for the training dataset, the real diameter value at next time and the prediction interval in fig. 1 show clearly that the data follows the regression line and that the real point for the predicted one is above the higher endpoint of the prediction interval. The displayed alert message is the following: "Significant increase in the diameter".

B. Example for the exponential model

Patient 2 underwent chemotherapy for 26 months. For the training phase, we had 6 points and we predicted one point preceding the end of the chemotherapy. Starting with the exponential model, the learning step returned the values 4.93097, 2.47087 and 0.1252605 for the estimation of a 0 , a 1 and a 2 respectively. The normality hypothesis was tested with the Shapiro-Willk test: W = 0.8965 > W crit = 0.713 for type I error equal to 0.01. The homoscedasticity and the correlation conditions were verified with the corresponding plots. As for the significance of the regression, we confirmed it with a Student test on a 1 and a 2 . We also tested the linear model, but as the non correlation hypothesis was not confirmed (DW = 1.0995 < 1.5), this model was rejected.

With the selected exponential model, we finally estimated the last point preceding the end of the treatment as well as the prediction interval for type I error α equal to 0.1. Fig. 2 shows the curve for the training dataset, the real diameter value, the predicted diameter and the prediction interval. The real data seems to perfectly fit the exponential model and the real point is inside the prediction interval. The displayed alert message is the following: "Regular diameter evolution".

V. DISCUSSION AND CONCLUSION

In this paper, we presented a new approach to help clinicians in decision-making for DLGG patients under chemotherapy. This approach is based on two statistical predictive models (linear and exponential) dedicated to the measure of tumor's diameter, as tumor size is one of the most important prognostic factors. Our study, conducted in Nancy University Hospital, France, relied on 16 patients whose temozolomide-based chemotherapy lasted between 14 and 32 months, with an average duration of 22.8125. Within this database, 13 patients followed the linear model while the 3 others followed the exponential model. Based on a training set including at least 5 MRI scans, the model is able to predict the next diameter from the current one with significant accuracy. Thus, thanks to the corresponding computed prediction interval, it is possible to check if the actual measured diameter matches the predicted one. Then, if the actual diameter lies within the prediction interval, a "normal evolution" message is given. In the opposite case, the clinician is alerted by a "Significant increase in the diameter" message. We are aware that the models' validation should rely on a different dataset than the learning dataset. Nevertheless, the small number of cases has not allowed us to carry out this procedure. That is why, in order to increase the training set size, but also to allow our models to predict diameters sooner within the chemotherapy period, a new protocol has been established in Nancy University Hospital. New patients who agree to this protocol benefit from additional non injected MRI scans at the begining of the treatment. Furthermore, in the near future, we intend to enlarge our DLGG database thanks to a collaboration with Montpellier University Hospital, France. Finally, as other molecular (IDH 1 or 2 mutations, 1p19q codeletion, MGMT promoter methylation, TERT promoter or ATRX mutations, etc.) or radiological (perfusion MRI, MR spectroscopy, amino acid PET imaging, etc.) factors could significantly influence tumor growth, we plan to include some of them in the design of our proposed models. Our long-term goal is to design a decision support tool which, based on different factors (tumor diameter, molecular and radiological parameters, etc.), would deliver a message to the clinician on the evolution of the DLGG in order to enable a personalized therapeutic management of patients.

  where T : the random variable representing the time of observation. ε : the unobserved error term. b 0 : the initial value of the tumor diameter. b 1 : the growth rate of the tumor diameter.

Fig. 1 .

 1 Fig. 1. The training dataset, the real value and the prediction interval with the linear model for patient 1.

Fig. 2 .

 2 Fig. 2. The training dataset, the real value and the prediction interval with the exponential model for patient 2.


Ben Meriem

Marie Abdallah

Sophie Blonski

Yann Wantz-Mézières

Luc Gaudeau

Jean-Marie Taillandier

Moureaux

Taillandier

Statistical evaluation of manual segmentation of a diffuse low-grade glioma MRI dataset

à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Statistical evaluation of manual segmentation of a diffuse low-grade glioma MRI dataset

Mériem Ben Abdallah * , Marie Blonski * † , Sophie Wantz-Mézières ‡ , Yann Gaudeau * § , Luc Taillandier * † and Jean-Marie Moureaux *

I. INTRODUCTION

Diffuse Low-Grade Gliomas (DLGG) are rare primitive cerebral tumours of adults. These tumours progress continually over time and then turn to a higher grade of malignancy associated with neurological disability and consequentially become fatal. Tumour size is one of the most important static prognostic factors [START_REF] Capelle | Spontaneous and therapeutic prognostic factors in adult hemispheric world health organization grade II gliomas: a series of 1097 cases: clinical article[END_REF]. Linear Regression analysis using mixed models have reported an average increase rate of 4.1 mm per year in tumor diameter [START_REF] Mandonnet | Continuous growth of mean tumor diameter in a subset of grade II gliomas[END_REF]. The therapeutic strategy is based on a personalized and long-term multistage approach with online adaptation over the years related to volumetric and clinical changes. Early functional surgery is usually the first therapy when possible. Chemotherapy can be used as an adjuvant treatment but sometimes, also, in a neoadjuvant position before surgical resection. Radiotherapy is usually reserved for cases of progression after chemotherapy for unresectable tumours or at the time of anaplastic transformation [START_REF] Duffau | New concepts in the management of diffuse low-grade glioma: Proposal of a multistage and individualized therapeutic approach[END_REF]. For patient monitoring, it is essential to apprehend the volumetric evolution under usual clinical conditions (during consultations) in order to optimally adapt the treatment in real time [START_REF] Pallud | Quantitative morphological magnetic resonance imaging follow-up of low-grade glioma: a plea for systematic measurement of growth rates[END_REF]. The simple qualitative comparison of two separate MRI examinations at 4 to 6 months intervals does not usually objectify the growth. It was originally proposed to measure the largest diameters in the 3 spatial planes, D1, D2, D3, and then to extrapolate the volume with the following formula: D1 * D2 * D3/2 [START_REF] Pallud | Velocity of tumor spontaneous expansion predicts long-term outcomes for diffuse low-grade gliomas[END_REF]. A softwarebased manual segmentation was developed in [START_REF] Mandonnet | Inter-and intrapatients comparison of who grade II glioma kinetics before and after surgical resection[END_REF] and has, since, become the standard technique for the majority of experts. This method is time-consuming, thus a massive segmentation by many different clinicians would improve the therapeutic treatment of patients. However, to our knowledge, DLGG manual segmentation's reproducibility on MRI images has not yet been assessed [START_REF] Chamberlain | Is the volume of low-grade glioma measurable and is it clinically relevant?[END_REF]. Indeed, the main up-to-date studies include several brain tumor types in the same study and focus rather on a comparison between automatic and manual segmentation performance. If automatic segmentation can be of great interest, we claim that in the case of DLGG, manual segmentation remains not only the ground truth but the current best way to determine the volume of such tumors for the majority of specialized teams. Indeed, automatic segmentation does not yet seem to be reliable for distinguishing tumor signal abnormalities and other causes of signal abnormalities (post-surgical or post-radiotherapy modifications, leucoencephalopathy from various aetiologies, etc.). But as manual segmentation is time-consuming, the less accurate 3 diameters method is mostly prefered for assessing the volume in daily hospital practice. The work we propose here addresses the question of manual segmentation's reproducibility by studying the impact of the practitioner on the DLGG's volume estimation. Indeed, the latter can strongly influence the choice of a therapy and the time to start or to stop it. Such repercussions motivate the conduct of a subjective study of manual segmentation consistency among a group of DLGG experts. Such a consistency is key to the reliability and reproducibility of clinical diagnosis and, consequently, to the selection of the appropriate therapy.

The rest of the paper is organized as follows. In section 2, the methodology and the tools applied in this study are described. In section 3, the statistical techniques of evaluation are detailed. Section 4 presents the results of the statistical study. Section 5 summarizes these results and discusses their consequences for medical practice.

II. MATERIALS AND METHODS

Subjective tests are often conducted to evaluate the quality of images and videos, as for example in the context of data compression studies [START_REF] Gaudeau | Compressed image quality assessment: application to an interactive upper limb radioloy atlas[END_REF], [START_REF] Chaabouni | Subjective and objective quality assessment for H264 compressed medical video sequences[END_REF]. These tests take into consideration the most current medical practices and are performed in a strictly controlled environment. The results of subjective tests are quantified by objective metrics and rely on a pre-defined ground truth for their interpretation. In this study, the average of the volumes was selected as a ground truth due to the absence of an absolute ground truth. A neuroradiology expert, who was excluded from the experts panel, selected 12 longitudinal MRI scans of 9 patients diagnosed with DLGG without any previous treatment. All patients were informed and provided proof of their written agreement to participate to the present study. Moreover, the patient information was anonymized and de-identified prior to analysis. The datasets were all FLAIR-weighted axial scans except for one T2-weighted axial scan. There were 3 Cube MRI scans and 9 regular MRI scans. The reproducibility of manual segmentation study was carried out within the Living Lab PROMETEE. 1 This platform is an innovation platform allowing the study and management of videos and images' technical quality with respect to medical usage. It is well-equipped and arranged, provides a highly efficient environment to comply with the general visualization conditions for these kind of tests, as fixed by the ITU-BT.500-13 recommendation [START_REF] Rec | Recommandation 500-13, methodology for the subjective assessment of the quality of television pictures[END_REF]. The room lighting was controlled so as not to produce reflections on the screen. The surrounding environment was all in white in order to avoid visual distractions. A panel of 14 experts performed manual segmentation on the dataset with OSIRIX as illustrated in the example of fig. 1. OSIRIX is an open source Dicom Viewer software for Apple Macintosh [START_REF] Rosset | Osirix: An open-source software for navigating in multidimensional DICOM images[END_REF] [START_REF]Osirix downloads[END_REF].The 32-bit OSIRIX version was adopted in this study. The participants started by performing a visual test on a tablet with the purpose of detecting the participants with vision problems. Then, they proceeded with a learning dataset, which was not included in the study results, so as to get familiar with the OSIRIX segmentation tool. The instruction was to manually delineate tumor contours on slices containing contrast enhancement related to a DLGG. In order to be consistent with medical practice, the radiological windowing and the number of slices to be segmented were not specified. The participants started the test by segmenting half the dataset, taking a 5minutes break, and then completing the segmentation of the other half. At the end, they completed a questionnaire about their medical specialty and their years of experience since residency.

Following the first tests of consistency, it turned out that one of the 14 participants had inconsistent results. Thus, all the results described hereafter are based on the ratings made by 13 consistent participants. For the study of the variability introduced by the medical specialty on the tumor, three categories were defined : neurologists, radiotherapists and radiologists. As for the years of experience, two groups were set: ]0 ; 10] and ]10 ; +∞[.The distribution of medical specialties and years of experience is listed, respectively, in Tables I and II.

After the test was complete, the manual tracings were saved and the tumor volume, for each dataset, was computed under OSIRIX based on the Delaunay triangulation reconstruction method.

III. STATISTICAL ANALYSIS

The final study dataset consists of 12 tumor volumes for each of the 13 participants: (x i, j ) i=1...13, j=1...12 . The purpose of the statistical analysis is to investigate the variability introduced by the practitioner factor on the tumor volume variable in order to examine the influence of the practitioner on the acquired tumor volumes. Other purposes of this study include the analysis of the relationship between the participant's medical specialty as well as their years of experience and the tumor volumes. For the study of the variability introduced by the practitioner, a one-way analysis of variance (ANOVA) [START_REF] Box | Statistics for Experimenters: an introduction to Design, Data Analysis,and Model Building[END_REF] was applied to tumor volumes.

In order to statistically quantify the variability introduced by the years of experience and the medical specialty on the tumor volumes, a standard volume, y i, j , was first calculated as follows:

y i, j = x i, j -x j σ j (1)
where x j is the mean volume, and σ j is the standard deviation by volume. Centering x i, j around the mean values of volumes for a given dataset and dividing by its standard deviation accounts for the difficulty of segmentation. The standard deviation, σ y i , of y i, j was then calculated and an exact Fisher test [START_REF] Altman | Practical statistics for medical research[END_REF] [15] was applied on σ y i for both studies. In order to assess the inter-observer variability, the coefficient of variation (COV) [START_REF] Weltens | Interobserver variations in gross tumor volume delineation of brain tumors on computed tomography and impact of magnetic resonance imaging[END_REF] [17] by volume was used. This coefficient measures the change in volume of the segmented objects, and is defined by:

COV j = σ j x j (2)
Another metric that is used to assess the inter-participant variability is the agreement index (AI) [START_REF] Xie | Semi-automated brain tumor and edema segmentation using MRI[END_REF]. This metric gives the inter-participants agreement , in pairs of participants, for each volume j = 1, ..., 12:

AI (i,i ), j = 1 - 2 x i, j -x i , j x i, j + x i , j (3)
for all pair of participants (i, i ); i = i ; i, i ∈ {1, ..., 13}. AI values vary from 0 (no agreement between participants) to 1 (perfect agreement between participants). Finally, to estimate the inter-participant variability on a pixel level, the interoperator variance (IV) [START_REF] Xie | Semi-automated brain tumor and edema segmentation using MRI[END_REF] was applied. This metric, computed for each commonly segmented slice of each MRI exam, quantifies the overlap of two segmented regions by each pair of participants. It is defined by:

IV = 1 - A M1 ∩ A M2 A M1 ∪ A M2 (4)
A M1 is the segmented area by participant 1 and A M2 is the segmented area by participant 2. IV values vary from 0 (perfect matching of pixel values) to 1 (no matching of pixel values).

IV. RESULTS

The statistical analysis was implemented with R software and Matlab. First of all, the volumes of the different participants for all datasets were plotted against the average of the volumes, the selected ground truth. As displayed in fig. 2, the practicians have the same volume variations, even for Cube FLAIR datasets, which are supposed to be harder to segment than regular FLAIR datasets. The set of curves merges well with the curve of the ground truth. This first result is confirmed by the boxplot in fig. 3, where the dispersion of tumor volumes per dataset around the mean and the median is low. This would suggest that practitioners tend to segment DLGG tumors similarly. In order to confirm this visual result, an ANOVA was performed on the dataset. With a significance level of 5%, it can be concluded that the practitioner factor has no significant influence on the average values of the volume variable.

Regarding the variability introduced by the medical specialization on the tumor volume variable, Fisher's exact test was performed with significance levels of 5%. With p-value equal to 0.604, we could not prove that the medical speciality has a significant impact on the assessed tumor volume. Table III confirms this assertion for medical specialty. Moreover, Kolmogorov-Smirnov tests on the COV between pairs of groups (with level of significance 5%) have confirmed this assertion. Note that the tumor volumes vary from 1.67 cm 3 to 117.35 cm 3 through the different exams. So we have a huge variety of volume size. COV is obviously more sensitive to small volumes. As for the variability generated by the years of experience on the tumor volume variable, Fisher's exact test released a p-value of 0.8961, indicating, clearly, that the years of experience could not be proved to have a significant influence on the segmented volume. This result is confirmed as well by Table IV and their field of expertise, was assessed. This study shows that, on average, neither the practitioner nor the medical speciality or experience seem to have a significant impact on the tumor volume. The latter result is rather surprising as one would expect that experience would be a discriminatory factor.

Another surprising observation was that the largest differences in volumes were noticed on the 3 first datasets, which are supposed to be easy to delineate. Their boxplot's (see Fig. 3) spread around the median is large compared to, say, datasets 4 and 11, Cube Flair datasets, that are supposed to be more complicated to segment. This might be explained by the novelty of the used delineation tool, OSIRIX, to some participants. So, on the first datasets, the participants still hadn't mastered this tool. Across Cube Flair datasets, dataset 14 seemed to be harder to delineate than datasets 4 and 11. This might be explained by the effect of tiredness by the end of the test. But it doesn't seem to affect the overall study result.

On the basis of several commonly used criteria of the literature dedicated to inter-variability assessment, the statistical analysis achieved on this study did not prove that the medical specialty or the years of experience had any impact on the segmented tumor volumes, regardless of the dataset difficulty (Cube vs classical MRI scan). This is an encouraging result that promotes cross-disciplinary collaboration among clinicians, especially for very frequent alternating consultations between neurosurgeons and medical neuro-oncologists. And even if this result should be confirmed by additional larger studies, it opens the door to interesting perspectives in the difficult context of DLGG, where automatic segmentation does not yet seem to be able to offer a fully reliable solution.

As a consequence of this finding, the manual segmentation process could be speeded up, as many clinicians would be able to delineate DLGG of different patients, even the ones they don't follow. The monitoring of tumor evolution would be improved as less time would be devoted by practitioners to manual segmentation and more time could be spent on clinical decisions regarding the appropriate treatment to prescribe at different stages of the disease.

Fig. 1 :

 1 Fig. 1: Example of the manual segmentation of an MRI's slice with OSIRIX. Each colored curve corresponds to the segmentation performed by one participant.

1 12 Datasets 13 Fig. 2 :

 112132 Fig. 2: Change in tumor volume based on MRI datasets and compared to the average volumes for all participants.

Fig. 3 :

 3 Fig. 3: Boxplot of the tumor volumes for all datasets.

TABLE I :

 I The distribution of participants by medical specialty.

	Medical specialty	Neurology Radiology Radiotherapy
	Number of participants	6	4	3

TABLE II :

 II The distribution of participants by years of experience.

	Years of experience	]0 ; 10] ]10 ; +∞[
	Number of participants	8	5

TABLE III :

 III COV, AI and IV by medical specialty.

	Medical specialty	Neurology	Radiology	Radiotherapy
	COV (mean±S.D.) 17.99 ±12.44	16.56 ±10.11	14.48 ±12.32
	AI (mean±S.D.)	0.74 ±0.28	0.73 ±0.27	0.74 ±0.27
	IV (mean±S.D.)	0.27 ±0.07	0.3 ±0.08	0.29 ±0.09

  .

	V. DISCUSSION AND CONCLUSIONS
	In this work, the reproducibility of manual MRI volume
	segmentation with regard to practitioners, their experience

TABLE IV :

 IV COV, AI and IV by years of experience.

	Years of experience	]0 ; 10]	]10 ; +∞[
	COV (mean±S.D.)	16.58 ±11.09	14.86 ±11.88
	AI (mean±S.D.)	0.75 ±0.28	0.73 ±0.27
	IV (mean±S.D.)	0.25 ±0.05	0.3 ±0.09

PeRceptiOn utilisateur pour les usages du Multim Édia dans les applications m ÉdicalEs: User perception for multimedia usages in medical applications. PROMETEE is located in TELECOM Nancy engineering School, Nancy France. http://telecomnancy.univ-lorraine.fr/fr/recherche/living-lab.

ACKNOWLEDGMENT

This work has been supported by the Celtic-Plus European Project E3.

Great recognition and thanks are due to all the clinicians from CHRU Nancy and CHR Metz who participated in this study. Namely, we would like to thank: Pr Serge Bracard, Pr Luc Taillandier, Dr Marie Blonski, Dr Basile Wittwer, Dr Guillaume Vogin, Dr Christian Delgoffe, Dr Claire Griffaton-Taillandier, Dr Marie-Alexia Ottenin, Dr Sophie Planel, Dr Fabien Rech, Dr Valérie Bernier, Camille Dahan, Dr Emanuelle Schmitt, Dr Lavinia Jager Simon and Dr Philippe Quetin.


Hubert Godfroy
email: hubert.godfroy@loria.fr

Jean-Yves Marion

A theory of reflexive computation based on soft intuitionistic logic

Computational Reflection is a paradigm in which the computational mechanisms controls the different levels of data interpretation. It can be decomposed into two processes: (i) reification, which turns a program into a data and (ii) reflection, which, inversely, installs a data as a program or a context in order to be run. We present a logical account of reflection based on a confluent lambda-calculus. We define two type assignment systems called Soft Intuitionistic Logic (SIL) and Intuitionistic Logic with Promotion (PIL) in which we introduce the exponential modality ! of linear logic. The duality between reification and reflection is to be found in the soft-promotion rule in SIL (resp. in the promotion rule in PIL) and in the dereliction rule. We also show that SIL (or PIL) is a framework in which partial evaluation can be efficiently performed. Finally, we add a control operator, which reifies its evaluation context. Thus a program may have full control of its computational state. We extend the type system with classical logic and semantics is provided by Krivine abstract machine. We establish the soundness of our type system.

Introduction

Nowadays, it is common that programs are protected against reverse engineering. One of predominant software protections is the use of packers. Viruses, and more generally malware, incorporate such protections. The run of a packer may be seen as a sequence of code waves. The first wave contains the initial code, which is going to create a second code wave by decrypting or decompressing a data. Then the second code wave in turn will create a third wave, . . . and it is not uncommon to see packers that deploy more than 100 waves. A packer is a typical example of a self-modifying program. Another example of a self-modifying program is a Justin-Time Compiler. A self-modifying program is a program that can modify its own code and that can generate on the fly new codes. Self-modifying programs are inherent to computability. This notion goes back to the second recursion Theorem of Kleene [START_REF] Kleene | On notation for ordinal numbers[END_REF][START_REF] Yiannis | Kleene's amazing second recursion theorem[END_REF]. The article [START_REF] Marion | From Turing machines to computer viruses[END_REF] explains the relationship between self-modifying programs and Kleene's amazing construction.

This notion of self-modification is closely related to computational reflection. The intuition behind is that code may be transformed into data, which is named reification, and inversely a data can be transformed into a code, which is named reflection. Computational reflection is an important tool in programming language theory. It is the foundation of meta-programming and of Futamura projections [START_REF] Neil | Computability and Complexity[END_REF] (in which an interpreter is specialized to define a compiler). We will show how our framework can be applied to partial evaluation.

Our motivation is that we seek a paradigmatic reflexive type language based on lambda-calculus. As self-modifying programs become more widely used, it is increasingly important to have a better understanding of the notions that underpinned them. We begin with the definition of a confluent lambda calculus Λ R in which reification and reflection are incorporated. Then, we present a type system SIL, which is sound with respect to Λ R semantics. The type system SIL is based on intuitionistic logic with the exponential modality !. Implicit computational complexity, and in particular the work of Lafont [START_REF] Lafont | Soft Linear Logic and Polynomial Time[END_REF] on Soft Linear Logic, has provided insight on exponential rules. The type system SIL uses the soft promotion rule to build a quoted term, that is to reify an expression. It follows that the dereliction rule amounts to a reflection principle, that is it allows to run a quoted term. Then, we will also see that the soft promotion rule can be replaced by the promotion rule. It turns out that the type system, named PIL, with promotion is equivalent to the system based on modal logic of Davis and Pfenning designed to deal with staged computation [START_REF] Davies | A Modal Analysis of Staged Computation[END_REF]. We will also see that we can define a fixpoint that captures the essence of Kleene second recursion theorem and thus define a quine.

Finally, the last section explore the ability of a reflexive program to have access to the computational states that is to have access to both evaluation contexts and current expressions, that are represented as data. To this end, we define a typed lambda calculus SIL * with a control operator (call/cc), which gives access to the reification of the current continuation. The operational semantics is conveyed by the Krivine abstract machine [START_REF] Krivine | A call-by-name lambda-calculus machine[END_REF]. The type system is built on the algorithmic understanding of classical logic by Griffin [START_REF] Griffin | A Formulae-as-type Notion of Control[END_REF] and Krivine [START_REF] Krivine | Dependent choice, quote and the clock[END_REF].

The design of typed reflexive λ-calculi is a quite unexplored research line, and so exploring different approaches is interesting. There are two other logical frameworks developed to study staged computation. Taha and his co-authors use Temporal logic [START_REF] Davies | A temporal-logic approach to binding-time analysis[END_REF] with 'next t" and "prev t" markers and type constructor A statement is true for the next stage. A Caml implementation [START_REF] Taha | A Gentle Introduction to Multi-stage Programming[END_REF] is available. Davis, Pfenning and their co-authors in a series of papers, see [START_REF] Davies | A Modal Analysis of Staged Computation[END_REF] and [START_REF] Nanevski | Contextual Modal Type Theory[END_REF], use modal logic to syntactically describe frozen terms, that is, closed values which remains to be evaluated. In this framework data are terms of the form box(t) : A and are in normal form. As we have already said, our study is closed of their works and have been a source of inspiration.

Reflection in lambda-calculus

We now present the paradigmatic reflexive language Λ R . In order to modeling reflection in lambda-calculus, we add two operations that we call reification and reflection. Reification converts a term t into a quoted term t . The intuition is that quoted terms represent data and so they cannot be reduced. A quoted term t may be the abstract syntax tree (AST) of t overs the domain of lists or a string contains an encryption of the AST of t. In this case, the intuition is that run will decrypt t before running it. The process of converting a reified value t into a term, which may be then executed, is called reflection. The reflection operator is provided by the construction let x = t ′ in t. The intention is that let x = s in t reduces to t[x ← s]. Thus, the term run defined below executes a reified term by unquoting a quoted term and run s evaluates to s

run def = λy. let x = y in x
The set of expressions of Λ R is defined by the following grammar:

Λ R ∋ t def = x | t t | λx.t | t | let x = t in t
All along, we will say that quoted terms are expressions of the form t . In contrast, terms will denote expressions which are not quoted. Expressions refer collectively to both terms and unquoted terms. That said, if we are not careful, the system may not be confluent. Indeed, consider the expression (λx. x )((λz.a)λy.y). It could be reduced to either a or (λz.a)(λy.y) , which are both in normal form. One way to fix the problem is to say that quoted terms are not affected by λ-binders. That is, the variable x in λx. λy.xy should be free while y is bound. Thereby, the term (λx. x )t should return x because the occurrence of x in x is free inside λx. x . Similarly, the term λx. run x should reduce to λy.x. That is why, the let construction is necessary because it ensures that variables in a quoted term are correctly bounded.

The set of free variables should be carefully defined in order to avoid to capture free variables in quoted terms. Notice that unlike lambda binders, a let bound variable can capture variable in terms as well as in quoted terms. The set of free variables is achieved by defining mutually both the set of free variables in (unquoted) terms (FV λ ) and the set of free variables inside quoted terms (FV let ) as follows:

FV λ (x) = {x} FV λ (λx.t) = FV λ (t) \ x FV λ (t 1 t 2 ) = FV λ (t 1 ) ∪ FV λ (t 2 ) FV λ ( t ) = ∅ FV λ (let x = t in t ′ ) = FV λ (t) ∪ (FV λ (t ′ ) \ x) FV let (x) = ∅ FV let (λx.t) = FV let (t) FV let (t 1 t 2 ) = FV let (t 1 ) ∪ FV let (t 2 ) FV let ( t ) = FV λ (t) ∪ FV let (t) FV let (let x = t in t ′ ) = FV let (t) ∪ (FV let (t ′ ) \ x)
As a result, the set of free variables of an term t is FV(t) = FV λ (t) ∪ FV let (t). To illustrate this definition, let us consider the term t def = (λx. run f x λy.y ). We have FV(t) = FV λ (t) ∪ FV let (t) = {f } ∪ {x}.

From now on, we work as usual with terms up to renaming of bound variables, that is up to alpha-conversion. This means that the name of lambda bound variables and the name of let bound variables can be changed to avoid the capture of free variable names wrt FV definition. For example let x = z in λx.x x is alpha-equivalent to let x 1 = z in λx 2 .x 2 x 1 . The operation of substitution is then defined thus:

x[x ← s] = s y[x ← s] = y y = x (λy.t)[x ← s] = λy.t[x ← s] y = x and y ∈ FV(s) (tt ′ )[x ← s] = t[x ← s]t ′ [x ← s] (let y = t in t ′ )[x ← s] = let y = t[x ← s] in t ′ [x ← s] y = x and y ∈ FV(s) t [x ← s] = t[x ← s]
Reduction rules are based on the contraction of λ-redexes and let-redexes:

(λx.t)t ′ λ → t[x ← t ′ ] let x = t ′ in t let → t[x ← t ′ ]
The set of evaluation contexts of Λ R expressions is defined as follows:

E def = [] | E t | t E | λx.E | let x = E in t | let x = t in E
and reduction rules are extended under contexts as usual:

t λ → t ′ E[t] λ → E[t ′ ] t let → t ′ E[t] let → E[t ′ ] Finally, we define →= λ → ∪ let →.
The reflexive and transitive closure of → is denoted *

→.

It is important to notice that for any context E, E is not a context. Therefore, it is not possible to reduce a quoted term. This is what is expected since t is intuitively a data and not a program. We end by two examples that illustrates two features of the let construction. As we have already said, the let construction allows to unquote an expression. Let us return to the expression run. It allows to execute a quoted term t :

run t → (λx. let y = x in y) t → let y = t in y → t
In turn, t may be executed. The second example illustrates how a variable, which is bound by let, may be replaced in a quoted term.

let x = (λx.x) s in (λxy.y) (λy.y)x x → let x = s in (λxy.y) (λy.y)x x → (λxy.y) (λy.y)s s → s
The computation ends because s is a quoted term. Notice that the reduction of the top redex (with let-binder) is blocked until (λx.x) s is reduced to a quoted term.

Confluence

We now state the fact that the system (Λ R , →) is confluent. Intuitively, the key point is that variables in quoted terms are not captured by outside λ-binders. For example, (λx. let y = x in y ) ((λx. a )λx.x) reduces to a because the let construction forces to evaluate its first argument (λx. a )λx.x and then performs a let reduction.

Theorem 1. (Λ R , →) is confluent. That is, if t * → t ′ and t * → t ′′ then there is an term s such that t ′ * → s and t ′′ * → s. We decompose the system (Λ R , →) into two systems (Λ R , λ →) and (Λ R , let →) in
order to show its confluence. We then prove separately that (Λ R , λ →) and (Λ R , let →) are confluent and that both systems commute. By Hindley-Rosen Lemma [START_REF] Barry | Tree-Manipulating Systems and Church-Rosser Theorems[END_REF][START_REF] Hindley | The Church-Rosser Property and a Result in Combinatory Logic[END_REF], we conclude that 3 Soft Intuitionistic Logic (SIL)

(Λ R , →) = (Λ R , λ → ∪ let →) is confluent. Property 1 The reduction rule (Λ R , λ →) is confluent. Proof. λ-

Typing reflection

We present a deductive system that we call Soft Intuitionistic Logic (SIL), which is a type assignment system for a proper subset of Λ R terms. The system is constructed from Intuitionistic Logic to which we add the modality ! that amounts to the exponential modality of Linear Logic.

The types are defined as follows where α ranges over base types:

Types ∋ A def = α | A → B | !A
The rules of SIL are shown in Figure 1 and are given in sequent calculus style. The assumptions have the form p 1 : A 1 , . . . , p n : A n where each p i is a pattern. A pattern is either a variable x or a quoted variable of the form x where x is a variable. Note that there is no nested quoted variables. A context is a set of assumptions where all patterns are different. The domain of Γ is defined by dom Take the expression run previously defined. We can see that the type of run is !A → A. Likewise, the expression λf λx. let s = f in let t = x in st , which takes a quoted function f and a quoted argument x and re-quotes their application, is of type !

(Γ ) = {x | (x : A) ∈ Γ } ∪ {x | ( x : A) ∈ Γ }. Contexts range over Γ , ∆. Axiom x : A ⊢ x : A Weakening Γ ⊢ t : B Γ, p : A ⊢ t : B Contraction 1 Γ, y : A, z : A ⊢ t : C Γ, x : A ⊢ t[y ← x][z ← x] : C Contraction 2 Γ, y :!A, z :!A ⊢ t : C Γ, x :!A ⊢ t[y ← x][z ← x] : C →Left Γ, x : B ⊢ t : C ∆ ⊢ t ′ : A Γ, ∆, f : A → B ⊢ t[x ← f t ′ ] : C →Right Γ, x : A ⊢ t : B Γ ⊢ λx.t : A → B SoftPromotion x1 : A1, • • • , xn : An ⊢ t : B x1 :!A1, • • • , xn :!An ⊢ t :!B Dereliction Γ, x : A ⊢ t : B Γ, x :!A ⊢ t : B Cut Γ ⊢ t ′ : A ∆, x : A ⊢ t : B Γ, ∆ ⊢ t[x ← t ′ ] : B Let Γ, x :!A ⊢ t : B Γ, y :!A ⊢ let x = y in t : B
(A → B) →!A →!B.
The soft promotion rule allows to reify a term t. That is, the soft promotion rule constructs a term t of type !A. Simultaneously, the soft-promotion also quotes all variables in the context, and thus all variables occurring in a quoted terms are marked. The soft promotion rule is inspired by Soft Linear Logic of Lafont [START_REF] Lafont | Soft Linear Logic and Polynomial Time[END_REF] using proof nets and by both typed systems defined in Baillot & al. [START_REF] Baillot | Soft lambda-calculus: a language for polynomial time computation[END_REF] and by Gaboardi & al. [4], which characterized exactly Ptime computations. The multiplexing rule of Soft Linear Logic is meaningless in SIL since there is a contraction rule. The elimination rule for the modality ! is the dereliction rule. It corresponds to a reflective process by turning a quoted terms (aka data) into a term (aka programs). Quoted variables are never bound by a λ but by a let construction. That said, the let rule allows on one hand to use a quoted-variable and on the other hand to introduce a new variable y of modal type (i.e. of type !A), which may be then bound by a λ. The let rule is like a border, which waits for a quoted term in order to make a substitution.

The type assignment systems for λ-calculus derived from Linear Logic have to be carefully design in order to be coherent. Indeed, a same λ-term may have different proofs. Thus, in the type assignment system STA of [START_REF] Gaboardi | A soft type assignment system for λ-calculus[END_REF] based on Soft Liner Logic, the cut rule is restricted to non-modal types. Similarly, the sequent calculus for Linear Logic of Wadler in [START_REF] Wadler | A syntax for linear logic[END_REF] has a let rule to deal with the fact that the cut rule and the promotion rule introduce incoherence. It is clear that the system SIL inherits of these difficulties and the proposed solutions.

Correctness of SIL

The following properties show that SIL is correct with respect to (i) the management of free and bounded variables of Λ R , which guarantees that the calculus is confluent and (ii) that the typing is preserved during computations.

Property 4

1. If Γ ⊢ t : A, then FV(t) ⊆ dom(Γ ). 2. If Γ ⊢ t : A and x ∈ FV let (t) then there is B such that x :!B ∈ Γ Proof. By induction on t.

Notice that if x ∈ FV λ (t), then x : B is not necessarily in Γ because of Dereliction rule: x :!B ⊢ x : B. The property of substitution is expressed thus:

Lemma 1 (Substitution). 1. If Γ ⊢ t ′ : A and Γ, x : A ⊢ t : B, then Γ ⊢ t[x ← t ′ ] : B 2. If Γ ⊢ t ′ :!A and Γ, x :!A ⊢ t : B then Γ ⊢ t[x ← t ′ ] : B
Proof. The proofs are in both cases by induction on t.

Finally, we get the main result which is the soundness of the type system.

Theorem 1 (Subject reduction) If Γ ⊢ t : A and t → t ′ then Γ ⊢ t ′ : A.

Proof. By induction on the reduction context E.

Intuitionistic Logic with Promotion (PIL)

Promotion

We present PIL, for Intuitionistic Logic with Promotion, which is the system SIL in which the Soft Promotion Rule is replaced by the Promotion rule given below:

Promotion x 1 :!A 1 , • • • , x n :!A n ⊢ t : B x 1 :!A 1 , • • • , x n :!A n ⊢ t :!B
PIL is a proper extension of SIL, that is SIL PIL. Typically, the term λy : !A let x = y in x of type !A →!!A is derivable in PIL but it is not derivable in SIL. This is due to the fact that the digging rule (i.e. !A →!!A) is not derivable in SIL.

In [START_REF] Davies | A Modal Analysis of Staged Computation[END_REF], Davis and Pfenning present a nice type system based on intuitionistic modal logic S4 for studying staged computation. They introduce a modal type constructor which plays the same role that !. Their system is based on sequents with two contexts ∆; Γ ⊢ e t : A where ∆ is the modal context and Γ is a non-modal context. Actually, the system PIL based on the promotion rule is equivalent to Davis and Pfenning system.

Theorem 2 ∆; Γ ⊢ e t : A is derivable iff ∆, Γ ⊢ t : A in PIL, where ∆ = { x :!A | x : A ∈ ∆}.
This result is not surprising since it is known at least from the works of Schellinx [START_REF] Schellinx | A Linear Approach to Modal Proof Theory[END_REF] and of Martini and Masini [START_REF] Martini | A Modal View of Linear Logic[END_REF] that S4 modal logic can be translated into linear logic.

A reflexive fixpoint

The system PIL allows to define an interesting reflexive fixpoint Z as follows :

Z t Z → t Z t
The type of Z is !(!A → A) → A. Now, we may express the spirit of Kleene's second recursion Theorem. Recall the intuition. A quoted term is a data. So a function takes as input a data and so it should be defined by an expression of type !A → A. Now, each expression p of type !A → A has a fixpoint e def = Z p . Indeed, p e ∼ e where ∼ means that both expressions has the same normal form or both diverge. We see that each partial function denoted by an expression of type !A → A has a fixpoint e . It follows that we can define a self-reproducible expression. For this, let p be λx. let y = x in y and let q be the fixpoint of p. We have that the expression q reduces to q, that is q outputs and runs itself.

Staging transformation

A reflexive typed programming language

Let Σ be a vocabulary that comes with a typing assignation σ such that for each operation f ∈ Σ, σ(f ) is the type of f . Thanks to the vocabulary Σ, we may define first order structures like integers, words, lists and operations like conditional, addition, multiplication. We define Λ R (Σ) that extends Λ R by adding (i) a fixpoint fix and (ii) first order facilities (n-ary constants) with respect to a vocabulary Σ.

Λ R (Σ) ∋ t def = x | t t | λx.t | t | let x = t in t | fix t | f (t, . . . , t)
where f ∈ Σ

The reduction rules of Λ R (Σ) are the ones of Λ R and rules as given below:

fix t fix → t (fix t) f (t 1 , . . . , t n ) f → t ′ where f ∈ Σ

Representing expressions

Quoted terms are data with a syntax at the same (meta)-level than Λ R expressions. Presently, quoted terms don't have any concrete representation and so it is not possible to perform computation on them and for example to define staging transformation, that is to specialize an expression to a data. Therefore, we now give informally an expression-as-data representation of Λ R (Σ) expressions. For this, assume given a data domain D generated by Σ and also assume a coding t of an expression t, which is a bijective function from Λ R (Σ) to D. Then, t is the concrete representation of a quoted term t . An historical example of such a coding is the Gödel numbering but we may also define an encoding function on a more expressive structure using lists as it is explained in Jones book [START_REF] Neil | Computability and Complexity[END_REF].

From now on, we may have an operation S in Σ that transforms quoted terms, with the proviso that types of p and of S( p ) are the same. We illustrate this idea in Figure 2 by defining a term transformation S that reduces a quoted term like a staging transformation. That is, redexes are reduced when it is possible. As a result, a quoted term like λf (λx.(f x))a is reduced to λf (f a) .

An example of staging transformation

An important benefit of having a program transformation defined over the encoding of quoted terms is that partial evaluation can be performed efficiently. Take as an example the power function pow n a such pow n a = a n . If we know that the exponent, say 2, we would like to fully specialized the function pow and obtain λa.a × a . For this just take the following definition of pow: where S is the program transformation defined previously. The function pow has the type int →!(int → int) in SIL. By a straightforward induction on we can prove that pow n is fully specialized. So for example, pow 3 is specialized to λa.a × a × a .

pow = fix λp.λn. if (n = 0) then λa.1 else let x = p (n -1) in S( λa.a × (x a) ) S(t) S → t ′ S(λx.t) S → λx.t ′ S(ti) S → t ′ i f (t ′ 1 , • • • , t ′ n ) f → t S(t) S → t ′ S(f (t1, • • • , tn)) S → t ′ S(ti) S → t ′ i t ′ 1 = λx.t ′′ 1 t ′ 1 t ′ 2 λ → t ′′ 1 [x ← t ′ 2 ] S(t ′′ 1 [x ← t ′ 2 ]) S → t ′ S(t1 t2) S → t ′ S(ti) S → t ′ i t ′ 1 = t ′′ 1 let x = t ′ 1 in t ′ 2 let → t ′ 2 [x ← t ′′ 1 ] S(t ′ 2 [x ← t ′′ 1 ]) S → t ′ S(let x = t1 in t2) S → t ′ Otherwise : S(t) S → t

A typed reflexive theory of control

Until now, we have focused on the process of reflecting a quoted term or on reifying a term. The next step is to a give to a program the ability to reflect and reify its own context. This is an important feature in the design of a programming language by "bootstrapping". More generally, the design of self-modifying programs necessitates to control contexts of execution. A typical example which comes from the malware programming world is a payload (i.e. the code of the virus) which is run piece by piece inside a sequence of waves of interpreters. Each wave may just run another layer of interpretation and may call a part of the code of the payload and returns a value to the context of the current wave or to the context of a previous wave.

Syntax and semantics

We define Λ * R which extends Λ R by adding continuations as follows

Λ * R ∋ t def = x | t t | λx.t | t | let x = t in t | k π | E
Stacks (or evaluation contexts) are defined simultaneously thus

π = [] | t.π | (x, t).π
A stack is a finite sequence t 1 Semantics of Λ * R is given by a Krivine's machine [START_REF] Krivine | A call-by-name lambda-calculus machine[END_REF] that performs a Call-By-Name (CBN) computation:

t t ′ ⋆ π → t ⋆ t ′ .π λx.t ⋆ t ′ .π → t[x ← t ′ ] ⋆ π let x = t in t ′ ⋆ π → t ⋆ (x, t ′ ).π t ⋆ (x, t ′ ).π → t ′ [x ← t] ⋆ π E ⋆ t.π → t ⋆ k π .[] k π ′ ⋆ t.π → t ⋆ π ′
The main difference with a standard Krivine's abstract machine is the control operator E. When E is run1 , the current context is reified and thus k π is pushed on the current stack. Thus, a program may eventually read or modify its evaluation context because it is a data. Conversely, in order to run a continuation k π ′ , we need first to reflect the quoted stack k π ′ thanks to the let rule. When a let rule is triggered, the expression t is first evaluated and (x, t ′ ) is pushed on the stack. Then, when a quoted term is met t , the variable x is replaced by t in t ′ .

A state of Krivine abstract machine is a pair t⋆π where t is a closed expression and π is a stack. The initial state is t ⋆ []. There are four kinds of halting states:

λx.t ⋆ [], t ⋆ [], E ⋆ [] and k π ⋆ [],
which correspond to the end of a normal computation. All other final states are error states. For example, λx.t ⋆ (x, t).π is an error state because (x, t) is not a term.

A type system for reflexive continuations

Following Krivine's approach [START_REF] Krivine | Dependent choice, quote and the clock[END_REF], we define a type system SIL * to type a subset of Λ * R expressions. SIL * is an extension of SIL. Types are defined thus.

A def = A → A|!A | ⊥
The constant type ⊥ is the "empty type", that is the type of terms which do not return anything to their immediate context. For instance, k π t evaluates t in π and is of type ⊥ because it returns nothing locally.

Type rules of SIL * are inspired by Selinger [START_REF] Selinger | From Continuation Passing Style to Krivine Abstract Machine[END_REF] and comprise the following rules for constants and stacks in addition of the type rules of SIL

Call/CC Γ ⊢ E : (!(A → ⊥) → ⊥) → A Throw π : A ⊢ Γ ⊢ k π : A → ⊥ Bot [] : ⊥ ⊢ Top [] : A top ⊢ TermCons ⊢ t : A π : B ⊢ t.π : A → B ⊢ LetCons x :!A ⊢ t : B π : B ⊢ (x, t).π :!A ⊢
The type of E is a variation of the double negation rule in which the modality ! indicates that it is not the stack which is stored but a data that represents a stack. Here the rule Top where A top is the top-level type of the entire program as in [START_REF] Selinger | From Continuation Passing Style to Krivine Abstract Machine[END_REF]. The type of a stack is the type of a term that can use the stack as an evaluation context.

Finally, a state t ⋆ π is well typed if both the expression t and the stack π are of same type:

Proc ⊢ t : A π : A ⊢ ⊢ t ⋆ π

Soundness of the type system

Now we establish that the evaluation of closed and well-typed expression t in SIL * by the Krivine abstract machine is correct.

Theorem 3 (Type soundness) If t is closed and is well typed in SIL * , then there is no sequence of the Krivine's abstract machine from t ⋆ [] leading to an error state.

To prove this theorem, we use a modified version of the subject reduction property which claims that well typing property is preserved all along the computation (Lemma 3). Moreover if t is closed and well typed, then t ⋆ [] is well typed. And finally no error state is well typed (Lemma 2). Lemma 2. No error state is well typed.

Proof. Error states are of the forms λx.t ⋆ (x ′ , t ′ ).π, t ⋆ t ′ .π, E ⋆ (x, t).π and k π ⋆ (x, t ′ ).π ′ . Each error cannot be typed because types A → B and !C are different. SIL * enjoys subject reduction.

Lemma 3 (Subject reduction). If t ⋆ π is well typed and t ⋆ π → t ′ ⋆ π ′ then t ′ ⋆ π ′ is well typed.

Proof. Substitution Lemma 1 is still valid. Then the theorem is proved by case analysis on the evaluation rule:

-Suppose that let x = t in t ′ ⋆ π is well typed. Then x :!A ⊢ t ′ : B and ⊢ t :!A and π : B ⊢. It follows by rule LetCons that (x, t ′ ).π :!A ⊢. So t ⋆ (x, t ′ ).π is well typed. -Suppose that t ⋆ (x, t ′ ).π is well typed. Then ⊢ t : A, x :!A ⊢ t ′ : B and π : B ⊢. By substitution lemma,

⊢ t ′ [x/t] : B. Then t ′ [x/t] ⋆ π is well typed. -Suppose that E ⋆ t.π is well typed. Then t.π : (!(A → ⊥) → ⊥) → A) ⊢. It follows that ⊢ t :!(A → ⊥) → ⊥ and π : A ⊢. Since ⊢ k π :!(A → ⊥), we have k π .[] :!(A → ⊥) → ⊥ ⊢. So t ⋆ k π .[] is well typed.
The other cases are similar.

Going up and down

The system SIL * provides mechanisms to have full access to the state of the computation, that is the expression under evaluation and its context. This access is provided by reification. Similarly, reflection can specify in which evaluation context an expression is evaluated. As previously said, it is common to specify a self-modifying program as a reflective tower in which the term at wave n spawns a term at wave n + 1 by executing a quoted term. Then, the expression run at wave n + 1 may have access to the evaluation context of wave n, and actually it may have access to each evaluation context below it, that is from the wave 1 to the wave n + 1. We illustrate this scenario by an example. For this, we reread and adapt Mendhekar and Friedman [START_REF] Mendhekar | Towards a theory of reflexive programming languages[END_REF] approach. We first define a reflective operator ⊗ :!(A → ⊥) →!A → ⊥ which takes a reified evaluation context and a reified expression and create a new wave by spawning the input expression in the given evaluation context: ⊗ def = λK.λT. let k = K in let t = T in k t.

Thus, if T n+1 encodes a given expression T n+1 and k πn+1 encodes a given evaluation context π n+1 , ⊗ k πn+1 T n+1 generates the wave n + 1 by spawning the state (T n+1 ⋆ π n+1 ) as follows:

⊗ k πn+1 T n+1 ⋆ π * → k πn+1 T n+1 ⋆ π * → T n+1 ⋆ π n+1
The reflective operator ⊗ allows to go from wave n to wave n + 1. Intuitively, we may define the wave 1 as the sequence of states starting from the initial state (t⋆[]) to the first state (⊗ k π1 T 1 )⋆π containing ⊗. At this moment, the second wave begins until it reaches again a state like (⊗ k π2 T 2 ) ⋆ π ′ , and so on. The intuition is that the reflective operator ⊗ is not executed inside a wave and so no data are run.

The second step of the construction consists in providing access to the evaluation context of the wave n to T n+1 at wave n + 1. For this, we suppose that T n+1 has a free variable k which will be replace by a continuation pointing to the evaluation context of the previous wave. The wave n expression T n spawns wave n + 1:

T n def = E(λK. let k = K in ⊗ k πn+1 T n+1 ).
Suppose that the stack π n is of type A n . Then, T n is of type A n . The run of T n in its evaluation context π n proceeds as follows:

1. T n captures a reified version of its context:

E(λK. let k = K in ⊗ k πn+1 T n+1 ) ⋆ π n → λK. let k = K in ⊗ k πn+1 T n+1 ⋆ k πn .[] → let k = k πn in ⊗ k πn+1 T n+1 ⋆ [] 2.
T n sends its reified context to data T n+1 by binding k.

⊗ k πn+1 T n+1 [k ← k πn ] ⋆ [] * → T n+1 [k ← k πn ] ⋆ π n+1

Fig. 1 .

 1 Fig. 1. Type assignment system SIL.

Fig. 2 .

 2 Fig. 2. The (meta)-rules of the program transformation S

  binders cannot bind variables in quoted terms. Then, without reduction of let-binders, boxed terms are unchangeable. So, (Λ R ,

	As a consequence,

λ →) is confluent because it is like pure λ-calculus with constants. Property 2 If t let → t ′ and t let → t ′′ then there is an term s such that t ′ let → s and t ′′ let → s. As a result, (Λ R , let →) is confluent Proof. Assume that t contains two let-redexes R and S. Suppose that R is let x = s in s ′ and that we reduce R. There is only one residual of S with respect to R. Indeed, assume that S is a sub-term of R. S can not be a sub-term of s . So S is necessarily a sub-term of s ′ and so S is not duplicated. The other cases are similar. Since there is no duplication of residuals of S with respect to R, we can indifferently reduce R and S, or the inversely reduce S and R. Property 3 Reduction rules λ → and let → commute. That is if t λ → * t ′ and t let → * t ′′ , there is t ′ such that t ′ let → * s and t ′′ λ → * s. Proof. The reduction of a let-redex does not duplicate (unquoted) λ-redexes. Inversely, the reduction of a λ-redex may create several copies of a let-redex. Therefore, if t λ → t ′ and t let → t ′′ , then it exists s such that t ′ * let → s and t ′′ λ → s. λ → and let → commute.

  • • • t n .[] of closed expressions or of couples (x, t) where FV(t) ⊂ {x}, that ends with the bottom of the stack []. Expressions k π are continuations. They are constants indexed by stacks.

The control operator is dubbed E to recall Kleene's enumerator E which satisfies E(#M ) = M where #M is an encoding of M . See Barendregt's book p.167