Alexandre Sablayrolles
email: dre.sablayrolles@gmail.com>.

Matthijs Douze

Cordelia Schmid

Hervé Jégou

Radioactive Data: Tracing Through Training

Data tracing determines whether particular data samples have been used to train a model. We propose a new technique, radioactive data, that makes imperceptible changes to these samples such that any model trained on them will bear an identifiable mark. Given a trained model, our technique detects the use of radioactive data and provides a level of confidence (p-value). Experiments on large-scale benchmarks (Imagenet), with standard architectures (Resnet-18, VGG-16, Densenet-121) and training procedures, show that we detect radioactive data with high confidence (p <0.0001) when only 1% of the data used to train a model is radioactive. Our radioactive mark is resilient to strong data augmentations and variations of the model architecture. As a result, it offers a much higher signal-to-noise ratio than data poisoning and backdoor methods.

Introduction

The availability of large-scale public datasets has fuelled the development of machine learning. The Imagenet collection [START_REF] Deng | Imagenet: A large-scale hierarchical image database[END_REF] and challenge [START_REF] Russakovsky | Imagenet large scale visual recognition challenge[END_REF] contributed to the success of deep learning architectures [START_REF] Krizhevsky | Imagenet classification with deep convolutional neural networks[END_REF]. The annotation of precise instance segmentations on the large-scale COCO dataset [START_REF] Lin | Microsoft coco: Common objects in context[END_REF] enabled large improvements of object detectors and instance segmentation models [START_REF] He | Mask r-cnn[END_REF].

Machine learning and deep learning models are trained to solve specific tasks (e.g. classification, segmentation), but as a side-effect reproduce the bias in training datasets [START_REF] Torralba | Unbiased look at dataset bias[END_REF]. Such a bias is a weak signal that a particular dataset has been used to solve a task. Our objective in this paper is to enable the traceability of datasets. By introducing a specific mark in a dataset, we want to provide a strong signal that this dataset was used to train a model. We thus slightly change the dataset, effectively substituting the data for similar-looking marked data (radioactive isotopes).

Let us assume that this image data, as well as other collected data, is used by a third party to train a convolutional neural network (convnet). After training, the model is inspected. The convnet is accessed either (1) explicitly when the model and corresponding weights are available (whitebox setting), or (2) implicitly if only the decision scores are accessible (black-box setting). From that information, we assess whether the training set contained any radioactive data, or none. We want to provide a statistical guarantee with the answer, in the form of a p-value.

Passive techniques to infer set membership [START_REF] Shokri | Membership inference attacks against machine learning models[END_REF][START_REF] Sablayrolles | White-box vs black-box: Bayes optimal strategies for membership inference[END_REF] require to know the trained architecture, as well as held-out data following the same distribution as that of the training set. Different membership inference methods can improve detection of data usage, but they do not increase the effect that data has on a model and they have overall a low confidence.

For this reason, we focus on active techniques, where we apply visually imperceptible changes to the images. We consider the following three criteria: (1) The change should be tiny, as measured by an image quality metric like PSNR (peak signal to noise ratio);

(2) The technique should be neutral with respect to the end-task, i.e., the accuracy of the model trained with the marked dataset should not be significantly impacted;

(3) The method should not be detectable by a visual analysis of failure cases and should be immune to a re-annotation of the dataset. This disqualifies techniques using incorrect labels as a mark: they are detected by a simple analysis of the failure cases. Similarly the "backdoor" techniques are easy to identify and circumvent with outlier detection [START_REF] Tran | Spectral signatures in backdoor attacks[END_REF].

At this point, one may draw the analogy between this problem and watermarking [START_REF] Cox | Digital watermarking[END_REF], that aims at imprinting a mark into an image such that it can be re-identified with high probability. We point out that traditional imagebased watermarking is ineffective in our context: the learning procedure ignores the watermarks if the information they provide is not useful to classify the image [START_REF] Tishby | The information bottleneck method[END_REF]. We need to force the network to keep the mark through the learning process, whatever the learning procedure or architecture.

To that goal, we propose radioactive data. As illustrated in Figure 1 and similarly to radioactive markers in medical applications, we introduce marks that remain through the learning process and that are detectable with high confidence in a neural network. Our idea is to craft a class-specific additive mark in the latent space before the classification layer. This mark is propagated back to the pixels with a marking (pretrained) network.

This paper offers a proof of concept that marking data through training is possible with strong statistical guarantees. The deep learning community has developed a variety of defense mechanisms against "adversarial attacks": these techniques prevent test-time tampering, but are not designed to prevent training-time attacks on neural networks. Note that our radioactive marks, while visually imperceptible, may be detected by a statistical analysis of the latent space of the network. However, the analysis of defense mechanisms lies outside the scope of this paper.

Our experiments on Imagenet confirm that our radioactive marking technique is effective: with nearly invisible changes to the images (PSNR = 42 dB), and when marking only a fraction of the images (q = 1%), we are able to detect the use of our radioactive images with very high confidence.

Our conclusions are supported in various settings: we consider both the black-box and white-box settings; we change the tested architecture such that it differs from the one employed to insert the mark. We also depart from the common restrictions of many data-poisoning works [START_REF] Shafahi | Poison frogs! targeted clean-label poisoning attacks on neural networks[END_REF][START_REF] Biggio | Poisoning attacks against support vector machines[END_REF], where only the logistic layer is retrained, and which consider small datasets (CIFAR) and/or limited data augmentation. We verify that the radioactive mark holds when the network is trained from scratch on a radioactive Imagenet dataset with standard data augmentations. As an example, for a ResNet-18 trained from scratch, we obtain a p-value of 10 -4 when 1% of the training data is radioactive, with no noticeable change of the network accuracy (±0.1%).

The paper is organized as follows. Section 2 reviews the related literature, notably watermarking, and explains how the problem we tackle relates to data poisoning. In Section 3, after introducing a few mathematical notions, we describe how we add markers, and discuss the detection methods in both the white-box and black-box settings. Section 4 provides an analysis of the latent space learned with our procedure and compares it to the original one. We present qualitative and quantitative results in different settings in the experimental section 5. We conclude the paper in Section 6.

Related work

Watermarking is a way of tracking media content by adding a mark to it. In its simplest form, a watermark is an addition in the pixel space of an image, that is not visually perceptible. Zero-bit watermarking techniques [START_REF] Cayre | Watermarking security: theory and practice[END_REF] modify the pixels of an image so that its Fourier transform lies in the cone generated by an arbitrary random direction, the "carrier". When the same image or a slightly perturbed version of it are encountered, the presence of the watermark is assessed by verifying whether the Fourier representation lies in this cone. Zero-bit watermarking detects whether an image is marked or not; in general, watermarking also considers the case where the marks carry a number of bits of information [START_REF] Cox | Digital watermarking[END_REF].

Traditional watermarking is notoriously not robust to geometrical attacks [START_REF] Vukotić | Are deep neural networks good for blind image watermarking[END_REF]. In contrast, the latent space associated with deep networks is almost invariant to such transformations, due to the train-time data augmentations. This observation has motivated several authors to employ convnets to watermark images [START_REF] Vukotić | Are deep neural networks good for blind image watermarking[END_REF][START_REF] Zhu | Hidden: Hiding data with deep networks[END_REF] by inserting marks in this latent space. HiD-DeN [START_REF] Zhu | Hidden: Hiding data with deep networks[END_REF] is an example of these approaches, applied either for steganographic or watermarking purposes.

Adversarial examples. Neural networks have been shown to be vulnerable to adversarial examples [START_REF] Szegedy | Intriguing properties of neural networks[END_REF][START_REF] Goodfellow | Explaining and harnessing adversarial examples[END_REF][START_REF] Carlini | Towards evaluating the robustness of neural networks[END_REF]: given a correctly-classified image x and a trained network, it is possible to craft a perturbed version x that is visually indistinguishable from x, such that the network misclassifies x.

Privacy and membership inference. Differential privacy [START_REF] Dwork | Calibrating noise to sensitivity in private data analysis[END_REF] protects the privacy of training data by bounding the impact that an element of the training set has on a trained model. The privacy budget > 0 limits the impact that the substitution of one training example can have on the log-likelihood of the estimated parameter vector. It has become the standard for privacy in the industry: the privacy budget trades off between the accuracy of learned statistics and how well the presence of individual records is the training set is hidden.

Recent work [START_REF] Abadi | Deep learning with differential privacy[END_REF][START_REF] Papernot | Scalable private learning with pate[END_REF] has shown that it is possible to learn deep models with differential privacy on small datasets (MNIST, SVHN) with a budget as small as = 1. Individual privacy degrades gracefully to group privacy: when testing for the joint presence of a group of k samples in the training set of a model, an -private algorithm provides guarantees of k .

Membership inference [START_REF] Shokri | Membership inference attacks against machine learning models[END_REF][START_REF] Carlini | The secret sharer: Measuring unintended neural network memorization & extracting secrets[END_REF][START_REF] Sablayrolles | White-box vs black-box: Bayes optimal strategies for membership inference[END_REF] is the reciprocal operation of differentially private learning. It predicts from a trained model and a sample, whether the sample was part of the model's training set. Getting statistical guarantees from membership inference methods requires access to a pool of data following the same distribution as the training data: this is often referred to as a public/private split [START_REF] Shokri | Membership inference attacks against machine learning models[END_REF]. Furthermore, some of these techniques require training multiple models to simulate datasets with and without an image, which is computationally intensive.

Data poisoning [START_REF] Biggio | Poisoning attacks against support vector machines[END_REF][START_REF] Steinhardt | Certified defenses for data poisoning attacks[END_REF][START_REF] Shafahi | Poison frogs! targeted clean-label poisoning attacks on neural networks[END_REF] studies how modifying training data points affects a model's behavior at inference time.

Backdoor attacks [START_REF] Chen | Targeted backdoor attacks on deep learning systems using data poisoning[END_REF][START_REF] Gu | Evaluating backdooring attacks on deep neural networks[END_REF] are a recent trend in machine learning attacks. They choose a class c, and add unrelated samples from other classes to this class c, along with an overlayed "trigger" pattern; at test time, any sample having the same trigger will be classified in this class c. Backdoor techniques bear similarity with our radioactive tracers, in particular their trigger is close to our carrier. However, our method differs in two main aspects. First we do "clean-label" attacks, i.e., we perturb training points without changing their labels. Second, we provide statistical guarantees in the form of a p-value.

Watermarking deep learning models. A few works [START_REF] Adi | Turning your weakness into a strength: Watermarking deep neural networks by backdooring[END_REF][START_REF] Yeom | Privacy risk in machine learning: Analyzing the connection to overfitting[END_REF] focus on watermarking deep learning models: these works modify the parameters of a neural network so that any downstream use of the network can be verified. Our assumption is different: in our case, we control the training data, but the training process is not controlled.

Our method

In this section, we describe our method for marking data. It follows three stages: in the marking stage we add a radioactive mark to the vanilla training images, without changing their labels. The training stage, performed by someone else, uses vanilla and/or marked images to train a multi-class classifier using regular learning algorithms. Finally, in the detection stage, we examine the model to determine whether marked data was used or not.

Threat model. The variations of our radioactive technique correspond to different threat models, that we explicit here. In the marking stage, we assume that we either (A) know the rest of the training set that is used with our radioactive data or (B) do not know what other samples are in the training set. In the detection stage, we assume to have either (1) white-box access or (2) black-box access to the model. The combination of these independent threat models leads to four different cases (A1, A2, B1, B2). Note that the assumption of Threat A (resp. Threat 1) is stronger than that of Threat B (resp. Threat 2).

We denote by x an image, i.e. a 3 dimensional tensor with dimensions height, width and color channel. We consider a classifier with C classes composed of a feature extraction function φ : x → φ(x) ∈ R d (a convolutional neural network) followed by a linear classifier with weights

(w i ) i=1..C ∈ R d . It classifies a given image x as argmax i=1...C w i φ(x).
(1)

Statistical preliminaries

p-value. Statistical hypothesis testing distinguishes two hypotheses, H 0 and H 1 . The null hypothesis H 0 is that the phenomenon did not occur: in our case, hypothesis H 0 is that the training set is not radioactive. We compute the p-value, which is the probability that we observe our results by chance. Under the null hypothesis H 0 , the p-value is uniformly distributed in [0, 1]. The p-value corresponds to the false positive rates: if we accept results with a p-value equal to 5%, it means that once every 20 experiments we will accept results that are in fact due to random chance.

Cosine similarity with a random unitary vector u. Given a fixed vector v and a random vector u distributed uniformly over the unit sphere in dimension d ( u 2 = 1), we are interested in the distribution of their cosine similarity c(u, v) = u T v/( u 2 v 2 ). A classic result from statistics [START_REF] Iscen | Memory vectors for similarity search in high-dimensional spaces[END_REF] shows that this cosine similarity follows an incomplete beta distribution with parameters a = d-1 2 and b = 1 2 . Precisely, for τ ≥ 0 :

P(c(u, v) ≥ τ ) = 1 2 I 1-τ 2 d -1 2 , 1 2 = B 1-τ 2 d-1 2 , 1 2 2B 1 d-1 2 , 1 ⊥ X O O X X O O X X ⊥ X O O X X O O X X X X X X X ☢ Figure 2
. Illustration of our method. In a high dimensional space, the linear classifier that separates the class is almost orthogonal to u with high probability. Our method shifts points belonging to a class in the direction u, therefore aligning the linear classifier with the direction u.

with

B x d -1 2 , 1 2 = x 0 √ t d-3 √ 1 -t dt (2)
In particular, it has expectation 0 and variance 1/d.

Combination of p-values. Fisher's method [START_REF] Fisher | Statistical methods for research workers[END_REF] enables to combine p-values of multiple tests. We consider statistical tests T 1 , . . . , T k , independent under the null hypothesis H 0 . Under H 0 , the corresponding pvalues p 1 , . . . , p k are distributed uniformly in [0, 1]. Hence -log(p i ) follows an exponential distribution, which corresponds to a χ 2 distribution with two degrees of freedom.

The quantity Z = -2 k i=1 log(p i ) thus follows a χ 2 distribution with 2k degrees of freedom. The combined p-value of tests T 1 , . . . , T k is thus the probability that the random variable Z has a value higher than the threshold we observe.

Additive marks in feature space

We first tackle a simple variant of our problem, where we can mark features instead of images. In the marking stage, we add a random isotropic unit vector αu ∈ R d with u 2 = 1 to the features φ(x) of all training images x of one class. This direction u is our carrier.

If radioactive data is used at training time, the linear classifier w of the class is updated with weighted sums of φ(x) + αu, where α is the strength of the mark. The linear classifier w is thus likely to have a positive dot product with the direction u, as shown in Figure 2.

At detection time, we examine the linear classifier w to determine if it was trained on radioactive or vanilla data. We test the statistical hypothesis H 1 : "w was trained using radioactive data" against the null hypothesis H 0 : "w was trained using vanilla data". Under the null hypothesis H 0 , u is a random vector independent of w. Their cosine similarity c(u, w) follows the beta-incomplete distribution with parameters a = d-1

2 and b = 1 2 (see Section 3.1). Under hypothesis H 1 , the classifier vector w is more aligned with the direction u so and c(u, w) is likely to be higher.

Thus if we observe a high value of c(u, w), its corresponding p-value is low, and we can conclude with high significance that radioactive data has been used.

Multi-class. The extension to C classes follows. In the marking stage we sample i.i.d. random directions (u i ) i=1..C and add each u i to the features of images of class i. At detection time, under the null hypothesis, the cosine similarities c(u i , w i ) are independent (since u i are independent) and we can thus combine the p values for each class using Fisher's combined probability test (Section 3.1) to obtain the p-value for the whole dataset.

Image-space perturbations

We now assume that we have a fixed known feature extractor φ. At marking time, we wish to modify pixels of image x such that the features φ(x) move in the direction u. We can achieve this by propagating gradients back to the image space. This setup is very similar to adversarial examples [START_REF] Goodfellow | Explaining and harnessing adversarial examples[END_REF][START_REF] Szegedy | Intriguing properties of neural networks[END_REF]. More precisely, we optimize over the pixel space by running the following optimization program:

min x, x-x ∞ ≤R L(x), (3)
where the radius R is the maximum L ∞ distance between the original image x and its modified version x. The loss is a combination of three terms:

L(x) = -(φ(x) -φ(x)) u + λ1 x -x 2 + λ2 φ(x) -φ(x) 2. ( 4
)
The first term encourages the features to align with u, the two other terms penalize the L 2 distance in both pixel and feature space. In practice, we optimize this objective by running SGD with a constant learning rate in the pixel space, projecting back into the L ∞ ball at each step and rounding to integral pixel values every T = 10 iterations.

This procedure is a generalization of classical watermarking in the Fourier space. In that case the "feature extractor" is invertible via the inverse Fourier transform, so the marking does not need to be iterative. Our procedure is similar to that used by [START_REF] Vukotić | Are deep neural networks good for blind image watermarking[END_REF].

Data augmentation.

The training stage most likely involves data augmentation, so we take it into account at marking time. Given an augmentation parameter s, the input to the neural network is not the image x but its transformed version F (s, x). In practice, the data augmentations used are crop and/or resize transformations, so s are the coordinates of the center and/or size of the cropped images. These augmentations are differentiable with respect to the input pixels, so we can backpropagate through them. Thus, we take augmentations into account by minimizing:

min x, x-x ∞≤R E s [L(F (x, s))] .
(5)

Figure 3 shows examples of radioactive images and their vanilla version. We can see that the radioactive mark is not visible to the naked eye, except when we amplify it for visualization purposes (last row).

White-box test with subspace alignment

We now tackle the more difficult case where the training stage includes the feature extractor. In the marking stage we use feature extractor φ 0 to generate radioactive data. At training time, a new feature extractor φ t is trained together with the classification matrix W = [w 1 , .., w C ] T ∈ R C×d . Since φ t is trained from scratch, there is no reason that the output spaces of φ 0 and φ t would correspond to each other.

In particular, neural networks are invariant to channel-wise permutations and rescaling.

To address this problem at detection time, we align the subspaces of the feature extractors. We find a linear mapping M ∈ R d×d such that φ t (x) ≈ M φ 0 (x). The linear mapping is estimated by L 2 regression:

min M E x [ φ t (x) -M φ 0 (x) 2 2 ]. (6)
In practice, we use vanilla images of a held-out set (the validation set) to estimate M .

The classifier we manipulate at detection time is thus W φ t (x) ≈ W M φ 0 (x). The lines of W M form classification vectors aligned with the output space of φ 0 , and we can compare these vectors to u i in cosine similarity. Under the null hypothesis, u i are random vectors independent of φ 0 , φ t , W and M and thus the cosine similarity is still given by the beta incomplete function, and we can apply the techniques of the subsection 3.2.

Black-box test

In the case where we do not have access to the weights of the neural network, we can still assess whether the model has seen radioactive images by analyzing its loss (W φ t (x), y).

If the loss of the model is lower on marked images than on vanilla images, it indicates that the model was trained on radioactive images. If we have unlimited access to a black-box model, it is possible to train a student model that mimicks the outputs of the black-box model. In that case, we can map back the problem to an analysis of the white-box student model. . Decomposition of learned classifiers into three parts: the "semantic direction" (y-axis), the carrier direction (x-axis) and noise (represented by 1 -x 2 -y 2 , i.e. the squared distance between a point and the unit circle). The semantic and carrier direction are 1-D subspaces, while the noise corresponds to the complementary (high-dim) subspace. Colors represent the percentage of radioactive data in the training set, from q = 1% (dark blue) to q = 50% (yellow). Even when q = 50% of the data is radioactive, the learned classifier is still aligned with its semantic direction with a cosine similarity of 0.6. Each dot represents the classifier for a given class. Note that the semantic and the carrier directions are not exactly orthogonal but their cosine similarity is very small (in the order of 0.04 on average).

Analysis of the feature space

In this section, we analyze how the classifier w learned on a radioactive dataset is related to a classifier w * learned on unmarked images, and the direction of the carrier. For the sake of analysis, we take the simplest case where the mark is added in the feature space just before the classification layer, and we assume that only the logistic regression has been re-trained. For a given class, we analyze how the classifier learned with a mark is explained by: 1. The "semantic" space, that is the classifier learned by a vanilla classifier. This is a 1-dimensional subspace identified by a vector w * ;

2. The carrier direction, favored by the insertion of our class-specific mark. We denote it by u.

3. The noise space F, which is in direct sum with the span of vectors w * and u of the previous space. This space results from the randomness of the initialization and of optimization (SGD and data augmentations).

The rationale of performing this decomposition is to quantify, w.r.t. the norm of the vector, what is the dominant subspace depending on the fraction of marked data.

This decomposition is analyzed in Figure 4, where we make two important observations. First, the 2-dimensional subspace contains most of the energy of the new vector, i.e. the (3) the noise space. Logistic regression with: q = 2% (Left) or q = 20% (Right) of the images marked.

norm of the vector projected onto that subspace is close to 1 (given by the unit circle). Second, the contribution of the semantic vector is significant and still dominant compared to the mark, even when most of the dataset is marked. This property explains why our procedure has a limited impact on the accuracy.

Figure 5 is an alternative visualization: it shows the histograms of cosine similarities between the classifiers and random directions, the carrier and the semantic direction.

The classifiers are more aligned with the carrier when q = 20% of the data is marked, a bit less with q = 2%.

Experiments

Image classification setup

We employ the widely-used benchmarks Imagenet [START_REF] Deng | Imagenet: A large-scale hierarchical image database[END_REF], a dataset of natural images with 1.2M images belonging to 1,000 classes and Places205 [START_REF] Zhou | Learning deep features for scene recognition using places database[END_REF], a dataset of 2.4M images from 205 scene categories. We first consider the Resnet-18 and Resnet-50 models [START_REF] He | Deep residual learning for image recognition[END_REF]. We train with SGD with a momentum of 0.9 and a weight decay of 10 -4 for 90 epochs, using a batch size of 2048 across 8 GPUs.

We use Pytorch [START_REF] Paszke | Automatic differentiation in pytorch[END_REF] and adopt its standard data augmentation settings (random crop resized to 224 × 224). We use the waterfall schedule for the learning rate: it starts at 0.8 and is divided by 10 every 30 epochs [START_REF] Goyal | large minibatch sgd: Training imagenet in 1 hour[END_REF]. On a vanilla Imagenet, we obtain a top 1 accuracy of 69.6% and a top-5 accuracy of 89.1% with our Resnet-18. Varying the random initialization and the order of elements seen during SGD, the top-1 accuracy varies by 0.1% from one experiment to the other.

Experimental setup and metrics

We modify Imagenet images by inserting our radioactive mark, and retrain models on this radioactive data. We then analyze these "contaminated" models and report several measures of performance. On the images, we report the PSNR, i.e., the pertubation magnitude necessary to add the radioactive mark. On the model, we report the p-value that measures how confident we are that radioactive data was used to train the model, as well as the accuracy of this model on vanilla (held-out) data. We only mark a fraction q of the data, with q ∈ {0.01, 0.02, 0.05, 0.1, 0.2}. Radioactive data are generated by running SGD by optimizing Equation ( 5) with R = 10, λ 1 = 0.0005 and λ 2 = 0.01. These parameters where chosen such that the average PSNR of radioactive images is 42dB.

Sanity check. We ran our radioactive detector on pretrained models of the Pytorch zoo and found p-values of 15% for Resnet-18 and 51% for Resnet-50, which is reasonable: in the absence of radioactive data, these values should be uniformly distributed between 0 and 1. We also ran experiments using the backdoor setup of [START_REF] Chen | Targeted backdoor attacks on deep learning systems using data poisoning[END_REF]; these experiments show the limitation of the backdoor technique in two aspects: (1) it requires a much higher perturbation of the images to show an effect (PSNR < 30dB) and (2) it is impossible to provide a level of confidence that a particular marked dataset was used (cf. Appendix C for details).

Baselines. We compare our method to two baselines. The first baseline is individual watermarking of all images of the dataset. When all the training set is marked, we are able to detect this watermark in the trained classifier with a p-value of 10 -3 : while this is a statistically significant result, it requires marking all elements of the dataset. We also compare to the state-of-the-art membership method of [START_REF] Sablayrolles | White-box vs black-box: Bayes optimal strategies for membership inference[END_REF]: we perform membership inference using a threshold attack on a Resnet-18. The attack predicts (correctly) "1" for training elements in about 70% of the cases, and predicts "1" for held-out samples in about 38% of the cases. Note that this baseline assumes that we know the 50, 000 elements of the validation set that follow the same distribution as that of the training set, and are known to not have been used for training. Even in this favorable case, our radioactive technique outperforms the baseline, as can be seen in Table 2. A1). We are able to identify models trained from scratch on only q = 1% of radioactive data. The presence of radioactive data has a low impact on the accuracy of a learned model as long as the fraction of radioactive data is under 10%. Radioactive data outperforms the passive baseline by a significant margin.

Results

Same architecture. Table 1 reports the results of a Resnet-18 model with fixed features trained on Imagenet. We are able to detect that the model was trained on radioactive data with a very high confidence for both center crop and random crop. The model overfits more on the center crop, hence it learns more the radioactive mark, which is why the p-value is lower on center crop images. Conversely on random crops, marking data has less impact on the model accuracy (-0.24 as opposed to -0.48 for q = 1% marked data).

Training from scratch. Table 2 shows the results of retraining a Resnet-18 from scratch on radioactive data. This setup is more challenging (Section 3.4). However, our watermark is detected reliably when only q = 1% of the training data is marked. Table 2 shows two interesting results: first, the gap in accuracy is less important than when retraining only the logistic regression layer, in particular using 1% of radioactive data does not impact accuracy (-0.1%); second, data augmentation is helping the radioactive process.

Black-box results. We measure the difference between the loss on vanilla samples and the loss on radioactive samples: when this gap is positive, it means that the model fares better on radioactive images, and thus that it has been trained on the radioactive data. We can detect the use of radioactive data when a fraction of q = 20% or more of the training set is radioactive. When a smaller portion of the data is radioactive, the model performs better on vanilla data than on radioactive data and thus it is difficult to precisely assess the use of radioactive data. Also there is no rigorous hypothesis testing for this use case. Detailed results are provided in Appendix B.

Distillation. Given only black-box access to a model (assuming access to the full softmax), we can perform distillation [START_REF] Hinton | Distilling the knowledge in a neural network[END_REF], and test the distilled model for % radioactive 1 2 5 10 20 Table 3. p-value (statistical significance) for radioactivity detection. Results for different architectures trained from scratch on Imagenet (Threat A1). Even though radioactive data was crafted using a Resnet-18, models of other architectures also become radioactive when trained on this data.

Resnet

radioactivity. In this setup, it is possible to detect the use of radioactive data on the distilled model, with a slightly lower performance compared to white-box access to the model (this corresponds to Threat A2). We give detailed results in Appendix A.

Ablation analysis

Architecture transfer. We ran experiments on different architectures with the same training procedure: Resnet-50, VGG-16 and Densenet121. The results are shown in Table 3: the values and trend are similar to what we obtain with Resnet-18 (Table 2). Although there is no reason that the feature space of a VGG-16 would behave in the same way as that of a Resnet-18, after alignment, we detect the presence of our radioactive mark with high statistical significance.

Transfer to other datasets. We conducted experiments on a slightly different setup: we mark images from the dataset Places205, but use a network pretrained on Imagenet for the marking phase. The purpose of these experiments is to show that even if the marking network is fit for a different distribution, the marking still works and we are able to detect it (it corresponds to Threat B1). Results are shown in Table 4. We can see that when a fraction q higher than 10% of the training data is marked, we can detect radioactivity with a strong statistical significance (p < 10 -3 ).

Correlation with class difficulty. The radioactive carriers added to features are correlated with the class label, so we expect the learning to rely more on this mark when the class accuracy is low. To validate this hypothesis, we compute the Spearman correlation between the per-class accuracy and the cosine similarity between the classifier and the carrier: this correlation is negative, with a p-value of 4 × 10 -5 . This confirms that the network relies more on the mark for difficult classes.

% radioactive 10 20 50 100 log 10 (p) -3.30 -8.14 -11.57 <-150 Table 4. p-value of radioactivity detection. A Resnet-18 is trained on Places205 from scratch, and a percentage of the dataset is radioactive (Threat B1). When 10% of the data or more is radioactive, we are able to detect radioactivity with a strong confidence (p < 10 -3 ).

Discussion

We observe that our technique, designed for the feature space, applies in practice with progressively relaxed hypotheses: (1) with pixel-space marks that reproduce the mark imperfectly, (2) transferring to another feature extractor and even between different architectures, (3) model distillation and (4) when transferring to a different dataset.

In each of these steps, there is some loss of detection accuracy (p-value) but the detection is still remarkably reliable. These observations suggest that our radioactive method is appropriate for real use cases.

Limitation in an adversarial scenario. We assume that at training time, radioactive and vanilla data are ingested in the same way. However, a subspace analysis could reveal the marking direction. This adversarial scenario is akin to that considered in the watermarking literature, where strategies have been developed to reduce the detectability of the carrier. Our current proposal is therefore restricted to the proof of concept that we can mark a model through training that is only resilient to blind attacks such as architectural or training changes. We hope that follow-up works will address a more challenging scenario under Kerckhoffs assumptions (Kerckhoffs, 1883).

Conclusion

The method proposed in this paper, radioactive data, is a way to verify if some data was used to train a model, with statistical guarantees. Our paper shows that such radioactive contamination is effective on large-scale computer vision tasks such as classification on Imagenet with modern architecture (Resnet-18 and Resnet-50, DenseNet, VGG), even when only a very small fraction (1%) of the training data is radioactive. Although it is not the core topic of our paper, our method incidentally offers a way to watermark images in the classical sense [START_REF] Cayre | Watermarking security: theory and practice[END_REF].

Figure 1 .

 1 Figure1. Illustration of our approach: we want to determine through a statistical test (p-value) whether a network has seen a marked dataset or not. The distribution (shown on the histograms) of a statistic on the network weights is clearly separated between the vanilla and radioactive CNNs. Our method works in the cases of both white-box and black-box access to the network.

Figure 3 .

 3 Figure 3. Radioactive images from Holidays[START_REF] Jégou | Hamming embedding and weak geometric consistency for large scale image search[END_REF] with random crop and PSNR= 42dB. First row: original image. Second row: image with a radioactive mark. Third row: mark amplified with a ×5 factor. Fourth row: We exaggerate the mark by a factor ×5, which means a 14dB amplification of the additive noise, down to PSNR= 28dB so that the modification becomes visible.

  Figure4. Decomposition of learned classifiers into three parts: the "semantic direction" (y-axis), the carrier direction (x-axis) and noise (represented by 1 -x 2 -y 2 , i.e. the squared distance between a point and the unit circle). The semantic and carrier direction are 1-D subspaces, while the noise corresponds to the complementary (high-dim) subspace. Colors represent the percentage of radioactive data in the training set, from q = 1% (dark blue) to q = 50% (yellow). Even when q = 50% of the data is radioactive, the learned classifier is still aligned with its semantic direction with a cosine similarity of 0.6. Each dot represents the classifier for a given class. Note that the semantic and the carrier directions are not exactly orthogonal but their cosine similarity is very small (in the order of 0.04 on average).

Figure 5 .

 5 Figure5. Analysis of how classification directions re-learned with a logistic regression on marked images can be decomposed between (1) the original subspace; (2) the mark subspace; (3) the noise space. Logistic regression with: q = 2% (Left) or q = 20% (Right) of the images marked.

Table 1 .

 1 p-value (statistical significance) of radioactivity detection. We train a logistic regression classifier on Imagenet with Resnet-18 features, and only a percentage of the training set is radioactive. Our method can identify with a very high confidence (log 10 (p) < -38) that the classifier is trained on radioactive data, even when only 1% of the training data is radioactive.

			% radioactive	1	2	5	10
	Center	Crop	log 10 (p) <-150 <-150 <-150 <-150 ∆acc -0.48 -0.86 -1.07 -1.33
	Random	Crop	log 10 (p) -38.0 -138.2 <-150 <-150 ∆acc -0.24 -0.31 -0.55 -0.99

Acknowledgements. The authors would like to thank Laurens van der Maaten, Tom Goldstein and Laurent Meunier for their feedback on earlier versions of this paper. This work was supported by the French government under management of Agence Nationale de la Recherche as part of the "Investissements d'avenir" program, reference

A. Distillation

% radioactive 1 2 5 10 20 log 10 (p) -1. 58 -3.07 -13.60 -34.22 -137.42 Table 5. p-value for the detection of radioactive data usage. A Resnet-18 is trained on Imagenet from scratch, and a percentage of the training data is radioactive. This marked network is distilled into another network, on which we test radioactivity. When 2% of the data or more is radioactive, we are able to detect the use of this data with a strong confidence (p < 10 -3 ).

Given a marked Resnet-18 on which we only have blackbox access, we use distillation [START_REF] Hinton | Distilling the knowledge in a neural network[END_REF] to train a second network. On this distilled network, we perform the radioactivity test. We show in Table 5 the results of this radioactivity test on distilled networks. We can see that when 2% or more of the original training data is radioactive, the radioactivity propagates through distillation with statistical significance (p < 10 -3 ).

B. Black-box results.

We report in Figure 6 the results of our black-box detection test. We measure the difference between the loss on vanilla samples and the loss on radioactive samples: when this gap is positive, it means that the model fares better on radioactive images, and thus that it has been trained on the radioactive data. We can see that the use of radioactive data can be detected when a fraction of q = 20% or more of the training set is radioactive. When a smaller portion of the data is radioactive, the model fares better on vanilla data than on radioactive data and thus it is difficult to tell. The gap between the loss on radioactive and vanilla samples is around 0 when q = 20% of the data are contaminated.

C. Experiments with backdoors

We experimented with the backdoor technique of [START_REF] Chen | Targeted backdoor attacks on deep learning systems using data poisoning[END_REF] in the context of our marking problem. In general, the backdoor technique adds unrelated images to a class, plus a "trigger" that is consistent across these added images. In their work, [START_REF] Chen | Targeted backdoor attacks on deep learning systems using data poisoning[END_REF] need to poison approximately 10% of the data in a class to activate their trigger. We adapted their technique to the "clean-label" setup on Imagenet: we blend a trigger (a Gaussian pattern) to images of a class. We observed that it is possible to detect this trigger at train time, albeit with a low image quality (PSNR < 30dB) that is visually perceptible. In this case, the model is more confident on images that have the trigger than on vanilla images in about 90% of the cases. However, we also observed that any Gaussian noise activates the trigger: hence we have no guarantee that images with our particular mark were used.


Alexandre Braconnier
email: alexandre.braconnier@cnrs-orleans.fr

Christian Chauveau
email: christian.chauveau@cnrs-orleans.fr

Fabien Halter
email: fabien.halter@cnrs-orleans.fr

Stany Gallier
email: stany.gallier@ariane.group

Detailed analysis of combustion process of a single aluminum particle in air using an improved experimental approach

Keywords: Solid propellant, Metal combustion, Aluminum, Burning time

The current experimental study aims at analyzing the self-sustained combustion of 30-120 µm Al particles using an electrostatic levitation system. In this improved set-up, a single particle is isolated in air with different ambient pressure (1-31 bar) to be then ignited by a CO2 laser beam. The integrated optical signature of burning Al particle is recorded using filtered photomultipliers and a high-speed camera. The photomultiplier is used to estimate burning time while the camera direct visualization allows to measure the evolution of combustion parameters in real time such as droplet diameter (including initial particle diameter) and flame diameter with important resolution. Important information are also provided to accurately describe combustion phenomenology. Measured burning times according to the pressure are compared to experimental correlations issued from literature and similar trends are observed. The existence of different stages during combustion is clearly evidenced and early assumptions can be made to explain dependence between combustion time and identified phenomena.

INTRODUCTION

Metal combustion has an interesting energetic potential and generate elevated combustion temperatures. According to its high energetic density and its wide availability, aluminum micrometric particles are currently used in industrial solid propellants, especially to increase thrust of the solid rocket motors (SRM). However, the combustion of aluminum particles in SRM is a complex process. Particles leave the propellant surface and burn in a specific gaseous environment, under high temperatures and pressures, given by solid propellant combustion. It is also well known that a significant part of initial aluminum particles coalesces into larger agglomerate [START_REF] Price | The fire environment of a solid rocket propellant burning in air[END_REF]. Considering these conditions, combustion dynamics can be directly altered, both for solid propellant and aluminum particles. The study of the aluminum combustion phenomenon has therefore been a continuous research effort, even in more common atmospheres such as air.

Since work proposed by [START_REF] Friedman | Ignition and combustion of aluminium particles in hot ambient gases[END_REF] using a flame plate burner to ignite aluminum particles and collect quantitative and qualitative information on their combustion, several experimental apparatus have been developed to improve the understanding of the aluminum combustion with increasing accuracy. Shock tubes were often used and permit to analyze the combustion of dust aluminum considering interaction effects between burning particles (Servaites et al. 2001) [START_REF] Bazyn | Combustion of nanoaluminum at elevated pressure and temperature behind reflected shock waves[END_REF]) and [START_REF] Lynch | Combustion of 5-μm aluminum particles in high temperature, high pressure, water vapor environments[END_REF]. Combustion of single particles was also studied in case of free-falling droplet, aerodynamic levitators or bulk aluminum samples attached to support, considering convective and conductive effects (Wilson and Williams 1971), [START_REF] Prentice | Aluminum droplet combustion: rates and mechanisms in wet and dry oxidizers, Naval weapons center china lake CA[END_REF], [START_REF] Bucher | Flames structure measurement of single, isolated aluminum particles burning in air[END_REF], (Sarou-Kanian et al. 2003) and [START_REF] Feng | Experimental investigation on the combustion characteristics of aluminum in air[END_REF]). Thus, it is proved that the combustion regime, and therefore the burning time, depends on the initial particle diameter D0. Indeed, for large particles (D0 > 10µm), aluminum burns as a vapor flame in diffusion mode whereas combustion of smaller particles occurs in a kinetic-limited regime [START_REF] Bazyn | Evidence for the transition from the diffusion-limit in aluminum particle combustion[END_REF]. Determination of correlations between burning time and influencing parameters has been an ongoing effort. The assumption of a similar behavior between solid aluminum particles and liquid fuel droplets was established by [START_REF] Glassman | Metal combustion processes[END_REF] and motivated the use of the classical D² law but studies have shown that the phenomenology of the aluminum particle combustion is different from the symmetrical and steady behavior of liquid droplets. [START_REF] Prentice | Aluminum droplet combustion: rates and mechanisms in wet and dry oxidizers, Naval weapons center china lake CA[END_REF] concluded that a nonsteady state must be considered to successfully describe metal droplet burning process and [START_REF] Dreizin | Experimental study of stages in aluminium particle combustion in air[END_REF] identified three distinct stages in aluminum combustion history: spherically symmetric vapor phase, asymmetric regime and extinction. Relying on experiments, [START_REF] Beckstead | A summary of aluminum combustion[END_REF] proposed to consider the effect of the oxidizer efficiency pressure and ambient temperature on the burning time in an improved D n correlation, with 1.5 < n < 1.8.

More recently, [START_REF] Gill | Combustion times and emission profiles of micron-sized aluminum particles burning in different environments[END_REF], [START_REF] Badiola | On Weak Effect of Particle Size on Its Burn Time for Micron-Sized Aluminum Powders[END_REF] and [START_REF] Feng | Experimental investigation on the combustion characteristics of aluminum in air[END_REF] worked on the characterization of the aluminum combustion in various mixtures or pressures.

Focused on small micron sized particles (D0 < 25 µm) or coarser particles (100 < D0 < 300 µm) with different experimental approaches. These investigations highlight that some data on aluminum combustion stay scarce, often inconclusive. Indeed, even if similar trends can be proposed on the evolution of the burning time according to initial droplet diameter, pressure, or chemical composition of the ambient environment, determination of the exponent of the particle diameter according to conditions sometimes stay heterogeneous because of the various authors' experimental approaches and determination of a universal burning time correlation based on fundamental analysis is still required. Moreover, experimental limitations prevent to obtain details, especially in real time and fundamental study of the aluminum combustion process requires elaborated experimental conditions in order to avoid any perturbing aspect like heat transfer by convective effect (in case of free-falling set-up and aerodynamic levitator) or conduction (in case of aluminum sample on support). Thus, research must be extended to have a complete understanding of the aluminum combustion process.

In this work, an improved experimental set-up based on previous works by [START_REF] Marion | Studies on the Ignition and Burning of Levitated Aluminum Particles[END_REF] is proposed. It allows recording the combustion of a single levitated aluminum droplet in a static gaseous environment without any perturbing support. With a high temporal and spatial resolution, this set-up introduces a new method to evaluate the burning time and interaction mechanisms between the aluminum and its oxide. This paper addresses the combustion of levitated aluminum particles, varying pressure (1 to 31 bar) and on a wide representative range of particle size (30 to 120 µm). This study is devoted to providing new and more accurate experimental data, especially on the impact of the pressure using latest imaging technologies.

EXPERIMENTAL SETUP

Isolation and ignition of a single aluminum particle in a controlled ambient environment

Isolation of a single charged particle without any perturbing support is an important issue.

Based on previous theory and design of [START_REF] Davis | Single aerocolloidal particle instrumentation and measurement[END_REF] and [START_REF] Bar-Ziv | The electrodynamic chamber: A tool for studying high temperature kinetics involving liquid and solid particles[END_REF], an electrodynamic levitator was developed, consisted of using the electric force to oppose gravity. The levitator requires three distinct electrodes (top, bottom and central ring), supplied by AC and DC voltage to generate an electromagnetic field and provide the necessary stabilizing effect on the particle (Figure 1).

The central electrode supplied by AC voltage induces a centripetal effect to adjust the horizontal position of the particle. The vertical particle position is fixed by the DC voltage which compensates the gravity effect. In this configuration, this apparatus offers capabilities IJEMCP-27988 5 to suspend a motionless charged particle. Hence, a single burning particle can be observed easily in a static oxidizing atmosphere and combustion is not affected by any additional heat exchanges (convective or conductive).

During the combustion, the particle as well as the combustion products contained in the flame are heated to high temperatures and a thermionic emission can occur, resulting in important charge losses. Charge losses preserve the combustion process of any influence due to electric voltages, which means that the charges are unlikely to affect the combustion and are only used to ensure a fixed and reproducible initial position. Then, even if thermionic emission prevents to maintain the electromagnetic effect on burning particle to control its position, characteristic time of combustion is less than the characteristic free falling time of a heated particle and overall combustion reproducibly takes place in the observation area.

The characterization of dependence between aluminum combustion and ambient conditions in terms of temperature, pressure and composition requires controlling each parameter accurately. The technical solution is a high-pressure chamber (Figure 2) supplied with various gases from external high pressure tanks. This chamber is connected to a digital manometer permitting to control internal pressure at room temperature, ranging from 1 to 120 A focused 50 Watt CO2 laser beam impacts the particle to initiate aluminum combustion. A beam splitter coupled to a set of mirrors is used in order to separate and reflect the laser beam and symmetrically irradiate the particle (Figure 2) while limiting its displacement. Specific Zn-Se lenses are used to ensure a high transmission in the laser beam wavelength (10.6 µm).

Optical setup

Main measurements used to describe the burning process are based on optical diagnostics. Indeed, a first optical setup is composed of two photomultipliers (PM) tubes (Figure 2). In more details, the luminous visible emission of the particle is collected through a lens set before to be split, filtered and integrated to finally obtain amplified optical signature of each combustion test. Typical wavelengths are selected (488 nm and 514 nm) to mainly receive the strong radiation of AlO products which are characteristic of the aluminum burning phase.

A high-speed camera, coupled with a long-distance microscope (Figure 2), is also focused on the single particle to observe it in real time during the combustion process, included ignition.

Videography is recorded with a considerable rate up to 25000 fps and a high resolution (1.7 to 2.5 µm/px), allowing to determine a fine evolution of combustion parameters such as droplet diameter and flame diameter to estimate burning rates and times.

The experimental procedure is elaborated to record and to process optical data of an autonomous combustion. To ensure that no extra energy is provided to the burning particle, the CO2 laser is connected with the photomultipliers signal to trigger the laser beam extinction once the luminous emission from the flame is detected being beyond a fixed threshold. Moreover, photomultipliers and camera recordings are synchronized with the laser beam trigger. An in-house MatLab script has been developed to determine the significant parameters with an automatic data processing and image analysis. This method will be described in the next part.

RESULTS

Measurements and data processing

Initial particle diameter

The initial particle diameter is estimated with an image processing routine based on video sequences of aluminum combustion. Before the heating up due to the energetic laser beam, Figure 2 : Schematic representation of the experimental setup the solid aluminum particle has an irregular shape which does not allow a reliable diameter measurement. The picture to be processed is selected when the particle forms a spherical droplet due to aluminum melting, just before the ignition (Figure 3) to avoid approximations and assumptions. Then, the determination of the initial size of the particle is based on the interpretation of light intensity profile, defining the droplet border as the most marked intensity gradient. Considering emission disparities on the droplet surface, due to a random distribution of brighter zones (possibly aluminum oxide), the gray level is extracted on several measured profiles crossing the droplet, typically on 35 radial profiles. The extremums of their derivatives allow defining representative detection of the droplet surface and its diameter (Figure 3). Thus, the initial diameter can be deducted, being the average of the 35 measured values.

Evolution of real-time particle and flame diameter

High-speed camera video provides an important number of images describing the combustion process with a temporal resolution less than 100 µs. Each picture is then processed from heating phase to extinction to determine parameters relative to the aluminum droplet combustion in real time. The methodology used is similar to that previously presented. The spherical droplet and the diffusion flame can be clearly distinguished (Figure 4 -1). First, a large zone of interest is created, based on the detection of a slightly bright circular structure around the reaction zone with a thresholding method (Figure 4 -1). Then, the flame area can be defined as a thermal limit. Considering this definition and according to the experimental results proposed by [START_REF] Bucher | Detailed studies on the flame structure of aluminum particle combustion[END_REF] and adapted by [START_REF] Glumac | Temperature measurements of aluminum particles burning in carbon dioxide[END_REF], radial temperature decreases when AlO consumption reduces, corresponding to the zone near the maximum Al2O3 mole fraction. Optically, this limit coincides with the brightest border observed in the reaction zone and this criterion will be selected to be a satisfying evaluation of the flame diameter. Thus, using Abel inversion all around the zone of interest, flame size is calculated as being the average distance between maximums of Abel inversion profiles in the reaction zone (Figure 4 Ignition is clearly observed with the high-speed camera, coinciding with the first picture where the diffusion flame takes place around the melted aluminum particle. Extinction corresponds to the end of the combustion process, identified when the intensity of the photomultiplier signal recovers its initial value, without any light emission. Thus, the burning time is defined using synchronized information of the high-speed camera and photomultipliers to estimate time between ignition and extinction, respectively determined with image processing and signal processing (Figure 5).

Burning time definition

Aluminum combustion dynamics and pressure effects

The combustion of aluminum particles in air with varying pressure has been already investigated in different studies [START_REF] Bazyn | Combustion of nanoaluminum at elevated pressure and temperature behind reflected shock waves[END_REF], [START_REF] Lynch | Combustion of 5-μm aluminum particles in high temperature, high pressure, water vapor environments[END_REF]), [START_REF] Marion | Studies on the Ignition and Burning of Levitated Aluminum Particles[END_REF] and [START_REF] Legrand | Ignition and Combustion of Levitated Magnesium and Aluminum Particles in Carbon Dioxide[END_REF]). The theory does not predict the effect of pressure on the combustion time in diffusion regimes but experiments identified a weak effect for low pressure range, influencing melting and vaporization temperatures and potentially combustion dynamics [START_REF] Legrand | Ignition and Combustion of Levitated Magnesium and Aluminum Particles in Carbon Dioxide[END_REF]. The interest of this study is to provide finer qualitative observations of the pressure impact on phenomenology and an accurate data set in a diameter range representative of particle diameters used in SRM.

The understanding of pressure effects in the diffusion regime requires to define clearly the combustion process of aluminum particles under atmospheric pressure in air, considered here as a well-documented reference configuration. As already reported, different combustion phases can be distinctly identified [START_REF] Dreizin | Experimental study of stages in aluminium particle combustion in air[END_REF]. First, after the heating phase and the ignition, a symmetric vapor phase takes place before transiting to an asymmetric vapor phase, leading to the extinction.

The heating phase is characterized by an increasing light emission of the solid particle due to increasing temperature. Aluminum surface is naturally covered with an aluminum oxide layer (aluminum oxide Al2O3). When the melting point of aluminum is reached (~930 K), the solid particle is transformed into a spherical liquid droplet due to the surface tension effect. The temperature increases, the melting point of alumina is then reached (~2300 K) and the protective layer is finally broken and melted, staying on the aluminum droplet and forming typical distinct oxide caps on the droplet surface (Figure 6 -2). The gaseous aluminum can thus react with the oxidizing environment, and the combustion process starts (Figure 6 -2).

Then, a diffusion flame develops around the liquid droplet during the beginning of post ignition phase (Figure 6 -3). The flame initially grows up with the reacting gaseous flow to reach an equilibrium position and become quickly established and totally spherical, corresponding to the maximum of light emission (Figure 6 -4). Thus, the aluminum burns in a symmetric steady vapor phase. The droplet diameter and the flame diameter gradually reduce and the emission signal decreases proportionally to the reduction of the luminous surface (Figure 6 -3 to 6). However, a contour detection by the application of a Laplacian filter allows to observe the alumina lobe expansion. This image processing approximates the second derivative in both directions of the image with a convoluted 5x5 mask. The Laplacian operator is then computed and represented as a gray scale image to allow the contour detection. This method highlights that the oxide cap becomes more spread and grows up on the aluminum droplet surface, progressively creating an increasing area where the gaseous aluminum cannot be released from the droplet surface (Figure 6 -5'to 6'). During the steady phase, the covered surface stay limited and does not alter the flame structure or the steady combustion process.

The transition from the symmetric steady vapor phase to the asymmetric and non-steady vapor phase is induced when the expansion of the liquid oxide on the aluminum droplet surface becomes significant (Figure 67). This transition is identified by a singular intensity peak on the different emission signals. The gaseous aluminum is still produced and a gaseous flow is maintained on the reduced uncovered surface. Thus, the symmetric regime break induces a significant particle motion with relatively high velocity. The droplet displacement during asymmetric phase is characterized by sudden jetting (similar to thrust) and spinning effects. The spatial distribution of the reaction zone is also modified and the formation of several flame shapes occurs. A spherical flame conserved above the uncovered surface and a tapered shape above the oxide lobe (Figure 6 -8'). The liquid oxide is spreading on the surface and can finally cover the whole droplet (Figure 6 -9'). The synchronization between images and signals allows demonstrating that the aluminum reaction with the oxidizer is quickly prevented after this transition. In these conditions, the combustion cannot be sustained and the light emission decreases until the particle extinction. This peculiar dynamic has been only scarcely evidenced or studied and it is a strong interest of our set-up to be capable of observing it with sufficient spatial and temporal resolution.

Works are currently ongoing to study this asymmetric combustion phase in more detail and reveal the underlying physical mechanisms. This will be the purpose of future works.

The modification of pressure does not modify the combustion steps order significantly. The existence of a symmetric vapor phase before the transition to an asymmetric regime is identified both for low and high pressures. However, the temporal distribution of the different steps and the phenomenology can be impacted. Many behaviors are observed by varying pressure (Figure 7).

Mode 1 (low pressure): the combustion process remains similar to the atmospheric case (Figure 6) but the increase in pressure contributes to an earlier asymmetric phase occurrence with a noticeable quantity of unburned aluminum. The light emission during the ignition is also more noticeable.

Mode 2 (intermediate pressure): the symmetric steady phase is significantly longer and the aluminum droplet is progressively consumed. The droplet diameter before transition to asymmetric phase is also relatively smaller due to longer symmetric combustion regime.

During the symmetric regime, the accumulation of liquid oxide in the spherical flame is often observed (Figure 7). Some oxide aggregates may grow up and follow the droplet displacements until their relative size becomes important compared to the aluminum droplet or even significantly bigger. The asymmetric step finally occurs in different ways. Either, as previously mentioned, the liquid oxide cap grows up and spreads on the droplet surface or the oxide aggregate, originally located in the reaction zone, impinges the aluminum droplet, covering instantaneously a major part of its surface. In each case, jetting and spinning effects appear as well as the asymmetric flame shape before extinction. In this mode, unburned aluminum quantity is limited.

Mode 3 (high pressure): another phenomenological aspect takes place in high pressure conditions. The flame is brighter, possibly saturated by dispersed aluminum oxide surrounding the droplet with a relative movement. Some quantities of liquid oxide can impinge the particle surface, perturbing the symmetric phase. The deposition and/or accumulation of oxide on the droplet surface generate the asymmetric transition and the particle is finally totally covered with aluminum oxide, leading to extinction in different ways. Either oxide layer is ejected like in an explosion effect before extinction or the oxide layer cannot be ejected, stays on the droplet surface and prevents the combustion further.

Important quantity of unburned aluminum can be frequently observed.

Pressure effect on combustion parameters

The pressure effects on combustion behavior of aluminum particles have been qualitatively described. The quantification of some parameters such as the combustion time tc and the relative duration of the symmetric phase allow to evaluate the pressure influence.

The determination of combustion time according to the pressure, as well as the initial droplet diameter, was established following the previously detailed methodology. A global overview of the experimental results shows that measurements are in agreement with the correlation proposed by [START_REF] Beckstead | A summary of aluminum combustion[END_REF] (Figure 8) and the observations are in accordance with documented experiments which also predict a low impact of pressure on the burning time. A linear evolution of the combustion time according to the initial square droplet diameter is observed for each pressure range. Thus, a simplified linear correlation between tc and D0 2 is deduced for each pressure condition and used as a correction to estimate the burning time at an identical initial diameter. This measure gives another detailed trend on the burning time dependence with pressure for a given initial diameter (Figure 9). The burning time is IJEMCP-27988 relatively constant with pressure as expected from theory for a diffusion flame. However, a trend for a slight increase in combustion time with high pressures is noticed and diverges from Beckstead's results. This should be confirmed by additional measurements. Beckstead's correlation shows a decrease due to a P -0.1 dependence but his expression results from a global correlation on many experimental data and this may not capture the specificity of each case which is expected to depend on particle size, oxidizers, etc. The accurate information given by high-speed direct visualization allows to temporally characterize the asymmetric phase occurrence and the temporal distribution of the different burning phases is also determined to highlight the pressure impact on the phenomenology of aluminum combustion. The ignition is considered as the temporal origin and tavp will define the onset of the asymmetric regime and, as well, the end of symmetric combustion. The relative value of tavp compared to the combustion time is presented (Figure 10). These results show a potential influence of lower pressure ranges on the symmetric and steady phase duration. In first, steady phase duration reduces with pressures between 1 and 5 bar. Then a singular behavior is identified close to 6 bar, corresponding to the combustion mode 2, where the duration of the symmetric phase significantly increases to represent a large part of the combustion time with a behavior similar to a liquid fuel droplet. Finally, the evolution of tavp is then more constant and the pressure influence is predicted to be less marked for higher ranges where symmetric phase duration stays important in comparison with the combustion time. These data also corroborate the statements previously mentioned on the pressure impact on the combustion phenomenology.

DISCUSSION

According to the experimental observations and measurements, the pressure clearly alters the combustion phenomenology, especially for lower pressures, but does not modify the burning time. Thus, if the different combustion modes are considered to interpret the evolution of tc according to tavp (Figure 9 and Figure 10), the assumption can be made that the combustion time is independent of the respective phases duration.

Various parameters can potentially explain the existence of different combustion behaviors and require further investigations. This is the objective of our ongoing efforts to understand the associated physical mechanisms in further details. In order to understand the temporal occurrence of the asymmetric phase, the accumulation process of alumina oxide on the droplet surface with respect to the pressure has to be understood and quantified. The phase transformations could be considered to have a hypothetical effect (Trunov et al. 2005) as well as the modification of the surface tensions which depend on pressure and temperature.

To explain how the combustion time can stay relatively constant despite the inconstant phase distribution the estimation of the aluminum regression rate during respective phases depending on pressure could be a first representative indicator. Indeed, pressure is predicted to have no effect on the combustion rate in a steady diffusion mode, but, investigations to confirm it and estimate this rate during the non-steady phase could bring important information. Determination of the unburned aluminum quantity is also interesting and can allow to improve the burning time definition which actually considers, in some cases, an important part of remaining aluminum fuel.

CONCLUSION

An advanced experimental set-up was developed to propose an improved approach on aluminum combustion analysis. Indeed, a quick review of the experimental research shows some limitations of the setup already used such as additional heat transfer by conduction or convection and insufficient spatial or temporal resolution. Conversely, this study provides a configuration which allows visualizing the combustion of a single aluminum particle in real time with high spatial and temporal resolution. Without any perturbing effect or support, the direct high-speed visualization of the burning particle gives considerable information on IJEMCP-27988 20 phenomenology. Then, the aluminum burning process can be fundamentally characterized thanks to the determination of various combustion parameters based on image processing.

The results presented the unambiguous existence of symmetric and asymmetric vapor phases with accurate details. The combustion behavior is also modified due to pressure and different modes were identified. A correlation between combustion time, favorably compared with available data, and the relative duration of the symmetric phase, highlights no potential link between these parameters.

Based on this experimental set-up, further investigations are on the way to explain the existence of different combustion modes when pressure increase and quantify the effects on the combustion parameters such like standoff ratio, droplet surface regression and oxide cap expansion. Sarou-Kanian, V., Millot, F., Rifflet, J. C., (2003)

Figure 1 :

 1 Figure 1 : Schematic illustration of electrodynamic levitator

Figure 3 :

 3 Figure 3 : Determination method of the initial droplet diameter for a burning aluminum

  a) excluding high-intensity singularities (like a possible aluminum oxide aggregate in the considered case) by an intermediate thresholding process (Figure 4 -2).

Figure 4 :

 4 Figure 4 : Determination method of the flame and droplet diameter of a burning aluminum

Figure 5 :

 5 Figure 5 : Determination of combustion time based on direct visualization and emission

Figure 6 :

 6 Figure 6 : Characteristic combustion sequence of an aluminum particle in air -P = 1 bar -

Figure 7 :

 7 Figure 7 : Combustion sequences of aluminum particles burning in air with increasing

Figure 8 :

 8 Figure 8 : Aluminum combustion time dependence with pressure and initial droplet

Figure 9 :

 9 Figure 9 : Aluminum combustion time dependence on pressure and comparison with

Figure 10 :

 10 Figure 10 : Effect of pressure on temporal distribution of the symmetric and asymmetric

FIGURESFigure 1 :Figure 2 :Figure 3 :Figure 4 :Figure 5 :Figure 6 :Figure 7 :Figure 8 :Figure 9 :

 123456789 FIGURES

Figure 10 :

 10 Figure 10 : Effect of pressure on temporal distribution of the symmetric and asymmetric

  Surface Tension and Density of Oxygen-Free Liquid Aluminum at High Temperature, Int. J. Thermophys., 24(1), pp. 277-286. Servaites, J., Krier, H., Melcher, J. C.,Burton, R. L., (2001) Ignition and combustion of aluminum particles in shocked H2O/O2/Ar and CO2/O2/Ar mixtures, Combust.

	Flame, 125(1), pp. 1040-1054.
	Trunov, M. A., Schoenitz, M., Zhu, X., Dreizin, E. L., (2005) Effect of polymorphic phase
	transformations in Al2O3 film on oxidation kinetics of aluminum powders, Combust.
	Flame, 140(4), pp. 310-318.
	Wilson, R. P. and Williams, F. A., (1971) Experimental study of the combustion of single
	aluminum particles in O2/Ar, Symposium (International) on Combustion, 13(1), pp.
	833-845.